And yourself, Gareth. Excellent. So we'll start down the attendance and just ask people to check in, say who you are. I'll go first to give an example and then I'll go down the list that's written in the attendance. My name's Sarah Allen. I am one of the co-chairs of security. And this week, or in the last session, since the last meeting, I outside of my role as co-chair, I helped one of our members escalate a security issue to Facebook through the time-tested channel of sending email to random people I know. So would welcome feedback on offline, outside of this group. We specifically said we are not serving that role of being on deck for actual security vulnerabilities. The focus of this group is to look at how to prevent future security vulnerabilities, because we don't really have, we're all volunteers, and we're not really in a position to be on deck for a problem and ready to respond quickly. So that was pretty exciting. And I think that helped. And then I'm thinking a little bit about audio-video security, and how do we know that audio-video streams aren't tampered with and stuff like that, because in my day job, I'm looking at audio-video streaming. So that's my non-SIG update, but interesting little notes about security. And on the SIG, I started a little set of repo highlights. So helped Brandon land the conflict of interest guidelines by nudging my co-chairs and various people to review and give feedback. So, Brandon, thank you so much if you're on the call for making that happen, even if he's not on the call. Yay, Brandon. So that was a little long update from me. Everybody feel free to give a update that involves a SIG or not. Other security-related things in your life, because that's always interesting to members of the group. Next, Justin, Kapos. Yes, so in the past week, so Santiago presented a paper in Toto, which of course we all heard about and reviewed and did things like that, a assessment of. At using security, it was very well received. We also have been talking a lot with folks at, I don't want to break out an emitting case. I'll just say one of the big five tech companies, multiple product teams that look like they're starting to integrate it. So more to come on that soon. Now, on the tough side, tough is going in for graduation quite soon. So I've reached out to a few people to ask them if their company is using tough to please go ahead and just post something on the issue. And I would appreciate it if you could give us what we would appreciate it if anyone here knows folks at Oracle, Cloudflare, DigitalOcean, VMware, are I think some of the big companies that I know that we're missing. I've put a note for the poll request here, but I got folks from the automotive space and I have folks from Microsoft and Datadog that have already said that they'll post something. So yeah, hoping to see more of that kind of support for the graduation PR for time. Great, thanks, Dustin. And my thoughts. Guys, quick update on security day. Mike and I had our call in yesterday and we're kind of waiting on a couple of things to happen. We're guarding the security event. We need some more information about where we stand with sponsors, getting access to the CFP so we can see if anybody's going in. We're also looking to get a response about CNCF potentially doing a Twitter post about the CFP that went out for it. There's a couple of action items that are dropped in the SIG Security Events Channel and we're just waiting on a response. I did submit the PR that was merged in for the security day website content, but it doesn't look like the website is done yet. So we're kind of in a holding pattern until we get some more information about where we're at and what's going on before we can continue to move forward. So that's about it for me. I did update the supply chain issue and we're gonna talk about it a little bit later regarding a new article that came out. So I was hoping everybody's gonna pay attention to that and chime in. Great, I put that on the agenda. Thanks, Emily. And then Michael put the CFP in the chat. So I wanted to touch on that a little bit and I put that on the agenda too so we'll circle back. Mark Manning. Hey, this is Mark Manning. I work for a company called NCC Group doing some security audits and we have an internal team that is gonna try to be more involved in this group to see if we can't help out doing more security related stuff before it becomes an issue in Kubernetes. So this is the first time I've been on one of these meetings and kind of excited to see where you guys are going. But yeah, that's about it for me. Welcome, Mark. Christian. Hi there, Christian, Lexina here. I work for RxM. We're a collaborative training company and consulting and one of the things I'm mainly here for is to get a good sense of what's going on on the Kubernetes security front and hopefully see if we can get some of those updates into our course material or see what we can do to push along the training side of security. Great, thank you. Wei Zeng. Hi, this is Wei. I'm from the Unfinancial, the child company of Alibaba. And this is the second meeting for me and I'm reading all the GitHub issues and all the documents in the security report and trying to get involved. Great, welcome, Wei. Also, for new members, there's a PR on we're working on actually having some documentation for new members. So we'd love anybody, new-ish folks, to look at that PR that's in progress. Okay, I'll take a look at it. Michael Ducey. Yes, so as Emily already updated you primarily on the cloud native security day in regards to sponsorships, it sounds like we have two diamond sponsorships sold, at least one gold sponsorship sold. So we're meeting the requirements of CNCF needed us to promote financial obligation perspective. So that's good. I need to probably talk to Sarah and JJ at some point because it sounds like there might have been a third diamond sponsorship sold. And that means there's another five-minute spot taken up on the agenda. But I don't want to cover that on this call, we can take it offline. I just want to know, bring it to your attention. And then the other thing is deep in the realms of trying to figure out how we rebuild the thoughtful container images. So how we make them as small as possible and reduce kind of the attack surface of what we're shipping in our container images. So it's kind of an interesting project for me right now. Super, thanks Michael. Next up is Anjo, if I was saying that correctly. Anjo? Is it me? Yes. Oh yeah, An-J-O. Yeah, can you hear me now? Oh no. Yes. Microphone issues. So yeah, this is also my first time. I'm an interlabs researcher and I have recently presented also using security, a technique to securely and efficiently protect sensitive data within the same memory outer space. And Justin Kapos at some point during the conference suggested that I also get in touch with you guys to see if there is some interest in using it. We're basically looking for people to apply it to their workloads. But yeah, for now I just wanna see what you guys are up to and listen. Yeah, and if you wanna drop a link to, if you have a paper or a link to information in the chat in case people are curious, that'd be great. Sure. Chris Nova. I'm muted. Can y'all hear me? Check. Yes. Okay, sorry, yeah. So hi, this is my first security call. I hope everybody's having a great day. I'm gonna be joining Cystic. I'll be working on Falco. And one of the first items of business that I was planning on doing is moving our entire engineering cycle into open source. So starting next week, we're gonna be doing all of our Falco planning and all of our feature working feature discussions in open source. So there's a mailing list in the Falco repo now. If you wanna go check it out, if you wanna get involved, you would love to have it. And of course, we want to be as involved as possible in this thing. So, nice to meet everyone. Welcome, Chris. Thanks. Jack Lidford. Hello. I'm also a security consultant at NCC Group, working on applied cryptography protocols, memory corruption, that sort of stuff. Just want to join and contribute to the group. This is also my first meeting. Thank you, Jack. Welcome. And Gareth. I think this week, I've been doing a bunch of things. One of them that I don't think I'd mentioned before, so I'll mention now, is folks who I presume, well, I think most folks are now familiar with open policy agents, mainly in the context of Kubernetes. It's a CNCF project. It's actually super general, but most of the users and users have been around Kubernetes admission controllers or policy there. For a little while, me and a few of the folks have been hacking on a tool to make that more about a CLI tool or something that you can use for like unit testing or NCI versus something you use in production called Colftest. We've shipped a new version of that this week. That actually allows you to use the rego of policy agent stuff to test. Terraform code or any arbitrary YAML or any arbitrary JSON or INI files. So you can use it for Terraform code. We've got a pull request out for Docker files. So starting to build up libraries of rego of security rules for all of these different formats with the idea that like there's one tool that we can use to assert policy around configuration. And not just in Kubernetes land, but actually for any of like config formats. So a bunch of work on that this week. Great update. Thanks, Terra. That sounds fabulous. And definitely drop links in the notes if they're not there or in the chat. Next, Martin. Hello again for me. I'm not sure if I mentioned before, but currently I'm working on Clare open. Okay, I'm working at VMware in their open source team and in their security sub team. And currently I'm working on Clare open. This is an open source project which aims to make static analysis for vulnerabilities in Docker images and also containers. So yep, I'm working on to support more base images for Clare. You can look at the project if you're interested. Yeah, definitely dropping a link to the project that sounds great. And definitely needed. Then next is John Menorick. Hi, John Menorick from Ford Motor Company. And yeah, lurking around in GitHub and providing feedback and relevant items. In addition to can't wait for the key club audit because it's really needed in all the different already identified vulnerabilities that nothing publicly exposed. In addition to all the other interesting work that we're discussing here as well. So hi everyone. Super, thanks John. Deborah, Deborah Shans. Maybe you're muted. Are you on the phone perhaps? All right, we'll come back to Deborah. Christian Kemper. Hi there. I work on Google's cloud security team and I'm looking at the platform implementer persona. So I finally met with some of the internal teams at Google that are basically representing that persona. And that was a pretty interesting meetings. And they pointed me at more people. So I'm chasing down people throughout the company that are part of that. I need to at some point reply to some of the comments on the PR. I haven't had the time to do that yet. Right, yeah. If you're interested in that platform implementer persona, take a look at the PR.  