Who of you, this year, had a security nightmare? Lights please, we won't see you otherwise. The question was who had one, not who was one. Again, with lights on. Who of you had a security nightmare this year? So few people, I won't believe that. And with whom of you was it the parents-in-law? And who was his or her their own security nightmare? A few people are admitting it. All those using Facebook know that it would have to be you. You would have had to show up. Okay, Ronald Frank's security nightmare is just like every year. Let's go. Hello, Hamburg. Hello, Hamburg. Moin, moin. We are still here. 16. event at the 32nd congress. Now, I would like to say that had been the plan all along, but we don't think so far ahead into the future. The remarkable thing though, is that we have a 30% Market chair. Who belongs to the church of market share? Da war einer. Da war einer. Okay. Kann jemand ausrechnen? Kann jemand kaltest, wie lange es für uns zu kommen wird, bis zu 90%, oder wenn wir das erreichen werden? Was? 160 Jahre. Wir haben ein paar Plätze für das Zeit.    Gut. Gut. So, willkommen zu der Kongress.   Du warst, um zu relaxieren.   Wer durfte es nicht wecken? Wer war nicht allowed, um einen zu kommen? Oh, der, der, der, der, der, der, der, der, der. Oh. Ancient operating system 300, some windows 90, something. I found two boxes, clearing up this, month. One of them was MS-DOS 3.3, I think. And the other was OS 2. Ich könnte sein, aber ich habe nur einen Punkt durchgekommen. Nein, das ist nicht möglich. Wer von euch war auf dem Camp? Wer von euch war auf dem Camp? Die beiden Translator. Es hat ja jemand ... Man war von dem ersten Camp in den ersten Jahren in der Old Talk. Ich habe über Suchmaschinen gesprochen. Es ist sehr, sehr komisch. Ich frage mich, wer von euch kennt Alta Vista? Wer weiß Northern Lights? Und jetzt frage ich euch, wer von euch kennt Northern Lights? Ein ganzes Dutzend. Ein ganzes Dutzend? Und dann stelle ich da und sage, es gibt diese neuen Konzepte. Einmal von einem Unternehmen, Google, und jeder, der das ist. Also, Zeit. Wir sind wieder hier. Wir sind wieder hier.   Sie können etwas ändern.  Und natürlich nicht alles ernsthaft. Das ist man es heute schon dazu sagen muss. Und das zu sagen, dass wir das haben müssen. Ja, manchmal haben wir das auch. Manchmal sind wir ziemlich früh.   Es gab nichts zu sehen. Das via DAB, das Radio-Konzept, könnte man in das KAN-Bus und das Entertainment-System gehen. Und das, ich glaube, war auf dieser Stelle, nicht auf dieser Stelle, aber in diesem Event. Ich habe es schon 13 Jahre ago demonstriert. Aber mit RDS, nicht DAB. Dann war es dieses Jahr mit der Fridge. Es gibt niemanden, der in der Fridge die Google-Kalender benutzt.  Wer hat eine Fridge mit Ethernet oder Wireless-Land? Wow. Es gab mehr von diesen letzten Jahren. Was ist mit diesen Leuten passiert? Ich glaube, das Keyword hier ist Soylent-Green. Ja, sie konnten den Kalender-Entrieb nicht für dieses Event reden. Sie haben sich vergessen, für ein Ticket zu klicken. Wer hat ein Problem mit Radio-Kontrollen? Wer hat ein Problem mit ZigBee? Wer weiß noch, was ZigBee ist? Das ist viel. Es gibt es aber. Wer hat zu Hause zu Hause zu Hause zu? Papa, ich wollte ein Drehbuch für Christmars. Wer hat dann zu Hause zu Hause zu Hause zu Hause zu? Wer hat zu Hause zu Hause zu Hause zu?  Vielleicht wird es für das nächste Weihnachtsjahr sein, für den kleinen Bruder. Picken Drones in den Park oder so. Ja, Picken Drones in den Park. Es war ein Song, Poisoning Pigeons in den Park. Tom Leera, in German Magdiel Kreisler, von Vienna. Das könnte für Drones Reden sein. Und dann eine Review zu 10 Jahren ago. 10 Jahre ago. Das Thema war die 2006 World Cup, Fußball World Cup in Deutschland. Men's Football, ich sollte sagen.  Dieses Jahr in Hamburg, die Olympischen Games Propaganda, sie wollten, dass sie viele Olympische und Bicycale fahren. Sie waren so angri, so angri. Aber das meinten sie doch gar nicht.   Weil die Drones von den Skiern fallen? Ja. Oder anderen kleinen. Oder andere kleinen Parts. In London hatten sie das Airspace-Defense. In London dachten sie, wenn sie ganz ehrlich waren.  There were a few nice cartoons about this too. But then the whole thing, the Olympics bid, was voted down in a referendum. Also auch 2005. Oder was ist das halbe Kilo of beef doing in here? It's not good, is it? So, Tupperware, that shields RFID. That was in the business ideas, business models category for what was then the next year. And I think the Tupperware company did not pick this up, which disappoints us hugely. But it's of course not a problem at all to get RFID bags and purses or for your passports, your ID card and all these things. You don't have to fry them in the microwave anymore. Which we liked and we then thought, what about tinfoil hats? An uncharted business area? Nothing happened there. Okay, meanwhile there were treatises on the internet that said, it's wrong to buy your tinfoil hat, you had to make it yourself because you wouldn't otherwise know what's in them. I think at the camp there was a workshop. But the problem is the scientists have determined that tinfoil hats are problematic because they make those dangerous phrase focus on the brain. Those that then went ahead just didn't get that message. Those that ran a Kickstarter campaign. This is what a tinfoil hat looks like once it's finished. The campaign is still going on Kickstarter. So now seriously, it's quite chic, isn't it? Well, maybe it will lower your average head temperature by 0.01 degrees. Is that a good thing? I don't know. Well, it's a fact. Warflying, Wifi, long distance Wifi in airplanes. It was another topic in aeroplanes. And then this year the whole thing went through the press again about planes that could be made to fly sideways. It wasn't even with Wifi in the plane. That guy I think just grabbed the cable on the floor and put it into his laptop. And Frank said, you shouldn't touch flight control devices. Peer-to-peer and firewall worms. The respectable ones. Did anyone see any? You asked it the wrong way. Do you know anyone that has seen? Okay, we won't ask for a friend, but after, or for a friend, we're asking a difficult translate. So, I'm passing over. Question from the audience. Okay, also die Kurzfassung, es gab einen Wurm für... Shot, there was a Wurm for ubiquity, Ruraltis, and we're sessions. And they played with flash. Okay, ist doch zu lange. So, go to the microphones if you have something to say. Well, it's open. There's peer-to-peer worms. It still has to happen. Then proper malware routines. And that's quite interesting. What has happened was got through there. Malware routines have worked to crypto lock our troll trends. They are often in the news. You catch them. Then they encrypt your data.  Encryption as a service. Das ist halt das neue... The dog has eaten my homework. But actually it's the same with Microsoft. Key back up. Somewhere else. I'm not sure if you think... I'm not... I'm not sure they like that. You explain why Windows 10 is for free. It's got a scene from marketing view. Captive marketing. Everybody encrypts their hardest keys of Microsoft. Next year, 12 months. Well, Microsoft says, well, we thought about it at $99 a year. And for that you can have your hard drive key back. Captive markets. We can hope that Microsoft is well and alive for a very long time. Because who knows, maybe they will ever do it. But the bankruptcy handling, you know, they have to generate profits. So they encrypt... Siehlef Prover from the FBI. And the FBI say, well, if you have one, they'll just pay. Average customer happiness is high. And you can really get the key back. And if you have a look at it, what happens from Malware Alinesses company, they say if you lose your key, well, there's a lot... You get a lot of fuss with the other players in the market. Because it's a market that regulates itself. Capitalism works there. Because you get... It's technically really interesting how they work. The private key, you would need to unlock the data. On the hard drive, they do public key cryptography. And this is the symmetrical keys on the computer. And the question I asked myself is like, is it transaction safe? Have they thought about the fact that the scatter-matter satisfaction is the highest good? If the customers aren't happy, then other people come and kick your door down. But the other people are interested in the quality of the market. It's important that you first encrypted things with a symmetrical key after already having sent the key to the command and control server. So things can be decrypted. So that's quite interesting. It's pretty interesting. So we have fun with e-government, online forms, we predicted that. I'm not quite sure how many of you have been... Is that the broadcasting fee collecting service? Yeah, I registered there. So in Berlin you don't get the appointments at the local offices. There's a company that scrapes the Berlin e-government website and takes all the dates and appointments and then sells them. If you want to go there and want to have a new passport, you don't get an appointment. It's not there. It's not available. You can go there at six in the morning with all the others who don't get an appointment. All the e-government has been privatized, has been turned into a market. If you want a market with timely dependency, if you want one in the next three days it costs more than one in the next two weeks. So people don't get... So people even get threatened with fines because they don't have a personal document and they don't get an appointment and they refuse to pay the tax. But that's the only way they have the chance to have. So the privatization for our e-government, we haven't really seen that. We saw that this website is sort of semi offline. So, what? Also, dann gibt's das schon als Tool? Is there a tool? There was two snipers of ebay. Das brauchen wir jetzt. Now we need this for public registration offices. The switch monitoring. So there were sensors that were basically put in the sewers and put in an environment and keep for a long time. And I... especially in the switch.  Und es wird nur für ein Jahr dauern und es ist verabschiedet und es ist gebrochen.  Sie kommen mit Sensoren für Air und es wird vielleicht in den nächsten paar Jahren etwas sein. Und dann bin ich ziemlich froh, hier zu hören, was passiert.  Und du hast, zum Beispiel, ein Anmesser in deinem Hallway und dann hast du eine E-Mail, die sagt, du solltest es anders essen. Okay, das war in Lutwigshafen in Mannheim, wo sie bestimmte Sicherheitsflugtuations haben.  Ja, das ist das, was man in realer Zeit mitführen möchte. Und die Weise, in der man mit den Sicherheitsflugtuungen verabschiedet ist, hat sich nicht viel verändert. Es gibt drei Verhandlungen von Firmen, die von ihnen verabschiedet sind.    Nicht viel verändert.  Data wealth, wasn't called that in 2005. We just said, databases will go missing to the left, right and center, and that of course is not as nice to a term as data wealth, which is the same thing if data will go away, will be, will be, goes stray. But we have to be grateful for the word. Who do we have to thank? The company that infected the government or the people. They don't have a copyright on that, do they? They should have created one, great word, data wealth. Okay. Now the Internet Normality Update 2015. Yes, let's just quickly go through that. Not much time. A few numbers, 81 billion dollars by cyber bank robbery. What's the problem? Bank robberies, they're quoting a popular tune now. 17 million was the highest published phishing transaction.  