Hi, I'm Priyanka Sharma and I'm Director of Technical Evangelism at GitLab. Today we are hosting GitLab Connect SF in partnership with General Catalyst Venture Partners. We're super excited that you're all here. We're being recorded and this is going to go on the interwebs, just FYI. The theme for today is Zero Trust Security. As many of you know, security is a hot topic, especially in the age of cloud native, which I, trust me, I hear a lot about. I serve on the board of the Cloud Native Computing Foundation and it's an important aspect of companies modernizing their software workflows. So today we're going to have conversations around there that there's folks from multiple companies here today. So everybody should mingle, hang out, learn from each other. And the agenda for today is going to be, first we'll start with a kickoff talk by Steve Herrod, Dr. Steve Herrod, who is a general partner at General Catalyst, followed by a lightning talk by Jim Zemlin, who heads the Linux Foundation. And then we'll have a panel with these awesome panelists right here where we'll talk about Zero Trust Security. Through the panel, folks can ask questions and we'll all interact and talk to each other. If there are things that are discussed on the panel for which you have a comment, that's also welcome. I think of this as an interactive experience and less of a broadcast. So with all that said, let's get started. I'd like to welcome Steve Herrod, who is a GP at General Catalyst and has a background in computer science and was the CTO of VMware in his early days, among many other accomplishments. You're very nice. I just wanted to say a few things quickly as we welcome the panelists here. First of all, thanks for coming to General Catalyst. We're in Palo Alto if you ever down there. We're in San Francisco and Boston, New York. And I lead our investments in developer tools and enterprise infrastructure, kind of anything that's extra techie as well. So it's a good crowd to be with. I guess this is also nice because we're on the eve of RSA.  There's 800 plus companies that are going to be there this year. And part of it is this is one of the biggest growing areas of trouble, obviously. That's why it's a board level issue. It's also one of the growing budget areas because it is still a problem. But I think it's also really neat and I think that's what the group here will talk about. Really, as you're going to try and improve the software development life cycle, which GitLab is obviously, that is the mission. How can you actually make security, which is usually the biggest inhibitor, actually become part of the flow? And so I'm anxious to hear how you'll think about it. There's easy themes that come at each RSA if you've ever gone to these. One year, well, it's gone through a bunch of different phases. This year, I think the predictions are it'll be, everyone will say they're doing AI. So that'll be the first prediction. Actually, I heard that the funny quote now is if it's written in PowerPoint, it's probably AI, if it's written in Python, it's ML. So that's the way to know. So I think AI would be a big deal. Zero trust architecture, as this group will talk about, is absolutely something. It's kind of a trust no one, even if they're in your perimeter.  And then cloud native apps and the way that they're deployed, whether it's in containers or in the future as serverless comes on board. Really big focus and people don't really know yet exactly how the security world will work for that. So our friends at Twistlock and other places can talk about that. So anyway, the whole point of these events is for you all to talk to each other and meet some interesting people. So I hope you do that. And thanks for coming. Well, thank you so much, Steve. We appreciate your remarks. And it's so nice to be here at General Catalyst. I really appreciate you hosting. Now I'd like to welcome Jim Zemlin, executive director of the Linux Foundation, which doesn't need any introduction. They are leading the charge on open source across the world. Every time I talk to Jim, he's either in one country or another, rarely ever in San Francisco. It's like the mission is going far and wide. And the Cloud Native Computing Foundation is also a part of the Linux Foundation. So they're very deeply involved with modernizing software workflows. So with that, Jim, please come and talk to us about security and open source. All right, thank you. Thank you. So you've all heard of Linux, I know that. But how many people here know that the Linux Foundation has a lot of projects, including the Cloud Native Computing Foundation beyond Linux? Were people even aware of that?  Like, San Francisco or an adventure firm, GitLab, like you know. So, yeah, I mean, we started out as the Linux Foundation, but really took a lot of the practices that we learned in collaborative development from Linux. Obviously, Git was another outgrowth from Linus Torvalds, who worked at the Foundation. And we are glad to see that there's a lot of commercial value being captured from Git and that project. But we work on the Kubernetes project, Node.js, Cloud Foundry is a project of the Linux Foundation. We're the largest certificate authority in the world. Let's Encrypt is one of our projects. So we just have a very hundreds of open source projects and thousands of developers working on them. A couple of very quick trivia questions and I'll talk about application security. We gather about 40,000 developers every year at open source events all over the world. Our KubeCon Barcelona is expecting 12,000 people, I think. Yes, yes, we're a little freaked out about space. But it just, the growth curve of the interest, attendance, and then just quality of the attendees at these events just in my tenure at the LF, which admittedly has been long, is just stunning to see. And I think what it is, is a shift in purchasing patterns, influence towards developers and towards open source that's just manifesting it itself in our experience at the Linux Foundation. And one of the fun things about the Linux Foundation, I was talking to Steve about earlier, is I get to see all kinds of projects, from the world's most successful projects to projects that may be struggling. And that's something I think about application security as it relates to open source, that all of us have sort of a collective interest in, and in many cases, a collective responsibility to try and understand. The most successful open source projects, whether it's Linux or Kubernetes, tend to have a very similar set of economics, labor patterns, and sustainability patterns. You start with incredible code, you don't end there. But that code is generally worked on by a diverse set of stakeholders, whether it's a company, or people from different countries, or different development perspectives. But the main thing is there's a second step of productization, where Git gets a Git lab, or a Git hub, a Kubernetes begets a Heptio, or a Kubernetes service on any of the popular clouds. And those products in the productization process provide tremendous innovation feedback. What does it mean to scale the Alibaba cloud on the most popular shopping day in China? Like you don't get those requirements working from your PC at home. It's a very important innovation feedback loop into the upstream project. In addition, it kicks off a ton of profit. There is a lot of money that's being made either directly, companies based on open source. So we're proud at the foundation that last year, two projects based directly on technology started by Linus Torvalds, Git, and Linux were collectively purchased for $40 billion. Now we're waiting for those deals to completely close so we can get our portion. But it's that monetization, it's that value capture that then creates reinvestment back in the open source project. Not in the form of working at the Linux foundation, or giving to Linux foundation, I was joking about that. It's largely the labor economics of the developers who work at a VMware or an Amazon cloud wherever it is that are working back in Kubernetes or Linux and creating more value that begets better products and services, more profit, better code. And that's really how generally the economics work. And in that cycle, you get the benefit of people who as they productize care about security. And I would argue that even in that very effective positive feedback loop, we can improve in those healthy, sustainable projects application security practices. And that's a big part of what the foundation is focused on right now, and what we think will improve our collective privacy and security. Things like just making sure that there's a responsible disclosure policy, there's a security mailing list that you have good test coverage. Again, for people who are at application security, this is very basic, and it may shock you that many open source projects, and I'm not gonna name one, Linux, but not the best test coverage in the world. And we need to kind of continue to work on that. Fuzzing the code regularly produces a lot of bugs, but those bugs are important to fix in order to reduce the footprint for being exploited as software, which is what kind of a lot of intrusions end up coming from. You know, third-party audit of very, very critical code bases is something that's really important. Bug bounty programs, I noticed there's a Hacker One t-shirt right there. I don't know if you work at Hacker One, but we work with Martin who helps us facilitate bug bounty programs for critical open source projects. Making sure that application security is part and parcel, like the process, and you know, that's obviously Kit Lab, very curious very much about this, is something that we really wanna promote in the big open source projects that we all care about. And that's something you're gonna see us do more and more and more and more. The interesting thing is that most big successful open source projects from a security perspective tend to be generally good in the same way. That's that positive feedback loop. They have the means and the resources to collectively fund an audit to do meaningful application security practices. The question that I think is even more interesting is what do you do with the long tail of projects that fall in the intersection of important to our security and privacy and totally screwed up beyond belief? This is really the most difficult part of understanding all of our collective security from a software perspective because this software is so widely deployed in almost everything we use every single day. And what I'm talking about are not just doing a dependency analysis on the software you're running, which you should, and then doing a vulnerability analysis of that and so forth, that's gonna pick up NPM packages. It's gonna, you know, things from like the major package management systems, RubyGems and so forth, where you're pulling in things, they may be the wrong versions are out of date and there's some vulnerabilities because of that and so on and so forth. Like there's a whole industry now of software composition analysis tools and products from companies like it, that do that kind of work. But the question that I think is even more interesting is something the Linux Foundation is working with, Harvard's Lab for Innovation Science, the Institute for Defense Analysis in Washington and some others on, is trying to answer some simple questions. What is this world's most important software? By package, by version number. By some algorithm that measures criticality, is it network-facing, is crypto-involved? Like where is it on the stack in terms of criticality? Understanding that, ranking that, so you can say starting with number one and all the way down to let's say three, 4,000, here's the world's most important software. Second question, who wrote this stuff? Does anybody know? I know, it's actually kind of disturbing. Like we don't actually quite know. I think with modern version control systems like GitLab or GitHub, where fortunately a lot of these projects live, you have relatively good provenance of where code is coming from. True identity may be a little bit more opaque. I think I'd like to see some things that solve for that in the future. But for older projects that are critical and everybody knows these names there, the open SSLs, the NTPDs of the world, it's less clear. Who's working on it? They're not in places like GitHub. They're in like super old versions of like Bitbucket and stuff like that. There's nothing wrong with Bitbucket. But they just are in a mishmash of things. I was telling Steve earlier, all the good projects are generally good in the same way and all the troubled projects are very Tolstoy-esque. They're just screwed up in their own unique individual ways. And I'll give you then some examples and I'll stop speaking of the third question that we really ask, which is what is the world's most important software? Who wrote it and then is it secure? Is this helping us? Is this hurting us? And what we've discovered in that long tail of these projects like an open SSL or an open SSH or an NTPD is there's these unique cast of characters that maintain this software. Open SSL is sort of the perennial example where the Linux Foundation post-heartbleed, this is when everybody's privacy was essentially exposed on the internet due to vulnerability in open SSL, raised, I raised a $6 billion fund to go help these projects in 48 hours.  