Well, as much as I like to introduce people, if you have to do it after Deborah Small, it's kind of annoying. I don't know of a better way to introduce our new executive director Maria McFarland Sanchez Moreno, but I do want to say this. When Ethan told us in January, when he told me that he was resigning, I was trying to take a day off, and the phone rang, and as Ethan did, I was like, I can't get a day! I picked up the phone, and he told me he was stepping down.  I was angry. I knew we had a conference this year. I knew how much he carried this conference. Ethan, I hope I've done you proud in trying to hold some space that you held this year. And I also hope that I've done you proud, Maria, in welcoming you, because I know that this is a lot to hold, and a lot to pick up, and in just such a short amount of time, the elegance and grace and openness that you have brought have taken away any measure of fear, any measure of doubt, and I join the 80 staff members of DPA in being proud to say, welcome is our new Executive Director, Maria McFarland Sanchez Moreno. Thank you, everybody. Thank you, Asha. Those are such beautiful words as everything that Asha says is. It's so beautiful, but thank you, and thank you, Deborah, for setting us up so in such a lovely way and your clarity of vision, and thank you to everyone who just spoke, who spoke from the heart and illustrated the many very different ways in which this terrible, terrible war on drugs is affecting us and affecting our societies. I want to just start by thanking the people who put together this wonderful four-day conference in which we've all learned so much, and those are Jim Claps. Jim, thank you. Thank you for making everything run so smoothly, for doing all the logistics, for planning this for months and months on end. Stephanie Jones and Stephanie Polito, both playing key roles. Asha for bringing together our partners, that beautiful candlelight vigil. Thanks to Hannah for bringing the international perspective, and our international colleagues from 50 countries. Thank you to Tony Newman, Megan Farrington, and our comms team for spreading the word about this event. Melissa Franke for her hard work on the app that so many of you have used. So many staff who suggested and moderated events and panels and brought people in. Thank you for coming, for being participants to all the presenters to the exhibitors. Beyond DPA, thank you to Zara Snapp and to the seven interpreters. Thank you to Karen McCallson and her team at Helms Briscoe for making things run smoothly. Thank you to the harm reduction in action display participants. Thank you to the Center for Civil and Human Rights that allowed us to have that beautiful candlelight vigil. Thank you to the Omni staff. And I want to say I was distressed that there were a couple of instances in which we heard of situations where people did not feel respected at the conference or near the conference. And I want to say that that's wrong and that's not acceptable and that we believe that everybody in this room, everybody who comes to this event, no matter your background, deserves respect, deserves to be treated with dignity and we will stand by you. And I want to say just very specifically, we appreciate the concern that was raised with us about gender-neutral bathrooms and we've tried to raise it with a hotel. And we were unable to get a solution this time, but we've taken note of it and believe us, we will make sure that this does not happen again next time. So thank you for raising concerns. You know, Michelle Alexander at the opening urged us to think big. She urged us to think about the war on drugs in the context of bigger forces at work, of white supremacy, of oppression, of global economic structures. And she's right. You can't divorce the war on drugs from that broader context or from the erosion of even the rhetorical commitment to basic principles of human rights that we're now seeing around the world. These are dark times. We're seeing a backlash of reactionary forces across the world, not only in the United States, but across Western Europe, in Asia, in places like the Philippines and Mexico, in throughout South America. We're seeing a backlash to movements that have fought for rights for many years, that have fought for democracy, for open government. And the war on drugs doesn't express that backlash in its entirety, but it is a tool by which many of these leaders are trying to exert control, trying to oppress societies, trying to instill fear in others and justify their abuse. And that means that our work today is more pressing than ever. So as we fight to end the war on drugs, let's do so with the rich understanding of the context in which it's happening. And let's do so with a clear understanding about the underlying principles that guide our work, because this isn't just about the goal of ending the war on drugs. This is about our common commitment to basic principles of human dignity, of human autonomy, of truth, of social and economic and racial justice. It's about how we stand alongside the people who are most affected, the people who are most vulnerable and most marginalized in our society and are therefore being targeted. We also have to translate that into practice. And so that means that when we look at marijuana legalization, we don't just legalize willy-nilly, we think about how, we think in a very deliberate way about making sure that when we give out licenses to people, that we do so in a way that integrates racial equity, that benefits those who have been most affected by the war on drugs. And that's not going to solve all problems, because as my colleague Cassandra pointed out yesterday, providing more access to licenses for marijuana is not going to repair the harm of generations of racism and inequality in our society, of injustice. It's not, but it's a step that we can take. It's a concrete action that we can push for right now. And we need to push for many, many concrete actions that will build together as we have our sights on the bigger picture. We need to translate all of that into reality. We also need to think big about the problems and the solutions. And that means when we think about legalizing, we don't just think about marijuana. And it means that we, when we think about decriminalizing drugs for personal use, which many of us are talking about as the next step in the drug reform movement, we have to ask questions, will that really solve all the problems that we're talking about here? Of course not. It will solve some of them. But it's going to leave a number of things out of the picture. Because the people who are producing coca, the indigenous people who are being affected by the war on drugs in Colombia and Bolivia and other parts of the world, the people who are producing opium poppies in Afghanistan, Burma, they are still going to be in trouble. And Pookie is still going to be in trouble. So we need to talk about legalization of all drugs. That has to be part of the conversation. And we need to work together. You know, part of thinking big is part, is thinking across the different silos that we're all working in, the lines that divide us. We need to know that we are all partners. Everybody in this room, in the drug reform movement, we have to think across the lines that divide us. But we also have to think about other movements that are connected to ours and how we can work together and how we can learn from each other and think about common solutions. You know, whenever you have autocratic leaders, whenever you have tyrannies, fascism, it's a classic move to try to divide and conquer. We need to respond with strength, with unity, with truth. I said it before in my opening session.  This is our movement, our movement for truth, for justice, for human dignity. It's going to be really, really hard. This is going to take a long time. It's going to get a lot worse, I'm afraid. But I am confident. I know that you are all brave enough and committed enough and honest enough to make it through. And we're going to make a difference. And we're going to transform this country. And we're going to transform the world. So thank you. Thank you all for your commitment. So as we look toward St. Louis in 2019, and I remind you there are midterm elections between now and then. I can't tell you how to vote, but I can tell you to vote. There's a lot of people who don't have the privilege. You hold space for them when you cast that ballot. We can make a difference. Chloe Coburn, who was sitting in the front row, and who has made a lot of this possible, including the partnership with Afro punk that was masterfully pulled off reminds me that when we're at movement for Black Lives conferences, we close out one way. You want to try it with me? Want to try it? Y'all ready? Y'all kind of quiet. You're not bringing the Brooklyn energy. So you'll repeat after me. And this is how we're going to close it out like this. We're going to say, I believe that we will win. I believe that we will win. Let me hear you. I believe that we are going to be tired. I'm just getting started. Let's go. Go home. Be safe. Take care of yourself. And let's end this disgusting, dirty, stinking drug war. Not another day of our watch. Bye bye.


RIPcord blockchains are revolutionary. Cryptocurrency is revolutionary. It has the ability to change the world, like the internet and the automobile before it. Crypto is a fundamental change to the power structure of finance and is shaping our world for a better, brighter future. Immutable. RIPcord blockchains are immutable and tamper evident while our ancestors said written in stone. Our children will say written on the blockchain. Public. RIPcord blockchains are public. Flat networks between participants. No hierarchy, no gatekeepers, no controls on what transactions can take place and all data is verifiable and auditable by anyone. Collaborative. Gun are the days when our only options are opaque banking systems. We're now able to access blockchains as a community. Volunteer participants on the protocol work together to run the network and collaborate to establish and enforce consensus rules. Open. Anyone can participate in RIPcord blockchains. There are no barriers to entry, no borders, and no permission is required. If you have an internet connected smartphone, you have all you need to participate. Resistance to censorship. Crypto is resistant to censorship, interference, seizure, manipulation or control which makes it neutral to all participants and all transactions. It is not controlled by governments or banks or corporations. Cryptocurrency built on RIPcord blockchains is controlled by the people. Decentralized. Crypto's greatest strength is that it is not controlled by a central authority but rather it is a decentralized protocol. RIPcord blockchains are neutral platforms. These networks do not, cannot prioritize or censor any transaction based on anything other than the adherence to the consensus protocols. Decentralization of power is the primary principle which makes all of the other RIPcord properties possible.


