Afternoon, now there's a uniquely very special exhibition of Ukrainian arts opening this weekend at Angrenin Theatre. It's a collection of works by Ukrainian artists, both amateur and professional, and the exhibition will be opened by the Kheerluk of the Derekenny municipal district that's councillor Donald Mandy Kelly on Saturday. And it is called Birds Flying High. The curator is Svetlana Babenko who joins us now in the studio. Svetlana, thanks for coming in and tell us a little bit about this. Why birds? Why were birds chosen? Yeah, I have this idea. Yes, because birds have a lot of meaning in Ukraine. It's as many kinds of birds. It's like amulet for your home, to bring in your home peace, love, joyful life. It's to bring something nice to your home. And with these birds, we also the main idea, we would like to, because I really feel thankful, yes, for Irish people, how they meet us here and group, I'm a group of artists. We decided to make other presents before Christmas for Irish people, and bring these birds also to Irish home, that these birds bring love, bring nice beauty, and save each home. So how did you get to know the artists? I guess that as you're a Ukrainian community now in Lerrkeny, that sort of evolved since the war started, that artists sort of came together, gelled together, got to know one another. You wouldn't all have known each other before. Yes, I don't know. Just I know in this project, only one person, this is, I'm with her in the school. This is my school friend. She's living in Ennis. But Ennis, yes, but other girls, I don't know. And when this idea come to me, I start to collect it artists. We have Ukrainian groups in Telegram. And I write in these groups, yes, about my idea. And it's in one week, I collected about 15, 20 people. And when we start this project, it's become more and more. And now in my team working, it's about 30, 32 artists. And are they all based in Donegal or? Most. Most of them in Donegal, and most of them in Lerrkeny. But just some we have from Ennis, some from Slaigo. And you've been here since the start of the war? I'm, yeah, yeah, yeah, yeah. Whereabouts in Ukraine? Where in Ukraine are you from? I'm from south of Ukraine, from occupied territory. It's Kerson region. And I'm from Zipat. This is left side of River Dnipr. It's still occupied.  Yeah, I still, but most of my friends, they live left. Yeah, because it's totally now Russian territory. Right, still? Yeah, yeah, Kerson region, left side of the River Dnipr, it's totally occupied. How does it make you feel? How the war, when it started, how did it make you feel? And now being removed, being in a different country and with Russia occupying your part of your home country, how do you feel? You know, it was like first months. Yes, I came in Ireland in the end of May. First months till the August, I think so. It was, I have feeling as it's bad dream. You know, I don't feel like normally life. It's something strange. And only from the end of August, yes, I decided that I'm here. Yes. And I must do something. I must build something. And I decided that it will be like a new page in my book. You know, and only after this, when I take this decision, yes, I joined here in later Kenny to art and design course in ETB. Yes, and I'm really very thankful for Irish government. Yes, that they give this chance. Yes, yes, this support that you can study, that you can study even something new. Before I never worked with art, but it was as my hobby and it was as my dream. And I decided that it will help me, yes, to build something new. Brilliant, brilliant. So it's an opportunity in one way. Okay, the artists involved here as some amateur, some professional, and all will be on display. And will the art be for sale? Yeah, this art will be for sale.  Yes, that it's be not expensive, but or art, it's or oil paint, or acrylic paint, and it's really it's a big handwork work. Yes, yes. And we are trying to do this really with love. Yes. And that it can be for each people as a small present for a friend. I'm like this. So the art will make a perfect Christmas present, I suppose, for someone. And some of the proceeds as well going to the cathedral quarter here in town. Yeah, which is great. This is, you know, I know about this project from Literature Festival, and I really like it. And also it's in our mentality. If you are somewhere, and for example, you take money, you take help from some places, you must come back about 10, 15% for place.  And if we can bring for this project, any, I don't know how to say any help, it will be beautiful. It's a good project. And it's giving back. But if anybody wants to see the art for themselves will be on display from Saturday, the opening is on Saturday and then beyond, beyond that. And it's be until 19. But yeah, in Saturday, I'm really would like to make a big opening and what time on Saturday? It's at 1pm. And I mean, yeah, and we would like to make is as a family, as a family event, people can come with children, it will be nice warm atmosphere here with some gifts for the children. And there's going to be some music as well. Yeah, yeah, yeah. Okay, it's the work of over 30 Ukrainian artists. And it's a gesture of thanks. Above all, I suppose. So it's a chance to see it at one o'clock. That's for the official opening at Tangredan Theatre this coming Saturday. She would like it. Thank you very much. Yes. Thank you very much. The best to look at it. Yeah, thank you. We have now begun to close current and deposit accounts at the


Well, so here's kind of a historical view that I take about it and I'm not an expert on geopolitics or anything like that. But basically I see that our whole civilization depends or is built on, I call it a story of separation. That takes a lot of forms. For example, humans versus nature, self versus other, us versus them and so on. So as long as we had an enemy in the form, okay, now he's distracted, as long as we had an enemy in the form of the Soviet Union, we had a foil, this evil entity we thought, whereby we could define ourselves as good.  When the Soviet Union dissolved, there was like this moment of kind of cultural panic, where we were desperately looking for a new bad guy. And you might remember in the maybe early 90s, the new bad guy was for a brief moment the Colombian drug lord. And that was kind of portrayed even in some films as being like this really scary next foe of the good, the true and the beautiful but that didn't work very well. And so there is this crisis because how do you maintain the military industrial complex and all that goes along with it if there isn't a convincing enemy. So just in the nick of time, global terror came along. And here was finally something that we could be afraid of again. But you know, even, even at the height of the hysteria following 911 that gave birth to the second phase of the Iraq war, I got this sense that people weren't actually that afraid of terrorism, nothing like the deep dread of the Soviet Union that prevailed in my childhood. People weren't weren't actually that afraid of it. And so the fear and hysteria had to be kind of manufactured much more than in the days of the Cold War. I just kind of went along with it. But I think that it wasn't so much that the populace was clamoring for war, as it was that the policy establishment and the elites were allowed to kind of go and do their thing without huge public buy-in. There was public opposition and there was even more just kind of public apathy. I remember when there was the terror alert system, green, amber, red, like nobody, nobody cared what the color was, you know, and the airport security it just kind of becomes this ritual. So I feel like the Iraq war was kind of this attempt to give a new lease on life or it's kind of the war mentality on life support, extending it a few more years or decades beyond its time. Because really the paradigm of war, like the fundamental paradigm of defeating your enemy through overwhelming force, that, properly speaking, ended in 1945, when for the first time in human history we developed a weapon too terrible to use. Today nobody dreams of obliterating Russia or China or anybody through nuclear weapons. I mean, well, maybe not nobody. There are certain unregenerate elements that still entertain those fantasies, but seriously, like that's not an option anymore. It's different than it's been for thousands of years. For thousands of years, we've been able to at least pretend that our problems could be solved with final defeat of the enemy. So, Iraq, one of the things that, I mean, I guess I always look for silver linings. It's pretty hard to ignore the fact that none of the stated objectives were really achieved. So nobody's better off. And it's just like this new confirmation that what we do to the other we do to ourselves. And if we're talking about lies here, like the biggest lie of all, is that we can escape the consequences of what we do to the other. We can escape the consequences of what we do to black people, to poor people, to the forests, you know, to the oceans, to the rivers, to the mountains. If we build a big enough wall and secure enough bubble, then we can escape what we've done to the other. But that doesn't work, you know, like we have, yeah, like America has insulated itself from foreign violence, more or less, but we have unprecedented levels of domestic violence. There's like this mirroring that goes on. We've seemingly insulated ourselves from the poisoning of the planet. Yet we're in the midst of a terrible health crisis, where life expectancy is lower for the new generation than it was for my generation. And what we do to the other comes back to us. That's the deepest lies that we can avoid that somehow. And I think that the big revolution that's that's going on on this planet is to understand that we're all in this together. Therefore war is utterly obsolete.