And I remember talking to people and saying, open SSL is maintained by Steve Henson and Steve Marquez, these very dedicated individuals who have cryptography experience in a very unique space. In another way of saying it is the internet is secured by two guys named Steve. And you just see like policy makers like, oh my God, I knew the open source was bad and I always said it. Sadly, that's not an exaggeration. I just said it's true and I got more. Unfortunately, it's like, yeah, I won't share tonight. But what I think is interesting and what I think is a call for the industry and for open source projects is akin to something that basically Microsoft did. So now that Microsoft is a great member of the Linux Foundation and we love them so much, I'm now going around talking about everything I've learned from Microsoft and this is actually something where the open source community can take some good lessons from Microsoft and I will say there's a lot of impressive people there. Bill Gates writes this letter. I think it was 2003, 2004, stop all software production. We're not gonna release any more products. We have a real meaningful security problem here. It is bad. Customers, I believe, even just like, hey, we're not gonna buy anything more. It's that bad. You're just exposing all of our private data. It's just terrible. And he, a gentleman named Steve Lipner, who's a wonderful guy, retired now of an application security specialist at the time, went and forced every employee at Microsoft that was at least on the technical side. We're gonna look at every line of code. We're gonna take application security classes. I don't even know if they called it, maybe secure coding classes they called it at the time. We are gonna go through and make sure that we have a good way of doing this. We're gonna have bug Tuesdays. They literally research, like what is the best day to release bug fixes so that people aren't at the end of the month, where they're kind of sluffing off in the beginning of the month, where they're super busy, like that day is the day where these patches are gonna get applied. And it was really an effective thing, mainly because if you didn't do that, you were gonna be fired. People kind of wanted their jobs. So the question to all of us, and then I'll turn it over to the panel, is in a world where in an open source project you cannot be fired, where you lead through influence, where even though all of the developers tend to be professionals in the good projects and maybe in some of the long tail projects, it's still not a thing where I can go to open SSL people or I guess I could say that to Linus, but like probably not, even though I really am his boss and he doesn't listen to me ever, but like it's not that kind of world. And so the question is what do we do about it? And at the foundation, we believe the answer is we have to create a culture of application security and of secure coding practice for all of these projects. And we've devised lots of different ways and are still experimenting and still learning and sort of still stumbling along to do this. We created a thing called the Core Infrastructure Initiative Badging Program. So people like to have badges on LinkedIn or GitHub or GitLab or wherever. And so this is something where in order to get the badge, you have to show, do you have a security mailing list? Do you do responsible disclosure? Do you have at least not just theater, but like meaningful application security practices in your code? And I think we've done now 2,000 projects have graduated from that. It's a requirement for the Cloud Native Computing Foundation to even get into both the sandbox and graduate. And we do it for all Linux Foundation projects, but we need to kind of bring people with us by creating incentives and this culture. I think there's interesting things going on both from software composition analysis vendors. I'll do a quick shout out to a portfolio company, Tidelift, which is a general catalyst that's doing some things to try and improve some of the long tail economics around certain open source projects. All of these things I think, I mean, one's an investment thesis, but in our case they're all these little experiments that we're doing to get us collectively to a state of solid application security practices for code. I think Zero Trust Computing could be part of that literally in the process of how these projects get made. I will never forget a terrifying call I got that colonel.org had been hacked and compromised. The gentleman who did that has actually gone to prison for it. We caught him, but it was disturbing. Thank God Git was structured in such a way that we could go back and check every patch that was ever committed, ever, and rebuild the entire data center from scratch. But just understanding the systems where the code is developed, who wrote it, why they wrote it, and is it secure, and what projects are important, I think is a really important question. And like any of you who are super smart about technology or all this, those sound like simple questions, but please help me noodle on them. Because when you literally ask yourself what is the most important shared software by vertical industry, package, version number, where are you gonna get that info? Who's gonna give it to you? Is it in production? Is it just stuff they bought? Where is it? It's actually really hard to get. And then when you start getting to provenance and who wrote it, I mean, we're literally, we have tools doing essentially cyber archeology, trying to figure out who wrote this stuff, who owns what, when it got committed, did they change spacing, did they actually commit that line or not? So these are tough, intractable, difficult problems. I think they'll take years for us to figure out. But the Linux Foundation is committed to it. If you wanna get involved, we have our core infrastructure initiative. All of our projects are engaged in this in two weeks and this is my shameless plug and I'll give up the rant. My time here is we're gonna have a meeting for all the open source CEOs, leaders of the industry, leaders of projects down in Half Moon Bay, and we're gonna be announcing some new initiatives and tools to solve this very problem. So that's the challenge. I hope, I know Hacker One that we're working with and a whole bunch of others. So I hope you all join in on trying to improve the security and privacy of all of us by improving the quality of software in these open source projects. Thank you. Thank you so much, Jim. Every time I talk to Jim, I learn so many new things about the history of the internet, the history of open source, the biggest problems we're dealing with.  I'm always inspired after talking to Jim, so I'll take a moment. Okay, I'm done. So with that, we'll start with the panel part of today's event. For the sake of the recording, I'll start by introducing myself and then the topic, and then we'll have some intros here and then get into it. As I said before, ideally hold your questions till the end, but if you have a comment on something that's being discussed, you can raise your hand and suggest it. This is a collaborative thing. So I am Priyanka Sharma, Director of Technical Evangelism at GitLab and also a board member of the Cloud Native Computing Foundation. And today I'm hosting a panel on zero trust security here. Zero trust security, as we learned a little bit from Jim's talk as well as from Steve's is, it's about building a culture where security is a top concern, where every developer is thinking about it and there are protections in place the further and you go. So firewall after firewall after firewall is a simplistic way of saying it, don't freak out at me guys. But the concept of zero trust security is what we're gonna unify on today with a very diverse panel with different security practitioners and vendors over here. So with that, let's get started. Andrew, would you wanna kick it off? Sure, so hi everybody. My name's Andrew. I'm the head of product and one of the co-founders of a small company called Cytale. We're about 24 engineers based out of San Francisco and we focus on a particular part of I guess the zero trust problem but a really important one which is identity of software systems or trust of software systems. How do I get all of my disparate parts of a software system resolution or a distributed application to be able to actually talk to each other and trust that I'm talking to the right person? And we do that in a couple of ways. The first thing we do is or that we've been working on is an open source project called Spithy. Which is actually now part of the Cloud Native Computing Foundation. What Spithy allows you to do is to build your Cloud Native applications with best in class trust and application authentication and PKI built in. So it just becomes a function of the platform. And then on top of that we have some commercial tooling as well that helps once you've established trust across your Cloud Native application you usually have to establish trust back to things that are a little less Cloud Native and be able to authenticate to those. And so we have tools to help with that as well. I love Spithy, I've given some talks about it. It's based on a Google project, right? It is, yes. So it's the initial inspiration. Actually the name Spithy comes from Joe Beta who is part of the Kubernetes project. And he had spent some time at Google. He started Kubernetes to take the ideas behind Borg, this internal Google system, and see what would happen if we created an accessible open source analog of it. And then he went to, he cast his mind around for other systems at Google that could serve as the same treatment. And he came across a tool called LoAS which is this system at Google that runs on, I think every piece of developer facing or infrastructure facing, every machine running code at Google runs this software. And it's the foundation in many ways of Google security. And his big idea was to say, well, could we, much as we did with Kubernetes and Borg could we do the same thing with LoAS? And so that's really where Spithy came from. And now we've got a lot of other folks, not too far from this office actually who've been contributing to it as well. So Uber have made a lot of contributions recently, Square are very involved with this project, Capital One and a few other folks. So it's taking Google's ideas and bringing them to the rest of us. Thank you. My name is Patrick Townsend. Townsend