The thing is that there are enough companies where the guy that does the payments is not the guy who does that directly in online banking. He writes a note to his secretary saying, go ahead and make that transfer and she then does that, right. And there's more than 14 million that someone got out from a lottery using a root kit. 3 million ransom for a botnet admin. The botnet itself was a Zeus variant. That was supposed to have caused 100 million dollars of damage. So we're talking about a 3 million bounty, not ransom, a bounty. And a reward, that's the word, a reward, I'm so sorry. And then there was a headline that another 3 million reward was there for the developer of that botnet. That would bring it up to 6% altogether. I'm not sure if it was the right one. So then the plastic router massacre continued. Unabated, right? Weren't they all in the press again? Who updated the plastic router at home over Christmas? Not enough people, hardly enough, not enough by far. So the current exploits know about 50 models and most of these are not very well patched. I have this note at my wall asking which, or listing which family member has which kind of router. And there are some where there is no update available. So you have to update the hardware, but we'll come to that. Now, the impacts are drawing closer. For example with OSX, it's now up to 15% in the US. And you can see that this and that security hole was found relevant malware platforms. OSX is now a relevant malware platform. I was asking why not earlier? Because Apple users tend to have more money. So they will have to have an over proportionate market share. They are more silly, some other people say, Apple users. So again, they should have an over proportionate market share. And I think that in general and with Trojan developers, the cliché that's spread with malware developers, these are all poor artists. There's nothing to get there. The symbolic headline for this 500 million Android device is not erasable. I have been sold, I used by people, they soak themselves up with data. And the delete function does not work. You cannot wipe them, not properly at least. With a hammer, yes. Well, I have to say, it's a bit difficult with telephones if you use termite. But hard disk platters, great. Very recommendable. A symbolic headline, those are the 500 million devices that are then sold on eBay from which you can get the data before you reinstall them and then auction the data or whatever happens. They are cheaper on eBay. The problem is that they are sold on. They don't appear in the drawer somewhere or are not put into the waste bin. So what is the real problem here? Why are they sold on? Well, because you can swap the battery in those old phones. Was? Right? What? And that obviously is a huge problem. And you've noticed that Samsung has done something against that. The new model is not available with a replaceable battery. Is that a hygiene factor? The audience doesn't care. They're not iPhone victims, I think. Okay. You're not finding that funny, are you? Well, I think this is the operating system where the telecom goes ahead and says, I think we'll switch off MMS as a bug there. So they put all the whole network into the daisy mode because of some bug. Well, switching off all the whole MMS thing if I had to say something with Telco to switch off WAP and MMS would be my second act in office just after getting me coffee. Ja, das stimmt. That's true, yeah. Einbrüche bleiben im Schnitt 200 Tage unbedrückt. Break-ins not discovered for 200 days. Now, mind, we are talking about cyber break-ins, of course. A cyber break-in is a cyber thing in the narrow sense, I think. Yes, yes, that counts as in the narrow sense. The time between someone publishing a patch for something, something more or less relevant, and then there is an exploit public in metaploit of rover is not days now but hours. I think we have come, we have got to be low 24 hours for relevant systems. Great. Ja, this has interesting implications. The first one being that if you are in a large company, you haven't really got time to test a patch anymore. It's more a case of patch and prey now, as all you can say. The company software, whether that still works, well, just have a brief test test. And if the patch comes at a bad time such as Friday evening, that's sad. You have to just reduce test time even more. If you look at the patch cycles for something like Adobe Flash and enter it into the same graph, you would find that the patch cycle by Adobe Flash is getting shorter and shorter and the time from patch to exploit gets shorter and shorter. So, there has to be some kind of overlap in the curves. And the one exploit that has not yet been patched or couldn't be patched because you still have to test whether the app still works. So, cancel, right. Spam has decreased a bit. It's only 49% of all emails now. And to balance that, malware spam now is up to 4%. It used to be 1 in 2013 or something. And now it's about 4% of all spam. 2% of all emails have malware. And what I saw for the first time now are multi exploits of malware. Four exploits in a single piece of malware, just like that. You saw it for yourself in your own. Well, they were hurrying there, weren't they? I think they just didn't want to send so many emails. Let's not clock up his inbox. And then the environment. It all costs, spam has to be stored somewhere. Okay. Now, let's speed things up a bit. Now, looking back to 2015, e-government. The U.S. Office of Personal Management. Lost 22 million files. And I think these were all staff files. There was a certain uncertainty if it was citizens or personnel or people that applied to be employed. And then it turned out there were fingerprints in there. 5 to 6 million. So, from 5 to 6 million individuals, not 5 to 6 million fingerprints. And, well, if you then go, well, staff files, what can possibly be in there. This contains the applications for those that wanted to have security clearance. Those working at the secret services. With all the things that they had to fill in there to get their security clearance. So, anything. Everything. Yeah. That is data wealth. And what do these employers get? They get one year of credit card monitoring. If someone has abused their credit card. Well, forget it. Yes, what China then does with these data. Abused their credit card data, surely. Completely helpless, right? Completely helpless. Yeah, the crypto wars this year. Just mind, we're not saying crypto wars 3-0. We resolved to use year numbers now. We were thinking, if we talk about the crypto wars 2015, should we write crypto wars 3000? Or my crypto wars? No, or crypto wars El Capitan. I do think code names are quite beautiful. Crypto wars Tiger or something. Yeah, so crypto wars. We did talk about at this event for quite a while. So, we'll have to deal with those next year too. We'll come to that. Yeah. Things are clear, I think. We always think we are in a repeat of some bad American serial when you were about 14 and sick in bed and there were just three programs on TV. And one of those was running those serial repeats and that's I think what those crypto wars feels like. This is the symbolic image for that. The background, I'm sure all of you know the TSA, which is part of the government, does have backdoors to every suitcase out there. The Transport Security Agency, that's responsible for airport security, that they do have backdoors with those keys. And these keys in this quality, they held up to a camera. It took about less than a day until the corresponding 3D models for printing itself or filing into some metalware published. But the TSA then said, well, we do not regard this as a security problem because these keys were not really there to secure anything. They're just there to give you a good feeling. We'll skip this. You know what we mean. Cryptocalypse, it's always open SSL, SSH, Blackberry. Yeah, after Nokia, the next case of corporate suicide in the IT industry. After they, well, the company is not doing so well, is it? And after for a long time they positioned themselves those that do mobile security fantastically, everything super encrypted also. This year, the C-Level officer, the member of the board, gave an interview saying Blackberry is very advanced because they do privacy, they have balanced privacy. They balance privacy of the users with the security requirements of the state. So, there's no clear a way to say we have a back door and we will reveal it to the government. Pity, the old telephone with the keyboard, but I think that was it. Yeah, and then the story, that's private keys left, left, right in the center, up, down, are getting lost. Some manufacturers leave them in the camera firmware, some in the router. Others load them up to GitHub. Right. In pasted example code on Stack Exchange, great. Just simply no understanding what these things are and that's why this won't stop. Okay, Data Crime was renamed Data Wealth this year because it's such a nice word, but it sounds so much more positive. It doesn't have all those connotations, progress, optimism, peace, happiness. Strahlenblumen. Clear blue skies. Right. Hello, Barbie. Yeah, they received the German Big Brother Award. I believe Barbie or Mattel, was it last year or this year, was Barbie Dall so-called a camera? Ah, I'm saying it already, a camera that looked like a Barbie doll. A doll with a camera in the chest. What? 2010. And that quite quickly led to quite an uproar and it disappeared quite quickly and now.  Vielleicht etwas kreter. Und dann hat jemand den Privacy-Aggreiment gefunden, den du klickst und sagt, dass alles gestorben ist und die Transkripten können werden. Und ich glaube, das war eigentlich ein Feature.  Ich habe das gemischt. War das ein Feature? Ja.   Das ist ziemlich lustig zu reden, wenn das Kind mit dem Dorf mit dem Dorf spricht. Und wie war es bei der Schule? Ja. Und wenn es dann startet und das Kind mit dem Dorf mit dem Dorf spricht, dann sagt er, Well, look, Barbie, tell me the harmless things. Why can't we afford a big car, okay? Why is Mama always in such a bad mood, okay? And why, if we are very nice this year, maybe we won't get hit before going to bed. And that's where things start. What do you do with that data wealth? This is what you see in the underground in England. If you see something, reports suspicious activity to the police. So the question now is, at which point the Mattel company will be sued in 12 years by the children that have then grown up to be adults and said you knew.  So if I were their legal department, I could not sleep. I think I would not keep the data at least. That's what data retention does for you. Or at least put it into a crypto locker. We couldn't evaluate the data, it was encrypted. Right. Now this is what Apple says now. We cannot evaluate the data because it's encrypted. But I think they noticed that they are sitting on a certain amount of data wealth there and we'll probably have to do something. I don't know, there was an interview with the Apple CEO, which is the Chief Operating Officer, the COO, Tim Cook, whatever. He was it, he used to be it, and he was talking about the Apple Watch because he is responsible for that and the health kit. And the health kit is this platform for processing and storing health relevant information in IOS. And this has been open source by now. And they had this cooperation with large hospitals and they developed different apps and then said, well, we have, I don't know what the example was, but it was some kind of illness Parkinson's where it's better to know beforehand because you can then stop the disease before it's getting really bad. And the nicest scenario then is, this is the beautiful scenario and they have data by people from which they know that they have a diagnosis. They know that the people know that there is a diagnosis and they have data from people that do not know whether they have a diagnosis. But they can say, these people probably have Parkinson's. So what do you then do with that? If you see something, say something? Or do you then not do it because you're then getting sued because they're all getting heart attacks? Or something? Whatever. What do they do in Iceland? In Iceland they have a similar problem because the databases there contain a large part of the DNA sequence of the population. So they can have information about relationships, family relationships, those that perhaps said we do not want to be registered. And they said certain markers about those and I think the change was that they said, well we try to involve the people's doctors in this and let them say, did doctor with this patient it would perhaps be appropriate to carry out tests at least in that task. Difficult topic. So, interesting ethical questions and I think we're very much scratching the surface up to now. So, notable things. Well, so, not clear why they're laughing. I don't know this. So, see, film images. With companies you see a company of images, C9 Blocker. And a question. If you do know a company that has ad blocker in company images. Build. Build. Build. Fight