During the painful, panic winter of 1837, America's first identifiably libertarian political party neared the end of its short life. After the February flower riots and facing nothing but dire circumstances, movement faithful gradually peeled away from the party. Radicals called another park meeting for the 6th of March, despite threats of military force, and the crowd was reportedly even larger than the month before. Party historian Fitzwilliam Birdsall said 30 to 40,000 people showed up. There was life left in this movement, to be sure. But the politics of it all collapsed when depression closed in around the country. Welcome to Liberty Chronicles, a project of libertarianism.org. I'm Anthony Comegna. At the March 6 park meeting, the massive crowd of proto-libertarians, loco-focos, equal rights democrats, whatever you want to call them, they chose Alexander Ming Jr. as presiding officer, and pamphleteer John H. Hunt to write up a report. Hunt's report put theory and history in dialogue. It helped provide ideology and inspiration for activists to push beyond mere politics. Hunt wanted systematic thinking about why wheat prices were high. In a truly free society, high prices could only be produced by scarcity, and scarcity only by bad seasons, war, or other calamities. But there were no wars, plagues, or famines in America at the time, and Hunt's analysis targeted instead the rise of wage labor, capitalism, and the corporate interventionist state. In his 1842 movement history, recording secretary Fitzwilliam Birdsall reprinted the speech in full. The history of the loco-foco, or equal rights party, by Fitzwilliam Birdsall, New York, 1842. Report If society were in its natural state, if each man were permitted to exercise untrammeled, those rights and powers with which the god of nature has endowed him, high prices could be produced only by scarcity, and scarcity only by bad seasons, war, or other calamity, or improvidence. But our people have not been at war. They have not been unusually wasteful or lazy. They have had but little sickness. Save that heart sickness which must ever be felt by all who are conscious menials of speculators and drones. And even admitting that the season was as unfavorable as interested persons pretend, there certainly has been no blight or mildew sufficiently destructive to cut off our coal mines, or create a scarcity of lots and houses. We must therefore look to other causes, and as the true ones are plain and simple, we will state them in plain words. In perhaps all densely peopled countries, that earth from which everything must draw its subsistence is considered the exclusive property of a chosen few, not one in fifty having the legal right to plant a fruit tree or a potato patch to keep his family from starving. Those who are thus excluded from the common bounties of the great creator are consequently compelled either to return the glorious gift of life, or else to support it by selling their strength and skill, their only property to the highest bidder. The price of strength and skill, or labor, is naturally governed by the relative number of those who are struggling to sell and those who wish to buy. In a new country, where the possessors of strength and skill are greatly needed to erect mills and dwellings and to fit the wilderness for the cultivator of the ground, they enjoy nearly as much of the fruits of their laborers as their landowner, and are esteemed according to their virtues. But the forest once subdued, their services become less needed, while their numbers continually increase, and the landowners, no longer eager competitors for the services of the laborers, are surrounded and courted and flattered by miserable competitors for servitude. The strength and skill of the surplus poor is next directed to manufacturing and the mechanic arts, and a similar round is traveled on a new course. It is not long since an expert artisan could earn the price of a barrel and a half to two barrels of flour per week. Yet now, we see before us only the prospect of being slaves so long as we are able to toil, and poppers when we can toil no more. To make matters still worse, our own poor are forced to compete in every way with immense numbers of foreign poor, who have severed the ties of country and home hoping to acquire here by their industry and skill, that independence which their industry and skill could never buy in the land of their fathers, but who find themselves doomed to share and to augment our evils. But there is another great cause of high prices, so monstrous in its nature that we could hardly credit its existence were it not continually before us. We mean the curse of paper money. Gold and silver are produced from the earth by labor. They are, or ought to be, earned from the producer by labor. And the man who has earned a portion of these metals by honest labor harms no one by selling them for labor to others. No man nor combination can by Christian means collect a sufficiency of these metals to enable him to engross the food or fuel or houses of a nation. But a leaked band of paper promise co-workers exert absolute control over the whole wealth of a country. They can print off the nominal value of our whole wheat crop in a few minutes, and as they draw compound interest on all the debts they owe, the more they owe, the greater their income, and the more absolute their power. Whereas the banking system of the states of the union, and more especially the safety fund bank combination of the state of New York, is a hydro-headed monster preying on the useful classes of this community, impoverishing the great body of the people, defeating the proper exercise of their rights and liberties, subverting the constitution of the United States, and the vital principles of democratic republican government. Therefore, we declare it as our solemn belief that the bank oligarchy is the worst that ever existed upon the face of the earth, because it is founded on avarice, the basest of all human passions, and the one of all others that has the least regard for the benign precepts of religion or the happiness of the human race. Meanwhile, Locofocos were still battling timony over policy and political supremacy in the Democratic Party. When conservative Democrats failed to appoint Locofoco Assemblyman Clinton Roosevelt to the chairmanship of the State Bank Investigation Committee, supporters published a letter in his defense. The new chairman suspected that Roosevelt himself was the author and antagonist, and they determined to prove it. The committee then ordered Moses Jakes and Levi Slam to appear in Albany to discuss the matter. Both were major Locofoco activists, officers in the Equal Rights Party, and public leaders at the raucous park meetings. Even if they committed no crime, they were valuable targets in the ongoing party wars. Jakes and Slam demanded that the legislature defray their expenses. Outrage that their response, the committee pronounced them in contempt of the summons. The men were arrested, imprisoned at Albany, and questioned. On the 8th of March, they offered a statement of protest to be read into the record, but several members shouted them down, saying the Locofocos impugned the honor and dignity of the House. When Moses Jakes personally spoke to the House of Assembly, he denied any charges of ambition or agrarianism, getting up mobs and corrupting men's thoughts for political gain. Such, he said, has been the fate of all reformers in all ages and in all countries, and then he promptly compared himself to Jesus Christ. The New York State Assembly played the Roman Empire. He concluded with a brief family history. Jakes' ancestors settled in New Jersey about 1640. Survivors of a long line of Huguenots and Patriots stocked the family tree ever since. Birdsall said that he gave the members the best lesson they ever received in American constitutional democracy, vulgarly called Locofocoism. Birdsall concluded his narrative of the kangaroo court by revealing that it was he who wrote the petition and not Jakes, not Slam, nor certainly Clinton Roosevelt. Back in New York City, Locofoco meetings roared in support of the persecuted brethren. Locos passed resolutions condemning the House and even composed a song of support. The party defiantly nominated Jakes for mayor in the upcoming elections, and Slam continued his role as a popularizer of Locofoco ideas. For his part, Fitzwilliam Birdsall resented Slam a great deal, and considered him an opportunist, a self-aggrandizer, even a demagogue. Slam exploited populists and romantics within the Locofoco Coalition, and he swayed with the winds of popularity. He was more or less your typical Jacksonian era political operative, but by this point in his life he was tethered to radical politics for good. When Birdsall wrote his history in 1842, Slam was the primary advocate of Locofocoism in New York City, and helped shape the movement through the next decade, sometimes for the better, but more often for the worse. On April 3, 1837, Seth Luther, Levi Slam and John Hunt hosted another great park meeting, steeped in the language of class division and conflict. Hunt's resolutions compared modern social conflict with clashes between rulers and ruled throughout the ages. The world has always abounded with men who, rather than toil to produce the wealth necessary to their subsistence, have contrived to strip others of the fruits of their labor, either by violence and bloodshed, or by swaggering pretensions to exclusive privileges. It is, however, chiefly by this latter mode of robbery, that the working classes of modern times are kept into basement and poverty. Aristocrats have discovered that charters