If you could download a car Just sip instantly A fully functional car No one would lose their car in the process Just poof, you have a car That car could help you get to work, to school, to see the world, to live a better life Why would that be illegal? Now speaking of which Zeus, the king of the gods, is a bit of a douchebag So when the titan Prometheus tricks the god to accept inferior sacrifice While man gets to good meat Zeus responds by punishing mankind Taking away our fire and launching an age of darkness upon the face of the earth According to the story, it was Prometheus that created mankind So wanting to help us, he steals back the fire from Mount Olympus Hidden in a fennel stalk, he gives it to the race of men And the spark sets off human ingenuity, pottery, ironworking and even music As the burnt halls in the stalk creates the first flute Zeus then punishes mankind by creating woman as ancient in cells despair Then he ties Prometheus to a rock Remember kids, stealing fire is a crime Now, I don't know what it says about our modern western civilization So-called that we proudly draw our heritage back to this culture of slave-owning men Who thought, yeah, women must have been created as a punishment from the gods That's only natural But you know, that's neither here nor there The metaphor of fire and sparks as creativity is ancient and suits our purposes today If someone held the exclusive rights to fire, to cook, to heath, to make iron and pottery They'd be kind of a dick, wouldn't they? Of course copyright and the divine rights of gods isn't exactly the same thing But it is kind of similar, a handful of corporations dominate intellectual property Stifling creativity and expanding their monopolies Knowledge and the ability to control that knowledge is power As an artist, I'm like an ant pissing on the leg of a god But thanks to the legal framework of things like Creative Commons I can release my art for free use Advocating against the harm that copyright causes to artists, to society, to education, to humanity While striving for better and freer laws So today while I'm going through my archive and tagging and releasing a bunch of new art I thought it'd be a good idea to show a little bit of how you can use my art The short story is that you can use it however you want, personally or commercially As long as you credit me The longer story is that each artwork is like a spark Now you can use that spark to warm yourself for a little while Or you can use it to make your own flame Now let's see how this works in what I call the stupid and cumbersome part of the video Today I'm going to release over 100 new pieces for free use and that's a lot of work I'm just creating the art which I love but also scanning, editing, uploading, tagging And covering the hosting costs After dedicating 20 years of my life to making free art it's finally paying off We sustain it by selling originals and prints on den ungeherhorn.com And also by your memberships on Patreon, YouTube and Facebook However I'm no archivist and the current download site is the nightmare to navigate I created it so we have to expand our team to be more efficient and reach more people And educate them on how to use by free art So even if you can't support financially You can support by finding the new pieces, downloading them, printing them, changing them And even selling them And perhaps you spreading my art can spark the flame in someone else's imagination Meanwhile in the garden After tagging and writing captions and putting these 100 new pieces in the ink monster gallery They're released, right? They're published, they're free But my shop and my download sites aren't integrated yet Because linking over 4000 pieces, poorly cataloged pieces is a huge job When you go to den ungeherhorn.com you can't just click on the new arrivals And now to access the free art you have to go to more and then free art on smugmug But with this many galleries and my poor tagging finding what you're after is a challenge And when you find the piece you're after then find the tiny download button in the corner So me and my team have a huge job of making my free art easier to use But if you're looking for something specific you can just contact us for help And while you're waiting just go download a car or something Okay Anyhow Free art is more than just free art At its burning heart everything that can be copyrighted is speech And copyright is an anti-freedom of speech law It impacts art and culture and education and science and progress It suffocates them on the behalf of corporations Imagining alternatives to copyright is difficult with a system built around the ownership of things that can't be owned So most people don't even notice it Most people don't notice the flame is dying So if you manage to take my art and earn a profit on it You don't owe me anything I owe you a huge heartfelt thank you And now a word from our sponsor Me You may have noticed these birds edited into this video seemingly random And yes they are kind of random But for the first time in my life I'm going all in on being a creator of videos Primarily on YouTube And that involves planning a theme for my videos over the next year That theme will somehow end up with birds Now like all my art it is all based on some sort of magical thinking And a path will reveal itself in the process This video is the first step on that path It is my attempt at taking a boring topic basically that I've uploaded 100 new pieces for free use And see how I can use editing and storytelling to make it exciting It's the first video I haven't edited on my phone And it's a place where I can both learn editing on the computer And try out different ideas that I will return to in later videos Hope you find it fun Not all my videos will be as wild and eclectic as this one But in order to be as free as possible I want to shun advertisers like the plague Now that's where you come in I'm going to continue hiding sneak advertisements for ways to support into the videos Because that's how you have to do it in order to get past the algorithms But you just know that every time I casually mention my shop or memberships That's me advertising But for this ad break I will just say If you'd like to see more birds Please subscribe Now back to the video Ok so what I thought we'd do now is simply to look at some of the new ink monsters And see if we get some ideas of what they could be used for Click more Free art on smug mug Not the catchiest title Daily Ink Monster Gallery There are a couple of ones missing that I will be uploading later For instance the two made for this video Those will be out for free use when the video is released This is clearly a Christmas card This is definitely t-shirt material This would be so simple to make into a t-shirt I might do it myself and put it on my store And if not then you can make a t-shirt yourself Gay or die, I like it This one is if you just took a little snapshot of it Then that could be a pretty awesome CD cover or something CD cover, no one does CDs anymore LPs, that's where it's at This is just a great little mascot Mob, no not mob boss But Bob Moss, of course Oh I love this one Also called Bob, strangely This one is definitely a D&D monster or something This one has potential to be twisted into something really even more grotesque This is also cover material I think And it could also be manipulated way beyond what I would do with my own stuff And that's the fun part, is that other creative minds can come and interact with art And especially if you're planning on selling my art on your store Then you actually need to do enough with it With the design, with the colors, with the letters So that it has a personality of its own Yeah, I want a game set in the world on top of that fella's little back Someone do an epic RPG with a Jack's The World Buffalo You can change his name unless your hero is called Daxter Black metal cover art material Ooh now we're into older ones that were uploaded a while ago We have a print of this one on the website This one is gruesome in all the right ways This is the stuff I like, this is the stuff that makes me happy The tribute to Technoblade because he was a hero of one of my son He seemed like a good guy I want someone to make a platformer brawler Kind of streets of rage or double dragon with this Branana That would be perfect But you know, one of the problems of me looking through the art like this Is that I'm not the best one to imagine what these can be used for I've had requests from people who want to do short stories about them And that is magnificent Someone contacted me about training and AI on my art And I would definitely want to be a part of that But I managed to lose the email This one, t-shirt? I don't know This one is material for something It's so weird to look back I don't really like looking at my art But when it's this many images Then it sort of becomes okay in a weird way This one is disturbing And generally people are too scared of messing with my art But that's the point The point is to collaborate And for you to do your stuff For this to be a tool So that you can make it more awesome Now we're almost at the beginning This is the first ink monster I did Now this wasn't the point of this session at all But we've gone all the way back to the beginning So that's one thousand four hundred plus monsters ago Hugh the Hangry Minotaur Someone should make something with him I should make something with him Now we're a tiny team And we're working our asses off to make ends meet But we're getting there We're getting there And we also have to deal with Twenty years of baggage of my bipolar As messing up anything I come in touch with Come in touch with? Come into touch with? Touch nose? And that's why I so deeply appreciate Every single person who chooses to find my art And to download it And to even if you just print it and hang it on your wall Or if you do something with your local RPG group Or if you use it in your indie game Or write a short story Or send it to your godmother And it's so fantastic when people send me examples of their work Or when I've met people with my work tattooed on them It is mind blowing And I'm so grateful for it No matter how small or huge the project is If you ever do anything with my work And you want to show it to me Then send an email to freeartatdenungeherholm.com Or tattooedatdenungeherholm.com If you want to show off your tattoo With my art Nothing makes me happier Now if it sounds interesting Maybe I can do some videos Where I actually go in and manipulate the art And make it into different designs To show a few examples of how you can actually use my work And do my take on it So you can do yours But lastly in this video I just want to say something to those of you Who have already sent me your works with my art And then I'll give you one final new drawing time lapse At the very end So stay tuned My wife claims that I'm the messiest person ever But she doesn't know the truth If you have sent me your work then I'm sorry I was gonna post about it But poof it vanished Sometimes they reappear in the strangest of places I found these great looking RPG books By Odin Speard in a pile of bills After a year this LP using my live art Of Sinistra's concert at Roadburn Came back boxed still unopened And this t-shirt by Lola Valkyrie is great But it comes and goes as it pleases So to all of you who have used my work Lost or not I swear it wasn't me I didn't lose it It was Vanessa That's the end of this video But if you want to know more about copyright My social media journey And even how to save us all From techno feudalism At least in part Then there's an old video up here With the birds somewhere It's a very simple video Unlike this Just talking and drawing But it's interesting Now I have to go make my next video Make free art or die


That's dangerous. That's dangerous how good that sounds. Like, oh.  Just coming from this time, it's unreal the sound that you get. I press the boost and I don't think I need to press anything else. Like I'm fine with absolutely everything. The response you get from it is unreal.  Having to sit down for like five, 10, maybe even 20 minutes and just get the right sound for me personally because I'm not that much of a lead guitarist. I can just do mainly rhythm stuff and a lot of my stuff is in open tuning. So to find an amp that's just so plugged in and playing, press the button, I'm like good to go for an entire set. It's so rare. This is definitely on the money for me by absolute certainty. Yeah, I'd buy 10 tomorrow. I'd buy like 10 of these and just give them to every guitarist I know and just be like, I know you've already got amps, but just give this a go and thank me later. It's perfect for when I'm sat in my room and I want to write demos and no one's home. I can just plug this in, get my pen and paper out and not feel like I have to worry about not getting the right sound for what I want to write down. Because a lot of the time when you're a singing songwriter, getting the right sound from your guitar is so important to helping the development of your writing because when the sound's right, the lyrics will just flow out like water and this is exactly what that amp will do. Scratch that, I'll buy 20. I'd buy 20 in a heartbeat like it's spot on.