ad blockers. Do you know a company that has ad blocker in companies that has more than 10,000 employees? No, half a dozen. No one knows a company that has more employees with ad blockers in the image. And large, medium-sized companies. There's no brainer. It turns on the internet graphic. People don't click on websites ad blocker, and there's something for the mental hygiene. And you're about to get rid of 80% about browser malware and you save internet costs. And people pay less money. People don't spend that much money. So, therefore they don't need that much money than the total brainer. The reuse. We have had backdoors in model systems. Juniper was backdoor recycling. There was a backdoor in it and changed a few parameters and just recycled a backdoor. Very environmental friendly resources. You don't have to put that much developers to it. The NSA thought there was their backdoor and then suddenly turned out there was someone else's backdoor. It writes it for someone else, for myself. So the reality delivers examples. So you say you can't really lose the crypto wars because if something, that what happens in reality, has some relevance. And then you have a look at the current presidential campaign in the U.S. and then, well, you know. Das hatten wir erst als Geschäftsmodelle für 2016. So, first thought that we had this business model for 2016, Crypto Trojans as a service, but it's already there, already exists. It's already 10 and ready, so yeah, there's not much to do. One of the positive trends is that the large companies, except for Apple, that also search for bugs and other companies. So if people click less web, they click less. Sorry. So Google and Kau, can you please just fill this up? Okay. I heard the rumor in between that Microsoft was only now daring to get involved because they want to have a market share, too. Right. A gold mine, the hacking team leak. Those that would like to see what is in the arsenal these days, look at that. Have a look at this. Rohamma, do you remember what Rohamma was? You do. Rohamma, you can influence memory cells by using neighboring memory cells, and that was interesting. We always knew that there are nice things lurking in Hardware, but the way that could be used, that was kind of funky, and surely there's more to come there. And this is how we exit from this, right? This is just the amazing thing. That was this. We give you $50 every month if you have this box and put it into your network at home. That looks very serious, very respectable. What could possibly go wrong?  I mean, they steal your credit card, $30, they steal the logins to Minecraft in those games. What's that worth, another $30? And that just pays for the box, not even the first monthly rate. So, it doesn't calculate. I think they just won't give you those $50. You think so? You think they won't give me those $50? No. Well, perhaps they say, well, it didn't quite work, but plug it in again at your company office. Yeah, very clear. Did you receive the box? Could you put it in your network? Okay, we'll have to wait a week to see it work, and that's when we'll send a check. Two weeks later. Well, the check hasn't arrived yet. Well, okay, leave it in there. The check's in the post. Then, sorry, we know just, we could be, we were able to speak with the box for a short time, but your internet is so bad, you should call your internet service provider and then perhaps plug it in the company, la la la. And finally, then you have those millions of phishing transfers. But you have a nice little box. But some people are trying. I'm really astonished, wow. Okay, we have seven minutes left for the whole of next year. So we'll have to overwrite, overrun a bit. So the evil hardware category, which of course is the same thing as software, we did talk about last year, we did talk about the fact that devices are so, that are clearly too cheap, for which there has to be a second monetization scheme. So, these things phone home and then give the user's data back. That's just a start, though. Because by now, with these huge devices, of course, you can involve several parties. Let's think of a notebook. You have the people that buy, they build the hardware, the ones that build the interface, the firmware, the operating system, build the graphics card, and all of these build in their own phone home service. And just think of smartphones, if you have standard phones such as Android and put in a few apps and leave a client running around for a while, then the data plan is empty quite quickly. And that's the way it will go with our beautiful Internet of Things. Now, this development, which is inevitable, of course, because somehow you have to win the price wall, coupled with other things such as this, probably devices from Java. There are people that printed this, printed the sign out in A3 und hung it outside for Halloween. What's the thing circled in the graph there? Credit card. So, this is all taking place on several levels. This is not patched. There is no update function. So, there's only one thing that can result from this. The Internet of Dust Catchers. Those are those old boxes that really catch dust and put on a layer of ancient dust and you then find some things in the bit where the DSL arrives. The good news here is the power of Ethernet is not something that people in the Internet of Dust Catchers can do. And these adapters are so bad. They all died too quickly or they cause a fire. I was talking to a fireman the other day and asked what are common causes of fires at home. Well, the typical thing is kitchen, Christmas tree, children playing with fire. And then in fourth or fifth place catch fire and I have a suggestion for the Internet of Dust Catchers. Evil networks, net neutrality. We don't have that anymore, not really. So that was that. And it will get worse before it gets better. If software defined evil in your Computing Center, I think you are having taking too much of a negative view there. Can you do dynamic segmentation here or whatever, everyone can. Also, you have more things to patch, right? Right. Genau. Well, this is reality. In Germany now with this refugee ID card these people have become the better testers for what the government is going to become. One card for using all kinds of government services has positive upsides and downsides. The interesting question is where the upsides, the potential upsides are the necessity to have a million or more people go through the education system because this is the only chance that may lead to positive things happening there. I am very much interested in what's going to happen there. Was bringt es zu den Employee-Citizen-Life-Cycle-Management-Topic? Life-Cycle? Auf einem bestimmten Level, ja. Wenn das Lifestyle nicht korrekt ist, dann wird das Lificycle zu short. Ist das Soilengreen am Ende der Chain? Ja, wir sind vegetarierend, sonst machen wir uns kein Soilengreen. Was macht sie aus, ist, dass sie sich als Zitizen wählen wollen.  Das ist nicht nur ein negativer Punkt. Es gibt auch sehr interessante Papers von Leuten, die sagen, dass ein Employee in eine Komponente enthält und ein Staates aufhört. Er soll sich selbst oder sie selbst nicht befreien und fühlen, auch wenn sie gehen. Da muss man mal sehen, was in Firmen, was möglich ist, in amerikanischen oder englischen Strukturen, was unterschiedlich ist, was man sich für Zitizen benutzen kann. Da ist ein bestimmtes Wastetag.   Man kann sich von einem bestimmten Bullshit-Talent verraten. Das ist ein Fritz, erlaubt zu vertrauen. Diese sind große Fragen. Diese Leute haben dieses Autonomous Vehicle. Also diese lustigen Konzerte?   Alle zwei Stunden, ne? Alle zwei Stunden, ne? Ich glaube, 3.000 in einem Monat? Ne, ne. Alle zwei Stunden. Ich glaube, es sind etwa alle zwei Stunden. Okay, so. Es ist ein Li-Wei da, aber nicht so viel. Und dann gab es Honepots, Honeenetz, Honeetrain. Da gab es Honeetrain. Einen, der simulierte Honeetrain auf der Internet. Und dann sah man, wie das attackte. Und dann gibt es diese lustigen Konkurrenz.  Oh, no, they are all real. These are all the real power stations, nuclear power stations. Don't ever believe that these are simulations. And steelworks simulators. I'm sure that's the excuse of those that broke one of those last year, right? And then there is the simulated company. We had secretive researchers that complained that the companies that were attacked didn't publish enough about this, the way the attacks took place. And the response was there was very busy and that won't help them. Just simulate your company and look how that is attacked. Okay. Right. So, ToxFox for hardware. ToxFox has an app from the faculty of Germany. You can have a kind of barcode and then the app tells you what if you should eat it or not. Oder war es nicht mehr so schmiert ihr das nicht ins Gesicht? Put it in your face or something like that. And it's crowd sourced. So, you can upload the table of contents. It's great features and stuff. And you can write an e-mail to the manufacturer and take this out of your stuff. And we need that hardware. If I wanted to buy a pacifier six years ago and I stood there in the shop. I didn't understand why one company was sold out and the other one was for that. It came out and there was BPA in every other one except for one. And you don't need one at your electronics store. Oh, the router doesn't have a firmware update anymore. I'm not taking this one. Das ist keine Selbstverteidigung. How do we want to survive the next Christmas? Ich geh's dann durchs Heim. Okay, lassen wir das weiter machen. Trendsport, reversing firmware, that's a new unboxing. You know the videos where I bought this, my new gadget. I have to celebrate this by unpacking it. The hacker asks, why is he stopping now? Where's the screwdriver? Das ist das. Das ist, was we want to see, YouTube-Videos, where they continue, where the unboxers stop. Unboxing. You take this screwdriver, pentalobe, and the JTEC is here at this point. And then you put this on there. And then you take these per script and put them to that. And they exist, but not enough of them. And get that one. Coupling dating bots. Ah. I thought about this before. Like this. Take a dating portal, portal B, and dating portal B. And then you put there, I talk a lot of people dating books and then couple them. And it scales. Also meine Vermutung ist, meine Vermutung ist, dass es wahrscheinlich auf die Art und Weise am ehesten Schwarmintelligence entstehen kann. I think that there could be swarm intelligence coming out of that. This is my assumption. I'm not sure if you agree on that. But yeah. Silicon Valley versus UK and China. And the tech companies deal with the British and the Chinese and the Americans. The China has this law. The UK has this. We have been, this is going to be interesting. But I want to tell the activists in these countries, go to your representatives, tell them, listen, if you're, if you. Der nette Mann vom Geheimnis stehen und dir dein iPhone wegnehmen. Damit leben kannst, kannst du dem Set zustimmen. So tell representatives, like if you agree to this law, the guy from the Secret Service on the way out of this parliament, they're going to take your iPhone away. And if you can live with that, then it's okay. Then have a look at the next year or the next, the following. A company like Apony, that positions itself very, very strongly. The question is how they act when the British say all the crypto in Britain has to have a backdoor. If they go and say, well, oh, we can't sell you iPhones anymore, that's bad. Don't close down their companies, because they can sell Max and stuff, and a couple of TVs. And we have to, had to get rid of a thousand appareas, you know, make a number of languages. And that's the left variant. They can, we think about different levels. If you turn on the iPhone, you know, it asks where you live. And if you say you live in the UK, it says I'm going to have to turn off all crypto. Are you sure you're living in the UK? That's another variant.  And the Manhattan-like project that Hillary Clinton wants to build backdoors, the assumption was that Trump also said something like that. We called Bill Gates and all the important people and talked to them. And then we defined a Manhattan-like project, not in order to shut down the internet. Lock the doors of the old one. Maybe they want to put a lock in front with keys. It will be interesting in the next year. We wish you have a lot of fun with the machines and have a happy new year in 1984. Thanks for listening. This was Julian and Sebastian. If you have any kind of feedback, please use Twitter and write us at C3lingo, use the hashtag C3T. Let us know if you listen to the talk in English. Just write something. Thanks for your feedback. We love to hear from you. Goodbye.