security is the company. I'm founder and CEO. We specialize in protecting data at rest. So encrypting data and doing the hardest part of that which is protecting encryption keys. So in today's world now doing encryption is really not hard. Almost all the basic languages have good encrypto libraries that's readily available. Protecting encryption keys is really the challenge. So that's where that's where we come into play. We have products. It's hard to, unless you've kind of been through this, it's hard to appreciate what Jim was saying. We're so dependent on open source. It's deeply in our products. We're dependent on it. We contribute to that community. We need that community desperately. The two steves are people that we've worked with over the years was no exaggeration. We love them. They're way overworked, but we as a company, we're typically on, we come into play when there's a problem. When someone calls us, they're in trouble. Somehow they forgot to put a certain amount of security in their projects and now they're suffering from it and we're gonna help. But it's so important to work in security like encryption and key management into your whole DevOps process. And so we are GitLab customers. We appreciate that technology. We use a lot of these technologies, but security has to go right in there from the beginning all the way down through. It is so hard to re-engineer these things. And I think there's a lot of convergence between zero trust and cloud native. If you're doing cloud native stuff and we're right in the middle of this ourselves, you really have to adopt a zero trust model because even if your project's going on premise, the architecture is cloud and your customer wants to get to the cloud or they think they want to get to the cloud anyway. So you have to adopt the zero trust model even if you don't think initially you might be in the cloud, you have to adopt that. It's where people are going and it's what they want. So totally in agreement with the notion of working security in at the beginning. It is so hard to patch that in at the end. And I think actually we've seen companies, startups as well as mature companies fail in their projects, maybe not the whole company, sometimes the whole company, but fail when they get down to the end and they didn't do the security piece right. And they try to close that big deal and maybe it's a global bank and suddenly they get a sig and they've got to fill out with 80 security questions and they can answer maybe two, okay. And then they're not in contention anymore then they're not able to compete. So it is important and just so glad that so many companies are focused on this and working it in. And we come at it from security. So we're learning our way into the DevOps area. We're obviously doing DevOps, but that's where our learning curve is more in that spot. So anyway, thank you as a good, it's hard to say anything after Jim spoke, but that's where we come from. So I have a question. So the two Steve's, let's go back to that. Do they not sleep? What's the deal? I don't think they, I don't think they sleep. Steve Henson and Steve Marquess again are the kind of the core, they're technical people. They're the core people around Open SSL. Open SSL is everywhere. It's hard to overstate the importance of that open source project. They helped us do our first FIPS 140-2 validation. There were components that we used Open SSL. They were there helping us, you know, step-by-step and get that done. They're just in so many products. It's hard to overstate how important it is, but it's just really, I think they're probably, I hope there's more infrastructure there today. When they got into trouble, I think they piled in, right? There were a lot of folks who started contributing to help with that. We did a big grant. We didn't talk about that part. I'm sorry. That's okay. When we engaged in the first time, there were two Steve's, Steve Marquess. We couldn't talk to Steve Henson because he never stopped working on the code. But we work with Steve Henson. That's right. He might be a mythical creature, I don't know. He kind of likes the machine. Awesome. Thank you. Hi, I'm Cindy Blake. I'm with GitLab and I focused on security. I'm a product marketing, but more of the security evangelist and pretty passionate about application security. From a zero trust standpoint, as containers and Kubernetes kind of detach the application where it can run on any cloud, one of our goals is to be cloud agnostic so that you can run your applications anywhere that you choose. And as you do that, it changes the whole security landscape because now there is no perimeter anymore that you're protecting. So that's why zero trust becomes so important and protecting the data through encryption, protecting the applications that process that data. And what we do is we protect the applications in two ways or secure them in two ways. One is we help you as the customer of GitLab use our scanning capabilities to scan your code. And the other way is we protect the software development lifecycle, the integrity of that, so that as Jim was saying, you wanna know who made the change, when did they do it, what did they change, all of those audit capabilities of the lifecycle. And I've got a whole page on it out there under compliance. If you're interested, you can see more details about how GitLab can help with the compliance end of things. But on the application security testing side, if you think about it, AppSec's been around for a very long time, 15 years or so, that's a long time in security, in the security landscape, maybe longer. And yet we only have probably 20% of the folks out there using application security and we're still having lots of security hacks that focus on the applications. So you have to kinda question, I think it was at Albert Einstein that said, if you're doing the same thing over and expecting this, don't expect the same different results, something like that. I need to look up that quote again. But it's really important to think about, is there a better way to do application security? And so what GitLab does is we are helping really shift left. And in fact, I'd call it a seismic shift because lots of people are trying to take security tools and applying them to developers. But what we wanna do is really enable a whole change in the workflow, a change in how the security people are involved. So empower the developers to find and fix whatever they can. And then let the security folks be the ones that help with the exceptions. So let them come in and help with what the developers need help with. Rather than, you know, I've got 10,000 vulnerabilities and the security person is just, you know, wading through all of those and prioritizing them. Get them out of that minutia. Let them focus on the value added pieces.  And so that's an area that's very passionate that we're focused on. Yeah, I work with Cindy and I learned so much from her about security, zero trust security, security and cloud native. So I myself, I'm a DevOps person, right? I have spent a lot of time in observability and hang out around the CNCF folks a lot. But I'm new to security and everything I've learned, I'm like, man, so this is like, you know, if someone hacks into our system, takes all the stuff, it's our fault and says like, there's no police around here. Oh my gosh, this is reality. And then I was like, this is my Mr. Robot is this popular. Now I get it. It's become my go-to show. But I've learned all of that from Cindy and Kathy who leads security at GitLab. And I think that thought process adds a lot to the product development. Finally, Kevin, do you want to introduce yourself? Sure. So my name is Kevin Lewis. I'm a principal solution architect at Twistlock and we're a cloud-native security company. We started primarily as a container security company, securing things from the entire development life cycle from the build to the deployment, as well as the runtime. But over time, we've expanded out to cover pretty much anything that you can provision in the cloud, whether that's virtual machines, containers, your clusters, or even your serverless functions. And what we're seeing, and you guys have made a lot of great points about zero trust, is that when you start building things for the cloud, you can't trust anything. You don't know where the applications are coming from, who's provisioning resources, and you have so many different touch points of how you can be compromised. There's not one ingress point anymore. You've got virtual machines that can be compromised, that have access to Docker networks. You've got serverless functions that could be exploited that you made out of secured properly that now can access resources. And so you have so many different touch points and part of that is how do we secure that? And some of that is shifting things more downstream. So you put security closer to the actual applications and the things that you're using, rather than traditionally where you have things as far upstream and protecting the perimeter. And so really what we focus on is how do we make that possible? And we feel that you have to integrate first with the development life cycle, which is integrated directly into the build process, whether that's with GitLab, or Jenkins, or Circle, or whatever you guys happen to use, to build better images, build better applications, and let the developers know upfront, you have vulnerabilities, you have things that you can fix. So shift security left, tighten the feedback loop with them, so you're fixing things before they ever even make it out of the build process. So that's kind of step one, how do you build more secure images and more secure resources? Second part is monitoring over time, scanning things like registries and your serverless repositories and understanding. Are there new vulnerabilities that affect me today that weren't there during the build? I don't wanna have to wait until I scan things over time or scan things in production to understand that I have new vulnerabilities. So let's take a continuous approach where we scan and understand vulnerabilities on a daily basis, send alerts to the right people so they can be fixed and you can push out new versions. And then finally in the runtime, really understanding the intent of applications, which process, network, file system activities that we expect our resources and entities to exhibit and then alert and enforce on any of the anomalies in those behaviors. So really having that end-to-end protection and understanding how can we empower developers but also empower the security professionals to be able to interject policies in an automated fashion. So developers aren't left to be responsible for the security of the applications. You can have other parties involved as well. Yeah, Vanav is first looking at cloud computing and cloud native way back. I realized how many exposed edges there are and how no one knows what's going on there. And I was like, how did the cloud providers convince anyone to use what they're offering? This is crazy. This is, as I said, there's no police, right? And I realized, and Cindy and I have talked about this, how the business value of shipping fast, of using microservices of going cloud native is so high that people have been willing to make that trade-off. And what that means is that security then becomes just that much more important. And so all of these different approaches and different aspects are so critical to make more and more secure for the world as it moves cloud native. So I wanna ask a question around Zero Trust that may be different for each of you. I rather expect it to be different for each of you. So all of the people on the panel here are taking one angle or another. There's a lot of overlap, but different approaches, encryption, tokens, scanning, et cetera. What aspect of building the Zero Trust security mindset or culture do you see as most important and least addressed in your customers? You don't have to take names, but I'd love to hear some anecdotes around that. Maybe we start with you. Yeah, sure. Well, I think there's a really area that I think throws most customers off. That is going to the cloud. So the cloud service providers are all messaging constantly about security.  