Hi, hello and welcome to the second lecture in the program analysis course. So in this second lecture we will look into operational semantics. The lecture will be composed of five parts and this is the very first of these five parts. So let me start by looking at the big picture. So in the last lecture we have looked into what programming languages actually are because programming languages obviously are at the foundation of program analysis and we had looked into how one can define the syntax of a language for example using a grammar. We've also looked at different representations of programs written in these languages like abstract syntax trees or control flow graphs and what we want to do in this lecture today is to look at how we can assign meaning to programs written in a language. So this meaning or semantics can be defined and we'll use operational semantics as a way to define the meaning of a programming language. All of this will be done in the context of imperative languages. There are other kinds of languages for example functional languages which we will not look at here in the course but instead we focus on operational semantics for imperative languages. In a sense these operational semantics are a formal foundation for specifying languages and also for describing program analyses which is why they are relevant for this course. Just to warn you so this lecture will be probably the most theoretical of the course. If you like it great if you do not like it that much stay tuned because things will get a little bit more applied and practical after this lecture on operational semantics. So here's a rough plan for the lecture. So we'll start and this is what I'll do in this first part of the lecture with a motivation why do we actually need operational semantics and then I'll give you some preliminaries basically formal concepts that we'll need in order to describe operational semantics. Then we'll describe the syntax of the language that we'll use in this lecture which is called SIP. It's a simple imperative programming language. So this is a toy language but nevertheless interesting to look at in particular for the purpose of formally defining the semantics of a language and then we look at three different ways how we can actually describe the behavior of a program in this language. The first of which is an abstract machine and then we look at two forms of structural operational semantics namely small step semantics and big step semantics. So let's get started with a few preliminaries that we'll need in order to define the semantics of a language. Before looking into what operational semantics actually are let's start with a question that you should always ask and that is the question of why do we actually need this. So the question is both about why do we need operational semantics and why do we actually need to specify the semantics of a language at all. And to answer that question let me just show you a small piece of C code and then I'll ask you what the meaning of this code is. So in this piece of code we'll define an integer variable i and assign a value to it let's say five and then we're calling a function let's call it f and we are passing two arguments namely i plus plus and i minus minus. And now my question for you and that's something you should think about maybe while pausing the video for a few seconds is what are the arguments that are actually passed to this function f. So if you think about what the meaning of this piece of code is there at least two options that may come to your mind. One option is that the arguments are five and five and this is what you'll get if the two arguments are evaluated from left to right. So that means at first the first argument is evaluated which is i plus plus the meaning of the postfix plus plus operator is to first return the value and then increment it so it will return five and then assign six to i and then the second argument is evaluated and because this is a prefix operator it means that we'll first decrement i so instead of six it's now five again and then pass the result of that decrement operation so the value five to the function f and as a result the arguments are five and five. But there's also another option which is option two which would be four and four and this is what you'll get if the arguments are evaluated from right to left. So if you first evaluate the value of the right argument then we first decrement i and return the value of this decrement the result of this decrement operation which is then four and now i has the value four then we move on to evaluating the left argument which we first return so the value four again and then increment it again so after that i will again have value five but the values that we give to function f in this second option would be four and four. Now you can argue which of these two options makes more sense and their arguments in favor of both of those. The funny thing is that both of these two options are actually possible in C so now you may wonder why this is the case and the answer in short is that C has unspecified semantics at least for some parts of the language and this is actually one of these parts. So the language despite being used by millions of programmers and many many lines of code has some parts of its meaning not really defined which essentially means whoever's implementing this language can decide whether the arguments are evaluated from left to right or from right to left and you may even change your mind a couple of times while running a program if you want. In practice what this means is that the compiler that is compiling a piece of C code is deciding what the semantics of this piece of code is and if you want to try this out you can try to compile this small snippet of code shown here with different C compilers and you'll see that actually you'll get different behavior depending on what compiler you're using. Now of course this is not ideal because as a programmer you want to know what your program is really doing when it's going to execute so what you really want from a language is that all or at least let's say almost all behavior should be clearly specified and one way to actually do this is to formally write down the semantics of the language for example using operational semantics. Now operational semantics which we'll focus on here in this course is just one way of specifying the semantics of programs just for the sake of completeness and to show you that this is not the only way let's have a look at different ways of specifying the semantics of programs. So first of all you can specify semantics both in a static and a dynamic way. The static semantics do not really say exactly what happens at runtime but they somehow constrain the possible executions that the program can have and even without executing the code will give you some guarantees about some aspects of this code and one way that I'm sure everybody is familiar with to do this is to have a type system which describes which type each variable and maybe each function has and without executing the code if the type system shows that the program is type correct you know that this variable will always have a value of these types so in a sense a type system is a way to statically assign some of the semantics to a program. And then we'll also have so-called dynamic semantics which come in in different forms so one of them is called denotational semantics we won't go into this so this is just so that you've heard it and maybe can put it into context if you have heard about it before. Another form are axiomatic semantics and finally there are also operational semantics and this is actually what we want to focus on here. So now what are all these semantics useful for? Well they're useful for a couple of things you've seen the C example on the previous slide but in general they are useful for at least four scenarios. One of them is for language design so if someone sits down and designs a language and for every programming language someone has done this at some point then of course that person wants to think about what is the meaning of the programs that you can write in this language and in order to really clearly define what the meaning of the program of these programs will be you somehow have to write it down and a typical way to do this is to specify the semantics using one of the formalisms that you see here. A second use case is for language implementations so if you are the person to implement say a compiler or maybe a virtual machine then of course you need to know what the program what a program written in a specific language is supposed to do because otherwise how can you implement its behavior. Then specifying the semantics is obviously very important for programming because if the programmer doesn't know what the program is supposed to do then how the hell can you actually decide what kind of program to write and finally and this is the reason why we are talking about all of this here in the course knowing the semantics of a language is obviously also very important for program analysis because a program analysis after all reasons about the behavior of a program and the only way to do this is if the behavior that the program will have is actually well defined through some kind of semantics. Alright so now I've hopefully convinced you that it's a good idea to define the semantics of a language and before we can do this we need to go through a couple of preliminaries which are basically kinds of formalisms that we'll use in order to define the semantics of a programming language. So let's get started with the first one which will be about so-called transition systems. So what is a transition system? So in essence it's a way to describe that you have states of a system and that you can transition from one state to another according to some well-defined rules and we'll use these transition systems to describe the states of a program and describe what happens when different parts of the program are actually executed. So these transition systems consist of two things. One is a set called config which is a set of so-called configurations or states. So states and configurations are just two terms that I'll use interchangeably. And then the second ingredient of a transition system is a binary relation. So a relation between two things that I'll denote with an arrow and this arrow is a binary relation over pairs of elements of this config set which basically means that it's describing how to get from one configuration to another configuration. And this binary relation therefore is called the transition relation. So using this transition relation I can for example say that I'm in some configuration C and then can transition to another configuration C prime and then this is called a transition or if you want to use the other terminology you can also say this is a change of state and what we'll use this for is to essentially describe a step of the computation. We'll assume that our transition relation is deterministic and this means basically that whenever we are in some state and we can transition to another state then there's only one other state we can transition