Hello everyone, welcome to Shangri-La's academy. The civil service examination result for this year has been announced and 993 aspirants have cleared this prestigious examination. So out of this 993 aspirants, 336 students are from Shangri-La's academy. So huge congratulations to all of them. Today we have with us Ms. Arya Vihem who have a second order in the rank of 36 with us. So welcome Arya and how do you congratulations to you from me and the whole center family. Oh thank you. Arya, how do you define this success? I usually follow a code by Winston Churchill that says that success is the ability to go from one failure to another without the laws of enthusiasm. So I was someone who prepared myself a lot to accept failure this time I must say because I thought me going to interview to be a good fit considering so many uncertainties that I faced in the preparation journey. So I thought the ability like I tried to master up as much energy as possible to try my best for the next problems I started solving question papers from 17th of April onwards which was five days after my interview and I was solving questions just two days before my results also. So I thought I defined success like that and even now I define success like the same like it is the ability to move from failure to another without the laws of enthusiasm and also to move from one success to another without having a sense of pride and also being condescending like condescendingly. Okay that's a great way to define success. Okay Arya, we all have that point of time that specific spark which makes us to do or not to do things. So according to you what was your initial spark to come into the civil services? Okay it happened sometime when I was in my 8th standard I was going on a bus and I saw a lot of things like littering over there and I don't know whether it will sound very philosophical or not. I saw very big bungalows and so many huts like standing adjacently. So it was just this whims and fancies of an 8th standard student who thought that an IPS officer or an IAS officer can make things right. Again it is something that movies instilled in me and that is that spark. Arya as you said you got the spark now you are in this journey. So we have as we have in the roads we have the twist that turns the red lights, the green lights, the ups, the downs and at one specific point of time we have to take that u-turn. So how did you get to that decision like what guided you to take that decision? I'm someone who actually started with the speed breaker I should say. After my masters I wanted to join a civil service academy and pursue civil services. I came in here I inquired about fees and how I should go about doing it then I got to know that it is very costly I must say and not just fees but also getting accommodation paying for that. My parents were ready to pay but I had a terrible sense of self-esteem so I just wanted to do things myself. So I took a small break I started teaching over there and then once I came back to this preparation the biggest hurdle that I faced was I was a teacher now I should be a student and listening patiently to classes taking notes has become a very difficult task for me and then I prepared and then came again another major hurdle that was COVID. Like I had online classes I'm talking about I had COVID and it was very difficult for me especially during that COVID days to sit up and attend classes but fortunately the exam got postponed so that was again my accelerator over there. I thought that okay I have got some months in my hand so I'll give a very good try this time and I tried and I actually expected myself to clear my first problems but that was the biggest setback I had in this preparation journey I should say I couldn't clear that problems and I must say that it was a very difficult time because I was I got JRF but I was sacrificing that for pursuing my passion so everybody was coercing me to go for a safer option that will be a PhD in a very reputed university but I could have secured them or to go for another job I did write many exams but again I couldn't clear it and I had to even come back home after my first problems so that was a kind of a red light for me and then again there was a sea of advices and I was lost in taking the right one because I was someone who had little what like peer group in the beginning but later it evolved actually but I was not sure whether I was doing the right thing and when to I talked to two people they'll be telling absolutely contradicting things and when I am watching YouTube videos I have seen toppers talking about some toppers will be talking about the importance of logic some toppers will be talking about gaining maximum information somebody will be talking about studying 16 hours a day and I was like okay I'm not in for this but later things turned out well for me in my second problems I could clear my second problems and then came means and then I saw one of the biggest red lights in my life that was my optional because my optional English literature it was not a very popular one and we hardly had any testers for the same and I myself was thinking like am I going myself into a gamble because it's like you have cleared problems but you don't you don't have a testers you don't have a mentor you don't have any answer keys and are you like putting all your hope over something that you are not sure of but I had no options but to go forward as Robert Frost said I chose the path that was less traveled but however it was my optional that paid me off and the moment when I got to know that I cleared means that was the what is the most unusual moment for me I will place it even over my current results because I was someone who didn't expect me to clear means but however I could clear that and then it was like okay now I'm going in front of UPSC I'm going to talk to people I'm going to talk to many people which is something that I loved and also I'm going to talk in front of UPSC which is something that we have usually seen only in movies like for a person like me I have seen that only in movies so that was like a cinema moment for me. Cinema moment like there is one interesting I will I will catch that so what was that specific moment okay and someone who watches a lot of movies but I don't know anything about technically or I'm not a critic either but cinemas or series I should say something that sustains me a lot so when I was just in front of my interview board like we will be asked to wait in front of that board for some time like we should ease our tension somehow so I just did a small swing movement in front of that was not filmy but that was something that happened like I didn't dance outrightly but I had a small I did a few steps and then when I went in surprisingly I haven't mentioned movies anywhere in my daff but I talked a lot about movies in fact I consider myself who talked a lot over there and I talked about uh Pariyar Mirmal I talked try talking about Darjeeling Limited but I mentioned some other name over there so that was very filmy for me and even my moment of success when the results came out in Mararalam there is actually a dialogue where a person who is winning a lot is at Dichamone at Dichamone moment was there yes yes you talked about moments so can you please revisit your moments the moment you felt happy you felt excited and you felt sad so those moments okay first of all talking about the moment of happiness this is something I haven't talked much I'm someone who had slight signs of clinical depression when I was preparing especially during my maids so after writing my maids when I talked with my psychologist she told me that you have evolved a lot okay I have seen you in a very bad position and I could with slight mild depression I could write my maids and the success came later but I could write it I could muster up all my courage and might to write it and after doing that she told me that you have grown a lot and that was a moment of happiness because it's like I have pushed myself up my moment of excitement came actually in one of the most unlikely places that was during my interview in front of my interview board because I was someone who's not very happy before going into like that inside that building but once when I got in when I signed that those papers I actually saw that like I am there in front of UPS like I am inside that circular building and I'm going to phase a board and when I went in like when Satyavati ma'am she was my panel member she asked wish me out Arya I said I was like yes ma'am with all my mother this I will not advise that but that was a moment of excitement excitement for me then talking about the most frustrating moment this is something that might be faced by many girls of my age when I go for each and every marriage they'll ask me about when am I going to get married and for somebody who was honestly preparing for you to see though they didn't know this but to expect that a girl of 26 should get married otherwise she'll be run out of demand in the mark marriage market for something that frustrated me when talking about the moment of being helpless I should say that again it happened during my maids I had some maids exam which was part conducted by other institutions like SSA and all emits my maids exams and I also tried sidelined all those exams and I went in for UPSA but when my first full test results came I scored very low I thought I have done myself well but I scored very low I was not certain about my optional also then that was like a moment of helplessness because it was just one week before the exams and I couldn't do much then but again later it turned out that that evaluator that person just stuck on to a key and then evaluated me but however that moment was like very helpful because my three months of hard work and me sacrificing a lot of other jobs for this preparation going wrong and I felt very helpless then I literally there was a veranda where I in that reading room that I used and I just went in there and cried but looking back I think those cries were answered or those prayers were answered then coming to a moment of being blank I should say after seeing 2023 question paper like on one hand I felt very relieved that I'm out of the loop but on the other hand I was like what will I tell to my fellow aspirants because I had seen the question paper and it was a completely new pattern like we had state they asked statement questions they asked about a lot of animals the squirrel that I could see the elephant that I could see assumed a lot of importance in my life or it would it will assign a lot of importance in my hello aspirants life so I felt bland with the sense of relief but also with the sense of concern I must say but I think aspirants are stronger enough to come out of all those uncertainties definitely they they are becoming stronger that's a different case so we all know the exam is getting tougher and tougher and there is this nature of unpredictability for the UPSC so even considering that fact the aspirants they are having this concern like the exam is getting tougher and tougher year by year so how to tackle those things like this last this year is in 2023 prelims is one of the toughest exam connected by the UPSC so what's your take on this for the aspirants I'd like to consider prelims as one of the biggest tests for testing the grit of an administrator maybe or as we'll serve it maybe because once we are into the service too as the surprises that's provided by UPSC we'll have we'll be having a lot of surprises from the system and from society but I think what that is important is yes we will be we'll be having a moment of shock and we'll be shaken for some time but to reinvent ourselves within a short span of time that's very crucial for a civil servant so with this prelims especially with GS1 what I found was that yes there