It's a challenge to talk about foreign aid at wider. You know from the selectivity that most of the people in the room will know more about aid than you do, or than I do in this case. So I will refrain from giving the great overview that Sam gave and instead give what could be considered a case study. I know that economists hate case studies, but I've recently drifted into interdisciplinary work and I've learned that it actually can provide insights sometimes, even though it is mainly gossip. So I'll try to give you a case study of the debate and how it involves in foreign aid in this discussion of aid. First of all, looking at some numbers, trying to get back here, this is the sexual distribution of aid commitments from the bilateral donors from 1970 to 2010 and you will notice that my scale is off by 100. But this should be in 2013, US dollars and then 100 million dollars. What you should note here is that we have four main sectors and the first sector on economic infrastructure is transport, communication and energy. So we've been talking a lot about this, this is infrastructure building. Justin Lin alluded to this, Durkan alluded to it and also Steve O'Connell talked about the importance of infrastructure, the importance of energy and power in their analysis of the need for aid. We also have production sectors, agriculture, industry mining, construction and then trade and tourism. So these are what's called the economic sectors, as I said. In total, it's about 30 billion US dollars and we have the social infrastructure where we had the largest increase, but in there we see water supply and sanitation. And finally, on top of what I'm not showing, what we have is these multi-sectoral allocations, that's budget support. But what you see from this is that we actually spent a substantial amount of money on capital investment, infrastructure or machines or whatever. As Justin Lin talked about yesterday, the World Bank is also now changing or has been into infrastructure. It's now the single largest business line of the World Bank Group. It represents 43% of total assistance from the group to low and middle income countries. So you could say that infrastructure and by that capital in total is certainly on the agenda in the aid community and the way we give aid. Now, some analysis would then think about what's the return? Sam talked about the return to aid in their simulation study. This is a study by a Casselian fire in quarterly journal of economics in 2007. And what they did was a calibration of the return. This is a broader scope. They're thinking what is actually the return to investment in reproducible capital. So they subtract in some of these natural capital and they correct for some price differences between rich and poor countries. Moving from a very large difference in the return to capital from rich countries and poor countries from 27 here to an 11%, moving down correcting as they do for these differences of natural capital and prices. They find that actually in the group of rich countries the return to capital is about 8%, 8.4%, whereas for poor countries it's lower. And they rationalize virtually all of the cross-country variation in capital per worker without appealing to international capital market frictions. So capital markets are working in that situation. They're simply a lower return to capital in the poor countries relative to the rich countries. In the conclusion, Casselian fire state that as a result increased rate flows to developing countries are unlikely to have much impact on capital stocks and output unless they're accompanied by a return to financial repression and in particular to an effective ban on capital outflows in these countries. Even in that case increased rate flows would be a move towards inefficiency and not increased efficiency in the international allocation of capital. So in that perspective the call for more capital or infrastructure, whatever investment in that perspective this is actually not efficient as such, right? If we consider infrastructure as being part of this broad capital concept and this is what they do in their conclusion. This is a bit interesting because it takes us back the 30 years. It takes us back to the mostly micro-macro paradox because the World Bank in 2003 and 2004 were still producing economic returns, economic rates of returns on their projects. So these are projects in different sectors. Whoa, this goes wrong. These are returns to projects in the different sectors and you will see the economic rate of return in the next final column and then the revised economic rate of return. For different sectors you find very respectable rates of returns but again project-based. So these are the assessments by the World Bank on their projects only the ones where they actually do compute an internal rate of return. When you think of this in terms of country and incomes then we see that in the lower income countries we have a return of about 19% and 20% for lower middle and upper middle income whereas if you go to the high income countries the returns to these projects is much, much lower. So we're back, you can think of in terms of having this paradox where we still find in the early 2000s, still find high returns on our investments, project investments but at the aggregate level we find low returns and capital flight would be induced according to Kasselian Fyre. Basically when you think of what they're doing and what you can't be doing there are three approaches as Kasselian Fyre mentioned to computing aggregate model of product of capital. One is to look at interest rates. This is hampered a bit by other restrictions in the markets. You could also do regression analysis of GDP growth on changes in capital which would be more or less investment but it could be a structure like a growth accounting formulation or you could calibrate based on national account statistics and other data. Kasselian Fyre using the third method by calibration and this is why they have the country by country observations. Together with Carl Johan Delgar he and I have been working on estimating the return to aid investments using regression. So we start out from this growth accounting formulation and allow aid capital to be different from domestic capital if you like. So making this distinction between if you like infrastructure investment funded by aid and machinery or whatever private capital as part of the domestic capital. So we think we allow the marginal products of the two types of capital to differ within countries and then we estimate the returns instead of calibrating these. The problem is of course we do not observe the aid investments. We do observe what has been allocated but not what has been built as such. The same problem goes for the accumulated investment used to create the capital stock in general but for aid it's virtually impossible to get a good guess of the capital label. So this is why we think of this as an unknown parameter and you can think of the share of aid investment in the share of total aid. It's on the margin but what you find that the return to aid capital is of course a function of this. So if all aid is invested we estimate a return just below 20%. If half of the aid is invested we estimate a return slightly above 20%. What you get from this is that this is not an important unknown parameter. It's not truly important to know with great precision how large a fraction of aid we actually spend on capital as such. We get close to these 20% as you will see from these regressions. This is the overall average from 94 countries over 40 years. It's in the wider paper mentioned here. As you have to do with regression work you have to do a lot of different estimations, different regressions. So we run six different regressions on two different data sets. What we get is 20% gross return. This is the gross return we get so we have to deduct the depreciation on capital. The gross return in the neighborhood of 20% does not seem to be completely off. You may think of this as a bit high but then again the depreciation rate could be fairly high in some of these countries as well. So thinking of 10-12% as a return or a macro level may not be totally wrong. What we get from this is the 20% and we also get this is in good accord with the median World Bank projects. These 19-20% is what we get from the average across 94 countries, different data sets, different periods. So we think of this correspondence as supporting our results. We would also claim that this is not necessarily in contradiction with the overall return on aid being more or less the same in rich and poor countries because we are discussing different kinds of investments. Aid is not funding private sector machinery or capital equipment. It is funding infrastructure. And it should be... It's not difficult to think of a situation where aid has a huge return whereas private investment has a low return because that's exactly what happens when you have poor infrastructure and it could be when costs are high. So we may actually find a negative correlation between aid investments and private investment in this situation. So it could be that the overall return as calibrated by Kasselian and Fira is precise for this overall thing. But it has nothing to do with the return to aid. So the claim that aid inflows are just going to rush out of the country but capital outflows seems not well substantiated in this case. We can get some support for this in another reason studied by Pablo Selyer who's here at Eva Soonersen. They have been looking at foreign aid and foreign direct investments. And what they find is that if aid is directed towards infrastructure, human capital, whatever, there's actually crowding in terms of attracting foreign direct investments. If aid is for the competing sectors, there's a crowding out. So it's fairly clear in our mind at least that aid investment do have a positive economic return. Thank you very much.