I think Christian would love to have more voices from different companies who play that role. Exactly, exactly. I don't know what this to be Google specific. I think most of the stuff is generic, but it could be that stuff creeps in. Great. Yang. Yeah, this is you. I'm from on Spanish. And this is my second time to attend the meeting. And in the past weeks, I just read the issues from the repo and talk in the program. And I just want to follow up and find a way to get involved. Great. Welcome, Yang. Welcome back. Brandon. Hi. So I guess quick update on the K-Club stuff. I think some of you may have saw both Pingdas back and he mentioned that they seem to be short of stuff a bit more than they thought they would be. So he said he's going to get back to us. But I'm guessing if it looks like they have to delay this, I'm not sure. Maybe we don't want to bring Falco up to the next one. I guess we can have a discussion about this once he gets back to us. Other than that, I've been working on looking at where we're collaborating with NIST to create a reference architecture for a Kubernetes architecture over a hardware rule of trust. So we've been staying around a lot with the TPM 2.0 stuff, the asset tags and stuff like that. We're trying to basically provide a reference way to create, to bind the hardware rule of trust to the container level. So if anyone's interested in talking about that, I'd be more than happy to chat about that. That's something that we're still flashing up. Great. Jonathan Meadows, I think you're on the phone. Yep, I've been out of the office this week on all day, so nothing security related this time. Thanks for joining us. And do we have Deborah? Maybe she had to step out. So scrolling down to our agenda, I didn't hear anybody particularly from the partner sigs, so I'm going to skip that part unless somebody wants to shout out. And we should actually have on our template the switching this to the new member link when we have it. But if you've been attending the calls and you're not on our member list, you can PR yourself in as a member to our repos linked for the notes. And I wanted to, I don't think Robert's here today. I didn't hear him check in. So we'll skip the next item. Dan said that there was a discussion last week on this envoy issue, but it had to be cut short. So we'll carry that over next week. And I wanted to touch quickly on Cloud Native Security Day and just specifically ask Michael and Emily, what are the things that this group can do to help or win? I don't think there's anything. There's just a few things that are blocked with. Well, let me replace that. There is something. We need people to promote the CFP. We're kind of blocked on the website, and we're trying to get that through with the CNCF. Hopefully, we can get that done by the end of the week. But I dropped the link into the chat. And so the more that we can spread the CFP among our networks, the better. So to clarify, even though the website isn't up, it's where we should just sort of contact on the CFP side so people can submit. So people should tweet about that. Tell your colleagues, specifically invite individuals who you think would make great presentations. Yeah. And just to call out to anyone, and especially anyone on the call who is in this space, like practical guidance and user stories tend to go over really, really well. And then I would also like to see some things more on the cutting edge. And then I think the supply chain stuff would be really interesting to incorporate as well. So practical guidance, cutting edge, supply chain, all kind of topics that come to mind right off the top of my head. Right. I think Michael's not on the call. Michael, whose name is not springtime. Hasselblass. Yes, Hasselblass, who's working on the microsite. And I'm very passionate about also getting that old content highlighted in some way that would inform, like highlight to the rest of the community, the good work that's happened here, which is sometimes hard to find amidst all of our less riveting updates that happen day to day, week to week. So I had this, I missed last week's presentation. And I thought maybe a neat way to do the work of describing the presentations would be to have a movie night where we could just, even if it was just a few of us, it'd be fun to have company listening to or re-listening to things from the archives and then writing up a little summary or having a little discussion about it. So if anybody would be interested, please chime in on the website channel or shout out if you have ideas about how to structure that. OK, we'll just have a conversation on Slack. If anybody was interested in watching old episodes that Dan and I pulled together a while back of presentations from last year or last week's presentation. So. Sarah, could we have a pinned message or something with the other Slack channel? It's kind of in the main Slack channel. Oh, yeah, that's a great idea. That's a great process improvement. Then next up, Supply Chain Resources Catalog. I think there was a bit, there was a thread on the issue about some discussion there, but I didn't have a chance to completely catch up. I think, Emily, maybe you could lead that discussion slash whatever part of that needs to be talked about. So really, I was just going through, I had somebody send me that article that I had posted about supply chain attacks are on the rise. And I don't know if anybody had a chance to skim through the content of it, but they're going in and they're targeting the vendors themselves, the trusted sources for which we are starting to get all of our content. Made me think about this particular ticket, not getting updated in a while. So this started off as a proposal from Santiago about creating a catalog for software supply chain compromises, best practices related tools for securing them. This is a growing problem space with almost no solutions available.  This is the types that exist. This is the way that we've been experiencing them or that the community is experiencing them. And here's a recommendation for protection against it. And it's especially important as we start and review more and more open source products that come into CNCF or start graduating from CNCF. What are they doing to secure their supply chain because we want everybody to be cloud native and cloud agnostic and be flexible in their cloud environments? And if we're pushing and promoting CNCF tools, product services, we want to ensure that they have some level of security, preferably robust, about where they're getting all of these projects from in the libraries that they're using for it. So I wanted to bring the group's attention to this particular project. There was a lot of discussion about it a while ago, but I haven't seen any movement on it. And I wanted to jog everybody's memory about where we're at. So I was hoping we could kind of kick it off, maybe. Yeah, I think it would be great. Well, we have Justin Cormac and Santiago Torres-Harias were going to take the lead on this. And they're not on this call. And so maybe we can have, I think it would be great if to have any highlights of the things that have been recently posted to just kind of get people engaged about the things that they maybe could read in preparation. And then let's queue up a call where we, at least one of them, are going to be there and have it be the subject of the meeting. Because I think this is something that a number of people in the group have expressed interest in.  And we could have a whole meeting about it. But in the meantime, I don't know if you can see the screen. I'm sharing the issue. And OMG Clouds linked to the MITRE definition. And is there anything like, does anybody want to chime in on the recent postings to the? Sure. OMG Clouds, i.e. John Vanerke. Yeah, it's interesting. Because there's nothing new about quote unquote supply chain tax. You can see my talk at DEFCON on the subject, or also look at Kim and What's His Name I Forgot when they were over at Blackberry and later on before they went over to Microsoft on this very same challenge as well. There's really nothing new. I mean, the only thing that's relatively new, so to speak, is people are using those third party breach databases to spray and pray across NPM and everything. And why you see it now as of late, ignoring the journalistic page views is solely because the author and controller, so to speak, the account behind the rest API library forgot he even had the account a decade plus. And then of course, you know, spray and pray they got access in from there. To reality, there's nothing really new about any of this. I mean, sure, we talk about deterministic builds of all the CNCF projects. And as one would imagine, this would come up during the quote unquote security assessment of each and every one of these different things. Now, the hard part is, where do you draw that line turtling all the way down? To say G-Lib C, for instance, because you're going to find yourself turtling all the way down to even the hypervisor or more specifically, the BIOS or equivalent microcode. So there's a whole bunch of stuff to be discussed there. I look forward to helping that out once we, as you guys allude to, get that project kicked off. Yeah, and I think that, like, as you point out, like, yeah, we've had a software supply chain as long as we've had software that was made by multiple companies or organizations. Why this feels very relevant to Cloud Native is, to me, and this came up in the ATOTO assessment, is that this is, while this is kind of this area where, while it pertains to stuff outside of Cloud Native, it is particularly critical in Cloud Native because we need to have more automated systems as we take advantage of Cloud and virtualization and things spin up unattended by humans. Whereas in the old world, there were more frequently systems which had human gatekeepers because you had a physical machine to set up and a human has to take the machine out of the box. So I think that's where this gets to be more critical in the Cloud Native land. And it also could contribute to why these attacks are on the rise because more of us are using these, automating our supply chains. Yeah, it's definitely interesting. I have over 20,000 typo third-party libraries where we just went for typo off the main library. And I get roughly three to four million downloads a month of which those you have to imagine most of them are as what you allude to, CICD pipelines, grabbing, pulling, building, tear down the environment. So it's interesting that, yeah, you're absolutely right, especially when there's no human review, much less the freedom versus responsibility discussions they have over at Netflix companies. So it gets interesting when you also end up getting just a solicited defects being asked of you saying, hey, can you help me debug this? And you're like, sure, if you rev up to this version, I can live debug with you, but obviously you can't do that or you'll get, let's call it legal contributor requirements or documents from IBM or in Silver Lord's group saying, hey, can you sign off on this legal declaration? So yeah, it's gonna be a fun project once we figure that out. Well, I don't know if people saw the REST client, Ruby instance, like