was a very big pattern change but we could apply the logic that we usually apply for eliminating options in order to ascertain whether a statement will be right or not and then it will take some time it is not easy but that is the only way that we can come out of it so with such kind of surprises I think we should do the best that we can do with it and especially another paper that is getting tougher year by year is CSAT paper it was meant to be qualifying but it is eliminating these days so with that paper I think again it is a test of time management and also decision-making of an administrator because time management in the sense that we should pick up those questions that we will be capable of doing within that two hours so that we can qualify and decision-making I'm not talking about comprehension but I'm talking about selecting that some questions that you will be able to do and avoiding some questions understanding that it is tough and you will take up your type I think that paper is crucial in that manner and again there is no substitute for practice in UPSC so practice as much and again be ready for surprises then fight it out till the end of the last moment are you your interview score was 193 so that's a true score so what was your moment of conflicts I had this huge debate about whether personality test is an interview where questions will be asked we should just answer or is it really a test of personality going around in my mind that's when I attended a panel mock in Shankara IS and I could also have got the opportunity to meet a few toppers like Meera Ma'am and another topper from 2020 so that was the moment like I was not very prepared then I just had what I am my usual talking stuff with me and a little bit of preparation on my back but during my first panel mock it actually went very well and Raja sir he constantly told me that just be yourself you'll be able to do it and that sheer confidence that sir vested on me and like he used to repeatedly tell me and even Lena Ma'am used to convey that to me that I just I should just be myself and it was that conference that will carry me to the list or any other place I could and that was my moment of confidence are you your option was English so English literature not everyone takes that option so all over India there were very few aspects who take English as an option subject and you scored a very huge mark as we said you scored 299 marks in English option so how did you do that now what was your strategy on that I was a postgraduate in English literature so I had my postgraduate subject among the optional optional sister out by UPS so that was my first obvious reason to choose English literature more than that I knew that there were so many uncertainties associated with it but when I just went through previous year questions and also the syllabus I got to know two things one most of the texts that was mentioned over there were part of my either UG or PG syllabus so these were those were basic texts that will be familiar to each and every literature student and two when I just went through the previous year questions I put zero in on four or five themes that's there for each and every text so considering that I have done my masters that job was actually easy for a master student because I just want to study four or five topics from that and most of the patients in that optional came from the syllabus so that gave me the confidence because choosing other optionals for me was like building a house from the scratch but for me English literature it already there was a foundation and a small hut was there I just want to build on that so I chose to build my house in English literature are you how your options of the English literature how it helped in your GS book reference I'm not saying that the proficiency of an English literature optional student is required for GS however it helped me in many ways for instance when it comes to essay I usually used to start with a code or a form like for instance when it comes to this year's essay I started with a code by Savitri Bhai Bhule and I think that helped me a lot and even when it comes to GS answers rather than writing something like it reduced it eliminated I used synonyms and that helped to create a kind of lively feeling like I am writing the same thing but it will sound like I am writing different things and again when it comes to interview my language helped a lot again I will not say that it is very necessary to speak very fluent English when it comes to interview but again applying with words will help us to catch the attention of the board at the next page yes and it will help us to be confident there are a million aspirants who apply the civil service examination every year and among these million people only a selected thousand gets selected I'm not getting the exact facts but still approximately a thousand people will be getting a from these 10 lakh aspirants so there is a huge majority who get ousted from the civil services so what's your take like what can you say to those people like people who are not getting into the services when it comes to UPSC the numbers are really huge but I had a friend of mine who used to tell me that don't think of permutations and combination when it comes to UPSC just do your job and my fellow aspirants who may be finding themselves in a very difficult situation right now I would just like to say that don't give up on yourself like sometimes the whole universe may be conspiring for you sometimes nobody will be rooting in for you but as you are following your passion and if you are putting in your effort be confident about the effort that you are putting in and even if nobody is there to push you or nobody is there as a beam of hope for you just be your own light and just don't give up are you satisfied initially when I saw the results I had a great sense of satisfaction because I got everything that I asked for but then I saw a lot of people coming with me with a lot of hope it's not the hope that they have placed on me but it's also the hope that they have in this institution and in this system and that I think is a very huge responsibility and I think I'll have miles to go before I sleep and then only I'll get that sense of satisfaction you're going to make the future but still I wish you a great future ahead from me as well as from Shankar Ayesha Academy the whole Shankar family thank you thank you thank you


Hello, you're watching People's Dispatch and this is the second part of an interview with Ahilanka Dergamar, a senior lecturer at the University of Jaffna. In the first part of the interview, we looked at the origins of this economic crisis as well as the food insecurity that many Sri Lankans are facing. In this part, we'll be looking at what happens when Sri Lanka accepts the conditions of an IMF loan and is there any possibility of re-envisioning the economy of Sri Lanka? What steps need to be done to undertake that? Yeah, on the IMF, as I mentioned, we've gone through, you know, 16 IMF agreements, the most recent ones were after the war in 2009, then again in 2016. You know, in 2016, many of us analyzed what that agreement involved and the recent IMF staff report that just came out a few days ago is repeating many of the points that were said in 2016. It's the same recipe, except Sri Lanka is in a much harder situation. We are not in a position to be able to negotiate. We are in such a weak position, begging from every bilateral actor and every multilateral actor. So this time, the conditionalities are going to possibly actually get implemented and that's the worry. But how did we get here? We didn't have to go to the IMF. For two years, they sat on it. The opposition also did not try to push the government to change direction. They have also been saying go to the IMF. The government quietly has been wanting to go to the government. Our think tanks in Colombo, which are mainly neoliberal think tanks, they've been calling for. So this common sense has been created that the IMF is the magic bullet that is somehow going to solve this crisis. A comrade of mine, Devaka Gunavadana and I think in the next day or two, get to bring out an article in the Daily Financial Times in Sri Lanka on what we're calling a post IMF crisis. Our economy is unraveling and within it in the next two years, because it's now a moot point. We are going to the IMF. The government is definitely heading in that direction. We have to worry about what the consequences are going to be and declines. It's really going to be a crisis for the people. The foreign earnings of this country are earned by working women, as I mentioned. Women working in the PSA, women working in the garment sector, migrant women going and working under horrible conditions as domestic workers. And what did we do with that? We imported luxury goods. We beautified the urban areas. And now again, the fix is going to be austerity, which is going to affect the people. And that's the concern. And I mentioned our long history of free education, free healthcare, and various government services. 99% of Sri Lanka is electrified. And the people who use the lower limit pay about a fourth of the production cost of electricity. Now, what is one of the IMF demands is that you market price energy. What are our fisher folk going to do with these huge increases in global oil prices? So it's going to be a real crisis for the people. And so it's just the beginning in that sense. So what is the alternative? It's the question that I also often get posed if you're saying don't go to the IMF or the IMF is going to create a crisis. What is the alternative? And one, I think it's really important that we prioritize our imports and we recreate a public distribution system. We had a robust public distribution system until the 1970s. There was the cooperative wholesale establishment, the food commissioners, department, all of these together allowed for the state to import essentials and distribute it to the public. So we need to reestablish that public distribution system. We need to prioritize our imports, giving importance to the food system because it really has become a food crisis. We are really concerned that you might be reaching family type of conditions. How are we going to provide this relief? How are we going to subsidize it? Already taxes have been cut, the economy is shrinking, incomes are falling and there are a number of businesses that are going to go bankrupt as well. So it's very hard to increase income taxes and we don't want the value added taxes. So we need something radical like a wealth tax to be able to redistribute wealth. Given that wealth distribution has been in the other direction from the bottom to the top, now we need to figure out a way to really distribute wealth to the working people. And then a focus on agriculture, the rural economy and the food system. So we need to, you know, and this dependency on tourism, obviously Western actors, powerful agencies want a country like Sri Lanka to consider tourism as the way forward because it keeps us dependent. They want us to go through an IMF agreement and continue to go and borrow in the international capital markets where we borrow sovereign bonds, US dollar loans, which are on the average, the last 15 years, 7.5% interest rates. So every 10 years, by the time you repay it, we double the amount that we have to repay. The interest costs have become equivalent to the principal. So we need to change our economy. We need to think of ways of developing. We need to substitute for imports. So there needs to be a whole re-envisioning of our economic trajectory. And that would only come when there is a reconfiguration of political forces. An economic crisis of the scale is definitely going to lead to a reconfiguration of political forces. And the danger is that it can also be towards the fastest direction. It could be a fastest fix or it could be a progressive alternative. I think it's going to be very difficult to continue in the direction that we have continued so far. Absolutely. Thank you so much, Ailan, for that very illuminating analysis of what's happening right now. What are the parts ahead? We'll be following what's happening in the coming weeks and months as well and hopefully be able to talk to you on what happens as well. Thank you so much.


