The makers of Mars coconut bar and all those other good Mars candy bars invite you through the creaking door for another thrilling inner sanctum mystery. Tonight, the smile of death starring Larry Hayes. Good evening friends of the creaking door. This is your host to welcome you once again into the inner sanctum. Come on in. Say, are you busy? We are. Yes, sir. It's been a week of corpse-packed, always-say-die frenzied activities that even had our zombies complaining about their blood pressure. To make our horror complete, some enterprising creep even scheduled a revival meeting. But the project somehow never got off the ground. I guess that's because some people just don't revive. Yes, there's thrilling mystery awaiting in the inner sanctum. But first, this is Alan Z. Anthony making up a little mystery about another thriller. It's something delicious, refreshing, and deeply satisfying. It starts out way up in a tall tree bathed in sunshine and ocean breezes. Know what it is? Well, here's another clue. When it's freshly shredded, it's snowy white, juicy rich, delicious. Yes, you guessed it, coconut. And when it's in a Mars coconut bar, it's always the finest Philippine coconut, the very best. Yes, that's the answer, the perfect answer to your crave for coconut. All wrapped up thick in deep, dark chocolate. The Mars coconut bar, a new taste thrill. And it's still a mystery how any candy bar can taste that good. And now, for tonight's proof that some men diligently build their own gallows. Our builder and candidate for extinction is Archie Davis, a young man with a blind spot that he couldn't quite erase without erasing himself. Our workshop is the pageant hotel. An ancient ramshackle hotel where even death can sleep the night for $1.50, payable in advance. Payable to Archie Davis, Nightroom Clerk. On a job like mine, your world gets as small and shabby as the wallpapered lobby. You wait and check in the characters and creeps. You wait and you watch. And then the desk bell rings bingo one night.  But elegant, the aristocrat on the wrong side of town. I want a room for the night. Okay, sign here. Ruben Small, is it? Yes, Ruben Small. That'll be $1.50 payable in advance. $1.50, here you are. Room 313, here's your key. Uh, young man. What? Do you have a hotel safe? Young? This portfolio, I'd like to check it. It has some value. Okay, I'll lock it up. A receipt, please. Receive? Oh, sure. Receive. Here you are. One of the staircases over there. Room 313 is two up then left and down the end of the hall. Okay. You have no elevator. That's been out of order three years now. Climb too tough. Yes, I'm not well, my heart. Oh. Mal, try one step at a time and rest on the landing. Yes, yes, I suppose. Can I summon you from my room? The sign behind me reads no room service. But in an emergency, if it's a matter of distress. If it's a buzz, the switchboy, it's an emergency like that. A cardiac in room 313. And a portfolio to be locked up in the safe. A gold-tooled leather portfolio that makes your fingers do a nervous dance. You sneak a look, and your girl sneaks it with you. Archie, you shouldn't.  I've blown a fuse myself. Count that, baby. Archie, no. Oh, I had fun. There's no law against only counting other people's money. I... I can't count it. That much money frightens me. It's indecent, huh? I count 20,000, baby. So much in cash? Lush green cash. Put it in the safe. You can't lock a dream up, baby. Oh, Archie, stop staring at it. Stop torturing yourself. Torture? Baby, I'm on a golden horse riding in the sky, so where's the torture? Get it out of your mind. To do that, I'd have to go out of my mind. You... you mean to steal it? An old guy signed in to die in room 313, so I could be rich. An old guy signed in... Ruben Small. A phonious name ever invented. In the morning, there'll be a corpse in room 313 named Ruben Small. Why are you so sure?  I know. Because my luck's been long overdue. Archie, not murder. Not murder.  His own way? See that red button flashing on the switchboard? It's room 313. It's an emergency. It's death buzzing me to say that room 313 is checking out. It was death calling from room 313. I could see it standing over the old iron bed, putting the final touch on a man with hardly enough breath left to say goodbye. Young man, come closer. Please, I'm dying. You're dead. There are things to tell you. I don't want to hear. I know all I want to know. You're alias Ruben Small. You're something that crept in out of the night with a gray mustache and a cane. A dollar fifty. You just about had enough to pay for a death bed. My portfolio... I never saw it. You left it in the cab.  What portfolio? Mister, you must be kidding me. All right, Irene. Grab the portfolio and run. Archie, I can't. Now, you board a train for upstate of... Rose Day away, your grandmother. No.  I know what goes here at the hotel.  It's our whole future. It's wedding bells and a terry cloth rodent of mutants. People calling me sir while I laugh out loud in their faces. You've lost all conscience. Lose yours. It's one luxury we can never again afford. Even with twenty grand. Now, start running. Irene obeyed. Now, the night drags. A second at a time. A minute at a time. And the longest night of your life. You wait for the morning discovery of a corpse in 313. You wait. And the fog in your mind gets heavier. Your nerve begins to go and... You begin to imagine things. You see a red button flashing on the switchboard. Flashing. From room 313. From room 313. A corpse in 313 is... Calling for room, sir. And room 313 back for a second look at death. Back to see how a dead man could call the switchboard. You took a long time coming, sir. What? You think you took a long time coming? Oh, I was away from the desk. How did you get in here, lady? Through the lobby and up the stairs. As you say, you were away from your desk. Oh. What's funny? You.  Did you really think a corpse was telephoning for room service? A corpse? Don't pretend now.  You knew my husband was dead when I rang for room service. He was your husband? June and December. Don't say it. He was Martin Bruce. I'm Jessica Bruce. And your name is... Archie Davis. Why didn't you report my husband's death at once? I see you're not going to incriminate yourself. Let me. The valuables my husband left for safekeeping. Were you hoping to keep... He didn't leave any valuables for safekeeping. No. It's your good fortune that I went through my late husband's pocket before the police did. Why is it my good fortune? It is. A receipt issued by you for a portfolio my husband checked. Okay. I'll give back the portfolio, but I can't right away. I didn't ask for it back right away or ever. No. I'm glad you stole it. It gives us a common purpose. What common purpose? Profit, Archie. Your profit and my profit. His death can be worth $200,000 to his widow. Oh, is that what's to be our common purpose? Yes. That's how you keep the $20,000. Give me details. His insurance policy has a double indemnity clause. Provides against accidental death in any manner, shape or form.  No, his car skidded and crashed through a guard rail. He died of drowning at the bottom of a river. You expect to stage it like that? I expect you to stage it like that. You registered here under an assumed name? Ruben Small. Nobody knows Martin Bruce stayed here, died here. He met his death just as I described it. You want me to do a lot for $20,000? Oh, Martin's dead anyhow. You just changed the story of his death. You lose my way. Where's his car? Around the corner. I followed him here to the hotel in it. Lift him up, Archie. Yeah. All right. Jessica. Look at his face. So? The grin. That's the way his mouth rings. No, no. He wasn't grinning when I found him before. Archie, don't be hysterical. He didn't die with that grin.  The agony of a man whose heart blew out, I saw. The true thing is utter nonsense. A dead man died. But you'll believe it. He's changed expression since we met Miss Romeo and me. Since listening to her scheme. He's grinning now. As if... As if... As if he knows... The joke's gonna be on us. Now friends, this is your host with a personal suggestion. For you, if you're the right person. And you are if you like coconut. And particularly the right person if you're particular about the quality of coconut.


