Hi friends, welcome back to my channel and a very special welcome if you're new here. My name is Jen, I'm a certified weight loss and nutrition coach. I follow Weight Watchers and I count calories and macros. Happy Monday, it's Monday, so it's meal prep day. I am filming this on Sunday, of course. I just came back from a massive hike. I hiked to the top of a mountain into Sond. It was incredible, the view, the view was worth. High up, really hard hike. It was definitely, definitely worth it. Came home, getting my meals ready for the week for success. So if you're excited and you can't wait to see this week's meal prep and give it a big thumbs up, make sure you're subscribed and your bell is turned on because I upload a meal prep every Monday in five videos per week. Check out the description box down below where you will find nutrition coaching. I do offer personalized to you macros and calories. Highly, highly recommend. This is how I have lost the majority of my 136 pounds and I have one-on-one coaching. If you would like to chat with me directly, links, discounts to my favorite things, my recipe website and my Facebook group. Come join us over there. Are all down in that description box. So let me turn you around and let's start cooking this week's meal prep. My breakfast this week, I'm making cranberry orange bread but like I mentioned in my grocery haul, we're subbing cranberries for mixed berries because not a store in town is carrying cranberries right now. So I actually have some frozen mixed berries that we're subbing in place of the cranberries but it's still going to be such a great addition to a healthy breakfast. So let me show you what's in our recipe. First, you're going to need some orange juice. I am subbing the flour in the recipe with the Kodiak power flour. There's 10 grams of protein per quarter cup of this flour. So it's a great substitution for regular flour to really up your protein. I buy this at Walmart. I find it in the aisle with the other flowers. I also know that you can buy it online on the Kodiak website. So you could buy it there if your Walmart doesn't have it but I love it. It tastes just like regular flour. You cannot tell the difference but you get all the protein. I'm using unsweetened applesauce in place of the oil slash butter in the recipe. Salt, vanilla extract for sweetener. I have my Lakonto granulated which is my all-time favorite. Sweetener alternative. I'll link Lakonto down below with 15% off site wide. I have baking powder, baking soda and orange. I'm still going to put the orange in here. I think it'll pair really nicely with the mixed fruit. One egg and then I have the triple berry blend from Costco, the organic triple berry blend that we're serving for the cranberry. So to get started on our bread, we're going to start with our dry ingredients. So I have two cups of the Kodiak power flour, three quarters of a cup of Lakonto granulated, salt. I will link my gravity fed salt and pepper grinders down below. I just bought these on Amazon. I love them. And then we're going to add in our baking powder and baking soda. So two teaspoons of baking powder and half of a teaspoon of baking soda. And then stir that all together really well until fully combined. Now we're going to add in our wet ingredients. So I have one cup of orange juice. We're going to do three tablespoons of unsweetened applesauce, a teaspoon of vanilla extract, two cups of frozen or fresh fruit. And then I'm going to zest in my orange. Give everything a good mix.  It was some non-stick cooking spray and set your oven to 350 degrees. Can you hear Palmer squeaking his toy? Palmer got a new toy at the worst time right before I started my meal prep. So you may hear some squeaking in the background until he shreds it, of course. Our berries definitely made our batter an interesting purple color. So we're going to add our batter nice and even to our greased loaf pan. And it's going into a 350 degree oven for about 50 to 55 minutes or until it's cooked through. So insert a toothpick, make sure that it comes out clean. I just pulled our bread out of the oven. It smells so good in here. I'm so excited for this. I'm going to allow it to cool. We'll slice it up so I can show you what a serving size looks like. And I'll give you all the points, calories, and macros. For my lunch this week, I'm making a loaded bacon burger bowl. I'm so excited for this. It is everything bacon burger without all the carbohydrates. So this is going to help us get in our greens. We're going to get in some vegetables, lots and lots of protein. So let me show you what's in our recipe. First, you're going to need lettuce of your choice. So I'm actually going to do a mix of spring mix and arugula. I like the kind of peppery vibe of arugula. So I'm going to mix those two together for the salad base. You're going to need some salt, dill pickles, any dressing of your choice. I'm going to use the light ranch. The recipe actually has a homemade dressing option. I'll make sure that I put that as part of the original recipe on my website if you're interested. But for me, light ranch will do just fine. I also have some sliced up mushrooms, cherry tomatoes, a pound of 96% extra lean ground beef, garlic powder. I have a pound or a pack, not even a pound, I guess, of sugar-free distilled turkey bacon. That's going to be in place of regular bacon, a onion, avocado, and a red onion. So the first thing I'm going to do is get my bacon in the oven. I forgot that this bacon crumbles after you freeze it, which is completely fine. We're going to crumble it up anyways for our burger bowls. But be mindful of that if you do buy the distilled brand, which I buy half of imperfect foods and you freeze it. It has a hard time keeping it in shape. There's no added sugar, really clean ingredients. I'm guessing that's why. And super low-fat, very lean bacon.  Now I'm going to do some chopping. I need to chop up my sweet onion and my red onion. And I'm going to use my new knife. I know she looks stout and scary, but this knife is incredible. I've been using this now for about a month or so. It's from the brand Eno King, Eno King. And you can pick it up right off of Amazon. That's actually where I bought it. And because she is, she's stout, it also comes with a case to store it in. So I've been just washing it and putting it back in the storage case and putting it into my drawer. It works so well to chop. I especially, especially love it for chicken. It just glides right through chicken. Tomatoes is another thing that can sometimes be hard to cut if your knife is dull at all. Or if you just don't have the best quality knife. And this literally just glides right through. I mean, you saw how easy it cut that onion. I really, really, really love it. So I'm going to use it to dice up these onions for my burger bowl. And of course, I will link it down below for you. To a skillet, we're going to add our pound of 96% extra lean ground beef. Allow that to start browning up just a little bit before we add in our mushrooms and our onions. Once your ground beef starts to cook down, we're going to go ahead and add in our diced up white onions. Set your red onion aside. We actually top our burger bowl with that. I'm also going to add in my mushrooms and again, the anoking knife slices through mushrooms like a dream as well. It's another one of those vegetables that can be a little bit hard to slice through. And that knife is just a big kitchen game