are safer weapons than swords, and that Kant, falsehood, and hypocrisy serve all the purposes of a highwayman's pistol, while they leave their victims alive and fit for future exactions. Thus have the producers of wealth been kept for ages in subjection to a wicked confederacy, whose interest it has been to sow strife and dissension among them, lest they should unite and redress their wrongs, to paralyze their intellect, lest their own pompous pretensions should become objects of ridicule and derision, and to subvert the moral sense of mankind, lest themselves should become objects of universal execration. It was the curse of such an aristocracy that drove our fathers to the savage wilds of a distant continent. It was the hope of releasing us, their descendants, from such a thrall drum that supported them during the terrible struggle of the revolution, when they boldly advanced against the meridians of injustice, leaving the bloody tracks of their unclad feet upon the frozen ground. Our fathers performed their duties well, but we have neglected ours, and hence our suffering. We have suffered our political power to fall into the hands of men who fatten on the diseases of the body politic. The resolutions finally called upon working people to combine their strength, reject violence, and assert their power through the democratic system. Moses Jakes received about 12 percent in the spring 1837 elections. Locofocos again held the balance of power between Tammany's 39 and the Whigs 49 percent. Democrats lost the city government in a clean sweep, and Tammany was furious, but still the Locos organized, combined, and held their meetings. The New York City bank runs during the Panic of 1837 began on May 7th. The banks had far overextended themselves over the years, and now could not pay liabilities in specie. Counters closed, and depositors were turned away. Bankers and officials feared mob violence of the sort during the flower riots. After three tense days, the bank suspended specie payments entirely. In the state legislature, the same banking committee that interrogated and even jailed Moses Jakes and Levi Slam was charged with investigating the health of every bank in the state. Astoundingly, they determined that each and every one was sound and well or ably conducted. The financial calamities of May 1837 provided the public a thorough demonstration that the much extolled credit system was in reality a system of debt. Clearly, the whole system was a fabrication, a tissue of lies, and cascading crimes. The Panic of 1837 deeply wounded Locofocos in their daily lives, pushing ever larger numbers to voice their anger at park meetings or abandon the fight. At a 5th of June meeting, members called for another state convention at Utica in a park meeting to address the high price of flower. On the 24th of June 1837, the largest concourse ever assembled in the City of New York gathered at City Hall. Combination, manly virtue, and an unbendable political will could effectively meet the power of the banks. The final check on the power, influence, and destructive capacity of the banking aristocracy was simply to let credit alone. Throughout the summer of 1837, Democratic President Martin Van Buren proved to be this very sort of non-interventionist, and it appeared to many that Locofocosism had taken Washington. But while Locofoco influence at the national level had reached its greatest point, the Equal Rights Party organization was incapable of matching it. The 1837 state convention at Utica suffered because the Central Committee of Correspondence did not announce the date to other committees around the state. Then the Utica Democrat published the wrong date. Most counties had no representation at the convention, which was absorbed in drafting a new party constitution that defined their movement. In Fitzwilliam Birdsall's mind, Locofocosism was no different than Christianity. It was Christian democracy, a mix of the Golden Rule and the Kantian moral imperative. He defined Locofocosism simply as, those acts which are naturally, politically, and morally right, which may be done by all, without injury to any. The party constitution demanded reform after reform, equal laws, the abolition of corporate charters, the protection of justly acquired property, the abolition of exemption laws, prison and justice reform, including abolishing the death penalty, debtor's prison, and prison labor for state or private profits. By the fall of 1837, both Tammany Hall Democrats and the Locofocos loved Van Buren's administration so much, that reunion was now a real possibility. At a 24th of October general meeting of the Equal Rights Party, some members moved to support a single Democratic ticket. Tammany nominated five Locofoco candidates for assembly, and the Equal Rights Party leaders requested resignations from candidates not on Tammany's ticket. Job Haskell refused, igniting a battle between unionists and separatists. A vote of 71 unionists against 22 separatists confirmed Berzel's worst fears, that these pledge makers became the most violent and shameless of pledge breakers. Reunionist sentiment sent attendance at Locofoco meetings plummeting, and Tammany adopted a declaration of principles essentially the same as the Locofos. The Equal Rights Party then split between a unionist majority, called Buffaloes, and a minority of separatists, the Rumps. Berzel described the conflict as particularly bitter, violent, and nasty. Charges of corruption and other mixed motives flew with abandon, and factions refused to even meet in the same room. The Rumps nominated their own ticket for local offices. Job Haskell received the greatest number of votes, a mere 371. Berzel mourned, Mr. Slam was chosen to be the executioner of the final act, by those who conspired for the purpose. Slam was the new recording secretary with constitutional duties to call meetings, and he refused to do so until most all Locofocos filtered back to Tammany and the Democratic Party. The separate party died, but Tammany still failed to win back the assembly in November. After the reunion, they gained back seven of the 12 percentage points lost in the schism. A crucial five percent of the electorate remained independent, and Locofocos survived. The Locofoco movement did not die with the Equal Rights Party, and this show will continue their story all the way through. For the moment, they had shown enough strength to be feared, if not properly respected. In the short term, defectors gained office and influence, but the workingman Locofoco war against Tammany was more than a mere factional battle over the party leadership in New York City. In the long term, the new alliance lasted a decade and created a revolutionary new state constitution for New York. The coalition ruptured only from the powerful influence of the slavery and territorial issues. Wistful over the political losses of its cause and the decay of Locofoco camaraderie, Fitzwilliam Birdsell mourned the emptiness of the military and civic hotel, that old secret meeting place of the original Lococonspirators. Gradually, the Locofocos of both sections became merged in the Democratic Republican Party, and they brought not only their new fangled notions with them, but also their significant designation as a party. The glory of the military and civic hotel departed with the Locofocos. There were no more meetings held there by those enthusiasts, and no enthusiastic cheers resounding within its walls. Neither was there any more transparencies with terse mottos and inscriptions to adorn the venerable casements. The old mansion became deserted and cheerless, for there was only one Locofoco, Robert Hogburn, who made it his haunt as usual. He was the last of the political covenanters, and the only one who went there regularly, month after month, on the evenings appointed by the constitution for the meetings of the faithful. And he would bide there, solitary and alone, until 10 o'clock. The hope within him that the Locofocos would gather themselves together in the Babylon of their captivity. In order to direct their steps back again to the renewal of their venerable temple, but they never returned. The old military and civic hotel fell into decay, and at length was pulled down.  But Locofocos did not die. It lives forever in Christian democracy. That democracy which, while it concedes to the majority the powers of government, does not allow to it the right to do wrong, but restrains it by constitutions drawn from the paramount love of God and the principles of Christianity. Birdsall published his history of the Equal Rights Party in 1842, perhaps in part inspired to do so by the latest awakening of Locofoco activists, the door war in Rhode Island. Between his time as recording secretary and his time as movement historian, Birdsall saw Locofocos go nationwide. Radicals all over the country, read William Leggett. They followed the ERP's war on Tammany. They conspired together in their own local cabals. They sought revolution, civil war, a class war to end all class wars. Locofocos almost bathed Rhode Island in blood, and they elected a president of the Republic of Canada. They added stars to the flag and dreamed of America's libertarian manifest destiny. They fancied themselves the world's liberators, and suffered their own martyrdoms in Tasmanian prison camps. Though we have forgotten them almost completely, the Locofocos transformed America. Liberty Chronicles is a project of libertarianism.org. It is produced by Test Terrible. If you've enjoyed this episode of Liberty Chronicles, please rate, review, and subscribe to us on iTunes. For more information on Liberty Chronicles, visit libertarianism.org.