Hey, what's up guys, welcome to a new video. So in this one then, I've got a day one strategy to go through with you. I made it myself and the way I designed this then is to essentially take you from having nothing, i.e. on day one, all the way to having a 40 function in Shopify store with some winning products, running some profitable Facebook ad sets as well. I have exported this strategy into a PDF, so if you do wanna get your own copy and use for your own reference, you can do so. It won't cost you any money, just simply check out the first link in the video description down below. Before we jump into it then one final thing I just wanna quickly say is that I do read every single comment. So if there is something you want to ask me, then simply leave your comment down below. I will see it, I will read it and I will answer it. If you enjoyed the video, make sure you let me know. Just simply hit that like button. And finally, I do upload four videos every single week. So for regular and consistent content, please do make sure you subscribe to my YouTube channel. That being said, thanks again for tuning in. I hope you enjoy it and let's get straight into it. So the start budget then for this strategy is 500 pounds. This will allow us to get the required and necessary Shopify apps, pay for the required plan and obviously do all the testing we need to on Facebook and the scaling as well. Remember, you also need some funds left over to consider the order fulfillment. The faster we can fulfill our orders, then the better because the faster our customers will receive their products. So to start from the very beginning, then you need a Shopify plan, which is gonna cost you $29. Now for the sake of ease, I'm just gonna do everything in pounds. Being in the UK myself, it's just easier to do this. Shopify won't let you sell either until you sign up to a paid plan. So this is a expense that you can't avoid essentially. In terms of the apps I recommend, there's four kind of apps in which I strongly recommend that you need and that you get. If you want to add any others on top of this, then that's completely up to you. Number one is iBelow. It is 100% necessary to create the link and integration between AliExpress and Shopify. Number two is an upsell app. This is gonna cost you about 20 pounds per month depending on which one you use. So a lot of people always ask me then whether having an upsell app is necessary and there's only one answer to this question and that is yes. To illustrate how powerful this is then, I read a study, it was going a while back now so I can't truly remember the specific numbers, but it was, I think it was in America in the Southwest region. All the branches there adopted the method of asking their customers a simple question. All they would simply say to them is would you like fries with that and simply by offering that as an upsell? So that's what an upsell is. It's when somebody buys something, you simply ask them if they would like to increase the size of their order or buy something else as well. And by doing this then, the branches in that particular region were able to increase their sales by an extra, I think it was $120 million, simply by asking a question. It doesn't cost them anything to get their staff to ask that question and they were to make that considerable gain in sales. So make sure you have an upsell app basically. Point number three or app number three then is Lux Reviews. Just to quickly mention, I'm not affiliated with any of these apps by the way, so these truly are my genuine recommendations. Lux Reviews, in my opinion, is the best kind of review app because of this layout and the reviews you can integrate from AliExpress. Just head over to the Shopify app store, check it out, see what you think. And it's gonna cost you about 10 pounds per month. In my opinion, it's an absolute must have and we'll be getting into why later on in the video. The fourth and final one then is a free shipping bar because one of the biggest reasons why people abandon checkout is because they have to pay an additional fee for shipping. So we're gonna include free shipping with all of our products and we're gonna advertise the fact to all of our customers too because then that's one less worry or one less reason why they might leave our store without making a purchase. So that brings our total spend so far to 89 pounds. In terms of the theme then I want you guys to use, I want you to use the debut theme. It's 100% free, you can get it from Shopify themselves. It won't cost you any money. And to give you an example then of a debut theme store, here is the very first Shopify store I created. Now it's not currently live but I do keep it live for YouTube reasons so I can refer people to it just to kind of use as an illustration of essentially what a good store looks like. I won't get into it now because I've documented this in numerous previous videos but using this store, this exact product page I was able to generate over 100,000 pound in sales. So I know that this strategy or this method or this setup and layer actually works. So to kind of summarize what I want you to adopt then in your product pages is these bullet points here. So number one is a white background. Now one thing I will say is that simple often works best so keep it simple. Use a white background, high quality images, neutral, easy to read font. You want clearly bullet pointed features and benefits just so all the information is right there and then the customer can naturally progress through the information and consume it all pretty easily essentially. It's easy on the eye, easy to read, easy to consume. You want short to the point product descriptions that essentially present a problem to the customer and then solve the problem by buying that particular product. You want to stand out ad to cart burn if we go to this page here. You can see the only other blue thing on the page is this free shipping bar and both of these are kind of like a benefit. They've got free shipping and then naturally that eye is gonna kind of track towards the ad to cart burn which is essentially what we want. Trust me, it can make a big difference, split test in different colors of your ad to cart burn. You want trust badges and you want reviews. Now why do you want these final points? Here's a quick little study I want to share with you. When shopping online, which of the following features on an online store makes you trust it to most? This was a survey that this particular company did and the number one thing then was customer reviews. They are a must on your store, think about it. If you go into, if you go on a website that you've never heard of before, you've never seen before and they've got absolutely zero reviews on all of their products, you're gonna be pretty skeptical about handing over your credit card details or spending money with them. So the kind of number one thing I want you guys to consider is that when you're building your store you need to make it come across as trustworthy. Additional things then that every site should have now I need to mention these because some of the sites I'll review don't have these pages, they leave them off. Number one isn't about us page, you need that information on there. Number two is an FAQ page for obvious reasons. Number three is the legal policies. So your refund policy, delivery policy, terms and conditions, privacy policies. You need to contact information on there. You need an email and you need a phone and address if you can now I've covered these in previous videos on how you produce those for your customers without revealing your personal phone and personal address through our ways to do that. So make sure you check out my previous videos. But basically the more information you can give to your customer, the more trustworthy you're gonna come across. And then finally you need a track my order page and a blog I guess is optional. But what I find the benefits of a blogger is that if you can give value to your customers, i.e. so if you run in a dog shop and one of your blog posts could be certain training techniques for your dog, then it gives people a reason to keep coming back to your store to follow you on your different social media pages. And therefore they'll be consuming your content more and more and therefore they're more likely to become a customer and be a returning customer too. The final point name when it comes to your Shopify store is to get feedback on it. Now when I say get feedback, don't show your mother. You need to get honest feedback. That should say get honest feedback. In fact, I'm gonna put in there. So go into Facebook groups, ask the admin if you can post for feedback. You can join my Facebook group. I allow people to post their store links in there. And we've got a pretty great bunch of people in fact that give you genuine, honest feedback. So the reason being is because it doesn't matter. You could be selling bars of gold for half the weight of it or half the cost of what it should be. But if your store isn't trustworthy, then nobody's gonna buy them even though it's a great deal. You need a good and trustworthy looking store. Otherwise nobody's gonna buy your product regardless of what it is. That being said, they're moving on to the product. So we need to have in total 30 minimum on your store. This is to give an impression of a well-established, legit, and again, trustworthy business. Next point, they don't all have to be winning products. Just make sure you don't add a load of rubbish because if you have a ton of just crappy, plasticky rubbish products on your store, it will devalue your store. It will make customers think that your company, your business is cheap and not worth spending their money with. Have high quality products, but they don't all necessarily have to be winners. Those golden products. The strategy then I want you guys to adopt is I want you to choose three products to test. Number one is I want you to pick a product based on your gut feeling. The reason for this then is because picking products is a skill and by choosing products that you go with on your gut feeling, if they work or if they don't work, you're gonna soon learn by trial and error and develop that skill. Number two is I want you to choose a trending product because this gives you a good chance of success. Number three is tried and tested. So I eat a product that you know is selling successfully. How do you find these products then? Number one, in terms of your gut feeling products, the numbers correspond with each other. You can use all the different product research tools in the world. These are just a few of the popular ones. You've got Thieve.co, you've got Ecom Hunt, you've got CJ Dropshipping, AliExpress and of course, Facebook. Number two then to find trending products and Google Trends is the place to be. In my opinion, it doesn't matter what product you add to your store. You should always check it on Google Trends because the information it gives you for free as well is just invaluable. Number three then to find tried and tested stores. The best place, hands down, is the exchange marketplace. Again, I will be illustrating all three of these in a second. The exchange marketplace is essentially where people go to sell their Shopify stores. You can see how much they've turned over. You can see what their best selling products are. Again, I'll be showing you this in a second. So as an example then, so if this was me adopting this strategy. Number one then is this spaceship nightlight. The reason being is when I first saw this, I thought that's a pretty cool product and my gut feeling tells me that when other people see this product, they will think the same thing as well. Number two then in terms of Google, sorry, in terms of trending products, we've got Jim Leggins up here. So this is just an example. And this is just an example then of a good product. If I