The third continental assembly of the ALBA movements concluded in Argentina on May 1st. The platform brings together over 400 progressive social movements and organizations across Latin America and the Caribbean. ALBA movements was formed in 2013 amidst a growing tide of opposition to neoliberalism and US imperialism in the region. It followed other regional integration platforms created by revolutionary leaders Fidel Castro and Hugo Chavez. In this third assembly, the platform vowed to strengthen its work with anti-capitalist and anti-imperialist movements and groups across the world and ratified its membership to the International People's Assembly. We refuse to give capitalism any more time. We refuse to give them more time for capitalism. Capitalism's time is finished. Capitalism's time is over. 260 delegates from 23 countries participated in the five-day meeting in Buenos Aires and addressed the platform's six key principles of work and unity. These included internationalism and regional unity, decolonization, cooperation and defense of the planet. Delegates also discussed issues of democratization, sovereignty, popular feminism and the economy. The gathering also emphasized the importance of the Cuban and Venezuelan revolutions. Caribbean People's Assembly member Camille Chambers stated that imperialism could not control the region thanks to these revolutions. In the face of the crises of capitalism and neoliberalism, delegates emphasized the need for a socialist political project. Argentine delegates also called for the expulsion of NATO from the region, including its military base on the Falkland Islands. A key theme for the summit was also the ideological and cultural battles facing progressive social movements. Ecuadorian peasant leader Wilman Sarango presented proposals to strengthen Alba's work, including political education schools and the people's media.


What's going on everyone Sam here with latent sports cards are been one box to twenty one twenty two Penini mosaic road to the FIFA World Cup soccer hobby box for Stefan L It's good luck here Stefan. Let's do it buddy. Dude. I'm that's what I was gonna say We got to get hunter pens to the shop and break with Brent and Caleb. That'd be fantastic No, let's get that. We gotta get that in the works Do you know, um, do you remember hunter pens? Yeah, he apparently Max just said that he streams Magic the gathering on twitch really be like hey, let's reach out the hunter pens and get them in the shop and break with Caleb and Or I thought Caleb and Brent. Yeah, awesome, dude. Why not? Yeah, say we got it. We got to all make hunter pens signs for sure That was so funny Louise from oh from Mexico Will car for Nias for Venezuela pitch masters Ibrahimovic and Savitzer. I Loved hunter pens. Yeah, he's like one of my favorite players when I was little, too I'd be like star struck. There's a Holland base. There's a team over for Germany Cut it Cody Gakbo, that's okay What? We have an issue with that too. That's just this is weird. What's weird put ketchup on hot dog That's just that's not like That's just that's not something you should like advertise the people Like a different dimension right now. It's in Cavani. We just got silver Carlson. Oh God here. We go. Yeah. Yeah. I Don't know. I'm not a catch-up on a hot dog. I think that's strange What?  It's not weird like Oh Vojtek Skvetsny for Poland Gorgende Erskada for Germany Oh now Ryan whoa, whoa, whoa, whoa with the mail back it up Back it up with the mail you put mail on it. I've seen people do it really No, I would sit like catch up on hot dog. It's not it's not an out-of-the-ordinary thing I just think it's like Vinnie, Jr. Nice and a silver Dijon Kulisevsky I Just think it's like it's like the most inferior topping of the three like mustard relish good good I think ketchup's kind of like you're pushing it Chili I would put on onions sauerkraut. I think I didn't catch up goes below all of those No, no, no, I don't like I don't like Onions you're gone onions are good.  Yeah, definitely That's Jackson Irvine. See thank you for us. No, you guys are silver for three coach. She's a I don't know See, thank you. See Brian knows Brian's from Chicago. That's like a hot dog Mecca and he says it's a sin We've got Tyler Adams from the United States on the Scripps auto not numbered right. I didn't see your ID Jenless God you see Garth Bale for Wales Yeah, no, I'm the same way like it's not some it's not the first time I all put ketchup on my hot dog every now And I won't not do it, but it's just not my favorite Me it's just ketchup mustard relish. That's what I love it. I Can get behind mustard and relish. Yeah Jules Kunde Phil Foden So for so relish, you don't like sweet relish. I like sweet like pickle or like Yeah, yeah, that's good Bo expand Uri telemonds ketchup on that bad boy Martin Boyle Australia and Base that'll do it for your box there Stefan not too too bad for a man We'll get them right out to you. Thanks as always buddy


I'm curious to see how sharing a screen from your browser to share your browser is going to work. You can only share. Do I need to give you some special permissions? I don't think so. I know. That's perfect. Came across. You see it. Yep. Double screens going. Yeah, that looks very good. So I think we can start. So welcome, everyone, sorry for the late notice, but I see some people showed up. And thanks a lot, Jeff, for stepping in and giving us an overview on this topic. So yeah, go ahead. Yeah, good morning, everyone, or good evening, depending on where you're at. I'm Jeff Saylence. I work in the CNF working group as one of the co-chairs right now underneath the CNCF umbrella. So I work with my friend Taylor and Ian Wells around, we're really focused on the network device inside of containers paradigm. But we typically work with service providers, and what you'll find is that most service providers run air-gapped environments. And there's lots and lots of reasons for why they have to do this. Typically, you want some type of network segmentation when you're hosting the internet. You want to keep your private stuff private. And so typically, there's maybe at best a proxy, sometimes not even that. And it's for your typical security compliance reasons. So it's not just the whole wall perimeter, but the era of potentially pulling up a malicious image through a public repo. You run a Helm chart, and suddenly something spins up that you don't want to spin up, and it tries to phone home. If there's a default proxy set up, you can get yourself into trouble really, really fast. So at my previous job, I was at Charter Communications as one of our lead architects for our Container as a Service Platform. We set out to build a fully air-gapped container as a service platform. And we had quite a few bumps and bruises along the way. You find out that getting something truly air-gapped, especially in the world of cloud, where it just assumes that you can egress out of your VPC or you can egress out of your data center and go to Red Hat or VMware or whoever's repos, whoever your favorite software developers, there's just this notion that maybe there's Docker Hub floating around there somewhere and that you're always going to have access to it. Then suddenly, you don't. And so how do you develop and run the images that you want, but then build a pipeline that then assumes that you were going to