Hello, in this presentation, we will enter a bank reconciliation into our bookkeeping problem in Excel. Keep in mind how that same information could be input into accounting software such as QuickBooks. We will first take a quick look at QuickBooks and then jump back over to Excel and enter the data there. When considering QuickBooks, we have a feature to allow us to conduct the bank reconciliation that starts with choosing the account. We are going to choose the checking account and then we are going to put in the date. We are first going to reconcile the first month. So remember, we have two months worth of data now. We are going to go back and reconcile the first month and take a look at some of the problems that can happen in making adjustments in that case, if there is a problem and we need to make some adjustments for the prior month. And then we are going to have the beginning balance and the ending balance and enter that information. Once we do that, we could say continue within the QuickBooks software and it really just gives us a detail of our bank.


Here's the top three recommended AI courses for beginners. The first one is by Google. It's free and it's the best. A generative AI for everyone. All the introduction classes only takes an hour to finish. Number two is GenAI for Beginner by Microsoft. And these two companies clearly are competing in scans each other to educate the entire industry. But Microsoft course is significantly longer than Google. Number three, Deep Learning.ai has many entry-level generate AI for everyone, classes for everyone to start to learn and get into the space quickly.


I'm Petty Officer Keegan Dyer. I'm a recruit division commander at Recruit Training Command. I currently work at Fleet Quality Assurance or FQA. Quality Assurance, basically everybody calls us the police. They try to avoid us the best they can. They don't normally like to see us walk in when we have the briefcase. These hours are long, but I think that a lot of the times they go by faster than you would imagine because of how busy you are with the recruits. I think coming here the hours are worth it because there's always that one recruit that you find in P-days that you never think they're going to make it through. And then one day it clicks for them. And that to me is when all the hard work is worth it.


OK, I guess it's time to start. This works, right? OK. Hi, I'm Lena Padling, and I'm going to talk about systemD and TPM2 today. Yeah, let's jump right in. So with the stuff that I'm going to talk about, like I want to start out with making clear what the actual goals are with TPM2 support in systemD. I probably want to sketch up with other OSes, because usually all the other commercial, the big OSes, generally default to using some form of Secchia enclave TPM by default. Generic Linux typically doesn't. I mean, there are some Linux-based operating systems, which do, of course, but it's usually very focused and not available in generic stuff. And if people want to do their own OS like that, they have to do major work. And I want to make that a lot easier so that this kind of stuff is just available without much effort. And people don't really have to think so much about it. So yeah, the goal is to default to a measured boot and using that for unlocking distance things. I want to go further than just disk encryption. I want to be able to unlock any former secret that we have to TPM and make that a natural way how you interface with services. There is a goal of secure parameterization. I mean, this is kind of related to what I was just asking Serge about earlier. Yeah, sometimes it's important to be able to parameterize the West when you boot it. And that's a difficult problem because you want to really restrict what you can do there. Contradan computing. In focus, they have different requirements. Ideally, we would make this as little different as possible. So yeah. And of course, one of the purposes is also to open up the TPM for other purposes than what we in the system you want to use it for, so that it generally just works. And there are some semantics on how it's initialized and things like that. Yeah, so the goal really is to be ultimately good enough that we can turn on TPM to support by default on generic Linux and not just as an afterthought. So let's talk about the current state of what system you can provide with the US right now. So basically, I'm just going through the different components in system you that have TPM hookup in one form or another. The first one is, I guess, the most interesting one, which is the FTE support, like the full disk encryption by a system decrypt setup. System decrypt setup is basically just a wrapper around lip-crypt setup. But what it does do, it integrates it with the rest of the system, like with the system you boot process, for example, with interactivity, but also with all kinds of crypto stuff, including FIDO2 and PKCS11, and what we like the most interesting thing here is which is TPM. So yeah, the obvious way is to unlock the Lux volumes by TPM2. We do it a little bit different than the previous solutions because we actually extend the Lux superblock with our data, so it feels a lot more natural because you don't have to have secondary data anywhere else. You don't have to store anything in NV indexes or something like that. It's entirely like all information that is needed including the Lux superblocks and nowhere else. So that's kind of nice. The relevant TPM policies that we actually implement are one based around literal PCR values. I'm not sure how useful this is because it's so nasty dealing with literal PCR values. More interesting is the one of the signature of PCR values, like the extended authentication thing that was mentioned in the earlier talk. And the third one is pin based. That is then interactive during boot. Or you can have a combination of these. This assessment crypt setup is not just about unlocking things, it will also, if you want to, one thing more, which is unlock the, oh this is annoying, the volume key that just unlocked to PCR 15. The purpose of this is that we want PCR, I will talk about this more a little bit later, but the goal of this is basically that we have PCR 15 as a way. Like it's a hash that represents the identity of the system, if you so will. And if you bind TPM objects to that, the idea is that this basically means that only that specific machine can unlock it and not other machines. Then another tool that's closely related to system decrypt setup is called system decrypt enroll. As the name suggests, it does the other thing. It actually enrolls a TPM on a looks partition. It's not much more to say, I mean, you can also enroll a couple of other things like recovery keys, which are probably actually useful in the context of TPM so that if you have some way to get back into the machine, if TPM stuff didn't work. Let's talk about the next component, system DPCR phase. This is about measurement now. It's not about unlocking. It's more about getting the PCRs in the right state. One component, system DPCR phase, the job, what it does actually, it's invoked at selected places of the boot process and measures certain words into PCR, which one was it, 11. So the relevant words are like, when system D first takes over from the kernel, it measures the word enter entity into that and then when it's done with the enter entity, it measures the word leave in it already and so on and so on and then it's assisted in it and ready basically when the boot up is finished. Why is that useful? This is useful if you bind secrets to the value of PCR or to a signature of a value of PCR 11, then you can use this to make secrets that only can be unlocked in a certain part of the boot or in multiple parts of the boot, but not any later. This is at the most basic, even if you don't care so much about the phases, what's kind of useful is by the way that even if you want your keys to be unlockable during the entire boot time, at the very least you can say then yeah, not on anymore and when the system shut down. So that's one thing that we do. Yeah, so it's really about, I mean some operating system that has a concept of destroying the PCR management and measuring values by measuring garbage into it or something like this. This is really supposed to be more useful that you can actually pinpoint exactly where a key shall be unlockable and where it shall not. There's something very closely related which is the new PCR machine. It measures the machine ID, which is basically just a file and it's a machine ID which contains something like a UAD into PCR 15. I mentioned earlier already, right? Like this was where the volume, root volume key of Lux is also measured into. Background is the same thing. We want PCR 15 to be a PCR that identifies the system. Now, the system of course needs to be somewhat generic, right? Like it's not specific to one use case, it's supposed to be generic for everybody. So if people do not actually use disk encryption or something, then this is supposed to help them to have an identity anyway, right? Like of course, much weaker properties but that's not really our problem. Anyway, so yeah, PCR 15 contains both the root volume key and the machine ID. First the volume key and then watch later when we actually have access to that machine ID, the machine ID. And there are system new PCR FS also measures into PCR 15 and what it measures is actually the file system UUID and type of like this can actually be instantiated multiple times. So if you have multiple file systems, the idea basically is that yeah, once all three of those things ran like the system decrypt setup stuff that matters the volume key, system new PCR machine which basically measures the machine ID and that system new PCR FS which measures a couple of file system. PCR 15 is basically done and it can be useful to identify the machine in that combination that it was put together. So that it's definitely gonna change if you like install it in any different way. These things are enabled by default but only under the condition that you're actually booting with a UKI kernel. The reason like we would like to, I mean we would have liked to enable this by default in any case but I mean we take possession of PCR 15 was this right where we consider it our own private property once this is enabled. So we wanted a way how people can actually explicitly tell us we buy into our view of the world and that's like yeah, we decided that yeah, if we detect that the system is Buddha with UKI we do this by default. Of course by default doesn't mean that you couldn't turn it off. Yeah, the goal of the PCR 15 management is identity of the local system. Next thing is the system destub was mentioned earlier in the earlier talk because it was forked already. System destub is a EFI stub glued in front of the Linux kernel runs in UFI mode there's various things most of them are not really relevant in this context but one thing it actually does that is relevant in this context is TPM measurement of the components of the UKI. The idea basically is this is also done into PCR 11 I probably should have mentioned this here. So basically the idea is that if you pick a different kernel PCR 11 as contains the identity of the kernel PCR 11 is assumed to be zero when this stuff initialized. So this way PCR 11 is first becomes an identifier of the kernel booted along with it's inner dirty and all the other components. And if you remember correctly the PCR phase stuff is also measured into PCR 11. So yeah it encodes both the things which was you picked and which phase of the boot you're in. Yeah, this was mentioned in the earlier talk kernel system destub already we call that the UKI. Oh, I actually did mention the PCR 11 thing. So anyway, yeah, so it matters into PCR 11. It also matters they use kernel command line into PCR 12. So the parameterization of the system. To summarize this these are the relevant PCRs that system deep kind of takes over if you buy into the model and use SD stub as the UKI stub. So first of all PCR 