show you this in real time. So this is Google Trends. Essentially put your search term up there. So that would be your product. You can choose your country. You can choose the timeline. And then you can see the actual interest over time. And what you're looking for then is a product that's as close as possible to 100. If you see if I scroll across, you get different ratings, that's 53. And essentially what that's telling you then is how popular that current search term is. So you can see that Jim Leggins at the point at right now is the most popular it has ever been in the past 16 years. The other important information that Google Trends gives you is the interest by region too. So essentially you can see what countries are currently searching for this search term. So essentially you know which countries to target when it comes to Facebook ads. If we go back to the strategy then, the third and final product is one that we know is selling very well right now. So again, to illustrate this, this is the store that I found on the exchange marketplace. It's called Amp Mobile. And if we go down to the sales history, we can see these guys have done nearly $2 million in revenue. Now what we want to do then is if we head over to the actual website, we can use the Shopify Inspect Chrome extension. We can go straight to their best-selling products, which is this Amp station. If we click on it or take it to their product page, now we know that this store has done nearly $2 million in revenue and this is one of their best-selling products. We know that this is a winning product essentially. And that is gonna be the third product that I want you guys to kind of base this strategy on and actually use and implement. So that being said, we have our Shopify store, we have our products. Now for the most important part then of pretty much any business, which is the marketing. Now what I want you guys to do then is watch this strategy all the way through and then go back and re-watch it because there's a lot to cover. It might get confusing at points. So if it does, make sure you leave a question down below. Like I said, I will answer it. But trust me, I've used this strategy time and time again and it never fails to work. So where you start then essentially from the very beginning is we're gonna have one CBO campaign, one ad set per product and one creative per product. So essentially we've got a CBO campaign and then within that campaign we're gonna have three ad sets, one ad set per product and we're also gonna have one creative per product. The conversion objective will be for you content because if we go after purchase, our reach is gonna be lower. Therefore we're not gonna get as much data back. Therefore we're not gonna be able to make as good a judgment of which essentially which product is performing best. When it comes to finding products that are working, i.e. so when you're testing them, then the more data you can get back then the better because then the more accurate decision you can actually make. We're gonna target one country because it's the beginning. We wanna kind of keep things relatively narrow. We don't wanna bite off more than we can chew just yet. We wanna go for all ages and genders that way essentially we can see where the data is coming from as well. The detail tags and options are when you guys to use an online shopping narrowed by engaged shoppers. So to show you how you would set this up in real terms, here is an example ad set that we are creating. So in here we're gonna put online shopping and that's gonna target everybody who has shown an interest in online shopping. If I can spell it correctly, let's just go back online shopping and then the next thing we want to do is narrow audience and we want to go for engaged shoppers. And essentially what that means is it's gonna be anybody who has clicked the shop now button, engaged shoppers. It's gonna be anybody who's clicked the shop now button, which is obviously a good sign. It's people who are interested in buying a particular product. Now you can see the potential reach is quite broad but this isn't a problem at the moment because we are just testing. Then essentially we wanna try and get as much cheap data back as possible. And by going broad, this is our best chance of doing so. In terms of the placements then, so again just to show you how to set this up, we're gonna go for Instagram and Facebook newsfeed only. So if we just scroll down, we want to edit the placements and then just remove absolutely everything. So as you can see now then all I've got left selected is the Facebook newsfeed and the Instagram newsfeed. The reason being then is when we're testing we wanna make sure that we get the truest data back as possible. And by selecting newsfeed then we can pretty much guarantee this because the newsfeed section is gonna be the biggest section on anybody's desktop on anybody's mobile phone. That way we can pretty much guarantee we've got a true impression and somebody has actually genuinely seen and registered our ad. The runtime then for this initial CBO campaign is gonna be three days and the budget is gonna be 30 pounds per day. So essentially that brings our total spend up to now at 179 pounds. Now the reason this is our starting point then is because we're testing three different products in one CBO campaign. And by putting it in the CBO campaign it allows Facebook to tell us essentially which product is performing the best and that's the products that we're going to roll with. So the next steps then are essentially what we're gonna do now is creating two new creatives for the best performing product. So from this initial CBO campaign after three days switch it off, look at the data and see which one performed best. Performance is based on the cheapest data accumulated and the most budget spent. So because it is a CBO campaign what Facebook will tend to do is put the majority of your budget into the best performing one. And whichever one that is then I want you to then go ahead and create two new creatives around that one specific product. Once you've done that then what I want you to do is to create a brand new CBO campaign. And in this time we're gonna have three ad sets within this campaign and each ad set is gonna have its unique creative but essentially each creative is gonna be for the same product. And the tags in the placements then are gonna be exactly the same as the previous. So as it says there, the same as the above. Run time again is gonna be three days at 30 pounds per day which brings our total spend now up to 269 pounds. Now the reason being for this then is because essentially to begin with we've tested three different products to find out which the best one is. Now what we wanna find out is the best creative for that product because essentially the more money we can funnel down on what works so doubling down on what actually works the better chance we have of being the most profitable and therefore the most successful. So after you've ran this for the three days and you've tested the different creative our next steps are to now test the audiences. To do this, we're gonna start a brand new CBO campaign. We're gonna have three ad sets within that campaign but we're gonna take the creative that performed the best from this CBO campaign and we're gonna use the same creative for each ad set then. The target and placements are gonna be exactly the same as above except we're going to change the detailed targeting for each ad set. We're gonna have three different audiences one at an audience size of 500,000 people one at an audience size of a million and one at an audience size of 1.5 million. So essentially what we're doing here is we've got the best performing product we've got the best performing creative now we need to find the best performing audience to essentially move into scaling. So create the CBO campaign let it run for another three days at 30 pound per day and that will bring our total spend up to 359 pounds. By now as well, you should be seeing some sales. So while 359 pounds may sound like a lot at this point you should have seen some sales by now so you should be starting to recoup some of that cost. Our next steps then after these three days are now to focus on the best performing audience i.e. the ad set that performed the best from the CBO campaign and start to absolutely go crazy with the scaling. Now, the reason of why this works and I like to explain absolutely everything I do. Number one is we are testing absolutely everything. The more you test, the more or the better chance you're gonna have for finding essentially what works. So we're testing different products we're testing different creatives and we're testing different audiences and they are the three kind of key features to any successful Facebook campaign. So we essentially as it says there finding the best of everything to then focus on its scale. Now I was gonna include the CBO scaling strategy for this video but I've just realized I've been talking for like 20 minutes now so I'm gonna include it in a different video. Let's say if we can get this video to 100 likes and I'll release part two which will be the CBO scaling strategy that follows on from this. That being said then guys that pretty much just covers everything so one final thing I wanna say is thank you very much for watching. If there's anything you're not clear on by the way as I've mentioned a couple of times already just make sure you comment your questions below. I will answer them for you and then a couple of final things just before you leave. Number one is check out my free e-books there's five different ones there's a link for each one in the video description below. If you want more content on Shopify and Facebook ads make sure you follow me. Head over to Instagram, follow me at Jack Kitchen at 458 and then finally if you want a proven step-by-step program for Shopify that includes my full support make sure you check out my e-commerce academy too again there will be a link in the video description below. That being said then guys thanks very much for watching the video I hope you enjoyed it and I'll see you in the next one.


