Thank you all very much. Thank you. Don, you could have taken another question. I was signing an autograph out there. He has to wait till I leave. Well, thank you all very much, and welcome to your home, America's home. It sure looks good to see this old room filled with the sons and daughters of the Grand Old Party. This is a real treat for me today. It is a treat because while you may not know it, you're the ones I think of when ever those jaded voices start telling us what we can't do and why we shouldn't even try. I think you know who I mean.  Seems to me you were saying, don't hold us down. Don't get in our way. America is still an eagle, and she's ready to soar again. And yes, you not only said the American people want to win. The people will win again because we offer a vision of victory. You did all that. Had an important moment in our history, we set forth together to awaken our nation and rally her spirit. We said, let the opposition have their entrenched elites, their power brokers, and let them play their special interest politics. Let them have all that. We just want the people. And we're winning the people, millions of converts to our cause, millions of new Republicans in uniting under bright banners of freedom and opportunity, turning a grand old party into a grand new party, making GOP the great opportunity party for every American. When we ask the people to help out and cut spending and tax rates, bring down inflation and interest rates to index taxes so government can never again profit from inflation at the people's expense, when we won each of those great victories, we did it with the people's help. And all of the people have been helped. When we ask the people to help America meet great new challenges through renewed excellence in education and developing new frontiers in space and technology, we were declaring that the Republican Party does not fear the future, that the Republican Party embraces the future with confidence, a clear vision, and an open heart. And when we say we're the party of opportunity, we mean to draw attention to a modern miracle. Nearly 8 and 1 half million, wait a minute. I can update that figure as of this morning, more than 9 million new jobs in the last 34 months. 378,000 more people went to work last month than had been working. And it is now, if you take the employment pool as defined as everyone male and female from 16 to 65, the highest percentage of that potential pool is employed than has ever been employed in the United States before. Now, more can be done to squeeze this bloated federal establishment, and believe me, more will be done. We're going to bring deficits down, and we're going to bring them down the right way, with greater growth and spending restraint and not higher taxes. We're backing, I was just worried there for a split second. I hope you were with me on that last part. We're backing what I believe can be an historic proposal, the Graham-Rudman Hollings Amendment in the Senate that will lock in spending reductions and lead at long last to a balanced federal budget. And believe me, that's one proposal that is worth fighting for. But this amendment is being held hostage to a wrangling over the debt ceiling, putting the federal government in an emergency situation. The business of our nation must go forward. We need the debt ceiling increased past. Now, I know it's true that we Republicans have swallowed hard, and we have regretted every time we've had to sign an increase in that. But we weren't responsible for the 50 years of deficit spending that was a matter of policy on the part of our opponents that brought this all about. We've now inherited the bomb that we always said was there with a lighted fuse in all of that deficit spending, and we're going to do something about it on a permanent basis. And we need the Graham-Rudman Hollings Amendment passed so we can reach a balanced budget without hurting our senior citizens on social security and without raising taxes. Let's just make one thing very plain. We don't have a deficit problem because the American people are not paying enough in taxes. We have a deficit problem because the federal government is spending too much of the people's money. I hope you didn't tell them this figure because I'm going to tell it anyway again. You know, we've gone through some recent periods here. 1965 until 1980 in the last year before our administration. The great society and the war on poverty, which poverty won, went into effect. It went into effect in the latter part of the 60s and then the 70s. And in those 15 years, the budget multiplied just about five times in 1980 what it was in 1965, 15 years before. But the deficit multiplied 50 times what it had been in 1965, which explains and means that it is built in. It is structural, and that's why we're going to set out to change the structure with this plan that I have just mentioned, which is a five-year plan. Now, I'm appealing for your help on that plan and on another pressing matter, too. We have another historic opportunity to overhaul our tax code, to knock down the barriers to achievement, to make America's future as big and open and bright as your dreams. We can replace an unfair system of 14 tax brackets with a simple three-bracket system of 15, 25, and 35% so that more of what the people earn stays in their pockets, not Uncle Sam's pockets. We can reduce business rates to 15, 18, 25, and 33% and enable our firms to outcompete, outproduce, and outsell anybody anywhere in the world. We can be the American family's most faithful friend by nearly doubling the personal exemption to $2,000 for each dependent, increasing the standard deduction to $4,000 by providing the full benefit of IRAs. Those are the amounts of earnings that could be deducted and put into a savings account and be tax deductible until the time of cashing in. And we want to extend that to both spouses, those working inside the home, as well as those working outside the home. I don't think anyone can ever convince anyone in their right mind that a spouse working within the home is not working. Under our pro-family plan, a family of four won't have to pay a single cent of tax on their first $12,000 of earnings. So really, it's more than a three-bracket system. We've got a fourth bracket, zero. Families in every income group would be better off than today. And I happen to believe that as the family goes, so goes the nation. And those in Washington should put the needs of family budgets ahead of the wants of the federal budget. Passage of our fair share tax plan, as submitted, would increase economic growth by some 3% above our projections, create the equivalent of nearly 4 million more jobs, and provide from $600 to $900 a year in added income for every American household. And more people paying taxes means less red ink. I'm convinced that an historic reform of this magnitude would be the most precious gift that we could give to our children, an America striding with confidence into the sunlight of human progress, leading a world that hungers for liberty, prosperity, and peace. Here in Washington, rumor has it that this tax issue doesn't excite the people's passion. Well, that's not the impression I get out in the crass roots. As a matter of fact, one of my most recent appearances out there was in a town of 14,000 and 20,000 of the 14 had come to the rally. So let me ask you, are you with us? With your strong support in your communities, contacting your representatives and the media, we can forget what the cynics say in pass America's fair share tax plan this year. But even that great step won't be enough to get us where we want to be. We know there are pockets of great pain in America, with casualties lining a roadside stretching back for too many years. Well, we're the party of Lincoln, born in the deep, rich soil of the plains, born of bread of sturdy stock, the hardest-working, most productive people in the world. And only by keeping our family farmers strong and only by keeping our family businesses strong will our Republican Party remain strong. When anxiety and despair knock at our door, we must answer with a willing hand, reaching out with support. We must answer with tax policies that ensure robust growth at home and with trade policies that pry open markets that are closed to American exports abroad. And we must answer with monetary policies that ensure a sound dollar, low inflation, interest rates, low interest rates, and stable exchange rates. Incidentally, the inflation rate for the last four months has been 2 and 1 half