changer. I'm going to add some salt and some garlic powder and we'll let this finish cooking completely. So what I'm going to do is put together one of the bacon burger bowls because I'll have it for lunch today. So I can actually show you what a bowl looks like put together. And then generally what I do with all my meal prep ingredients like my burger mushroom mixture, onions, tomatoes, avocado lettuce is bacon. I will go ahead and package it up and then I'll have all the pieces together kind of like a buffet style meal prep ready to go for when I want to assemble my bowl for lunch. It makes it so easy because the ingredients are prepped. I just throw them all in a bowl and lunch is served. So we're going to put one together. Like I said, I am going to go ahead and have it for lunch today. So it's about 11 o'clock. So it's almost lunchtime. I'm going to add a handful of spring mix. And then like I said, I like arugula for that kind of peppery vibe. So I'm going to put a little bit of arugula in there as well. And then I just kind of mix it up. That way my greens are mixed together. And then I have my meat mixture here. The recipe makes six servings. So my recommendation would be to weigh out the entire batch of the meat mixture, divide the number of grams, the whole batches by six since it's six servings. And that's the amount that you're going to add to each burger bowl. That's the easiest way to measure out a big batch of cooked food in general. So I'm going to add one sixth of my burger mixture on top of my lettuce. And then I'm going to top it with some of those sliced up red onions, cherry tomatoes. We're literally making a bacon burger here. Pickle. I'm going to use my amazing knife to cut my avocado. That's another thing I should have mentioned as it just glides through avocados too, which is another thing that can be really, really hard to cut. These are the teeny tiny avocados. So I'm going to add half of that. Now, of course, all of these toppings are optional. You could even add some cheese to this if you wanted a bacon cheese burger bowl. Then I went ahead and crumbled up about a slice and a half. You need eight slices of bacon total for six bowls. So yeah, about a slice and a third of the bacon topped the burger bowl with that. Now I'm going to grab my food scale and we'll measure out our dressing. I measure everything in grams. For me, that's the easiest, most accurate. So I'm going to do two tablespoons, which is a serving, which is, this is 30 milliliters. Okay, so we're gonna do it in milliliters. Instead, usually it's in grams on the back, but this is in milliliters. So we're shooting for 30 milliliters. And there we have it. There is our bacon burger bowl. Doesn't this look incredible? I mean, bacon burger vibes all the way without all the carbs and all the unhealthy fat. Plus, we're getting in a good amount of vegetables and greens. I'm super excited to make these up for lunch this entire week. So my bread is cooled. I want 10 slices. I'm going to use my no-king knife again. I'm telling you, look at how it just glides through everything. It seriously blows my mind. So we're going to cut each half into five slices. Still a little bit warm. I could have let it cool just a little bit longer, but we're gonna make do. So I have my 10 slices. I am going to put these in a storage container for the week, but let me show you. Look at how amazing this bread looks.  She's still a little bit warm, but this looks absolutely amazing. And we really amped up the protein using the protein flour. So my plan is, is to have a slice of this with some eggs, bacon, yogurt, cottage cheese, some other type of protein source every day for a really well-balanced, healthy breakfast. But like I said, this looks amazing. And I will go ahead and put points, calories, macros here on the screen for you. For dessert this week, I am making protein brownies. I'm actually really, really excited for these. I'm upping them my protein game with my Kodiak flour to even add more into these brownies. Chocolate chips, it's going to be amazing. So let me show you what's in the recipe. You're going to need unsweetened applesauce. This is in place of butter and oil in the recipe. Salt, a chocolate protein of your choice. The only one I have on hand right now, I actually just ordered the Ascent. It's not here yet though from Amazon, RV's Vade protein packs.  You just throw them into water, it dissolves, it's covered in pretty similar to what's on a vitamin. So totally food safe, soluble. You throw it into water, shake it up and you have a really yummy protein shake. Since it's the only chocolate protein I have on hand, I'm going to use that. I know it's going to add some really good chocolate flavor. I will link Vade down below with a discount for you guys. I love them, if you are on the go a lot, if you work outside the home, if you're in the car a lot, it's the easiest way to get in your protein and it tastes so good. I have the chocolate milkshake, which is my favorite. And I'm replacing the regular flour with my protein flour. I have my La Contra granulated, Lily's chocolate chips, vanilla extract, eggs, cocoa powder and baking powder. For our brownies, super simple, everything's going into one medium bowl. So we're going to start with our one cup of flour, one third cup of unsweetened applesauce, two thirds cup, La Contra granulated. I'm just going to pop open my pack of protein powder. I figured this is pretty close to a third of a cup, which is what the recipe calls for. 200 chocolate chips. I always have a mix of Lily's, La Contra, all the sugar-free chocolate chips. We're going to add two eggs, two tablespoons of cocoa powder. This is unsweetened cocoa powder. Pinch of salt, teaspoon of vanilla extract and one teaspoon of baking powder. Mix everything together really well and then we're going to grab out an eight by eight, six by six, whatever you have on hand, brownie pan and spray it with some non-stick cooking spray. I did have to add a little bit of water to my mixture. It was just way too thick. So feel free to add water, milk, whatever you want to use to get that right brownie batter consistency. I'm going to add it to my sprayed baking dish and then I'm just going to spread it out nice and even in the bottom. And here are the brownies. They're going into a 350 degree oven for about 20 minutes or so. We want to make sure they're cooked completely through. Protein brownies are out of the oven. These fluffed up really nicely. They smell super, super chocolatey. I'm really excited for these.  I'm really excited for these this week. I'll go ahead and put points, macros, calories here on the screen for you. Thank you for joining me for this week's WW Meal Prep. I hope you enjoyed seeing all of these really healthy recipes. They are protein packed, they are delicious. I have eaten that burger bowl and it was one of the best things I've ever had. It definitely could use some cheese. So if you have the points or the calories, you can definitely add a little bit of cheese, make a bacon cheese burger bowl, but it was absolutely delicious. I mean, delicious, highly recommend. Of course all the recipes are on my website which is down in the description box along with nutrition coaching, links and discounts to my favorite things and don't forget to come and join our Facebook group. We'd love to have you. Thank you for watching, happy Monday. Here's to an amazing week and I'll see you in the next one.


