All right. Hi, everyone. Thanks for attending this session. My name is Colleen. I'm the Keystone PTL, and this talk is going to be about a new feature we introduced in Keystone this cycle that's going to help give users a new way of delegating access control for application credentials in Keystone. So to explain why we needed this feature in Keystone, I first want to discuss a little bit about the traditional way we have of doing access control in Keystone. We use a kind of role-based access control where users assigned a role, but they're also assigned a target where that role applies. So we say, for example, the user has assigned the member role on Project Foo. And we call this scoped RBAC. It's kind of a unique way of doing authorization in Keystone. And the only way for a user to get a role assignment is for them to go and ask their cloud administrator to make that role assignment for them. And the meaning of a role isn't an inherent property of the role itself. Actually, we have to define the meaning of the role in config files and policy files that are distributed for every service in OpenStack. So just for example, if you created a role named Reader or if you have a role named Reader that's available in a Bootstrap Keystone, it doesn't automatically mean that a user can only do read operations in the deployment. Actually, the operator needs to go and make that configuration in all of their policy files. And so that's a little bit difficult to do. And it doesn't really fulfill our goal of being self-service, because if the user needs that permission, they need to go and ask the cloud administrator to give them a new role. And if there isn't an existing role that does what they need without giving too much access, then the operator needs to go and edit a whole bunch of config files in order to achieve that sufficiently least privileged role definition. And so application credentials are a feature we introduced in the Queen's Cycle that brought users a little bit closer to that self-service user experience, at least for authorization delegation. So before application credentials, if you were creating an application, creating some kind of automation that was going to run on top of OpenStack, you would have to give your users' own credentials to the application, either embed it in a config file or hard code it in the application somehow. And that means that the application has full access to do whatever your user can do in OpenStack. And in the worst case scenario, maybe that's even like an LDAP password. So a rogue application could have access to do anything in your organization if it had that password. So application credentials were created in order to allow users to delegate just a subset of their access to an application. And the biggest one with that is, of course, you don't have to any longer embed your own password in the application. You only share the application credential secret. And that can be revoked at any time. That can be rotated out. So you don't have to change the user's password in order to deal with a security issue. The second win is that application credentials, they only have access to a single project at a time. So you're already limiting the breadth of this application's privilege. If a user has access to a whole bunch of projects, the application credential can only access one project. And finally, at least in the first iteration of this application credentials feature, the user can delegate a subset of their role assignments to this application credentials. So for example, if the user has a member role and a reader role on a particular project, maybe this application is just a monitoring type of application. It only needs the reader role. So the user could delegate just that role to their application. But so that interface is kind of clunky because that still doesn't allow users to have that kind of fine-green control over their applications and allow them to do specific, just explicit, whitelist actions of what they wanted to do. And the user still needs to also go to their cloud administrator and ask for a new role assignment if they don't already have a role that meets the needs of what they want their application to do. So this is why we introduced access rules to application credentials. This is supposed to help with this problem by creating this as a new attribute of application credentials. So these only apply to application credentials. They don't apply to trusts. And they don't apply to regular user permissions. Those still just use regular policy rules. And it's a completely separate layer from policy. So all policy rules still apply. And they're still enforced by the service. But access rules are enforced by Keystone Middleware. And so since users are creating these application credentials themselves, they have full control over these access rules. And they don't need to know anything about policy rules. They don't need to change any policy rules. But they are not able to create an application credential that could do more than what their own role assignments allow that user to do because we're still backed by policy rules too. So an example of how you might use this new feature is here. So opposing, the user has a regular role on a regular project. But they're creating an application that's maybe like an auto-scaler application. And this thing only needs to create servers and only needs to delete servers. So the user, instead of going to their cloud administrator and creating a new role that only does these two operations, they can create an application credential that has these two access rules. And so when the application goes and tries to use this application credential on the compute service, the Keystone Middleware will check that the request matches what the rules allow them to do. And then the request is then passed on to the Nova Service. And the policy engine also enforces the role assignments that the application credential has. You can notice the syntax here. We use this bracketing wildcard syntax. And that kind of matches what the path will look like in the API reference. So this will mean that you don't have to know the server ID ahead of time in order to create this rule. You can have this sort of wildcard instance here. And another way of writing that is with a wildcard glob