Hello everybody and welcome back to my V-Log, my channel. Now this circuit is a pre-amplifier circuit. I bought it from AliExpress. I'll show you that in a minute, we'll go over it quickly. And I just want to say it was really easy to build. Everything's laid out nicely, all the components feel nice. There is one little thing and it says that it comes with Alps. Potentiometers. And this one's an Alp Potentiometer. And it's more expensive than these ones. But these ones are Song. Now it came with three songs and I thought well I'm going to put in an Alps and just see if there's much difference on there. We'll be able to have a look. There is a slight thing there. But apart from that, all the components are as they are. They've got Nichicon capacitors, it's ELA capacitors. All the parts seem to be pretty good. I'm not sure now if I should be swapping out these carbon type resistors with metallized resistors. Because the carbons are generally 10%. And the metallized ones are 1%. But just for now we're going to leave it like this. I mean I'm not going to change this one at all. But it was pretty easy to put together. And everything's on there as you'd want. Now I've put a wire across here. And it's come down to this ground point here. Because it tells you to do that in the right up to it. If you're not going to put it in the case. And just for now it's not going in the case so that's fine. There are only two mounting points. There's no mounting points on the corners as you can see. There's only two mounting points and that's one's here. That's in the ground plane for the ground. And that is connected to ground. I did a test between there and these. And then there's another mounting point here. This doesn't actually connect to anything at the top or underneath. It's isolated. So there are its mounting points I presume. This one you put in to connect it to your metal frame. And that would be grounded. And you'd have ground because I do believe I should check it. But I do believe that this ground is going to be the same as this ground. Anyways, so what I've done is I've connected it up to this. So we've got our waveform generator here. The output here. And all I've done is I've just tied two of these together. So we've got two outputs from the same waveform generator output channel. So we know that they're going to be exactly the same. And I've got my two probes on the outputs. At the minute I've got a 33K on here. Now the reason why I've gone for 33K is because the input impedance on the amplifier I've built. They are 22K. And let's say their new NAD 3020. Because this is what this is supposed to be a replica of is the NAD 3020 pre-amplifier from back in the 70s. But the new NAD, the D3020, that's got a 56K input. So I just thought well I'll just do something in the middle. I could mess around with 1K, 10K, 22K and go through like that. But who's got the time? And maybe in the future I'll do it here. But I'm not going to do it all on camera. I don't know if there's any differences of this. Notable or anything like that. You can see that you've got two channels here. Two identical channels. And if you notice that you've got your filter caps coming in. And you've got these two voltage regulators. And then you've got one, basically one channel. Two caps here, one cap, two caps. These transistors which are actually doing the push-pull. The side of this. And then you've got exactly the same one going through here. Which is pretty good. And all the rest of this sort of stuff is for the tone control. But yeah, so it's a nice, neat little board. It's very well laid out. For what I can tell. And it's just a neat board. I'm messing around with the lighting because I don't... It doesn't matter, I've got my own shadowing I think. Not sure, never mind, doesn't really matter. Here is the actual advert. I'm AliExpress. This is the one that I bought. There are quite a few different ones on there. And the prices do vary. But I like to think I look around for a bargain. And here it is. It's all nice. Now this is the bit where it says here, with Alps Potentiometer. And it doesn't, it has these song runs. What the differences are from what I can tell is price. And maybe a bit of quality. Now here's the image where these shows on here. The cable going across between these potentiometers. And here's cable comes around and goes down into that. There is actually a hole there on purpose. So I presume that's just where you ground it to. And that's what I've done. I've just copied that. Just to make life easy for myself. As you can see it does come as a kit. But it's a lovely board. The board feels nice. Everything feels nice on it. It's a lovely little board. So we've got some bits in here that you're going to consider. And that is one of the things is the voltage here. AC, 24V, 0V, 24V. Now I don't have that, but it does say here be careful brother you must watch what the power supply voltage shall not be lower than AC dual 22V. All right. And that's what I'm using. I'm using a 22V. I don't have a 24, 0, 24V. If you are only listening to the bare board you must connect all the potentiometer enclosures with wires. That's what I just showed you. And then connect them to ground at the power terminal on the board. Now it's not gone through to the power terminal it's gone through to that grounding point like I said. Which happens just to be here. There's a hole there. And that's ground straight off this cap. As you can see it's got the stripe there. That's the ground side. So that's what I've done mine to. And in the image here as well he's done the same thing to that. I hope you can see that. But if you look it up you can see a bit better for yourselves. And the audio signal wires must be shielded by a if it's installed into a chassis please refer to one point grounding. All right. So basically I've not used shielded on the input. I'm just using this. And these are not shielded. No. They're the cheapest ones I could possibly find. They're not shielded. So if there is little bits in there we've got to expect maybe a little bit of but I can't see anything. And we're going to look at that in a minute. I can't see anything. I just got some close ups of the board and a bit of some pieces. Okay. So guys. So what we got here then is we've got it connected up. Now what I've done is I've decided to go and use 22K resistors for my dummy load for this preamplifier. Why have I chosen 22K? Well because this is one of the amplifiers that I've built and we can see as we look across here that down there going from the input to ground the first resistors 22K. So that's going to be our input impedance.  So that's why I've chosen to use 22K because if I was going to connect this up, marry this up to an amplifier it was going to be one of these ones. Because they're the ones I think are the greatest ones if you want to build them. I mean if you see it's about wanting to build a little amplifier that's easy to build. This is the one to go for because it sounds really, really nice. Now even though it's asked for 24-0-24 volts going in I can only provide it with 22-0-22. So I've got to work with what we've got. I'm going to be using the old Digilent Discovery, Analog Discovery 2, to take the measurements of this. Alright, let's do it. Okay guys, so we're going to just put some power in on this. We've got some power. We'll run our waveform gen. Let's go running already. Let's just put this around about let's say 2 mini-volts. We're going to start just turning up the volume. So our input volume all the way up on the potentiometer on this. And I'm going to start putting some actual input into it. So as you can see we're going up and up and up. Yep, we're going off here. All I want to do is just have a little look and just see what sort of input we can put in. Now the highest I can go on to this is set at 1 times, it's 5 volts. Which I think should be enough for a pre-amplifier. We can see we're clipping at the top. Let me just, a bit easier to see. Now you can see there, look, clipping at the top. Which is good, that's the good clipping. We like that sort of clipping. I'll give it a bit of extra, you know. All the thumb seems to be bottom clipping, not very good top clipping, better than bottom clipping. Yes, you can clip top first, that's better apparently. So we got that first backer off. There's no clipping and we can see on the FFT, look how bad that gets. See on the FFT, we know all that drops down. Okay, we're good. We've got about 13 volts there, RMS. Peak, 37 volts and 37 volts, that's pretty good going. So let's just tighten this up a little bit with this. We can see we're 0.8, 0.7, minus 0.8, 0.7, not 1 on there. We're into minus 70, minus 78, minus 71, minus 79. Minus 82, 83. So this is all very low down there. The noise floor down here is really, really low. I'm talking like 110 plus, which is pretty good. That is good, isn't it? That is pretty good. All right, so let's just back this down a little bit. Let's say we keep it round about there and swap this back to, let's say, about there. We'll do a sweep. Just have a little look, what it looks like on a sweep. So here we have it, sweep there. We've got one volt going in here. We could probably make that just look a bit bigger by dropping this down to one volt. It's probably a bit far extra from five. There we go. We've got two volts on here as well. And so we can see what we're looking for is, you know, does it do anything here? Does it fluctuate on its amplitude? I mean, it certainly doesn't. It does not. Not even in the tens of millivolts, it doesn't. Richard and I know it's not apparent, but it's nice to look at. It's nice to look at. So, well, that's that. That's all you can do really. I mean, I can connect it up to something to have a little listen, and I'll do that. But I'll do it in another video. I don't know, it's like, but these videos get too long else. It's just no good to be in too long. Let's put this back here to that same there. Let me have a look at that like that. So, looking all the way through this lane, it looks pretty good. It's pretty good. Yep, that's it. I'm going to wrap it up. If you got this far and it was interesting in any sort of way, that's brilliant. And thanks for watching and I'll catch you in the next one, guys. Bye-bye for now.


Welcome to Psychic Medium, Tony Green. I am Tony Green, the Psychic Medium. And yes, I, you know what? I have this habit. I always, always no matter what time of the day it is, I just say good morning. I do. I can run into somebody at like 10 o'clock at night and I'll be like, good morning. And everybody always cracks me. They're like, it's nighttime. And I'm like, sure. Yeah, okay. Sure. So wherever you are, happy day to you. Wherever you are, whatever time it is, happy day. I wanna start the show by saying thank you so much for joining me and being here with us. Hopefully this is gonna be quite an amazing show. I want to thank everybody who's already on the chat live on YouTube. If you wanna join us live, you can. It's just every Monday and Wednesday at noon central. You can join on YouTube or you can call in. You can still call in today. The number is<PHONE_NUMBER>. And I will answer questions from callers and also from people in the YouTube chat. Okay, a couple little pieces of information really quick. Hey, Stevie, how are you? Yeah, my brain. Okay, yes, here it is. Okay. Listen, I will never reach out to you for a reading or anything else. I don't reach out to people to tell them they need a reading in the comments or anything else. And the scammers are stepping up their game. So the scammers are now taking from me and other people. They're just replicating our pages and then taking our content and putting it up. What do you do? What do you do with these people? Like if they put, this is my thing. If conmen and scammers put that much energy into their own thing, think of how famous and how big they would be, right? But it is what it is. So just please know, I will never ever reach out to you. I will never ask you or tell you that you need a reading. I won't do any of that stuff. So just know that if you wanna reading, you reach out to me and I only have the one website, T-O-N-I-G dot I-N-F-O, okay? The number you call in for the show is not my business number, that's just the show line. My business number is<PHONE_NUMBER>. That's the only way to get a reading, hypnosis or healings from me. Alrighty, I wanna say hello to everybody online there. I'm just so grateful for everybody here. We have Heather, we have Sal, Mimi, hey Mimi, we have Vaughn, Patrick, hey Patrick. Genevieve, Caroline, Ryan, hey Ryan, how are you and Moe? Thank you so much everybody for being here. I'm so grateful for you being here. If you have something you would like cleared, please post it in the chat. If you want to call in with a question, please feel free to call in with a question. And here we go. I'm gonna get started right away with the call log. 415, what's your name and where are you calling from? Hi, Tony, this is Kate. Hey Kate, how are you today? I'm in Colorado. Oh, excellent. Good, it's freezing. I don't know about there, it's like 20 degrees, but. Yeah, it's. It's warmed up. Yeah, pretty cold in the Midwest, but if you go from like a warmer climate to a cooler climate, it's definitely very, very different. Very, it's a lot colder. Is that the way to say that? Cause you're not used to the cooler temperatures. So yeah, yeah. So Kate, how can I help you today? Well, I keep getting more visits on my bed. So I've been house-sitting and it's like something has opened up and all of the pets are on the spirit side. They come wherever I am now I get. I feel like cats or dogs jumping on my bed about fall sleep. Okay, so Kate, a couple of things could be happening. The first thing I get is just communicate. I know it's probably a little bit late and you're tired. Ask them what they need. That's the first thing I get. Is there anything they need? They may just need something before they transition. They may be coming through from the other side. They may have transitioned and be coming through just to communicate messages to you. I will tell you every single person and I cannot stress this enough. Every single person I've communicated with the dreams are off the hook right now. Some things going on where our dream states and I've had like I was asleep. And for those of you who know, I used to have two little hairless Chinese cresteds. And I was asleep and one of them literally jumped up and I was in that state where you know when you're sleeping and you think you woke up and you pulled the cover off. I think it's called sleep paralysis.  