11 contains the measurement of the components of UKI and the boot phases PCR 15 the system identity and PCR 12 12 the kernel command line. So it's about basically the first thing picks boot phase and OS the second one system identity and that is kind of powerful that you can then build complex policies out of this for your boot TPM objects of your choice. So next one is system in measure. Actually, I mean it sounds like it would actually measure something but what it actually does it predicts what the PCR values will be in PCR 11 given a specific kernel that is booted and given a specific boot phase is like the systems currently in specific boot phase. What's the purpose of this? It's basically that you can build your policies and log arbitrary objects to this. It can not only pre-calculate the PCR values it can also sign this stuff for you. So yeah, it did currently only focus on PCR 11. We want to extend this by the way that it can also predict the PCR values you will see in PCR 15 and PCR 12 depending on your configuration so that you can do this ahead of time. This is systematically different like by the way how grub boots generally work because they put everything in the same PCR which is great if you are just interested in logs but it's terrible if you want to predict anything and bind security to this with system in measure our goal really is about like having predictable ways so that's why we separate out the PCRs and the purposes of this. Yeah, you can use system in measure to sign the expected values right away and system decrypt setup can actually use that information for the signature based policies that I mentioned. And there's another tool called Ukify I'm not entirely sure yet how we want to pronounce that if it's Ukify or Ukify or Ukify, I don't know. Anyway, this little tool helps you building UKIs so what it actually does, it takes the kernel image takes the system destub, takes an inner ID, takes device tree, whatever else you want, boot splash and so on and a private key glues them all together and a PE image signs them with secure boot, use the private key for that. It then also does the, like it invokes system to measure to predict what the PCR 11 value will be once the system is booted up. We'll sign that with another signature key and we'll then also add the signature to the kernel as well so that the kernel when it boots up we know what the PCR value is going to be and the kernel already ships with the signatures that matches the expected PCR value so that when the system decrypts it up runs it can just take the signatures that was passed that was part of the kernel and unlock the disk with it. So that result is basically that you can say, yeah, I lock my disk against Fedora kernels and then you have to boot a Fedora kernel to actually unlock the disk and you never have to re-enroll anything. Next topic is system decredentials. System decredentials is not just about TPM, it's basically our way how you can pass little secrets, certificates, private keys, but also configuration if you want into a system D as a whole and into services specifically and there's a way how you can propagate them, you can inherit them down from the system into a specific services. System decredentials are actually powerful concept that people should really start using because you can also pass them in from a hypervisor, container manager into the system and then from system D into the services and then you can pass them on further down to container manager and to another VM and so on and so on. System decredentials are very easy for applications to read because it's just ultimately they see it as a directory where these files end up in but they also have, I mean here, just to mention this, like you can supply them to the system by SM bias and QMF, WCFG and a couple of other things, but the one thing that is interesting in this context is that they can also be locked to the TPM with a symmetric key. The reason why we originally added this is secure parameterization of EFI, like of UK eyes in a second world because this allow listing thing that was discussed earlier is one way out of this, but sometimes it's like you want to parameterize in more complex ways and keep the stuff secret, right? And so yeah, if you put this information in the ESP which is unprotected, you need to protect it somehow so our solution out of this was this. It's actually extremely simple to use, you just say, there's a tool called system decreds and we just say, I have this little bit of information, you can use it like in a shell, like in a piping thing and then it does everything automatically for you so that people don't even have to think in any way about TPMs or anything like this. Unable to mend similar TPM policies as crypto setup was the exception of the PIN because it's inherently non-interactive, right? Like the goal of this TPM hookup is that it happens at the latest possible time when it's actually needed, the decryption and authentication of the data and that happens basically when we start a service. But that also means it can't really be interactive because of course, yeah, you don't want to boot up the system interactively, presumably. I mentioned this already, system decreds is a tool, how you can actually create these things. All of system Ds, various components can nowadays deal with system decredentials. It's actually kind of nice because you can securely supply SSH keys and things like that through this and yeah. To be more specific in unit files and system Ds service files you can use set credential load credentials and set credential encrypted to set these credentials and it just does the TPM stuff behind your back. You don't really have to care about that. Yeah, use case for the credential stuff secure parameterization of systems and services can be replacement for things like cloud ends and clouds and yeah, OS installs can parameterize you guys. It can already have said all that. Next thing is system D report. System D report is a, I guess like a declarative repetitioning tool that can run at boot and add petitions that otherwise are not there. Why is this relevant in the TPM context? That's because it can create petitions and automatically encrypt them and link them to the local TPM and roll them there. The use case for this is basically that you ship an OS as a variety image, basically justice slash user petition and then on first boot a root file system is dynamically created. The user thing is, the user petition is basically mounted into it and the system boots up and in that case this has a major benefit that the root file system is inherently local and all the secrets to unlock it remain inherently local between the TPM and the host. So you do not ever have to provision any of the secrets that are generated locally and it's also kind of nice because it adapts to local sector sizes, local disk sizes and things like that. So yeah, declarative non-destructive automatic petition tool, non-destructive basically means you can't really do anything bad with it. It's the only thing that you can do with it is growing petitions and adding petitions. That's really it. Yeah, the key really is that the main point is that all the key material to lock down such petitions is generated locally and locked to the TPM. Yeah, the use case I can already describe. So this was the trying to give an overview like what we currently have. This has holes everywhere and this is like the holes is what the rest of the talk is going to be about and maybe it makes sense like if anyone has a question right now, we can answer that. Otherwise, I would just continue with all the shortcomings and all the white space that still needs to be filled in to actually build a proper secure system. Is there anyone, no one has a question? Was my talk that good or? Everybody's just confused. Anyway, so let's talk about the shortcomings because there are many of those.  I'm not a TPM guy. I'm struggling reading all the TPM specifications like everybody else. I try to talk to the right people though and figure out what to distill out of them, what actually makes sense in the general case. I also talk to the Windows people, by the way. I work for Microsoft in case this wasn't clear. What they're actually doing, they do different things, by the way. Like for example, this is mostly for historical reasons I guess because when they designed the TPM stuff and when it was still TPM 1.2 was a thing and you didn't have what's EAs, enhanced authentication stuff. So you couldn't sign PCR values and things like that. And that of course forces them into certain other ways, like massively other ways. And we have the luxury of coming late in this way so that we can rely on signing PCR values and don't really have to do really, really messy stuff. But anyway, it's very difficult from all the people who do think this TPM distilling what we actually want in the general case and the generic case because that's what I care about in the system. I don't care so much about specific solutions for specific projects or something. I want the general stuff that works for, maybe not for all, but for a large part of the community. Anyway, let's talk about the shortcomings. One of the major things is that we took possession of PCR 11, 12, and 15 for the purposes that I just described, but, and we know that there's zero initially, at least if you boot a regular Shem style boot, but precisely that's a problem because there's zero, any other user space can, like any other learners can basically boot up and they're also zero and they can measure the exact same stuff into it that we do without actually just making it up basically and could unlock secrets with that. So to lock this down we probably would have that Shem probably should measure like something identifying the payload it's about to start doing boot up into all the PCRs that otherwise aren't used. The effect of that would basically be that if you use a different, like if you boot a different OS, you can be sure that the PCRs will be different and that would be lock this thing down. This is a major security hole I guess in a way. It goes away if you don't care about Shem and just enroll everything into the UFI chain directly, the key ring, the DB and things like that, but as long as people want to use Shem we probably should address that. It's a big one I think. The other one is we currently don't keep a measurement lock. I mean we do log everything even in structured form to the journal like to this lock, but there is like I mean for the stuff that happens during UFI like all the measurements there's the UFI measurement lock so you can actually argue about what happens. So far we don't have anything comparable to that. We get away with this because like for us everything's predictable and our goal is not so much about like arguing about what happened but more about unlocking secrets and hence predicting of what's going to happen. But we probably should address that. I think sooner or later we probably want to implement something like the TCG canonical event lock format which is like the spec from TCG. But I'm not sure how much of the community actually bought into this so far. Like if there is actually a tool set that people actually use to parse this. As I understand the event lock format is actually pretty close to what UFI uses and it's just an extension for user space for this but anyway maybe I figure we should do that so that people can actually come at arbitrary times and argue about what's actually happened there. Another short come is asymmetric unlocking. Right now like it's always modeled that you enroll locally and you unlock locally but for various use cases that's probably not what you want but instead you want to encrypt it on one machine and then unlock it on another. For that asymmetric unlocking would be useful. There's actually a patch now that does this. It's work in progress but hopefully we'll have that. Yeah, the goal would then ultimately be that some orchestrator can prepare images for one specific host. Only that host can unlock it