Good morning, everyone. I'm really excited to be here. This is my first time and the CD mini summit the first time I see many of you in person. So I'm really really excited about it Today, we're gonna talk about tecton chains and how it works a Quick introduction about me or for those of you that doesn't know me. I'm a developer advocate leading redacted this year I'm a CD ambassador. I'm really excited about it And I'm also in the organization of a Kubernetes community days Italy And I'm out of those two books modernizing enterprise Java and gtops cookbook And I have a link at the end of the session So you can if you want you can download those those books for free. So let's go ahead and let's start with that. Why? You usually when when you buy a car you expect that any part supply to be genuine, right? Moreover for those, you know expensive card you expect those are perfect and What about the software should be the same? When we use a software when we buy a software when we you know Adopt a community software. We expect this software the component of this part are all genuine a lot good This is a very important topic. Let me share some scary numbers with you. Those are the percentage of Supply software supply chain attack over the past three years 742 percent 20% data breach compromises software supply chain but the the good number also that teams are start started the doing initiative to bring DevOps and security together because them the attacks are increasing in the software supply chain and Those kind of those are the most common attack right dependency confusion a stolen certificate malware, you know my ransomware any any any bad thing around but you know dependency confusion and a Compromised build environment. Those are also very common attack So let me start with this tail right a software development tail Here's I really like this diagram because show how development works for for any company now for any Project so you have some developer teams that start developing an app one of more application, right? development usually obtains local laptop local workstation or remote or Even though I'm using directly Kubernetes, but this is what we call the inner loop when you start coding building the bagging hopefully testing The software and then you start pushing your code into git So you do a git action. So your development is in the inner loop When you move things to production or to deployment to the CD part to to quote Jeremy, right? Let's talk about the CD This is called the outer loop. So you move your software your artifact into Kind of an automation that build your software and here's you in this outer loop You can have a pipeline that build run compliancy test run security test integration test unit test Deploy your software artifact into one or more environment and and then you are ready then to push this to production now you see those those are two loops and they are very close to a Forming an infinite loop because when something happened in the outer loop You got to go back in the inner loop or you need to add a new feature So it's a continuous inner loop outer loop and then the connection is always a git action So you have a git push then you have a Pull pull request. So you start with the code review and then you send to probe I had that to this diagram. This is really this arrow here the devs a cop So this means that security should be in place from the first time from when you start a code to when you Deploy this code into production. This is the ideal flow And today we're gonna focus. We're gonna talk about the outer loop how tecton and tecton chain a really help implementing Security aspect for your pipeline. We're gonna talk about it in a moment I want to sometimes I make some history jokes this month today. I Borrowed the Joffrey Chaucer Contemporary tales and this is the start of the contemporary tales Adapted for you know, this context one that dependency and this out at so yeah, I'm not gonna say in all English But this is really cool, right? because this is a kind of a song that Is a in to the dependency Dependency and dependency tales what I want to say is that we're gonna talk today about how to secure the supply chain and how Our how opens our software like tecton help with that Before we go ahead into into it. Let me give you some terminology for those of you. Maybe not not aware of these Terms. So one of the most common term is a SLSA, which is sub supply chain level for software architect artifact and then there's a zest and then you might have heard about CVE when there's a vulnerability There's some CVE published in in some public website That there's this bomb the software bill of material The sick store, but the the important thing today is also the attestation and the provenance So attestation about authenticated statement about metadata about the software architect artifact We're building right and the provenance is the record of the region the history and who made the change so it's like more kind of a git but more on the software artifact and SLSA is a very important the specification and define also some levels So level zero is a you know a best effort is a kind of a dry run And then you go into more levels. Let's say level one level two level three level three is really the one that the prevent Vulnerability prevent injecting the dependencies Not expected. So level three you might want to have SLSA SLSA level three in your outer loop and Here's the another good diagram about the shift left. No We start, you know from the final up goes to your user and then You have the user use some networking and they go to production now production is the final result of all the them They are Tifa software artifact. No promote it across development QA staging But you everything start as a you as a developer coding and pushing into it That's that's why the community the industry is promoting also a Shifted approach from source to product and what what about this the coding part? When we talk about coding we need to we usually have use our favorite package manager for Java It's pom for Python is peep any any any of this right and we have our dependencies. So It's kind of automator, right? You I need an HTTP library I'm writing in my Pomex ML something and the maven eventually downloads two gigabytes of stuff I don't know what it's doing, right usually like this and But if you analyze what what is doing under the hood? This is an example with maven Dependency tree it's downloading lots of stuff, right? And we don't really Look at it where we we we have it as a given, but this is also very important. It's the way An attacker can inject a vulnerability as a malware Or is a single point of failure if you remember when that guy from MPM Removed that no JS library and basically stopped the world for for some reason or if you think about the vulnerability Log for J Java, you know, that is really severe that that was a something the people start recognizing about dependency Important after these issues basically, let me show you some open source friends that help you implementing the shift left approach So you start with any git repos you get Git SCM you can be github githlub whatever you want to use, but Most of the time your production is Kubernetes, right? And Kubernetes today is the factor standard for application deployment application workloads and so Kubernetes has a really rich ecosystem of project to to build software and one of this is tecton and Today we're going to talk about specifically about one extension of tecton called tecton chains that help implementing provenance Implementing at the station together with other open source friend like cosine Which is another open source software that can sign artifact and other Software like Claire Claire is an open source software that scan container image Consult a public list of CVE this kind of image give you a result per layer Then if you're using kubernetes, you might want to use policies and open policy agent is really a popular open source software for that and that you might want to deploy software in kubernetes So tecton usually can build the software can also deploy of course But usually build the software sign the the task sign the container email and then you you can deploy the Argo CD But any software for the gtops, but Argo CD one of the popular one So here's an opinionated open source chain for building secure software chain So we're gonna focus today on the safeguard of the building system so we're gonna focus on the outer loop and I know some some of you are directly involved into tecton development, but I was wondering How many of you are already using tecton? Yeah, that's a good number. That's a good number for those of you not aware of tecton Tecton is open and open source software Governed by the CD foundation that provide the kubernetes native CICD on kubernetes This means that you don't have to install an external Software to run CICD on kubernetes. It's native You just install it those what is called those API called custom resource and you have Pipelines in say kubernetes so you can do kubectl get pipeline or kubectl get pod. It's native to kubernetes So that's the default choice when you have when you want to come have kubernetes being a CICD system The good thing of tecton for those of you not not aware of it is that is declarative like anything in kubernetes You declare the state the decided state of your pipeline as an API It's composable you can insert into a pipeline multiple tasks. It's reproducible and it's a cloud net It means that you it's it's native to the containers and kubernetes A quick recap of the concept because in the quick demo we're gonna see really briefly some of this So the pipeline is a pipeline object for pipeline API that can contain one or more task The task in the pipeline can be sequential or parallel But inside the task you have multiple steps. Those steps are sequential and under the hood those steps are just container image That are executed just because tecton is a kubernetes native. Everything is a container So a step is really a container can be a script in the container by it's a container running and The task is a pod is a pod running in your in your cluster Let me show you a quick tecton architecture So basically you define the pipeline that pipeline contain the task Here's the thing different if you use a other software for CICD outside Kubernetes also the running Object is a is an object is a kubernetes object So you can do a kubectl get pipeline run to see the live execution of your pipeline and the pipeline run as a task run inside So when you run the pipeline under the hood you create basically a Task that represent a pod So you have your pipeline is the decomposed by a task the task is a pod inside the pod You have multiple containers that represent the steps. Those are the Overall picture. Let me focus today on tecton chain So tecton chain is part of the tecton ecosystem and it has been had just to add those Secure supply chain component. We were talking about how tecton chain can do that. Well, it can sign task and with sign task result with cryptographic keys and they can also do attestation format like in total We'll we'll look in in a second So can essentially can sign the execution of your task as a software artifact and can also sign the container image that you Generate it so you can I'll show you In the demo in the registry you can have some kind of a tick that display that this is sign it The the in total attestation is Authenticated metadata for one of more software artifact. This is how it is defined in the in the official website So basically you can sign an OCI image OCI is a crony that means open Container initiative. So any container image today is an OCI image docker images Pogman generated images, whatever is a is an open format So you can sign this open format container image and