And they are, I think we're partners with all the major platforms, and so there's some really great security people there. They go about this far, okay, and then they're really secure. Now you take your stuff into the cloud, you have to own that piece of it. And I think this really throws a lot of people on the ground, and it's hard to get your arms around, and partly it's the messaging about the cloud service providers that they're doing. So most of when we engage, and we're in AWS and Azure, and we have been for quite some time, but what we see is that people are not owning the Zero Trust requirement with solutions they're taking in there. So I know that Microsoft and Amazon are securing their data centers, they do SOC2, SOC3, they're serious about all that stuff, and they have good teams. But when you lay your stuff on top of that, you have to own that Zero Trust stuff, and that is throwing most people on the ground, and I think is probably the thing that we see most frequently lacking. And especially in a world where everybody is trying to get to the cloud. Right. So it's like too much trust. They're starting with too much trust. They're trusting the platform too much. Yes, absolutely. And it's not the fault of the platform. I'm not trying to cast shade on Amazon or Microsoft or Google or anybody else. It's just that when you build on top of that platform, that's your foundation, and they own that, you just have to own your part. Right. And you can't make assumptions about that. Even to the fact that you're using the platform correctly, we've seen breaches around the Amazon's S3 service for example, that's, you know, if you don't use the service correctly, you can get yourself out of trouble. It's your own fault. Yeah, absolutely. It sounds so harsh when I say it. I'm sorry. Your own fault. Got it, got it. What do I use in these? Kind of going off of what Patrick says, there's a lot of effort that still has to be done. The cloud vendors make it sound like if you're using cloud, you're safe. I mean similarly, people tend to think, oh, I'm using containers or microservices, so I'm more safe because my things are more partitioned. And yes, there's a benefit to that, but there's a downside of it too, because now, you know, for containers, you've got your image, your registry, your traffic within the container, and all of those things need to be secured as well. So they become an additional point that wasn't, of entry, that wasn't there. And so people need to look at the cloud native environment a little bit more holistically, I think. And, you know, we've had a hard time getting them to look at application security. Now we need to get them to look at not only the application itself, but the infrastructure in which it resides and operates. And so I think that's gonna be the challenge going forward. I hear that. What about you, Karen? Yeah, I think similar. I think there's two kinds of things. I think number one, kind of focusing on containers and the serverless functions is that we give a lot of the responsibility to the developers to secure their applications. And, you know, most developers don't necessarily have that security background. So I'm building an application, I'm building an image, I might even build a database image that's supposed to have encryption and I may not have any experience in that. And now I've deployed it into the cloud. It has customer data or, you know, business data in it that can be easily exploited. So I think, you know, giving a lot of trust to the developers to secure their own images is one thing that needs more focus. And then kind of going on, what you guys have said is that ability for anybody to deploy anything in the cloud, I mean, so many people have access to the AWS accounts. I can deploy something in production, just provision an EC2 instance and leave it there and do we even know that it's there? Right, and so now it has access to our VPCs, it has access to our data and it might just sit there and not being updated, not anybody even knowing it's there until it's too late. And so I think that, number one, the developers have the responsibility of security and so there's ways and tools that we can help make that easier, but also understanding what's out there, what's being secured and then having policies and controls in place to ensure that we know what's being deployed into the cloud. Yeah, I think just to kind of carry on the theme that every other panelist said, it's that there's this gap between, on the one hand, there's application developers who are pushing to build in the cloud and build on containers and build on functions and get that agility, get that things to market, but don't necessarily spend too much time thinking about security. But then you have security teams who of course it's their day job to think about security, but the toolbox that they have and the mental models even that security teams have, geared around things like perimeters and around firewalls and IP addresses and it's hard, it becomes very difficult for organizations to realize the benefits of moving to these great new technologies if they apply many of the old security models. There's so many cases that you can deploy an application in 20 seconds now, but it still takes you two weeks to get a firewall set up so that you can actually do it. So there's a gap between, I guess what the application developers who want agility and want to be able to push for that and these old models of security, and there's not a lot sitting in the middle right now, there's not a toolbox, there aren't designed practices, there aren't well-codified design practices and patterns that people can lean on or even a language that people can lean on in order to solve for that, so. You know, I think part of that comes down to automation because if you can automate, you said having the developers be responsible for security and they don't really understand security, they weren't trained in it necessarily, but if you can automate and find vulnerabilities and by looking at, for instance, if there's a vulnerable code library that you're using and the tool can find that there's a more current one, apply that as a patch and see if it works. You can run the pipeline if it works. Great, then the answer is to your developer, we found a vulnerability and it's fixed instead of hey, here's a vulnerability and you need to figure out what to do with it. Yeah, I just would affirm what everybody else has said, you know, at our company, we get up thinking about security every day. That's where we live. The startups that we work with, the companies that we work with, they're trying to bring a solution to market, that might be a financial system or HR, they're trying to compete in their world, their focus is there, they're trying to get a solution out and make their company successful. They're not thinking about security and so I'm with you, the more that gets embedded in our DevOps process, in the core modules, the better off we are. So it would be great if we could enforce that those different components of security through DevOps and so something comes out the other end, much more secure and you don't have to think about it. Best case. Yeah, we all have too much to do, way too much to do. And I think that's a real opportunity as well for leveraging automation to have your security professionals, they can implement policies in place that as you move through the lifecycle, whether it's in the build or even at deployment time, you can have policies that are built by people who understand what they're trying to accomplish and then let your DevOps people or your developers deploy applications through those automated pipelines, how you have security built in, they're still getting feedback on the reason maybe why something wasn't deployed, maybe you had a critical vulnerability that has a patch available, so let's block the deployment of it. So they get the feedback, but they aren't necessarily responsible for defining those policies and that's where you can really leverage automation in addition to all the stuff we get from scalability and force multiplayer. So I wanna ask my last question and then I'll open it up to the audience. So you're all providing some help around security, but you're also running your own systems. So you're consumers of security products, of thinking through the zero trust security model and all of that. So, and I would imagine you're much more sophisticated than the average company out there. As folks think about security, there's so many aspects, right? Like the diversity of what you all offer is an example of that. What kind of framework would you suggest people to use when they're thinking through, okay, this is a good way to get a lot of coverage and feel secure based on your own experience and your own products? It's funny when we talk about security frameworks, there's a whole language and ecosystem there that I think I'm probably the least qualified person on the panel to talk about, so I won't. But there's a lot of thinking around practices and policies you can apply. I think in startups, it's even, you get exposed to that one way or the other when you start to talk to real customers and all of a sudden you get that 80 page checklist of that security product and it's, I don't know about how prepared you are, it's usually a little bit eye-opening in some ways, but then I think the, so we as a company went through that recently and there's always eye-opening questions and gotchas, but where we, there were also cases where we were looking through those questions and we were breathing a sigh of relief and it wasn't because we thought of the question specifically, it was because we were able to put in place some automation and some, you know, to Kevin and Cindy's point, some automation such that it almost became a non-issue and there was, the tooling, the tooling would answer the question for us and so, which is a somewhat vague answer, but the more you can lean on automation, the more a lot of those security questionnaires or NIST questionnaires or, you know, FedRAMP questionnaires suddenly become, hopefully a bit more tractable. So that means look at a security questionnaire that's part of an RFP or something and then automate to checklist, answer those checklists even though you might not be participating in an RFP, it's a good framework to use. It definitely is. I mean, I'm just trying to problem solve here. Got it, got it. Okay, what about you, oh, sorry, Patrick, you're... Oh, okay. Well, what Andrew said is right to the point, the automation is critically important. We do have some good frameworks. Center for Internet Security provides a framework. National Institute for Standards and Technology, NIST provides frameworks. So, SANS Institute does a lot of work in this area. We live in a key management area so it's a very narrow part of security but NIST has provided a framework, an actual published framework for key management systems. People can use that to evaluate potential acquisitions. But the problem is all that was built without DevOps in mind. That's exactly what I was going to ask you. Is it kind of new-friendly? It's not, yeah, so there are the all the ideas that how do you stitch all that into a DevOps process and the automation and what Cindy was saying about really making this a part of your standard practice and automating it so you don't have to think about it. We're just not there yet. We're so early days, it needs to happen. Yeah, I mean, OWASP is taking baby steps towards the whole DevSecOps thing but it is very early, although I'm sure we'll hear lots of DevSecOps next week at RSA.  