because it's the only one knowing the private key to it and that enables a lot of things. It's like the confidential computing people want this kind of model because they then can precede the TPM, the virtual TPM they give to the confidential computing stuff and then can be sure that only the VM can unlock it. Another issue is robot protection. I think this was also measured and mentioned in the earlier talk. Like this stuff allows you to bind a full description and encryption of credentials to like the vendor of a series of UKIs but there's no protection against taking a really old kernel that happens. Like for example, if Fedora would start signing UKIs with the Fedora key, there's nothing stopping you from using the UKI from 10 years ago and trying to unlock even if it's entirely insecure. So we need to look into that. I have some ideas about how this will work with NV indexes and things but this hasn't happened yet but it's definitely something we absolutely should do. Yeah. The next one is, what happened here? This one's a biggie. So for what I've just described so far it works really nicely if you have a specific system like for example a VM because that's a very controlled environment and you can enroll all the second boot keys to natively directly into the UFI curing, everything's great. The problem is once people want to do things on general PCs, things become much more complex because suddenly things are not closely defined anymore but people can extend their systems with boot ROMs and whatnot and firmware updates and everything else which makes it really hard to bind policy to because half of these, because they always are reflected PCR changes and there is no signature scheme for that. So what Windows for example does, it binds it to, it's like a bit locker to the literal PCR values and then tries to predict when they're going to change. They cannot predict everything because some of the changes just happen behind the back so they have also a way how they can turn off basically the binding to that. I'd rather not, yeah this is messy because on current PC systems there's simply no way how to make this beautiful. You have to deal with the fact that there's no signature scheme available, you have to work against that. Yeah the way I think we should address this like we have to address this sooner or later if this truly should become generic and people don't really have to think about this. The way I want this to work sooner or later is yeah, if we expect, I don't really wanna go into that game of predicting what the PCR values are going to be because that basically means you have to parse through the UFI measurement log and then figure out which are going to be the parts of it that are going to be replaced by a firmware update or boot loader update and then putting the new stuff in there and calculating every single thing. This sounds so terribly fragile and I'm, you know, if awareness people can do this I'm not sure if I want to maintain anything, like this sounds terribly fragile to me in particularly as it's never gonna solve the whole problem because some things they simply cannot predict and then they turn off the protection anyway. So I want to come to a way how we can basically bind a full disencryption or whatever you want to bind to. Some public key where the private key is actually stored in the TPM locally and then I'm kind of trying to come up with a scheme where we can then for one boot only basically generate like sign a different EA policy that is loser but only applies on the next boot and then for the subsequent boot doesn't work anymore. So basically that you have a system where you can basically say okay for the next boot I'm gonna turn off the PCR zero to four and seven binding and then you reboot and then we immediately bump the counter or something that protects all this to be disabled again and before that we looked at what the actual PCR values are and those are the ones that we bind to. I'm not sure like this is very vague. It's not surprising it's vague because the stuff doesn't exist. I just have ideas and we actually have to implement them first but I think this is a really nasty problem and I'm not aware of anything and then the Linux world would even remotely try to address this for the general case. Last missing feature which is like really complex one I didn't know what any of this means in the context of KX or user space reboot. Well let's say like I mean yeah I think I know what the right approach to that is right like because some people say yeah just don't measure anything more on the second KX or something sounds like chickening out to me you know the clouds they love KX like because of gray out time so I think we have to do something about this. My current thinking is probably we just want to continue measuring stuff as we always did. However we probably should add away how selected secrets that actually need to be handed over or handed over by some path tied to the TPM expecting what the VCR values are going to be after the KX and then be unlocked there. So basically what I'm saying is that I think it needs to be a different way how we pass over the secrets and not be enrolled in the super blocks of locks for example but anyway this is, I don't know if anyone has a clear idea what we actually should be doing in case of KX and user space reboot. I'm all ears but this is like yeah we really have to think about this because this is as it appears to me seems to be like very soon the common case how clouds reboot. So yeah, so much about the shortcomings I hope you can understand they are major and then particularly major if we think about PCs like actual random systems that people want to install systems on but if you have a non-PC like if you know your hardware and particularly if you run things in a VM I think it should already be pretty comprehensive and you can build things locked down. Any comments at this point? How much time do we actually still have like once now? Or I just only spoke half an hour or something. Anyone has a question? There's a question. Where the microphone. I have a comment. So in the missing feature F you probably also need to look at crash kernels and crash kernels.  Yeah, but you still need to be able to boot it. But yeah, I mean yeah definitely. But it sounds to me like it's like the 10 step and the nine before that are all missing. So we probably have to address those first. I don't like the crash kernel has magic powers about anyway, right? Like you can look into the first kernel, right? You might need to lock down what it writes in some way. Anyway, yeah, it's a mess. But I would rather not think about that yet. Let's first get the clean code pass in order and then we can think about what happens in the exceptional code path. But anything, any other questions? Somebody in front of that? Thank you. Yes, this can all be quite messy. One thing, so you have asymmetric encryption coming. Are there any other features on the horizon to support confidential computing that you're aware of? They're like, I'm actually in regular meetings with confidential computing people. I'm not one myself though. But they are trying to make it work and they have sending, like I think at least three PRs open that I still have to review. So yeah, there's a lot of stuff going on. But I mean, the confidential computing thing, like there are multiple different factions, like groups of people who have different goals with confidential computing, right? Like some of them want to run proper VMs with a virtualized TPM and things like that. That's probably very much in scope what we're doing, but then there's the other group of people who do confidential computing where they just basically run something like Qatar containers thing inside of them. Well, all of this is entirely irrelevant, but they still, it's not that binary. Nobody knows what's actually gonna happen, I don't know. But yes, there's lots of stuff coming going and for example, the measurement of the volume key, the measurement of the UIDs actually explicitly from request by Red Hat confidential computing people. So I don't know, yeah. We try to distill out of what they want when it's in focus for us. We definitely want to add this and yeah, there's some stuff pending. I'll take a look at the PRs. Yeah, well, review is always very welcome. Any other questions at this point? Can't believe that no one has any questions. I mean, I only have one slide left, so you really have to ask questions because otherwise I don't know what I'm gonna talk about. This is a bit different, I suppose, question. But what does Microsoft want in its system? Like, why do they care about system D since it doesn't run on their platform? Of course it does. It does? You know, I think we, how many Linux distributions do we have, James? We have, that is, public, Maranam, and we also have, internally we have any better operating system that's used for the infrastructure. There's more than that, right? Yeah. Anyway. But we also support, yeah, sorry about my one, Microsoft, come on. Yeah, so we also support all of the things used, but yeah, I don't want to get into marketing. How come? There's a lot of Linux users. So, I think it's public knowledge by now, like in Azure, like there is some component that runs Linux heavily and it's all system D stuff. It basically checks all the boxes of what system D offers. That's the reason why I work for them. But yeah, and there's multiple other projects that also do system D stuff. So, these are... Microsoft is a Linux company now. Any other questions? No, I can't believe it, like, come on. This is, like the shortcomings because it was supposed to be something that get you all started and give me ideas like how to address this stuff. But, okay, the only last thing that I have is something that... Can we have one more question? I'm sure. What are the changes for Linux distros to implement secure installation? Oh, wow, that's a good question. Yeah, that's good. So, like the first thing is probably to adopt UK eyes, right, like because UK eyes, like right now, like how classic this Linux distributions, regardless if it's Ubuntu or Fedora or Devian, how they boot is that they don't protect the NLRD. I mean, this was also on your slides before, right?  