literally just yesterday, they broke. Again, people turned up, there was a version of the REST client, really popular Ruby gem, published Ruby gems. There's no tag on GitHub. People opened an issue saying, hey, is what's up here? Turned out that the person who owns that gem, that account had been compromised, someone had uploaded a malicious library. I think what's happening in a bunch of cases as well is in fashion, technology is quite fashion-ish. So people join one language community, build things that are useful, then move on. Those libraries are increasingly not, they're popular, they're stable, but they're subject to attack. And the maintainer doesn't notice because they're not working on it every day. In fact, they've not worked on it for months or years. Yeah, we track a bunch of them at work and report them. But yeah, that certainly popular, previously fashionable ecosystems are where they're mainly cropping up at the moment. That's a good point. And then, yeah, I mean, I think that that's, that is, we are working with the security assessments to try to, it's more about how do projects even deal with this, right? And some projects are like, check, we got that. And then other projects are like, well, we should do that. And I think that's also an area where this group can contribute. I think we have an open issue on best practices, like let's have some, yeah, there's so many things that are, there's not enough conventional wisdom about what should we do when we can't do everything at once, right? Other highlights from Emily or go ahead. I think another thing that is interesting is to raise awareness of this outside of the security community, right? I think it's, we all know that these attacks happened and have happened in the past, but some other people that are only now adopting cloud native stuff want to make sure what can be done about that, you know? And I think it's important that forums like ours educate people on that. Yeah, and I think that one of the things that came out, when we were talking about the EnTodo assessment, like part of the reason this came out of the assessment is that, in defining the edge of EnTodo, right? Like EnTodo, we want to support a project in doing one thing that it does and it doesn't have to take responsibility for everything it touches, right? Just because it's frequently, you know, installed with something else, it doesn't mean it has to do that. And so kind of what came up in conversation is that we have this knowledge, right? In this community about, oh, one should do this, but it's hard, right? But do people know what they should be doing or why? Or if it's hard, can we give feedback? Do the vendors who are responsible for the things that people are finding difficult even know have gotten that feedback? So hopefully this discussion can unearth some of that. Any other thoughts on this issue? It has an introduction for, I'll try to see if I can schedule it for next week. Otherwise, I'll just have like a couple of DMs with different people and then update the issue with when we'll have that bigger group discussion. Yeah, I think it'd be interesting as well. I think John, you obviously have a lot of experience in this area if there was some, or you did have some links around best practice information and advice that was already out there that you can perhaps put into the PR request on this to educate the rest of us so we can start putting together that guidance. Now, there's a lot of information about the actual attacks and details on how that was put together and maybe we can collect that information and those links. But I think it'd be good to go into that conversation where we've already got a common knowledge on it. So I guess it's just updating up. I'll be happy to do that once we get the whole thing kicked off, certainly. Yeah, or you can drop a minute ahead of time if it's stuff that people might find useful to read in advance. So, yeah, because it's kind of our habit to try to collect the information just as comments on the issue in preparation for discussions. Super. So that's all of our agenda items. I wanted to kind of open the floor if there was something that we touched on quickly that people wanted to follow up on and discuss more or we can always end early if there isn't, it seemed like we had a really busy agenda and then things went quickly because we don't necessarily have all the folks here to talk about specific things, but I want to open the floor for anybody who wants to follow up on the things we discussed or other topics. I just, can I just, for people, so I had a few people who reached out to me to be a chat about the Kubernetes, or I'm sorry, the Cloud Native Security Day. So it's the day before QCOM. So I'm gonna say that's November 18th. It's called Day Zero Events that the Cloud Native Computing Foundation hosts. And one thing you need that we're gonna do that might be interesting to members of this group is we're gonna host about two, two and a half hours of open spaces where you can bring topics to discuss and then find like-minded people to discuss those topics. Much like kind of like a birds of a feather, but it's kind of held in line during the conference. So if that intrigues you and you're headed to QCOM, I might be something interesting that you add on to your registration. Yeah, and I think registration is open. So- Yes, it is. And if the dollar fee is a hardship for anyone, there will be, we have an opportunity to have scholarships to that. So the main thing is the dollar fee. It does help defray the costs, but it's also to help avoid no-shows. So we wanna have some fee. And so the CFP is up, but, and I think the registration is- The registrations tied to the QCOM registration. So when you register for QCOM, you get the option for the Day Zero Events and you can have those on in the normal registration workbook. So yeah, so if you've already registered, there's probably a way to- Yeah, if you just go in and edit your registration, you can have in the Day Zero Events. Great. And why did we settle with the, like we have room for about a hundred? I wanna say it was around a hundred. We'll have to see with the sponsorships being sold because they get so many tickets. And so like we don't wanna have a situation where like we sell 40 tickets via sponsorship and then we got 40 people that are registrants. Not that there's anything wrong with sponsors as I work for one. Yeah, we wanna make sure that we have that. We wanted an opinion from the community, not an opinion from Fenders all day long. There's also generally diversity sponsorships for QCOM. So if you think about people who are security experts, you know, who might not plan to go to QCOM, partly, you know, if budget may be an issue and you think that their voices should be represented, then I think you're just brainstorming about that to yourselves, thinking about, you know, are there minority voices, you know, whether it's minority demographics or because they work for a smaller company, but their expertise would be really valuable. You can think about that. Are there other highlights, other questions about Cloud Native Security Day from the group? We have an issue with, in the repo that has details on it, if anyone, oh, by the way, I don't know. It's an issue 209 and updated in the notes from Michael. So also, if anybody, I don't know if anybody noticed, I changed the test roadmap format to be named project traffic tracking board, where this is, this may not be complete, but this tracks the bigger things, the bigger sort of longer and duration things that we're working on, that have like kind of multiple people involved. And so, basically where we, things that kind of require coordination, we're gating to have not too many happening at once. And so, the Cloud Native Security Day is linked here. And I'll just open the issue so everybody can see it, who's seeing the screen. And this has a nice overview of kind of what's going on and a proposed format and all of the links. So, if anybody has questions and wanna follow along, this is a great issue. It's weird to say a great issue, a really good record of the happenings of the group. Open the floor again for other topics. Hi, this is Abhinav from Frame.io. Nice to meet you, Sarah. One question is that around what we are doing as a community to, especially in the Kubernetes security or in general in the cluster security area. I know Kubernetes has different ways of securing cloud security policy, metal security policy and so on. But are we looking into projects or new projects that are trying to find some way to the actual use or we are doing brainstorming what we are doing additionally that what we have? Well, I think that there's a, just to give an overview because I think there are a lot of new people and even people who've been here a lot may kind of lose track of a big picture. I think that's a great question. So, I'm just bringing up the project tracking board as a way to kind of visualize some of the current activities.  So, there's a lot of things that we could possibly do to make the world a safer place for cloud native technologies. And we are a mix of things that the TOC has encouraged us to do and things that are led by our wisdom insight, enthusiasm for individuals in the group who want to spearhead topics and take care of things. One activity that's being facilitated by Justin Capos is the security assessments, which is looking at specific projects. So, that is like, it'll take a long time before that, you know, sort of touches everything, but that is bubbling up things that the group is taking care of like the supply chain stuff we talked about. And that this group isn't Kubernetes specific, but those projects tend to work with Kubernetes. So, that is one thing in the Kubernetes world that we touch on. And then the other thing is our policy subgroup is really co-located with a superset of the Kubernetes policy subgroup. So, there's a lot of cross filtering there in policy. And so, that group meets Howard Huang, lead tech group who is in China. So, that meets in the afternoon on Wednesdays. So, people should feel free to join that. And we should make, I think there's an issue open actually to make sure that's documented on the repo. And then the other thing that we're doing, which is not Kubernetes specific, but also covers Kubernetes is we're trying to do a better job of echoing out the, what we discover, right? Which is really this microsite. So, the idea is our repo is really for us, right? It's for the security experts who are, it's like a lot of things are works in progress. And it's for people to engage in the work of, making security, making the world a more secure place to be using shorthand there. And then this microsite will be more of a, what are the things that are really more finished or presentations that we've had so that the rest of the community who may not be, who may need to be knowledgeable about this, but isn't going, doesn't have the bandwidth to be engaged in the SIG or the expertise could consume some of the outputs of the SIG. So, and then a bit in the backlog, but also kind of in progress before we had more of a bigger group and a more rigorous backlog, is a security overview