then not have any access whatsoever to the internet? And so this is just kind of a very high-level overview of what we were building. So the other big thing, right, is you're gonna start with an internal repository. It can be any of the favorite ones. It could be Artifactory, it could be Harbor, be Homegrown, but one of the biggest things that you have to instantly get all the people who wanna move fast to not do is to basically just turn that into a proxy. So most of the private repositories have the ability to where all it does is like an intermediate stopgap where it's just going anytime you make a request, it goes to the public repository and immediately pulls it down. So if you don't put the right restrictions in place, I know typically the word restriction isn't really liked in the cloud native world because everybody wants to be agile and move fast and get things on demand. But we found that it actually saved us a lot of pain by controlling what releases were made, available to this far-right cloud infrastructure, both vendor-provided images, open-source-provided images, and then privately-developed images.  And the struggle with that is, people will turn up proxies in their dev environment, they do things, and you will find lots and lots of random things that slip through the cracks. So depending on what you're using to deploy Kubernetes and to what images you're hosting, you will find that in your ranchers, your Tanzus, your OpenShifts, even a lot of homegrown, CubeADM or CubeSpray deployments and stuff. There are hidden curl commands everywhere. There is assumptions that packages are available. There is some automated lifecycle that just assumes certain containers or service platforms will just go and self-update. And you'll go, you'll build something in an air-gapped deployment like once, and maybe you did get all of the packages that you need, but then suddenly it goes into production and the first time you try to update your Fluent D pods to like, as you're doing your logging, you're like, oh, I'm gonna update this log folder. And suddenly everything breaks because there was this assumption with this hidden URL inside of the tooling that it was gonna go back to rancher or Tanzus main repositories and pull down the most updated certified image that they had. So you find all these weird little nuances as you build it out because there's tons and tons of expectancies within the Ansible or the Go or whatever is written that there's gonna be access to these and you really don't find these things until you get things first built in a truly air-gapped environment in dev and then once you start doing all the day two operations in production. Trying to think, I'm just kind of rambling here, like what specific questions do people have around like how you would build an air-gapped deployment or maybe like what pain points come about it and stuff like that. Feel free to jump in. I see Alex, you have your mic open. Yeah, just wondering whether in this the developers themselves are also air-gapped or whether the infrastructure that you're building is air-gapped. So it was an iterative approach. We eventually got it to where the development teams were air-gapped as well and what we would do. It started off and like it instantly makes things start to slow down which then annoys the developers. But when we got the private repositories actually tuned correctly so that way you could pull in an image on demand to the internal repository and then immediately execute like a sanity scan and then tag it so that it was made available in one of the dev sandbox environments. So once and it took a long time to get all of the web hooks set up to create all of the filters to make sure like, I mean, originally we were pulling in like the whole Helm repo, right? Like just the stream Helm repo. And suddenly you start going through everything and there's like, you know, here's a chart for deploying Bitcoin miners. And we're like, oh, we probably don't want this available in our data centers, right? So we started to build the filters. It took a lot, I mean, it's like most automation tasks. There was a lot of pain and effort up front. And then once we kind of got to the top of that, you know, hockey stick curve, we fell over the other side. And so it started with, you know, developers just kind of doing whatever they wanted, which, you know, it's just cause they're trying to get stuff done. And then they would try to go and deploy in the air gap environment and everything would break. We'd go collect all the lessons learned, like why isn't this working? You know, like which URLs did we not catch in this chart or this manifest? You know, sometimes the containers themselves think that they can reach out to the internet. So, you know, you spin up the image and then within the automation, within the container itself, especially if you're building runners and stuff, you'll find like all kinds of stuff baked into a runner that suddenly just pukes on itself when you try to do this in an air-gapped world. So that was iteration one is, you know, they're building locally, they put it into dev, everything breaks, we do some analysis. Then we got it to where we were, you know, creating the taboo of where we made it to where you would make a request to the private registry and then it would just automatically pull something down through the thing, but then there was no filters in place, there was no sanity checks. So like, you know, it would just go to a URL and we pull everything at that URL. It's not being choosy. And then once again, you start getting like the Bitcoin riders and things like that that come in and expose you to risk. And so then finally, you know, we got it to where we had like, you know, the appropriate repos mapped out. And the other thing too is, you know, I'm assuming since the CNCF, I'm being very like, you know, Kubernetes and container focus, but we had to do this for everything, right? So like the base OS image, you have to create your image and then all of the tools that are building that image, we only let them pull from the private repositories. So all of the packages, you know, whether it's YUM or whether it's, you know, Debian based, we're sitting there vetting all these packages, putting them into the repository, then building the images. And honestly, once we went all the way to the left in the build process and thought about what do we actually need to build? We then started to write all the web hooks to, you know, pull everything from upstream, immediately do the scan and then tag it and make it available for dev. And then eventually what we did was the devs would just build within the dev environment or locally, but they would point, you know, their local devices to the internal repositories instead when they were doing specific repositories. And then if the package wasn't there, we'd make a note of it, we'd go, we'd get it for them. And they could now do this, do self-service, but the framework was already there in place so that they know that they're not gonna pull anything malicious, that it's gonna be, you know, tagged appropriately. Like, so like I said, once you get that automation in place, then the devs are allowed to kind of do what they want, while also still meeting like what, you know, production and operations are demanding from a security and a compliance standpoint. I mean, mirrors a lot of what I think we've done at GB Search. The question that I have is whether the developers who are working on their developer box there, do they have just free access to the internet to like go and look up things on Google? Yeah, I mean, on their local devices, we're not getting in their way. Cause this is where you get into like the weird chicken the egg scenario, right? Is what packages do you need to pull? So... And that's the thing that I think I find crazy at G-research where developers don't, like that developer box is also air-gapped and they don't actually have access to the internet and to get, to even understand like what they need. I don't, I don't know how they know.  