expression that also means the same thing. That means we don't have to know the server ID ahead of time. This application credential could delete any server with any ID. We also have this recursive wildcard glob syntax, which is even more permissive. So instead of just this application credential, for instance, could do pretty much any post or any delete operation on the compute service. And then something worth noting is that once an application or once an access rule is created, the access rule becomes independent from the application credential. So you can reuse old rules if you want by using their IDs instead of going and looking up the API reference every time you want to create or every time you want to rotate your application credentials. You can create, you can use this ID and re-assign old access rules to them. There's a couple of caveats with this feature. So access rules are only enforced on the external entry point. And this is something we went back and forth on a little bit while we were designing this. But the idea is that the user only has to know the external entry point. So for example, if they're creating an application that needs to interact with Nova, they only need to write in the Nova access rules. They don't need to know specifically that Nova on the back end needs to call it to Neutron, to Glance, to Cinder. That all happens implicitly. The end user doesn't have to know about that. Those are all still enforced by regular policy rules. And then the other thing is that there's no kind of pre-validation of these path strings. Once the user creates it in Keystone, it's freeform created in Keystone. And it's not until the application actually tries to use it against a service that it actually touches that service. So we're expecting users to look at the API endpoints in their services API reference. They're allowed to use permissive things like the double star syntax to create really permissive rules. So it's possible that a user can create an application credential that has access rules beyond what they intended to do. But again, since these are still backed by policy rules and by regular RBAC, they can't create an application credential that does more than what their own user is allowed to do. So where we'd like to take this next is, first of all, client support is on its way. We have reviews up for OpenStack Client and for Horizon. The examples that I showed for the OpenStack Client, those are still under review. So it's possible the syntax might change slightly between now and when we actually get that merged. But it's coming. Another thing we're thinking about is microversion support. For example, perhaps the behavior of an API changes between microversions. Maybe you want to pin to a particular microversion. That's something that we want to consider. We're not really sure how that would work. And we want to talk to other services that actually use microversions to talk about whether that's really a good idea. And then the other thing is that when we originally conceived of this idea, we had some ideas about making this a little bit more automated. Instead of asking people to go look things up in the API reference, maybe we could validate this against the actual services somehow or pre-generated against the actual service somehow. But there's not really any kind of mechanism in OpenStack to do that kind of API discovery yet. So that was a little bit too far out of reach for us to implement it for this feature. And similarly, we also had this idea of maybe we could couple this a little bit more with role definitions and maybe move policy more in this direction, more in the middleware direction, rather than the way we have been enforcing policy at the service layer. Again, that was a little bit too big of a hump to cross while we were implementing this feature. So we wanted to get this done and make it useful as soon as possible. But that's something that's on our minds for the future. I don't have any time for questions, but you can reach us on IRC or on the OpenStack Discuss mailing list. You can also contact me directly. And I'll be here for a couple more minutes if anyone wants to come ask me questions after this talk. Thank you so much for your attention.


Germany models scenario of possible attack of Russia on NATO. The German government has delivered a civil defence risk analysis report to the Bundestag outlining one of the likely scenarios of a possible conflict between an unnamed aggressor and NATO based on lessons learned from Russia's full-scale war against Ukraine. European Pravda reported this. According to the report, Russia's war against Ukraine has confirmed that modern warfare combines classical and unconventional operations, the latter including cyber attacks, disinformation campaigns, and sabotage. An aggressor attack, hybrid, and or using the full arsenal of modern armed forces in all dimensions on NATO territory is therefore a likely scenario. The report says. The report's authors then outline one of the scenarios for such an attack, emphasising that it is only one of the possible scenarios and not specifying what the other scenarios envisage. This scenario divides the conflict into four phases. Phase one lasts for several years with varying degrees of intensity and involves hybrid influence by the aggressor. Espionage, cyber attacks, sabotage, and attacks on vital and defence facilities and critical infrastructure. A key feature of this phase is that the hybrid influence is conducted covertly and cannot be immediately linked to the aggressor. Phase two lasts several months and involves the deployment of aggressor forces on NATO's eastern borders and the deployment of NATO deterrence forces in response. The hybrid influence continues but becomes more intense and less covert. Phase three, which lasts for at least one year, involves open military aggression against NATO territory, selective attacks using conventional and non-conventional means including against targets in Germany as well as possible disruption of satellites in space. Finally, during phase four, the aggressor's troops break through NATO defence lines into Germany. A full-scale armed confrontation in space is also envisaged. The scenario assumes that this phase ends with a ceasefire agreement no earlier than a few months later. In the