Now auto light and its 60,000 dealers and service stations present Suspense Auto light brings you miss Betty Grable in the copper tea strainer a Suspense play produced and directed by Anton M. Leader Friends even a camel can't compete with an auto light stay full battery because an auto light stay full battery needs water Only three times a year in normal car use Yes, sir that dandy dynamic dependable auto light stay full battery needs water only three times a year in normal car use an Auto light stay full battery has extra plates to for extra power Protected by fiberglass insulation for longer life and stronger life Why in recent tests conducted according to the Society of Automotive Engineers life cycle standards Auto light stay full batteries gave seventy percent longer average life than batteries without all these features So remember be battery right switch to auto light And now auto light presents Betty Grable in a tale well-calculated to keep you in Suspend I was in the two by four dressing room changing into my street clothes It was raining beating down on the low skylight like a fury It made such a racket that I didn't hear a thing Until a buzzer rang and the outer door closed open But first I heard your voice. I was sorry for you. You sounded tired and you had a cold You'd be surprised if I ever told you but I wasn't frightened at all when you spoke to Irwin You the photographer who runs this place. I'm James Irwin, and this is my photo agency. Yes You have some work to do I got work to do There are dame named genie done here Irwin When you said my name, I got a little scared without knowing why I'd been modeling a sun suit and I was cold anyway Irwin was never a guy to pay for decent heating Now I got cold way inside my fingers tremble as I tried to zip my dress I leaned against the partition to try and hear better, but the rain was too loud. I couldn't figure out why I was so jittery I I was blank. I couldn't remember what had happened all day or yesterday But I knew you were dangerous to me, and I had to find out why I Opened the door a crack to hear better.  Say you was easy easy.  I'll tell you all I can't believe me. I'll cooperate I believe you you're the type I couldn't stay out of sight any longer I slipped into my shoes and stepped out from behind the door What do you want mister?  Hey, what happened shut up? I'm talking to miss Dunn He's got a boyfriend, too.  Hey look miss. Get out Okay, all right Thanks for that anyhow, but look about Ted war if it's anything you're trying to pin on Ted then Irwin's right I won't talk I didn't mention that name did I Ted wouldn't do a thing nothing wrong What time do you usually leave home for work miss about eight if it's any of your affair? Yes, I'm afraid it is Could you be more specific? Describe your routine say this morning for example This morning. I I've had such a headache all day. I really don't know about this morning actually I Can't remember Most mornings.    You'd better take care of that call mister. Thank you Are your mother and Ted walk friendly you better take care of that cold I Repeated that stupidly so as not to hear your questions Then I stared at something you fished out of your coat pocket I felt the arteries jumping on the sides of my neck. You were looking at my neck Maybe I could ask you some time if that was a tip-off you learn by studying people like me You toyed with the thing in your hand and it picked up a sliver of light from a flood lamp It's sparkle like a a jewel only it wasn't any more jewel and any of the junk on my bureau It was a common tea strainer made out of bright new copper You watched me and spun the thing by the handle between your finger and thumb I couldn't stop looking at the shiny wire mesh like a Net well miss. What do you say?  Suddenly my mind cleared everything.   I tell you have they inhibit my artistic expression I want to sling wonderful words about my personal experience with auto light stay full batteries And all they'll let me say is not all I'd stay full battery needs water only three times a year in normal car use Yep needs water only three times a year in normal car use. Well, that's important What's more happen auto light stay full battery has extra plates protected by fiberglass insulation for a stronger life Longer life folks want to know those things Harlow No, maybe so and in recent tests conducted according to the society of automotive engineers lifecycle standards Auto light stay full batteries did give seventy percent longer average life than batteries without all these features Well now Harlow folks should be told those facts. No, maybe you're right. Have maybe I shouldn't be angry Maybe I should put in a commercial right here, which too late Harlow here suspense And now auto light brings back to our Hollywood soundstage Betty Grable as Genie in The copper tea strainer a tale well calculated to keep you in Suspend Can you faint dead away and keep sitting in the chair talking and acting normal? I did mr. Detective at the side of the tea strainer. You kept spinning between your fingers Cold blackness paralyzed me and our two voices seem to be coming from a great distance.  Why miss nothing?  I wasn't sure but the word started memories flashing through my mind like jumping movie scenes You studied me with your tired expression massage But you couldn't see into my memory The nagging pattern of my alarm clock at home was waking me one morning any morning except today The others were all alike for the last ten years Right you devil get up Another day dear. Yes, mother sleep well. I'm always in pain. You know that dear If you're up you could rub my back a while before you have breakfast here. Yes, mother.  Oh, I'm not complaining.  It's getting low and I can't bear I'm sure there's plenty mother. I'll get it for you now when I wish you would I don't know Went into the bathroom while mother kept droning on and on The bottle was almost empty Mother you haven't been taking more than you should have this have you don't be absurd You heard the doctor say that my medicine more than one capsule a day is poison She talked and talked accusing me of being careless with her medicine and neglecting her She said if it hadn't been for me she would still be on the stage and famous But I realized she was in pain and unhappy and some mornings I was afraid all of my strength would be drained before I could get away from her Especially when she harped on Ted and me getting married And dear don't be angry, but I simply must ask whether you're serious with your young man this time This time what after all Jean in the past years? There were several young men I certainly thought you were going to become engaged to and every single one lost interest. Oh mother Yes, they did you can't deny it at your age dear a good has to consider her future and now that young man William something he surely wanted to marry you and he had a bit of money too now Why did he stop coming to see you dear was it anything you might have told him? You're trying to use me to excuse your own shortcomings there, but on earth how could I scare away any of your young men? When I was on the stage young men used to flock around me like bees and now your Ted certainly thinks Well enough of me to bring me flowers and look at my scrapbooks Even if my own daughter I wonder how long that will go on When will you ask him whether he thinks the daughter has the right to let a helpless old invalid die alone? Horrible horrible girl. Have you asked him that already after the sacrifices I've made for you ruining my own health Destroying my youth and my career so that you would have the best from life. Oh mother Perhaps the easiest way for both of us would be for me to not try and Hang on to this mortal coil any longer Close my eyes and never wake up She used death as a weapon against me many times I felt weak and nauseated although I was certain she was bluffing And I would rush out with no breakfast and a panic to feel a healthy life of the city around me and lose myself in the traffic and crowds Rotten deal isn't it miss, huh? Honest, I'm interested in you and Ted walk you serious about each other. What are you getting at mister? What's happened? I have a right to know really in love He paid no attention to my panic you kept prodding me with that question and twirling the tea strainer Faster now it seemed to me Was I really in love with Ted? I Couldn't have answered even if I'd wanted to How can you tell a stranger your dreams? Miss tell me Exactly. What's the matter with your mother? What treatment is she getting? That was funny Ted asked almost the same question last night You'd give a lot to know about last night, but you'll never get a word out of me If you had seen Ted and me last night, you wouldn't have had to ask if we were in love Last night was one of those miserably few times I found a neighbor to come sit with mother and Ted took me to a little neighborhood bar where they have a jukebox and postage Stamp dance floor. We were dancing crowded in like cigarettes in a pack How about a kiss baby Ted not right here in public Nobody here but us genie us in the mob Anyway, it's just as crowded at zeroes. They tell me well, we'll get to the ritzy places someday baby We got it coming to us darling. You make it sound real sometimes You stick it out a little longer, baby, and it will be real just trust me. There's always ways sure a million bucks Million would help and I'll forget the gloom honey.  Well, there is a booth. Hey, watch where you're going. You're big Don't start a fight. Come on. Yeah, I should have poked them Maybe you'll tame me down baby Here sit next to me, huh? I don't want to reform you darling.  Oh, baby. I I don't know the words like you do How can I tell you you don't have to tell me in words, darling? I want to those somehow I want you to know I I Love you genie more than at first and I was crazy about you there We could be so happy together together Yeah, that's what we both want more than anything else in the world. Isn't it baby Ted? What's the matter? Huh matter. Oh, there's nothing a matter. I just figuring things out. What are you folks have fun? Oh? What'd it be honey beer's fine to be it? Then we'll have to be leaving I promise Mrs. Grogan. I'd get home by midnight. Oh, baby You promised me would make a night of it. I'm sorry Ted, but mother was worse this evening before I left Jeannie, what really ails your mother the doctor has a long list.  