Anyway, that... Yeah, no, that's definitely not like... Cause yeah, you get into scenarios like how do you know what you need to add to your private repo? How do you develop? How do you pull in tools? If, you know, at some point there has to be some level of freedom so you know what you wanna test in the first place, right? And so basically, and when you say developer would come in from like the service provider world, I mean, there's like somewhere upwards of seven to eight lines of business with, you know, four to five development teams each that was then all funneling into this big, big infrastructure, right? So like basically what we did is if it was heading for in production, right? It was going to one of our public cloud, you know, areas, sorry, environments or one of our data centers, there's basically like this inlet that starts with are you building on one of the golden images? Are the packages that you need available? And so, you know, we provide that base template and we would start giving out tips, right?   If the answer is no, run yum update, you know, add the repos that you need and then we'll check it, make sure that's safe and then once you get into the, you know, the true pipeline towards production and you move through dev, you'll find out quickly whether or not you built your stuff correctly because it'll break in the dev environment with little risk to you, right? Like dev is, we treat it truly as dev, if stuff breaks, that's okay. But it's not going to let you build anything that you did not see it in that private repo. So like, you know, it's on the developer to kind of keep track of what may not be available for them.  And sometimes they don't know and that's why we have the dev environment is, you know, they build it locally in the box. Okay, go deploy this in dev, see what breaks and then, you know, typically, it'll break two or three times before they catch everything, you know, just because they've pulled something and, you know, the amount of code they're writing themselves versus stuff that they've just pulled from other places, you know, is sometimes very drastically way more towards the, I wrote a little bit of glue code for like lots and lots of other people's stuff. And then that's when you have all those embedded URLs that get you in trouble. And there's just this assumption that, you know, your VPC is pointing out to whatever public repository and it can pull whenever it wants to. What are all the checks that you're running? You know, what, we run a battery of test ourselves. I'm just curious what, particularly third party tools you're employing to do all that stuff. So now, since I'm, you know, I just moved companies, I'm not running any tools currently.  So like image scanning tools, code scanning tools, you know, Veracode, X-Ray, if it was in Artifactory or Prisma Cloud, I mean, a lot of the big players and we run different kinds of scans and different types of compliance checks then we'd also have like a battery of functional tests, right? So for instance, I mean, we treated the infrastructure the same as we did the application. So like, we would have this whole battery of tests to make sure that all of the packages we needed to build Kubernetes existed, for instance, and that the packages that we were putting together would survive like Sonabooey, that would survive, you know, we would use disaster recovery methodologies where we'd, you know, back up at CD, we'd completely nuked the cluster, rebuilt from the cluster and like, so I mean, we treated everything from top to bottom, like, you know, this whole like top left-hand corner here, the whole GitOps thing, you know, I'm not gonna say we were even 80% there, but that was what we were ultimately striving for. And so whether it was, you know, all I'm doing is updating, you know, like Qube-ADM for instance, right? Or I'm updating Qube Proxy, I'm updating, like I said, a Fluent D thing, the application itself, I'm making an update to the base operating system, every single one of those was declared in Ansible, and Ansible was sitting there creating a mapping, and you can do this with any, you know, pick your favorite scripting modeling language of choice, but basically what we would do is we would make, you know, these infrastructure code templates to the best of our ability, then put the Kubernetes manifest on top of that with the Helm charts and so on, we'd build like this layered stack and everything line by line, you know, would map only to an internal repository. And then like I said, where we would constantly think we were good is, you know, we've used Rancher, we've used Tanzu, we've used OpenShift in the past and stuff is, you know, our manifests would be clean, like the YAML, driving Ansible or the YAML that we were pushing into Kubernetes, everything pointed to an internal repository, but then there's some internal mechanism within Tanzu, for instance, that thinks it can go back to VMware or, you know, OpenShift is assuming that the satellite instance has access to the internet and that is always when we found all of the gotchas as we were trying to do this or at the application layer itself is when everything would break because the app would assume that it had access to the internet and we're like, you don't get that. Yeah, and in a couple of cases, I mean, I run an open source program office, so in a couple of cases, we've had to go back to whatever project it is and try and fix their stuff so that it doesn't phone home or there is an option for looking at an internal repository or, you know, some file somewhere, kind of thing. Occasionally, we've actually run into places where people didn't want to fix the stuff. Have you ever run into that kind of situation where? Yeah, in fact, especially to like so in the service provider world, because we have, you know, SLAs and SLOs that we're required to keep, we, you know, we walk a fine line with open source and also wanting, you know, if we can get it some type of vendor-supported backing for, you know, even open source projects. I mean, that's how like, you know, the red hats of the world make their money, for instance, right, is provide, you know, service agreements on open source software. So, yeah, it gets weird and it was a lot of times, I'll be honest, being at like, you know, a tier one telecommunications company makes it a lot easier to wave a big stick and say, I need you to fix this for me or I'll go to your competitor. But we run into this a lot or conversely, we would go in, like what we did with our containers or service platform, we're at the platform layers, we had to go in with the fine tooth comb and we went and changed a bunch of manifests ourselves internally and just swapped out all the URLs to point to our internal repositories. And this is like I said, I mean, we were six, seven months in, you know, we're like, we're good. And then suddenly we would like run like one update or something. And next thing, you know, we found like this other hidden embedded thing that would break everything. And you know, some of that like that's the whole being agile thing is sometimes you just got to take your lumps and deal with like, you know, bruises that come along the way. But what we would find sometimes is like certain, you know, open source communities or vendors would be like, well, you changed this so we're not going to support you. And we're like, well, then I can't use your software. Like that is definitely like a struggle, right? And so I mean, with like the more sane ones we were, you know, we even got them to start making it so that some of these things were modular.  