It's there, yeah. Yeah, I shot every time that they said that. Right, right. It's a very interesting. Yeah, drinking game. You know, I think there are some exciting things coming out. Our CISO, Kathy Wang, she's really a thought leader around Zero Trust and she's working, not only on Zero Trust for GitLab itself, but working with the analyst community as well and we're excited that there's, I don't know if I can say who it is, but they're getting ready to do a really cool reference architecture around Zero Trust. It's both an open source version so what could I put together for Zero Trust if I had no money to spend and it's all free and then a paid version and how would that look and what would it cost me and what would it give me? Super useful, I imagine. What do you guys think? Will it be useful? Yeah. Okay, this is good news. Yeah, I think the frameworks that you can leverage really depends on what you're trying to secure. When you look at securing a container versus securing a virtual machine or even setting up policies into your pipeline, I think there's different things you can use. The CIS, the center for internet security is fantastic. They have their Docker, their Kubernetes, their Linux benchmarks that you can use. One of the things that we actually do to make that easier on you is we have all those modeled out of the box, but we also rank them based on, we have an in-house research team that ranks them just like we do vulnerabilities and so you can focus on the critical and high aspects and things that really matter whereas maybe the things that are ranked as medium and low are things that would be nice to have and you should get to, but it really helps you focus if you're new to this environment or you don't have a huge team. These are the things you really should be doing, but let me kind of get back to the question. Does it really depends on what you're trying to secure? But definitely start with the CIS benchmarks and then understanding how to integrate security I think primarily into each phase of the pipeline whether that's build, deployment, or even runtime. Having something in each one of those three phases is a good high level to say okay, let's find something to secure our running stuff, let's find something to ensure we're monitoring things over time and then primarily building better applications out of the building. With that, I'd like to open it up to the audience. Anyone have a question? Did anyone hear? Okay, there you go, yes. I'll repeat the question once you've asked it for the benefit of the recording. Sure, thank you for your contribution. I really appreciate this forum, this panel. My application actually spans both cloud and hardware platforms. That's curious whether you have any experience or approaches to mitigating insecure processors, firmware, and whether you see some opportunities to automate pipelines for validating these purism reports as it's open sourced. There are chips that design pipeline. I was curious to know whether anyone's applied sort of set up approaches there. Do I have to repeat this question? I guess you do. Okay, who wants to take that? Well, we intersect, I mean, we have a hardware appliance and so we follow that. We understand the Intel STX challenge and other challenges that have to do with firmware as well as hardware. So these issues come up, we track them very carefully. You've touched on a brand new area. I mean, this is getting DevOps to integrate at the hardware level is really a challenge and I'm not, maybe you guys have done this but it's an issue, yeah. Yeah, we're not looking at that per se. I can tell you a lot of that's being handled at the firmware level. So HP, for instance, is doing a, they have a new method that'll track whether the firmware itself has changed and whether it's fingerprinted back to its original. So I tend to think of that as more of a hardware piece but maybe we should talk. Maybe there's a way, maybe there's a gap there that's not being filled. It feels like there's a set of disjoint technologies and right now there's things like secure enclaves and measured boots and then software supply chains and signed binaries and then there's things like TLS. So we have all of these different ways of verifying what goes into and out of our systems and whether or not those systems have been tampered with but what we don't seem to have right now is a way of being able to reconcile all of that or unify all of that in some way. It's not something we're looking at either but it's something that people are using the SPIFI project to try and solve for. Someone look at this. Someone else look at this. Well actually, I had a conversation with someone recently and it was about zero trust and I asked them what zero trust meant to them and they said this was a large financial institution and they took a very traditional view of security which was if it's not behind a locked cage and I know exactly the names of the people who own the keys to that cage and I vetted them then I don't trust it and that was one model trust and this person pointed to, this was in a conference room and there was a server at the back of the room. It was unsecured, it wasn't doing anything useful and they pointed to that server and they said to me zero trust is being able to run the same things that I have in my locked data center where I have to go through biometric screening and all the rest of it and jails and cages to get in that I can run something on that server with the same degree of integrity and safety that I could run something in my data center and their point was that again all the technology is there to do that if we want to but it's fractured, there's different pieces of it. It is things like secure measured boot. It is things like TPMs and some of these things work better than others frankly. All of these things of course have their own threat models. SGX is a great example but they can be unified, they can be scored. There's got to be a way to do it but no one really has yet. Someone, yeah, someone should. Awesome. Any other questions? Speak loudly so I don't have to repeat. Sorry. There's a notion out there of a zero day threat or a zero day vulnerability. Something that is unknown in the wild that from a security practitioner's standpoint how often are people really worried about those unknown kind of things or are they focused on the blocking and tackling basic kind of types of those securing your application and how much, how many attacks out there are based on these zero day threats or just kind of base level, baseline types of security protection? All the big ones are zero days. Yeah. What a zero day means is it hasn't been, it hasn't been documented and so people don't know how to patch it. There's not a patch available for it yet and lots of times those are discovered and they may be disclosed ethically and that goes back to the vendors for them to create a patch but sometimes it can be months and months before a patch is released and so your defense in depth is really important and continuous security, scanning everything all the time is important and patch management. You wanna make sure that when those patches come out forget which, there was a real big attack, I forget which one it was where there had been a patch out for some time and they just didn't apply it. Well that happens all the time too. Yeah. That was Equifax and the Wisconsin, I don't think. I think the, No, go ahead. I was gonna say I think the zero days defending against that is, so we call that an unknown attack. So there's the known attacks or the unknown attacks, the vulnerabilities, things that publicly disclosed, I know whether or not Ubuntu has a patch for it or not and those are things that we can go ahead and fix. When we start talking about the zero days, in that case, having policies and things in place that can help prevent those things from happening in the first place is something that we focus on and so if we take the container breakout, the run C vulnerability that's been going around lately for containers, we can't necessarily stop that exploit from happening, somebody taking advantage of that and running that image if you don't have security in place. But you can put policies in place that say, I'm gonna whitelist the images and resources I'm gonna allow to run. I'm gonna prevent containers from sharing the host namespace, I'm gonna prevent root and privilege containers from running. So there's things that you can put into place to help mitigate some of the zero day things. Also one of the things we do is we have our whitelist security modeling where we know which process should be running inside the container which networking activity or file system activity to expect. Now the result of the exploit is gonna be something, I'm gonna download an attack kit, I'm going to contact some other server to do whatever. And so there's gonna be fallout from the actual exploit. So how do we protect that fallout and prevent that is a way you can protect against the zero days whereas a known exploit, hopefully there's a patch against it. So there's different ways to protect against them. And I would just add to what Cindy said, the DevOps environment is critically important. We were affected by Heartbleed. We got a product, it's got open SSL in it. Heartbleed happens, Amazon's on the phone. We know that you're running an exposed version of open SSL. How do they know that? Well okay, they know that, they know everything. But your ability to react depends on the automation and the DevOps platform that you have. So if you can identify that and you can get a patch but can you move it through your whole process? He's a GitLab customer. Yeah. It's true. But it's critically important that you have those kind of things, that you're doing those kind of things to even address the zero day, yeah. Cool. Oh sorry, Raven, is there something? Oh, well, nothing important but it's. Just a small observation, you know that another indirect way of helping to solve that problem is, I guess you're seeing more and more particularly critical security functionality being moved out of applications and into the infrastructure and becoming the provenance of the infrastructure. So service mesh is probably a great example of the design pattern right where things like open SSL now aren't typically run as part of my deployed application binary that an application developer needs to reason about. It's part of a, it's still a binary but it's now one that's run by my infrastructure team. And so I am at least now in a position to start doing, have a single owner of that who can be hopefully responsible for it and I can start to do, when I find a vulnerability like Heartbleed, I can address it reasonably easily systematically rather than having to go to 100 different application development teams and beg and convince them to update the patch and to rebuild it. This is of course assuming there is a patch so it's a bit more than zero day but at least gets you to a point where you can, when you do have a fix for something you have an option to do so. That's a great point. I think there's a trend now to embed security invisibly into the product. Okay, take it out of the hands of the end user, the end customer who may not have an IT team even in house having trouble getting cycles from their security team embedded in the application. So I think our partners who've embedded our technology have benefited from doing that because they can address it. It's just immediately there and they don't have the complexity. It simplifies in many respects that and that just makes it faster to address too. That's a big parallel to the observability world, right? Where a lot of folks are putting in the observability stuff into the service mesh or whatever they use to generate the base framework of each microservice just so that there's something that out of the box people have and it makes it just a lot more easier. Well, anyway, with that we're 10 minutes to eight o'clock so I'd like to give a hand of applause for the panel. Thank you. Thank you. Thank you so much for joining us today. I learned a lot. I think the audience did too. This duck around was signed for something and I'd like to just thank all of you for coming. This event was brought to you by General Catalyst and GetLab, the first single application for the entire DevSecOps life cycle. Thank you so much for coming. Yeah, let's get out of here.