percent. We have learned that without such stability as I've just mentioned, free trade is a fantasy. Now, all this we must work for and more. To those in our inner cities, in our ghettos and barrios, we say our progress cannot be complete until the dream is real for all. The party of Lincoln will not be whole until those who were with us once before rejoin us again, until they taste the emancipation of full economic justice and economic power. Let us make one thing plain. It is we who are battling for a true jobs amendment agenda within enterprise zones and the youth opportunity wage. But if we're to open these doors for millions of whites, blacks, and Hispanics, if we're going to help people get off unemployment, off welfare, and into the decent jobs they deserve, then we need to ask them for their support. We need to elect more Republicans to the United States Congress. In 1990, there will be another reapportionment. And do you know that I believe it's been more than 50 years since Republicans have been in charge of reapportionment? I think in our own state out in California, the only Republican district they've left us is south of the border. My friends, when we say that we're going forward and taking America's heritage with us, we're saying that the values of our fellow citizens deserve to be respected and not patronized. For us, words like faith, family, work, and neighborhood are not slogans to be dragged out of the closet at election time. They're values we cherish and live by every day. For us, the right of an unborn child to be brought into the world, the right of children to pray and acknowledge God in their schools, the right of parents to guide the education and moral development of their children, these are not fringe issues to be forever shunted aside. These are questions that go to the core of who we are and what we stand for. And these rights must and will be proudly carried forward by our party. I can't leave without reminding you that America must remain freedom's staunchest friend, for freedom is our staunchest ally. It's America's responsibility and the responsibility of the Republican Party to stand with people that are being persecuted for their beliefs, to stand with people risking their lives for liberty, from Afghanistan to Angola to Nicaragua. Supporting them is not only morally right, it is the way of honor. To abandon these brave souls would be to condemn America to eternal shame. By pushing forward the frontiers of freedom, we reinvigorate the forces for democracy and peace. At the same time, we will continue trying to work with the Soviet Union to solve problems, work for an agreement to reduce the weapons of war in a manner that is equitable and verifiable, and build a foundation for a safer world. I'm going to do my part after reading Time magazine. I'm going to wear my pinstripe suit to Geneva. Seriously, that's why I'm determined to pursue our research program to explore the feasibility of strategic defenses, a security shield that could protect the United States and our allies from a missile attack. Why should this effort fill us with hope? Because it would not kill people, it would destroy weapons. Because it would not militarize space, it would help demilitarize the arsenals of Earth. Because it's the essence of science and spirit joining for mankind's highest ideal, peace on Earth. It must go forward. It will go forward. It is not a bargaining chip. And we will go forward. Thank you. God bless you.


What's up everybody? JCM for jazby's case breaks.com 2021 immaculate football two box break ran in teams number six just sold out 32 total spots all-carts ship and don't mind this guys. This was when it was a Super Bowl Square promo spots It's not anymore. So number six is not these are the last two boxes of the case though. So good luck guys I don't know what we pulled but hopefully some nice fire hiding in here. Here's the dice roll Here's the customer name so kind of am down to David bought those straight up and then Josh won those from prestige Pack filler number 29 down to found pack filler number 30 and there's all the teams as well So let's roll and here we go full 12 six and the six one two three four five six seven eight nine ten 11 12 12 Blake down a cayenne. All right, so let's go 12 times now here one two three four five six seven eight nine ten 11 and 12 it's the 12th and final time boom. We got a 12. We got 12 We have since any bangles at the top are they winning the Super Bowl at the top right there They might be Blake with a man goes shamanic with the Raiders Josh. You have the Colts Sean Breen with the Broncos Josh Ironman you have the Vikings young with the Cowboys Kevin with the Steelers Derek with the Commanders Which is Washington football team commanders? Nathan with the Seahawks bow with the Jaguars Joshua with the Bears Follow the rounds Matthew with the Panthers Jago with the Bills Mark with the Patriots filed my Eagles To the Texans mark with the Giants Sebastian with the Titans Richard with the Saints Matthew with the Cardinals Niggles with the Chiefs Panther Dolphin sorry Paul with the Falcons Peter and with the Ravens David with the Browns Matthew with the Bucks Sean with the 49ers Joe with the Jets bow with the Lions Jeff with the Packers and kind of with the Los Angeles Chargers So let's alphabetize it and I guess that's pause the video. Let's pause the video. See if there's any trades if not, we'll come back and rip this All right you guys welcome back. There was a trade offer, but not accepted so We're just gonna Close the trade window and rip. All right guys. So like I said, this was the last two boxes We have so no more immaculate for the meantime First one we got is Cortland Sutton for the Denver Broncos 24 to 75 Whoa, we have a jumbo little helmet relic Rookie helmets that is Ian book three out of 11. It's like must be on the side of the helmet or something Saints going to Richard. We have a Andre Johnson 71 out of 80 Houston Texans that is the one Alex We have a three color patch and autographs 63 out of 99 James Robinson Jaguars is bow for my egos. Look at that premium patch autograph Fly with flat file. That's four to ten miles Sanders How does a beautiful patch autograph right there? In player warm game use material. I'm jealous and We have a two color patch and autograph. Yes, it's two colors a little bit of orange on that top corner That is 87 out of 99 true RPA of Jalen waddle Very nice right there for the Miami Dolphins. That's going to Nathan. All righty Remember it is a two box break. So one more box. So Jalen waddle RPA in the first box. I'm bad. I'm bad All right, good luck guys Next we got is Phillip River's four out of 25 Not Justin Herbert But the previous Chargers quarterback before Herbert semi-fajoco 19 out of 49 Dallas Cowboys All up we them boys No, you ain't Whoa, speaking of not Herbert's There's really Justin Herbert 23 out of 25 one two three four color patch. That is a huge jumbo patch numbers player worn or says on authentic memorabilia is not for many specific gamer event, huh? Either way, it still has Herbert on there. It's gonna sell a one of one Try to trade couldn't trade mojo mark NFL shield eye black autograph of Cadarius Tony Wow, I Don't think you were expecting that mark. I wasn't that's for sure You actually had a really rough start. I'm not gonna lie, but I think you kind of picked it up towards the end of the year You know it was a first-rounder Definitely hoping bigger things for him in year two There you go, man little uno of uno All right, let's say we have a redemption And the last one here is Chuba Hubbard patch autograph for the Carolina Panthers 20 out of 30 Chuba Hubbard is Carolina Panthers Matthew There you go. You might have a buyer in Josh mark.  And there you go guys appreciate it. Jasper's case breaks calm. Damn Josh really