And then most were somewhere in the middle, right? Where like they grudgingly slowly but surely.  Like, I mean, how many different log forders are they are? And you know, everybody's convinced there's the best.  So even in the open source, there's some level of, you know, protection and willingness to try to like, you know, make your software projects stand above the rest. So I mean, we definitely kind of leveraged that a little bit.  That's definitely gonna be a much bigger challenge. Yeah, it's, you know, we've been mostly successful except where the people we're trying to convince are so big, they just decided to ignore us. There's Google and Amazon come to mind. The AWS one that comes to mind currently is something in the client that they don't actually follow the HTTP standards for redirection. And we point this out to them and they're just like, yeah, we're not gonna fix that. Like, but it doesn't, yeah, so what are you gonna do? Well, even then too, you have to decide where you're like, so the Amazon example, right? If you're using EKS is CNI, it's a routable IP address throughout your VPC, right?  So the legacy model of security of, I think of things and like perimeters and like, you know, here's this walled garden, here's this wall. Well, you have to understand like where your walled garden is too or, you know, same thing with them. You're doing something fancy with like Calcorsilium even where you're advertising pod IP space to the underlay via BGP, you might provide reach to something you never intended to provide reach.  Like I think someone, I think Ricardo, you said at the beginning that a lot of people in this group you know, working like, you know, the education space like at universities or like research and stuff.   So maybe I have a follow-up on this and it's actually more on how much you expose the fact that these environments are air-gapped to the developers themselves. And I'll give an example. So yeah, CERN is probably a good example because there are systems that are clearly air-gapped, anything that is controlling the machines or the accelerator is very much controlled, but then you want to give developers a good experience and they have a general network where they can actually get internet connectivity and do their builds and things like this. So imagine like one situation would be you do all your work, all your builds, all your images in some sort of general network and then through this process that you also described of kind of approving images, you would have some sort of replication of say the registry in the air-gapped environment with some sort of automated replication. And this would be like an exception to the air-gapped is that you actually have some paths for the images to be promoted to be exposed in an air-gapped environment, how this works could be done in different ways. But let's say for example, you will have two hardware instances, one in general network, another one in air-gapped network and you will control what gets replicated automatically. But then the question here is if you will have deployments both in multiple air-gapped environments and you're running instances of a registry in each of these air-gapped environments, how much do you hide this from the applications and from the developers? Because there are some things you can do like for example, have mutating web hooks that will just rewrite the registry to use a local registry, things like this. How far do you go into making this invisible to the service managers, developers, et cetera? So the answer is it depends, which I know is a cop out, but I'll explain. Because for one, there's lots of ways to solve this air-gapped, right? So I definitely don't wanna propose solutions just because depending on your environment. I mean, one proposed solution is I take a thumb drive and I walk to all the different environments and I plug it in and I upload it to the registry. But what you were saying about having multiple, so what we actually did was we had a private network and since I was in a networking company, we had the ability to do this, but we had a source registry that was the single source of truth for everybody.  And so what this afforded us was since we had a single source of truth where we basically had a single instance to write, but you couldn't read from it because we didn't wanna over-tax the thing that was like our master source of truth and then everyone else was a read in its local environment and was only accessible there. But then your point about mutating webbooks is basically then I could take an image and deploy it anywhere and there was just this assumption that there was a local registry within that local network. And you were always, since it was a single source of truth with a common tag that's then mirrored to all the different satellites, it doesn't matter where your software is deploying because you get to, and this is something, I mean, and this took us like 18 months to get to you, so I don't wanna make it sound like it's trivial, but basically it got to the point where like a developer would write one image, that they would then push upstream into that source of truth and that one image got to make the assumption that it was gonna call a local URL. And since they're private networks, we leverage things like any cast addresses on the networking side and then we got a little bit loose with some of our URL naming because these were all in isolated environments depending on which data center you're in and stuff and then we would control in our route tables what networks were and weren't exposed. And so then your software deploys in any of our different data centers or any of our different VPCs or other public cloud instances. And it was always assuming that the registry was local to that network and it was common. So then you have federated images and federated secure packages in these air-gapped environments. But then like I said, I mean, the other way to do it is like you could do a thumb drive like you could make it so that all of the local networks are calling back to a single source of truth like you could have a singles registry and then they have two different network attachments, one's a private network to the registry and everyone calls back through that. So like I said, depending on what your environment looks like there's a lot of different ways to skin this cat but the biggest thing that we pushed and it was the most painful was, A, the application specifically and whether that's platform software, user applications, it doesn't matter but like your application needs to deploy in a world where there's no internet, right? And then additionally, everybody needs to use the same source of truth because one of the ways like the other part I didn't get it super deep into was how we tag things.  