Like so, the first step is that they fix that whole. Various distributions are have gone past there, some are further ahead and others are not so far ahead. I know that the Arch Linux people have something that's pretty close to working and the Fedora people with the next release, they'll have it as an option that you can boot UK eyes and the confidential computing part in Fedora even has it already, like they actually go that way. If you have the UK eyes stuff, then this enables all the other stuff. There is no discussion yet. Like for example, I think that probably on TPM systems, the root file system by default should just always be locked to the TPM. And then if you want some other kind of locking as well, you probably should enroll something in addition to it, right? Or replacing it. But I think the default for modern operating systems at the most basic should be non-interactive TPM enrollment. But this discussion has not started yet because the way like reworking everything to be UK eye-based is just a massive effort because they currently, they have to rebuild everything because right now everything's built around like inner-degenerators that are inherently local to the system. And if they move this to pre-build them on central servers, on the build servers of the OS, it basically puts everything from the head on its feet and that's just, yeah. And so things happen bit by bit. That said, I know that the Arklinox people are way ahead and I'm doing things better there, but I'm not sure that I don't think they have anything on by default in this regard. But it's definitely my intention to do this, but I have no illusions this will take ages. And like Debian and these very conservative distros I don't think we'll see that in this decade or something. But I mean, in particularly a certain community still have this, I don't know, ideas about TPMs being evil, terrible Microsoft stuff that destroys open source or something and that's not gonna happen anytime soon, I guess. But yeah, it's definitely my interest though that general purpose distributions sooner or later switch to this and we're getting very positive feedback from some of them, at least. And particularly Fedora, Susie people do something there. Arklinox people do something there. Ubuntu people have for the embedded version of Ubuntu, whatever that was called, like Ubuntu core, do some things in this area, but I don't think they have switched to the system anyway of doing things. We'll see. Any other questions? Questions? That's a good question. Somebody was doing a question. Not a question, just a comment. I don't think you had mentioned it. For the Kexec issue, we've all had that thought too, of course, the only, I mean, we don't want to mess with the TPM at that point. So the only thought we've had is you take your credentials that you have at that point, your secrets, put them in a temporary, in it already, a one-time use in it already and pass that along to Kexec. I assume you've had that thought too, but. Yeah, but I mean, I'm kind of a believer that the secrets should better stay in the TPM as long as possible. It would be better, yeah. I'd rather have them pass them over in some TPM-locked form, that however is unlockable at the right point after the Kexec comes. And the question is simply, how do we define that? I'm pretty sure the PCR phase concept, like where we measure all these words into this, that probably might suffice because then you can basically, during shutdown, generate a new TPM, like encrypted container, that says, yeah, the words shutdown and final have to be measured and then the words for booting up of the next system have to be measured and then it can be unlocked until ready or something until the boot process is done or something like this. So I think we have things like that and we have to look into this, that this can just work. Yeah, I mean, so the point that I was making, trying to make earlier is I think we probably want to re-encrypt basically every time we are about to Kexec the data we actually want to path instead of having everything unlockable, not only during the first boot but also during late ones, if you follow what I mean. I think we should constantly only do it when we know that we're coming back because otherwise you basically unlock it for everybody always. So just thought maybe this is where you're going with that but I believe those PCRs, I think you can reset those. You can reset exactly two or something. Okay, yeah, it's been a couple of years so my memory could be fuzzy on this but I thought what are you using, 15, 11 and 12? Like we use, actually we use one more but I didn't want to go into detail but yeah, but there is one resettable. I mean, once they are resettable they kind of lose the magic properties that you can go back to. But here's what I'm getting at. I mean, if you want to treat Kexec at least from a TPM perspective similar to how you would if you were a cold boot, basically when the initial kernel or whatever kernel N is, you basically, like you said, when you get to that final, like the last thing it does before it unloads the TPM driver is it's going to reset those PCRs that you care about and then it basically is in the same state more or less that the system would be when it was warm booting and basically have that kernel act is whatever you're going to have your bootloader or the stub that's in the UKI basically have that then begin for the Kexec. But how do you protect the, that I mean, if you allow PCRs to be reset that way, relevant PCRs, like how do you protect that nobody else resets it for you? Well, but you listed that as another problem which you're going to have to solve, right? I mean, that was I think the first problem you mentioned.  And so if you solve that problem, then you should basically have it solved in this case as well. I, yeah, I mean, I come, it came to the conclusion that probably Kexec reboots are inherently different from the first one, right? Because the, you can pass information around and things like that. And we probably should take benefit of the fact that they are different and then have, like not try too hard to reset everything to the original way. There's benefits to be had, yes, agreed, but you don't have it working yet. So maybe, maybe, you know, start off with it. But saying it doesn't have to be different. I'm pretty sure that's exactly one PCR that you can reset, like the debug one or something. It's possible. Like I said, I could be mistaken, it's been a few years. So are you required to just do SRTM or would you consider like DRTM? So DRTM is what would give you PCRs that you can reset in a controlled way and then redo measurements in a controlled way. And so with the Kexec, you could basically reset it to a known good system. You run your DRTM code. You know that you're coming out of it in a known good state and you can verify those measurements and go forward. So I'm aware of DRTM, but it's hard enough to get this far, right? It's like the DRTM stuff as far as I know. It's like you still need special bootloader and everything, if I think like that. I think it's like, you know, I already list like six major issues that we have to address first. Once we come to that point, like the Kexec one is probably the least of the things that I want to actually address first. So yeah, but it's sure I have it somewhere in focus but also I, you know, I'm not a TPM guy or anything like this. It's not the world that I come from. I'm a user space, OS guy basically. So don't put too much pressure on me to just buy into all the newest fads that there are.  But for now, I guess we probably should fix these problems first. I guess a matter of priorities. How much time do I still have left? Okay, very good. I mean, I only had one slide left but it's only the outlook thing which I wanted to show if I have nothing else to say. So that's good. So thank you very much. Thank you.


Christian Watson is 6 foot 4, 208 pounds with 4.36 speed to give him 96 percentile height adjusted speed among receiver prospects since 2010. Is there anything not to like? Well, Watson played at North Dakota State where he saw just a 27 percent reception market share though he did accrue 3.12 yards per team attempt. That's basically a receiver average type of market share though the efficiency is better. It's worth noting he'll be 23 by the time he takes an NFL snap. It's a really weird profile to fit into past comparisons usually players with that size in athleticism are playing at bigger schools. Denzel Mims though is another bigger receiver with great athleticism some market share concerns but with plus efficiency it's not the strongest take but Watson should be a solid wider receiver 3 for teams that use his athleticism well and if he can make the adjustment to NFL level competition maybe a little bit room for more.


My name is Mark, I'm an open source tech lead at Cisco. I'm also a CNCF ambassador as of this March. For the last couple of years, my primary job was to help engineering teams run their business applications on top of Kubernetes without worrying about things like configuration management, secret management, or deployment pipelines. Before we jump into representation, I want to ask you a couple of questions. Who uses Kubernetes here right now? Are used or plan to use? OK, so who uses Kubernetes secrets? OK, so who rotates those secrets periodically in an automated way? How can you sleep at night? All right, so I'd like to start by telling a story, which I believe will be familiar to a lot of you. A couple of years ago, I was in the debug session in the middle of the night. I probably had a couple beers in me at that point. And I figured out the problem. It was a release that went out that day. Fixed it, pushed it to Git, and I was about to get home when all the bells went off. Turned out I managed to commit and push AWS credentials to a public repository, which is obviously not good. And I was so lazy and reckless that I actually took those credentials from an active instance in a development environment. All right, so I rotated the credentials. It was a dev environment that was fine. Rotated the credentials, deployed a new one. I was about to go home when even more bells went off. It turned out that those exact same credentials were used in three different other environments, including a production one. So what started as a simple debug session ended basically in a production incident. Does it sound familiar to anyone? Oh, okay. So obviously there are lots of ways humans can leak secrets and cause production incidents, but coming from a Kubernetes directive or direction, there are other ways to compromise secrets. For example, there is a common misconception about Kubernetes secrets that they are insecure because they use base 64 encoding. Well, why they can be really insecure is because there is no encryption at rest configured by default in Kubernetes. So if you just spin up any Kubernetes instance on any cloud provider, those secrets will be stored in plain text in HCD or in any other database that the cloud provider uses for their Kubernetes offering. So that is a problem. If you can't trust your provider, it doesn't necessarily mean it's a public cloud provider, but if you store secrets in Kubernetes, basically they are available in plain text in HCD. Another way to compromise secrets is, and this is actually my favorite, not setting R back up properly. Like a lot of people often think about disabling access to secrets to developers so they can't access Kubernetes secrets, but they still give execution privileges into the pods for debugging reasons, which means that basically any developer who has those permissions can just go into the pod and get the secrets the same way that they would just get from Kubernetes. So it's really not about when your secrets will be compromised, it's really about what you are going to do about it.  And well, what can you do about it? Obviously you can do a lot of things, but if you read the title of this talk, today's topic will be rotating secrets. And when I talk to other people about rotating secrets, they often get scared that do we really have to rotate all the secrets we have? Like in a lot of applications we have a bunch of different secrets. And the answer is you only need to rotate secrets that are not rotated automatically anyway. Like in a bunch of cases, if you use workload identities for example, those already use short-lived tokens and you don't need to think about rotating those, you need to think about rotating the long-lived credential type secrets. So why is it important to rotate secrets? And we already talked about one of the reasons why it's important because if you leak something, for example, you push it to a public repository, then you have to rotate the secret.  Like if there is a rule in your company that you have to rotate all your secrets every 90 days, you just have to, you don't ask.  Now when you think about the challenges of rotating secrets, obviously, depending on your environment, you may have multiple Kubernetes clusters. You may run different applications in different scenarios. So it's generally a complex process and it doesn't work well with humans. So we are not really good at complex tasks. And we tend to screw those up as well. So it's, which obviously, in the worst case, ends up disrupting your service availability. So all this really points to the fact that secret rotation goes without saying should be possible. But possible in this case means it should be possible within a reasonable timeframe. If you can't rotate your secrets quickly enough in case a secret actually gets leaked, then you have a problem.  