Good morning Washington on your side. Coming up in our 6 a.m. hour, a new type of lie detection test, how your eyes can give you away. Well, they say that eyes are the window to the soul and one technology company believes that your eyes are also the most efficient way to tell if you're lying. Reporter Gabby Hart takes a look at some new technology that its creators say can see right through your lies. A new form of lie detection claims it can see the truth. There are markers in the eyes that are able to accurately determine if an individual is being deceptive. Neil Harris is the vice president of Converis, the company that created this new technology called Eye Detect. It uses only the eyes to determine if a person is lying. When a human being is being deceptive, there are these micro dilations of the pupils. It's the extra mental energy that it takes to be deceptive. Eye Detect has been in the work since 2003, only taking 30 minutes to complete. This new testing technology could be faster and more efficient than the old school polygraph. Its creators argue that Eye Detect may have the edge because it isn't influenced by any human bias. So by removing the human element, we believe we can make the assessment of credibility far more forensic in nature. Ron Slay is a security consultant who administers polygraph exams. He says in his 40 years of experience, he's seen all forms of deception. And he thinks it takes more than a computer system and answering a few questions to detect a lie. You can't automate the human mind. But Slay says it can sometimes be harder to catch the people you wanna catch because they have their own truths. They're not really answering your questions at all. They're answering what they perceive to be your question. Slay and Harris agree that both Eye Detect and polygraphs can get it wrong sometimes. There will be some false positives and false negatives with Eye Detect as it exists today. But Harris says the beauty of computer algorithms is that they get smarter over time. Still, the polygraph remains a powerful detection tool, not likely to be replaced anytime soon. I think it's the age old argument of man against the machine. I'm Gabby Hart, reporting. How about a blend of the two? That's what I'm gonna say. A blend of the two. Yeah, yeah. Interesting. Maybe eventually we'll get to that maybe. I have some people that should invest in some sunglasses then. Is that true? That's true. Let's talk during the break. Just saying. Do we need the sun shades today? Yes, we do. But for this morning? No, this morning we could see.


from San Francisco. It's theCUBE, covering Red Hat Summit 2018. Brought to you by Red Hat. Hello everyone, welcome back. This is theCUBE's exclusive coverage of Red Hat Summit 2018. In San Francisco at Moscone West, I'm John Furrier with my co-host, John Troyer, and we are here with David Levine, Assistant General Counsel of Red Hat. We've got the lawyer in the house. Who's billing for this hour? Welcome to theCUBE. Thank you, John. It's good to be here. So obviously, the legal challenge is, you know, putting GDPR aside, which I don't want to get on that rant, but we're not going to talk about it, is licenses in open source. This has been an enabler, but also an inhibitor for many in not knowing what licenses to use or what code license means for them, their role in the community. All this stuff could be a morass of gray area or just no one's educated in some cases, right? So it's tough and that's what I do. I mean, my job is to help, you know, bring some order to what you describe as a morass, right? How do we help reassure, especially enterprises, that it's safe to go in the water. It's safe to use open source. Red Hat is an open source company. Our entire business is built on open source and that sort of has a couple aspects to it. One is on the development side. We collaborate in the development of software, but what really enables that are licenses, open source licenses. And much of Red Hat software is built on top of a particular license, which is called a copy left license. It's known as the GPL or the general public license. And it's a great tool to foster collaboration, right? What copy left means is if I create a piece of software under a copy left license and I give this software to you, I give it to you with all my copyrights. So you have the right to copy it, to distribute it to John, to improve upon it. But the only requirement is if you give it to John, you have to give it to him with the same rights. And you have to give him the source code. And if you improve upon it, you have to license the improvements to him under those same rights. So it's this whole virtuous circle, right?  You're able to continue to improve on it. You redistribute it and we all get to share. So if I create value, do you get that back? If you decide to distribute it to me, you don't have to. But if you distribute it to someone else, then you have to give it back with all those same rights. So you're paying it forward. Basically, all the rights forward. Exactly. So it goes good ethos. But then if I improve upon it, I create like a derivative work, whatever the legal term is. And I, oh, this is a magic secret sauce. 10% of it is magic secret sauce. Now I distribute that product. I pass along the license. Correct. Including my secret sauce. If you decide to, there's nothing that requires you to do it. So, you know, a lot of our customers sort of build their secret sauce internally. You know, they keep it within their companies and it doesn't go out any further than that. And that's perfectly fine.  What does that mean distribute? Distribute the software to a partner or the product itself? Yeah, it could be both. So the product is sold publicly as a service. Say a cloud service and I got some secret sauce. So if it's a service, it's a great question. It kind of goes into sort of legal issues. But generally speaking, if you're providing a service, that's not a distribution. So if I don't really have access to the software. That's actually a really good thing for developers. Yeah. Well, it's an issue. We are now in a service oriented world. So that's a, we are, that's the next, maybe that's one of the next things that we as a technology community and an IT industry have to deal with. Certainly it seems though, David, before we get into kind of the new news here and what were the specifics of what were the new development, but open source was scary. A few, a generation or two ago. It seems like at this point, especially in cloud, it's the new normal.  It's a great point. So I've been at Reddit for 13 years now. And so I've seen sort of tremendous change over the years. And when I started in 2005, we were having a lot of discussions with customers about the copy left aspects of the GPL. This requirement to give back. And there were companies that were concerned about this, but over time, they've become more sophisticated and they're realizing that, notwithstanding what their lawyers were telling them, it really wasn't that dangerous. And I have very few of those conversations today. Most people get it. And also a lot's changed since that time. I mean, right now, I think people have seen the benefits of projects being out in the open where it's fostering great collaboration and the productization piece can still exist with that. So the dynamic between productization, aka commercialization and open source projects is interesting. So you can almost make the argument, it's easier to be compliant if you just make everything open source because rather than re-engineering any fixes, the community can do it for you. So this efficiency has already been proven. Absolutely. And customers are concerned about compliance with all the obligations under the open source licenses. And one of the things that I try to tell customers is if you take open source, you build it into a product, rather than spend a lot of time focusing on pulling out all the obligations into a separate file, just make the source code available, republish it, and you get to participate, you get to push your contributions upstream. And so you have a whole community that's supporting the contributions that you described. Okay, so what's the big news here? The GPL version two. Okay, so first of all, what's the current situation? You guys made a quick tweak in this GPL two, three situation. What was the current situation? What was the motivation? Why the change? What's the impact? So I talked earlier about the GPL and the GPL has sort of very exacting requirements. I mentioned that if you're going to distribute the software to John, you have to give him the source code and you have to include a copy of the license. Well, understanding what is source code, what has to be, what has to accompany it, depending on how you're distributing the software, that's not always an easy question. And so companies don't always get it right. And one of the challenges with GPL version two is that there's no grace period. So if you miss something, if you make a mistake in the way that you've tried to meet your license obligations, your license is terminated and you're a copyright infringer, sort of right at that point in time. And that scares a lot of our customers. It scares enterprises. They need more