Like you can do whatever you want, right?  But the shared dev environment, right? Definitely still a lot to break things there but we're hoping that you did your due diligence. So then you pull those images into the source of truth but the first thing as far as like our promotion status is is the tag first makes it available only to the dev environment. So now you have the satellites in those air-gapped dev environments and this tag says that only these users, basically what we try to get to is policy as code, it's kind of a buzzword but using like different policy engines and whatnot we just made it so the devs could pull images in as they wanted the policy would say you can't promote this image to these dev repos until the scans have been done, until the tests have been run. If those are successful, you're good but once we got the policy in place and overcame that automation hurdle we basically just kind of took the reins off and let the developers go because the left and right limits were in place to where they could move as fast as they wanted but then they still weren't gonna like do something that was gonna take everybody else down. Now that kind of matches the approach we tried to do as well although probably we don't do it at a low level networking. We really need tools that are able to do these mutations and this could be like for the registry and the images is the easiest example to just mutate the source like you said and there is support in quite a lot of tooling and handling containerized deployments to do this sort of thing. It's not only Kubernetes, there's other tools that also support this but yeah, I think one of the things that made this popular is that we can manage this ourselves centrally without the developers having to know anything about this and it's all handled by the deployments. That's a key thing unless you get a lot of shouting. Yeah, the developers had a lot more insight early on because things were breaking and making them mad and they're like, hey, what's going on? Like I'm just gonna like fix this but once we kind of hit like that 18 month to almost two year mark, we just kind of like I said, fell over the other side of the hill. The policy was in place. There was clean methods to pull new images into the private registry, validate that they were safe and like you said, after that, I mean some developers just because they would be provided baseline templates for like their container images for their OS images, et cetera, or we would just once the base images had the URLs pre-baked in for them, at least for internal development, like you pull in third party software then there's always gonna be some kind of de-confliction. So, but yeah, we were able to make it to where it was largely abstracted from them and like once we stopped making things painful for them, they stopped asking us questions and they just did their thing. Awesome. I do have to run, Ricardo. Yeah, yeah, thank you so much for joining. Yeah, feel free to reach out, like I'm down to come talk to you again. Just let me know. Yeah, thank you so much for taking time to join us. Yeah. Great chat with you all. Cool. So I don't know if anyone had additional questions kind of this was a late call for the subject. Anyone has anything to raise or even other topics? Alex, I saw you and me too. I was just trying to think of what else we, how else I think about it from the standpoint of this, we're an air gap company and I run an open source team and there's inherent tension there. And I don't know whether it's worth, just trying to think about that tension and whether there's any discussion to be had around it. But it's not a well formed thought. So I put myself back on mute until I thought about it. So I don't know, I drove a bunch of questions there. Has anybody else got questions around this air gap world? Not really any questions, just kind of here to kind of see what others are kind of up to in that space, where I come from. We do some kind of different kinds of national security work. So we have several different types of networks that are secluded and within those networks, they might be running Kubernetes. And so trying to figure out different combinations of tools and how to securely scan artifacts or create new artifacts that can be consumed all outside of that protected space and then pull those in so that they can be deployed in a production or even a development environment for that matter. Yeah, we leverage GitLab quite a bit for a lot of those kinds of things. Just from an organization model perspective, we use the runners and the way that they're designed. We can be a little bit flexible about that. But it depends on what environment we're talking about because sometimes it's kind of hard to avoid the transfer of certain kinds of files without walking them over and physically applying them to said cluster space. So it's interesting anyhow. Yeah, so I'm just kind of here to kind of learn and listen and so yeah, no specific questions though. I think for our environment as well. We also have GitLab and we explore a lot the runners. But what we've been trying as much as possible now is to have this model that also Jeffers is describing which is to have one single source of tools for all the packages, images, and have that really tight and then define policies on how things should be mirrored or replicated to different environments. And yeah, those replicas will be airgapped and read only and they have to be populated via the central one where we enforce the policies. This is basically what we've been trying to achieve. The challenges are really on making this as seamless as possible for everyone. We actually do the same for external packages. I don't know, like Jeffrey mentioned briefly, this idea of having kind of pull through caches and in repositories, we do that as well. We try to enforce even on our general networks that nothing is pulled directly from whatever. It's all coming through our single source of tools even if that means pulling through and then just making them available after the checks. Yeah, we do the same thing where we use policies to drive, okay, where is that single source of truth that we're allowed to pull from in order to really tightly control even people within that space trying to do custom things or try things out directly, where are they allowed to pull those resources from? So we control that via policy, so. I think Alex asked before about the actual tools being used. Maybe like for us, we use specifically for container images, we are relying on hardware and we run the CVE vulnerability scanners plus some additional checks that we have in addition to like whatever goes in the code themselves and the GitLab reports. What are people using for this? Well, since I was already talking, I'll share. We're using some of the AquaSec tooling out there to scan our repository images and we're using GitLab artifact repositories to help deploy those so and scan so. I think we're using also like checkmarks and AppSpider and a few other things out there too to kind of provide that reporting level and kind of adhere to the standards that we have to, so. Yeah, I feel like we were using AquaSec at one point. I don't know if we're still, I know BlackDuck is something on the inside as well. I sometimes don't see all of everything because I'm on the outside. Those are two that I know that we're employing, I assume X-Ray because we use Artifactory as well. I just signed this up for TiedLift so there's some amount of that coming in. Various things built into GitHub, I suppose. Yeah, there's probably a whole world that I don't even know about in terms of scanning that GB Search is doing. I could come back and give a full list at some point. Yeah, but we are using also Aqua. Thanks to the vulnerability scans as well. Gersh, Allah, what are you employing over in IBM?  