So I was having a sleep paralysis thing. Okay, so here's the whole dream. So let's go, it's so weird. So I saw a guy, like a guy go to walk into the room and then he looked at me, this is all a dream folks. He looked at me and then he backed up but I could still see he was still there. And so I was trying to wake up from my sleep. Now we've all had this, this is no big deal. Like we've all had these things but I was in sleep paralysis and could not wake up.  Like the little bumps that he would get on his skin I could even still feel that. And I know that now they are on the other side and they're my guardians. I know that for a fact, that's how they come to me and protect me. And in my dream, I knew this thing, this person that was walking through my home was a spiritual being that was not whatever and it sent this green puff of smoke at me. I know this is like the craziest dream. I can't believe I'm telling this. Here I'm wasting like 10 minutes of your life. You can never get back telling you my crazy dream. However, now I feel like I need to finish it. I need to own it to the end. This green puff of smoke at me.  Okay, so the point is if you're having these dreams with spiritual things and sleep paralysis just call in the white energy. If you can remember to do that in your dream state. You, however, dear, start communicating with the animals that are coming in because the message I'm getting is that they need to communicate. There's some sort of closure that they need. And even if you are never able to get the message to their loved ones, you're going to want to just at least hear their message and listen, hear what they have to say and you don't necessarily have to wake up to do that. You can just do that while you're in your sleep state still. And I do know, I'm going to say it again, so many people have been having such vivid dreams, good and not so good.  If you're having really bad vivid dreams, take a red onion. I know, just, I know, don't knock it until you've tried it. Now, cube the red onion into four, right? And then put a quarter of the onion in your room. Now, one thing red onions do is they absorb bacteria, illness, things like that. So it's great in the winter for colds and such. If there's anything, any, what do they call that? Like stuff floating around your room, it'll absorb into the onion. But when I have a red onion cut up in my room and put it throughout the house, the house feels better and I don't have nightmares. I'm going to tell you that. So if you are having bad dreams or nightmares, just try it and then come back and tell me how it works for you because it worked amazing for me. And Moe is saying, yeah, that I love eating the onions too, but I will tell you this because they do absorb bacteria and illness. If it's been sitting out even in your fridge cut up, do not eat it. Once it's cut, use it all or let it sit out to absorb more, but if it's been sitting out like on a salad bar or something, do not eat it. Do not eat it because it's absorbed all the pollutants from everything around it. So yeah, that's what I would say about that. So try that, but communicate. Okay, Kate, 20 minutes later, communicate with the animals coming through. You will not regret it. You will not. I feel like you're going to get some really incredible communication from them. And I feel like it might lead you to something even more if you do so choose, okay, beautiful? I think so. Excellent, thank you. Thank you, can you do a clearing? Like I hear the messages, I will hear and remember messages or I think I need a clearing of. Okay, I can, I can, I can. Okay, for you, everybody listening, re-listening, watching, re-watching, we hear the messages that are meant for us. I get a no, so let's clear that. Oh my gosh, you guys, that hits me again in that solar plex area, like right here. And that's all fear. That's all fear. So let go of the fear. We're afraid to hear messages. Let's clear that.  So it was an exorcism or like electro brain shock therapy or burning you at the stake. I mean, pick your choice, which one, right?  And let's not forget the whole how do you know who you're listening to? How do you know if it's a good message or a bad message? Well, you know what? I'm just gonna say the devil isn't trying to spread love. So if it's a message of love, you know it's good. But yeah, there's a lot of fear with hearing messages. So let's clear all the fear with hearing and knowing it's a good message. And then let's clear any interference between us and our angels be immediately cleared and healed. Now, if you don't personally work with angels and you work with other deities, let's say you're Indian from India or Native American Indian or any other, whatever you work with, whatever your deity is, I'm A-OK with that. Just replace that word with whatever your deity is. Like if it's Ganesh or if it's like the God of Thunder or is that Thor? Is Thor the God of Thunder? I don't know, I don't know. I'm sorry, folks. Could I be serious for like 30 seconds? No, no, I can't. Okay, I mean, okay, I hope this was really helpful for you and I think. Yeah, I love to go all the way, thank you. My ears were hot, my ears are my throat are hot. So that was great. Oh my gosh. And so folks, thank you, Kate. And like, so when you, okay, so here's, oh my gosh, I love that. When I do clearing, sometimes we have, sometimes we feel it, sometimes we don't and sometimes it is that. And when it's the heat or the really icky feeling, that's something really toxic going and that for your ears and your throat to be hot, then you know something's leaving. Get ready, Kate. I hear that song, ready or not, here it comes. I'm gonna find you. I'm gonna find you. Yes, yes, so that means, and then I hear that song is going down for real. There, there, there, there, there, there, there. So get ready because something is opening up. Don't be afraid as I say this, like don't reinstall that fear. Something's opening up that's going to allow you to really communicate with animals from the other side and this side. And I feel like maybe that's your next stop. I mean, maybe this is where you're going. I would really, really love to hear more about this on Wednesday call in because I wanna know how much this opens up. And everybody else, if you feel this clearing, let me know. If you're in the chat and you're feeling this clearing, let me know. Heather says her dreams have been crazy too, right? Man, can we sleep for more than 20 minutes?  Okay, Genevieve felt this clearing in her forehead. I love this, you guys. Thank you for letting me know that because that's why I do this. Like it's, you know, I just want us all to get there. I don't care. I just want us all to be there and to be in that space where we are there, whatever there is for you, right? It's so, yeah, I love that. Anyway, okay, Kate, thank you for sharing that. Thank you, Genevieve. Thank you, Heather for, and Heather also felt it in her chest and ear pressure. And that is clearing that out so we can hear. Now wait and watch what happens if we clear it out so we can see. But a lot of you aren't ready for that yet. Okay, Kate, I'm gonna go to the next caller now, but thank you so much for calling in and sharing this with us. I can't wait to hear the details on the updates, okay? Okay, great, I love it. Me too, thank you so much. And I do want to say for all of you that are feeling this on the chat or, you know, on the podcast or on any venue that you're watching or listening on, communication might open up a little bit more for you if that's what you want, okay? A lot of people do want to hear those messages from their grandparents or their parents or their loved ones that have passed on or their pets that have passed on. And when pets pass on or even when they're here, it's a telepathic message and they're speaking English. They speak your language that you speak. They don't bark at you to communicate. Okay, I'm gonna go to 727. What's your name? Where are you calling from? Yeah, my name's Lisa, I'm calling from Florida. Hey, Lisa, how are you today? I'm good, how are you? Good, how can I help you, Lisa? I was working for this app and they let me go about four days ago. Do you feel like they'll never ever reach out to me again? I'm sorry, first, I did get an answer to that but you were working for an, did you say app, APP or ASS, an app? Yeah, an application. Okay, apparently I can hear spirit just fine. People, that's where my problem comes in. Okay, no, I don't, as far as them reaching out to you, I don't feel like they are going to, however, here's the good side of that. I do feel like you are going to have something of your own that you can create. I think you need to start working on it right away. I do feel like there is another position coming in for you. It will be with a completely different company. I do feel like whoever's coming in for you, it's a much better fit for you. It's a much more solid fit for you. I do feel like it's a bigger, okay, I don't know what this means in your world and hopefully you do. It's a crossover, it's a crossover. Now, I don't know, okay, so thank you. I don't know if that's the app you're going to be working on personally or if it is the company you're going to work for is a crossover, but I'm going to tell you it's a crossover and I'm going to tell you it's, you are going to have to reach out to them, but I feel like you are going to find them very quickly, but I also, I'm going to say this again, Lisa, and I cannot stress it enough. I feel like you need to get on your app right away, the app you're going to create and why am I seeing like, Lisa, I'm just seeing that I don't know, I don't know a lot about this part of the world, but this app type stuff part of the world based on the way I'm communicating it, it would be hard to tell, I know, I know, right? I had it so well, here's what I'm going to say. What I'm seeing is like a game type. I don't know if you're going to create a game and an app or the app is a game, but either way, that's where you're going, that's where you're going and it's cute, I don't want to say it's a game, but it's like, I can't tell you, they're just showing me what I would know for a game, like they're showing me one teeny weeny bit that would say, okay, this is like a game. So I think you need to get on that right away. I think that's your Fortune 500 thing. And anybody who has listened to me for more than a minute knows, I believe our success, our money, our ability should never be kept by a company. Sometimes yes, we do have to work for a company to get that steady insurance check, yada, yada, yada. But I do believe we should have our own thing going on where it is uncapped. I always believe that and Lisa, this is your thing. This is your, this is your Jimmy to your jam to your whatever. And again, I'm hearing that song, get down on it. If you really want it, get down on it. I don't even know if those are the real words. Those are the words they're