predictability. They want some level of fairness. This is the grace period you're talking about. Yeah, this is the grace period. So there's no grace period in version two of the general public license. That problem was fixed when they came out 10 years ago with version three of the GPL. So version three included this grace period in it. But the challenge is that a lot of code today remains GPL version two. So what do we do with that large existing code base? And so the solution was to adopt the Cure provision or the grace provision from GPL version two, I'm sorry, version three for GPL version two code. Stop me if I'm speaking too quickly or I'm getting too technical. So the idea is- Three, one, just back 33 seconds. So like do a little playback. So if you can apply GPL v3 to the v2 code. The Cure period. Oh, just the Cure period. So I'm adopting the Cure period. So the license stays the same. The only difference is I've said that if you fail to meet your obligation to John when you redistribute, I'm going to give you 30 days to fix the problem. So essentially your grandfather in this v2 was a grace period. We're giving this grace period. And this is a corporate promise. This doesn't change the license. This is a corporate promise. It's a promise by any copyright holder. So in my example to you, I'm the sole copyright holder here, but in the Linux kernel, there are thousands of copyright holders. So the Linux kernel developers back in October adopted the same approach. Adopted the GPL v3 Cure period for the Linux kernel, which continues to be licensed under GPL version three. And then in December, sort of Red Hat led a group of companies that included IBM, Google, Facebook. We all adopted it for our own copyrights, right? So we, you know, together, you know, those four companies own a lot of copyrights and open source code. And then in again, in March, six more companies joined us. SAP, Microsoft, Cisco, HPE, SUSE, CA Technologies. And at the Red Hat Summit today, we're asking developers to do the same thing. You know, we want to show that it's a movement that, you know, we want to cooperate in an enforcement because we think ultimately, if we want, you know, more people to join, you know, the open source ecosystem, we can do that by making enforcement more predictable. And so what specifically are you asking startups? What's the, what's the ask? So for developers, if you go to, we have a site on GitHub. So it's, it's the GPL cooperation commitment. So gplcc.github.io slash gplcc. Can you go there? There's the statement, the same commitment that the company's made. And you go in and add your name to the bottom of the file and submit a pull request, like developers know how to do on GitHub and your name will be added as a supporter and would apply to any for some good. That gives them the promos or your stop-all or rights. And you know, anyone who takes that code has that, that peace of mind. Well, great stuff. Grid 101 on the GPL v2 v3. Great, great. It's super cool that you guys are doing that. It's just such a hassle. It's just, I'm sure the complaints have been crazy. The bigger question for me, if I look at, because I love it, the innovation comes from open source. We're seeing that both in the collaborative side and the projects, but also people are really productizing open source and it's running everything. The question is, when do I have code that I, you know, people are programming like crazy. They're slinging code like it's nobody's business right now. So I might be afraid and reliable if I'm in enterprise or startup that through venture capital or M&A process where something's going on. Wait a minute. We can't actually sell this because that's his code over there. You didn't comply with the license. So there's always these tripwires in the mind. And sometimes it's just fear. This is a general kind of licensed hygiene kind of practice. What do you, what's your take on that? What's your advice to entrepreneurs, to enterprise developers to be safe? What should they do? Is there an approach? It's a great question. I mean, what you want to know is, you know, where's my code coming from? And you have, I mean, it's a license issue, but it's also a product security issue. Right? I mean, if you're, you know, taking something from someone, they took it from, you know, two places down the food chain. You know, what's the provenance of that code? So, I mean, just like from a security perspective. How does she emanate herself because of this? Yes, you want to know the source of your code. You know, get it from a trusted source. You know, make sure that you understand what the license terms are. You know, one of the things that we're trying to encourage developers to do is make sure you attach a license to it.  And that can become problematic if they have a liquidity plan. Okay, so here's my next question. So then the next question is, obviously open source is growing and people are joining projects and or creating projects. So it's hypothetical I have a project and I want to donate the CUBE code to the open source sort of CUBE community. Do I just ship the code? Do I have to pick a license? What's the best license? And then I want to also have in the mind that I might use Linux and all the things. So I have code, I written, proprietary code, I want to open it up. I got to pick a license. Like, do I just go like that and pick a license out of the hat? Or lots of times it's sort of dictated for you. So it depends on the ecosystem that you're working with. I mean, if you're working in the Linux kernel ecosystem, generally it's going to be GPL version two. So you have to sort of look at what other projects you're working with is this part of a particular project that already has an existing license. And then it's a philosophical point. I mentioned before, the GPL is a copy left license. It forces sharing, right? So it protects John's rights downstream from you. But there are other licenses that are permissive and give you lots of rights, but you could decide what you want to do with it downstream. So if you're okay with people taking your code downstream from you and making it proprietary, then using a permissive license is fine. But if you want to ensure this virtuous circle, then you want to pick a copy left license. Paul, do you think we have reached the end stage of open source licenses here? Are you, you know, GPL v3 is 10 years old, you know, we started from MIT and Apache and I could probably list a couple of others and I haven't even been paying attention. So are we settled down? Are we about done? Are we looking for things? It's a great question. So I was at a conference two weeks ago in Barcelona put on by the Free Software Foundation Europe. And one of the conference sessions was the future of copy left. You know, is there going to be another copy left license? Do we need GPL version four? You know, it's, you look at sort of what the GPL has done and how many projects are governed by it and how it's forced this collaboration. It's done amazing things, but it's pretty complicated. You know, so is there a simpler way of accomplishing the same objectives? But I don't know that people have the stomachs. And the answer is? Yeah. I'll come back next year and let you know what I learned. Well you're wearing a button. Now I'm going to have to ask this. Ask me how you can support open source license. So I'll ask you, how can you and me support open source license? So it's take the GPL v3 cure commitment, you know. Commit your name to supporting, you know, greater stability and predictability and fairness in the way enforcement takes place. So, I mean, it's an exciting project. It's kind of fun to, you know, pull the whole community together. It's quite an accomplishment too if you think about open source principles. Again, we've been talking about the skew other events, but okay, we've just beginning of another generation of open source greatness. Certainly remember the glory days when it was a tier two citizen in the enterprise. You guys made a tier one, but now it's going to a whole nother level with cloud native. And you're seeing open source ethos being applied to other markets, not just software development. So you start to see the success create this circle of innovation. And you guys have the pinch me moments inside Red Hat saying, hey, this is actually working. That really well. I mean, just a couple of touch points.  When I joined Red Hat, I mean, that wasn't a friendly relationship. And now they've embraced it.  