Tell me the truth Has she gotten to you with her her talk?  She said that huh? She did I'm glad I know that I'm glad I know that for sure. Look, maybe it's because she's sick. Maybe maybe she's not getting the right treatment Say, what is the doctor giving her some stuff and capsules mixed with strictening strictening Fine That's poison. Yes. She has to be very careful You were Need a prescription for that. Don't you uh-huh here? I'll show you the prescription. I have it somewhere in my handbag Oh here Yeah, my Latin soda rusty. Excuse me Ted. I'll freshen up and we'll go be right back. Okay, baby The mirror and that dingy little powder room was cracked and clouded, but I could see my own face all too clear as I tried to dab on some rouge My face was an old face the thin cruel mouth. I Tried to remember how I looked ten years ago when I had the screen test. I was Garbo and Dietrich only younger the director said It was then my mother started getting sick and needing me I looked into the mirror and saw my strange pinched face That was when the whole plan formed in my mind as I stared into that cloudy mirror Excuse me, you better take care of that cold.  Did he ever say that she stood in the way of your marriage? I never told you any such thing Ted wouldn't have done what miss Mother's dad isn't she you're not very subtle. Why else would the police persecute me?  No, no, you keep putting words into my mouth Maybe she was worried about being in the way. Would your mother have been likely to have mother suffered night and day I I suppose that's why she acted so depressed the tea what tea? Leave me alone, please believe your mother took her own life by making herself a poisoned cup of tea Because she didn't want to be a burden any longer Yes Yes, that's what must have happened But I lied you led me into that lie And then because I couldn't help myself I relived the most terrible day of my life A day I'll never confess to you or to anyone on earth I woke up this morning with a headache The pain running deep back of my eyes I had a feeling of dread with the thought of last night in the mirror Are you awake dear? Yes Then did you get my prescription filled as I asked you to? No, but there's plenty Without later than usual last night weren't you there? I don't mind for myself, but it isn't imposition on mrs. Brogan Oh your young man says She must have gone on complaining as usual, but I didn't hear I seem to be moving in a strange world all my own as I dressed and went into the kitchen Sounds lost their familiar proportions and the sharp tinkle of table where hurt my ears as I went about setting the table When I put a teacup in its regular place in the center of the faded blue cloth The spoon fell against the saucer. It was like a fire rasping the slate in my ears I ran from the kitchen to get the medicine bottle from the cabinet There were only two capsules left My heart was pounding Only enough for two normal doses Not enough for I yanked my coat on and ran out the front door I hadn't planned on this. I ran all the way to the corner drugstore. I never do hear that door open What what gene is your marbad off? No Well, yes Her prescription has run out I was shaking all over having this unexpected job to do I knew the medicine bottle had plenty the day before I thought of them. I thought I must be going crazy I'd known mr. Harmon since I was a kid his Patient wise and face and celluloid eye shade But I found no comfort in him now Young lady. I asked you twice for your prescription Gene oh my sakes are are you well? No, no I'm sorry, mr. Harmon. I I can't find it. Oh You you sit down at the fountain my dear I'm not supposed to of course without a prescription, but I'll make up those capsules anyway In the meantime Lemon syrup and soda remember how you love that when you were a little pigtail type I think I cried then I scarcely was conscious as I hurried home I took a drink of whiskey in the kitchen gagging on it gene. Where did you rush out to? I answered her while I struggled to unscrew the cap from the medicine bottle I took four capsules and emptied them into the tea strainer I emptied two more to be positive On the bottles label it said Warning no more than one capsule on any one 24 hour period Be careful And put two spoons of sugar in my cup dear. It was too bitter yesterday Did you hear me gene? I hear you I was careful all right Three heaping spoons instead of two to hide the bitterness A double measure of black tea carefully Very carefully over the white pottery stuff in the strainer And it was hidden completely I left the tea kettle whistling on the electric plate Ready for mother I didn't see mother again I left the apartment half running all the way downtown of the studio in the rain Everyone was crabbing as soon as I walked in oh good morning duchess All right hop in your sun suit now and make it snappy hand make up for black and white What's the excuse today have to go to a funeral or something? I did it. He said I did it.   No, but miss Your mother never would have taken those capsules the hard way in a cup of tea There was the flaw in your life. Wasn't it now What your friend Ted work got a hold of your mother's prescription Maybe he took it from your purse. That doesn't matter. Oh, no No, no, no, I'm afraid I must place you under arrest miss Dunn But I didn't kill my mother You said you said no.  Oh, no Not Ted He couldn't have done No No, you lie.  No half, you know, I never hold a grudge In fact, I like to talk about auto light stay full batteries I like to tell people an auto light stay full battery needs water only three times a year in normal car use I like people to know auto light stay full batteries are made by auto light which makes more than 400 products For cars trucks airplanes and boats in 28 auto light plants from coast to coast Yes, and auto light also makes complete electrical systems for many makes of america's finest cars Batteries spark plugs generators starting motors coils distributors All engineered to fit together perfectly work together perfectly because they're a perfect team So folks don't accept electrical parts that are supposed to be as good Ask for and insist on auto light original factory parts at your neighborhood service station car dealer garage or repair shop Remember you're always right with auto light here again as our star miss betty grable I want to thank tony leader and his wonderful cast of actors for helping me to make my first suspense visit It's so pleasant I'm a suspense fan from way back and I'm sure all of you are as anxious as I am to hear next week's show When mickey rooney appears in the cornell wool rich story the lie It's another truly gripping study and suspense Betty grable appeared through the courtesy of 20th century fox film corporation and will soon be seen in the Technicolor picture the beautiful blonde from bashful bend Tonight suspense play was written by john t copeland with music composed by lucian morroweck and conducted by lud bluskin The entire production was under the direction of anton m leader In the coming weeks suspense will present such stars as bob hope claire trevor james steward and many others So make it a point to listen each thursday to suspense radio's outstanding theater of thrills And next thursday same time here mickey rooney in The lie You can buy auto light stay full batteries auto light resistor spark plugs auto light electrical parts at your neighborhood auto light dealers Switch to auto light. Good night. This is cbs. The columbia broadcasting system


Hi and welcome to the session. I am Priyanka and I'll be helping you with exercise 1.3 question number 2 on page 20. The question says, solve the following systems of equation by using cross multiplication method. The equation given to us is 3x minus 5y is equal to 20 and 7x plus 2y is equal to 17. But before proceeding on with the solution, we should be well versed with the method we are going to use. The method's name is cross multiplication method. So in this method the solution has a unique solution that is it has exactly one solution. So the pattern of the solution under this method is written as c1. The knowledge of this pattern is the key idea we are going to use to solve this systems of equation given to us. Now let us rewrite the equations given to us by shifting all terms to LHS and introducing 0 in RHS. So now 20 and 17 were positive in RHS so now they are negative in LHS. Here b1, b2 are the coefficients of y that is b1 will be minus 5 and b2 will be a positive 2. c1, c2 are the constants which are given to us in the equation that is minus 20 and minus 17 and a1, a2 are the coefficients of x that is 3 and 7. Now on substituting the values of b1, b2, c1, c2 and a1, a2 in the above given pattern we have x minus 5 to minus 20 minus 17, 3, 7 and then again minus 5 and 2 right. Now to obtain the solution write x, y and 1 separately with an equality sign. Now the first two columns that is minus 5, 2, minus 20 and minus 17 will be written under x. The second and the third column that is minus 20, minus 17, 3 and 7 will be written under y and 3, 7, minus 5 and 2 will be written under 1. Now mark cross arrows pointing downwards from top to bottom and from bottom to top like this in the denominator of x, y and 1. Now to obtain the denominators of x, y and 1 multiply the numbers with downward arrow that is the answer of minus 5 into minus 17 will give us 85 and subtract the product of the upward arrows that is 2 into minus 20 that will give us minus 40. Similarly under y also minus 20 into 7 will give us minus 140 and subtract the product of minus 17 into 3 that is minus 51 then again 1 divided by 3 multiplied by 2 will give us 6 minus the product of 7 and minus 5 that is minus 35. Now to obtain the value of x, y will equate the first expression that is x divided by 125 with the third expression that is 1 divided by 41 and similarly the second equation that is y divided by minus 89 will be equated to the third expression again that is 1 divided by 41. Now to find out the value of x take 125 from the denominator of LHS to the numerator of RHS and similarly minus 89 will be taken from the denominator of LHS to the numerator of RHS. So on doing this we get x is equal to 125 by 41 and y is equal to minus 89 divided by 41. Now as we can see that they are already in the lowest form so therefore x is equal to 125 by 41 and y is equal to minus 89 by 41 is the solution of the given equations. Hope you enjoyed the session and bye for now.