to. So it's always well defined what the next state will be if there's a next state. So more formally this means if we have a state C and we can transition to a state C1 and there happens to be another transition from C to a state C2 then this implies that C1 must be equal to C2 so there are no two different states we can transition to from state C. And to add one more piece of notation here in addition to this arrow notation for a single transition we'll also use the arrow with a little star and this denotes the reflexive transitive closure of our transition relation and what that means is the following. So reflexive just means that for any state or configuration we can go to the same state again using this reflexive transitive closure. So reflexive just means you can stay in the same state and transitive means essentially that if you go from one to the other and from the other to yet another then you can also go directly from the first to the third. So more formally that means for all configurations C, C prime and C double prime it holds that if you can go from C to C prime and you can go from C prime to C double prime then this implies that you can actually also go directly using this transitive closure from C to C double prime. All right so now transition systems are one of the things we'll use here. Let's move on to a second point and this is about rule induction. So what is a rule induction? It's essentially a way to define a set by first specifying some basic elements of the set and then defining rules that you can use to generate more elements of the set and this allows you to describe a possibly infinite set using a short well a small number of basic elements and a small number of rules. So what we do here is we'll define a set which is then called the inductive set with two things. The first is a finite set of basic elements. So these are elements that we just enumerate and say hey these elements need to be part of our set and they are typically called axioms. And then the second ingredient for rule induction is that we have a finite list of rules or finite set of rules to be more precise and what these rules do is to specify how we can generate more elements given elements that we already have in the set and the way this is done is that we need to say well if we already have this and this and this then we can conclude to have yet another element and one way to write this down is to use this bar notation where we have some conclusion which we can take if some set of hypothesis from here called h1 to hn is true and you can also write down the axioms in a similar way where you basically say without having any hypothesis so without assuming anything we can conclude something for example that some element t is part of our set. So just to explain this notation a little more everything you have on top of the bar is the hypothesis in this case this is mt and in the case of the rules that we specify there needs to be something and then what we have at the bottom of the bar is the conclusion so in this case it's an element t of our set and here it's some conclusion c. Now this may sound pretty abstract so let's look at a concrete example to make this a little bit more precise or concrete so as one example let's just look at the set of natural numbers it's a set that everybody certainly knows and actually this can be specified using rule induction using just one axiom and one rule where we say we have one axiom that says zero is part of the set without any hypothesis so it's just an axiom you can always say zero is part of the set of natural numbers and then we'll also have one rule that is saying if n is in our set then n plus one should also be in the set and having this axiom which gives us the starting point zero and this rule which just adds more and more elements to the set we have defined the set of natural numbers. Now the natural numbers are not a particularly interesting set and you wonder why we need all this formalism just to describe natural numbers so let's have a look at a second example which is about evaluating expressions for example arithmetic expressions that you may have in the programming language so in this second example we are also defining a set and we'll use this set to define the meaning of expressions so for example let's say we have an expression that looks like this and this is just one possible syntax to write down an expression that adds three and four then what we want to do here in order to define the meaning of such expressions is to is to define a set and this set consists of pairs of ast so abstract syntax trees that describe a particular expression and the values that these expressions have once you evaluate them and now because there are infinitely many expressions of course we cannot really write down this entire set in an naive way but just enumerating all its elements but instead we'll use this rule induction idea to define some axioms and some rules which then defines this entire set to explain the meaning of all possible expressions so the notation that we use to write down these these elements of the set is the following we'll say that an expression evaluates to a value n using this down arrow notation okay so what this means is that the expression e evaluates to the number n which just means this expression has the number n okay now looking back at the arithmetic expressions that we have defined in the previous lecture let's write down axioms and rules to actually specify what these expressions mean so for the axioms one thing we'll need to do is to define the meaning of very simple expressions that just consist of individual numbers so we can do this for example by saying that an expression that just consists of one obviously has the value one and an expression that just consists of two should have the value two and because we do not want to do this for all possible numbers because there are infinitely many we can actually summarize all these axioms into a so-called axiom scheme by just saying that for any number n this number is just evaluated to the value that this number has so to n now this is still pretty boring because it's just about numbers that obviously have the value that they do have now to really define what more complex expressions mean we need to look into complex expressions which are built from operators and we do this by defining some rules for example a rule like the following which at the end will allow us to say what the meaning of applying the plus operator to an expression e1 and e2 is and we can do this assuming that we know two other things so we have two hypotheses here one is that we assume to know that expression e1 is evaluating to the value n1 and expression e2 is evaluating to the value n2 and if we know this we can conclude that this entire expression plus of e1 and e2 evaluates to some value n if n is actually the result of adding n1 and o2 now this only defines the meaning of plus so we would have to write more of these rules for other operations for example for minus and if our language contains also multiplication and division and so on then also for those but again we can use a scheme here in this case now a rule scheme where we just say that for any operator it holds that if we know that some expression e1 evaluates to n1 and some expression e2 evaluates to n2 then we can conclude that op of e1 and e2 evaluates to n if n is the result of applying this operator op to n1 and e2 and this now covers all operations that we may have in our language rule induction now gives us a way to specify the elements of such a set so we can for example use it to specify the meaning of all possible expressions now sometimes we may want to just prove that one element is actually in our inductive set for example to show that a particular expression has a particular meaning and the way we do this is by writing down a proof tree which is actually showing using the axioms and rules in our inductively defined set that a particular element is part of the set so what this proof tree is doing is show that an element is in an inductive set just getting back to our two examples let's again have a look at the natural numbers where let's say we want to show that two is a natural number so at the very end we want to conclude that two is a natural number and now if you look back at the axioms and rules that we have we can just use these two axioms and rules that you see down here right um and let's do this to show that two is a natural number well we can conclude that two is a natural number if you can show that one is a natural number and in order to show that one is a natural number we need to show that zero is a natural number and this happens to be an axiom so we can just conclude this without showing any further hypothesis. Let's also have a look at a second example which is again about our arithmetic expressions and here let's assume that we want to show the result of evaluating a particular expression. Let's say this expression is minus of the result of plus of three and four and one and we would like to show that this actually evaluates to six. Now here's again a moment where I'll invite you to stop the video and try to write down the proof tree on your own because only by trying and possibly failing you can really check if you understand these concepts. Now let me show you the solution so what we want to conclude at the very end so this is what we write down at the bottom is what we also have there at the top so we want to show that minus apply to plus of three and four and one indeed evaluates to six and in order to do this we now need to look at the different ingredients of this expression so on the one hand we have this plus of three and four which evaluates to something and in order to show that this overall expression evaluates to seven to six sorry we will have to show that this evaluates to seven and then on the other side of the minus operation we have one which we want to show to evaluate to one. Now let's start on the right hand side so one does evaluate to one this was one of the axioms that we have described using this axiom scheme here and looking at the other side we now need to further decompose our expression here by basically showing what the meaning of three is namely that it evaluates to three which happens to be another axiom we can use and showing that the value of four evaluates to four which is yet another axiom so overall by applying these three axioms and using two rules we can show that this complex expression is actually evaluating to the value six based on the inductive set that we have defined just on the previous slide. All right and this is already the end of the first part of this lecture on operational semantics so we've now looked into some preliminaries which we'll then use in the next parts of this lecture to define the operational semantics of a programming language thank you very much for watching and see you next time