Good afternoon, and thanks for attending the most exciting talk at the OSS Summit today. I'm a little biased, I admit. But it is the end of the day, so I hope that no one falls asleep. It's going to be pretty action packed. There's a lot of information. And there's a lot of content, so let's jump right in. So this is securing your infrastructure as code pipeline. And I am Jesse Sanford. I'm a software architect at Autodesk. I focus on platform engineering and secure software supply chains, and I speak at conferences like this, contribute to open source. And when I'm not in front of a computer, I like to sail and get outdoors as much as possible. So a quick agenda. First, we're going to talk about whether or not infrastructure counts as software in today's world. And next, we're going to level set on some definitions. And after that, I'll pose a supply chain security risk scenario, and we'll look at a mitigation technique that's a variation on talk I did at KubeCon North America last year. And finally, we'll look at an incrementally better solution before we get into some questions. So we're here to talk about IAC, supply chain security. But I have a question. Is infrastructure software? Can I see a show of hands for anyone who thinks so? All right, a little mixed bag here. All right, well, I would posit that with the massive adoption of public cloud offerings and platform as a service, or as a services generally, that more and more of what we traditionally thought of as infrastructure is actually software, or at least software-defined. And so even if you were to push back on networking and other plumbing, what about your databases? What about your file and blob services or your caches? And even if you were to push back on those, increasingly these things are controlled by automation. And that automation is definitely software. I mean, we call that automation infrastructure as code for a reason, right? But what is infrastructure as code, really? Well, first of all, it's code. So it's codifying the intent of a developer, good or bad. As code, it's repeatable, diffable, automatable. Second, it's usually executed in highly privileged environments, creating everything from networks to user accounts. So common examples, cross-plane, Pulumi, Terraform. And there's others, like cloud provider specifics, like cloud formation from AWS. Next, there is software supply chain, which is very similar to what you think of supply chains elsewhere. It's all those upstream things that you build and use in your product. In software world, it's usually code. Sources are compiled. You may have or may have not had any hand in creating it. There's a lot of code that runs in and around your production stacks that you didn't write, OSS packages, language packages, Kubernetes, the OS running Kubernetes, hypervisors running your OS, developer tools, build tools, all that stuff. And increasingly, much of that software is open source software. And you don't necessarily know who wrote it. And you don't necessarily know if you can trust them. And you don't know how to hold them accountable if they break that trust. All of that's actually a very good target for attackers. Now, with those definitions in mind, let's set up this problem space. Autodesk has been on a platform journey for quite some time now. And critical to that platform journey is our deployment platform, which we call CloudOS. CloudOS handles our application delivery. And it does throw through the use of a declarative format, which we call an ADF, but it's essentially a YAML file that contains a manifest of infra and app artifacts to be deployed. And that ADF starts its life out as YAML, as I said, and then goes through some homegrown tooling built in Python and Go and JSON it, and it's turned into Spinnaker pipelines and also Terraform, which in turn produces those cloud resources that we use by our products. What about that Terraform, though? Where does it come from? Well, frequently it's created by our internal teams, but they often rely on open source providers like those produced by Hashicorp and others. And how do we really know who produced those providers or those modules that they find out in the wild? What if they're produced by bad actors? To be fair, it's not just Terraform that has this problem. Almost all IAC tooling comes with some pluggable way to extend its functionality. And usually there are numerous community providers or extensions. Here we see crossplane in the hot seat. And IAC is great. And it comes with a lot of benefits, as previously mentioned, but it does require a lot of permissions to do its job. It needs that power by design, but it's very important that it's secure. So what can we do about that? Here we see a familiar CI-CD flow that I borrowed from the Celsa project. And the steps that you see here should be familiar. I'll fill in some icons that are more infrastructure as code specific. You can see that we have GitHub storing our source, Jenkins building our modules, and a Terraform registry down below, which are hopefully visible, that's storing those modules. That's kind of like the public Terraform registry. It could also be an internal GitHub. You can source Terraform modules from GitHub as well. And you can see those modules are getting pulled in as dependencies there in the middle to be used in other modules before being deployed out to our cloud provider. And so now let's take a look at where those threats are. Same thing also from Celsa project. There's a lot of red there, a lot of attack vectors. Pretty scary stuff. To help defend against this, at KubeCon North America last fall, Jason Hall and I proposed a way to create a walled garden for our ISC and its dependencies. We showed that our current solutions are more like this than this. And in that talk, we showed that by centralizing the execution of our ISC and layering on Kubernetes RBAC, we could choose who has access to install and manage that ISC and also who can use it. The solution we proposed was for allowing cross-plane to actually verify packages signatures using cosine, signing and verifying those packages. And the OCI package format was handy because both cross-pane and six-door cosine are able to read and write it. And so we showcased the work that we'd been doing with the cross-plane community to enable that. But what if we don't have the ability to use cross-plane? Can we still make use of these tools? Terraform has a lot of inertia in a lot of companies. Autodesk is no different. And we absolutely can. And this is what I hope to show you today. But to do this cross-plane or not, we still need a funnel. You have to control what's being used to manipulate your environment. And you need a centralized choke point. And the only way to do that is to centralize your reconciliation. And for a funnel, we could use something like Spinnaker, which is what we have, or Jenkins. However, to achieve any security gains, you'd still need to verify that those Terraform modules that are being used in those builds are good. And Terraform doesn't have any way built in to validate those modules. It does have weak trust of providers based on storing hashes of first execution. And if you don't know, that's very similar to the SSH error message you get when you log into a server after an IP address has been recycled. But it doesn't do anything for the configuration composition of modules themselves. And again, we talked about this last KubeCon. If you're interested in the security gaps in that model, go ahead and watch that replay. And I demonstrate a dependency confusion and typosquadding issue that could lead to some very bad things. So what can we do? One thing we could do is introduce static analysis scans. We could check that all the modules being used for a particular execution are checked for known misconfigurations and vulnerabilities. And this would work, but it requires a lot of duplicate scanning. Even if the scanners are quick, just the idea of adding additional scans to every deploy is controversial. And our developers really bemoan any additional time spent in CD pipelines. So each module is not just one module, either. It also adds some unknown number of submodules, and all of them could be good or bad. And we can do better than that. And thankfully, there is a better way. By using the TF controller from Flux to centrally execute our Terraform, we can build a pipeline that largely mimics what we built for crossplane. This is because the TF controller can utilize Flux's built-in OCI registry type to manage Terraform modules, basically wrap Terraform modules in OCI images. And we can also require that a passing bone scan is done before sending that OCI repo definition off to Flux. And additionally, when Flux reconciles that definition, we can require that the module image be signed by SIGS or Cosign before pulling it. And finally, at deploy time, we can know that only signed and attested modules are being run against our AWS environment. This is our wall garden. So I mentioned it a couple of times now. Let's quickly review what SIGS or Cosign and the rest of the SIGS or tooling is. There's a number of different component parts, but the three critical pieces are Cosign, which does the cryptographic signing of the images and knows how to interact with OCI registries. Fulcio, which is a special purpose certificate