Hello everyone. Thanks for joining this session. So today's topic is distributed authorization for microservices powered by Kubernetes, Istio and Open Policy Agent. Yes, I know it sounds like a very big topic and it indeed involves a lot of tools and techniques as we mentioned in the title, so I will try my best to tell a good story and hope you can enjoy it. Before we start, a little bit about myself. My name is Gong Mengnan. I have worked in Ninja Van before, which is a logistic company and now I'm a senior engineer at Shopee. Shopee is one of the largest e-commerce platforms in Southeast Asia too. And here's the agenda. We will start with background and goals and then we will talk about the tools that we mentioned, Kubernetes, Istio and OPA. Then we will talk about our solution and at last it will be a summary. Yeah, so let's start. Background and goals. Before we start, since this session is actually marked as entry level, so like regarding all the concepts that we mentioned in this session, I will try to give a brief introduction or some samples for you to understand. So we will start with RBAC basics. RBAC stands for role-based access control and is very classic and popular approach for the user access control and I'm pretty sure that you've seen in many, many other products and websites and companies. Even if you've never heard of it, there are a few concepts here to help you to understand. First is the user. It could be a person or automated agent or actually it could be anything or anyone that contact your service and then a role, which is a job function or title, which defines an authority level and then permission is just an approval, like if you have access to a resource. So it's pretty much close to the real-world definition. And here is a summary. A one-liner user is authorized for all those permissions assigned to any of the roles it is assigned to. Yeah, so this sentence seems a bit complex, but yeah, if you didn't get it at the first time like me, then you can try to read it again so we actually describe exactly what the RBAC is. And to help you understand, we have a small simple here. Let's assume we have user Alice and Bob and Alice is a shipper and Bob is the driver. So here, those two terms are actually within the logistics realm since this was the thing I did in the logistics company. So shipper, it just means who have parcels to ship with us, basically the customers. And driver is the one who drive for us straightforward to drive for us and deliver the parcels. And then let's assume that the shipper and driver has the following permissions. For shipper, it has the permission to create order and get the order. And for driver, it has a permission to get a route. And this action and resources is exactly like as the REST4 API definition. So most of our API are exposed in the REST4 style. And the good thing is in the REST4 API, the endpoints is actually representing your resource. And the scb method represent the action. For example, for create order, it will be posed to this slash 1.0 slash orders endpoints. So this is a perfect combo to represent our permission. And this is what we do in our company also. And then for the get order, you can see is get this endpoint. And for get road, it will be get this slash 1.0 slash roads endpoints. And combine these two, you should be able to make the decision based on the user and the action they want to do. For example, for Alice, if she want to post to this endpoint, and it will be allowed because Alice has a road shipper. And this road shipper has a permission create order, which is allowed to access these endpoints with a post HTTP method. So it's the same for Bob to get a routes. And but if Bob want to get slash 1.0 slash orders, it will be denied because Bob doesn't have a road shipper, which means it doesn't have the permission create order. So it won't be allowed to access this resource. So I hope it's a simple example. But I think it should be sufficient to understand what we are trying to do next. Okay, so we will talk about how the authorization works before, like before we introduce our new approach. And here are some typical components and maybe you've seen somewhere else having the roughly same approach. We have a client and then there will be a load balancer before it arrived our API gateway. And the access token is validated on the API gateway here. So which is the first step. And so one note is that we will mainly talk about the authorization in this session. So about the authentication, we won't be covered. So we just assume that you've already had a token. And then for the second step, the API gateway will forward the request to the targeted service. So basically, there is a routing happening on the API gateway. And then that's where the authorization happens. So it will happen on the service, which is Service A here. And then the Service A itself doesn't really have sufficient information because it will get the token, but it doesn't have the user information to determine if this user has the access to the specified endpoint or not. So the service has to make the request to another service, which is the auth service, who has all the user information to help for the authorization. So this was our previous approach and probably maybe some other companies also doing the same. But there is some challenges. We will talk about it later. So for this approach, since all the authorization is happening on the Service A, as we mentioned here, and here are some code tips about the authorization part. So there are two approaches, the authentication and auth middleware, which is actually what we did for Java and go, because that was our primary languages. Let's see for Java, if we can have an auth annotation and do specify the permission that you want to allow to access this resource, for example, create order, then you will annotate this controller function. And then for Golan, we don't really have something like annotation, but you can have something like the middleware to post this slash 1.0 slash orders, which is also create orders. You can annotate this, you can actually annotate these endpoints with the middleware and you specify other permissions here. So this was how we do in the code, but there are some challenges. Firstly, the permissions required for accessing endpoints are only available in the code itself, which is this kind of code. So it doesn't exist anywhere else unless you document it somewhere. And every time you make a change, you need to make a change on the documentation also. You need to keep these two parts in sync, which is not really realistic in our practices. And the second is very difficult for engineers to get the whole picture of the permissions required for service or endpoints. This is easy to understand because it's in my scattered everywhere in your code and either annotations or middlewares, you might use it in different places. And when you want to see, okay, for this microservice, what kind of the permissions it uses and for each permission, what kind of endpoints it can access, you can't really have this kind of information at one place. You need to maybe go through a few files to understand how it looks like. And the last point is even more difficult for non-technical users to understand our system. So yeah, because it's not available anywhere else besides the code itself. So for non-technical users, for example, the account managers, yeah, apparently, they can't really understand the code or even they can, they might not have the access to the code. And what's worse, the account managers have to guess the permissions behind the name and often end up renting on desirable permissions, which compromises the overall system security. Yeah, so here is an example. We have a user and the role and permissions. So let's see for Bob, he has a role shipper and it has a permission manager or this, but that's all we have. So all of these informations, the user roles, permissions, it can be stored in the database. But after that, it only exists in our code. So for example, for the action like get, post or delete, and for for service, like what one microservice it has access to. And for the resource, like all of these, you can't really get it because it's scattered everywhere in your microservice, in your code. Yeah, so this is definitely one of the difficulties for our account managers, because sometimes the rules and permissions are not even the straightforward like shipper or manage orders. It could be somehow big and then it's hard for you to guess the real meaning behind it. And based on those challenges, we just described, here is our goals. Firstly, we hope it to be language or framework agnostic. And then we hope to have a distributed authorization. So there won't be a single point of failure. Instead of now we are solely rely on the odd service. And third point is kind of related to the second point, we hope it to be scalable. And then we want it to be future proof. And yes, a bag, I'm looking at you.  So yeah, it means attribute based test control. So what is a bag? So for example, I want a shipper who name is Alice with red hair and a master card to ship with us. That's definitely a very ridiculous example, but I'm just showing you like let's see the username at least and red hair and master card. These are all users attributes. And instead of the role based access control, you can actually make a decision based on the users attributes. And this is much, much more flexible than our back. And we've already forced in that there might be some cases that we want to adopt this a bag, a bag fashion. And, and we hope if we want to refactor the whole thing, we hope this can actually support the a bag in the future. And the last but not least, we hope it to be user friendly, because as we mentioned, it's really not user friendly, especially for non-technical users. And we hope to make the system they are more usable for them. Yeah, and I hope you all understand our background, like how we did the authorization before. And, and now we will talk about the tools that we will utilize for the new approach to Kubernetes is still an open policy agent. So let's start with Kubernetes. Kubernetes is an open source platform for managing containerized workloads and services. And, yeah, period. That's all I have for Kubernetes. I'm sorry, because it's not really a Kubernetes 101. So I hope you have the, the basic understanding of the Kubernetes and how it works. And I have to jump to the next one, which is Istio. So Istio is a service mesh solution. And I might spend a little bit time explaining what is a service mesh. So as the diagram shows here, normally you will have clients and you might have many, many clients. Then that's where the proxy layer kicks in. So it can handle some logic, for example, caching or like HTTPS offloading and so on and so forth. Right. So, and then the request will arrive your service. And this direction as we showed here is usually called North South traffic. And when we talk about North South traffic, we mean the traffic from the outside to the inside of your system. And this part is openly, is often handled by API Gateway, which is also the proxy layer that we show here. But there is also a East West traffic, as we showed here. And the East West traffic, which just means the communications within your system, between your services. This is this part that we marked out. And the service mesh is mainly targeting for this part, the East West traffic, which are the traffic within your system. And the API Gateway and service mesh, I think there's definitely some aspects are actually overlapping with each other. But when we talk about service mesh, we will focus on the East West traffic here. And here is an illustration about the data plan. So one of the main components of the service mesh is data plan. And there is also control plan, which is in charge of the configuration management and keep all the data plans in sync. But we won't put too much weight on that. So for the data plan, so here are the main reasons that we introduce a data plan in our system. And at the beginning, before we have a data plan, the same functionalities are implemented repeatedly for different languages and frameworks, which are this part of code, the security retries, logging, tracing and routing, and maybe many others network related functionalities, because it will be reside in your code base, in your service. So you might need to implement it in Java, you then in Go, and maybe in the future, you need to do it in Node.js. So you need to keep implemented in different languages or frameworks. And then here is a new approach after we introduce the service mesh. So here you can see we extracted the code to a standalone proxy. And let's see if you ran a part, a Kubernetes part, then you can consider these are two containers, and your service will mostly care about your business logic, and you will upload the networking related functionalities to the proxy. And in a word, we are outsourcing the networking functionalities to a language framework agnostic proxy, also known as Cyca or data plan. You can see like in some articles or videos, these words interchangeable interchangeably. And here is this definitely has a lot of benefits. First of all, it's language or framework agnostic. And you can rely on the proxy to handle your incoming and