white paper, where what we're finding in a bunch of the presentations and the discussions, and I think Kubernetes is aware of and they've got subgroups working on, is that people don't really understand what the big picture is and where Kubernetes and other things fit in that picture. And so a lot of the security vulnerabilities, I've observed happen because somebody assumes Kubernetes or something else. And I think Kubernetes is the most commonly comes up, maybe because of its widespread use, but also I think people getting into cloud, I'm hearing they're like, oh, get on Kubernetes. And then they make some assumptions about it's gonna take care of a number of things, which are outside of its scope. And so there's just, there's a lot happening there. And so our hope is that this white paper will help frame where like how to reason about security and stuff that is common wisdom in this group could become then more sort of echoed out. And then a sort of companion piece is the policy white paper where there is analogous confusion and about like what is policy anyhow? And that that's a more developer centric piece that there's a draft, but it's some, I think other things have just been queued up above that along with the landscape where that we decided to pause where, which is another way of looking at kind of visually work by categories, looking at what different things people are working on and how they relate to each other and which things are like either or which things are, you should have one of each, and I think are the kinds of things that people are trying to reason about. I don't know if that helps answer your question, but also invite other people to chime in on what is this group doing about, maybe if we articulate your question. No, I mean, I think that's a good overview of the mission.  So that's a Michael and I talk a lot on how Falco can help us or help the community. When you go to CNC's site, there is not a big push for security if you browse the websites, right? I mean, you see that a lot of people are representing different aspects of cloud and security is not properly presented. So I just wanted to understand the mission of this group and how to bring security at the forefront of CNCF. Yeah, I think that we think that the first one of those things is really what the, well, it's sort of like we don't, I think we don't, we haven't quite curated enough stuff to feel like we can put forth, this is what security is, this is how you should like reason about it. And there's a, there's definitely a need and it's just a work in progress still. Cool, thanks. And you and I should talk Sarah sometime offline. We are, I'm in Frame.io and Frame.io is a video region collaboration platform. So we do a lot of on video security, watermarking and everything. So given that your background in audio and video security, we should chat sometime. Sounds great. Anybody else want to chime in on the, you know, kind of ecosystem stuff and what we're doing, stuff I might have left out? Great. And then back to the agenda. Are there open the floor again if there's other topics or questions to bring up? There was a discussion before about the idea to have, while you're doing the, while we're doing the security assessment that there will be more experienced folks in the group who, you know, who will have some kind of, who will mentor, mentor, how can I say it? Like who will mentor not so skilled people? And I wanted to ask if that's, is that the case, if there's a discussion about it and what is, how can I join? How we all can join in this program? And if there's something like this? I will turn this over to Justin Capos and I'm gonna bring up the assessment reviewer to talk about the shadowing, which I think is like a great opportunity. I've certainly like, I've done a lot of, I've played the role of security reviewer where most of my expertise is receiving security reviews because I've led a lot of development teams and, you know, have 30 years of experience being security reviewed, rather than serving in the security department. And so Justin, maybe you can talk a little bit about, so I just wanted to say, it's really an opportunity to participate in this reviews and learn from other people with different perspectives. Is Justin Capos on the line?  So I will go over this, or Brendan could too, because you have recently contributed to the guide. Yeah. Mm, that'd be, do you wanna do it? Okay, I'm, you can chime in. So yeah, so basically I have it up the, so the, aside from the fact that we're jump-starting this right now, and so of course the first couple of reviews include people who had not done a previous NCF security review, so we're in a little bit of a bootstrap process because we're working on wrapping up number two, which is OPA, and kicking off number three, which might be Falco. But then I think we have enough of a crew that we want to make sure that one of us who have been involved in the prior reviews participates in the next review and then we'll be leveling up this process. And so that the first requirement is just that you've done it before, where shadowing, right, can then bootstrap that. And then it's preferred that you have previous experience performing formal or informal security audits or assessments. And that's where by participating in the shadowing effort, and you can just, by shadowing, you can, it can be as easy as you just jump into one of the channels and start reviewing the documents and asking questions. And noticing the questions that people ask, which turns out to be like this really interesting informative thing because we have a process where, and I'll just skip over to the process because I think that this kind of helps illustrate the point where we, in the steps, like the first step is that the project leads somebody who is a primary contributor or maintainer to the project. Usually the actual primary maintainer, but it could be somebody who is, is just part of the team with an interest or knowledge of the security of the project or wants to learn about it, writes this assessment. And so there's an initial assessment, self-assessment of the project.  And so usually, so the lead reviewer will like spend a little time pre-bedding it and make sure that it all has the content that everybody else needs. And then there's a period of time where we don't, we all read it separately so that we all have a chance to have like kind of beginner mind and think about things that maybe the other person not have all of our questions informed by other people's questions.  We haven't yet done that, but we're iterating to try to get it to be a little tighter. So that there's like a clear, you know, I think week or five days or something when you get a chance to read it without seeing everybody else's questions. So in shadowing it, I think it'd be great to like challenge yourself. Well, what could I come up with here? What can I just think about that is something, a threat that maybe hasn't been articulated well enough for a question I have about how they handle the security and then have a chance to see what everybody else says. And then, you know, and also chime in with your questions. So I think the format is a great training about how to think about security and think about risks. And there's been some really good discussion. We had a great presentation from someone from the security team at Google that Christian looked in that checklists are actually can be a problem, right? That we do wanna have, we all have our mental checklists but there's also value in not having a checklist so that people are really encouraged to think about the security because the security of each project is different and the biggest risks are the ones we don't consider. And so that's why we've taken this approach where we have an outline, which is kind of a checklist but it's more, these are the different things you should be thinking about, right? And then the security and everything around this is about how you think about these things, how you like have the background material, right? What you need to know in order to do a security analysis and the core of the write-up is really this part, right? And we're, instead of having a checklist like these are the security things you should implement instead we have a checklist of you think about attacker motivations, you think about what are the preconditions to this software running and so forth and so on. So this is the process we're iterating through and this is sort of a long-winded way to answer the question which is to get involved you chime in on this security issue and then just can join a channel. Yeah, that's the security issue. We also opened a new file called the assessment matrix. I think- Can you put that in the chat? Yeah, one second. So the assessment matrix is kind of a table what are the upcoming reviews that we have and then we have people sign up whether they wanna be reviewer. We also have, I think someone also had this, you can bracket, you wanna observe us, I think we had a column for that. Let me paste it and- Yeah, I got it. Oh, you got it, someone got it, okay. Somebody did it, thank you. Yeah, so yeah, I think if you're interested in just looking at one of these for the project that you're familiar with or want to interest you just like create a PR, we just merge it in. Like Sarah said, I think like looking at a lot of the past reviews, I think if we can put some things to the old Slack channels, I think it should be okay to be public, right? I don't think there's anything there. Yeah, actually that's a great idea because then people can like kind of review what kind of discussions there were in questions. Yeah, and also I think that the presentations that happened at the end of the reviews, those were really helpful as well. It's kind of just see the types of questions. If you have any questions of that, I personally will be open to answer questions about that if you have questions on that. Thank you again for the long, for the extensive answer and I will contact you on Slack with more questions. All right, sounds good. All right, so that's a wrap for today and we'll see y'all on Slack or on the email list and see you next week. Bye everybody. Bye bye. Bye bye.


Out of all the parts of Africa, Kenya's president William Ruto and Iran's president, Ebrahim Raisi, have signed a number of trade agreements during a visit by Iran to the East African country. The two leaders pledged to strengthen bilateral ties with Raisi, describing his visit to Kenya as a turning point in the development of relations between the two countries. The five memoranda of understanding sign, focus, and cooperation in information, communication, and technology, fisheries, animal health, and livestock products, and investment promotion, Ruto told newsmen the visit is a start of a three-day tour of Africa by Raisi. Today, President Raisi and I have witnessed the signing of five memoranda of understanding on cooperation in information, communication, and technology, fisheries, animal health, and livestock products, and investment promotion. These memoranda will enhance and further deepen our bilateral relations for sustainable growth and development between our two countries.