It's time for the Lawn Jean Chronoscope, a television journal of the important issues of the hour brought to you every Monday, Wednesday, and Friday, a presentation of the Lawn Jean Wittner Watch Company, maker of Lawn Jean, the world's most honored watch, and Wittner, distinguished companion to the world-honored Lawn Jean. Good evening. This is Frank Knight. May I introduce our co-editors for this edition of the Lawn Jean Chronoscope? From the CBS television news staff, Larry Lusser and Ned Kalmer. Our distinguished guest for this evening is His Excellency Ambassador Salem Safer, head of the Turkey's delegation to the United Nations. Ambassador Safer, the president of Turkey, is arriving in this country tomorrow on his first visit to the United States. But before we ask anything about his mission here, I wonder if you'd tell us something about Turkey, its size, its population, perhaps its political system? Well, then I will begin with the second part of your question. Turkey has an area of about 750,000 square kilometers. And according to a census which was taken in 1950, the population is just a little over 21 millions. Our political system is a democratic republic. We have a one-house parliament, which is elected by the people once in every four years by secret ballots. And the president of the republic is elected by the parliament from among its members for the same term of four years. Well, he's more like the prime minister than the president of this country is. Well, no. Precisely. That was the point I wanted to make. Then the president of the republic designates the prime minister, who in turn chooses his ministers, the members of his cabinet. And the prime minister has to go to the parliament with his program, and his program and his government had to be approved by the parliament before they can function. And if necessary, they would have to ask every now and then for a vote of confidence. They might have. They don't do it often, not in our country. Anyway, we are not fortunately in that position. What is the president's term of office? The president's term of office is four years, just exactly like the term of the parliament itself, which elects the president. So that's the difference between the president of the United States and the president of Turkey. The president of the United States is both the head of the state and the head of the government. Whereas in Turkey, the president of the republic is the head of the state and the prime minister is the head of the government. Well, Turkey, of course, is a member of the North Atlantic fact, Ambassador Sopper. But could you tell us something about its strategic position in the Cold War? Well, it is a little difficult to say much about the strategical position of any country in what you call, quote, the Cold War, unquote. But in a general way, it may be said that the strategical position and the potentialities of Turkey are of utmost importance for the defense of the West and for the defense of the Middle East and the Mediterranean. The Cold War, of course, we deplore that like the rest of our allies. But we have to stand firm. Mr. Ambassador, one of the things I think that will interest Americans most of all... Yes, Muck. ...old by all means, I'm sure, is the position of Turkey in reference to Russia. How is the Soviet, the new Soviet attitude under Malenkov, affecting relations with Turkey? Well, of course, after the death of Stalin, there was a softening of the Soviet policy towards Turkey. Exactly like the softening which took place towards other countries, which we witnessed almost everywhere. But I think that it isn't the interest of the peace of the world to be very cautious about that sort of softening of the policy. And we should wait and see whether suitable solutions can be found to the major problems which are still pending. In other words, the Turks are just as skeptical as we are. Well, let's call it cautious. And what about these reports that we're always having, or that is to say that we periodically get about vast concentrations of Soviet troops on the Turkish frontiers? How much is there in that kind of story? Well, I don't know, but I am rather inclined to believe that that is a part of what you call the Cold War. I don't think that there has been much increase of the Soviet troops along the Turkish border for the last, let's say, year or two. Of course, I am not an expert in military affairs, I don't know, but that's a feeling I have. Ambassador Sopper, your President's visit to the White House will mock the first time I think that a Democrat president is visiting the head of the Republican Party in this country. Now, is there any similarity between the Democratic Party of Turkey and the Democrats here and the Republican Party? Well, yes, in a way, but otherwise I think that the names of all parties in Turkey, you know that the party in power now is the Democratic Party in Turkey. The founder of the party happens to be President Bayar, who is arriving tomorrow to the United States. And in the elections of May 1950, they came to power. And the Democratic Party is really democratic in the real sense of the word. Was it as conservative or more conservative than the Republican Party? No, by far not. On the contrary, I may say that at least in this economic policy, the Democratic Party is liberal and very firmly convinced that we should be and remain allies of Western democracies, United States and the rest of our major allies and others, the members of the North Atlantic Treaty Organization. Well, your Democratic Party and your Republican Party agree on foreign policy, but domestic policy do they differ? Well, on foreign policy they agree, there's no doubt about that. And when the former party, the party of opposition today was in power before 1950, the Democrats were in their position. They too had agreed with the foreign policy of the Turkish governments. So I may say that the foreign policy of the present government is a national policy. By the way, you pronounced the name of the president a few moments ago. Would you pronounce it again because we're going to have to be using it on news programs from now on? And he arrives tomorrow. He arrives tomorrow, we hope, towards four o'clock. Mr. Ambassador, the Turkey has undergone a tremendous modernization job in the last generation, seems to me. Your people, the women, for example, have received rights that were denied them for very long. How does the position of the Turkish woman in modern life compare with the position, for example, of the woman in America or in England? Well, if I may say a few words before I come to your question to that point, you might be surprised to hear from me that the Turkish woman, the Turkish woman, in the early Turkish society, let's say before the Ottoman Empire in the ninth and tenth centuries, had equal rights and equal duties with men. For example, if I may call so, the ambassadors from other tribes or neighboring countries were received both by the Han and