So it should be possible. It should be automated because it's not something that humans should do. And if you think about the scenario I just mentioned that you don't even know your secret is leaked, it should be done periodically. So how does this look like in practice? Not in the context of Kubernetes, but in general. So generally you have some sort of secret store. This is where you store your secrets. This is where you deploy your configuration or secrets from to some environmental, multiple environments. You have some sort of secret provider, which may be AWS, GitHub, whatever. And you generate these secrets from those secret providers and store those secrets in your store. Now on the deployment side, you need something that watches your secrets and deploys the new secret to your production or dev or whatever environments that you have when something changes. So how does this look like in Kubernetes? So first of all, you have to decide if you really want to use Kubernetes secrets or not. As I mentioned before, if you don't plug the holes, then using Kubernetes secrets may not be for you. So make sure to turn encryption at rest. It's called, I believe it's called encryption config on a lot of cloud providers. You will see it as an end-of-encryption. Make sure you configure our back properly. And generally just go to the Kubernetes past practices page and just go through the recommended steps and just apply those. If you want to use Kubernetes secrets, make sure that you do the most you can to secure the use of Kubernetes secrets. All right, so how do we deploy secrets to Kubernetes? Obviously, you can just keep CTI, apply a secret object to the Kubernetes API, but if you have multiple Kubernetes clusters, if you have multiple different environments, that's probably not something you want to do. Especially if you have like a GitHub's workflow, where you want to automate the whole secret deployment process. So this is where the external secrets operator or just external secrets comes into play. It's an operator. You can configure it through custom resources and basically synchronize the secrets from an external secret store like HashiCorp's vault, all the different cloud provider-based secret stores to Kubernetes secrets, which is great because you can actually put these custom resources to your GitHub's workflow because they don't actually contain the secret, they just contain the instructions, how the secret should be deployed to the Kubernetes cluster. And once ESO deploys the secret into the cluster, you can use that secret as you usually would. You can mount it as your environment variables, you can mount it as a file. So very quickly, how it works behind the scenes. As I mentioned, you configure ESO through custom resources. Similarly, how you would configure third manager, you can configure a cluster level secret store or an in-space code secret store. The naming is a little bit unfortunate because you scold the secret store, your external secret store, where you actually store the secrets and the custom resources also called secret store, which is basically the configuration for your external secret store, how external secrets can go to the secret store and synchronize secrets from to your Kubernetes cluster. And then you have the external secret object, which tells the external secrets operator to configure a particular secret from your secret store to a Kubernetes secret in a certain format. So we have a lot of options here if you want some sort of templating or you want to generate a file or something. Yeah, so the cluster secret store is in a cluster scoped resource, while everything on the right here is namespace scoped. It's similar to how it works in third manager with the cluster issuer and the issuer. All right. So there are alternatives that you could use if you wanted to. Sealed secrets is a pretty popular one. The problem with sealed secrets and SOPS in general is that they don't really work well in a multi-cluster or multi-tenant environment. Yes, of course, you can share the key between the clusters and you can absolutely do that, but you still have to expose the key to the developers or whoever manages the secrets for encryption and you can't essentially revoke them without re-encrypting everything. So general speaking, I find the SO to be a better solution at this point, but if someone needs a quick start solution sealed secrets may work as well. So I deployed the secret in the cluster. I have it, the application is running and something changes. ESO can actually synchronize changes, so you can specify an interval if you want the operator to check the secrets and it can actually synchronize changes as well. So now what? Well, if you mount the secret as a file into your pod, then obviously your application needs to take care of reloading that file and reloading the secret, but if you inject the secret as environment variables, you can't really do that on the application level. So what you need to do there, is actually trigger a new rollout. And so far, I mean, reloader is a pretty new component on the market. I mean, it's one or two years old, but so far we didn't really have a good solution. Reloader can manage triggering standard workload rollouts when any of the Kubernetes secrets referenced in those workloads change. So it's pretty cool. And going back to our earlier process, now we have Kubernetes in the middle, which is our environment. We have external secrets that deploys the secrets to the Kubernetes cluster, and we have reloaded that watches for those changes and triggers workload rollouts. So basically with this pipeline, whenever something changes in the secret store, you never have to touch anything. It automatically deploys the secret to the Kubernetes cluster, and it automatically reloads the workloads. So, sounds good so far. It actually works pretty great as well. We've had this in place for almost two years now. But the next question is obviously, how can all this go wrong? But the first answer is who knows? So you have to monitor your entire secret management pipeline, and you have to have some tools to notice when something goes wrong.  They also have like SLI recommendations for you. I do recommend to revise those and find in those to your needs. Depending on how you deploy secrets to Kubernetes, you may want to observe different metrics. They also have a very nice Grafana dashboard that's good for an overall overview of how the operator works currently, but it's not that great for debugging. Like when something is going wrong, it's not that great. So I've opened an issue, and I'm working with the ESO team to come up with a better dashboard that can help debugging issues. And one additional note here is that some of the metrics include resource names as labels, which in very high environments can cause problem because of the high cardinality. So you may either want to drop those labels if you don't use them, or just don't drop the metrics entirely. But this is something that we actually had to deal with. Now, another common problem with ESO is that when you change something, you change a secret store configuration, or you change some authorization details on in HashiCorp's wall, for example, that change doesn't actually take effect until the next synchronization period of an XML secret. So the problem is when you change something, you don't actually know if you're broke anything or not. So what we did here to solve this problem is we actually have test secrets for every single secret store that we have, and every time we change something, we make sure that this secret gets deployed again. So we know if something goes wrong, we have alerts. If any of those test-secret synchronization fails, the alert goes off and we can fix the problem. But this is not something that's immediately obvious, and this is something that we've learned the hard way. Another other issue we had recently, which I'm told may not be an issue anymore in newer versions of ESO, but I wanted to talk about it anyway because it's such an edge case and it's still happened. So in the secret store, there is this option called store validation, which means you can tell external secrets not to synchronize anything until it can reliably communicate with the store. So if the store goes down, it doesn't start synchronizing all those external secrets, still hammering the not working external secret store, which is great. And we had that turned on, and naturally our internal went down for like five hours. And the store validation has a retry on it with a nice back off, which after five hours were somewhere at the day interval, which meant our complete synchronization pipeline stopped working, which we've learned the hard way because some of the secrets should have been rotated and the secret was not synchronized because it wasn't working at all. The whole pipeline stopped working, which means it caused the production incident for us. So I'm told this may not be a problem anymore, but a seemingly simple problem like the store going down actually caused the entire synchronization pipeline to stop working. Our solution for this problem, we use GitOps, we use RGroCity to deploy all of the configuration to all of our clusters. So what we did, we basically add in an annotation to all of the store configurations, which caused the store all addition to start again, and that's restored everything. But doing that across dozens of clusters manually, would have been hard. So to sum up ESO, it's a great solution together with ReLoader. You really don't have to touch anything for it to work, but you still need to understand how and when changes take effect, and you still have to monitor and alert for everything to make sure that, well, it doesn't stop working. Now that's, so you may decide that you don't want to use RGroCity secrets at all because you can trust your provider because you can't change any configuration to plug all those holes I talked about, or maybe you just don't want to use RGroCity secrets for whatever reason. So you can do that if you want to. In that case, naturally, you will have to talk to the secrets store directly somehow. Now, option A is to integrate that communication into the application directly, but that's not really what we want to do, like keeping configuration in secret management apart from the application is usually a great idea because you may have to deploy it into different environments. You may not want to tie your configuration management to your application. So we need something else. And the alternative is that you inject those secrets into the applications somehow. For example, using environment variables. Now, in case of Kubernetes, there are some solutions available. They generally work the same way. Like usually they have a mutating admission webhook that mutates pods being created in Kubernetes. They inject custom init into the container through a mounted volume. They change the entry point as well so that the custom init goes first and then they inject environment variables into the application somehow. Now, different solutions use different strategies for determining what secrets need to be injected. One of those solutions is called bank quotes. Anyone heard about bank quotes before? Okay. So bank quotes started at Monsign Cloud as a project and it's now being developed at Cisco. I'm one of the original engineers and we like to call bank quotes Vault Swiss Army Knife, HG Corpse Vault Swiss Army Knife because it's not just a secret injection solution. It can run Vault on top of Kubernetes for you. It can configure Vault for you and it can do that secret injection I talked about. So how does that work in case of bank quotes? Where did bank quotes? We use the so-called secret reference and we set them as environment variables for the application. The mutating webhook, we use a mutating webhook as well. The mutating webhook goes through the pods, the secrets and all the custom resources that take place in creating the pod and scan for the secret references. If there is such secret reference it's going to mutate the pod, it's going to inject the custom init and that custom init is going to replace those secret references with the actual secrets from Vault. As you can see, the secret