Welcome to the show. It's me, JP, and it's time for JP's product pick of the week, and I've got a good one for you. So I am so glad that you could join me, and we could provide you with an opportunity to check out this super cool product and get a ginormous discount on it today. So before I go any further, I will tell you where you can check it out. If you want to jump over to the product page, that right there is the URL. Right over there, or darn it, to that QR code in the corner, I have a mirrored view of myself so I'm often pointing the wrong direction. That's my excuse at least. But if you head there to that QR code or this URL, you can check out this week's product pick, and it is 50% off.  There's no coupon code needed. You can get up to 10 of them. But what even is this thing?  So take it away, Lady Aida. Okay, next up, we've got a Pan 8302 breakout. We've had a breakout board version of this, like breadboard friendly version for a long time. But I want one that's plug and play that is pre-soldered, ready to go. You don't have to do any soldering to get it working. You have terminal block on one end for the speaker. You have the JST for audio input on the other. And it's just a kind of nice three watt class T amp, low cost, simple. By default, it gives you about 14 dB of gain, but into a 4 ohm or 8 ohm load. But if you look at the next photo, there is a little volume control knob. It's a potentiometer that you can twist to reduce the input from, you know, can be up to three volts peak to peak input. You can reduce it down to reduce the gain so it doesn't, you don't blow out your set up. So I have a little demo. We have a demo. I have a demo showing the kind of configuration because there's, you know, we have a lot of amplifiers and I'll explain why you want one or the other. So what's nice here is that, again, it's solder free. This is a prototype. It's green. The final version is blue or black, but green, I don't know, sometimes I'm feeling green. Inside there's a JST 2 millimeter pH input with, and you can use, we have cables that are like a dollar piece. Black is ground, red is power, three or five volts will work. And then white is signal in. And the signal is capacitively coupled here. So it can be DC reference. It doesn't matter. Well, AC couple it on the input. And then the potentiometer is the gain. And then there's the amplifier. There's a couple of capacitors and then output. You can, is a bridge tag load to, in this case, it's a four ohm speaker and up to three watts. So it's, it's fairly loud and I don't want to get us into YouTube trouble. So I'm just going to quickly turn it up. Stop it. Okay. But YouTube police. YouTube police. Everyone's a cop now too. Everyone wants to just, they're just like, I'm going to turn you in because you're doing something. I know. But this is great, like for example, this is circuit python and it has three volt peak to peak output. But, you know, I also tried this with line level output from my computer and it works great, you know, because you have enough gain. And then you can use the, use any flathead screwdriver to adjust the gain and, you know, don't, don't play copyright music ever works with pretty much anything. It's just a straight analog audio in to class D amplifier out. Very simple, but really great when you just have my controller on your PWN or pure DAC output and you want to amplify to a speaker. Yes. Yes, that's it indeed. Let me give you a little preview of it right there. That is my product pick of the week this week. It is the PAM 8302 Stemma Audio Amplifier. It's a mono 2.5 watt amplifier and it is pretty plug and play. You can see here I've got a little set of a little speaker here, not a set, a single speaker here plugged into the screw terminal for the speaker output. And then we have a little Stemma 3 pin plug that you can plug into your project and get the audio power and ground reference over to the board. So let me plug this one in and give you a little demo of it. I'm going to adjust some, some cameras here first and let's do a little bump up of exposure there and I'll fix that focus. There we are. OK, so you can see what I have right now are a QT pie with the output that I need to do PWM audio over one pin. I'm choosing the MOSI pin and then power and ground. I'm just going to plug those right into the little PAM 8302 Audio Amplifier. I've got a little potentiometer on there that I can use to adjust the gain and then this is running out to the speaker. So I'm just going to power this up over USB. Let's see. I can adjust the volume down and up and that's just going to loop. This is wave files that I'm playing using circuit Python. And I'll show you in a second what that code looks like. But this is really nice and easy to use. You can see here you've got a lot of options for how to plug that in. You can use screw terminal shields and you can use any header pins that you might have on a board or something like a feather doubler. If you want to plug in some cables of this type, we have both male and female versions of these little three pin JST connectors. In this case, I just soldered directly to the board and you can make a nice little neat package of that. It's even got some mounting holes on there. Got your speaker, maybe mount some stuff up like that. So this is really good for your wireless, rather your wearable projects. This is a really good one for battery operated portable projects. I'll give you a little look at the board right there. You can see we have it's a fixed gain. So this, I think it says max 14 dB 5x and then you can adjust the gain by about 24 dB using your potentiometer. But the actual wiring of it is a fixed gain. It will do up to 2.5 watts on the four ohm speakers. And then that'll vary. It'll get cut in half if you go up to an eight ohm speaker depending on the resistance there or the impedance. You've got the ability to drive your speakers directly. So you don't need to go through some intermediary object. You just plug directly into there. In fact, the only way to do this, you don't want to plug that this out to another amplifier. What else? It's a class D mono. So you're not going to get stereo out of this, but it works really well over things like a PWM pin, which is what I'm using in this case. Or you can do a analog outpin. So let me show you another example here. I'm going to set this off to the side and I will show you this example here. I'm going to move some camera just a little further out even. I'll get some stuff off the screen there. Let's move my camera off to the side a little bit. I'll focus this. So here you can see I built a little project into a box here. I've got a grand central, which has a analog DAC output. I can use so my audio is coming out analog rather than the PWM pin and the other project. So I have analog coming out over A0 into my little Stemma amplifier there and then out to this nice big juicy speaker. And then I'm driving Synthio stuff on there. So that last project was playing wave files. This one's using Synthio and Circuit Python. And then I'm sequencing Synthio with this Norns Shield XL from our good friend of Adafruit, Steve Denke Otto Noriko. So this, when I start this, is going to be just sending MIDI notes over USB to the grand central, which is then going to use Synthio to play those. And you're going to hear all that nice sound coming over the large speaker there through the amplifiers. Let me hit play on this. And again, I can adjust volume on the amp itself. So that's at full volume, which is also, of course, tempered by code, what I'm telling the maximum volume to be in code. And I'm also getting some nice resonance from this wooden box that I've screwed the speaker into to act as a soundboard. And that's a little picture of the sequencer there that's running this. I can stop that. So really nice handy for this type of a small project. Maybe this is going to be a battery operated project or maybe you're just trying to get things neat and small and tucked away. This is a really nice option for doing a single speaker, decent sound, but a nice small portable type of project with the amp there. So if you want to take a look at this is, let me turn off the second mic here. Yeah, and Todd made a point over on our Discord. This is the Discord happening over here. Yeah, normally you would adjust the gain one time with your screwdriver. So get it to the spot where it's loud but not over driving your speaker. And then you can do adjustments in software you wouldn't really expect to go in there with a screwdriver a whole bunch to adjust that tiny little trim pot, good point. So if you take a look here, this is the page here. This is product 5647. And you can get it for $2.48 today. You can get up to 10 of them per customer. And if you take a look here in the links below, there's a learn guide that we can check out by Katny.  It is a very efficient amp, talks about efficiency and the types of speakers that you can run on it. And then we have an example of the pinout here as well as some example code that you can use in both circuit Python to play some tones and some wave files and from your Arduino as well. And those examples work well with both PWM outputs and analog outputs if you have a board that has a true analog output. If you take a look in our Downloads section of the Learn Guide, you can get more info about the chip itself. This is the PAM 8302, talks about specs on the chip, as well as typical applications, they say. They suggest I always like seeing these, what they thought they were putting it out in the market for GPS, portable speakers, walkie talkies, hands-free phones, speaker phone, cellular phones. So those are just some of the uses that you can come up with for this. But it's inexpensive, easy to use, pretty much solder-free once you have a wiring solution on one end for this JST connector. And by the way, if you take a look in our main page here for the product, you will see if you're not aware of this, when you go to add something to the cart, you can also say, oh, you know what? Let me include some of the cables that goes with it or sometimes there's other products that go with it. But here you could say, yeah, I want a JST, pH, 2 millimeter, 3 pin, 2 male header cable, and that'll allow you to plug into something like the board that I have here, my Grant Central, which has these female header pins already plugged into it. So let's just plug right in and you're good to go. Let's see, what else? Am I missing anything? Let me know if you have any questions over in the chat. Thanks for stopping by over in our YouTube chat as well. The Quinman16 in YouTube says, they need to make the volume control over I square C. Yeah, you could certainly do that if you use something like one of our breakout Stem-A-Q-T encoder boards. You could have your code looking at that to adjust the volume. And speaking of code, I said I would show you what some of this code looks like. So this is from my Wave Player example here. I'll turn this back on for a second. You'll hear it playing some music there with this little ported speaker.  That code is, is that the one right here? Yeah, so you can see somewhat typical stuff for bringing in audio files, Wave files, and playing them. I'm looking through a couple of directories and playing whatever I find in there that ends with Wave. The key thing here is, this one is importing audio PwMIO as the audio out. And I'm choosing the, in this case, the MOSI pin. And that was just because it was convenient on the QDPI there to put all those in a row there. I could do the MOSI pin for PWM audio out, and then ground and power, or power and ground next to those. If you look at my other example code, this was the SynthIO code based on one of Todd Bot's excellent synthesizers, SynthIO MIDI Synth. And I just made some adjustments to it. The key thing being I'm using audio IO with the DAC. So my audio code right here is audio equals audio IO dot audio out, and then I'm picking one of my analog output pins. So that uses the DAC rather than the PWM. Arguably, you'll get better sound from that depending on your speaker size, the type of sound you're putting out over it, the type of effect you're going for. You can also make the PWM output filter through an RC filter if you want, depending on your needs. But I didn't, in the case of this QDPI, just wired it directly to the amp, and it works pretty well. Let's see. I think that's going to do it. So thanks, everyone, for stopping by. That's it right there. And that, let me go ahead and unplug this and sign us out. So I can unplug that from the QDPI. It's just screw terminals to plug that into your speaker lead, so I can take a tiny little screwdriver there. It's a little flathead. I think LeMore secretly favors tiny flathead screws over Phillips. So that right there is my product pick of the week this week. It is the MAX8302 Stemma Audio Amp, class D Mono 2.5 watt amplifier. Thanks, everyone, for coming by for Adafruit Industries. I'm John Park. And this has been JPE's product pick of the week. Don't forget, you can head on over here until the end of the show, throw these in your cart. You will get them at half off today, 50% off for the audio amp. Thanks, everyone, for Adafruit Industries. I'm John Park. I will see you next time. Bye-bye.