the Hatun, let's just say the ruler and his wife. And later on, after the Ottoman Empire, when the empire began to extend to its east and west, we came in contact with other societies in which the status of women were lower than that of the men, so that influenced the Turkish society to the detriment of the rights of women. But later on, and after the Turkish Revolution in the times of Kemal Atatürk, in 1926, 1930, and 1935, different laws were accepted in the past, which gave women, respectively, their rights in the family thirst and then in municipal or mayoral elections, as you may call it, and then in the whole country as a whole. So that today, women have exactly the same rights as men in Turkey. Any man or woman over 22 has the right to vote, and any man or woman over 30 has the right to be elected to the parliament. Women have played very prominent roles in Turkey now as members of parliament, as lawyers, judges, medical doctors. They've completely given up the veil, have they? Yes, engineers, and so on and so forth. Ambassador Sopper has a final question I'd like to ask you. How do the people of Turkey actually feel about the American people and towards the United States government? Well, Mr. Leserp, Turkey is one of the countries where you cannot hear or read on the walls these unpleasant words, quote, American go home. We can't see that in Turkey. Turks and Americans have many things in common. For example, we don't have and we never had before an aristocratic society class in Turkey. The Turk and the American have more or less the same kind of sense of humor. We know how to laugh. We know how to make fun of ourselves. Thank you very much, Ambassador Sopper. It's been a great privilege to have you here tonight. Thank you. The opinions that you've heard our speakers express tonight have been entirely their own. The editorial board for this edition of the Long Gene Chronoscope was Larry Leserp and Ned Kalmer. Our distinguished guest was His Excellency Ambassador Salem Sopper, head of the Turkish delegation to the United Nations. Another busy year of sports timing has already begun for Long Gene, and magnificent sports timing watches like these are working the world over. Timing ski contests in the Alps and the Rockies, speedboat races in Florida and Mexico, indoor track and swimming events from coast to coast. Now the Long Gene watch on your wrist is blood brother to these championship Long Gene timing watches, made in the same Long Gene factory. To the unique Long Gene standards of excellence, the standards that won for Long Gene, ten World Fair Grand Prizes, twenty-eight gold medals, and countless official honors for accuracy. Yes, for the difficult and exacting use of a sports official, or for timing the busy days of active men and women, the choice of the discriminating is Long Gene, the world's most honored watch. So the next you buy a watch, either for yourself or as a gift, remember that throughout the world, no other name on a watch means so much as Long Gene, the world's most honored watch, the world's most honored gift. Premier product of the Long Gene Witner Watch Company, since 1866, maker of watches of the highest character. We invite you to join us every Monday, Wednesday and Friday evening at this same time for the Long Gene Conestment, a television journal of the important issues of the hour, broadcast on behalf of Long Gene, the world's most honored watch, and Witner, distinguished companion to the world honored Long Gene. This is Frank Knight reminding you that Long Gene and Witner watches are sold and service from coast to coast, by more than 4,000 leading jurors who proudly display this emblem, agency for Long Gene Witner watches.


What's going on, infinite fam? Welcome back to another video. It's your girl Denise. If you guys are new to the channel, make sure you hit that subscribe button and join the family. Guys, today is a super busy day. We have to go to the post office and Isaiah and I kind of woke up a little late and Isaiah's already in a rush. Isaiah is in the bathroom getting ready himself so I have to be really quiet because I am about to break him. So guys, I am going to go ahead and set up a camera in the living room and I am going to wait until Isaiah is all ready. Then I'm going to pretend to fall asleep. He is going to have a heart attack because we are super, super busy. We have been super busy these past couple days and it's just gonna set him off. So if you guys are ready for today's video, don't forget to smash that like button and comment team Denise in the comment section below. Let's get it. So he just asked me if I was ready and I completely ignored him. So I'm going to go ahead and lay down on the couch and pretend I'm sleeping and we're going to get his reaction. What are you doing? Babe, we have to go. Babe, come on. You can't sleep right now. We have to go. Babe, let's go. Come on. We have to go to so many places and you're over here sleeping.  You didn't slept for like 10 hours. No, I didn't. We even got up late. Come on. Bloop. Wake mommy up. Lick her face. Lick her eyebrows off. Babe, seriously. Come on. We have to go. So you're going to stay here?  Come on, because I know if I go you're going to be upset.  Why did you take me in? I already know what's going to come. Babe, come on. Seriously.   Come on. For real. Babe, water.  I'm going to spray you. I don't want you to say, oh, why did you leave without me?  You do that all the time. Post office. It's under your payment. Come on.  I need you. Just come to the post office at least. I need you there. I can't get it done over there without you. Okay? It doesn't bother him. Are you going to get up or not? You're losing out on that money. You don't care. So if I go, you're not going to be upset. If you're not up and ready by five, I'm just going to leave it out of you. You sound like a parent. And that's fine. I'm going to count to five. I'm going to give you like a five. Just come on, bro. Stop being childish. It's not even funny.  You want to go to sleep? Like, come on, bro. I always want to put up my baby. Bro, this is why my life is always in a constant rush because you're just lolly gagging. Come on. Lesson. What are you talking about? Being in a good mood even if you're in a rush. I will if things are going smoothly while I'm in that rush. Are you going to get up so we can go? No. Because Isaiah has already left me. He's in the car and we really are in a rush. So if you guys enjoyed today's video, don't forget to smash that like button, comment to your niece in the comment section below. Also, time for today's post notification shout out. Today's post notification shout out goes out to Rosemary Murray. Thank you so much for your love and support. Isaiah and I love you. If you want a post notification shout out, all you guys gotta do is like, comment, share and subscribe and turn your post notification bells on to notify whenever we post a new video and we'll catch you in the next one. Love you infinite fam.