authority that can issue short-lived X509 certs in exchange for OpenID Connect tokens. And Recor, which is a transparency log which records that exchange and also assists in the verification of those short-lived certificates later on when doing the signature validation. So a demo. I had a bit of an infrastructure failure earlier, and so I'm going to resort to slideware in my apologies. I think that the images are going to be high contrast enough, and we'll get the gist of it. So here you'll see a Jenkins file that's going through a bunch of shell steps. I hope that some of it is visible. But at the top, we clone a repository. And then below that, we move a TF file within that repository to a main.tf. And then we run checkoff on that main.tf. So it's doing the static analysis on that main.tf with an output of a Cyclone DX JSON format, which is a format for S-bombs. And then we take that S-bom and we cat it out so that we can see it, but then we also push the flux artifact that builds that OCI image with flux to a GitHub OCI registry, which is just under my name. So it's basically taking the contents of that Terraform module and wrapping it in an image and pushing it to the OCI registry. After that, we're down here now. Sorry, guys. After that, we tag that artifact so that we can find it later. And then we run cosine on that image to allow for to have cosine sign the image. And then we again cat the cert that cosine uses the short-lived cert so that we can see the contents of it. And then we take that S-bom that was produced earlier and we attach it through an attestation to that image with cosine as well. And then we validate that the attestation is there inside the OCI registry and output the contents of it so we can take a look at it. So that's basically what we're going to walk through. So here you can see Chekhov doing its static analysis. And it's outputting that Cyclone DX S-bomb format here. If any of you are familiar with S-bombs, it usually lists the contents of the software. Since this is a static analysis vulnerability scanning tool, it also lists any vulnerabilities it finds. And you can see the components that are contained in the module on the right-hand side, so the hashes of the files that are contained as well. Finally, at the bottom, you see those vulnerabilities that I was just mentioning that Chekhov found with the default policies that are built into Chekhov. Of course, you can write your own policies and then run it against that. And those will also be output by Chekhov. This is very useful info, though. Already we have something that's very useful. So now for flux, we create that OCI image like I was mentioning before. And we push it with this artifact command. And we push that to that GitHub repo. And we can tag it with the main tag so we can find it later and reference it. Now we see cosine signing that image. And it's essentially saying that, hey, this image was built on our Jenkins. And we know that this TF module was composed and built on known-good Autodesk Jenkins process. And we can see that the short-lived public certificate that was output starting to kind of be catted down below. And that's the certificate that was issued by Fulcio. And we'll output it to the console. And inside that certificate, if we inspect it, we see that the subject alternative name is the spiffy ID that we expected for this Jenkins node. So we can customize that to meet the needs of our workloads. And it also shows the OIDC discovery URL that we expected. So we know that this particular certificate was issued correctly. Now we can see cosine signing and attaching the SBOM as an attestation in that Cyclone DX format. And this is actually stored on the image inside the OCI registry. So the attestation and the SBOM, the contents of that SBOM, live side by side with that image inside the registry. So this is very handy because you can now query anything that can pull the image can query the contents of those attestations. We can actually see the contents of that SBOM by using that cosine verify tool that I was talking about before. It actually will pull that OCI image down, pull the metadata of the blobs that are associated with it. And then you can look at that attestation right there straight out of the OCI repo. And it is the same SBOM that we showed earlier as expected. So now let's try to use that image. We have this Terraform module stored in an OCI repo. Flux knows how to use that. Let's try to ask Flux to pull that image. And here you can see a Flux OCI registry type, an instance of the OCI registry type, referencing that image that we had pushed earlier. And when we apply that, we expect to see it show that the artifact was correctly pulled and stored above. But oh no, it did not do that. It actually says down here that it failed to verify the signature using the provider cosine keyless. And as it turns out, that's expected. But at least we know that it blocks modules from being used that it doesn't trust. Unfortunately, right now, using private recore and full CO servers with the TF controller doesn't work. This may change. There's already this old issue in the backlog. Hopefully we can get some more attention on that. There's no technical reason why that can't be achieved. We were doing it with crossplane package manager. We can do it here as well. But until then, you can use the public six-store infrastructure. There's public good infrastructure that six-store hosts. And you can actually use your own identity federation as well. You don't have to use the identity providers that they have built in. So you can kind of make it your own. But still, it's going to expose some information. And cosine will tell you about that. It'll expose the information that's in those certificates. And the instructions on how to do that are actually pretty easy to find. You'll see them on the right there. They're actually directly inside the GitHub repository for Fulcio. It's as easy as creating a pull request really to get set up. But there may be another way. We can probably make use of admission controllers, like Caverno, to fill the gap in the meantime. I haven't tried this proof of concept yet. I know that this is actually really small. And unfortunately, I did not get a high contrast version of this. But what you see on the left is a Caverno policy to verify flux OCI. Not just OCI, but I kind of focused in on the OCI repo type. But flux sources can be verified with Caverno. And on the right, you see that Caverno can also do cosine signature validation as well. And you can plug in custom recourse servers for that. So the two of them combined should allow us to achieve that intended goal of enforcing that only signed and tested packages are able to be used by the Flex TF controller. If anyone's a Caverno expert, I'd love to pick your brain afterward. This is something that I'm going to probably be attempting very soon. But there is one thing that bothered me when I was producing that demo. And there is that gap between the step where you actually do that checkup scan. You do that static analysis. And then you attest to that and store that attestation. There's a window there where, depending on how you have your job set up, depending on how your supply chain is configured, someone could possibly spoof that SBOM. And so then you have an image inside of a repository that's supposed to be trusted with a fake vulnerability scan, essentially. But we can do better. And so to help with this, I'll introduce two other tools, Witness and Intoto. Very quickly, these tools help you use attestations to cryptographically prove all of your individual build steps and prove that they were known good. Both Intoto and Witness use the Intoto attestation format. Witness just allows you to do unplanned attestations, or attestations that are more ad hoc. You still are able to do a validation of those attestations later with Witness policies. And so it's kind of like you can build your pipelines and have a more diverse array of pipelines that are not necessarily all planned in advance. And so Witness can also be used in conjunction with another testify-sec project called Archivista, which stores Intoto attestations in a graph database and allows you to query those attestations centrally, which is actually very handy when you're building up attestations from many different places and also validating those attestations in many different places. So looking at that previous example that I gave, you can see that we still have our execution of the scanning and the signing of our S-bombs and attachments there at the top, kind of in the center, except now that we have this observant little Witness owl focused on watching them. And you can see that it's creating these attestations that are stored inside of Archivista, our little squirrel or chipmunk there. And after that, you can see that we have kind of like split out our CD process down below. And now we're kind of using Spinnaker to do our deploys. And this could just be another Jenkins job, but the intention here is that it's kind of out of band and not done as triggered by the CI process. It could be, but again, you need this extra step to check that S-bomb, to check the assets to attestations coming from Witness. And this allows us to introduce a verification step before deploying. So we have that step to check