enough space to accommodate accessible entrances that are covered and stairways that are covered. Part of the issue that becomes with this as well as the zoning on the property is a suburban office zoning currently right now and it has some different restrictions in comparison to a residential zoning. So overall as Steve had stated we are looking for a multiple amount of variances as notated in our application from building coverage ratio, side yard setbacks, street yard setback, and minimum paved surface setback in dwelling unit separation, off-street parking spaces required within this zoning instance, and minimum eave width. Starting out the building coverage ratio we're requesting an allowance of 0.51 versus 0.5 again just due to the nature of what we're trying to provide with our plan that it limits us a little bit just because of the size and the nature of the existing sites. Front yard setback we're requesting a one foot five building setback in along the front panav side which is consistent amongst the existing structure right now. This is allowing for a double decker porch to be added on to the front as far as a means of egress and also from a convenience to each tenant. Side yard setback we're requesting a four foot eight variance building setback along the west property and a one foot nine building setback along the east property. Again this is allowing for additional covered entrance ways and access not encroaching any further than current standards on that property. Paving setback with the addition of the additional garage we're requesting to get the paving closer to the lot line which gets closer than the required setback within within the zoning standard. And then same with the rear yard setback we're requesting a 24 foot four inch building setback along the alleyway side. Off-street parking we have about two and a half spaces for off-street parking as well as two vehicle spaces within. For the zoning I believe it's three parking spaces per unit as what's requested with that. And then minimum eave width we're requesting a 10 inch eave width that's just being consistent with existing building and existing structure. I think that outlines it all. Steve do you have any comments? Yeah I think a couple of things to add. We did receive two letters from the owner of let's see 502 Pennsylvania Avenue which is the property owner to the east I believe and then 510 Pennsylvania Avenue which is the property to the west both in support of the proposal. I think a couple of the comments that I would say is as Mr. Presky mentioned there the property has a zoning designation of suburban office so that's part of the reason why they're here today but as you can see from the drawings you have before you the maps all the residences you know basically by the county courthouse along Pennsylvania Avenue our duplexes and single families. We have a gentleman I'm assuming you must have just recently purchased the property or have you had this for some time? Yeah I purchased it in October. And there must be a reason for that. Well again I live across the street I was looking at rejuvenating it I've got a couple people my sister my sister-in-law and someone else who would like to live there so I thought I'd refurbish it into a two-family you know simply because of the location. Yeah and so you know when you take a look at some of the properties over there these are all fairly tight lots they're put in there together you can see how the front lot line has an angle over there so you can see some of the need for the variances to the front yard setback not really I mean they're increasing the footprint but that's to add a garage presently there's nothing there there's a number of the other adjacent properties next to this that do have garages on the alley it's a significant you know improvement to the property you can see some of the pictures on the screen what's what you have there now and you know the shape it's in and the fact that we have someone who is taking a property on Pennsylvania Avenue which is one of the most heavily traveled corridors to the lakefront and looking to improve it and and have some vision and see what it could be yes there's quite a bit of variances but this is a very positive project and staff was recommending it. Pat do you have anything to say? I believe there was a neighbor I didn't know if there was anything that you wanted to add or I just want to say I totally support his idea and his vision I think it'll be a 98% improvement but my only question is there is a sidewalk between both our properties. Which property are you sir? 502 Pennsylvania Avenue that's to the east east okay I was just curious about like the sidewalk I know we discussed it but I just you know it who's responsible for that or if that you know I wasn't sure yeah what apparently I'd have to get an easement from him I don't have a problem yeah yeah we'll have a lawyer drop an easement for sure the sidewalk that is partially on your property yeah I didn't even realize that I've been there I've been there almost 30 years so I wasn't sure yeah it was brought out when we did the survey. Are you two gentlemen getting free passes for a trip to Mexico or something? I hope so. I'm taking a look at the the survey on the screen and it's the one on the east side over here is this so so that sidewalk is your property yeah but I like said I didn't know if I if I own it or you know yeah yeah so yes sure oops I'm sorry I'm on the wrong one I'm looking my fault thanks so just so that would be this area right correct right to clarify currently right now the the existing sidewalk is on the neighboring parcel so it's kind of an existing non-conforming element to it so what I've suggested is to get an easement to legally make that proper of what it is and who maintains it and in so on for maintenance okay that answer your question Dennis yeah yes and then like one more question to I know I should do this on the phone but like I'm considering a deck on the opposite side of my garage but I don't have a variance yet for it what's the yardage you have to be off the property line for a structure what for this city I think what we can do on that is probably you could either give myself or the inspector a call probably have and I don't mean to you know but maybe we could have that conversation and then we can talk a little bit more because it may have to go through a similar process like we're talking now everybody done talking Pat the gears laid up I pressed the button and it should turn red that easement has to be in place because that's a service walk so just keep that in mind and to the neighbor I'm Pat Eric I'm the building inspector give him feel free to give me a call and I can give you that information okay have you heard that I'll call the question we have a motion on the floor to approve it all the favor say aye opposed carried thank you you got yourself a deal thank you next up the bat is Chad war no no I'm sorry so what we're gonna be taking a look at here is a mr. Jack West falls requesting construct a deck in a front front and street yards at 1034 bluff Avenue this is a deck that started construction without permits and he's here to discuss the possibility of receiving a variance to allow him to continue to construct hello hi I'm Jack West fall I want to first of all apologize for that permit issue and just as a background or context on Monday of that week I called for an appointment for surgery and they said as soon as they received the pathology report they'd schedule it well I gotta call the next day on Tuesday and they scheduled it for Thursday morning it was a four-hour surgery and you know I was just a little bit out of it and that was the week I was supposed to apply for the billing permit so it's not an excuse but I just wanted to provide some context that I wasn't you know trying to get away with anything and in that respect this is Brian the carpenter and he put up his his sign so we weren't trying to hide anything it just as I said it just got caught up at any rate the property is at 1034 bluff that's for my taxes and water and everything else that's the address so the front of the house I understand is 1034 and then it has you know two side yards in the backyard now the side yards it's five feet off the neighbor on one side and some 16 18 feet on this side and the tenants downstairs tenant has a small girl and he wanted you know just some privacy for them to be outside and being that the side of the house is kind of on the street and you know just just no privacy and you know so that's awkward yes so we designed this to you go out the front door and then around to a side and that's gonna be a porch it's not really a deck it's gonna have a 42 inch high handrail all the way around it you can only access it from the front door so it's not really like a deck there'll be no no other access to it other than from the front door and you know the plan was you know have some private space because other than that there's no private space on that lot that's a question so when you talk when you say privacy is the deck just speak gonna be a deck with rails or are you screening something off what we don't have a sense in terms of what the deck itself you know so whether it's you or your contractor someone needs to you know when you're talking privacy a lot of times people are putting up a fence and screening things off so what is your definition of privacy well it'll be a 42 inch high handrail with two by two spindles every four inches okay so it's more it's not necessarily privacy it's no want to space the hang out on I mean it's yeah that's what a decksboard and private so well semi-private it's not it's not on the street let's say out on the grass yeah and you know he can leave his daughter out there and stuff like that so so the issue before the board is just like a lot of our fences and things like that there's stuff that we have as far as setbacks along fronts and street yards typically 15 feet for uncovered 25 for the house a lot of times we talk about design in the front yards this looks like it's going to be strictly wood treated wood are the rails or anything any type of color to match the building what no well stained what are we talking about doing well you have to leave it for a year before you can paint it but yeah we would be painting a thin white to match the house but you have to let it age for a year yep no no it would just be a typical typical deck design that's correct that typically you wouldn't be allowed to do this you know if you take a look at some of the maps or the pictures I have you know there are some homes in that area that do have some stoops that encroach from the house a little bit and so when you take a look at the deck it kind of lines up with some of those things but you know again what it comes down to you know when we're taking a look at these things is what's it gonna look like are we just gonna have a treated deck that's just jammed out in the front yard that looks so so but allows them to do what they want but with everyone passing by it and looking at it is it a decent looking deck and so whether it's you know wood rails you know different materials those would be the types of things that the board should consider looks like contract or maybe as innocent yeah go ahead I'm Brian from B&I Builders I understand under ordinary circumstances that the responsibility for the permit the submitting the design the variance all that