My name is Samuel, I'm a research and insight associate with Nuremberg Financial Group. I just completed my advanced financial modeling course with D-Brow result, which has been significantly impactful for me and in terms of my work. Here I learned how to create financial models from scratch, and in line with global practices, I met a number of other non-executives starting together, creating financial models from scratch to the end. We learned how to create schedules, how to create three statements of financial statement, and also value companies. These have also impacted my work, increased my efficiency, turning around time. I would gladly recommend the AFM course to everyone in my colleagues also who wants to learn how to create financial models and also want to improve their financial skills. Thank you.


So, okay, I wanted, I want to show you the exercise, basically the exercise that I would like us to review is there are two exercises, so one is related to the DEI register and what happened when you refill these reserve values. So I'm using another server for this example. And you can, you can do it with the one that, with the one from the academy. For example, for this case, I'm using, I'm changing the reserve values to 90, and I want you to know where you can find it in your Android app. So, this is what you, that you'll find here, here, in general settings, you'll find 90, and if we go, and if we go to the Android app, and we go to settings, we will find these, all these parameters, all these sections, and if we go to reserve values, and we click here, we will find, for example, in this case, all these parameters, like it says, 90 reserve values left for system case ID, and 89 for TV identifier. And if I click refill, well, then it is going to change to 90, the value that I put it here. So that's one of the ways to do this exercise. You can do it on your own, using the academy, the server from the academy. Again, the value that you were, I'm using an example from another server, so it's not the same number. You will find it here again, one more time. And as to know, we go general, general settings, we go to this section, this part, reserve values, and if we want, and we change the number here, well, in this case, you are not going to be able to change it because the user is not, is not allowing in this case to change, but you can, you can take a screenshot of what is the number that is, that it says for reserve values. And also, you need to find on your Andrea, what are the values that were before we fill in the reserve, the reserve values, and what are the, and if the result is the same as the one we put it here on the end result, that will be the first part of the, of the, of this exercise. And if there's something that is not very clear, very open to, to talk about it. And the other exercise is this one, and it's related to program, the synchronization of program settings. So for program settings, again, we go here synchronization programs. And in this part of the synchronization programs, I've added in this particular case, I added some, some parameters for some programs, for example, child program, TV program and patient morbidity, mortality. And how can I, and I put some, in this case, let's say that it's random number. So it says 150,000 and 50, where can I find, if I'm these parameters that I'm supposed to, that my app is going to download. I'm going to find it here. And this is what I would like you to do to do it is, again, go to the Android app, go to settings, and on settings you'll find sync parameters. You click on program settings, then you're going to find a list of programs. As you can see here, these are the same, the same numbers that I put here. So 150 for child program, 1000 for inpatient and 50 for TV program. And those are the same numbers or of the numbers of the eyes that I that I have put for or change for for these specific programs. Again, and another thing that you can also find here is, for example, it says here, the maximum track and entity. The maximum to download is 200 and the maximum events to download is 1000 right here you can also find it here events, maximum 1000 di 200. So that's the way we can find these parameters. And you can check or validate that what what someone is configuring on the Android settings app is actually changing on the Android app. And it's really important to know that that again, if you put some if there are parameters that you add on the Android settings app, it's going to affect the Andrea always be aware of that. All of I have done this on another server so I hope you can do it on our Academy server. You're going to find programs that are already configure for for each of you. So, again, very open tool to discuss any, any question travel or some or dots that that you have you have about this exercise. There will be it on my side. You want you can start the event now if we have some time. So we can discuss it during this time. Thank you Milagros. So yeah. So now for the participants you have some time to do the exercises. And we're going to remain here in case you need help with it. In case you have more questions about the settings with up Milagros has been Milagros in the meanwhile, if there are no questions because I think it was that creative for someone yesterday. So let's wait for a couple of minutes and if there are no questions we can stop the recording like is the size of the upload file is smaller and people with bandwidth issues can download it. Perfect. So I'm going to stop the recording now right. Wait for one. Are there any questions regarding the exercise. I see one in in slack. It says the reserve values on the server is 80 and in the app is 100. John says, when I click on refill on the app it seems nothing happens. So I'm not sure if they need to reset just to see the 80 or I don't know Milagros. I'm going to check the server. Milagros. I'm not sure if you have not seen your screen anymore. We have some questions in them. In slack people don't understand very well what they need to submit in the size one. So maybe you could go through it again. Yeah, sure. Okay. Okay. What you should submit are two screenshots of this process. So as I said, here is what you will find in the settings web app. And when one of the screenshots that you should submit is the one before refilling. And then what happened after you refill. Sorry, I'm asking some questions as well. I know this was a question by a pretty much yellow was it more clear now we know what you need more clarification. Okay, some of you are saying that it's not working. You need to know that in order to retrieve these new changes you need to make metadata or sync configuration. So there are some values that have been put on the server side, and for your application to receive these changes you need to do a synchronization. If you have free, if, sorry, yeah, maybe you if you have fully sync everything what you can do is delete again the app, the data and see if when you sync you retrieve these new ones.


Chaki, we're playing with Goryachkina with the black pieces. Can you tell us about the game? Okay, it was quite interesting game.  So I have a normal position with extra tempo, Qe7. It cannot be bad for me, but okay, but way which I wanted to realize it probably was wrong because I decided sacrifice piece for two pawns, but okay, but underestimate Bf4, it seems that black is fine, okay.  It was chance, but okay, I am still piece down, okay, Ng2, Bg4, Bg5, Qe5, I don't know. It's very difficult to play. Only pawn against piece, okay, I have pawn f2, but it's very unclear, okay, maybe objectively it was better for me because after take, Nc3. Unfortunately, I have no f2 intermediate move because Bf3. Study like motive and white is much better, but I took and Nxf3 and position is extremely unpleasant with opposite color Bf3. Unfortunately, I cannot attack. It looks like I can make some threats with Nf4 or Bf5, but it doesn't work because if Nf4, instead of Qg4, just rook he1 is strong. I cannot take on g2 because Bxh6 and also I cannot play Bf5 because rook d4 is coming. If Nd3, Nd2, if Nc5, Bf4, I cannot do anything, so okay, I played Qg4, of course my position was bad, okay, she had many good options to play for win, but even when she exchanged queens after Qe3, it's still he has good winning chances, but of course he should put Bb4, not on d4, but to g5 with idea Bd8. Okay, maybe there is draw somehow, but at least I am still suffering, but okay, she just exchanged pieces and draw. But you feel she could have tried more at that point? Yes, even in endgame after Bg5, okay, it's still quite dangerous situation for me. I don't know after Nd4 or immediately without Nd4, even Bd8 is coming after c6, Nd4 came. I have some chances for draw, but it's not easy. Right, well, it's been an interesting game and a tough day for you now. What about the evening? What are your plans for the evening? Okay, firstly, I want to go for a walk, then I will eat something, okay, then I don't know. Probably I will see games from Corus, okay, what else? I don't know. Well, we wish you have a pleasant evening and we hope to have you back in our studio. Okay, thank you. Thank you.