Sok about your mansion, Yumba, Bayo, Waiwai, Amiangusha, Pali, and where... Atu juli labda uli Anzalini, because tumona tukitu oneisha juzen, so I'm happy for you and I'm like, you really inspire so many people, maybe to tell us more about it, me umefiki ya wapisa sa iwi, ama imeku kwa he langatu. I'm not going to talk about finances because blogs are going to get their caption out of it, so I'm not going to talk about that, but I'm just so proud of where God has been able to elevate me too, and I'm also wishing that each and every person out there that akuna determination ya kudukutu kama iyo, piya fanya onona, and you have to start somewhere. Sometimes kunam se mone unazaji patanga vituza kwa zime stop, just because unanguja lam samu nanguja millions to do it, and trust me, I don't have millions, but by the time I'll be done, I will have spent millions, okay? So use whatever you have, kidogo, songa, songa, songa. If you, in fact, muse ma... Maybe my way might not be somebody else's way, but I believe kama wazizi wako wako in a bad state of living, elevate them first. The moment you do that, a ujuwata doita toku abi, ya kufanya ya kuhu. Unazaji anza ya kuna, badauki anza ya kuna mamako ako pale and unneed, same kind of shelter, unazaji kwa ma. So I started by sorting my mother first in the village, I also sorted myself in the village, then nikaku jahuku. Sotena songa pole pole, tuki songa. Tuki kwa ma tina kwa ma, tuki ni nitu na ni ni, but as long as tutasonga more than tita kwa ma. Yes, that's the point. As long as we finish well, abu you're right. Why? Why? How you doing? Great, how you doing? Niko salama sana. Kazimzuri muna piga. Anapu li kwa kunandinga ya waifu. Na imetu li asana for a waila tujawna wuki ko, slab da prok punenda juhu. Kwa sumaputu nimaliza sezon 1? Tuna waja sezon 2. So we have to take a break, restart agais and come back bigger and better. We've also learned from episode 1 or from season 1. We know the challenges now. We know how to attack some of them. Zenye twa shindot fendangatu na azo, baka indus zizi fukuke. If you have to answer season 1, what can you say about it? Did the actors deliver when you were expecting them to come back? Beyond my expectation, the show was bigger than I expected and I thank God because it's just something we are trying, trial and error and then it worked massive. So I'm so humbled about it and also the viewers and Kenyans that were supporting the show and watching it. Atas Iwana liya, season 2, season 2 aje, season 2 aje. So that keeps us moving. When we get that positive feedback, it's everything to us. Labda, we can be a bit curious when it comes to picking out actors or your cast. What do you look at? First of all, I look at how much drive someone has in their own projects. Okay? That will tell me how reliable they'll be when they come to my project. So I look at how determined they are and I look at the passion that they are putting because if I see somebody who can say and put so much work kwa kituyake, mazo kumita kwa kituyake trust me, they also do not want to disappoint because when they are coming, they don't come with the mentality of they are coming to do for you. They also coming to build their selves. Ono na ni kenakwa projectia mutu. Siyenda ti wajan enims idea because ni kenapwa ni fanya kitumbaya ni mimi na jia ribia jina in the long run ni kefiki ria tina mua ribia. So it trickles down to yourself. So ono kuna kwa naka na kama say mokam wu kifanya mema ono jitanya me menewe kifanya maba ono jifanya me menewe. So I look at those that are passionate about whatever they are doing and those that are always improving. Nikiwa na mutu, the way ni limuana last year ni limuana this year, then it says in my kwa projectia yankwa sababa tani ambukiza static growth. In fact, when they static, there's no growth. So tani ambukiza yoku sumama, stagnation, for lack of a better word, yes. In a few weeks ago, your wife won actress and she was so happy because she was like my husband has really supported me. Maybe how did it make you feel kuna in mkwa 2-1 year in the industry and she won a kapitawa 2-1 sana wini kwa kwa industry and you really supported her. That was really challenging for me because nearly feel challenged. My younger self felt challenged because at her age maybe I was not able to scoop such awards but I'm also proud of her for the work that she has put. Despite us supporting from the back, it doesn't matter. No matter the effort you put, kama umse unapush ako 2, then you will not grow. So I also believe that she has something, she has talent, she has a star in her, she has the nyota that will ignite in alipuka. No matter how much washi motokwa kwa maji, aita waka, lakini motokadoga kwa spirit, motokadoga petrol in alipu.  So I'm really proud of her by the way. How did you discover that she can actually act? She actually told me that she used to act kwa zeal kwan takfokas kwa interior design. So she told me that she used to act back in the days in KU. So I said, okay if you used to act then it's transanize if you do it too. So nikuwa na kuja home na tohitu na vanya toa pikanae, she was so spontaneous and you know I don't have to like write script word for word na umeruniaji this scenario. So I'm going to come as a cheat cheat in husband, I'm late and then you act like a wife that has always that has been waiting for me home then when Akazi then she comes up with her own words and then that thing flows becomes so hilarious. So I loved that aspect of creativity. So I say this is something I would really love to nacha because you don't want to nacha somebody that gives you all the burden to do everything. You at least want somebody that is coming up with 30% then you put in the 70. According to how you act people think that maybe ninham kwa sanangi you guys are always okay. Kwa na kwa sanangi? Of course, of course. There's no perfect relationship. There's no perfect union. They, there isn't. And if there's anyone wana onyashanga mariali tizau vileo kwa ngasawa throughout they're lying to you. People argue in fact I can say maybe we even argue more than we are happy just that the days that we are happy zikona strength enough then you can sustain days then you won't be unhappy. Yeah. Let's talk about your mansion. Yumba, Bayo, Waiwai and the Angusia Pali and where atu juli labda in Uliyanzalini because tumona took it wana nesha juzen. So many power are happy for you and are like you really inspire so many people maybe to tell us more about it me umefikiawapisa saibia maimeku kwa helangapu. I'm not going to talk about finances because blogs are going to to get their caption out of it. So I'm not going to talk about that but I'm just so proud of where God has been able to elevate me to and I'm also wishing that each and every person out there that akuna determination yakuduku tu kama iyo piya fanya onona and you have to start somewhere. Sometimes kuna mse mone unazajipatangavituza kwa zime stop just because wana goja lamsa wana goja millions to do it and trust me I don't have millions but by the time I'll be done I will have spent millions okay. So use whatever you have kidogo songa songa songa if you infact mumsema maybe my way might not be somebody else's way but I believe kama was wako in a bad state of living elevate them fals first the moment you do that ujuwata doita toku abi yaku fanya yako oneza anza yako na badauki anza yako na mama kwa kupale ananid same same kind of shelter oneza kuama so I started by sorting my my mother first in the village I also sorted myself in the village then ni kaku jahuku so tina songa polepole tuki songa tuki kuama tina kuama tuki ni nitu nini but as long as tutasonga more than tina kuama that's the point as long as we finish well are you right? and last weekend at the Oktoberfest we saw what Nyashinsky did bringing out other previous actors other previous musicians sorry in the industry how can what lessons can now can we learn from him now in the film industry sansan? you said Nyashinsky did what? he brought out other musicians from before into his performance like working together ni ni ni ni ni so what lessons maybe can the film industry go from that? no, togetherness is everything together even digai waifu I would have done it if I was just doing it alone so it's the power of the rest of them and as much as I'm the one that was writing the script directing and being the executive producer and financing the project I couldn't do it alone I can't play all the characters I can't be my wife and still be my wife's husband you know somebody else has to do it so we have to compliment each other so that was a good thing and I would really wish that we emulate that because togetherness is key now I say when you wanna say even God said that unless you agree you will not move together unless you do what? unless you agree yes so it's a good thing to agree good thing to work together I'm always open to collaboration with a lot of a lot of talents a lot of comedians even musicians muhendata na chesagita na chesapiano na na mawasa niwengino muzikiyo niya tuxiyani in terms of comedy and everything it's just about that let's embrace this in a sense it's a family grow to kumuji aniki kwa ma nikuwa na musu wako piki asimu umutua kiki kwa ma kwa na musu wako piki asimu but the moment you mejitango kwa alone you become you be in your own world siku na kwa mata oto na juangatuwe oku dini ako wacha dini ako ikusahide ya yeah thank you Shiko I have a question about your friend maybe you can tell us a little bit about man and Tulene maybe what was going through your mind especially at that time when people thought he had actually committed suicide I don't think I want to talk about that incident totally because there's a lot of information that is that Zinaji contradict online and so I'd rather just plead the fifth because oneeza semakitu okhaim tumbaya oneeza semakitu ufraisha watuangine so I'm just gonna you just gonna allow me to just let it be because there's a lot of truths and lies at the same time ok so allow me yeah thank you so much thank you have a good one you too


Hi, how are you? What's up? I'm good. Introduce yourself. Of course, ya'll, you know me. It's your girl, Jackie Matumi, and guys, we are in the CBD. Naleo to me kuja akama wanawake to just stop killing us.  As a mother of girls, this is very personal. This is so close to my heart because takiku kwa mahali na ugopa nanin. Even me, personalita ni kwa monamu, keniki kichembena irobi spai kuwa na woga because this is crazy. So we are here to say stop killing us and it doesn't stop here to turn the layer to turn the layer. If this match is not going to do anything, we'll continue and continue adding to skizwe because at this rate, at this rate, the government should listen to us. They should listen to us and they should know that this is a serious matter. Ni ini mo ni kupaku li kwa, teizu obitu zote wana jenga uko, amana tu pange uko. This is big.   It's just simple. Ni go to simple kabisa. Mabia message to men out there. To the children out there, we need to take care of ourselves as women. And at the same time, even mothers, we need to take care of our kids. Kama uko apana ni monamu. Fanya hima and support this famous thing because it's for the future of your children. It's not the future for us. It's about the future of your children. Be brave enough to stand up so that your children can be free and they can be safe. Thank you.