falls on me however I know Jack personally I've worked on his other properties and this is something that he didn't have to do so he takes care of his properties he goes above and beyond I think in this case like he said he's gonna let it weather for a year maybe 18 months and paint it up so it'll be tastefully done I also hope you'll consider the fact that it is set back I don't have the measurements in front of me but I believe we're about seven feet off the edge of the sidewalk is it okay not only that it's a corner lot as well so yeah not much with respect to the rest of the yard in the back with those measurements you know you got to make sure they're right because if they're not you're coming back so he doesn't have a survey with a plot plan no he's got a couple of sketches and I don't know exactly how they came up with the measurements well just I know I know the one side yard is five feet to the east and I wasn't aware of a alternate setback for a side yard so yeah this is the trouble we get into when people don't call ahead of time but um Pat I don't know if you had anything well the only that we would not be here tonight had the contractor follow the rules and apply for a permit with building inspection first of all whether he is licensed in the city and the location of the deck it would have been denied at that time we would not be here so now it's kind of asking for forgiveness I guess if if this was done the proper way and went through the right channels would this have gone through as far as the staff is concerned I'll answer quick and then Pat you can it would have been denied and they would have probably had to come and do what they're doing at this point in time okay yeah that's correct about the permit process if I could like I said ordinarily obviously we all know it falls on the contractor however like I said I know Jack personally I'm actually from Green Bay so if he tells me he's going to secure the permits and submit the drawings I trust him to do that that week he had a procedure done on his eye I believe the material showed up prior to us starting and there was some spindles missing and a few other things so I kind of ran him around for that but if you know if he tells me you get to permit I don't question Jack like I said he did have a few things going on health wise and material delivery things of that nature that week so are you a licensed contractor I am yes and you in Green Bay I'm sure you when you're gonna do something like this you gotta have a billing permit to start all correct right and and usually they ask to submit a drawing like like you stated and and go from there what's your idea how far you set back from different places have different rules some people say you have to be so far from the center of the road other guys say you have to be so far from the curve so obviously I would have got all that information if I would have pulled to commit just out of convenience sake I said Jack up to do it and I just assumed that if you guys needed any of my information or credentials that you'd ask for it there so we just went ahead and started and I guess I didn't question them so it kind of blame falls on both of us I guess but I'll entertain abortion from the floor well if I can I can ask another question normally under these circumstances we don't have any kind of a survey so we don't know what we're what the measurements are how close for the lot lines and all that stuff officially I mean we have we're just kind of hearing rough guesstimates normally under these circumstances before we allow anything you really move forward as we typically want to get at least an official survey right so we know exactly what we're like a building permit which would have a survey is well I I don't know I mean it doesn't look like it was one question I can answer yeah I mean typically the answer is yes sometimes what we've done is to indicate to the applicants hey you guys need to know what you're coming in because the board could if they approve it require a survey to make sure that these measurements are indeed what they are so say for example they got denied they wouldn't have to be expense of having to go through a survey but the board could say hey if we're considering this you will submit a survey to verify that those what you're showing us is correct and then that permit could be issued so that could always be a condition of approval if that was something that we were looking at I mean I think I kind of like that idea because right now it doesn't look like it's it's to me it doesn't look like it's going to be a terrible project you know when it's all done especially if it's going to kind of match in and blending with the with the property but I think we kind of do need a an actual survey to make a conditional just to stay consistent with all this other stuff that you know all the other projects we approve or deny or something like that we just I think we should start there and make that as a conditional so what you're seeing is we could make a motion approving it subject to them getting a billing permit does that work sir and that would include the survey or I could make it we can make it conditional upon approval to have a survey that's correct because then if it doesn't meet it and it's short and it's not meeting it then it they wouldn't be able to get the board the variants or else they would have to come back the other thing I think that the board may want to consider is they talk about the green treated you know is everyone okay with the the treated wood it do you want to see it stained do you want you know you know that that white is pretty striking with the house and and to just have a green treated deck you know to go along with it you know that's something else to consider as well question owner has a go for what would you rather see us put siding on it like on the house so it matches the house exactly no no okay that won't that won't be very appealing at all I mean if you wanted to do some you know nice rails or spindles or something to that effect that that would look better than just having additional siding there's a lot of siding when you look at the building already all it is is white siding so I mean even if this was stained and had some you know decent design to it in terms of the rail or spindles or something to that effect it certainly would add something so I don't know if that's what you know the board wants to consider okay if if approving it you know that would certainly be the survey and and you know design would be some elements that should be incorporated in any type of approval if the board chooses that if they don't deny it well I mean we can certainly paint it this year it's just they recommend with 3d with it you wait you know a year and 18 months or your paint's gonna peel right off so that that's why we're gonna wait our problem is that we start doing this all of a sudden the next door neighbor wants to move it within two feet at sidewalk in front and what he is we're gonna stop this you know yeah just never to press the button that just a couple of questions do you have your state qualifier and your cq from the state okay second thing is in lieu of a survey we also are able to contact the engineering department and they'll give us what the setback is from center of road and then you would come up with a drawing not a sketch showing everything in scale drawing that's something else the board can think about as well I'm just throwing it out there and then to the board again third thing is that again no permit was issued so there was no plans to meet the deck code and I think I had a couple of issues when I went out there as far as joy spans so if you approve this tonight I don't know what you're gonna do and he has to tear half that deck apart am I gonna allow him to put it back again that's the question I have I can the answer that would be they would need to get a plan that meets code and if it if they don't get you a plan that meets code if the deck's not meeting code they need to do whatever is necessary to meet that building code that's what I'm saying so if they would have to tear part of the deck apart to meet the code yes can you put it back where you guys approved it or do we got an issue again hang on a second time well could you ask that one more time so if it's granted where the deck is right now and he has to tear that deck apart to re to make it meet code is that a new deck again and is he gonna have to come back again I think there's a couple of things on this I just want to make sure before I and we can talk more about that but first of all you know again if this is being proved I think a survey is a smart thing to do because we don't even know what we're measuring this up to second of all if it's approved they should get you plans that you know show how they're meeting requirements and if that requires them to remove things it requires them to remove things good and then they would get the permit as they should have in that first place if we go that route right route would you get a comment do we have the option of tabling this and let the issues get resolved before it comes before us so we're not layering on so many so in other words the next time it comes before us we have a billing permit in front of us well it's something that's more understandable but also you tack on so many amendments then who follows up on the amendments it would be a lot cleaner just to come in with an appropriately presented presentation good point tabling is always something that we can do obviously the questions that are posed here are you know I don't know if in the meantime they could get a drawing that specifies what it is get the building permits in the pat and get some type of design so we know exactly what we're looking at and and we've done that in the past and if the board feels comfortable instead of denying it to give the applicant an opportunity to get that in here to reconsider that that's certainly an avenue the board can take every said that and having heard that make a motion to table this for future discussion future submission or a second to that he's made the motion to table it there's a second I'll call the question is it all in favor say aye would would I be able to get on next months then as long as you move fairly quickly in terms of your drawings and getting everything in yes so you just want to stay in contact with Pat and I and make sure we get all that so if there's any questions but yeah we could get you back on next week depending on how quickly you can get things in or I'm sorry next month how quickly you can get it in yeah so just stay in contact with us comfortable you know that's your middle name is right Gonzalez I mean if I have to get a survey I don't know if I can do that they're pretty busy yeah so we can talk about that contractor gets up and together get some plans as well as something that shows us from a design hey here's what we're thinking yeah okay sounds good all in favor say aye about tabling it opposed scary okay you understand what the table means yes please do yes well somebody's gonna have to submit the plans to me to meet the deck code to meet the appendix B of the UDC code okay yeah we can do it but you mentioned some of you are getting drawings from engineering you can't do that you need a certified survey okay we'll get a rush on that good luck Chad you're up to bat what we're taking a look here is a very a variance application by Jed more requesting to add the width of the driveway at 2507 North 38th Street is he are you talking about my name the approach there too excuse me I didn't hear you because I noticed there's no curb there anything it's all black well the unique thing about this property that most of the properties down 38th are town not city I believe there's two or three of the properties that are actually city properties and not town so there is no curbs or sidewalks or overnight parking on the road the