that those attestations are good and true before we do the deploy. And we've actually, you know, Witness hashes all the files as well, like when those commands are run. And it basically takes the attestations that it creates contain all the environment variables and a lot of the things that it can watch and create attestations for. And then we can compare the hashes of the files from the inputs to a command and then the outputs and then the inputs to another command to make sure that what goes in and what comes out matches what you expect on the next step. In addition to tracking the exit code from the commands, which might indicate with a static analysis scan if there's any vulnerabilities. And then we can take that, like for instance, in this scenario, we could take the hash of the S-bomb that's output by check-off and then look at that hash as that file is input into the command from cosine to sign that attestation. And not only that, Witness stores all of that in Archivista, which again is that central store. You can query from any different places. Again, out of band inside of your CD process, it's available to you. So again, just like before, we run that check-off scan for static analysis, except this time we wrap it with Witness, like you can see here. Up at the top there, it's like Witness run, and then you pass in some flags. And it does its handshakes to get its certificates itself.  And then down here, you can see that the attestations that are built up running that command are stored in Archivista at that hash. So that's kind of like the way to look up in Archivista what that attestation is. And if we inspect that attestation, which we just dump here afterwards, we can see that Witness takes notes a lot of things like I was telling you before, environment variables. You can see here starting at the bottom. When you run Witness in debug mode, it actually can be very noisy. So you need to take account for that and make sure that you understand how much data you're going to be pulling in. Also, we can see the commit hash from that current working copy that this is being executed in. And at the bottom, you see on the left, you see the start of the hashes for all the files in the working directory. So it basically walks through all the files in the working directory and hashes all of them and stores those in the attestations as well. On the top right, you see the SHA, again, that's just kind of like continued over to the right-hand side. You see the SHA of that main.tf, that main.tf that we were running the check-off scan on. And we can also see that the check-off command was run in that forked bash process. And you can see how it was executed there as well. And finally, you can see the exit code from it is zero, which you'll notice the or true statement there as a hack because I needed to have Jenkins not fail at that step. And then we can see the hash of the S-bomb, right, that's coming out of that check-off scan in the outputs of that attestation. You'll see that there at the top. So this is still from that first command, the first run of witness with check-off. And you can see that the sbomb.checkoff.json file has a hash of that, right? And we can also see the next step, which I'll show you shortly, the S-bomb, sorry, the attestation from witness for the cosine step as an input, you can see that same hash, right? And so we can basically, the cryptographically match the output from one command is the input from the other command. And this means we can prove that that sbomb that was attached to that image is exactly what it should be and no one could have attached some sort of falsified one. Finally, we can see that if we query our Covista instance, which is a running a GraphQL database, we can see that the metadata for that attestation, which we can then use to traverse the graph and find out all the information about all the bits and pieces that we saw in those attestations before. And so any tools that can access this GraphQL database can query it and then obviously you can build up policy engines based on that. So let's come back up to the surface a little bit. That was a bit of a deep dive. Let's close out with some general principles for securing our ISE. First is definitely centralize the execution of your ISE. You need to have a funnel or a choke point just like in firewalling, that's probably the most important step to getting a handle on things. Second, know your ISE sources, right? Limit them in whatever way that you can, even if you have to put in egress firewall rules to stop people from pulling from the open internet. And third, sign and validate your sources using tools like Cosign. It's a way to make sure that nothing's been tampered with throughout your build process. It's the same thing with other software supply chain security, the same rules apply here. And fourth, scan your ISE with static analysis tools. There's lots of open source ones out there, check out PF scan to name a few. And then finally, run your ISE release privilege. This one's more difficult, so that's why I leave it to last. A lot of times you'll find that folks will have, even if you have a central funnel, they'll basically be running it with a user that has all power over their cloud environment. It's tough, but you really shouldn't do that. And we all know that. And then finally, oh yeah, that cloud provider should have the facilities to be able to help you with that. You can see the cloud trail and then work back from there. With that, I'd like to thank you all for attending. I know that was highly technical. If you like this talk and like to see more, I have a lot more material that would go into this and how we can expand on this in regards to how to include Spiffy Spire and machine identity so that you can get keyless ephemeral ambient tokens. And that's kind of what you saw behind the scenes there. That's how that Jenkins node was able to achieve the authentication. Thank you. So I think we have about eight minutes for questions if anyone's interested. If not, we can, oh God, you wanna come get the microphone? I can repeat it if you can. So particularly with Kyverno, and I actually, I'm more familiar with Gatekeeper, particularly with Kyverno, it has out-of-box facilities to do cosine signature validation on OCI images. And that's basically a way to kind of handle that for all different tooling that you might have running on your Kubernetes cluster. And additionally, as another sweet spot, it has the ability to scan for flux resource types or repo types, right? So you can possibly combine the two and have the ability to say, flux, you're not allowed to use anything that hasn't been signed by cosine. Yeah, I mean, I know that my security team has promised this for a long time and I know that we have some implementations that are doing that. You know, it's an arms race when you're doing application allow listing, right? Or sorry, blocking access rather than application allow listing. So I think that what they've investigated in there, I know that there's, I'm not sure about any open source tools, although it's probably right for the picking. But I know that they have some closer solutions that we pay for that will monitor that cloud trail in like kind of observe only mode. And then slowly over time, it'll ratchet down any privileges that it doesn't see and you can kind of set the window. So if it doesn't see anyone executing a particular API call in 30 days, then don't allow those users to do that anymore. Right, yeah. Yeah, and unfortunately, you know, all of those tools are pretty fallible.  Yeah, go ahead. Beautiful, yeah, absolutely. And is it built in to be able to revoke them as well? These are stale, right? Oh, that's cool, yeah. Right, right, right, right. You gotta go through and pick through each one of them across all of your policies and do it yourself, yeah. Yeah, that's tough. Yeah, no problem. Yeah, so there is that recording from last year from Kupka North America 22 that Jason Hall and I did. And it actually goes into great detail about why crossplane makes it a little bit easier than Terraform, just by virtue of it being already being required to be centralized is one of the biggest pieces of that. But additionally, it has a package manager built into it that we can hook into some of those events like I wanna pull this and basically say, well before you pull it, check for the signature and so on and so forth. So that's basically where we injected the cosine validation, right? We put it into that package manager. And so that plus the ability to apply Kubernetes RBAC across the crossplane types, we can then say you're not allowed to use these things. In addition, you're not allowed to run anything that's not signed. So it's like a closed ecosystem. Yeah. Yeah. I mean, again, there's no reason why that can't be achieved with Terraform. Terraform unfortunately doesn't have some of these facilities built in to do things like check signatures on modules. It does have that first execution hash that it stores in your state file for providers. That's helpful. But again, how often do we ignore logging in the SSH message and then, it's not the host you expect? Anyone else? Thanks for attending guys. This is a bigger audience than I expected this late in the afternoon. It's beautiful outside. We should all get out there. Thank you.