For more videos and people's struggles, please subscribe to our YouTube channel. What is happening in Haiti? Tens of thousands of Haitians have been on the streets since January to protest President Joe Biden and Moises' moves to consolidate a dictatorship in the country. According to the 1987 Constitution, Moises' term in office was set to end on February 2021. However, enjoying the backing of the United States, the Organization of American States, the European Union and the United Nations, Moises has refused to leave office, arguing that his term ends in 2022. Moises has attempted to justify his illegal usurpation of power by calling for presidential and legislative elections on September 19 this year, as well as a referendum to replace the current Constitution, which was won through a hard fought struggle in 1986. Prior to Moise, overstaying his term, his administration had already violated democratic order and rule of law in the country. Since January 2020, Moises has been ruling by a presidential decree as the country's parliament and the National Assembly has not been functioning. The mandates of all the deputies and two-thirds of the senators expired without the occurrence of legislative elections, which was scheduled for October 2019. These elections were postponed because of a wave of protests sparked by a fueled shortage crisis. The country with 11 million people has only 11 elected officials in office. The diverse opposition has charted up a plan to return to democratic order with the appointment of Supreme Court Judge Joseph Massini Jean-Louis as the interim president of the Caribbean country. 72-year-old Jean-Louis has been a member of the Court of Cassation since 2011. His transitional government should administer the country for the next two years and organize elections for the next government. Judiciary Multiple judicial bodies in the country such as the Superior Council of Judicial Power and the Association of Haitian Lawyers, numerous religious groups and institutions have condemned the disregard of the Constitution. They have called on Moise to resign and for the opposition's plan for transitional government to be adhered to. Supreme Court Judge Yuviquil Dabrysel was detained as Moise alleged that he was part of an alleged plot against the state and the president. There is a strike in the judiciary at present. Amidst the breakdown of democracy, activists denounce a sharp increase in violence. Haitians are being killed and kidnapped at a scale that has never been seen before. PNH, the Haitian National Police have unleashed a violent attack on journalists and there have been assassinations and arbitrary arrests of opponents. The PNH has committed more than 10 massacres since last year while illegal armed groups with ties to the government have committed even more. Thousands of innocent Haitian citizens have been murdered. The role of imperialism The U.S. government, the U.N. and organization of American states expressed the support for Moise to continue the government and hold elections in September. Moise wants to hold elections in 2022 while his gangs are leading the country while bleeding out public sectors. The U.N. has led a 17-year long military occupation first through the United Nations Stabilization Mission in Haiti and later the United Nations Mission for Justice Support in Haiti. This has been a central factor in aggravating the social, economic, political and human rights crisis in the country. 30 years of neoliberal policies imposed by the international financial institutions have left the country with more social inequality, poverty, exploitation of women and inflation. Protesters continue to take to the streets in spite of brutal repression and worsening conditions. Their brave mobilizations have been met with an outpouring of international solidarity and many have called on institutions such as the OAS and the U.N. and countries such as the U.S. and others to suspend their support for Moise dictatorship. Organizations across the world have called for an international day of solidarity with Haiti on March 29th to support the struggle of the Haitian people. March 29th marks the day the 1987 constitution came into effect. These organizations in the call include Alba Move Meantos, The Salinas Brigade, Community Movement Builders, Cote Peng Organization of Human Rights and Democracy, Instituto Simon Bolivar, The International Week of Anti-Imperialist Struggle, Haitian Women for Haitian Refugees, Party for Socialism and Liberation and Kamuna Karibeth. They have called on organizations to conduct rallies and symbolic and peaceful protests in U.S. Haitian embassies, headquarters of the U.N. and the OAS. They have called on people globally to take the issue to social media platforms with the hashtags, no dictatorship in Haiti, town with U.S. imperialism, long-lived Haiti.