outgoing network traffic. And this has many benefits. And one of it is the one we are using in our approach. And here is a very nice drawing I want to share with you. This is what our site time is. And yeah, so the external authorization in Envoy. So Envoy is the implementation of the data plan in Istio. So Istio is actually built on top of this. So Envoy is you can consider it's a proxy itself. And this external authorization is actually one of the amazing functionality that we rely on to build our new authorization approach. So you can see the service traffic. We arrive on Envoy first. As we mentioned, this is actually hijacking all your incoming and outgoing traffic. So everything will go through this proxy first. And before it gives the request to your service, it will actually use something called external authorization filter to make a request to OPA. And actually, it doesn't have to be OPA. It could be anything, as long as you fulfill the interface of the external authorization filter that required by the Envoy. And then your third party service should give an answer, I guess or no, to Envoy. And then Envoy will forward the request to the service if it's an authorized request or it will reject right away if it's not authorized. So yeah, so this is also what we do in our new approach. We actually rely on something called external authorization in Envoy. And the last piece, finally, the Open Policy Agent, also OPA. This is actually a very simple structure here. So when you make a query to OPA, so OPA will give you a decision based on the things that you feed to it, which is policy and data. So, compiling this, the OPA will be able to make a decision, and the decision could be any decent value. And I think that's mostly about the OPA, and we will show you how the policy looks like. So there's something called Regal. It's a policy language that comes with OPA itself. It's definitely another amazing thing that they did. Here is the two parts, the policy and the input, which is mapping to these two parts, the Regal policy and the data. For the policy, the Regal language is actually a bit different from what we are familiar with before. So at here, the default HALO equals to force is defining a variable is HALO, and the default value is force. So it's a Boolean. And then for this value, so this block means you will evaluate these statements within the calibrations, which are some statements that will be evaluated to determine the value of HALO. So within a block, within these calibrations, the statements, the relationship between the statements is n. So it means both of these need to be true for the HALO to be true. So the first statement is just declare a new variable m, and it assigns the value input.message to this m. And this will naturally result into a true. So and then it will go to the second one, which will evaluate if the m equals to world. And how do you make this work? So it will have an input here, and it will have a message inside, and the value is exactly what it means. The second one will be true also. Since this block is true, then the HALO itself will become true. So this is a very simplified example, and it's the regular version of HALO work. And later on, we'll show a slightly more complex policy. And but I think for now, that's it. And finally, we will be talking about our solution. And I hope you are still with me. So because this is actually where the good stuff began. Hey, so let's start with a high level design here. Actually, this structure is not very different from what you say before like what we did before. So there's still a load balancer, there's still an API gateway. And in the API gateway, we will route the traffic to the cross bounding service and then POD. So this means the Kubernetes service and then the Kubernetes POD. So I hope most of you already have the understanding of how the Kubernetes service works. So basically, your request can arrive the Kubernetes service and then it will actually forward it to the cross bounding POD. It will do a load balancing internally. So let's assume it arrives to one of the POD. And it will arrive on the envoy first because envoy already taking over the traffic. And then the second step, the envoy proxy will forward the request to OPA via the external authorization filter. So I think we talked about the filter a lot and the filter is just like a list of functions that envoy will exclude when the request come in or when a response goes out. So the external authorization is also one of the filter. So when you apply this filter, and it will be in the chain of the functions that it will need to call. So once we apply this filter, it will forward the request to the OPA that has been configured. And then OPA will try to evaluate the request and return the result. So the result is actually just yes or no. It's a simple binary question. And then the step four, the envoy will forward the request if it's authorized or the envoy will reject the request on spot if it's not authorized. So as simple as that, okay or not. Now let's rewind to step three to, as I said, the step three is about OPA evaluating the request and return the result. But hold up. I think like you are missing a very important part here is how does OPA evaluate the request? I think that's all it matters. And yeah, if you have that question, then yes, that's definitely the most important question. And we will describe it later on. And this is the red rectangle mark here. And there is one new thing. Yes, one new component, which is the auth operator here. And it's actually a Kubernetes operator. And if you are wondering what is a Kubernetes operator, we will have a small simple here. The Kubernetes operator pattern is actually based on what Kubernetes, the Kubernetes built-in design. So there is something called reconciliation loop, or you can call it a control loop. So that's actually how Kubernetes works internally. We all know that Kubernetes works in a descriptive fashion. So you will describe your needs, your requirements in a YAML file, and you submit it to the Kubernetes API server. So in this YAML file, you are just describing what you want. For example, you want Kubernetes deployments, and you want three or five or 10 pods within it. But you didn't really tell the Kubernetes the exact staff that you need to do. Instead, you're just telling it, okay, I want 10 pods. And that's my desire. And that's all. And then Kubernetes will definitely get your desire. And that will be your desired state. For example, the 10 pods. And in this reconciliation loop, it will keep observing the desired state and compare it with the current state. So it will make the adjustment to make the current state as close as possible to your desired state. So that's basically how Kubernetes works for most of the resources that it managed. And this is also the Kubernetes operator pattern. So you can also use this pattern in the Kubernetes system. You can implement your own operator, and you need to define your own resource, which is the custom resource, and you will work in the same way. You will run a reconciliation loop in your operator and keep watching the resource that you just defined. And whenever there's a change or you make a new custom resource, you will try to adjust the current state to meet your desired state. Okay, I hope you all get the Kubernetes operator's pattern and how does it work. And now we will continue with the part that we left over, which are the part that we didn't introduce from the last few slides. So here we have a YAML file here, and the first step is we're going to submit the CR, which is a custom resource, and which is also called the service grows.yaml here to the Kubernetes. And the arrow here is just I just try to show the relationships between the file and the Kubernetes operator. And in real life, you're actually going to upload it to the Kubernetes API server, and you talk to the Kubernetes API server at any time, and you don't talk to the Kubernetes operator directly. And then here is an example of how the CR looks like in the API version, the kind metadata and spec. These are kind of the default standard fields that you should include in your custom resource YAML file, and it's actually any Kubernetes resource YAML files. And here the kind is the service rule, which is we define with custom resource definition. And inside the spec, there is service and rules, cross is obvious. In the rules, it's actually a list, it contains a list of items, and each item has a few attributes here. It has method, the path, and these two together is combined, these two is actually mapping to a restful style operation to your resource. For example, here is the get orders. And then for the permissions, it's also a list of permissions here. We have get order and something else, so sorry, ran out of ideas. But anyway, you should be able to get a taste of it. So this is how the service rules work like. And of course, you can have as many of, as rules you want, you can just keep expanding this list. After you have the bundle, the next step is you are going to upload a compiled policy to the cloud storage. And this can be done by the OPA itself, and you can actually import the OPA as one of your dependencies. And then in your own Kubernetes operator, you can do the bundling in the code itself. And then you can upload it to a cloud storage. And the cloud storage could be AWS S3 or S3 compatible service or GCS or anything else. And another thing is the OPA bundling is actually quite powerful. And there are some knobs that you can tune, and you can even specify an optimized level. And this will change the behavior and will change how the bundle comes out. And I think we won't really cover that here, but do read that documentation if you are interested in it. Then after you upload the bundle to the cloud storage, the next step is how the OPA is going to get it from it. Then the OPA will download the bundle from the cloud storage during the startup. And it's actually going to periodically check the freshness of the bundle. This is also another very amazing functionality that implemented in the OPA itself. So you can configure the cloud storage that it can download the bundle from. And it will download it. And it will also check it periodically, for example, like three minutes or five minutes. And it will request the cloud storage and determine if there is any new version based on the ePag and also some other HTTP test control headers. If there is a new version, then it will download the new version of the bundle and it will just reload it. So this brings another advantage is that if you want to make some changes of your service rules and you can just submit it to the communities and then the OPA will get the changes and it will reload by itself. During this procedure, you don't even need to touch your deployments. You don't need to redeploy anything for your new rules to pick effect, which is very powerful. Then the next step is OPA will get the user data combined with the policy to make the decision. Here the OPA itself still again doesn't have all the information it needs. It mainly the information it has mainly consists of two parts. Firstly, is what it gets from the envoy. When the request coming, the envoy will forward the request to OPA. It contains a lot of extra request attributes. And the second part is the user information it gets from the service. And again, this can be cashed, so you don't have to request to another service all the time every time. And it should be able to speed up your procedure and also ease the load on other services. If you still remember this image that we showed before for OPA to make a decision, you need to have two things. First is the regal policy, which is actually converted by the YAML file, by this service rules YAML file that we uploaded. And the other half is the data, which is get from the envoy and from the OIS service. And then the step five, the last step, OIS operator will sync the service rules, which include the service name, methods, paths and permissions. If you still remember the YAML you just saw, it will sync that to the OIS service and the OIS service will persist it maybe in a database. And then later it can show it to the account managers. And this is mainly for the displaying purposes. So this is kind of the replica of the original service rules that you submitted in the YAML file. And by doing this, the OIS service can also be served as an HTTP server. And by doing this, you can have a nice web UI and show the users and your account managers and others, maybe engineers who have the needs to view the rules and permissions and also what other permissions are capable of. And now we will have a sneak peek of the regal policy that we defined for our RBAC needs. And yeah, you can click on the, you can go to the same link as me. And this is a real playground. Another cool thing that the team did. Yeah, the team really made a lot of nice tools. So for this playground, it just, like other playgrounds on the left is the main part of your policy. And on the right, there is the input, the data and the output. So when we run something, the output will be showed here for the input and data. So the difference of input and data is the input is mainly the dynamic things that you receive. And the data are more like the information you need to support your