reference contains Vault colon, the path to the secret and then optionally a key if there is a specific secret you want. And that custom init replaces the secret references with the actual values. Now the only downside of the solution at the moment is that it doesn't actually detect changes. So once you started the pod with a secret and if the secret changes in Vault that's the solution doesn't detect it, it's not going to trigger a workload reload yet. This is something we are working on right now but currently it's not part of Bankholds. What we did in the past with Bankholds is that we basically triggered a workload reload every day or basically just shorter than the interval for secret changes. Now obviously as in case of ESO this solution comes with its own risks and trade-offs. For example, if the secret store goes down then you can start applications because you don't have access to the secrets. Whereas with ESO you have all the secrets there in the Kubernetes cluster so even if the store goes down you can still schedule applications you can still scale your applications because the secrets are locally available in the cluster. Now similar to that solution you can actually start a Vault instance with Bankholds within the cluster and synchronize the secrets from your central secret store to that local cluster instance and talk to that local cluster instance instead of your central external secret store and that actually comes with a bunch of other advantages. For example, you're not going to hammer your central secret store with requests, you can just talk to the cluster local instance which is nice and obviously if the cluster local instance goes down you'll have to fix that but it still reduces the risk in case something happens to the central secret store. The other problem is the webhook itself. If the mutating webhook goes down for any reason and it can very easily go down if you are not careful with its configuration then you won't be able to schedule pods at all. Depending on the error policy that you define in your mutating webhook but if you ignore the error then your application will still not be able to launch because you will still not have any of the secrets injected into the application. So the webhook goes down so does your ability to schedule applications. Now there's a list of best practices that you can follow. I actually wrote a blog post about that. Make sure your webhook is highly available. Make sure it's spread across your cluster so if one node group goes down for example your webhook is still available. And of course there are alternatives for this kind of operation as well. Commus is being one which actually stores the secrets encrypted within the cluster and then with injected custom init binary within the container it talks to its central service running in the cluster and decrypts the secrets on the fly which sounds somewhat better because you can still schedule applications. You can still schedule pods if something happens with your central secret store but its development kind of died down in the last couple of years. So it's not really actively used in the community. And the other solution that's coming up is the secret store CSI driver. But the problem is you can mostly use that for mounting files in the containers. You can't really use it for mounting environment variables which is fine. But if you want to use environment variables you always can't use that. As far as I know it can't detect changes yet either. So a couple things about bank codes. We are trying to revive the community around bank codes. We are moving it to new GitHub organization. So if anyone wants to contribute it's going to be way easier. As I mentioned we are going to work on the workload reload feature. So we are going to detect secret changes and we are going to trigger workload rollouts on secret changes. We also plan to support more providers. Currently we only support HashiCorp's vault but the secret injection can actually work with any kind of secret store out there. So we're planning to add more providers. And we are also planning to add the new feature to the bank code suite which is secret synchronization. I mentioned earlier that you can run a cluster local vault instance if you want to and synchronize secrets. Now we don't really have tools for that at the moment and we plan to give you some tools so you can do that more easily. And if you have any feature requests or if you're interested in bank codes please just talk to us because we definitely want to hear from the community and we want to hear how you use bank codes. Now I actually prepared a little demo. I'm not sure if you have, oh we have time. So I just want to quickly show you how external secret works. Let's see. So I have a local kind cluster here. It's running vault within using the vault operator. ESO is already installed and the reloader component is already installed. And I can show you that hopefully I have still have the forward running, yeah. So I can talk to vault, I can grab the secret from it and I already have the application deployed, I believe. I just need to set up the, so I have the application running and basically the world here is coming from a secret. I can easily show that to you. Deploy, demo. So as you can see, the environment variable hello is injected from a secret which is synchronized by ESO from vault. Now if I go ahead and change the secret to something else, let's say hello everyone and I go back to the service, nothing changed. If I take a look at the secret, the secret changed. Previously it said world, now it says everyone. So what I can do here is I can manually roll out, figure it all out for the application. Obviously I have to restart the port forward. I wish there was something that could do that automatically. And if I take a look at, by the way, can you see the console? Okay. So if I take a look at the output now, obviously it uses the new secret. Now let's change the, actually let's enable reloader now. So I can do that by annotating the deployment. I'm gonna tell reloader, okay, start watching for any kind of secret changes and please trigger it all out when something changes. So this is gonna change the deployment and I'm going to change the secret as well. If I take a look at the secret, the secret is changed and probably I can't talk to the application now because the port forward is down. So I'm going to restart that and if I go back to the application, now it says hello points or something which is the secret I've changed the last time. Which is what I changed the secret to the last time. And I didn't do a manual out here for the last time. It was all done by the loader. If we take a look at the instance itself, we should see revision increased. It basically uses the same way when you use kubectl preloader start. It increases the revision count on the deployment. All right, where is my, so if you would like to see a more detailed demo, I have one for Bankwells as well but I don't think we have time for that. But I'm happy to talk about this. You can actually try this out. It's a Maggie tub. It's very simple. You just need some Kubernetes cluster which can be kind. And I have all the instructions detailed in the read me so you can easily try this. But I can show you in the hallway if you want to after the presentation. So to kind of summarize all this, it may not be the best life advice or the key to happiness, but certainly in secret management, it's always better to assume the worst, prepare yourself for the worst possible scenario and then you can actually sleep at night. Thank you very much. And I'm happy to answer any questions. There's a microphone over here I believe, so. Hi, I had a question about Kubernetes secrets itself. I want to get your viewpoint this. I was told that, sure, so Kubernetes secrets is not secure because I can just base 64 encoded or decode it on to see the reals text. But I'm told that apparently now we can actually like encode it with some salt, some hash. Okay, so the base 64 encoding is not actually the problem because it's for encoding. And if you think about the types of secrets you may store sometime, for example, certificates, you absolutely need the ability to encode those. So that's why base 64 encoding was added to secrets. The problem is that by default there is no encryption at rest in Kubernetes. So the default setting is plain text. And the reason for that is obviously, depending on the provider you are running on, you have to configure different KMS providers, for example, if you want to encrypt those with KMS. But you can configure your own encryption at rest. I think it's called encryption configuration, but you can tell Kubernetes to encrypt the secrets before it stores them in that CD. So basically that's how you can protect your secrets from being stored anywhere in plain text. When you are running on a cloud provider, it usually is called envelope encryption. And you can use KMS, for example, if you are running on AWS and EKS, you can use AWS KMS to encrypt those secrets.  But that's how you can make sure that it's not stored in plain text in that CD. Thank you. Any other questions? Oops. All right, if you have any more questions, feel free to reach out to me. You can find me in the hallways here or you can send me an email, find me on Twitter. And yeah, thank you very much for your attention.


Recent advances in immersive virtual reality, VR, technology have enabled users to experience more realistic simulations than ever before. Head-mounted displays allow users to move their heads freely within a simulated environment, providing a greater sense of presence and immersion. These devices can be used in conjunction with electroencephalography, e.g., allowing researchers to measure electrical activity in the brain while subjects are experiencing VR. This has led to a number of studies exploring how the brain responds to different types of VR experiences. This review summarizes these studies, highlighting the potential applications of e.g. based VR and its implications for future research. This article was authored by Gene Lu Choi, Haram Kwan, Jae Hoon Choi, and others.


The Appalachian Advantage plan is the simpler, better way to get the phone you actually want instead of paying hundreds of dollars upfront.  It's called the Appalachian Advantage and is available at Appalachian Wireless. Floyd County Sheriff's Department will be hosting the first annual Walk Run Ride in honor of Deputy Oliver Little, June 11th. Deputy Little had been with the Sheriff's Office for six years when he died due to complications from COVID in October 2021. Yeah, Oliver was a great guy, a healthy 46-year-old boy that loved police work. He loved people. He loved helping people. He was a paramedic. He'd done that for years even before he came over to me and service is what he was all about. And so it's a way for us to honor a man who loved giving to his community and serving others. And we just thought it was appropriate. His family wanted to do something in honor of their brother, their son. And it's just a way for us all to remember Oliver each year is to have an annual, this will be the first one, but we plan on doing it every year for Oliver. The proceeds from the Run Walk Ride will go to Kentucky Law Enforcement Memorial Foundation, which helps cover funeral costs for fallen officers. So we're going to have the 5k at the Geniwally Lake. So it'll be around the lake and Geniwally is one of the few lakes around. It's very scenic from a roadway. You can drive around it. And so we'll meet at the old swimming pool, the boat ramp there. And that'll be where we're signed up and that'll be the starting point. And we're doing a little different. It's called a Walk Run Ride. A lot of people want to ride their bikes.  Registration opens at 8 a.m. and the Walk Run Ride will begin at 9 a.m. Registration is $12 in honor of Deputy Little's badge number, 212. For more information, go to Floyd County Sheriff's Department, Prestonsburg, Kentucky on Facebook. For Mountain Top News, I'm Brianna Robertson.