then you create sign sign at the SLS SA provenance attestation for the task run and the pipeline, but not only the Say the software sign it the content and image sign it But also the pipeline run is sign it you are signing everything in your outer loop I Like the logo of SLSA this cyberdike is super cool But what what do you mean that the sign at the SLS SLS say provenance? It's used for verify which build system produce the attestation how the build system was used So it's a complete Verification of everything so, you know in usually in git you can see who mates what right in the code What about in the build system who mates what who did that who signed this is that valid or not? So in this case you in this way you cannot inject dependencies not expected because those are not sign it and Well how tecton chain know that a task run or a pipeline built an image This is done via the what is called type in thing So when you create Container image on OCA OCI container image you have the URL or the image digest this I just This digest is used and then it's gonna be a sign it So tecton build a container image generate and hash that this hash will be used As a digest and that would be will be signed Will change just sign the man the image yes can also Create a pipeline that pretend to build a certain image. Yes tecton can can be can be all of this And I want to show you in particular like James Brown here doing This I want to show you a demo and for the demo I'm using the official documentation You know usually I take the official documentation example to verify that our that works are up to date So if anything and we can send a full request But this is really cool because it show a really good example of sign and provenance tutorial So the first step is you have to generate a key pair with cosine It's a public key private key pair. So you do your signing with basically this is a Asymmetric cryptography once you generate a cosine pair basically you go you can configure tecton chains and you can tell tecton chain to use SLSA and then you can Create the secrets in the namespace of tecton chain containing your your cosine key the generated key Private key in this case and and the public key So you you configure tecton chain and then you move into the into the pipeline So in this example, we're gonna run a pipeline doing a canico task. Canico is a is a It's a building mechanism as an open source software that can build containers from a Docker file is agnostic So this task will generate a container image This image will be a sign then push in a public registry I'm gonna put to quite a yo is similar to Docker app and we're gonna see that this is sign it so This is also important the step for Chain observable the task run the snapshot the task run and then convert the snapshot to standard pilot format Sign them and store them in the metadata. So let's see that in action. This is the first demo Let me let me check why I'm at a much time. We have we might have used just this demo, but let me check this so I'm doing this demo and I'm using my Quaio registry and I want to show you that there's this There there's this CLI called tecton when you use tecton you can use This CLI that's really help you starting a pipeline. I'm using mini cube in my virtual machine I'm in my Fredora workstation. I'm in this namespace So I'm starting a pipeline that essentially will use this task that I have already downloaded And I'm show you what is this task about? So this is a tecton task that build a container image from a Docker file It expects some Docker file somewhere and then it pushed this container image into a registry somewhere So it's really simple task, but this is just used to to show you how it works Designing everything. So let me grab the log of this it takes some second to start the poll So when you use tecton and you start a task, this will create a pod So now this is running is a running pot in the Kubernetes cluster and it executing a step Each of these are steps. So those are containers into the pod And as you can see is building the container image and is and is pushing into a registry now Let me check what well, let me show you what what what this done? I'm gonna do a tecton TaskRound LS and I want to see if that is sign it so I'm gonna do a tecton The task around describe this one Let me check in the into the annotation here's I hope you can see Yes as you can see this annotation has been add and this means the tecton is Signing this this task and also you have a name and you have a Navidence of everything that is going on into into them Into the task run And I want to show you that also your the container image that we generated Has also an evidence on the registry so we're sending this we're sending the container image over here as you can see This is a little tick here This means that this tag has been sign it with cosine now. I'm using quail that also perform some security scan Under the hood where you use Claire Claire is the open source author that perform the scan So not only you signed it the task you sign the container image with the with the hash you generated Also, you can perform some security scan you can have this in you into your your kind of a outer loop to build the mechanism So that was the one part and I have my script here because I want to show you that you can also verify with cosine that Your public key has been used to to sign that image and then you can verify the attestation I'm gonna run this the command So you can see the output live And we here we should have the payload of the for the hour in total attestation so we also verify this with with cosine and then we can also a Click all the record click that help us giving more info about What we have done? Let me check. This is another click and a lot It's part also of the all the tutorial and give you for the for the container image give all the info What happened for the SL? SA Provenance attestation Mechanism that we did with a Techno chain. So that was one example. I want to show you another exam another demo. This was on mini cube but I Want to show you this that read that also build assas around all of this so tecton chain and The building mechanism can be can it go can be anyone Open open shift in skate the Kubernetes open policy agent So everything is over here and this is implemented the SL SA level 3 So I want to show you if we have time are a real app Please stop in when when we have to stop I have a real application here, which is there read that cool store So it's a store where you can buy cool swag like read that hat By the way, if you are interested that the hat is at the boot tomorrow at the conference So here we are out of stock, right? And this is some micro service base application I'll show you so I have a front end I will one or two three micro service for the back end Let's say I want to make all this from the inner loop to the outer loop in a secure way I can implement in my Kubernetes cluster through all the software component I was talking to you about but you but I want to show you that you can also use Assas like this that implement this and you can do the same on your own cluster if you want Let me show you how this works. Let's imagine we We do one change in our in our software like we want to increase the the quantity of Of the software, let me do this one so let me do I want to show you the full story if we have time if we don't have time I'm gonna stop and I show you that what I already deployed, right? So I'm gonna start this Java application the development mode, which is also as a Continuous testing mode for some reason my port 8080s, but I don't need it at the moment Let's imagine we want to increase that Fedora quantity not to 10 and I'm gonna go ahead and I'm gonna resume the testing So the first step in your secure software supply chain is to verify in the inner loop if everything is fine Now, you know, I changed the code. I haven't updated the test. This is really bad So I need to update my test as well and acquire cruise and the continuous And the continuous testing mode really really help with that Let me check what I've done here Look that's failed Job and I'm making something really bad. Oh the port 8080s build. Okay. Sorry. Sorry about it And for some reason the port 8080 is a is is busy But I wanted to show that, you know, you need to update the The the test you need to eventually perform some security scan locally and for that, you know, we Read that provides on what we call the dependency analytics report the pen extension. It's just an extension that analyzes your Dependency file like a Pomex ML and provide you early some security scan So before you push before you move into the outer loop, let's say this is in collaboration with Nick I have some I have some kind of important Severity in my in memory database. So let's say let's imagine me I'm not gonna use the memory database in production. So let's let's imagine this is good But here I could stop no, I can I can stop I am I can about sending this to production now Let me update the quantity to 10 and let me push Add into the staging area. I want to show you what what what you what you can done So when we push the application when we get push a web book Automatically will start a tecton pipeline and this this this tool is using a pipeline as a code To to to build a automatically the pipeline. Let me show you the source code over here There we go So when you use the tool is gonna inject in your git repo tecton pipeline as a code and for any push or any Poor request this is gonna start there again the pipeline with the task and the task is gonna build everything now This is something you can build out of the box without tecton chain but let me show you the cool thing when you use tecton chain and and all the ecosystem, you know, you can perform your pipeline security scan and Here's some something cool Not only the clear scan so the container image scan the anti anti-virus scan But also the software bill of material check Sast check so it's a complete suite and and the tecton chain then is used to push this image into The query just so I'm doing the same stuff. I was doing into mini cube. It's a little bit more, you know It's more more Extensive, right? But I'm showing you that this application which has been pushed into Into the production. Let's say with the tool is using a container image on this registry again And this is sign it with a tecton chain and cosine in the same way We were doing with a with mini cube So as you can see I'm using the same mechanism from a SAS and that SAS is also adding more stuff Like enterprise contract Anti-virus scan image can container image scan So you can really build something similar on your own with your Kubernetes cluster with tecton tecton chain Claire OPA and Kubernetes Argos CD. You can automate really everything and the good and and GitHub is not respond and and the good stuff is that you can take benefit of all opens or software for creating your secure software supply chain Now those where the demo wanted to do but the pipeline is gonna take some minutes to do the scan So we're not gonna see this live. Maybe we can check later But this will update the quantity in stock. We can have more Fedors to share tomorrow with you at the boot Don't don't forget about it. And what about the other tags that might interested you we have this panel about Secure software supply chain if you are interested in on the topic, please join as this is on Tuesday So it's tomorrow. It's we're gonna talk about SLSA and we're gonna talk about open SSF So you are you are more in security and those topics. Please join this talk because it's really interesting That was the talk. I hope you enjoy the live demos with all the consequences and If you are interested to know more about tecton, this is I think this is a good book because it starts from zero to get ops So there's a is a list of receipt containing how to build containers how to create Helm chart how to use customized and then it goes into how to create tecton pipeline work tecton task and then move into Argo CD how to Use Argo CD as a CD tool and and then tecton other kind of a CI CD tool So there's no tecton chain in version one, but I hope to add the version do the tecton chain part If you are interested to know more about red dot and red dot developer join us on developers with that I've come with many things of free books and tutorials and everything around developers and yeah Thank you all