decision. And maybe it doesn't change that frequently. But for input, for example, at here is actually what we receive from the Envoy proxy. So when Envoy proxy making the request via the external authorization interface, this is what they're going to provide to the OPA sidecar. And at here, there are a lot of attributes. And I would say it's like more than enough for us to make a decision. And here what we care about is under these attributes, there is request and HCP. And here are like almost all of the HCP attributes that we need to support our decision. First is the headers. It includes all the headers, even the internal headers that are managed by the Envoy proxy. And you can see there is an authorization header and you can see the barrier token here. And you can also see the user agent. And then there is also the method and path. So these are also used in our decision later on. And now you can see the advantage of having a restful style API because you have the method and path in these attributes directly. Then you can just take it and use it. And the combo of the method and path can map to a permission directly is very convenient. And then for the data, it actually contains the permission information. And here is different from service by service. So let's see for this service, we have the permissions here and these permissions contains two parts. And the first is protected endpoints and then the public endpoints. I'm not sure if it's common in your use case, but for us, there could be some endpoints that we just want to expose to the public. And it doesn't require any authorization. And for this kind of public endpoints, it will just be here. And for the protected endpoints, there is another map here which the key is the permission it requires. And here is a create order. And inside this, it will be the action which is post and then the endpoints. And as you can see, this can be an array and this can be an array. And you can also have multiple permissions here and you can just expand this list when it's needed. So after we see the input and data, we can take a look on the left side. Here is a slightly complex wiggle policy than the Hello World example we saw before. And here we specify a package name. And here is just importing the input and the data which you guys just saw here. And we have a default allow equal to false. And this allow is the one thing, the only thing that we clear. So in our policy, the output outcome would be this allow field. And if it's true, then it means it's authorized. If it's false, then it means the otherwise. And firstly, we can have token. We can try to get the access token from the authorization header. And it also has some nice utility functions like the trim prefix, which can trim the barrier of the prefix from the actual token string. And here again, the style and the logic of the wiggle language might not be very familiar to you because it's quite different from the programming language that we used to have. But if you use some other similar policy languages, then you might get used to it. For this one, for example, for the token, here is the blog contained in these calibrations. This just means if this thing is true, and this thing is true when this exists. So this just means when there is the authorization header, so it will be true. And if it's true, then we will execute this function, which means we try to get the token string and assign this to the token value, which means after this, if there is an authorization token, it will be assigned to this token value. And it's a similar logic for the rest of it also. So let's try to get used to the style of thinking. And here we have two allows block here. And as we mentioned before, within a block, within one pair of calibrations, all of these statements, the relationship between them is end. So it means all of the statements in one block need to be true to make this allow as a true value. But between the blocks, let's see we have two allows here. And the relationship between these will be all, which means either the first block or the second block can be true. And then the allow will be true. And this is actually very convenient for us to break down our decision-making process, instead of all this together. So here you can see we actually split the public path and the protected path into two blocks. And either of it is true, then it means we should allow this operation. So for the public path, we will get from the permissions.public, which I will show you is this part. And after you get this part and you will try to fetch based on the method. So we're just trying to keep narrowing down to the minimum set that we need to evaluate. And here we will try to get the HTTP request method. So let's assume if it's a get, then it can get this only list here. And it could be post-late or some other methods. And again, another new thing is this underscore means it's a loop. So it will iterate through the array. And it will assign a value to public path. And then it will execute this glob matching and see if the public path actually match the request path. If it's a match, then it will be allowed because it's a public one. It doesn't require any authorization. And for the protected ones, it's slightly complicated. And here we define a variable S and this, and initially it should get from a function. And here is an example for requesting the user's permission from an auth service. And here we actually make an HTTP call. But currently, we're not running any auth service on my laptop. So I just commented it out. But in the real life that we can do that, you can refer to this code and you can make the URL query params. And you can send it out as an HTTP request and get the body as a result. And at here, one important thing is you can see we enable the cache. And I think so should you if you go with this approach because you don't want to request another third party service every single time when a request comes in. So it definitely makes sense for you to cache it locally on the OPA container itself. And but because we don't really have an HTTP server running right now, so I'm mocking it. So I just make it a static variable, which is a create order. And which means this S would be the array of permissions and the array only have one item, which is create order. And again, you see our old friend on the score again. So this means you're doing iteration again, even though it's only it only has one item. But if you have more than one item, it will loop through, it will iterate through all the values. And because this we need to evaluate the protected endpoints. So right here, we are getting permissions.protective. And at here, the protective only contains, it also contains the permission that this user have, which is create order or the coincidence. So at here, we will get the perm, which is create order. And after that, it's another map. So we will get by ACP, ACP request method, which could be get could be post could be anything. But and again, you can see this whole procedure, we just keep narrowing down to the minimum set that we need to evaluate. And this can make the process more efficient. For example, if if in your permissions data, there is no this permission, or there is no this ACP request method, then it means it doesn't match anything. And then you can just skip the whole thing. It can speed up the whole process. And again, once you get the path, you're going to iterate through the path again, and try to match the path. So that's really how it works. And at here, we can run some example. And let's see for this example in this input, our method is post and path is slash 1.0, that rose, which is not something we have here. As you see, we only have a post orders and get public orders, which we and we don't have a slash 1.0 slash rose. And if we if we click on the evaluate, and you can see, it actually print out like all the variables that we define, but we only care about the allow, which is a false. And for example, if we try to get to change it to get, and we will try to get this public and one, which is slash 1.0 slash public slash orders, and we evaluate it again, and you will see it's a true. And if we make it a post, and we make it to request the slash 1.0 slash orders, and you can see the permissions here is create order. And we also like make a dummy user permissions, which is matching this great order. So when we evaluate it, it should show you a true also. And if we change for the permission and we change it to something else, and then you can see that this user no longer has this permission to access this endpoint anymore, and when we evaluate it, it will be false. And if you click through the link, and you can actually play around and change something and see if it acts as what you expected. Okay, then let's go back to the slides again after the small demo. Then after we see all the policies and we roughly know how the OPA evaluate the request and how does it work with our RBAC model. And the next thing is how do we enable external authorization and void filter as we talked too much about this external authorization. And again, this is configured by a YAML file.  And at here we have two parts that are bold. So first is the workload selector. This is definitely very useful. It means it can specify the workload that you want to enable this external authorization filter. For example, you are running some experiments and you definitely don't want to enable it for all of your workloads, right? It doesn't really make sense. So most of the time you want to take it slow and step by step and try to rule it out slowly. And you can utilize this workload selector and you can create the external authorization filter only for one application. And then the next part is where the configuration is. And I think you definitely should refer to the documentation. And here we won't go too deep of this. And you can see a lot of examples in the envoy examples. And here we have a benchmark. And so here is a benchmark that we ran on our Kubernetes test cluster. And we have like the we actually ran on GCP and we have H1, HighMam, 16 or 8 machine. And it is and we tested with 100 service rules. That's like the rules that you saw before. We have 100 of them. And we will see it should be a reasonable number for how many service rules that you have. Because if you have a microservice that has more than like hundreds of endpoints, then I think we would question ourselves, did we really design it right? Is it still a microservice with like more than 100 endpoints? So I we will see that like maybe a hundred rules or a few hundred rules should be a reasonable number in the real world applications. And here we have a few test cases. And you can see the operations per second is actually quite impressive. And for most of the evaluation, it can be done in the microsecond level. It's not even a millisecond. And I think you can definitely try to optimize your rules and make it more efficient. And trust me, our policies and the permissions data is actually more complicated than what you saw. So I will see the performance of OPA is actually very, very impressive. And it's definitely meet our needs. And here is a summary. So by doing this, we kind of have a distributed authorization approach because the authorization now is running on the on each port with side by side together with your service container. So it doesn't rely on a single, a single like all service. And we also minimize the single point of failure. But I won't see we actually eliminate it because we still need to get the information from from somewhere which is the office service. But since we cash it, and for most of the time, it doesn't have to keep requesting the office service. And then we also extract the access control out of the code. And we turn it into the CR, the custom resource if you still remember, which is in the YAML file. And furthermore, we can integrate, we integrate it with our CICD pipeline, which means it can sit together with your code and it will just be a YAML file. It just like how you do your normal CICD actions that you put your, maybe your deployments, details, or your, your, your GitLab CI files there. So you can also put that service rules YAML file in your, in your Git repository. And then it can be processed automatically by the CICD pipeline. Right. And again, if we need to answer this question now before we, after the permissions, we don't know the action, we don't know the service. And we also don't know the resource. But now I will say that we answered all that question. So besides this information, the users, the rules, the permissions that stored in the database. Now, after we submit our YAML file, and it will be sent into the all service. And all of this, all of this information we can also get from our database. And we can show it in a nice web UI, for example, it can show in a tree. And we can see like for a specific service, what kind of permissions are needed to request this service. And all the, the endpoint inside the service. And for a user, we can see what other permissions belongs to the user and what other permissions can do. And we, we kind of field all the gaps in the between. And at last, thank you very much. And I think that's all I want to share today. And I hope you are still with me. And I hope you enjoy the content you are seeing. Thank you very much.