Hi, everyone. Welcome to the boss wrap-up for July 25th, our second day of boss. I'm going to be calling all of the boss organizers up one by one to tell us what they achieved today, what goalposts they've set, and what goalposts they've passed. I'm starting through 2.2, which all day was getting in the applications first, and open QA, open QA sounds like a handle to tell us so fast. So, we've spent the entire day talking about here. We've started off discussing our experience with the Ubuntu LTS as a base, which turned out somewhat favorably. People enjoy the stability that LTS offers for us as developers. It's been a bit of a challenge because naturally as our user space software progresses we need to sort of let the libraries catch up and doing that in a consistent and non-regressive manner is a bit of a tricky topic. That being said, we decided to prepare for the move to 18.4, which is going to be the next Ubuntu LTS release coming out in 2018. We've also talked about snapping, which is containerizing bundling applications into isolated instances, more or less, which should allow us to update applications in a much more regression-free environment and also in a portable sort of scenario. So, we're definitely looking at that, and we actually have active plans to do application releases as snaps moving forward. So, I don't know what the next application release is. It's something, 17.12, something like that. Yes, 17.12 should probably be entirely snap-based unless we encounter big showstoppers there. Then we talked a bit about OpenKey, looked at our current tech for OpenKey. It's working well for our primary use case, which is ISO validation for the application testing. There's still lots of stuff to be done. That's something to do. We've also looked at ARM builds, incorporating the builds of Plasma Mobile into the Neon Scope as there is a vast overlap between the two projects. I'll say that in order to conserve big resources and also management, there's a bit of activity going on in folding the two into one big project that builds 64-bit Intel architecture and ARM architecture at the same time. We've also looked a bit at how our infrastructure behaves and how Plasma releases work in the context of our infrastructure, as well as on the RAM. There are some reminders to be made, but nothing particularly interesting there. We've also looked at a bit of the user experience side. Currently, we are having trouble with actually allowing people to install additional languages after the initial installation of the system. There's a bunch of stuff that needs engineering there. Also, a big topic is driver installation, driver management, so users can install proprietary drivers rather than free drivers. If they do so, choose. Again, there are lots of engineering needed there. We've also talked about Calamaris, hopefully a future installer going to replace the root-based installer called Ubiquiti. We have gone into great detail. There's a bunch of improvements that need to be made architecturally in order to facilitate the stuff that we wanted to do, which is a more concurrency workflow that should offer quicker installation and also a configuration during the installation itself, which would be really awesome. To close out the end of the day, we've then done a GBG key signing off where we went around in circles and looked at each other's IDs, and hopefully so designed each other's keys so that should be awesome too. So, that's it from me. Yes, thank you. Point three was much more varied, interesting, I'm sure.  We're going to discuss about Calam programs, which are with coding, we've got some work for them, it's a lot of query. We discussed about how this year's program went for us, how the changes were made, who were some of our core programs, should we have helped us or not. We asked the participants and mentors for the suggestions on how to improve our, how to improve our mentoring programs and how to improve our work flow. And there were some nice suggestions and there were also some last points with which we have worked upon. So, yeah, that's pretty much it. There was a Weyland boss and Dave is going to tell us about Weyland. There was a Weyland boss, where we invited people to make out for one-to-one plasma work Weyland to test around, see what works, see what might not work. Mostly things seemed good, we found a one-to-one system to fix, found a staff, to fix a few people's principal set-ups, or to fix their very important Python and Gamerain, and we've worked on practically fixing a lot of things, including some quite difficult problems. It's kind of precious that you don't want to talk about, generally, but since we were face-to-face, it was a good moment to do so. It was mostly improving different languages. Also, we were talking about merging and a bunch of repositories that we have split at the moment, which hopefully can help get new developers at some point. That was the biggest thing, besides bearing it picky issue. We applied it in general, and the integration that we put up on global configuration. There's some challenges with all of course this configuration for plasma and system settings that we need to address. And another important setting we were introducing is like a user-assisted white kid switch that disables not only the entire data submission, but also all the infringements that you might want to make with it, because there are some good services for organizations that want to disable that for the entire network. We got the infrastructure, we worked with systems to get this deployed on KD servers, so we can actually... And finally, starting with a discussion on individual applications of the old model and of him, we'll bind KD white policy on what we want to track or what we're allowed to track, how we review dance, so kind of the code of telemetry conduct. Well, it makes sense that yes, as he came to you, ensure that this is all up to our entire systems. Yes, that's basically it. That's the future for the microplasma here on Plasma Desktop. We also discussed some of the complexities of the background issue that Microsoft is facing. And we discussed on some of the cool skills that we could add to Microsoft like screenshots and make a generic media player still. Also, in the discussion was a bit about the privacy issue, so creating a message that belongs to users that it uses Google STT. So yeah, that's about it. Thank you. We'll get it together at the end of today. Yeah, okay. So we talked today about some of the short-term, medium-term and long-term vision that we want to accomplish for Plasma. And obviously, Plasma has a graphic environment so we have to think about this quite often. And so we developed some goals and some things that we have to do going forward that our teams want to go with. So expect a lot of change and a lot of feeling too comfortable is not going to happen. We're going to ask you to put up with us a lot and so we hope for your cooperation. Rather than that, thank you. We mostly discussed about how we need to learn about what the people who actually bought the device need to know more about the kind of companies that would be interested in doing an experience such as that we need to continue talking to people, but maybe there are smaller manufacturers that would be interested in the whole point of us thinking about it is whether we should continue doing this or not. We've been discussing about whether we should actually get group of hardware manufacturers or acceptors together or much like our advisory board, we should discuss it again. But I think that the conclusion is more or less that it would be a good idea to do it again at some point maybe not yet. There's also some places where we could be improving making sure that the hardware is exactly what we want and to make sure that processes that the company has in place are up to our expectations but we can do that, especially because like I said, we don't want to do it now really again, but maybe in a year or maybe five years. But then there's improvement and we'll do that and where it goes. Conqueror is dead. Long live Conqueror. You might want to be more detailed than that. Basically I've been reviving a little bit the effort of Conqueror lately, making it work with Web Engine and the idea initially for this both was to figure out what we want out of Conqueror. And then I learned that there is an existing Qt Web Engine based browser called Capsula, which is actually quite polished as a lot of stuff and my temptation now is to simply drop Conqueror completely and use Capsula and actually we talked to the Capsula maintainer on IRC so right now it's a GitHub project and he's open to the idea of moving that to the community and we also jokingly suggested to change the name actually sex to Conqueror okay with the idea if we're okay with it that can just relax but before you can relax we have Dan and Hindi Bob right so we discussed some of the tasks that we are currently working on and we are planning to work in the future we cleaned up our static cleanup, our wiki pages which are horribly outdated. We already talked about our effort to get contact for windows built, hopefully that will get soon folder made KDPim work on Wayland so we just need to fix the lines and we can work on Wayland now we also focused on our developer story so we want to make it as easy as possible for new developers to start working on KDPim it's not easy given the amount of repositories and the dependencies between them so we want to make their lives easier and hopefully attract new users to think that we will be also merging streaming the exchange support which currently is done by some guide github so we will be merging into KDPim runtime so that all our users will have a chance to use Microsoft Exchange we also finalized the KML user serving and we'll be publishing it very very soon and we talked about the plans for the Randa Spray in September so it will be in the morning soon and Thomas can tell us something about the main topics that we the main topic that we had was of what would need to be done in order for being portable to Kirigami so that we can then also have it on mobile the name discussion also came up and we came to the conclusion that we maybe should brainstorm on a new name which the design group is going to do and then we discussed a bit about things like should we to the play integrating services like Spotify and also currently it does play from YouTube and you can live from YouTube and then we discussed because of the legal implications and how we could still use YouTube and it would not be a legal gray area because we want the player to be back into all distributions which we also talked a bit about how it could be integrated with Mycroft and about how debuts could be used to for example offer a KRunner plugin so that you could from KRunner directly start playing music Assistant Scarlett to come forward those of you who are filming the Academy User Satisfaction Survey and with Levin they named you in a previous level the years are completely random QML application I'm sure and the button will be pressed to reveal the winner and the winner is Franklin Wang who wants to rock with Casbot catch the bus and be quick