Hey! Hey there, do subscribe! It's me, Logan, back in the game with another reaction video! And now today we're actually going to be doing two Stray Kids reactions, and I'm actually pretty excited for this because the first one is going to be to this final episode of the Stray Kids show for when they were, you know, doing the auditions. Well, no auditions. You know what I'm talking about. Like, their first show where they did the challenges, they were trying to debut as nine, which they did, and we're going to be reacting to the funny and cute moments from this. And then our second video is going to be a reaction to the show, the nine we're going to be reacting to the first episode. I haven't seen it yet, so I'm pretty excited for that. Why don't I just do that? I don't know. So yeah, I'm just excited for today. It's going to be a fun time. We're going to be reacting to two Stray Kids videos, so isn't it going to be awesome? But yeah, I'm going to let these kids straight into this. I'm freaking excited. I hope you guys are too. And let's do this. Sorry, I love doing that. I am good at doing beats with my voice. Oh, yo, Chan. Bang Chan. What a boss. Yo, Ujin. Or Ujin? Ujin? Ujin? Oh, yo. Changbin, man. He is a smayer. See, I always get him mixed up with, is it Minyoung? I'm pretty sure there's Sungmin. Why do I think there's someone called Minyoung? I don't know, but I always get those two mixed up. I already got their names. Sungmin and Younger. I forgot his name. See, they're the only two that I keep on forgetting. Alright, that's a freaking massive lens, eh? Yo, I love this episode so much. It was probably my favourite episode out of the whole series. I love the bundles so much. Bundles are the best thing either, am I right? Yo, Young Wings. It's my bias, Felix.  Oh, yes. How can you... Dancing is one of the things I would love to do. Look at that percentage. It just shows how good the fandom is. Screw that 4%. Screw that 4%. Am I right? JYP is a cool dude, man. He is the same as me. He's just a cool dude. I don't know why people don't like his fashion. I kinda dig it. Like, Turtle Nick? I actually quite like it. I don't like how he's got his pants rolled up, but I just like his fashion, man. Some people just don't like it. The Bundle! I love the bundles. The ships were real in this show. They were legit being like, yo, make these ships, okay? Where are you playing at? You're making these ships. And then it's happened. The ships have been made. Damn! That was unexpected, wasn't it? I don't know why I just dabbed twice. No! The ships! The ships! I was crying in tears when this first happened, man. When I first saw this, oh my god. I legit started crying with happiness. It was so emotional and good. I loved it. I loved it so much. Just saying it's making me sad again. Amazing members. Amazing members. Oh man, that was good. That was real good. Like, oh my god, I'm actually so happy to go over these cute and funny moments all over again. Like, it was good. Just like, going through the highlights of each episode. It really, really did make me super happy. And about like an hour or so after this, we're gonna be having a reaction to their first episode, which I'm excited for. I'm legit really excited for this first episode called The Knife. Like, oh my god, that's gonna be good. Really good. But yeah, this is gonna be all for this video. I hope you guys did and enjoyed. If you guys did, then definitely show some support by leaving a like and also comment down below. I can't think of anything for you guys to comment down below. Do you guys like Pepsi or Coca-Cola? Let me know by commenting down below which one you like more. I know it should be something to do with straight kids, but do you guys like Pepsi more than Coca-Cola? Or Coca-Cola more than Pepsi, because I love Pepsi more than Coca-Cola. Join the Pepsi gang today. Screw Coca-Cola, am I right? Yeah, yeah, and also subscribe, guys, to Nude's channel because there will be more straight kids reactions coming to you guys in the near future. Stay tuned for the one that will be coming out in about an hour or maybe a bit more because I don't know how long it's gonna be for the render since it's 24 minutes long, the actual episode. So yeah, I don't know how long it's gonna render. It shouldn't be too long, but stay tuned for that. It should be out roughly in an hour after this. So yeah, other than that, I hope you guys have a great night. Just keep on smiling and adios, amigos!


I know some of you work your asses off through the week. You do. This channel and my work and coaching isn't just for the elite. That's not what I believe I'm called to do and why I'm here on Earth for this time. I like to help as many people as I can and it would feel strange if I was only speaking to professionals who make a million dollars a year that are really stressed. No. This comes to all of us. In fact, more people who are low income and who are struggling to make ends meet.  I'm going to use the word deserve deserves it the most needs it the most should prioritize that the most.


Live from Austin, Texas, it's theCUBE. Covering Dell EMC World 2016, brought to you by Dell EMC. Now, here are your hosts, Dave Vellante and Stu Miniman. Approximately a decade ago, Michael Dell took a scan of the market and noticed a couple things. One, PCs were not growing. The cloud was just getting into the data center and open source software was finally starting to take hold. Michael Dell decided at that point to affect a major transformation of his company. At the time, he was reselling EMC hardware to the tune of several billion dollars and it was a very successful, but it was not vertically integrated. So he began embarking on a strategy to acquire companies. Equalogic was an example, Perot systems to get it to services, as another example, Boomi to get into the cloud management, Force 10 to get into the networking, Sonicwall, et cetera. The problem was, as a public company, the transformation could not occur fast enough. The decline or flatness in the PC business was not offset by the growth in the new enterprise business. Now, Michael Dell waged an epic battle with the great Carl Icahn, who does not lose often, but he lost to Michael Dell. Michael Dell gained control of his company, took it private. And then, of course, last year in the largest acquisition in computer industry history, Dell announced that it was acquiring EMC for 67 billion dollars, including, of course, VMware. That acquisition was consummated approximately, just slightly less than one year later, just late this summer, after a fairly long, but well understood process of getting approvals from the various regulatory agencies, and including, of course, China. And we'll be talking about that. I'm going to bring in my co-host, Stuart Miniman. Stu, great to see you back here at Dell World. It's good to be in Austin. Yeah, it's great to be here, Dave. Austin, we've always said, when it was Dell World, and of course it's Dell EMC World this year, Dell World is the event that most reflects kind of the local culture. So, you know, Dell is a round rock-based company. We get a good flavor of what happens here. In Austin, specifically, tonight, they've got Alabama Shakes playing, and they're going to have a big ground of food trucks, I'm sure, like they have every year. So it's a phenomenal city, one of my favorite places to visit. And it's a different show than some of the big enterprise shows that people knew. And it's a little bit different feel this year. We've got a bigger set than usual here on the show floor. It's exciting to be here. A lot of people that don't know this show and the ecosystem shown up for the first time. Last year, the press all came on the news that they were buying EMC. Now there's a lot of what are called legacy EMC people. It's the term I've been hearing. And by the way, there's the legacy Dell people on site. So coming together, exciting show, looking forward to the next two days of our coverage. So much to talk about here, Stu. I mean, obviously the acquisition is fresh. I mean, it's only been probably less than 60 days now. So EMC and Dell are obviously working through their alignment, their portfolio, their so-called swim lanes. A lot of that, I think they understood going in, even though they couldn't technically be working on it. But the overlap, as we know, in these two companies' portfolios was not huge. They made a number of indications as to how they were going to organize. We'll be talking to a number of executives about that, including Michael Dell, of course, David Goulden, who's running the, what you're saying is the legacy EMC business, but also includes the server piece of it. And of course, last week, the big news between VMware and AWS, where VMware and AWS are partnering to become each other's preferred provider of hybrid cloud, something that Andy Jassy, a term that he never used to use. So I'm not even sure he's using it now. A lot of really interesting indications as to what that means, who are the winners, who are the losers. We're going to be unpacking a lot of that here. Although it's less directly related to this event, let's face it, Michael Dell owns a majority of VMware. So it's highly relevant. We've seen Stu, EMC for years, leverage its ownership of VMware, walking a fine line between maintaining openness within the ecosystem, but at the same time, optimizing its presence within that very same ecosystem. But Stu, I ask you, is VMware as relevant as it was? And will Dell EMC be able to do that to the degree it was able to historically? And what about AWS? Can it leverage AWS the same way it was able to leverage VMware? Yeah, so a lot of questions there, Dave, and I'm glad we've got almost two days to unpack a lot of this. Yeah, first of all, most of the discussion of that VMware AWS stuff is happening in Barcelona right now. So VMworld Europe's going on, a lot of activity, and absolutely everybody wants to know about this AWS partnership. So first of all, number one, at VMworld, I asked Michael Dell directly, there are people that think that you're going to spin off VMware or you're either going to get rid of them or you're going to completely control them, which is it? And he was like, well, if people think I'm going to get rid of it, they don't understand the math of how I'm financing this and they don't understand the value. I mean, when we used to talk about the EMC Federation, it was VMware is the jewel of this configuration. So VMware is still critically important. They are in just a vast majority of enterprise environments and that's not going to change overnight. At VMworld this year, we spent a lot of time talking about the future of public cloud and how that's really going to grow and it struck people's little odd talking a lot about the futures. Now VMware is saying, okay, we can put, you know, take bare middle cloud in an Amazon data center and run VMware there.  