giving me for you so. Excuse me, you need to get on it. You need to just do this. And yes, I mean, you might need to, I don't know how long it takes to create an app or get like some kind of funding for apps, but you might need to work at a company. Yeah, you might need to work at a company while you're creating your app. And one of the elements of this app that you're gonna create or this game at night, I can say this because they're giving it to me. So I'm gonna say it, but I'm always careful when it's somebody's creative business stuff that they're about to create. One of the things that I'm getting, and I don't know why I'm getting this, is the little person or thing that you have avatar or person or whatever it is can constantly change their look. Like when they go up a level, they get a whole new, I don't even know if people would want that, but that's like something. Maybe it's the armor or the outfit that they get. I would call it an outfit instead of straight up armor. Maybe they go from coach to Versace. I don't know. I don't know. I'm sorry. I'm so joking. I don't know anything about that world because I get, yeah, I don't know, but you're supposed to start right away. Please don't hesitate. Like start playing with it today. I'm hearing that this is perfect timing astrologically. It doesn't feel like perfect timing. I didn't do anything wrong and they just removed me. No one even spoke to me with a computer algorithm and I was emailed, like just, we've removed you. No explanation, nothing. And I didn't do anything wrong. It was the craziest thing. Okay, so here's what I'm gonna say to you and I know this is, please do not shoot the messenger because the messenger does not like to be shot. Sometimes, and if you don't believe in God, that's okay, just replace your word, whatever you believe in with the word God. I use the word God, so there it is, oh my gosh. Sometimes God removes you from situations and people because God knows things, heard things that you didn't or saw things that you didn't. And also because it's time for you to do your thing or get into a better group. We're never removed from something, we're never removed from a place where we are supposed to be. We're never removed from a situation we're not. I signed up, I did sign up for another app yesterday and I got a job out of them. So hopefully maybe the new app will be busy for me. And again, everything is a blessing. Everything is a blessing. So yeah, and so please know that. Please, okay, so Lisa, just give me a second. Whoever is posting this, just stop, just stop that.  And for those of you who know, know. Okay, so now that that's done. Okay, here's what I'm gonna say, Lisa. Just be grateful that you were removed when you were removed and allow yourself to move into a much, much better space, okay? Thank you so much and know it's gonna get better and work on your own private app because that's where the real goodness is gonna come from, okay? Okay, really quick, on YouTube, somebody was just posting some salation and again so I'm taking care of that and I'm sorry it was a little bit distracting for a moment there. So I'm gonna go to the next caller who is 504. I want to say hi to Kathy and I thought I saw somebody else come in but Kathy, hey, thanks for joining us here this morning. Thank you again for being here with me. I'll be back Wednesday at noon for a minimum of 30 minutes to answer your questions and connect you with your loved ones on to the side. Okay, thank you so much for joining us today. Thank you so much for joining us.


Good morning everybody. Thanks for joining us nice late start today We're going to be talking about controlling access to open stack in the enterprise byline. This is not public cloud So let's get cracking Thank you finished Okay, so who my my name is Sean O'Mara. I'm a senior systems architect of Marantos I'm also the architecture consulting practice lead for EMEA Asia pack and Russia So all the Marantos architects work in my team within this region I've been an IT industry for over 20 years Primarily focused on enterprise and various types of enterprise solutions I've been my first open-stack public cloud was built on Essex So I've been in the open-stack community for a while. I've dealt with the pain A lot of those clouds been built in enterprise. So this is some of my learning some of the learning from Marantos We're going to be discussing this today And I'm going to be asking for a lot of feedback from you guys at the end of the session And going on into the future around these particular topics So We'll discuss typical requirements seen in the enterprise. We'll talk about how open-stack does access control today Where's the falling short? What is being done? And what can we do as a community and as operators? I'm assuming most people in the room here operators or some are involved in the open-stack And then we'll talk about some of our back solutions that are available So just setting the scene I'm talking about enterprise. I'm not talking about public cloud I'm talking about dealing with things like private clouds Hosted clouds the typical snowflake clouds that we're all building I'm not talking about any particular distro either of open-stack Public clouds are different they have different immediate needs the way that they're legislated is different the rules around public clouds are very different We're talking about integration in open-stack with that stuff from Big Vendor X Every data center has somebody else's weird and wonderful author system in place We're colliding with the old world. We're colliding with a whole bunch of things that relate to governance Typical role hierarchies and I'll talk more about that in a second The one point I'd like to make is a lot of the asks that we see from enterprises don't always make sense But they need to be met anyway. It's not a case of that doesn't make sense. We won't deal with it Even if it doesn't make sense sometimes we've got to deal with it, especially when it comes to authentication and auditors Okay So what are the enterprise requirements that we're dealing with these days? Enterprises want different backings. There are typically three or four different type of authentication backings that we're seeing It's caused by different org structures. It's called by different trust levels and go to any enterprise today And you're gonna find everything from Microsoft Active Directory to Nevelle I mean you the whole gamut something from IBM etc We need to integrate to existing systems a lot of these fourth systems are in place There rules are in place around them the companies have spent many years and many man hours setting these things up We need to comply So those of you work in big organizations with big IT departments, you'll understand this and then along come the auditors Single sign-on single sign-on is a critical component within a lot of organizations. We're trying to cut down sprawl We're trying to cut down on the number of user names password combinations and access in points that users need to understand and deal with Both at an infrastructure level and an application level audit requirements Show of hands who's been through an IT general controls governance audit? I can't believe it's so few people in this room An IT general controls governance audit is Something that anybody has worked in the financial services industry Anyone who's worked in the legislated industry will understand and we'll talk a bit of more about separation of duties in a second and then governance Governance is something that we often ignore as techies because we think we know better I've been there. I've fallen into that trap Governance comes in many forms. It can be corporate governance and rules that we have to apply or it can be legislation I live in Germany now the German IT governance rules from the government are intense I see some smiling faces, but they're intense and I don't speak German. So I don't even read them Okay, so off back ends one of the big things about off back ends and in the enterprises We tend to have a lot of multi-tiered off back ends We have different trust zones that we have to deal with A typical example is you'll have an internal active directory You'll have a LDAP solution for customers and then you'll have third-party sign-in from vendors All of those have different trust levels and different ways of getting gaining access to them within the enterprise They have different rules different roles. So we've got to handle things like role mapping those are Enterprise requirements and these are the things that we as OpenStack and the OpenStack community need to start learning to deal with I mean, I've got some examples up there. We're talking about LDAP solutions. We've got open LDAP We've got vendor LDAP and IBM various others active directory uses Kerberos as an author mechanism Which doesn't give us any of that extra information. So we've got to get role information elsewhere and Then one of the ones that's starting to take a lot of light these days is federated solutions Shibboleth IDP Samal assertions things like that that we have to start dealing with in the community and we need to be able to deal with those things well Now a lot of the focus of what I'm talking about today will be on role-based access controls We'll discuss that in a bit more depth and how OpenStack is handling that but what's important to understand about the authentication mechanisms being used is Depending on where the data is coming from we may have different levels of data available to us to achieve those goals a Lot of our orth back ends are also historical You know, they've been around since near dot they've got user directories of hundreds of users who nobody really knows what they're for And a lot of them are very slow We're talking about OpenStack and how fast the APIs need to run. We've got to take that into account So we're talking caching and cash handling of tokens and things like that user separation I've talked about and we'll talk more about that shortly, but it's about trusted users and role management So other enterprise requirements Granular access control in the enterprise is critical. We're seeing a lot of customers talking to us about separating admins admin roles and reducing admin access A lot of customers are saying great We want administrators to be able to create a tenant in OpenStack, but never get into that tenant We want admins who can work at the API layer, but no access to the operating systems You know, a lot of those separations of duties are required within the within the enterprise it is fairly nonsensical to us who are used to as you know Having roots on a Linux box may able to do whatever we please We can't do that anymore It comes back to the audit requirements around general controls and the separation of duties So Anyone who's done any work in the finance industry As I said earlier general controls auditing separation of duties That extends not just into the administration of OpenStack, but the consumption of OpenStack And I'm focusing OpenStack, but obviously this goes into a consumption of workload and workload Clinication And the last one which I've got there is obviously corporate standards This extends right from financial controls down to our technical controls Delegation of management is something which we want It doesn't exist today in any meaningful form We need a mechanism that I can delegate Portions of control to my environment to alternative users But with very specific rights to create users, but maybe not do anything Which means I'm starting to create very complex access hierarchies The other thing that's required is workflow All authentication all access control to the OpenStack community and OpenStack resources We need some sort of authorization to that and I'm not talking about authorization here in the AAA since I'm talking about approval If I want to increase my quota Someone needs to approve