In 1930, a new Air Corps era began with the dedication of Randolph Field at San Antonio, Texas. As headquarters for the Air Corps Training Center, it soon developed into one of its more important bases. It was at Randolph that many of America's World War II Eagles learned to fly. The winter of 32 was a man killer in the Southwest. Navajo tribes were snowbound in Arizona without food and other necessities. The 11th Bomb Squadron from March Field was sent to help. Traveling at 133 miles an hour in open cockpits at zero temperatures, the V-2 Condor crews dropped 15 tons of supplies. It was a unique act of humanitarianism. Machines designed to destroy an enemy were saving Native Americans. While American pilots were flying missions of mercy at home, an ominous voice was heard in Europe. Many laughed at Adolf Hitler as he and his Nazi party were coming into power. But with a highly mobile army, the Wehrmacht, and a well-equipped Air Force, the Luftwaffe, Germany posed a great threat to world peace. In the meantime, the U.S. was developing faster and more powerful aircraft, the B-9, the P-26, and the B-10. An excellent trial for the new B-10s came in 1934, when Lieutenant Colonel Hap Arnold led 30 officers and enlisted men on a long-range test flight from Washington, D.C. to Alaska. On the return trip from Juneau to Seattle, the crews flew 990 miles nonstop through fog and rainstorms. Thus, as early as 1934, the Air Corps demonstrated that it was technically possible for an enemy to attack the United States from the Arctic. When the volcano Mauna Loa on Hawaii suddenly became active, the government called on the Army Air Corps to bomb the lava flow and try to save Hilo City. Five keystone bombers dropped 6,000 pounds of high explosives on the lava stream and its source. Two days after the bombing, the river of fire slowed, then stopped completely, and Hilo City was saved by air power. In March 1935, the Army set up three combat wings, one at Langley Field, Virginia, for the East, one at March Field, California, with aerial forces to protect the West, and one at Barksdale Field, Louisiana. Thus, the nation was provided with small, mobile air forces that could spot and intercept hostile forces before they could get within striking distance. And if necessary, planes could be dispatched to reinforce American bases in Hawaii, Panama, or Alaska. Control of this tactical force was centralized for the first time under the newly formed General Headquarters Air Force. In the interests of scientific research, an historic balloon flight was made on Armistice Day, November 11, 1935, from the Strato Bowl in South Dakota. Piloted by Captains Albert Stevens and Orville Anderson, the world's largest balloon reached the greatest height man had so far attained, 14 miles. They landed after eight hours and brought back valuable knowledge on weather, cosmic rays, radio, and mapping, a profitable scientific expedition. Weather conditions in the spring of 1936 produced unprecedented floods in the eastern states. Thirty B-10 bombers with 45 officers and nearly 100 enlisted men were sent to help the victims. They dropped 8,000 pounds of medicine, clothing, and food to the stricken communities. The Air Corps played a major role in alleviating human suffering by quickly converting its weapons of war to wings of mercy. Meanwhile, Japan was making a bid for world power through an undeclared war against China. Japanese pilots were training for Pearl Harbor with a relatively modern air force that ruled the skies over China. At the same time, Italy was testing her air force in a campaign against Ethiopia. The American press raised a valid question. Why was U.S. air power falling behind Germany, France, Italy, Russia, and Britain? The War Department had an answer. The nation was not devoting sufficient money to aircraft development. But the Air Corps was planning an aerial dreadnought of tremendous capabilities, the 4-engine B-17, later known as the Flying Fortress. The Boeing Company delivered the first B-17s to the second bomb group in the spring of 1937. The new airplane gave the U.S. an unprecedented bombardment capability. On February 17, 1938, with Lieutenant Colonel Robert Olds in charge, the Air Corps dispatched six flying fortresses on a goodwill flight to South America. After visiting Argentina, Chile, Panama, and Peru, the bombers returned to the United States and landed at Langley Field, Virginia. All 49 men who participated were saluted for their skill in accomplishing the 10,000-mile mission. On March 11, 1938, German mechanized forces escorted by 400 aircraft crossed the Austrian border. Hitler himself followed the next day and formally swallowed up the Republic of Austria. On September 30, 1938, the Munich Agreement was signed. Without firing a shot or dropping a bomb, Hitler's military machine had won a great victory. The next day, 500 German aircraft took part in the invasion of the Sudetenland. Appeasement left Hitler free to conquer Czechoslovakia. Yet British Prime Minister Chamberlain believed he had achieved peace in our time. In 1939, President Roosevelt requested a larger defense appropriation for expansion of U.S. air power. First and foremost was concerned with increased aircraft production. Training was also stepped up at Randolph Field in Texas to build a pool of reserve pilots. There were intensive studies in meteorology, navigation, radio, and air regulations. On completion of the training, most of the cadets were sworn in and commissioned as second lieutenants in the Air Corps Reserve. Rigid training converted raw recruits into men physically and mentally fit to defend the nation. On the fateful dawn of September 1, 1939, Hitler directed the German Army and Air Force in a lightning-like campaign against Poland. Without warning, 2,000 modern German combat planes took off for the first aerial blitzkrieg in history. With this earth-shattering overture played by Stuka Bombers, World War II began. In early 1940, Hitler's forces led by the Luftwaffe began to overrun the map of Europe, across Denmark and Norway, then southward over Holland and Belgium toward France. The Luftwaffe repeated its Polish success as it paved the way for advancing panzers that overcame three and a half million French soldiers. The Luftwaffe appeared invincible. The U.S. was forced to respond. President Roosevelt said, I should like to see this nation geared to the ability to turn out at least 50,000 planes a year. This meant speeding up from 2,000 planes a year to more than 4,000 planes a month. Many said it was impossible, but American industry rose to the challenge. After the French surrender, only the British Royal Air Force remained for the Luftwaffe to conquer. As German aircraft crossed the channel, the Royal Air Force sprang to England's defense, a modest but well-trained force of British airmen equipped with spitfires and hurricanes fought back. The best the Luftwaffe had to offer was knocked out of the sky, then Hitler switched to night raids. But the Luftwaffe's final effort was desperate and doomed to failure. Britain's airmen fought furiously and England was saved. Half a world away at dawn, December 7, 1941, a Japanese air task force headed for Oahu, Hawaii. Mission, sneak attack, primary targets, Pearl Harbor, Hickam Field and Wheeler Field. Wave after wave of Japanese planes bombed American aircraft and units of the Pacific Fleet in an attack that achieved amazing tactical surprise. Although America paid heavily for being unprepared, the U.S. Army Air Forces, led by men like General Hap Arnold, began to rise from disaster. Hap Arnold said, we are faced with a tough job, but I know that we can do it. And with all due reverence, I say, by God, we will do it.


So thank you, thank you everyone for attending. I know it's Friday, it's a bit late, so really appreciate it. I hope it will be an interesting talk and you learn something new. So let's start, the talk is about implementing MTLS in Istio multi-cluster environments using Aspire. My name is Samu Veloso, I'm software engineer at Solo.io where I'm building a multi-cluster service mess based on Istio and Envoy. Yeah, my name is Edu Bonilla, I am customer success engineer in Solo.io, working with open source technologies, Istio, Envoy, Aspire, so hope you like the talk. OK, let's start from the beginning. So what is MTLS? Most of you probably already know it, but for those that don't know it, let's start. So most of you probably are familiar with TLS. It's a traditional protocol used by many websites to encrypt the traffic. So in TLS, the client has to validate the server from the certificate in order to establish an encrypted communication with MTLS, both the client and the server authenticate each other. So in this case, also the server has to validate and authenticate the client certificate in order to establish an encrypted communication. This is more powerful because with MTLS, you can define policies and restrict the access to your server only to some specific clients. So in order to establish or to use MTLS, you need to generate a client certificate and a certificate and a key for your client and for your server for both of them. So this is simple. If you only have two apps, a client and a server, but in enterprise environments that you are probably more familiar with, with Kubernetes environments, they are really dynamic. They, the pods are being recreated very often. So in order to handle the certificates, it's you have to use some kind of tool because it's impossible to handle this mess just with manual actions. So the technology that we are going to show that solves this problem is SPFI and SPIR, okay? So let's review first what the SPFI and later we will review SPIR. So SPFI stands for Secure Production Identity Framework for everyone. It's an open source standard for securely identifying software system in dynamic environments. So basically SPFI is just a standard, okay? It talks about how to design your system to be compliant with SPFI. So there are several concepts. In both in SPFI architecture that I'm going to go through. The first one is the workload API. The workload API is in charge of generating a document called SBID. I'm going to talk about a lot about SBIDs. So SBID is a verifiable identity document. It's a document that the workloads are gonna use to establish the MTLS communications because inside the SBID, we are going to put an SPFI ID, okay? So the SPFI ID identifies a specific workload within a trust domain. All the workloads running, for example, in a cluster, the cluster will be the trust domain as we will see later with Edu because we are going to have two different clusters so we will have two different trust domains. And the SPFI ID is just Yuri compliant, okay? It's you have to put inside the SPFI ID, the trust domain, and also the workload ID. And the workload ID depends a lot on your environment configuration. So the important thing here is the SBID. So the SBID, there are two different formats of SBID. We have the X509 certificate and the JOT token. The X509 certificate is preferred over JOT token. So in the rest of the talk, we are only going to speak about when we talk about SBIDs, we are going to talk about only X509 certificates. And it's a certificate generated by the workload API with the SPFI ID inside of the SBID. And for example, as you can see there, okay, it's a normal certificate, an