Lieutenant Mark Pierce with Shadow Troop 1-3-3 Cav through Brigade Combat Team, 101st Airborne Division. Today or last night and into this morning we're out here conducting our team sticks focused on area reconnaissance and then the focus key task in that focus on our infiltration surveillance and reconnaissance of the area and then our excretion. So some of the key takeaways and learning objectives were the infiltration piece especially with the training we're operating now is finding the best info routes and utilizing training to our advantage to remain unseen and unheard and then also going into that detailed surveillance and reporting piece and having to be able to provide that timely and accurate. So I'll say the biggest challenge for our dismounted teams out here and based on the server operations we're in is definitely the terrain. It's not to our advantage in some cases we have to utilize a lot of micro-terrain and a lot of the sparse vegetation in order to like to seal our movements and then using that period of darkness and then our night vision capabilities are advantaged in order to get into the AO and fill in and then be able to conduct reconnaissance surveillance and then head to the lab without being seen. So this translate directly into real world because we would be expected to do this no matter we don't get to choose where we fight so the brigade will put us where they need us and we like to speak that mission so we would be expected to infill period of darkness conduct that surveillance reconnaissance and then provide the brigade the timely and accurate intelligence that they're requesting up to them and then expelling without being heard to exactly what we're doing out here was what would be expected to us in real world. Rock the song shout troop leads the way.


Welcome to the video CDs on understanding service brokers on OpenShift. First, we'll understand why service brokers are required. If you think about a typical service provisioning process in an enterprise, it's usually manual and pretty time consuming. In general, a service consumer would raise a service request in a ticketing system. It goes for approvals and some administrator will provision the service on the service provider. You would receive the credentials and then the service consumer has to add those credentials to the application to connect that application to the service running on the service provider and then start the application. That's how it gets used depending on who the service provider is and the amount of manner process involved. It could be taking quite a long time to use it this way with cloud service providers by Amazon or Azure. This process is simplified a little bit, but it's still manual as a service consumer. If you are getting access to provision your own service, then the service provisioning process is probably simplified, but you still need to get the credentials and add it to your application, which which is still manual. In addition to that, the service provisioning process itself is different for each service provider. You would need to understand how to use each individual service provider. The user interfaces of these providers are different. Once you provision the service, you need to still tie it back to your application in different ways and use it. So this is all inconsistent manual and different for each service provider. Open service broker API was introduced for the same exact reason. It's a multi vendor project to standardize how services are consumed on cloud native platforms across different types of service providers. Service broker is an implementation of this open service broker API with service broker on OpenShift you get a service catalog where you will see services provided by different service providers like Amazon or Azure or even within your enterprise. You may have certain services that you would want to run and you can make them part of the service catalog. Now the service consumer would go to the service catalog, choose a service and instantiate that the service broker knows how to provision that service and it creates a service instance and makes it available for your application to use. Not just that your service broker can also bind that service that is just created to your application so that your application can start using it. So let's look at an example of what I just explained. What you're seeing now is a service catalog that is made available on the OpenShift container platform. As soon as you log in, you'll see the service catalog. There are different kinds of services here. Some of these are coming from Amazon. There is Amazon, EMR, Amazon Elastic Cash, Amazon S3. Now you also have different languages, different databases, different kinds of middleware, CI CD. All these are provided by Red Hat. So this catalog displays services that run on OpenShift cluster as well as outside the OpenShift cluster provided by an external service provider or your own enterprise specific services can also be made part of this catalog. Let us test using this service catalog. Let's browse the catalog. I'll try to provision a MySQL database. This instance of MySQL database uses a service broker. There are two types of database instances available here and these are categorized as two different plans. One is a development which has no persistent storage and the other is a production which requires persistent storage. For now, I'll choose development. I'll select a project into which this service needs to be deployed. I'll leave the service name as MySQL. I'll provide a password. Select Next. I don't have an application to bind this service. We'll do that later. So I'll just say create. Now it says the database is being provisioned and it takes it back to the project. The service is getting provisioned asynchronously. This will take a couple of minutes. So I'll take a pause and come back. Now the deployment is running and the database part is ready. That's how you provision a service using service catalog. Next we'll learn how to connect your database service to an application that needs to use a database for convenience. I have deployed an application that's already running here, but it is not connected to a database and I also have an instance of database that we deployed earlier. Now let's see how we can connect this database to the service. This application also has a URL. We'll try to test this database. This is a PHP application. It tries to connect to the database and the connection fails. Now we'll access this service. There is an instance running one part and will select this provisioned service to create a binding. The process creates a secret which contains all the credentials needed for your application to connect to this database service. It says binding is being created. Let's click on this and see and this is the secret that got created. Let's view the secret. It has all the connection parameters that are required for your application to connect to this database. Now let's add the secret to your application. So we'll bind this database to the application that wants to use it will select an application. Our application name is DB connect will select that. I want to add the secret as environment variables and save you'll see that the application is getting redeployed. There is a rolling deployment in progress. The application just got redeployed and the new instance of application is running. Let's also look at the deployment. If you look at the environment variables. There is a secret mapping that got added to this environment and this was added by the service broker. So I didn't have to connect the application to my database manually. The job is done by the service broker. Now, let's go back and test the application. Now reference the screen and here is the data coming from the database. Let's try to go and remove that secret from my deployment configuration. I'll remove this and save it. The app gets redeployed. So we have a new instance running without that secret. Let's test it again. There is connection failure again. You just saw how the service catalog provides the list of services that you can provision how the service broker provisions the service creates the binding with a secret that has all the connection information for your application to use and how the service broker adds their secret to your application's deployment descriptor so that your app can connect to the database and use it. In the next video, we will discuss how the service broker works in detail.