And you know, your point about sort of where else is open source going? One of my colleagues spoke about a year ago to seed developers who are interested in open sourcing seeds.  So- Oversization is a great thing. Yeah, absolutely. On the legal front, what's on the horizon? Then he hurdles, you see opportunities, challenges that you guys are working on. Obviously, there's always legal framework. You know, we just commented before you came on with Chris Wright about blockchain and, you know, some of the tokenization around content. And we might even see kind of a token economics and so forth down the road. So, I mean, a lot of interesting legal things happening to rights, if you open them up, what's your thoughts on the future?  So, what does it mean, you know, if you put open source software layers in a container, you know, what does it mean if there are proprietary laders in there? Does it mean, you know, if you add, you take my open source software, add a proprietary component, package it in a container and give that container to John, what does it mean for your proprietary layer? Is that, does that have to be licensed under the GPL? So, we spent a lot of time thinking about that, you know, a number of years ago and luckily concluded that it actually may improve the situation as opposed to, you know, adding any concerns. So, we're thinking about, you know, the impact of open source licensing in containers, ensuring, again, to your point earlier, what's the providence of the code? I mean, there's so much code now available, making sure that there is a license associated with it. Some of us, you should just declare all code free. Yeah. Absolutely. Well, certainly a lot of new things you're seeing societal change, this impact that you've got self-driving cars and all kinds of new things that are just mind-blowing at a legal framework standpoint, first-time challenges. So, you're busy, you're always going to have an interesting job. You know, and I really think that I have the best job in Red Hat because I get to think about these things. You know, what does it mean from a licensing perspective? What are the new issues that we're going to face as sort of the technology evolves, the market evolves, and... Super important. I mean, there's tripwires in there, and again, if you don't think about it probably, I know from I've seen from experience, you know, great companies lose big-time acquisition opportunities because of some faulty code on a license. And it's just killed things. And then I've seen enterprises get so... I mean, little weird things could happen. You just got to be on top of it. I mean, look at what Tesla did in open-sourcing their patents. You know, making their patents and technology available so that, you know, it helped the whole autonomous car industry. You know, we've been doing a lot of work in the patent area as well to ensure that, you know, patents don't become an inhibitor to the change that you've described. It's a great conversation, provocative, legal, and open-source software. These are competitive advantages and opportunities, not challenges and compliance, you know, old school, you know, guarded secrets, open it up and good things happen. David, thanks for coming on theCUBE. Thanks for sharing the insights on the legal perspectives of licenses as open-source software continues to power the globe on a global basis, global economy, and the technology innovation that's coming from us. theCUBE bringing you more of the live action here in San Francisco. We'll be right back with more after this short break.


There was there is this talk called audio networks and the security implications and you're probably going to Well, what why do we have security implications with audio networks? It's all XLR and analog and there are no security issues, right? well Apparently the world moved on and now it's all audio over IP and especially with Commodity hardware, so here to talk about audio networks and security implications Please welcome with a very warm round of applause PC Wiz Hey Hey Yes, I'm on PC Wiz. I Work for the company that put the sound system in abacus if you've heard that you probably definitely heard that on Friday night If you were here But this is my own work outside of work, so I've been sort of doing my own research But I work in that field and that's why I'm sort of looking at it so I'm hopefully I'm going to introduce you to all your networks what they are and Where they're deployed and get you a bit interested and Also show you just how soft they are as a target and Then after showing you how soft they are as a target hopefully people are interested enough to Think about it and maybe when people think about it we can change it So where are all your networks deployed well abacus But also big broadcast Situations, so think about Olympic games. You've got lots of stadiums lots of broadcasters lots of different people you've got to provide Public address inside the stadium for people watching in the stands And you've got to provide media streams that all of the various television and radio broadcasters can use to Create their coverage And what tends to happen when you make an audio network is That they extend to places you don't expect them to go to especially in places like theaters for example It's increasingly common now that your bathroom also has an audio feed from the stage So you don't miss anything when you go to the toilet, which is really convenient But now means that you've got audio access inside your bathroom so That might be a problem thinking about the things we're going to talk about later And yeah, any anybody who's got any experience doing penetration tests for know that bathrooms are quite a good place to Have plenty of private time with network equipment Okay So why are we deploying these networks? Because well no one deploys technology just for the sake of it unless you had a hacker camp in which case maybe you do It's mostly well cost Everything in AV is moving in this direction For IP based networking, so you've got art net on the lighting side. You've got various different video networking standards and Obviously ancillary stuff. So you show control Everything is going over IP networks nowadays So you can save a lot of money by building one IP based infrastructure and dragging one set of cables inside your building And that's that's pretty that's pretty nifty Yeah and if you're thinking about It's got it's do I shouldn't touch the microphone It's it's also more versatile Because you can share your audio feeds a lot easier with multiple places so sharing in the Olympics again between the the Public address system in the stadium and the multiple broadcasters outside. It's really easy You just sort of let them attach to the network and then they can ask for those Audio feeds and it doesn't have to go through any special box. The network takes care of Transporting the audio there so it solves a lot of problems. It's it's really nice and It's also really helps of consistency. I don't need a box of lighting cables a box of audio cables and a box of whatever else I just buy some single mode fiber and some cat 6 cables and some normal for all fairly normal switches and And everything's good. I can if something breaks I can just go to the local IT supplier and probably buy a replacement. It's it's nothing which is Special to the AV industry anymore really which Really improves your business continuity, especially if you are touring and you need the placements for things Okay, so why am I going to talk about the network and not the hundreds or maybe thousands of insecure Linux devices that are sad of the network? probably probably because it's more interesting to me and because a lot of people will already talk about hacking embedded Linux devices and I could do a separate talk on that but but changing the network is going to be a longer term goal because that requires integration between multiple different players of the industry hardware vendors software vendors and of course adoption by by people and that's That that takes a decade at least Even once you've got once you've got a standard in place to get that built into hardware we'll build into software updates and Then actually deployed There's a lot of work to be done. So I thought I would highlight the topic now and hopefully we can start to agitate some change So now I'm going to get into a section where I'm going to run through some attacks and we're going to build up We're going to sort of build up the knowledge we need to understand the system one attack at a time So I've got three different