Welcome to this edition of Vantage Point. We are about to enter into the holy season of Lent, a time where Christians across the world are observing this time, a time of fasting, a time of almsgiving, a time of repentance, a time of confession, and a time to prepare for the coming of the resurrection of Christ. Welcome to this edition of Vantage Point. Give me today is Eric Anderson, our Minister of Communication and Technology for the Connecticut Conference of the United Church of Christ. Welcome, Eric. Thanks, Kent. It's great to be back here. It's good to have you here. So today we're going to have a conversation, Eric, about Lent and about this season that we are entering into. One of the most important seasons for the Christian Church and a time of observance among many of our congregations here in the Missionary Society of Connecticut. Eric, you wrote something in the Spirit Calendar, which really caught my attention. And you said in that calendar that this Lent you were going to try to believe the good news. Could you say something more about that? I'm intrigued by that. Sure. Two things came together for that particular statement. One is that I personally am in a state of grief this season. A much-loved aunt died just at the end of January. And the second thing that came together was one of the classic phrases that we use when we place ashes on people during an Ash Wednesday service. It's not the one, remember you are dust and to dust you will return. It says, repent of your sins, believe in the good news. And so this Lent where grief is such an overriding reality, believing in the good news is just that much more of a stretch. And that became my challenge as a Lenten discipline. Thank you. One of my favorite writers and teachers is a man named Henry Nowan. Henry writes these words about Lent. Lent is the most important time of the year to nurture our inner life. It is the time during which we not only prepare ourselves to celebrate the mystery of the death and resurrection of Jesus, but also the death and resurrection that constantly takes place within us. True repentance is an interior attitude in which we are willing to let go of everything that prevents us from growing into spiritual maturity. And there's hardly a moment in our lives in which we are not invited to detach ourselves from certain ways of thinking, ways of speaking, ways of acting. Lent is a gentle but also demanding time. It's a time of solitude but also community. It's a time of listening to the voice within but also a time of paying attention to other people's needs. It's a time to continuously make the passage to new inner life as well as to life with those around us. Believing in the good news involves proclamation and the good news needs to be proclaimed and people need to hear the good news. We've been trying to share the good news on our staff with our communications ministry by having members of the staff write reflections every week. This Lent and beginning this Lent, we're starting a new series not just relying on staff for reflections. Can you share something about what's happening in the conference around writing? I am so excited about this. We're calling it Spirited Wednesday and the very first issue comes out today on Ash Wednesday. We've recruited, I believe the number is now up to 28 folks from around the conference. Most of them are clergy, a few of them are lay people, a couple of members in discernment, people who have a faith foundation that they're interested in sharing. The very first piece is by Maxwell Grant, the senior minister at Second Congregational Church UCC in Greenwich, and I can't wait until everybody sees this one. I've already read it, it's just filled with charm and wisdom and depth and I think a lot of people are going to really find some value, some spiritual value in the things that these folks are going to share. How would I access Spirited Wednesday if I wanted to get those, is it an email subscription service, is it on the website, how do I find this? Yes and yes, it's actually fairly typical of our media in the Connecticut conference. Spirited Wednesday will go to the folks who are already subscribers to our spirit calendar, which is the weekly reflection from our staff members. That's an email, they sign up for it at ctucc.org slash phyto and there's a sign in process, put in your email, select the services you want, make sure you click spirit calendar and Spirited Wednesday and you'll be getting the next one. But you can also find it on our website at ctucc.org and we make sure that when we post a new one that it is highlighted in our Twitter feed and on our Facebook page. The Gospel text for Ash Wednesday is from the 6th chapter of the Gospel of Matthew. Beware of practicing your piety before others in order to be seen by them, for then you have no reward from your God in heaven. So whenever you give alms do not sound a trumpet before you as the hypocrites do in the synagogues and in the streets, so that they may be praised by others. Truly I tell you they have received their reward, but when you give alms do not let your left hand know what your right hand is doing so that your alms may be done in secret and God who sees in secret will reward you. And whenever you pray do not be like the hypocrites, but they love to stand and pray in the synagogues and at the street corners so that they may be seen by others. Truly I tell you they have received their reward.  And whenever you fast do not look dismal like the hypocrites for they disfigure their faces so as to show others that they are fasting. Truly I tell you they have received their reward.  Do not store up for yourselves treasures on earth where moth and rust consume and where thieves break in and steal, but store up for yourselves treasures in heaven where neither moth nor rust consumes and where thieves do not break in and steal. For where your treasure is there your heart will be also. In the spirit of interdependence our conferences in New England are participating this Lenten something that is now the fourth year of practice around it, the Lenten Carbon Fast. And I'm excited to lend my support and my name to this endeavor to encourage people to also sign up for yet another reflection on how people can be mindful of reducing their carbon footprint. Can you say something about the Lenten Carbon Fast, the Ecumenical Carbon Fast? The Ecumenical Lenten Carbon Fast is a daily email message. You again subscribe to it there is a link to it right from the homepage of our website. Each day's message includes sometimes a reflection on an environmental reality in our world. Very often it's a practical step that you as a homeowner or a renter or just simply an ordinary citizen can take in order to reduce your use of energy and your harmful impact on our environment. It's a great service. So we are finding ways to deepen our relationship with God during this season of Lent. There are various ways that's done, some in writing, some in reflection, some in prayer, some in giving alms, a word that we don't talk about very much, but a way of making contributions to those who are in need of some support. Is there anything else you want to say in closing around the season of Lent that we're now entering into? Lent is an underappreciated season. We tend to associate it with some kind of a radical penitence and a penitence that increasingly seems to be disconnected from the actual state of our souls. But there is a reality I think that most of us, whether we be Christians, non-Christians, followers of some faith tradition or followers of no faith tradition at all, we are disconnected from our best selves. We are disconnected from those around us. And seasons like Lent remind us that it takes work to make those connections, to keep those connections, to renew those connections, to strengthen those connections, and when Lent comes to an end, to celebrate those connections, to see new life springing forth from what we thought was gone. Thank you. My guest today has been Eric Anderson, the Minister of Communication and Technology for the Connecticut Conference. We are grateful for your interest and vantage point. If you do have suggestions about our content for this video series, please email Eric Anderson at webmasteratctucc.org. Thank you and blessings to you. So here's a prayer for Lent. O God, be with us through this tender and delicate time. Be with us in the narrow and the thin places of the world. Break through and find us, for we are often wandering lost, and we seek the shepherd who seeks us. Amen.