reason why I'm filing for it is because if you noticed on the drawing here where the slant is where you got your cursor that's the third car garage so if I actually park and you we got three rows three cars going in straight if you're ready to pull into the third car garage you won't be able to even make the turn while staying on the concrete you'd have to drive straight into the lawn in order to get there you see if you pull go down a little bit sorry are you only doing a triangle in cement or you take you on with the approach to the approach as well where you see the dotted lines on my diagram there it's the dotted line there if you bring it down not that one yep that one right there okay that's the existing conditions right now what is it what you see right there and outlined in the red is the existing okay that's all the existing concrete in front of the garage those two car garage and the one car garage the one with the dotted lines yes that's gravel approach which is kind of a nuisance at 16 feet from the existence and then the block to the right right there that's all grass leads to the third car garage so you can see your bottlenecked in to even get to each garage door slot if I'm parked in front of garage one and two you're not going on three you'll drive to drive right through the grass so what you want to concrete as I understand it is make a straight line to the end of the concrete now correct up to the lot line you are up to your existing concrete now it's going in that third well from north to south I'd like to keep the same with gravel yeah and what I would like to do is keep the same width which is I have a survey attached on there the existing concrete now at the house is 34 foot 7 inches now if you look see where it's bottled neck down it reduces down to like 22 feet and I know that the city had spoke to a nice gentleman here in regards to that and I was told 25 feet that's what led me here today to get the variance so the proposed new concrete would be the part to the west all of it the approach to continue what should have been done in the first place rather than gravel in my opinion and then also that the triangle piece so it would be 16 feet out further to get the approach correct and then keep the same width at 34 foot 7 out to the approach all the way to the road that way we can park in our driveway not be on the street worry about moving our vehicles off of the city street or town street however you want to look at it and park in the driveway otherwise what we're doing is rotating vehicles all the time or we're parking in the lawn or we're driving through our lawn to get to the third garage garage and it tears up the lawn which creates an eyesore can make a few comments I think if you take a look at the picture that I gave to you guys kind of see the neighborhood yeah existing situation I don't know if you want to take this I don't have it on the screen but this is what I gave to them to take a look at that gives a good picture but I think what you what you have over here is you have a town road it's got no curb gutter sidewalk some of the properties are in the town some of the properties are in the city there are others in that same block that have done similar things to what Chad Moore is requesting so from a staff perspective there were no objections to the request no just remember you are in the city so I need a permit absolutely thank you you got it and I'm a licensed contractor I know the rules good no I don't have any issues with it either as I told you some last night I was glad he told you the correct measurements when you went there yesterday regarding replacing where the gravel is do you have a drainage culvert there to be concerned about I'm sure you're concerned if you do but there is no drainage culvert in the existing condition that is now whether I'm required to have one or not I don't know so that would be something that would be I would be looking at answers from you guys I guess for yeah I don't we don't have a problem with water drainage now I don't think we're gonna change the elevation of the land too much maybe on that one corner where you see but I think there's enough green space to absorb it now you know I I'm not real sure about that so one of the things we can do too is get engineering to maybe take a look at that I don't know a pad if you had anything you are a city lot you are a town road you need to go to the town to figure out how wide you can make that access approach from the street we don't deal with that so if the town gives you permission to widen that at the road that far you can do it you need to check with the town okay I got my hand slapped for that so we're because you're in the city we're just telling you yes you can do this but town for the curve you whether it's curve or not it doesn't matter it's an approach from the street okay they're gonna tell you if you can or cannot do that okay don't forget that yeah and I'll and I'll I'll see what the town says about that now when I do approach the town for that I guess I'm I'm actually looking for direction too because I do know I don't want this to come across the wrong way but I do know in my city tax dollars to go to the city and that's why I'm before this board to see what direction I need to go so now I got to go to the town and ask them for permission to do to but I mean I mean that all respect let's let's work on this and then you and I can speak see whether or not we get an engineering in there we can get some information back to you in terms of if there's the need to go to the town or not so okay let's maybe take some action one way or the other on this and if it gets approved then you and I can speak and see who else we can speak to fair enough I'll entertain a motion Kevin what what is your motion to prove what I would I would strictly recommend approving or denying the request as presented okay seconded any other discussion call the question we'll vote on it all favor approving it as proposed I guess it's approved thank you guys good luck there Chad and I will talk to town next up the bat mr. Pelican we tomorrow good afternoon just out of curiosity there was a fellow by the name of Pelican that was a reporter I think for the press or something was that is not my side of the family the rest of mine comes more from Canada so I'm more of an implant we're looking to extend our driveway out in front of the house we have a 1957 original or the second owners our issue is with our driveway every time we get out of our vehicle because of the lot line we are walking on to the neighbor's yard that's a landscaping one so the wife's vehicle is also nine feet wide which is the length of our driveway I have submitted pictures too of showing that when the vehicles in and in the winter if you do just our driveway we are literally jumping into the snowbank so each year I'm really snow blowing the neighbor's yard if we go past the house we do have a privacy fence from the neighbor right on the lot line and the you will see a picture with the vehicle that limits that's the front so when we are parked right in the middle if you jump off you are with two kids we are always on the neighbor's yard which is some of an irritants for him and his perfect yard we would like to extend about if you look at the back of the house where the truck is the that straight but you can't use the other doors because we are right up against his privacy fence we have tried to turn the vehicles to make up where we could turn around I did it with my car once and got stuck and spent 45 minutes trying to get my car back into their driveway so I submitted the contractors plan to extend it on the front so we can pull both vehicles in to also use it that when we get in and out of our vehicle we are not walking onto the grass I do want to maintain that integrity of the 1950s house we also right on the bottom where you kind of see the curb come up that's where our 9-4 ash tree was our 4-foot wide ash tree with a specific removed last year that stump is coming up and pushing up out of the ground so when we would do the driveway we would also have to remove the stump that's underneath the grass the roots in that are certain to come up this year and push up the sidewalk and the curb through that area which there is also broken parts of the curbs so we will be doing 25 feet I draw off memory 22 feet of sidewalk and 25 feet of city curb we would replace to make it all new also guess my pictures I tried to show how the curb is coming up I believe someone walked yesterday with my wife Elizabeth and she was able to show so the end result is to make sure that it looks like it's always been there and that it's not a just added on afterthought that's why we would remove that front sidewalk that would give us 923 square feet of just grass I want to keep integrity of the house and the neighborhood just to make it look like it's always been there but at the same point have a driveway where we can actually get in and out of our vehicles without walking on the neighbors yard we hope he never puts up a rope fence or anything because then our driveway would be useless on the one side questions just to clarify my thinking what you're proposing is putting concrete in front of your front window they're all the way up to the existing sidewalk that's going through the house right now the handicap ramp we were extending the driveway in the front out another so you're going to widen the approach also yes we were why if you want to widen that so you when you're pulling in you don't have your vehicle turned that it always looks like it's not an added afterthought I during looking around I've not seen a pad where you pull off that ever looks like it was meant to be there they always look like you were being cheap and you tried to add it on I wanted to look like when you come up that it was originally thought that way I am open for other ideas I am flexible but ultimately I was hoping to like I said make a driveway more useful but yet also keep the integrity that's one of the reasons we would remove that front sidewalk to give us more green space sure sure this is something that the and both Pat and I have spoken to Mr. Peliquin about this particular project and that it was a tough one to present to the board this is something that the board has denied in the past as far as putting parking spaces directly in front of the homes itself we do have an ordinance it obviously in Mr. Peliquin's position he doesn't have the room to go to further to the south but one of the things that we've tried not to have is parking spaces right in front of the homes and if you take a look at you know some of the photos that I provided to you and you take a look at the homes and the rest of the block there's no one in this whole area that has any type of additional parking that's directly in front of their home so from a staff perspective we would not be recommending approval of the variance request that you have before you this board has been together for a while and I think you'll remember we had one on north 40th was the same thing you want to put a cement slab in its front lawn and you remember what we did with that one so during that take a motion somebody anybody else who wants to speak on us you will make a motion all right I'll make a motion to disapprove it deny every second yes it's been motion made a second is there any other discussion and I'll call a question all in favor of denying it say aye opposed I'm sorry mr. Peliquin thank you for your time thank you are there anything else to be brought before the board today I think the only thing I would mention is that we can work with the deck we appreciate your comments and we'll try to get some more information back to you to make a decision with regards to that matter any other business we brought before the board no hearing none I'll take a motion to do all in favor of adjourning opposed we're adjourned thanks for coming thanks everybody