X509. But in the extensions, in the subject alternative name, we are putting this SPFI ID inside there, okay? So the workload API will return the SBID, the private key, and the bundle of the CIA of the trust domain to the workload. And the workload will use that information in order to be validated by other workloads in the trust domain. And as the talk is about multi-cluster, we are going to have different trust domains and every trust domain has to trust each other, the rest of the trust domains. So SPFI declares that you have to expose every workload API has to expose the trust bundle, which is the public information of the certification authority that is issuing the certificates to the rest of the trust domains. So with the trust bundle information, you can federate your trust domains into each other as we will review later in the demo. So this is SPFI, and now SPIRE is just one implementation of SPFI. There are several others, but here we are going to review SPIRE, okay? So in SPIRE, it's more complex architecture. We now, instead of having only the workload API, we now have an agent and a server. So the agent will generate the SBID for the workloads in a process known workload attestation. In order to do that, we need first to register the different workload entries with the registration API that you have just in there into the server. And the server will store these identities into a database that are different in SPIRE, it supports several different storage vacancies with the data store plugins that you can define, and the same with the certification authority. As the server has to generate certificates for the different SBIDs, we need to use a CA plugin. So you can use just an external certification authority. By default, it will auto generate a certification authority that will use to generate the certificates. So that's the server and now the agent in order to be able to trust the server. And vice versa, also the server has to trust the agent. The agent will be authenticated, okay? If this process is not attestation. So we are going to see how this works, okay? This reparts the registration API, the not attestation, and the workload attestation in Kubernetes. So the first thing is how we register our workloads with SPIRE in a Kubernetes environment. So in the SPIRE server, that's a pod running, okay, in the SPIRE system namespace, and inside the SPIRE system pod, we have two different containers. We have the SPIRE server itself and the controller manager. So this controller manager is continuously watching for pods that match the specification in the cluster SPFID custom resource. So we define, for example, a pod selector. So only the pods with these labels can be registered in the SPIRE server database. And the SPFID that will be generated for that workloads will match the, what we define in the SPIRE FID template. In this case, it's the trust domain, the namespace of the workload, and the service account of the workload. This is what we are going to, this format is we are using with Istio later on. So once the workloads are registered into the SPIRE server, we need the agent to grab or to get this, the SBIDs for this workload. So this is what this node attestation, okay? The SPIRE agent or the SPIRE server needs to trust the SPIRE agent and just only trust the SPIRE agents to avoid others, to impersonate the SPIRE agent and return the SBIDs to a different agent, okay? So the SPIRE agent will generate a CSR, a certificate signing request and it will use the service account token of the SPIRE agent. The SPIRE agent is a demon set running on Kubernetes. On every node, there is an SPIRE agent running with a service account. With that service account, the SPIRE server, so here we need a TLS communication, okay? Because we are sending confidential data, the service account token to the SPIRE server, so this communication has to be secure. And with that token, the SPIRE server will go to the Kubernetes API and with the token review API, we'll grab the information, the metadata for the agent. And with that information, it will register the agent into the SPIRE server database. It will generate also an SPID, but in this case, the format is pretty much different because in this case, the format is based on the planning that you are using to register the agent. For example, in this case, it's Kubernetes projected service account, because we are using just the path of the service account token. And the selectors are retrieved from the token review API and the selectors are used just to identify the agent inside the database. So once we have this, once we register the agent, we are going to generate an SPID for the agent that the agent will use to establish an SPID communication with the server and now it's gonna cast, it's gonna retrieve all the SPIDs for the workloads running on that node from the server and they will be cast in the agent. And finally, how now the workloads get that SPID from the SPIRE agent, okay? So in this case, the workload is just running on that same node where the SPIRE agent is running and they are going to communicate with a unit socket. So that unit socket is gonna be mounted by a different component, the SPIRE CSI driver. The SPIRE CSI driver will mount this unit socket into the workload and the workload is going to use this unit socket to communicate with the SPIRE agent. The SPIRE agent is exposing this unit socket at GRPC API and the workload is gonna request at this endpoint, the SPIFI workload API, the SPID. So the agent is going to get the PID from the workload, the process ID, because that information cannot be impersonated. The workload doesn't decide the PID, you cannot set the PID when you are creating a workload. So that's unique and with the PID, it's gonna get from the kernel, from the C groups, the container ID and the pod UID for that workload. And from the KubeNet API running that node, the KubeNet that is running, it's gonna get the rest of the information, the selectors that we are using to register the workload into the SPIRE server and from the list of SBIDs available in the agent. So with that selector, with that information, it's gonna get the SPID and it's going to return finally the SBID to the workload that we'll use to establish MPLS in the trust domain. So that's a bit of theory about SPIRE and SPIFI how it works. So now Edu is gonna show you in action how all of these works and how to set up a multi-cluster environment with all of these. Thanks, Samu. So now I am going to talk about how you can integrate SPIRE and IST in action in a real environment and then I'm going to show a real-time demo. So first of all, I'm going to make like a high-quality architecture of our demo which is composed of two Kubernetes clusters, Istio cluster one and Istio cluster two. And in each of them, we will deploy one SPIRE server in order to get the domain of its cluster. Then we will deploy one SPIRE agent per cluster because this demo is only done with one Kubernetes node so it's one SPIRE agent per node. Also both SPIRE servers will be in communication between them because we will federate the vendors from its them. So in order to know which applications are in its cluster and in order to be able to establish communication between them, we are going to create a mesh thanks to Istio. So we will deploy Istio in a multi-cluster architecture using the same network. So every application will be deployed in network one and we will deploy then some apps as you can see here in the image. So we will have our Istingress gateway from which our users will access. Then the users will be routed to our frontend application which is product page and from product page to the backend applications. So let's see the flow, users come to the ingress gateway, frontend and from frontend they will be to the backend. Also just for some observability for the demo purpose, we have deployed also Prometheus on its cluster in order to get the metrics from the traffic of the applications. This metrics will be federated into Thanos and we will show some observability using Kali. So first of all let me talk to you about the Istio multi-cluster architecture. In this case we are deploying both clusters in the same network and the way that Istio upstream has to discover the services deployed on the other cluster is by making request to the API server. This is why we will use this command which basically creates a secret in cluster one, let's say, which contains the cube config so that IstioD is able to communicate with the API server of cluster one. This way all the applications, all the services in cluster one will be aware of which services are running also in the second cluster. So we can establish a direct communication between service A and service B. So how have we set up this in Istio? So basically we are deploying a multi-cluster architecture we define here the name of our cluster, both of them will have the same mesh ID and both of them will be running on the same network. Also we have to specify the trust domain for each cluster and we have to make also this modification trust domain aliases in order for the applications in cluster one to trust also the applications from task domain cluster two. So now that we have Istio multi-cluster let's go with a spire federation. So how does this work in Kubernetes environment? So we have a spire server from cluster one and from cluster two and we need each one to communicate with each other in order to fetch the bundles from the other cluster. So for that we will enable federation and we can establish the template of the specific template which consists on the trust domain, the name space and the service account of the application. This can be modified but this was done for the demo. This will federate with Istio cluster two. So here for each federated domain we can establish like some variables. So the trust domain of the federated cluster and the bundle endpoint URL. This URL will be pointing to the gubernated service of a spire server two in order to fetch the bundle from it and have all the identities available also from this cluster. So now that we have Istio multi-cluster and spire federation, let's see how do both integrate together. So before explaining that, I'm going to explain how does Istio do it in order to get the certificates for Istio cloud and you need to know that Istio cloud in Istio contains two containers. One of them is the application container and the other one is the Istio proxy container. Istio proxy container is formed by two components which are Istio agent and Envoy. What Istio agent does is basically boost trapping the proxy and provisioning identities to the workloads. How does it do it? It makes a certificate signing request to IstioD, then IstioD signs the certificate and Istio agent and Envoy communicate thanks to this sacred discovery service which is called SDS, which is basically a Unix domain socket. So Envoy is able to talk with the SDS through SDS Envoy API and it can get the certificate and the keys which will be stored on Envoy on memory. So now that we know how does Istio do it, let's see how does spire and Istio do it together. So instead of having the Istio agent communicating with Envoy via SDS, we will establish direct communication between the spire agent and Envoy using SDS. How will we do it? So in the installation of Istio, we set some webhooks so that