Hello everyone, my name is Ryan Turner and I'm a software engineer at Uber and today I'm going to talk to you about something called production workload identity and explain what that means and how we can use it to improve scary posture. And how we can achieve that with something called spire. So to start I want to talk about a fictional services organization which I've invented for the purposes of this talk. It's called starboard games, and they want to get into the business of selling board games as an online retailer. So let's take a look at how they might initially build this system. So first they come up with a three tier architecture to represent different layers of the application. So this is composed of three different layers one is the storage layer which is a persistent stateful layer. And that contains data that is represented in the system. Then there's an application layer which interacts with that stateful storage and creates reads updates deletes that data. And then there's a web presentation layer which is accessible to users. And that's how they interact with the platform and that web layer talks to the app layer to do different operations and system. So this is all in this example running in an AWS VPC. And as an online retailer, this company wants to provide some level of security so that not everything in their production deployment is accessible over the internet. So they do this naturally through VPC at goals. And they basically set up three different Apple policies. One says that only things from the internet can access the web subnet. Only things from the web subnet can talk to the app subnet and only things from the app subnet can talk to the storage subnet. So pretty simple. And but over time they grow and they decide they want to try to decompose some of the functionality in this app subnet into several different microservices. So they move more towards a microservice architecture. And suddenly their deployment has gotten much more complicated. So you'll see in the middle and bottom layers where there was only one subnet there now that's tripled where the service in the app subnet has now been decomposed into three different services. The account service and order service which talks to the account service to get information about an account. And then a recommendation service which talks to both the account service and the order service to provide customized recommendations to users. And each of these services has its own database. So, all of a sudden this middle and bottom layer has gotten much more complex. Additionally, the operations team has come up with a requirement to be able to access the instances running in production through a jump box. And so there's a new admin jump box of net, which is a much more privileged subnet, and can talk to things in the web subnet, as well as things in the app subnets. So quickly, the organization realizes this is something that's difficult to manage. I want to talk about what this organization's long term goals might be. So, in this hypothetical example, let's say that they have some growth plans here to expand the retail business from North America to Europe and Asia, so to have more of a global footprint. They also want to provide an online board name experience, where users can subscribe to their platform and play multiplayer games online together. And we also want to host board game tournaments and physical locations where users can register for these board games and meet up in person. And those board games are sponsored by a board game company or some other companies, which provide this starboard games company some revenue. And what are the technical objectives here that this organization might face. Well, in the previous architectures we've seen that each instance of a service runs in its own virtual machine in AWS. And we know that this is not the most efficient way to run services today. There are many operating system services that are being duplicated for every instance of a service. So this organization wants to adopt containers and run their services as containers so that they can have a more general compute pool of resources and run instances of their service across that pool. They also want to streamline their deployment and most effectively use those compute resources in their compute pool using Kubernetes. Additionally, they have a requirement to use a native GCP service for the online board game experience that they're trying to build today. They only have a deployment in AWS. So this is a new set of challenges that they need to overcome. So with all of these growth plans and technical objectives. There are some new security challenges that we need to consider. So the business now has a couple of new priorities based on these growth plans. One is that they need to be more active in preventing ordering subscription fraud. Now that they're a global company, they're much bigger target for online fraud. And that has a big impact on their overall bottom line. They also want to protect users privacy and confidentiality. And this is important because they are now introducing physical meetups for the board game tournaments. So something about users location at a certain time could be exposed if an unauthorized actor or malicious actor was able to obtain that data. So this is kind of sensitive data that we want to protect. So what are some current challenges we might have with this existing architecture to satisfy these security challenges? Well, the current service to service authorization policies are all basically just network level ACLs. So since everything is running an instance in per VM, we can kind of design things around an IP address or a DNS name as a way of identifying a service. But when services are running in containers on the same host, those constructs suddenly lose meaning. And as a microservices deployment gets more and more complex, this does not really scale. Additionally, this perimeter based security model is really not sufficient on its own to protect unauthorized access to services in the network. Take for example this admin jump box. If anyone were able to compromise in operations teams credentials and get SSH access to that VM in the subnet for the admin jump box, they basically have unfettered access to any of the microservices running in the VPC. So this is quite dangerous. So now the question is where do we go from here? How do we actually achieve these security objectives? Well, I think it's pretty clear we need a new model. The existing network based model is not really working for us the way we want it to. So what we really need is a secure, precise way of identifying workloads to enable strong authentication in services service communication in order to limit access to only authorized actors in the system. So this is kind of the mission statement here. This is what we're trying to achieve to satisfy the business challenge security challenges that we've identified. So how will we actually go about this? Well, this is where spiffy comes in. So spiffy stands for secure production identity framework for everyone. And it's an open source set of specifications that define what is a workload identity, how do you represent it, and how do you as a workload obtain its identity. And this concept of a workload identity and spiffy is not tied to any network level constructs like IP address or DNS name. So it allows us to, in this more microservices container based world, identify workloads. So how does spiffy describe a workload identity? Well, it describes it through something called a spiffy ID. And this is an identifier string, which is actually represented as a URI. And there's an example of such a spiffy ID. So this is one example. We have three components to spiffy ID. One is a static scheme, which indicates that this is a spiffy ID. So it just is a static component. And then the host portion of the URI is something called a trust domain. And a trust domain is really like a logical security and or administrative boundary for trust. And then finally the path component. This is really a user defined value. It can be anything. The specification does not really dictate what the value is other than what characters can be in the path. But basically this path is what is representing the name of the workload that other workloads can use to identify it. So in this case, we're saying this is the entity workload running in the mydomain.org trust domain. Okay, great. So we have a way to refer to workload, but that in itself is not really enough to tell us for a given RPC, how do we know that this service is who it claims to be. So how did we enable this kind of authentication, the strong authentication, using the spiffy ID building block that we just talked about. Well, this is done through something called a spiffy verifiable identity document. So spiffy defines this specification