At first it was like, okay, here's the class of servers that you can run on and these IBMs are certified, these HPs are certified. Now, if it's x86, I can run it. Well, where are workloads going and where are the computers today? Well, many of those living in the cloud. So VMware wants to be able to say, hey, if I want to live on servers in an Amazon world, now I have an option. It just really expands what could be a shrinking overall market of servers. If I include those hyperscale players like putting it in Amazon, it keeps that addressable market larger. I've got some concerns about the long-term viability of how that integration, I think the word I think you were using, Dave, is will there be seamless integration? Is this just, if I'm Amazon, I say, great, I'm going to have this stuff coming into my cloud and I'm going to have migration services and all these other things sitting right in the rack next door and wouldn't be easy to just move over here and maybe even want to stop paying some of those Amazon licenses. So something that's going to take us a little while to figure it all out. It's not shipping until like mid next year, which mid next year is when Microsoft's Azure Stack, you will also launch. So 2017 is going to be a big year for hybrid cloud.  So in the cloud space, it's Dell plus Microsoft, big partnership, now VMware plus Amazon, partnership announced, it seems pretty important. How do those two go forward? What does that mean for this whole Dell technologies? And so there's my quick take so far, Dave, but lots of nuance there. Take up on some of the themes you talked about. I mean, I never felt like Michael Dell was going to sell off VMware. I think that would have been insane. And people said, oh, well he'll do that to pay down the debt. I never felt like that was necessary. I thought that would have been a strategic mistake. I mean, VMware is such a crown jewel and a pivot point within the enterprise still.  Having said that, the growth obviously is not going to be the same as it was the last 10 years, but I never felt as though it would make any sense for Michael Dell to sell VMware. What's interesting to me, Stu, in that deal is, and we were talking about this earlier at the analyst luncheon, is Dell's server strategy. So you mentioned Microsoft. Years ago, Michael Dell realized he could make money, packaging Microsoft software and Intel hardware and was very, very successful at doing that, even though it might have been throwing off, you know, 18, 20% gross margin. And he perfected that model with a massive supply chain. Now Dell is what, a $70, $80 billion company now. If not the largest, certainly one of the largest supply chains in the industry. That's the combined Dell plus EMC and the new Dell. The massive supply chain leverage that Dell EMC has. As a result, Michael Dell, I think, is looking at every option. I mean, he's always been about the customer, right?  What does the customer want? It's like, it sounds so basic, but it's true. And you hear Andy Jassy say the same thing. The difference with Dell historically has been, if the customer wants it, they'll figure out how to get it and they figure out how to make money because Dell is a low cost supplier. So Amazon, great, we can resell Amazon, make some money there. Nutanix, we can resell Nutanix, make some money there, no problem. Again, this is a company who's been living in the world of 18, 20% gross margin. Now you blend it with an EMC, 60% gross margin business. This is gross margin heaven for Michael Dell. So as a result, see a lot of ways that Dell can continue Dell EMC, can continue to make money, continue to throw off cash, pay down the debt, doesn't have to worry about stock buybacks and dividends anymore. I don't see that as a huge problem. We're going to ask Michael Dell about it. Yeah, so Dave did just a comment on those two examples we gave. Number one, it's not a resell of Amazon that Dell's doing. There's actually, that VMware's doing, it's actually going to be like a VMware zone inside an Amazon data center. And VMware will, they're going to configure it, they're going to support it, they're going to sell it. It's like I've bought, it's more of a VMware Colo than it is an AWS resell. And the other piece- So are they not getting points on the Amazon piece or are they just getting points on their own piece? So we don't know anything about pricing, but the expectation, if they do this right and I'm sure, you know, when you look at both of those sides, that they will be very diligent about what they do, they will price it to make sure that there's an incentive for Amazon to make sure that this works and that the Dell, I'm sorry, the VMware people and the VMware channel will embrace this and work there. But the other piece- There's got to be some way for a Dell to arbitrage that, for a VMware to arbitrage that. If they're going to be packaging and selling that solution, they're certainly going to make money off of their own software. And there's got to be some look off the cone for AWS or some way to arbitrage it because they'll be buying in volume, right? Absolutely, I mean the hope for both of them is that they get a bigger piece of the overall pie. Microsoft is the competitor that they're trying to beat in that space. The other one you mentioned was Nutanix, which is an OEM relationship where it is Dell's hardware. Dell feels that they have a differentiated solution compared to what I would buy separately from Nutanix or from the other OEM solution, which is Lenovo. And so, you know, Dell put some skin in the game, make sure that they're putting some of their own IP, not just kind of the might of their go-to-market and their whole supply chain. So Stu, we know that Amazon buys, just taking Amazon as an example, certainly we could use Microsoft and Google as an example, but we know Amazon specifically buys servers from ODMs. We know that. So, and we know Dell competes with the ODMs. So Dell, with a $70, $80 billion company with the biggest supply chain or one of the biggest supply chains in the business, why can't Dell compete for server market share within the big hyperscale audiences? Why not? So Dave, great question. I love it and something we want to dig into here. I'm not sure that Dell will make much comment, but. Matt Eastwood will. We got Matt Eastwood on the queue. We're going to talk about it. So two points on that. Number one, in the Amazon space, this is a new bare metal offering. And I'm sure Amazon is going to put out an RFP and I mean, I'm sure Dell is going after that. Heck, I'm sure Lenovo is going after that. The second piece there.  What's going on with this deal? You know, if I'm Dell, and my question I was thinking about this, Michael, first of all, I mentioned, Michael's not selling off VMware. Michael is also letting VMware be independent to an extent. But what's in it for Michael? And if Michael can get server footprint into Amazon, that is huge. And they've already got footprint into Microsoft's. The other piece on that, you know, when they talk about the whole EMC, which by the way, the EMC people, they say it's a merger. Michael Dell and kind of the MSD Ventures bought it, but the companies were actually, it's a merger, not an acquisition, just as the terminology that they use. I know, well, we'll go call it an acquisition. But a conversation I've had with Matt Eastwood over the years in my history at EMC, EMC sells a ton of appliances and a ton of solutions that have x86 inside. A lot of that was ODM technologies. You started to see solutions like in the hyper-convert space with Quanta. You know that all of those are switching over to Dell hardware.  At the end of the day, I always look, it's like Cisco cares about, you know, how many boxes that they can sell, kind of that core networking. And at the end of the day, Michael wants to sell more servers. So if you fall back to those basic principles, you would think that he's got some way that if more things are going to cloud, he's going to get a look off the cone when it's Microsoft or where it's Amazon. And what about Google? You know. The other thing we have to talk about, well, and we could come back and talk about Google because where was Diane Green in this whole deal? But anyway, well, the other thing we have to talk about is channel. So the channel right now has got to be wondering what's our future, right? So you've got a company EMC who's done a remarkable job with the channel, but you know, it was a direct sales force company and still has a direct sales force ethos. As does Dell. So the channel is going to be wondering, okay, what's going to happen to us? How is Dell EMC going to rationalize the channel? What's the messaging that's going out to the channel? What are you hearing? So last year, there were a couple of big, you know, EMC channel partners that came here to Dell World when it was Dell World last year and asking all those questions. And absolutely, the channel understandably so gets a little bit of trepidation when they look at these two pieces coming together because you've got Dell channel, which kind of happy. And now you've got all these big EMC partners and you have an EMC channel which, by the way, has a lot of partnerships with like Cisco and Cisco UCS. I mean, that's what Vblock has sold $3 billion worth of solutions last year. There's a lot of Cisco. So putting those together, yes, we're going to have choice and we're open.  