attacks And what kind of attack objectives might we have? So we can damage people obvious way to damage people is play something really really loud and create hearing loss less obvious way is just disrupt the system during Some kind of emergency announcement and you can create quite a lot of panic and then you're really You're really Gonna have problems with panicking people you get crushed people and that's that's not great and If you saw on the previous slides We also deploy audio networks in Transport hubs like train stations and airports so So definitely places where you want your public address to to work You can also damage equipment you can play square waves Out of the speakers and the transducers will pretty quickly burn out if you play a sufficient amplitude So Yeah, and then there's also reputational harm which which could go together with snooping you've got a big a big star and Then you Get a recording of the microphone while they're off stage doing something less than ideal or saying something less than ideal and well, you've just you've just got some blackmail material or Created a very sticky Situation and of course disinformation if you can control the system you audio coming out in especially a broadcast situation Then it's like in the movies. I mean you you you can do whatever you like You would hope you couldn't but there's some soft bits on either side where you probably cut if you've got time and effort I'm a time of motivation So let's start off with snooping right we've got we've got an analog audio system here. We've got a microphone a stage box and and a mixing console pretty pretty simple the There's an XLR cable that goes into the stage box and then there's an XLR snake or maybe Ethernet cable doing like AES 50 which is not IP based but but a special thing that also happens to use ethernet cables Into the mixing desk and it's pretty pretty hard to intercept that. It's going to be detected very very easily Because if I unplug the cable the audio stops the guy sitting at the front of house is going to notice the audio stopped that's It's hard to attack that situation But let's make this a network. Okay, we've got a switch in the middle great Well now now I can now I can plug it and unplug things without the guy noticing necessarily That's that's already a start So how how am I going to how am I going to tap this? And for that we're going to need to explain a unicast a mollycast But here's a attacker who is clearly Motivated to to spy on what's what's coming out of its microphone so just some quick background because I also need to explain multicast because in most network situations multicast is something you ban burn with fire and then Pretend doesn't exist, but in media applications. It's quite necessary. Unfortunately So so to explain it, this is what unicast looks like you send The same feed multiple times from your source, which is great If you if you have a handful of devices that need to receive this audio send unicast feeds It works you've got But what happens with unicast is that you start to consume all of your transmission bandwidth on your source and then you cause congestion and Especially in audio networks. We don't like congestion because the congestion Basically increases our latency and increases our jitter and makes our audio neck works less stable. And if we're trying to operate in a low latency environment for example doing Public address on a on a stage when we need low latency Somewhere in the sort of under two millisecond range would be nice So so we have to send a different Different stream for each device and this is this is Also somewhat vulnerable because you can just up spoof and then as long as you forward the packets quick enough They the person on the desk might not notice But your But you have to be very careful about your your forwarding because the latency is quite sensitive so Expensive network calls are advisable If you're gonna ob spoof and intercept unicast in an audio network But luckily for attackers well, we use multicast most of the time so so it's actually much simpler so we solved we solved our We've solved our problem of the source transmission bandwidth Because the source just sends it into the network and then it's for the network's job. So the switch is in the network to understand who is part of this multicast group and Who wants this network traffic on our case audio? And the basic way that this works is someone well usually the Vuta or a switch is a query and it asks everybody in the network what multicast groups would you like to be part of and Then everybody in the network applies with a list of the multicast troops that they'd like to be part of this perverses up the tree of switches and You basically end up receiving that multicast group So all you need to do to snoop on the audio is plug into that switch from earlier say Look look find out which multicast group has the audio you want in it and Join it and then you can pack it capture and Wire shock has a really handy tool which will take an RTP stream and just turn it into a WAV for you Which is which is pretty nifty So that's that's snooping it was very easy Yeah, so what else can we do? Okay, we can disrupt The network we can disrupt audio coming out. We can create audio artifacts We can make we can make dodgy noises come out of the speakers. We can we can just make the system not work Which depending on your objectives Could be interesting to you So the thing to attack here is the clock on the network Clocking is extremely important on media networks because to get phase alignment for the 48 kilohertz Audio stream, so if you're 48,000 samples of audio per second, and that's that's your media clock when you need a Accuracy for your wall clock within about one One microsecond so it's a very Very high-activity clock that you need available in your network.  How are clocks distributed on these networks or they use the precise time protocol It's it's in the name really and what it what it does is it has a Leader which unfortunately in in IEEE telemetology is called a grandmaster, but I will not use that term from here on This and this basically is the best clock in the network theoretically and this should in In theory also be backed by GNSS, so it should be a satellite device clock and this is going to also help you When you come to stream audio between multiple sites because the precise time protocol only works within one LAN So within one network within one site, you don't want to run the precise time protocol anywhere else Running the precise time protocol over a Over the one will not go very well because it basically calculates lots of delays and sort of makes some assumptions about how even that works and It does a lot of clever things and relies on a lot of clever assumptions about how local heavy networks work and it doesn't extend so well over over Over the internet so Yeah, that's That's where that works. Anyway, so precise time protocol you've got the sort of main leader of the top of your tree and then you might have boundary clocks or transparent clocks in your network and those are typically switches and these These boundary clocks will basically act as They will listen to the to the leading clock on one interface and then will lead clocks on the other interfaces Which helps take load off your main clock lead And a transparent clock is really just about providing increased accuracy which you'll find in newer switches Because it basically measures the time that your packet is inside the switch and then provides that information too which is quite useful for Understanding the delay in the jitter on your network Yes Yeah Yeah, so if you're if you want a LAN It's just ptp if you're on if you've got multiple sites then because they're both based off a satellite based clock They should be coordinated and pretty much aligned so you can have A broadcast coming from South Africa than streaming it somewhere and mixing it in Brazil and it should work just fine as long as you've got Access to satellite time But of course we can disrupt this clock and then things will go wrong So one option we have for disrupting this clock is by bigging elections Because the leader the lead clock is elected naturally Based on its characteristics, but not just its characteristics. It's also elected based on to use a controllable priority fields and If you ever touch a media network You will probably find out very quickly that you have to configure these In order for it to work correctly You'll find a lot of media networks where they