of an SFID. And an SFID is a digitally signed document, which allows workloads to basically enable strong authentication using cryptographically verifiable chains of trust. So there are two different kinds of SFIDs defined in spiffy today. One is an X519 and SFID. So this is an X519 certificate with certain constraints defined in spiffy. And then there is also a John SFID type, JSON web token. And additionally, this SFID type also uses the standard JWT format but with some additional constraints introduced. So here's an example of an X519 SFID. And I've just highlighted the portions that are relevant to highlight today. So we have an issuer. In this case, this is issued by an organization called spiffy. And we also have a subject. And here this is, the subject is basically an organization called SPIR. And then you'll see in the validity portion here, there's a not before and a not after. And these are actually only an hour apart from one another. So this is actually a really powerful thing to have a short lived identity. And this is something we'll talk about a little bit later with SPIR. But the core thing we want to highlight here is this URI subject alternative name in the certificate. And this contains the spiffy ID of the workload. So this is really what identifies what this certificate is issued for. And this example, it's issued for the service orders in the example.org trust domain. And then here's an example of a JWT SFID. So very similar. We have a subject claim here, the SUB claim, which has the spiffy ID of the service that this token is issued for. We also have an AUD claim, which represents the list of audiences that this token is valid for. And in this case, we're saying that this token is valid for the account service. There's also these other two claims, EXP, which stands for expiration time, and IAT, which stands for issued at. And you'll see here that these values only differ by 300 UNIX seconds here, and 300 seconds is five minutes. So again, this is highlighting that this is a short lived identity, which is really powerful because if the identity was compromised in any form, it would only be valid for up to five minutes in this example. Okay, so we've talked about how do you refer to a workload by its spiffy ID, and how that ID is represented in a cryptograph, the verifiable document called an SFID. Now, how do workloads obtain their identity, or in other words, their SFID. Well, this is defined in spiffy as the workload API. And this is a GRPC based API, which is available over a local UNIX socket endpoint in the recommended deployment form. It can also be deployed as a TCP socket, but in general that is not recommended for some security reasons that I won't really go too much into today, but you can read about it in the spec if you're interested. And this API exposes a few APIs, but these are the two that I'll kind of hone in on today, which are probably the most important to talk about. So one is an x509 SFID API called fetch x509 SFID, and this is how a client would actually get its identity in the form of an x509 SFID. It's a server streaming RPC, meaning that when the client connects, it opens this long live stream over which the server can actually push things later. So we'll see how that works later. And then there's a Jada SFID API, which in this case is a unary RPC, so that means the client will request its identity. And then it'll just receive the response and anytime it needs another identity, it just re requests it from this RPC. Okay, so that's spiffy. So now we basically define these primitives of workload identity, how it's represented and how we can obtain one. And then we use these things to actually enable secure authentication. Well, this is where spire comes in. So spire is actually an open source implementation of the spiffy specifications. And I just want to highlight a few key features about spire that are really interesting, like above and beyond what spiffy defines. One is that it automatically refreshes the identity documents that it issues. And this is really powerful when you combine it with the concept of a short lived identity, because you can actually define these short lived identities in the platform, and spire will automatically rotate them and push the new identity documents directly to the workload that needs them. And additionally spire can run in many environments, including in Kubernetes, or in native VMs in AWS, GCP and Azure, as well as in your own private cloud infrastructure. It supports identification of workloads via several means. One is Unix socket, another is a Docker container. Sorry, Unix process or a Docker container, or a Kubernetes pod. It also has flexibility to be extended into several different ways based on some of the key features that it delivers. You can actually write your own plugins and plug those into spire to adapt it for your own environment or use cases. So I want to kind of quickly go over what the architecture of spire looks like and how the control plane is designed. So there are three components here. On the right we have the spire database, and this contains information about the different types of workloads that can receive identity in this environment. In this case we're talking about a trust domain, which is the logical boundary for a spire deployment. And a spire server deployment here talks to the spire database and manages those workload registrations. And this can be deployed as a highly available active active deployment. And then on the left here we have two different hosts in this example, host A and a host B. And each of these hosts runs a host local agent called the spire agent. And the responsibility of the spire agent is to reach out to the spire server to get workload identities for all the different types of workloads which can run on the same host as that agent. And to cache those identities for the lifetime of those identities and deliver them to the workloads that need them as well as refresh them over time. So this is at a high level, the architecture. Now I just kind of want to walk through the whole flow of how a workload is registered in spire, and then how a workload obtains the identity for that registration, as well as how that identity is rotated and pushed back to the workload. So at the top here we have a component called a workload administrator. And this could be something that is like a deployment engine, which launches containers or launches processes that need identity. It also could be a separate service which uses a source of truth that shares with a workload administrator. So it can look up information about deployments and see where workloads are running. And then it can, what its purpose in this diagram is, is to actually make those registrations in the spire server to designate that these are identities which should be available in this environment. And so in this example where our workload orchestrator is going to deploy an instance of the order service and the account service. And so when it goes to do that deployment, it's going to reach out to the spire server, and it's going to register identities for the orders and accounts services. And then spire server is going to persist those workload registrations in its database. Okay, so this is kind of the registration onboarding flow. Now, on the left here we have two different hosts, a host A and host B again, and each of those is running an instance of a spire agent. So spire agent is, has a secure channel set up with the spire server, and it requests all of the workload identities that it can serve on the host that it's running on. So it's going to send certificate signing requests for all the x509 identities that I can serve. And the spire server will sign those certificate signing requests for all those workload identities and send them back to the agents that requested those signings. Okay, so now the agent has the identities for the workloads cached locally. So now the orchestrator launches instances of the order service in the account service. So the order services running on host A, and the account services running on host B. The order service requests an x509 svid from the spire agent, and the account service does the same on its local host. Now, both of those services get their identities from spire, and they set up the secure channel over mutually authenticated TLS. And now the order service can issue an RPC over the secure channel. And using the spiffy ID present in the x509 svid, the account service can actually verify whether or not the service that is making the request is is authorized to issue that request. So it can basically define an authorization policy which says the only the order service is allowed to access the get user account API, for example. Okay, so great we have this secure authentication now between services. And this is something that's cryptographically verifiable