of locks or and synchronization between threads right because you will have some sort of some piece of code which are critical which are basically critical sections and you cannot afford to have multiple threads modify those critical sections at the same time right. And similarly you would need some way to communicate between multiple threads you may have a worker thread and a master thread and the when the worker thread is done you should notify the master thread that with the result of the calculation right. And finally you would have to deal with exceptions so Haskell though most of the code you would write will be pure and they hopefully won't be any exceptions or errors in that code but when you're working with real world examples you have to deal with exceptions like you know network is out or disk is full or your code has to deal with them right. And finally transactions so sometimes in your code you would have cases where you want to modify multiple things multiple variables in a single atomic transaction right so that the effect is visible all at once. So Haskell provides great tools to deal with all of these so we're going to look at that then. First of all I assume that people are familiar with Haskell here because I'm not going to talk about the syntax or the libraries or how to structure code and such. I'm just going to directly jump into the concurrency tools it provides. So this is what we're going to do to demonstrate the tools. We're going to write a multi user chat right. A chat server is a typical example of a concurrent program and we'll see how we do that. The features we're going to have are very like sparse. We're just going to have a bunch of users it should be able to have like user should be able to log into the chat server and talk among each other like private messages which is what I call message here and then there'll be channels in the server in which multiple users can join and then talk in the channel so when you talk in the channel everyone else who is following that channel or in the channel gets a notification right so which I called a tell right so that's all we're going to have only two features and this is the plan. First thing we're going to do is add the ability to accept the user's connections right so you should be the server should be able to accept the user connections and keep it open as long as the user is connected. Then we're going to add user to user chat then hopefully if you have time we're going to look into user quitting and user just going away becoming inactive how to deal with that and then we're going to implement channels leaving joining channels and chatting in the


This study presents a novel approach for integrating fragile enzymes into a robust porous crystalline structure. The researchers used a pyrene tecton with four formic acid arms to create a hybrid bio-catalyst. These arms allow the pyrene tecton to be dispersable in small amounts of organic solvents, while also allowing it to form hydrogen bonds with other molecules. This allows the pyrene tecton to be linked to an extended supermolecular network around an enzyme in almost organic solvent-free aqueous solutions. The resulting hybrid bio-catalyst has long-range ordered pore channels that can act as gates to filter out the catalytic substrates, increasing the bio-catalytic selectivity. Additionally, the researchers were able to use this hybrid bio-catalyst to develop an electrochemical immunosensor that can detect cancer biomarkers at levels as low as one part per million, PgML. This article was authored by Wei Huang, Haitao Yuan, Huang Chenyang, and others.


Write evaluation methods to keep students motivated. Many factors can impact students' motivation, such as social, psychological, educational, and economical. However a teacher can still play an important role to keep the students motivated. In Afghanistan's educational tradition, students are often compared to each other, and they are ranked based on tests and exams throughout the course. Additionally the teacher corrects every student's assignment. Notice the word correct has been used instead of mark or assess. The teacher will try to point out every single mistake or error. Having six years of English language teaching experience plus observing my colleagues and students' behavior, and studying the methods of foreign language teaching, I have realized that teachers can considerably motivate their students by simply using the right evaluation methods, a teacher is able to make language learning experience interesting, enjoyable, and productive. The following evaluation techniques can be used to increase student motivation. Success and achievements. The first technique is to focus on success and achievement. When evaluating students' performance instead of looking at it with a critical eye, the teacher should examine the ways his students have been successful. This shift in point of view will change a self-centered teacher, who is always worrying about his authority and to a teacher with empathy and appreciation. In foreign language teaching this shift is vital. If a teacher looks at his students' performance over critically, he will never be satisfied because errors and imperfections are a sure part of learning a foreign language. However if the teacher focuses on his students' successes, he will be surprised to find how much they are learning, and how hard they are trying. There will always be things for the teacher to be proud of. The benefits of focusing on successes and achievements are numerous. Such a focus can build rapport between teachers and students, help students develop positive self-esteem, make learning pleasant, and lead to greater effort and success. Showing appreciation of students makes it easier for students to like their teacher, and once that happens they will take a liking to the subject. Of course praise should never be overused, or it will lose its power. The teacher should be observant and give genuine well-deserved praise in appropriate ways, keeping in mind the cultural values of the learners. Objectives The other vital method is using objectives reference testing. In the science of language testing there are two types of measurement, norm referenced and criterion referenced. The former measures a student's performance by comparing it to the performance of other students in the group. The students are arranged along a continuum ranging from the first to the last, or from the best to the worst. The result is contrasting ranking and competition. Norm referenced evaluation is like athletic competition in that prize winners are scarce. It is even worse, language learners are always competing with the same rivals, because the groups of students in classes are usually fixed. There are harmful effects for both the good and the not so good students. The former might become conceited or sluggish, for their victories seem to be guaranteed owing to the ability gap between them and the others. The latter students will become silent and humble, lose interest and self-confidence, and eventually give up trying. So norm referenced evaluation can motivate neither the better students nor the slower ones. Criterion referenced evaluation measures a student's performance by comparing it to a defined range of knowledge or skills. The students are evaluated according to standards, not each other. In classroom teaching objectives referenced evaluation relates students' performance to instructional objectives for a specific course, lesson, or task. This form of criterion referenced evaluation has clear advantages over the norm referenced method. It gives all students a chance to succeed as long as they are attaining the teaching objectives. In the long run students develop positive self-esteem and confidence, and the ability to accurately judge their knowledge and skills. Objectives referenced evaluation works well with essays. When marking an essay, a teacher does not just rank it outstanding or satisfactory in comparison with the other students' essays, and give a few comments based on a general impression. Instead the teacher judges it according to how well the student has satisfied the objectives of that particular assignment. If the objective is to develop a topic with supporting details, then this is the standard by which the essay will be judged. The other features of the essay would be dealt with on other occasions or as other assignments. Objectives referenced evaluation should be an integral part of the everyday teaching process, because it evaluates teaching results by referring to instructional objectives laid down during the planning stage. A competent teacher will not only pace his teaching properly, but also frequently check whether his teaching has been effective or not. Differentiation Last but not the least, a skilled teacher tolerates differences. Every student is unique and differs from other students in such diverse aspects as his family, educational history, learning strategies, and aptitude for foreign language learning. To detect merits and achievements in each student, teachers should be aware of the differences and acknowledge them. Teachers need to evaluate students' performance not only in light of their teaching objectives, but also with due respect for each student's individual situation. Do you want to teach English abroad? Take a TEFL course today. Finally, learning a foreign language is a long and complicated task. Learners need constant encouragement, and one of the best forms of encouragement comes from a sense of achievement and success. With a keen eye for achievement, an admiring eye for efforts, and a tolerant eye for differences and individuality, a skillful teacher can manage to enable the majority of his students to enjoy learning. A simple change in the way we evaluate them can yield tremendous results. Teach English Abroad and Online