every workload from Istio that will be deployed thanks to the CSI driver that is in the node thanks to Spire, we will mount this CSI on an own location in the workload. So the spire agent and Envoy will be communicating via socket in the same node thanks to the discovery service. So this is the way that we will provision the certificates to Envoy. So how does Spire do it? It's time we deploy Istio workload in our cluster. As I was saying before, we have the Istio controller manager which is in charge of checking which workloads or which identities, which workloads are created on our cluster and reconciling them. So in this case, we are checking the logs so Istio Spire controller manager saw that this pod was deployed on our cluster and it didn't have any identity. So it creates an entry on the Spire server with its PVD selectors and the domain which is federated with. Then if we check on the other container, the Spire server, the entries, we can see that we create one entry for each identity on our Spire server. In this case, it's the entity also of our booking for product-based application with the EntryD, SPVED, the same that we defined before, the parent ID which will be the Spire agent, also the SBIDs, and this is interesting because we are also able to define some selectors in order to identify our workload. In this case, this is the default installation so we only have the pod UID which is the same that you can check in the YAML of the pod running in Kubernetes. We can also customize this by adding more selectors to the identity of each workload. And also we have to say that this will federate with Istio Cluster 2. How does the configuration in Mboy look? So this means that Mboy will have two SANS, two subject alternative names created for each certificate which will match both domains for the same workload. So for booking for product-based, we will have the certificates matching the SPVED from Istio Cluster 1 and Istio Cluster 2. Also, if we check on Mboy, the trust domains, it will trust certificates from both bundles coming from the Spire servers. So now let's go with the demo. First of all, you have here the repo that we use for this demo. It is public and it's very easy to install with kind. We have made a make file so you can easily deploy it on your environment. Okay, so I'm going to show you what we have in Istio Cluster. We have two contexts. So if we go to kind Istio Cluster 1, you can see that we have been looking for the front-end application and also the backend. We have the Istio Ingress Gateway in Istio System, the Istio Decontamplane, and the Observability Components with ArcGale, Prometheus, and Thanos. Also in Spire, you can see that we have the Spire agent and the Spire server. So let's go to Istio Cluster 2. As you can see, we have all the backend applications to which we will make the call from the front-end. We have also Prometheus for Observability, the Istio Decontamplane, the Spire agent, and the Spire server. So let me make this screen bigger. Okay, so apart from that, we have added also more security in order to make the demo more interesting in the security aspect. And is that we have added some job policies to the Istio Ingress Gateway. So we are only accepting jobs that are signed by this certificate. You can see it also in the repo. We are extracting the job token from this URL. So we are getting this job token and we have also exposed the gateway using HTTPS with a certificate. So we will also need to specify one certificate in order to go through our Istio Ingress Gateway. So basically, this will be our job token. We have here the Istio and the subject, which is testing secure.istio.io. And we will only allow jobs with this Istio and subject. As you can see here in the request authentication, we are specifying the certificate. And here in the authorization policy, we are specifying the request principles. So let's make the test. If we make the test with the right token, it works. If we try to make it with a fake token, we get the Istio Ingress Configure. So it's like an extra step for configuring the security of our gateway. Also, another thing that you can do for security playing with the SPFIDs is adding some authorization policies. In this case, for example, we say that only booking for product page, which is our frontend, will be able to access our backend application reviews with this method and with this path. So any other application that tries to access this reviews backend application will be denied. So let's make the test. If we try to call from the sleep pod, the reviews application, we are not able to make any request to this pod. So this is another way to play with security and SPFIDs. Now I'm going to let a for loop running here. With every two seconds, we'll make a request to our Istio Ingress Gateway. And also if we check the logs that they have here, we are able to see what in the request is coming to our AppStream service. Yeah, so it's here, as you can see, this is the SPFID of our AppStream application. So I'm making the request to booking for details with this SPFID. You can see the hash that we have for the data, the certificate that it's been forwarded with organization, the UD, and also the SPFID from the application that made the request. If we check this into our graph, we are using Kali for this one, we are able to see all the flow of our communication. So this box is for Istio Cluster One, this one is for Istio Cluster Two, and let's display also the security. We can see that all the communication is encrypted. If we click on any of them, we see that MTLS is enabled, and we can see also the SPFID that is making the request and the one that is receiving it. So the SPFID that is making the request, in this case, is booking for product page, and the one that is receiving it is booking for reviews. So everything is encrypted, and just to make a double check, we get, I have a sniff pod running, and we also got some data into Wireshark. So this is the IP of the SUS node, and this is the IP of the pod application. This is the request, this is the response, and this is the ACK of the request. As you can see, everything is ciphered using MTLS, and we check the transport layer security encrypted application data. So that was the demo, different ways of securing your mains, your clusters using also SPFIDs. So we hope that you like it. We have here some references that we used for this talk, in case that you want to check it, we have also submitted these slides into the schedule of KubeCon, and here we are going to let also the QR code just to leave us some feedback. So we hope that you enjoyed it. So any questions, just feel free to ask. Yes, we have a mic just in the center. Great. Hello, thank you for the presentation. I want to know how certificate rotation is managed when you have this multi-crystallized setup. Is it managed by SPIRE and not by issue itself? Yeah, in this case it's managed by SPIRE, you can configure just the rotation period. So yeah, you can rotate it every hour, or do you prefer? Okay, one more there. Yeah, hello, hi. What would something change if you have chosen a different network architecture than you chose? Because you have the same network. Two closers in the same network. If I have another not network, something like that, what would change? Yeah, so nothing would change for SPIRE, it would change for Istio. So you are not able to access the API server of the remote cluster because you don't have, you are not talking in the same network, but you would have to deploy an Istio gateway in order to be able to do that pass through and go through the services. So it would change architecture of Istio but not the one from SPIRE. You would have to deploy also the Istio West component. But I mean, so the SPIRE will still be trusted even though you are communicating through a different gateway, right? Because you will now communicate throughout Istio West gateway not by Ingress anymore, but that would work normally. Yeah, SPIRE will be also trusted because the SPIRE will federate the bundle from the other clusters. So as long as both the SPIRE server has both bundles, the Istio West gateway will do a pass through. So it will forward also the same certificates. It's running pass through, that's correct, sorry. In this reference right here, the Istio.io docs, you have all the different multicluster configurations and yeah, all of them are supported. Thank you. Okay, one more right there, I can see one hand. Yeah, I was just wondering in terms of use cases, I guess benefits of having multiple trust domains over a single trust domain with one root of trust. Like when do you see one versus the other? What would you advise? Yes, it's a very good question. I think it depends on the company. I mean, on your business logic, that's gonna define everything. I don't know, maybe just one department is going to be one trust domain and the other, it depends on your organization, the different components and the relationships between these departments. I think it depends a lot on your business logic or business domain. Thanks for the talk. How is under the SPIRE server is the SPOF or it is possible to have high availability on it? Is it what, can you repeat the question please? It's a? Single motor failure. It supports, in our case, yes, because it's a demo, but it supports high availability configuration. So actually you can deploy it outside of Kubernetes in a different, actually it's a very important, it's a component that it has to be very secure. I mean, you need, so you can just deploy it outside of Kubernetes in a virtual machines with hardening and just in high availability. The same with the database. I mean, in our case, we are just using a SQLite inside the Kubernetes spot, but in production you are going to, you want to use a Postgres outside with all replication and in a production way. So yeah. Thanks so much. Thank you. Cool. In your example, you showed that the two Istio clusters are across a single network, like, and so they're connected as part of the same. I'm guessing it's possible to do it across multiple networks. And if so, how much complicated does it get? Yeah, this is, also if we go here to this link, you can see all the possibilities. It is possible. Yeah, it's like the similar question to the one before you need to deploy an Istio gateway because you don't have direct communication to the API server, so you must do a pass through to the Istio gateway. It depends about complexity. It depends on the number of clusters you have. So if you have 10 clusters and you want to do complex routing between one of them, yeah, then it becomes a bit complicated just to manage the objects. But it's easy to do for just traffic, but if you then want to implement policies like JotPolices, Redimiting, then it depends on the number of clusters you have, the more complex. But definitely it is possible and I have seen it in many places. Many customers have this, yeah. Cool, thanks. I'm sorry for the duplicate question. Sorry, could you just put the GitHub link up one more time? Yes, there it is. That one, right? Yes, thank you. If there are any issues, just open an Istio gateway and we will try to address or just solve your questions. So yeah. Any other questions? You can also ask offline, okay, or just in our social media. So thank you everyone for attending. Have a good day. Bye. Thank you.