with TLS. And then the next part of the life cycle of the x509 svid is that at some point it's going to expire. So the agent has to request new updated rotated svids for these workloads. So it reaches out to the spire server and asks for newly signed certificates. And the spire server refreshes those x509 identities in the same way that it originally issued them by signing the certificate signing request sent by the agent. And then once the agents get those updated identities, they actually push them to the services which contacted them over the workload API. So earlier we talked about how the fetch x509 svid RPC and the spiffy workload API is a server streaming RPC. So this is where why it's designed that way is so that later on the spire agent can transparently push the rotated identities to the workloads. Okay, so just to kind of focus on the first part of this overall flow that we talked about we had this workload orchestrator which was creating these workload registrations for workloads. So that's really how spire identifies different workloads of Tron on the different hosts in the environment. And this is how we represent registration inspire. And there are three key properties I'm going to focus on one is a spiffy ID. And this is at the top here this represents the workload itself. So this is what the identity is issued for is issued for the service orders here. And there's a concept called a parent ID. And this parent ID is really powerful allows us to group workload registrations to particular agent we're set of agents. So it allows us to effectively control which workloads can run on which hosts. And then the third thing here is something called a selector. This selector is a runtime attribute that we use to identify the workload that is trying to obtain an identity. And so in this case we have like a Docker environment variable selector called service underscore name, which is equal to orders, and a selector called pod name for Kubernetes, which is set to the value of order service and then Kubernetes namespace which is set to production. And so what this means is any service which has is running as a Docker container and has this service name environment variable set to the value of orders and has a pod name orders service and has a Kubernetes namespace of production is entitled to this identity of service orders. And then selectors are powerful and there are several that you can choose from. So other examples here would be like pod attributes and Kubernetes and labels of Docker containers. Okay, so let's talk a little bit about workload attestation. So this is the process of identifying a workload and issuing an identity. So at the top here we have a workload, which reaches the Spire agent over the workload API to request its identity. And this is not on authenticated requests. The workload doesn't provide any sort of like certificate or token or key or anything it just says hey give me an identity. And the Spire agent uses these different configured workload attestor plugins to determine what that workload is. So it's going to discover dynamically run time attributes about the process in order to match those selectors against selectors in the registrations that it knows about. So in this case, there are three plugins configured, there's a UNIX plugin and a Docker plugin and a Kubernetes plugin. And each of these plugins is going to reach out to a trusted authority in our infrastructure. So in the case of a UNIX it's going to reach out to the Linux kernel. In the case of Docker, it's going to reach out to the Docker daemon on the host. And in the case of Kubernetes is going to reach out to the local Kubla agent running on the host. Okay, so the workload contacts the workload API asks for the agent asks for all the selectors about that process from these different plugins. And then it gets a set of all these selectors available about that process. I know that this process is running with this UID of one, two, three, four, five with, which is a user called Bob. And then it has the service name environment variable set in Docker called orders. And it has a pod name in Kubernetes called orders hyphen service and it has a Kubernetes namespace of production. Well, if you're observant you may have seen that these last three selectors actually match the registration we talked about in the previous slide. Because it matches those three selectors, we can actually give this workload the identity for that registration of service orders that we talked about. So the workload API in this example would return the x5 and svid for the example.org slash service slash orders identity. So that's how workload out of station works. Now, what have we seen so far. Okay, this is there's been a lot of concepts we talked about. And how what does it all mean. So we've seen that the orders and the account services are now bootstrapped with cryptographically verifiable identities. And in this case it's an x5 and I'm acid. So this really enables the orders and the account services to be able to trust one another because they can verify the chains of trust associated with those. Using that verification, they can use secure communication using mutually authenticated TLS to encrypt traffic between the orders and account services. And using this Svid concept the accounts service can now actually identify in a very precise and secure way what the workload is on the other side of the channel. Using the spiffy ID present in the Svid. And based on that authentication method, it can actually start to write some authorization policies to say, only service orders can contact this account service for this particular API. And we've seen that these cryptograph keys, which are represented as as fids are actually rotated automatically by spire, and they're pushed transparently to the services on update so they don't need to manage any logic to refresh their identities on any certain cadence. So what's coming next, I just want to quickly talk about upcoming things inspire, which might be interesting to you. So, a major thing that we're focusing on is trying to improve these are experiencing kubernetes to be much more turnkey right now it's a little bit complicated there are a lot of configurations and you need to think about. So we're trying to make that a little bit easier to get going on. We're also trying to support workloads and environments where you cannot run a spire agent and environments that you might think of in this category or like serverless computing, like AWS Lambda for example, where we don't really control the infrastructure that the workload runs on, but the workload may still need an identity to talk to services. So we're trying to export those these cases. We're also working on providing a privileged API, which delegates the responsibility of issuing sfids to workloads to a trusted actor. So an example might be like a proxy on a host where services all route their traffic through a local proxy, and then the proxy determines was the identity of the caller, and how do I propagate that identity and like a TLS connection for example. Then we are also working on improving the support for Federation and Federation is really a concept in spiffy where based on different trust domains, we may have workloads running in a workload running in one trust domain, and a workload running in another trust domain, and they need to be able to talk to each other and trust each other. And that concept is called Federation spiffy. So we're working on providing a configurable API to designate what are the Federation relationships for different workloads and system. We're also working on improving our attestation of supply chain provenance using binary signing verification. We're also trying to enable secret list authentication to GCP using open ID connect Federation. And then in the long term we are working on how do we improve the key revocation and forced rotation with inspire. And then similarly for Azure we're also trying to enable secret list authentication using IDC Federation. We're also working on some production readiness kind of work like improving the health check subsystem to be more robust and improving error messages so that they're more actionable to users. So if you're interested in about spiffy inspire I'd encourage you to attend the talk that's coming up next, which is called bridging the great divide spiffy spire for cross cluster authentication which is being given by a spiffy inspire And it's going to talk a lot more about Federation and how you can leverage those concepts. If you're are interested in the project and more and more I'd encourage you to go to spiffy.io which is the website for spiffy inspire. We also have GitHub repos for each spiffy inspire. And then we also have a slack workspace where we engage with users on a regular basis. That's all I have. So thank you for attending.