Live from Washington D.C., it's theCUBE, covering Oracle Cloud World. Brought to you by Oracle. Now your hosts, John Furrier and Dave Vellante. Okay, welcome back everyone. We are live here in Washington D.C. for the special presentation of theCUBE at Oracle Cloud World. This is theCUBE, Silicon Angles flagship program. We go out to the events and extract the signal from the noise. I'm John Furrier. We're my co-host Dave Vellante. Our next guest is Mark Johnson, Senior Vice President, North American Sales from the public sector for Oracle. Welcome to theCUBE. Thank you. We are in public sector land. This is like the epicenter of all public sector action. The government, which we all know has been moving aggressively to a digital transformation of their own. The website crashed, I couldn't get it working. They bring the guys from California in. Couple developers, millennials probably, banging on some new code. Bottom line, huge legacy transformation. You guys have a big customer base there in public sector. What's the vibe like? What's the orientation? Are they like huddling? They understand where they're trying to go? Give us the update. Yeah, basically what's happened is with the IT budgets continuing to flat line or shrink, more and more of these government agencies are trying to consolidate data centers, consolidate their spend, try to drive spend out of the infrastructure that they have so they can acquire new technologies such as cloud. But I think from my perspective, when you look at the public sector, it's about the agencies using a lot of their IT dollars today to reinvest in their old sustainment systems and they don't have enough money to put on the front end which is net new modernization efforts. So we're seeing that. That's a classic. Dave always talks about it from an analyst perspective. 70% of your budgets used to operate not create new opportunities. In the feds it's about 80%. So 80% of the money is spent for O&M or sustainment. The other 20% is for let's call it net new initiatives but you got to parse that out. And certainly the digital servicing of having value for the audience, the citizens of the agencies is now going to be more developer for APIs, cloud computing, you're seeing cloud be a perfect fit but it's almost like it's a perfect use case for the whole inside out Oracle cloud machine because you want to provide agility and development, rapid deployment, but yet you got a ton of compliance checkboxes. Well, in the government, let's just talk federal government, there's let's say 3,500 data centers. Let's call 3,000 data centers. They're consolidating a lot of those and it's very difficult for a lot of the new cloud services to actually move their legacy proprietary systems into a private cloud. So the Oracle cloud machine actually is a perfect opportunity for Oracle to bring our private cloud into their data center and actually run their systems and actually maintain and support it. So talk a little bit more about the digital transformation specifically in the context of the government. A lot of push and consolidation is that a cost savings that can then shift into the digital transformation. So what does that mean for the government and how is that being funded? Yeah, basically the agencies right now, let's call it they have flat IT budgets. Some are up a little bit, some are down, but with sequestration, I would say they're flat to maybe slightly negative from an IT perspective. So what they're trying to do is what I've seen is there's less modernization efforts and the net new efforts, let's call it the digital government type or the net new modernization efforts are. There's very few of those right now. So basically they're trying to squeeze dollars out of their infrastructure and apply that to new initiatives and it's very difficult right now. We're seeing very few new starts. We're seeing most of their money going to sustainment, not as much going into net new programs. So when you look at the cloud, you have softwares of service, you have all the platform and infrastructure services. It's an area we're focused on, but it's a slow move, you know, the risk averse and we're not seeing them do a heavy adoption yet on that. So early days of cloud, the government, I don't know government in particular, I don't see any of them coming home early from coming to cloud, kind of made it a mandate. Cloud person. Yeah. Was that unsuccessful in terms of leading the objective and obviously going to save money and do more of that. And it's sort of, I don't want to say backfire of them, because did it not meet the expectations? You know, the cloud first initiative came out, I think around 2011. Right. They basically took the non-mission critical, like email, things like that, things that are non-mission critical. Safe stuff. Yeah, safe stuff. And they started moving those to the cloud. So in the end, they did move a lot of those systems, those applications to the cloud. And you're continuing to see them take, let's call it non-mission critical systems or applications and offload those to a third party cloud provider. As for the mission critical business, that's yet to be uptick in. But I guess, from my perspective, when you look at it, a lot of the savings comes from people. And in the government, as you know, the people are still there. So basically you have legacy systems, they need to move them off to a third party cloud provider and they need to retire the systems in order to save money. And that's the part that I don't know if we're realizing the savings in the federal government yet, but ultimately they will as they retire these older legacy systems, you know. It was a very difficult thing to do. Yeah, it is. I mean, if you essentially run up the government on those legacy systems, it's kind of hard to uncook them, right? Yeah. I'm trying to understand the Oracle play there, which is if you look at something like what we saw today announced the Oracle Cloud Machine, it's essentially a cloud. I can bring that into my data center and create a cloud-like experience. Yeah, here's the Oracle play. So one is, there's 95% of what the government has today is on-premise systems, okay? There's only maybe, let's say, 66% of it's in a cloud provider. So those systems, what we're doing is we're consolidating them, we're modernizing them, we're bringing in engineered systems. So the engineered systems are coming in and we're driving a consolidated play in the data centers to drive their costs down, let's say 50% in many cases on these applications and the statement dollars. And those dollars we're trying to reapply for net new initiatives like cloud and things like that. Okay, so Mark, we're going to break away for the keynotes in a few minutes. We've got a couple more minutes left. I want to ask obviously about the elephant in the room, so to speak, kind of a big data reference, I guess, with security, cybersecurity, huge issue, certainly for the government, not just for enterprises, but everything, what are you guys doing? What does Oracle have? I'll see the bars high for you guys. Yeah, we need to do all of them, I like to ask. Yeah, I got to tell you, Oracle runs most of the government databases. Not all, but we have a big market share. So what we do, my organization does, we have a whole security suite. I actually bring in, I have a team of security experts and basically we have a non-invasive script we run against the systems. We actually put together a profile of their strengths and weaknesses and we actually coach the government agencies on how to make their environments more secure. So it's not just technology, it's just practices as well. And it's not about selling new software in many cases, about they already own the software and the services and we're trying to make them more security aware from a layer perspective. Okay, we got a break for the keynotes. Sean Price is up next on the keynote stage. Mark Johnson here on theCUBE, breaking it down, seen by President and Federal sales for the government, public sector I should say, not federal, but all public sector. It's theCUBE, we'll be right back with more live action from DC after this short break.


ᵕᵉ ᵎ Quiz About蜋 ᵛʰᶦᵘᵏ �五ʰ⁰⁰ⁱ⁰⁰⁰ⁱ⁰ⁱ⁻⁰⁰ⁿ⁰⁰ⁱ⁰⁰⁲⁰ⁱ⁰⁰⁸⁰⁰ⁿ⁰⁀⁰ⁱ⁰⁰ⁱ⁰⁸⁰⁰⁰⁸⁰⁰⁰⁰⁰⁰⁰⁸⁰⁰⁾⁰⁰⁰ ʛ Wa are givingívämä сможSPEAK Superintendent Johnaros you can give up three examples you can give your kids how they feel you may say cook for kids cook for kids you can tell their children about cooking cook for kids cook cook వాక్వాస్బ్ప్య్ందాచినింద్రచి.


You being polite is not more important than someone else's safety. When we get into people-pleasing, we try to dial down ourselves, prohibit ourselves from speaking our truth or showing up as our authentic self, because we're more bothered about someone else's safety than we are about us being ourselves and this accumulates and is damaging to us as human beings.