So some of the compensation models are still being sorted out, how services fit between Dell EMC and the channel. I hear there's a little bit of friction there and concern. So, you know, a lot of these things, Dave, it's like, I'm sure they're all saying, hey, we're going to have a great plan in place for 2017. You know, we're not going to mess anything up in 2016, but it is something that, you know, I hear that there's some bumpiness and I'm definitely looking forward to digging into more this week. Well, why is this a new era? Let's talk about that a little bit. So with EMC and Cisco who have historically and still have a very strong relationship, Cisco didn't have storage for the most part and EMC didn't have any networking. So they had to rely, you know, almost exclusively on Cisco for networking. Of course, it did some other stuff with Brocade and others, but really Cisco was its primary networking partner. Dell has networking. Dell went out and bought, you know, networking companies and was in that business and granted, you can say it really wasn't at the core and okay, there wasn't maybe a huge overlap, but now you've got this sort of three way interesting mix. Yeah, so Dave, it was really interesting. So right, Dell bought Force 10. Tends to be more on the campus side, tends to be much more in the edge, not strong in the core, but when I hear the messaging, there was a really good interview with Michael Dell and CRN leading up to the show. And when they asked Michael about networking, his answer was NSX is growing great. And I'm like, wait, that's the networking on the virtual side that totally, we've sorted through how NSX and ACI and Cisco fit together, but you're right. They have some core networking pieces. They report to David Gould and absolutely something we're going to talk to David about shortly, but you know, I don't hear Dell trying to be a powerhouse and networking, the message you hear from Michael is that Cisco will be a long-term partner in many ways and Cisco gets the networking, if we can get the server is kind of, I think the deal they're trying to make. I mean, Cisco's really in the business of selling ports. Yeah. Right? And NSX is all about virtualizing those ports. Wait, Dave, isn't this all software world? Why are we talking about boxes and ports and all this stuff? Somebody's still got to make some money on hardware, right? Ever since I've been in this business too, they told me that hardware is dead, but still got to run on something. Oh, come on, you know, software comes and goes, hardware is forever. And the truth is forever as well. So we're here trying to unpack what's going on at these shows. It's actually quite a complicated mix for a lot of people. You're going to hear some, I think, attempts to simplify that messaging, really drive it to the customers. What do you want? You're going to hear a lot about openness, I'm sure, a lot about choice and a lot of fun because it's Austin. Absolutely. I mean, we're digging in some customers looking at things like IoT and security, two hot areas that we've been spending a lot more time recently focusing on because that's some of the disruptive areas and things that are changing. Real good lineup of all the executives. Dell is a great host here and it's exciting to be here. We're going to have a little smattering of some of what used to be called the Federation at EMC. Now it's sort of Dell Technologies. The Federation 2.0, if you will, have some folks on from Pivotal talking about their big data stack. We've got to be drilling down into servers, certainly storage is a big theme of this event, networking, so we'll be covering it wall to wall. You're watching theCUBE. We're live from Dell EMC World in Austin, Texas. We'll be right back after this short break.


Our lives, careers, success, failure, etc. all depend on us. It all depends on what we do and what we don't do. We are entirely responsible for our lives and so, to make any difference in our lives, we need to, first of all, understand that we are solely responsible for bringing changes to our lives. No one's going to do that for us. Devin Kovie, an American educator, author and businessman said, we are the creative force of our life and through our own decisions rather than our conditions, if we carefully learn to do certain things, we can accomplish those goals. According to Janice Trachman, an inspirational speaker, everything is within your power and your power is within you. When you understand how much power we have to change our lives for the better, taking steps to do this becomes easy. Kevin Michael, an Australian politician said, small shifts in your thinking and small changes in your energy can lead to massive alterations of your results. Now that we understand this, it becomes easy to take specific steps that can change our lives for the better. In this video, I'll share with you 9 tips to change your life for the better. If you are new here, consider subscribing so that you won't miss out on other exciting videos like this. 1. Decide to be fully responsible for your life To change your life, you have to be ready to take responsibility for your actions. Whether they yield positive or negative outcomes, you do realize that when you start taking actions to make changes in your life, some of them will bring excellent results and others might seem like a total waste of your time and effort, right? However, when you understand and admit that whatever result emerges, you are responsible for dealing with the consequence. It will be easier to accept change and open up yourself for opportunities that might bring about a difference in your life.  Every situation is responsible for your present predicament. The Boots, an American author, former attorney, and former conservative radio host once said that, The key to accepting responsibility for your life is to accept the fact that your choices, every one of them, are leading you inexorably to either success or failure. However, you can define those terms. 2. Find out the things that are important to you What does life mean to you? What do you want to spend the rest of your life doing? What drives you? How would you like to spend your entire life doing without getting paid or pressured by anyone to do? These are some of the questions that will help you determine what's important to you. To change your life effectively, you have to know what specific things you want. It'll help to see the direction you want your life to go so that you can force your energy and time there. To change your life, you'll have to find a course that drives you. Hear something you should know. Challenges will arise in the process of taking steps that can change your life. However, the only reason why you won't give up quickly is that your quest means a lot to you. You are passionate about it. 3. Set goals and plans to help you achieve your dreams Because you know what is crucial to you. You can set goals and plans that can help you achieve that dream. And doing this can change your life positively. Tony Robbins said, Setting goals is the first step in turning the invincible into the visible. Setting goals will help you channel your energy into achieving those dreams. Norman Vincent Peale, an American minister and author, said, All successful people have a goal. No one can get anywhere unless he knows where he wants to go and what he wants to be or do. Not only should you set goals, but also create plans that will help you achieve them. Your action plans should be detailed enough to highlight the step-by-step process needed to accomplish your vision. Mark Victor Hansen, an American inspirational and motivational speaker, as well as an author, said, By recording your dreams and goals on paper, you set in motion the process of becoming the person you most want to be. Put your future in good hands. Your own. Or, start at the end of your goal. Since you have a goal for your life, you can do well to work your way from the end to the beginning. Start from your destination and work back to where you are. Identify the steps necessary to get to your goal and start taking actions, one at a time. Say you want to become the youngest designer in the world, start by highlighting the steps needed to get there. To be a designer, you must understand a lot about art, fashion and design. Art means that you need to go to a fashion and design school. You also need to go to an art school. Also you need the basic knowledge of textile and fabric, sewing, drawing, body measurements, ETC.  With this, you can now start taking the necessary steps one at a time until you accomplish your goal of becoming a designer. 5. Step out of your comfort zone. There's a whole lot out there that you can explore, a lot of opportunities and adventures. But how do you get these goodies if you are not willing to step out of your comfort zone? According to T. Harve Ecker, an American author, to move to a new level in life, you must break through your comfort zone and do things that are not comfortable. If your goal is to change your life, then it will help to learn how to face your fears by stepping out of your comfort zone. 6. Invest in yourself. Learning encourages us to be more creative and innovative in our thinking, making us more comfortable with the unknown. To change your life for better, you have to be willing to attempt new challenges. Take risks and open yourself for new opportunities that can help you discover a thing or two about yourself. However, to do this, you have to be equipped and that's where self-development and investment comes to play. Find ways to keep learning and growing. 7. Network with successful people. Success doesn't happen alone. You need trusted people along the way, a healthy support system that will help you deal with pitfalls of life. If you want to be better, then you have to be around people that want nothing more than to be great. And the Larrish quote states that, if you hang out with 9 successful people, you are bound to be the 10th. Likewise, if you hang out with 9 broke people, you are bound to be the 10th. So find the right company because being around them will improve the quality of your life. 8. Learn how to manage your finance. The truth is that if you want to be happy and prosperous, it will help to learn how to manage your finance responsibly. I mean, you don't need to make so much money to be satisfied, you only need to handle what you have excellently. When you learn to manage your finance, your life will change forever because you will become financially independent. And we all know that a part of making your life change for better means having your financial freedom. 9. Take care of your health. Your health is the most critical asset that you have in life.  When you're healthy, you will be a better person to handle specific inevitable life challenges better. The result of this is that your life will be better. There you go. Thank you very much for watching our videos. If you like this video, watch more videos on our channel and subscribe. We love you.