that increase. How are we handling that and how do I access the control access to that? I'm not pretending advances to all of this, but I'm saying these are the requirements Okay, just quick refresher AAA. What is AAA? authentication authorization and accounting We need to handle each of these things within our environments. So it's the who are you? What can you do and what did you do? I hope you like my little split log V We're gonna focus the rest of the discussion this morning mostly around authorization and what OpenStack is handling authorization today And how we can move forward with that Okay, so our back roll-based access control At some point in our lives we've all dealt with it Those of you who have been around as long as I have us probably dealt with you know various group level systems in active directory or LDAP or OU's those are all role Assignments, so how's it done today? within OpenStack today every single project API does its own Policy checking the policy checking is done through the Oslo policy enforcer class and I'll talk about that a little bit further That policy checking is based on a flat file that is stored on the API service on Each instance of the API, so if you've got 10 over API is running you have 10 policy adjacent files Currently there is no single store for that. It's all current Currently available only as policy files the policy file is Essentially like a set of firewall rules that the user is compared to a rule and it allows you to do certain things The default policy set today has only got three users in it four users All who are basically some form of admin. It's very difficult to change this It's not impossible, but it's complex and it can get very messy and you have to have distribution systems to get that policy everywhere Keystone currently handles user crad roll and project assignment Roll creation all sits within Keystone and the back ends are typically LDAP for Authentication or SQL or now Federation through some sort of SAML 2 assertion Assignment backends currently with an open stack are comes out of the SQL database whatever SQL database you're using in the back end That's where your assignments are for Keystone The challenge with that is it's very easy to create extra roles within Keystone it's a lot harder to assign specific rights to those roles and To get the hierarchy correct those roles actually are signed correctly so the enforcer class within the Oslo the policy is The class that handles both the loading of the rules the checking of the rules and agreeing to pass and fail of the rules within open stack The enforcer class is slowly being worked on there are a number of new enhancements coming within Oslo policy Those of you are interested in the code base. It's all available. There's a lot going on I'll talk about a few of the blueprints in a second But it's a very simple class within that class. There's an enforce Every single time you make an API call with an open stack enforcers called Every single call you make enforcers called The rule sets are loaded every time you make a call or they're now they're cached as well So not strictly true, but if there's a change to the policy file, it's reloaded That's obviously is and if you start thinking about doing this it's Adding an extra potential cycle delay in an API call So if you've got a very busy cloud you have to realize that every call is it an extra delay coming along So when you try and change that system out For something else you have to be very aware of the performance So policy to Jason for those of you who haven't seen a policy to Jason file yet the works That is what a policy to Jason file looks like It's a set of rules that denote to an API call that then denote to a role or a user or There are a number of special checks available in policy Jason Newish newish one is an HTTP call You can actually add a rule that you can pass certain information across using an HTTP call Get an answer back now. I spoke earlier about speed Can you imagine Thousand API calls that have to make a thousand HTTP calls a second to some arbitrary HTTP server That's got to process something You're now starting to add not milliseconds but seconds into your call cycle I mean just think about the HTTP setup never mind everything else that goes along with that so The whole policy to Jason mechanism It was great when it was first put in place The teams are doing a lot of work to try and make it better But we need a lot more user input a lot more operations input to the community to explain what's required From enterprise from operators Okay, a couple of new features that have come around There is the capability now to load Policy files from an API Keystone has an API back in for policy Nobody's using it. None of the projects are actually using it at the moment But the ability is there and the ability is there that you can now use the authorized instead of in force class To make those calls So what's our back currently lacking within open stack? There are no native auditing capabilities. Yes, we've got the logs, but those Don't really say whether things were applied or not. It's just a fall-through mechanism The only time you get a log is if there's a failure you don't get positive logging currently For those of you have to deal with general controls auditing positive logging is seriously required It's a critical component. It's one of those things that we have to be able to prove We have to go back Six months a year sometimes and show yes, that person access that resource at that time And we have to prove that we have to have those logs in a way that we can place reliance on There is no method right now built in that allows us to programmatically Modify the rules for our back Those rules are currently as I said just this flat file model They all are created outside of the creation of the API call currently and I'll come to what's happening in the future in a second But what it means is I can't do for example time-based Access controls I can't say an admin can do You know between 8 and 5 he can do something but not between 5 and 7 can't do that because there's no programmatic way to change Yes, there are external systems before someone argues with me, but there are external ways of doing it But they all have different pitfalls and problems Lack of synchronization I spoke earlier about the API's if I'm running a massively scaled cloud and I want to scale my API's so if I want to put 20 nova API instances out there to help me scale Every time I create that instance. I need to make sure that that policy file is copied identically across each one of them That's a big challenge Because there's no centralized store. I'm also in a situation from a control perspective that if I get it wrong on one If I leave the default policy on one of those API's and somebody hits that API and they get to do something Hey, I won't know about it because I've logged it be They've got different access rights all because of an admin mistake a failure of automation it happens stuff doesn't copy correctly It has a terrible format. I mean, I'll go back to this but Working out what's actually happening in policy to Jason. It's painful It's truly painful. I've written some complex policy to Jason files. They Making sure that the rules actually apply in the order you think they're applying It requires so much testing and so much review that you're never quite sure Because there's always going to be that weird thing that somebody tries to do that you didn't think about and oh wow They're allowed to do that and they're not supposed to so Multiple occasions. I've mentioned creates ambiguity It makes us not be able to place reliance on these things and I keeps using this word place reliance General control audit is about placing reliance on data and systems We have to place reliance and Then finally it creates massive separation of duties issues for me to create a new user who has control over Just a small portion means I have to go and review everything else within the stack The other thing is an overtly long policy file takes longer to load uses more memory takes longer to process It's just the complexity grows and grows So what's happening in the community today So the Oslo team are doing a lot of work as along with the Keystone team to Programmatically create defaults and the default rule sets for the Jason The way this is going to be handled It's going to be within and this is I don't want to go into too much dev here But basically within the code within each API call there will be a default Jason or policy call which can be read out and create the policy file automatically Advantage of that is you know, you're always going to have the same defaults. It's not somebody's bad copy and paste It's not a fiddle. So every time you spin up a new copy of the API You get a new copy of the policy file which you can modify But it makes it a lot simpler to manage it a big part of this is the policy Jason files today if I go into Github and I pull the policy Jason file from Nova and From trunk and if I pull it from somebody else I have no guarantee that they're going to be the same thing Because people modify them all the time The other big change and this is the one which I really like is Instead of using the current language for assertion. We're going to start using YAML. What that means hierarchy We can use YAML hierarchies to define policy We're going to be able to put comments in You can put comments kind of in the policy files today but More often than not they break the policy assertion So we're going to put comments and we're going to be able to explain what we're trying to achieve All of this is great. It's a way forward But it still doesn't solve the basic problem that the stuff is in files on The API's and I'm not linking it back to my organizational data coming out of my directory structures So what are we trying to achieve? And This has been going on for almost a year now. We've been doing a lot of work into this We spoke about this in Austin. We have a working demo. We're looking at creating a pluggable enforcer class for For also the policy currently they are not accepting a pluggable enforcer class. There are a few blueprints out there for it What that means is that I'll be able to come along pull out the current enforcer class Like in my own enforcer model and then be able to do those lookups and those are back verification against another back end Typically an enterprise. I'm going to do that against LDAP or Some sort of LDAP based system Tree system if you have a massive sequel database that does your enterprise role behind great we can use that but This is where as a community we need people to start talking about what's required from an enterprise perspective openly on the dev channels in the community channels in the community user group talks so that The developers can start to understand the importance of this. I think they understand the importance But we need as a community to be pushing against it We need to be able to centralize the assignments and policy back ends The current situation where we're coding roles in one place that have no relation to policies assigned to another place We need to fix that we need to pull those closer together What we need to be aware of when doing this and I've mentioned before is we need to be aware of performance This mechanism needs to be fast. It cannot be a delayed slow mechanism and The loading of rules we need to make a decision about whether they're real-time Rules or cash and that it comes back to affecting performance So where are we? There is a blueprint make and force call pluggable that was logged six or seven months ago now Please go in and have a look and comment on their blueprint The idea is that we're going to create a pluggable and forster class Which means just like a lot of the other open-stack projects. We have essentially created a driver This takes away a lot of the argument