So I have to admit that I'm in IBM research so I'm a little bit removed from production environment although I have been involved in the development and continuous integration and deployment for some IBM services before but not currently at the moment. But it's, so just a few comments on some of the things that were mentioned. So I was really surprised when I heard someone said that open source data are gapped even in their own environments, right? That's, actually, we don't have that, right? For open source, people contributing to open source typically are able to download and experiment and so on in their own environments, right? That these are things not going to production, right? But they are able to do that freely. So we deploy, of course, DevSecOps pipelines and a variety of image scanning tools. Different organizations or different business units really are using different pipelines actually. So there are some efforts, of course, to unify those things but as you can imagine, IBM is very big, many units are doing different things. So I don't see one unified DevSecOps pipelined with fixed set of tools that are forced on everyone. Certainly in research, we have flexibility in that. So in terms of, so we use, of course, IBM Cloud Registry, we use Quay, we use Artifactory. These are some of the repos that, of course, we use plus GitHub, of course. And we have our internal IBM GitHub. And that's the other thing, of course, that for some of our projects, we have only inner source. So we replicate the GitHub.com model in GitHub.ibm.com and basically we have projects that people can contribute to. We call it inner source, right? Following the same open source model. Cool, sorry that I stopped you from heading out.  Yeah, thank you, appreciate it. But thank you all for the discussion, really. All right, I think this is probably just, like it feels a bit like we can learn a lot still on this kind of thing, but it's also a very broad topic. So maybe it's something we want to bring again later in the year, I guess. Seems like there's interest. Yeah, I feel like it's a pity that Jamie wasn't able to join and he could have given a lot more flavor from our side about trials and tribulations of working on the inside of the air gap solution to research. I am on the open source side, so I'm on the other side of it mostly. That's all good, you can bring it back. But okay, so I think we still had quite a nice overview of options and problems. So if no one else has things to raise on this topic, I think, I'm just looking at the agenda for the next one and we have cluster API and crossplane. So I think that will be a very interesting one as well. So that will be in two weeks, March 16th. I'm just thinking if we should cover both in the same section or if it's even worth to split, because they are not really the same. Like crossplane is more a generic way to integrate external resources while cluster API is really focusing on one use case. So maybe we choose one, which one would people prefer? I'm more interested in crossplane. Crossplane? But I am at one vote. I don't have a personal preference, so I will jump on the bandwagon there. So I would vote for that. There's two now, awesome. Yes. All right, so we have Jonathan and Nathan to break down. Yeah, I think it's settled. I think it's all crossplane all the time now, yeah. All right, fair enough. Let's do crossplane though. That's an easy one to reach out. I know that people also, that will be easy. And then should we go, maybe we keep cluster API in the back of them, just so that we don't forget that we had it there. I'll just add it here. Nathan, you just can't take a firm stance on this one. I was going to say, oh. Staying the best. Jonathan also voted for crossplane. I didn't see him in the chat, so. I need to get the, you know, we started putting this batch working group together for the CNCF, and hasn't mean many respondents for the doodle, just trying to figure out when a, when we should have a meeting. If any of you are interested in this topic, here is the doodle. This was sort of born out of a discussion around Allah, who was on here, has a project MCAD and we have a project in Nomada. Klaus Ma has a project Volcano and there's a whole bunch of work around batch scheduling. And in one of the tag sessions, we thought that it might be useful to have a focused working group on just that as part of the CNCF. There is one already happening as part of Kubernetes, which met last week. That was the discussion last week. We have one going to the CNCF in general. If any of you are interested in that kind of a discussion, there's a doodle here, so that we can try and figure out when would be a good time to meet. So just making a plug for that. Yeah, maybe I'll send an email to the list as well and maybe push it on the Slack channel as well, so that, because here we are only five right now. Yeah, this is my first step towards getting some traction here, so, yes, I will do that. And yeah, also I just posted also the link to the collocated event for, yeah, in general, that is the case, yeah. It's the, I think it's called batch system initiative within the CNCF, and it will be under the tag run time. Nice. And then I just posted the link for the this collocated event at Cook County in Valencia in May, so the CFP is still open until, I think, Monday next week, midnight BST, so basically Tuesday for all of us. I was supposed to link directly. So feel free to submit a proposal, including things like the batch system initiative, it's probably worth talking about it in this event. There will be talks about the Kubernetes batch working group and the proposal for Q that we saw in the last meeting. So there will be a lot of talks in this area for HBC and batch and workflows and Qs and stuff like this. So, yeah, make sure you push all the proposals you have. We'll definitely have a good event. It will be a half day with a networking dinner after. Yeah, I hope to get out to that. I think Ricardo, the other Ricardo, signed me up to speak something at some point, I don't know, so we'll see. I think that's for the CNCF batch run time, though. You mean a Varena, Ricardo Varena? Yeah, so that's at the CNCF tag run time, but this is the co-located event at KubeCon, so make sure you submit proposals. Yeah, it was something to do with KubeCon that he signed me up for. Have you had to figure out what he did? Ah, okay, then I don't know. Sounds good. Yeah, all right. Cool. Okay, so I think that's it for today. So thanks a lot, everyone, and meet you in two weeks for cross-playing. Perfect. Thank you. Bye-bye. Thank you.