basically Denial of service themselves because they're not properly configured and the thing that isn't properly configured is is the priorities in the in the In the ptp announcements for the for the election of clocks But in reality if you're if you're an attacker You can change all of these fields and basically what you want to do is say I have the lowest priority which the lowest number of priority gives you the highest score in the election and You can sort of fake your accuracy and instead of saying you've an eternal also later You maybe you can save an atomic clock or something if you really really want to be the clock So if you want to be the clock, it's pretty easy to be the clock So you're the time Lord now great so if you want to make the clock drift you can make the clock drift if you want to Make the clock jump you can make the clock jump you can do whatever you like and It's pretty much as simple as running ptp for Linux on your laptop and Have fun with that There's there's another option of course You can you can do a denial of service you can generate some traffic But you don't have to generate that much traffic because because all your networks rely on Prioritization happening within the switches to achieve different Amounts of latency and different traffic classes basically So the clock is the most important and this goes into the expected forwarding class The audio is the second most important thing and this goes into a short forwarding and everything else is best effort and what this relates to is for the switch typically has a couple of cues like eight or so and there's there's a basically at some There's basically a load balancing algorithm that prioritizes certain cues like the expected forwarding cue over the assured forwarding cue and then the assured forwarding cue over the default forwarding cue and this basically Tries to make it under certain conditions that you don't lose your clock packets and that you don't very often lose your lose your Audio packets and that the jitter applied to them is also lower so all you actually need to do is send send enough traffic labeled Labeled with this field with the correct value and then you fill up the cue where the ptp should be going and When you filled up that cue then the ptp will start to deteriorate quite quickly So you don't need to saturate a lot of the network to cause Problems, and if you're just aiming for Chaos, then that will give you chaos Okay, now we move on to possibly the most interesting attack types of Of this presentation Actually hijacking audio streams. So how can we get the speakers to play our audio or how can we get the broadcast station to play our audio? So we've got the first option which is pretty Pretty trivial all of your audio Streams will be announced on the network somehow This example is from a Venom implementation so we're choosing the session announcement protocol but But you'll also see Dante using MD and s but it doesn't that that's really doesn't matter because the Always inside MD and s all the session announcement protocol you will find the session description protocol, which was the same in both Dante and the Venom Basically any audio for IP solution And what what you find in here is Basically the multicast group where where the audio is being sent to You find the port number and you find It's an information about the time synchronization You'll notice the media clock direct equals zero line. This is interesting In in already RTP the real-time transport protocol that you you have a timestamp and this There should be a timestamp for your media clock and According to the standard it should start at a random number Where the idea was to Make plain tech known plain text attacks less possible if you if you encrypted your your RTP traffic but In most implementations of audio networks This is zero the random interval is pretty much always zero So that's that's just an interesting thing to note. So you pretty much you don't need to take account of random intervals in practice The information you've got here is basically what type of audio it is and this is linear PCM 16-bit encoded two channels at 48 kilohertz If you have done any digital techniques, you probably know what pulse What PCM audio is? You basically just measure the amplitude of the signal and you measure it into a 16-bit value each time and then you measure it 48,000 times a second and in this stream. It's a stereo stream. So we have two channels of audio And it also tells us what clock domain we're in which is quite useful Okay so what you can do here is you can just make your own announcement and then you can make your own name and Wait for someone to click on it. That's possibly not so interesting, but it will probably work because there's no verification here, so the client will present all of them equally and Depending on the recommendation of your if your clients There will be some caching of these messages and you can probably abuse the caching of these messages to Make yourself higher in the list and more likely to be clicked on So that's one way of doing it which would work When the stream is set up But how do we do it when the stream is already running? How can we attack? something that's already running So we've mentioned already That we have Latency on our network, so it takes it takes time For a packet containing audio data to get from our stage box to our mixing console And it takes a different amount. It takes a different amount of time each time The variation in this different amount of time is our jitter So we can't just we can't rely on On our network Delivering something in constant time Which means we have to we have to buffer when we're receiving when we're receiving When we're receiving audio data in our mixing console, we have to buff it. We have to have a buffer to With a fixed offset In time against against the clock We need a fixed offset to ensure it's real-time playback otherwise would be speeding up and slowing down each time packets Can arrive and they can also arrive out of order. So we definitely need to buff it So So what we can walk in do is we can we can abuse this this buffer and this buffer will be biggest in broadcast applications Because in broadcast applications, you've got higher latencies because you're typically going longer distances over over wider networks But you can if you've got sufficient resources you can probably also do this On on a on us on a smaller network. You just need to be very precise about your timing And just to look at what more package you're sending here. It's it's a real-time transport protocol There's your time stamp, which is based on your media clock the sequence number which is fair basically to detect packet loss and in some applications of RTP you would send Basically Replies back occasionally telling telling the sender how much packet loss you've you've encountered But in most applications You don't So that's not so important to us and then your payload basically just contains It just contains your linear PCM encoded audio Interesting sort of fun fact here is that you can list your contributing sources So if you've got multiple audio streams being mixed into one audio stream, you can theoretically keep track of them But I don't think anybody actually does that Yes So how how can we abuse this buffer? Well, we can basically pay play pixel flute But with with a deadline So you basically just need you basically just need your pack your packet to be the last packet that arrives because there's no way to verify the packets coming in and You're unlikely to spend the time checking if there's anything in your buffer already Because why would you and even if you did then it would just change the game round so we can We can basically monitor the network and see when our legitimate source is sending packets So we sent a packet and then We can offset our clock. So we always send a packet So we don't arrives at the destination just after Just after the legitimate packet arrives, but just before the clock comes along When we get played back and that's That's that's basically how you do it Almost got this working So I hope at some point to have a proof of concept published because it's it's not that not that difficult To achieve especially on higher higher latency setups So let's start to summarize this a bit Yeah, so we've seen a couple of ways that you can attack network audio this definitely more of them and let's Just compare Yes, okay, so Why are we in this state is is interesting The the the industry hasn't quite adapted to the fact