In 1972, a French factory began importing high-quality rare uranium ore from Oklo in Africa's Gabon Republic. Many quickly began to wonder where they had acquired such a difficult thing to make. It turned out that the uranium had come from a place which should have rewritten the history books, yet it seems to have been quietly brushed into the archives of the past. They found the site of origin had functioned as a large-scale nuclear reactor. Amazingly though, this reactor was in operation some 1.8 million years ago, and was functioning for over 500,000 years. These unbelievable claims were not made lightly or indeed by anybody. They were conclusions by some of the greatest minds on Earth. For example, Dr. Glenn T. Seaborg, former head of the United States Atomic Energy Commission and Nobel Prize winner for his work in the synthesis of heavy elements, explained to the press why he believed it wasn't a natural phenomenon and must have been a man-made nuclear reactor. He stated that for uranium to burn in a reaction, very precise conditions are needed. The water must be extremely pure, much purer than exists anywhere naturally. The material, U-235, is also necessary for this type of nuclear fission to occur. None of the isotopes not found naturally in uranium. Additionally, several specialists in reactor engineering have also come forward to testify that they believe the uranium in Oklo could not have been rich in U-235 enough for a reaction to take place naturally. It must have, somehow, been a man-made operation. And new research has only deepened the mystery, confirming that water regulated the nuclear reactions in a cyclic pattern similar to that of a geyser. Alex Meschik and his colleagues at Washington University of St. Louis have determined that the Oklo reactor, which comprises several separate sites, ran for 30 minutes and then shut off for two and a half hours before starting over. The time is characteristic of water infiltrating rocks and then being boiled off once reaction started. The water all boiled away, the reaction stopped until new water percolated back down. This geyser-like activity also prevented a runaway reaction. It's amazing it didn't explode, Meschik said. Instead, it efficiently released energy in short pulses for an extremely long period of time. Just who could have possibly been around over 1.8 million years ago? Or more specifically, able to enrich uranium and create nuclear power? Is man's history on Earth really that old? It seems, according to numerous nuclear specialists and the compelling evidence they present, that is exactly the case. The Makati-Kati in the Kalahari Desert of Africa was once an enormous lake. It stretches some 65,000 square kilometers, about the same size as present-day Lake Victoria. The basin is seriously old. Things have remained in their resting places upon the bed of this dry lake for many thousands of years, giving researchers from around the world the opportunity to find things out about our distant past that may have otherwise been impossible. Oxford University's researchers of the School of Geography and Environment, for example, have unearthed new evidence in the Botswana region that suggests the area has endured many drastic climate changes throughout its long history. The upwards of 600 different artifacts have now been recovered and catalogued. The research was apparently prompted by the rediscovery of what are believed to be the world's largest stone tools, thought to have vanished over 25 years ago. The discovery of the four giant axes had not been scientifically reported. It seems the collection was intended to disappear, but was instead thankfully buried within archives until now. Four giant stone hand axes, measuring over 30 centimeters in length and of an unknown age, stone tools suitable for men far larger than we are today. Professor David Thomas, head of the School of Geography and the Environment at the University of Oxford, said, quote, Many of the tools were found on the dry lake floor, not around its edge, which challenges the view that big lakes were only attractive to humans when they were full of water. As water levels in the lake went down, or during times when they fluctuated seasonally, wild animals would have congregated around the resulting watering holes. It's likely that early human populations would have seen this area as a prolific hunting ground when food resources in the region were more concentrated than at times when the regional climate was wetter and food was more plentiful and the lake was full of water, end quote. Co-researcher Dr. Sally Burrow has dated the sediment and shorelines of the lake basin, which has shown that the lake was filled with water on multiple occasions in the last 250,000 years. New research began in 2010 and funded by the Leverholm Trust and is investigating possible links between the lake basin and the Zambezi River, while initial discussions are in hand for setting up a major international georchaeological program to further unravel the complexities of the lake bed. Although these stone tools suggest early man co-inhabited the basin with a giant species of humans, the researchers are clearly distancing themselves from such postulation at this moment in time. There are many ancient relics strewn across our planet, which are unimaginably ancient. Hidden from inquisitive minds, often by a variety of factors, millennia of undergrowth, conspiratorial bodies, or even personal perceptions of historical truth. However, there lay a far more interesting, far more inspiring tale resting just beneath the surface of this illusion, just waiting to flourish. Previously, we covered some of the amazing discoveries made by a man known as Professor Pottini, in particular, his extremely peculiar stone found in 1990 within a diamond mind in Sierra Leone within West Africa. It is known as the Sky Stone. Numerous specialists have analyzed the stone and concluded that it is somehow made of pure oxygen, with a color source which is, as yet, unknown. Unbeknownst to many, however, is that Professor Angelo Pottini had many strings to his bow. He was a geologist, a botanist, discoverer of emerald mines, an expert in the precious stone Lapis Lazuli, along with many other talents. And although many perceive his Sky Stone as a defining discovery, we feel his actual defining discovery, his legacy left upon the unexplained mystery history of our planet, can be found elsewhere. He did in fact, during his lifetime of exploration, indeed discover something unique upon our planet, something undoubtedly important, immensely ancient, and quite possibly, a last remaining remnant of an unimaginably old civilization which was once found upon the African continent. Found during his ventures deep within Sierra Leone, West Africa, the Lady of Mali. He examined the land at the foot of her mountainous form, and according to his calculations, the stone monument was indeed man-made, and carved well over 12,000 years ago. Reaching an astonishing 1,500 meters in the air, it is an image of a woman's figure hewn from an entire face of Mount Lore. Predictably due to modern academia and the entrenched, paradigmically cast spell upon many modern fields of study, the only explanation that can be ascertained for this clearly man-made, highly ancient artwork is that it is merely a coincidental natural formation. In an interview with journalist Carmen Mikado, Petoni explained that the statue is located to the north of the city of Conakry, and close to the country's border with Mali. The geologist estimates the Lady of Mali to be some 20,000 years old. This concluded through the observations of displaced motions within a natural rockfall he found within the Lady's form. He also spoke of caves in the area, which contained mummies guarded by the locals who he claimed rumored of their, quote, Atlantean origins. Unfortunately, Professor Petoni died in 2009, so any other invaluable information he may have acquired regarding the area went to the grave with him. However, the Lady of Mali remains and will undoubtedly live on for many years to come. Just who could have built the Lady of Mali? Is she really a 12,000-year-old relic left by a pre-flood, pre-cataclysmic civilization or merely a natural formation? Do you believe an opinion based on a historical assumption, or one based upon explorations investigations resulting in unexplained physical artifacts? We will let you decide. Around 150 kilometers west of Port Maputo, South Africa, the remains of a huge metropolis can be found. An ancient site measuring an astonishing 1,500 square kilometers in size, suspected by some to in fact once have been part of an even larger civilization, estimated by some to have been around 10,000 square kilometers in size, and constructed 160,000 to 200,000 years ago. The region is somewhat remote, and the stone-circle remnants were only ever encountered by local farmers who assumed they were made by some indigenous people within the past. Amazingly, or rather conveniently, modern archaeology has seemingly forgotten to investigate this amazing place. Fortunately, this all changed when researcher and author Michael Tellinger, in association with Johann Heiner, a local fireman and pilot who had actually been looking at these ancient ruins for years, decided to investigate. Heiner had the unique opportunity to see these incredible structures from the air, and knew that their significance was undoubtedly not appreciated. Quote, when Johann first introduced me to the ancient stone ruins of Southern Africa, he had no idea of the incredible discoveries we would make in the following years. The photographs, artifacts and evidence we accumulated all point towards a lost civilization that precede all others, not for a few hundred years or a few thousand, but many thousands of years." According to Tellinger, these discoveries are so incredible that they will require a complete paradigm shift in how we view our human history. Quote, I see myself as someone quite open-minded, but I admit that it took me over a year to figure it out, and I realized that we are actually dealing with the oldest structures ever built by man on earth. We have been taught that no ancient civilization of significance ever existed within South Africa. Powerful civilizations all emerged in Sumeria and Egypt and other places, Michael Tellinger stated. Regardless of what certain individuals claim regarding the age and indeed size of this site, it is certainly of historical significance, going against all currently upheld understandings of the timelines regarding ancient civilizations within South Africa. As Dan Eden from Viewzone put it, quote, I would suggest that the Sumerian story was given as a base metaphor for actual ancient cataclysms that caused the diminished planetary resonance and a spiritual injury to the psychoacoustic field of human consciousness. He continued, The tablets of Sumer describe the Anunnakai as a race of extraterrestrial beings who enslaved humanity for the purpose of exploiting our goal for protective use in the atmosphere of their home planet. I understand the Sumerian mythology as a metaphor for the cataclysmic changes that occurred in the deep human past, which offset the psychoacoustic balance of human consciousness. End quote