hello everyone another video for you before I begin please hit that thumbs up button down below so it will help to get this message out there to other viewers as well how the narcissist gets you to obsess over them you're constantly thinking about the narcissist you're considering something they've said or done you're going over the same matter in your thoughts again and again and it's like no matter what you do you just can't get your mind off of them even when you try to think of other things it always brings your thoughts back to them to where you want to know what they're doing and why it ended in the way that it did you may be wondering if it was deliberate or if it was just an accident you may be wondering what is actually wrong with them because you're projecting your own human qualities and feelings onto them which are things that they do not possess so it's not going to make any sense because you're expecting them to think and respond in the way that you would when their way of thinking and processing is very different to a normal person so the more you try to understand it the more confused you will become until it becomes an obsession and you will feel like you're losing your mind because on one hand you already know what they did to you you know that what they did was wrong but you have this cognitive dissonance these two conflicting beliefs where you're thinking and even worrying about them and you're entertaining the possibility that maybe there could be a better side to them you start thinking about what could have would have or should have been as though something was possible in the past or you had the ability to do something in the past but you didn't do it so you start judging your own value and character based on what you did you revive the past in your mind you start thinking about other times when things went wrong and then you start to wonder if something is wrong with you and the narcissist will make you feel that way because that's always their objective to make you feel like you're the problem because then you will reassess yourself instead of seeing the actual problem which is them because the person who is the problem is not going to be examining or questioning themselves if that were to happen then the problem would cease to exist so how can you be the problem if you are reassessing yourself that wouldn't make any sense but they find ways to make it make sense by projecting what they are onto you and getting you to confess and accept blame and responsibility for everything that they caused you as their victim to be because they prepared and trained you for this particular purpose and activity to obey them and questioningly to be submissive and compliant to be willing to do what other people want and considering your wishes as less important than those of other people so they already conditioned you into being this way they assigned this identity to you which then makes you feel like you're bad or wrong and you're responsible for everything and in the end it causes you to think deeply about what happened because with narcissists there's always a lot of unanswered questions their stories never really add up it never makes complete sense and they're not willing to go into detail about it or to give you an explanation because deep down they already know that they're wrong it's just easier for them to pass the blame onto you because they already assume that you're going to accept it since they've already programmed you into being this way now the mistake a lot of you make is when you're treating narcissists like normal human beings and you're trying to rationalize things that they're saying or doing you're trying to make sense of it you're trying to explain or justify the behavior or attitude with logical reasons when logic is not relevant or appropriate when you're dealing with narcissists you can't just treat them like a regular person or from a normal perspective where you're trying to construct or establish something based on who you are or from people that you have interacted with before you're making a big mistake by doing that that might work with normal people but it's not going to work with them because they're anything but normal so things are going to deviate from what is normal or usual to you because they lack the key components of a human being they lack effective empathy the sensations and feelings that we get in response to other people's emotions which normally includes mirroring what that person is feeling or we might feel stressed when we detect another person's fear or anxiety but it is not like that for them narcissists do not feel what we feel which is how they can abuse you for years and feel nothing it's like they don't even care but if you went around an empathic person they would immediately sense what you've gone through they would feel your pain and they would be unable to bear it you'd probably break down and cry in each other's arms or it would be like how we come together on here as a community we care about each other and we support each other but it's never going to be like that with them they can't even experience the full range of human emotions this is why they're always angry or upset and they're always trying to project these negative feelings on to you because they're primarily operating from their reptilian brain they're constantly in survival mode they're like animals they don't even try to control their basic feelings or physical needs their savages or barbarians they're motivated by physical and carnal appetites rather than moral spiritual or intellectual forces so they're not even human they're more like monkeys or apes and they're just trying to survive so they're only focused on what benefits them they can barely even see you or recognize your feelings once or needs it's not even a concern to them they're only concerned about their own survival so it's about their needs only which is why they struggle to interact in a healthy manner well what makes us human is how we treat other people it's about being ready or available when we are wanted or needed being friendly and helpful where we are willing to give information or to talk and we can participate in enjoy give and receive together and have the same feeling quality or experience in a way that is fair and honest without favoritism or discrimination and without cheating or trying to achieve an unjust advantage which of course are all qualities and characteristics that you or I possess and they are behavioral traits of humankind's but narcissistic people are not human and that is why you get so confused and you can't understand why they do certain things because you know that you would never do what they do but that's just it you're not the same as them you don't have a mental disorder which means that you're not experiencing significant disturbance in your cognition emotional regulation or behavior you're able to conduct yourself and present yourself appropriately and professionally you behave well in public or formal situations so you're in control of yourself but they are not in control of themselves and that is the difference they're not operating at the full human level or capacity which means that there's going to be a lot of things that are missing from your interactions or engagements and there's going to be a lot of things that don't make sense to you because you're a fully developed human you're not a neanderthal you're not uncivilized you're socially culturally and morally advanced while they are lacking sophistication they're antisocial and immoral they're rude savage wild primitive barbaric and uncultivated and yet you're trying to figure out why things went a certain way because you can't understand why someone would mess up something good when they could have just continued to progress succeed and achieve a particular result and it's because they're missing the key components of what makes us human the components that would otherwise keep them following the correct and established course but they're just not at that level of development they have significant counter defects and flaws that are characterized by intelligence and behavior that is below your usual standard which is why you need to stop thinking of them and treating them like normal human beings because as long as you do that you're going to wind up feeling frustrated and confused and it's not going to make any sense to you because you're expecting them to function and operate like normal human beings when that's just not what they're capable of so you need to manage your expectations when you're dealing with them stop expecting them to be at your level of development and only communicate as needed because otherwise you're going to be really confused and you're going to be obsessing over them thank you for watching if you found this video helpful you can give it a thumbs up down below and let me know your thoughts in the comment section hit the subscribe button and click all notifications to be notified of my future videos and if you would like to support the channel you can donate at paypal.me slash Narc Saviva you can book a one-on-one with me on my website it is NarcSaviva.co.uk thank you for watching and I will talk to you soon