Biogiographic ru-elm, a biogiographic ru-elm or echizone is the broadest biogiographic division of the Earth's land surface, based on distributional patterns of tristrial organisms. They are subdivided in ecorgens, which are classified in biomes or habitat types. The ru-elms delineate large areas of the Earth's surface within which organisms have been evolving in relative isolation over long periods of time, separated from one another by geographic features, such as oceans, broad deserts, or high mountain ranges, that constitute barriers to migration. As such, biogiographic ru-elms' designations are used to indicate general groupings of organisms based on their shared biogiography. Biogiographic ru-elms correspond to the floristic kingdoms of botany or zoogiographic regions of zoology. Biogiographic ru-elms are characterized by the evolutionary history of the organisms they contain. They are distinct from biomes, also known as major habitat types, which are divisions of the Earth's surface based on life form, or the adaptation of animals, fungi, microorganisms and plants to climatic, soil, and other conditions. Biomes are characterized by similar climax vegetation. Each realm may include a number of different biomes. A tropical moist broadleaf forest in Central America, for example, may be similar to one in New Guinea in its vegetation type and structure, climate, soils, etc., but these forests are inhabited by animals, fungi, microorganisms and plants with very different evolutionary histories. The patterns of distribution of living organisms in the world's biogiographic ru-elms were shaped by the process of plate tectonics, which has redistributed the world's land masses over geological history.


Hi everybody, this is Hari Swaminathan. We are looking at the multi-time frame trend indicator and in this video I want to show how you can get prepared for a small swing trade in the sense that if you look at this We have Amazon here The top left is a five-day five minute and then the top right is a one-hour chart Both of which are mostly used for intraday or very short-term trading So we're going to look at the bottom left, which is a 20-day 4-hour chart and the bottom right Which is a three-month daily. So first I'm going to maximize the 20-day 4-hour chart So as you know, this is a five level deep indicator So the lowest line the lowest set of dots are the same time frame as the chart itself Which is a four-hour chart So each of these bars are four hours and then the next one after that you'll see these are the configurations right here So the second row of dots is a daily trend The next one is a two-day trend and the third one is the fourth one is the three-day trend and then the fifth one is the four-day trend and so whenever a trend changes you can see Amazon was bearish all through this and Whenever a trend changes always the lowest time frame will change first most of the time most of the time The lowest will change first and then a couple of more will come in and so you already know that Okay, maybe after all this bearishness some bullishness is coming now if you want to jump in a little early and catch this trend That's fine. Just remember that not all of the trends are aligned yet And then when you see this four dots over here Then you become a little bit more confident and now actually we are waiting for the fifth dot So if Amazon goes up today my sense is the fifth dot will also appear And you will see the green dot in the master level indicator So as you can see you can start getting prepared for the trade when you see this kind of activity going from one dot to three dots And here it goes to four dots now It hasn't completely gone to the five dots and maybe today or tomorrow it might do that So that is if you look at the 20 day four hour chart let's take a look at the three month daily chart and Over here if you see also Amazon's been bearish and you know There's been a lot of red dots over here and over here you had three master level red dots But after that you can see and this is a daily chart And so the bottom row is a daily chart is a daily time frame the next is two days The next is three days four days and a week and you can see the two dots develop first Now you know that might be a bit early to jump in but when you see the next one as three dots Perhaps you can take a small trade there now you can see there are four dots developing over here And so my sense is once it gets to five dots Amazon will try to push up obvious level of resistance might be this previous high over here Which is 1822 which is quite a bit of distance away So you can jump in a little early if you want maybe half size and things like that Or you can wait for this to develop but regardless with using the multi-time frame Trend indicator you can actually get prepared for the trade you can get prepared for the trade on a daily chart You can get prepared a day or two earlier before the trend actually sets in on all five of these time frames. Thanks


And I saw that Curvedow just took a big nosedive and I'm like, well, that's quite interesting. And then in front of the show, sent me this article, Curved finance exploit puts a hundred million dollars worth of crypto at risk CRV token tumbles. I want you to be aware of what it says here at risk. However, apparently $41 million is already gone. Curved stablecoin exchange has been the victim of an exploit according to a tweet from the project itself, which, you know, I'm not going to say much about that, but it is nice and reassuring when someone says, you know. But don't worry, your funds are safe, which is exactly, I shouldn't laugh, but it's exactly what a lot of these different places have said, FTX, Voyager, Celsius, don't worry, but your funds are safe. So upwards of a hundred million dollars worth of crypto were at risk due to a reentry to Bug and Viper. Several stablecoin pools on the platform used for pricing liquidity on a number of different DeFi services have been drained by hackers so far.