it takes away a lot of the challenges Yes, we'll still have the open-stack reference mechanism with this policy to Jason, but let's move forward Let's allow other people to move forward and The driver for Oslo policy is related to the make and force call The code is there. It's available There are options that we've done which will allow us to do this But we need the first one to be accepted to get the second one working For those of you interested all the Oslo policy blueprints are also there go and have a look at them Get an idea of where they are with the statuses and comment, please Sound like I'm selling something Okay, so alternative approaches We've run into this challenge at a number of customers. We run into this challenge a number of scenarios So we have started working on different models to be able to handle this at speed So a number of people within Mirantis have been working on this What are the goals? We want to centralize the assignment back end and policy back end Leverage so in this case we work with Fortress, but it could be another LDAP Leverage Fortress to introduce new features for the open-stack RBAC. We're able to do all this OU based role-based component Delegation of permissions hierarchical RBAC, which is a critical component Native support for multi-site Here's another classic one Multi-site replication has been solved For LDAP and for most authentication providers. Why do we need to solve that for keystone? Someone's done it already. We don't need to solve that problem Let's just consume what has been done already We've also leveraged midpoint to provide a single point of management For RBAC and RBAC controls and authentication controls use a crad all of that within the environment So how does this tie together? The other policy call will happen to Fortress We have a driver that talks to Fortress. Fortress has a very good RBAC interface already It has a solution available. There are other ways to do this, but this is one we've been experimenting with It does the look up against Fortress every single time the call is made So obviously I've talked about delays. There is a minuscule delay But because of the speed of Fortress and because of the way they handle it that delay is fairly negligible In small-scale testing we haven't seen any issues You know in the interest of full disclosure. We haven't done large-scale testing on this So, you know, we have to see how that works The keystone the assignment back end could come from midpoint, but will still be stored potentially in the sequel The longer-term goal here is that all will come from Fortress So everything will come from that LDAP assignments back end now this changes a little bit If we want to start using Federation We start using SAML assertions from Federation Where we do that assignment and that role accesses also has to change it has to come from whatever is behind the IDP So That information has to be provided from somewhere Keystone still needs to be aware of it because it's part of the call But it can be created on the fly So it doesn't need to be permanently stored within Keystone Especially if all the policy information is coming from somewhere else Okay So how we get there We've got two assignment connectors that we're working on two versions of the Simon connector This assignment and user creation right now, which is working It's fairly effective. It's a little complex to get work to set up And once you throw SAML into the mix it gets the fun of getting an IDP to work with an SP and all of that If you've dealt with that it's a lot of fun The open stack permissions API which is being worked on we need to influence that we need to deal with the way that that's being Moved forward at the moment essentially what's happened within Keystone they've created a Way to store policy We need to handle fortress support for groups projects because currently open stack doesn't really recognize some of the that information like OU's Potentially extend fortress commander to act as a UI So in summary I've spoken about it during the session. How can you help us? You can help us by getting your stories out there by talking in the community and telling us what you need Let us know your business your specific user case Your specific user stories Typical user story generation we need to understand what it is you're trying to achieve in the community We need to understand how you're trying to achieve it We need people in the various regions around the world who understand the governance requirements both from government and industry To share that information in a way that's consumable to Developers and engineers That's the input which we really need your help on So I don't know how much time I've got left I've got through pretty quickly any questions Absolutely silence. Is everybody awake? I'm not So any questions I can answer it is in place and it does work, but it needs it needs help if you're an admin Okay, so my point is that if you're an admin anywhere You're an admin everywhere. Yeah, right there is the keystone the very famous keystone bug open since 2012 and All of this is great, but before you fix that bug It actually doesn't okay, so much right. I can answer to that I didn't want I didn't go into detail here on that But so part of the work that they're doing with assigning the auto creating the rules Within keystone so within the API so every time you create the API you have that call Is to remove that particular call? I know the one you're referring to is the one that says if admin drop don't even to run through the checks Part of that is to remove that now. There is actually a bug log for it. There is work happening on it It's been addressed in one of the blueprints the top mate. I can tell you what it is But part of that is to fix that In the code patch, which we've done we've actually removed that We've taken it out because it's the obvious one But it's a very it's a very valid question and it is something that needs to be fixed and again it Right now because of this general assumption that an admin is God within an environment That's kind of not really getting the focus should get What we need to be doing and I come back and I'll hop on this and if you guys talk to me in the passageways I'll keep doing this, but we need as operators to feed back our real-world requirements It's great that we talk about in the passages. It's great that we moan about these things when we all moan I moaned terribly especially when I've got a nice glass of whiskey in my hand. It's It's important that we get our messaging across that we do it in the channels because Some of these devs who are working on these projects are working on them either in their free time Or are so snowed under out the bottom and under the volume of stuff They're trying to achieve on the cycles that they're only grabbing at the low-hanging fruit and We need to help them prioritize That's really a critical portion of what we need to do as operators. We need to help them prioritize So Any other questions It's probably not correct them to do this But the one other place I know roles are read like that is horizon to do a an iteration when you when you log into horizon It wants to know what to show the user based on basically iterating through everything that's done Is that still possible when you're I mean, that's a bulk tell me everything operation rather than a what is this? So so our solution breaks horizon right now, okay? But Okay, this is my personal opinion and someone's gonna throw something at me I believe that if you're building an enterprise grade cloud, you shouldn't be installing a rise Why are you interacting through horizon when you have API's? I mean if you're doing proper automation, you don't need a pretty console, but please don't shoot me Horizon has this place. So I'm not I'm not knocking horizon team, but it has this place for admins only Yeah, okay. I grew up in the age of Linux and you know, I started with him It's DOS. So I never really got used to guise Anything else? I'm a vmware administrator. I really like horizon. It reminds me of vSphere Just kidding. So what I love about that question, and I'm gonna actually answer it quickly What I love that wasn't my question. Let me go ahead I've done a lot of Vmware implementations And everything you can do through that you can do through the command line the CLA and an API call And in fact just like horizon where horizon exposes, you know, 30 40 percent of the possible with the API vSphere Exposes 30 to 40 percent of what's actually possible With VMware. Well, I said I was a VMware administrator I don't know this command line that you speak of Somebody shut him up because he will carry on like this for the next 20 minutes My question really was as far as best practice goes Let's say I have an IT service catalog Let's just pick a vendor like service now That's driving my provisioning of new users through the API Would you suggest that That service now drive that through Keystone And then let it be handled in Keystone once you make these changes to to do Programmatically through the API to make those changes or have it drive LDAP and then have the authentication come through I'm going to give you a very opinionated answer on that question To me Keystone's job is to provide tokens That's a big part of what Keystone's job is Keystone shouldn't be the user backing Keystone can There and I said this earlier. There are a million things that handle user management far better That problem has been solved Use Federation get the Keystone do its job which is token management token Authorization that's what it does very very well and very fast Let it do that Let the user creation happen and user ownership happens somewhere else So if using service now service now uses some kind of back-end use a sample to assertion I mean this is for those of you enterprise. This is where we're pushing. We're pushing most of our enterprises to start using SAML Okay, so many things support SAML active directory support SAML. Yes, you've got to install the Federation component, but it supports it a Shibboleth IDP It works There are a lot of them out there Yes, it's finicky to set up and secure But once it's done, it's done. You don't have to do it again So yeah, that's my opinionated answer To get the German rules set down to one sentence. It's a Don't trust anyone so Yeah, I was thinking about this wouldn't it be possible to start with a plain JSON file that just allows nothing and then go with some kind of Ansible or other orchestrator and Enter the things you want to use for a specific role by an orchestrator So that's essentially what they're trying to achieve with this idea of moving to the Ansible to the policy file being Auto-created on first use. This is what they're trying to achieve because we do need defaults. I mean I Think the Nova I don't know if someone's got a machine in front of them. They quickly check how many lines are in the Nova policy. Jason It's a couple of hundred To go and hand create that couple of hundred when you're just trying to do basics is Challenging at best and possible. I mean, it's just it'll take you so long and it's such a mess to achieve The main point that I'm trying to bring across is we need to move away from this file We need to be able to place reliance on information. We need single points of information To comply with various governance requirements I mean right now as I mentioned earlier this idea that we've got potentially If I've got five Nova API's I've potentially got five different Jason files I can't audit that I can't prove if I have a breach that I was in the right And that's what we need to be able to do and that's part of centralizing and bringing all that all that enforcement into one place And that's that's if there's a message. That's what I need to get across anything else Silence people way down the back there. All right. Well, I'm done then. Thank you very much