they're running networks yet They're running them They don't understand the implications of them yet and this this is a sort of table word which should help us understand the differences and what they're expecting So as we mentioned if you've got an analog system a cable goes from point A to point B This is you know, it helps you with traceability. You just follow the cable it helps you With controlling ingress and egress because if you unplug the cable audio stops, it's very detectable and It creates And it creates a natural choke point of a mixing desk, but all of the audio is definitely going through a mixing desk because that's where the cables go Whether's on when you're using audio of IP the network can basically be rooted The audio can basically be rooted in a matrix from any device on the network to any other device on the network So you've lost that choke point And the only way to really observe that is to get your net flow data from all of your switches Which is not something that audio engineers are equipped to do or particularly want to do So we need to find some solutions to that What can we do in practice today? Well, a lot of these are sort of bad solutions to problems. We really shouldn't have But you can do network monitoring and if you've got a fixed installation With a lot of resources then you can probably afford to have a security team look at your network occasionally collecting data and Figuring out what normal looks like You can disable ports which Kind of works In practice, it's not going to happen because Someone's going to pluck something in last minute complain, but it doesn't work then just enable all of the ports again because that's basically the the practical side of AV technology at the moment You could try to implement 802 on X on all of your devices Which has a bunch of management overhead and your devices poorly that support it and you could try to do Mac address filtering But it really wouldn't be that effective Yeah, yeah, we increase increase your attack time by 30 seconds or whatever however long it takes you to notice it was Mac address for doing in place and Stalt spoofing your Mac address Then your other option is basically just Segment your network make sure that your show control isn't running on the same network as your audio Make sure your lighting isn't running on the same network and and just try to minimize your your footprint So how's it moving in the light direction? Well, PTP is getting better The the clock can now be authenticated Which is helpful and the clocks can also be validated against more clock domains. So now a PTP client can Can listen to multiple PTP clock domains And then if one of those clock domains is wildly out of sync with the other ones that can be ejected Which is an interesting concept now So it's kind of a cover them based on based on what's happening in your network And there's also the option to do authentication Which which I don't think any of the endpoints are really using yet, but It's at least a start And this of course secure RTP The only problem with secure RTP is It's not really got a solution to multicast yet It kind of goes. Oh, you could use it in multicast, but didn't find any Anything about how you would use it for multicast So that could be interesting So what what we're missing basically is a usable way to distribute keys to multicast groups And all of the software and hardware implementations that support it because when we can distribute key material then Then we when we've solved a lot of this problem That's pretty much everything Yeah, this is my own research, but My employer is also looking to hire a lot of people so if you're looking for a job in the making loud things then you can You can join Holoplaw. We've got lots and lots of jobs really a lot of them Also, if you just want to move to Berlin, it's quite a nice place to live Yeah, I think we might have some time for questions Thank you very much for the more than interesting talk Well, if you have questions, please line up at the microphones in the middle of the tent And while you do that, I have one question. Would be a mitigation to just switch back to XLR That is a mitigation, but I think I think the industry has changed enough that it's not going to happen anymore. I think I think one of the world cups Like over a decade ago was already using audio for the IP. So it's Definitely in the higher-end applications. It's it's already there and it's not going back So so that cat is out of the box that that that cat is out of the box The only thing we can do now is try to create a secure standard to use And trying to get it implemented Questions from the audience you look like knowledgeable people and it wasn't highly technical talk any questions No, seriously Going once Yes, please come up to the mic So analogous to the XLR situation, how expensive and practical would it be to just Apply only physical security to the whole thing? Well, that's an interesting idea. You could apply only physical security to it But then you put a switch and a ceiling tile above your bathroom And I don't know whether you want to put a CCTV camera in your bathroom like So I mean like separating all of the things because in the XLR situation everything was physically separated in any way So isn't that like Well, not the proper solution, but yeah solution. I mean physical separation is a good start and it's going to minimize Minimize your attacks, but if thinking the size of the venues that exist nowadays There's always an unprotected network access point somewhere So you you always going to find something so there's switches in front of house with switches behind stage There's switches in the foyer outside It's there's lots of different places where Unless you've got security walking around the whole time Or CCTV and you know everything else You're gonna have a hard time Controlling your network perimeter You know, it's not to say you shouldn't try to control your network perimeter. You definitely should but But the network perimeter, I don't think it's going to keep people out and maybe Also worth mentioning that in a lot of these situations, you've got contract workers coming in with random laptops Introducing random machines to networks So you could you could come in already with malware on the laptop that wants to exploit this specific thing and probably if I may add Companies or installations are not not keen to implement twice the IP cabling for just for all Well, that's an interesting point. They actually do tend to tend to build two networks But not but not to separate not to separate the different things They tend to they tend to build two networks because the way that The way that redundancy is done in these networks is you build two completely independent networks ones on like one nine two one six eight one hundred slash twenty four and ones on two hundred slash twenty four and and they They operate completely separately and you I bet each device has a primary and a secondary interface on it and you send the same packet over both Is is basically how redundancy works on these networks So they tend to build two but they don't tend to build it the network segmentation. They build it for practical redundancy reasons Want to follow up? Please go ahead like if there's nobody else here So I think the question I would was getting at was Did the security actually decrease With the Digit like if you would put XLR cables and audio cables through the whole to all your buildings, etc Um, or you would just put these digital tiny cables in there. Did the security actually decrease while moving to digital cables Um, I would say what it did because they generally added more access points to the to the to the network Um, they generally put it in places. It wasn't before Yeah, so so they generally used the versatility that was added and by using the versatility that was added increased their exposure Um, and also you've then got computers which Which just come into networks and you can run a virtual sound card on your laptop and then put audio onto the network Um, so it's it's it's not that difficult to do And again these laptops come from You know five-it one-man AV contractor turns up to do a gig Probably uses the laptop for other things And then god knows what's on there Excellent all questions answered anyone else We still got some time Think about it Now's the time One going once Going twice All right. Well, if there are no further questions, I would like to ask you to give another very warm round of applause for this wonderful talk