report, the German government proposes that this scenario should be used as the basis for building a civil defence concept and that the relevant agencies can model further sub-scenarios for more effective defence. It was previously reported that the Bundeswehr is drawing up a new comprehensive operational defence plan for the first time since the end of the Cold War taking into account the lessons learned from Russia's full-scale aggression against Ukraine. Russia prepares for China's invasion. Military rehearses use of nuclear weapons. The Russian armed forces have reportedly rehearsed the early stage use of tactical nuclear weapons in a conflict scenario with a major global power according to leaked information from Russian military files outlining preparations for potential Chinese aggression. A threshold for the implementation of tactical nuclear weapons appears lower than ever publicly acknowledged by Russia. The cash comprises 29 classified Russian military files spanning from 2008 to 2014. Criteria for potential nuclear responses range from an adversary's invasion of Russian territory to more specific triggers such as the destruction of 20% of Russian strategic submarines armed with ballistic missiles. Despite the documents dating back a decade or more, experts assert their relevance to contemporary Russian military doctrine. Training materials depict scenarios wherein the Russian Eastern military district simulated various incursions by China. Such exercises offer rare insights into Russia's view of its nuclear arsenal as a cornerstone of defence policy and its readiness to deliver a first nuclear strike under certain combat conditions. One exercise outlining a hypothetical attack by China notes that Russia dubbed the Northern Federation for the purpose of the war game could respond with a tactical nuclear strike in order to stop the South from advancing with a second wave of invading forces. The order has been given by the Commander-in-Chief to use nuclear weapons. In the event the enemy deploys second echelon units and the South threatens to attack further in the direction of the main strike, the document says, in a separate training presentation for naval officers unrelated to China, broader criteria for a potential nuclear strike are outlined, including repelling an adversary's landing on Russian territory, targeting units responsible for guarding border areas, or countering an imminent enemy attack with conventional arms. The threshold is defined as a combination of factors where losses incurred by Russian forces would irrevocably lead to their failure to stop major enemy aggression, a scenario deemed critical situation for the state of security of Russia. Ukrainian drones hit over 14,000 Russian targets in six months. Over the past six months, Ukrainian attack UAVs have hit over 14,000 enemy targets including Russian equipment, electronic warfare, air defence, and fortifications. Ukraine's Prime Minister Denis Shmihal said this at a government meeting. In just six months, strike drones have hit more than 14,000 targets. Russian equipment, air defence, electronic warfare, and fortifications. He said according to the Prime Minister, Ukraine has revolutionized the development of drones. We adopted 20 laws and bylaws and thanks to this, we scaled up production 100 times. Burocracy has been removed and there is real competition among about 200 private companies in the UAV industry. $1 billion is provided in this year's state budget for the purchase of drones. And this is not the limit, he summarized. Shmihal also emphasized that the creation of the unmanned systems forces as a separate type of troops will maximize the potential of drones and added that the course of the war is changing the latest developments. Maritime drones paralyzed the enemy fleet in the Black Sea and guaranteed the security of the water logistics corridor, he said. On February the 11th, the head of the Ministry of Digital Transformation, Mikhail Fedorov, said that Ukraine had caught up with Russia in terms of the number of long range kamikaze drones produced.


So I was recently taking a ride in an Uber and next to me was sitting a student at a conventional medical school and we started talking about things and exchanged what we were up to and he said that he had recently gotten acupuncture and his conclusion was that It was questionable in terms of its efficacy or its results long-term for him So for him acupuncture didn't really work And I don't know if he was trying it just to try it and see what it was like or if he was trying it for a Medical condition, but in this video. I want to share what happens when acupuncture doesn't work and what to do about it Hey, I'm Alex Hein author of the book master the day current doctoral student in traditional or classical Chinese medicine Now I've also included a free download and infographic on five Chinese medicine practices to add 10 years to your life So it's the first link right there in the description box Alex Hein com forward slash free if you click that and download it'll be sent right to your email So what happens when you try acupuncture and it doesn't work? Well, I've shared my story here before many times that acupuncture for me was not love at first sight and the majority of people that gave me acupuncture for a specific Health problem where I needed results did not get me results. It only took me You know probably six practitioners the minority to find two exceptional practitioners that were really just head and shoulders above the others And so what I find is that Chinese medicine is heavily skill dependent and it's not a matter of going to every acupuncture or Chinese medicine doctor It's not all the same because it's not really standardized So there are two things to consider if you still need help with a medical condition You didn't get results from acupuncture when someone referred you there and you're kind of like now what? So the first thing is to keep in mind that results are the most dependent on the practitioner So even though as Chinese medicine doctors or acupuncturists we have a national licensing exam I have four boards I have to take currently herbs acupuncture basic medical theory and biomedicine which is similar to conventional Western medicine Even though we take those ironically Chinese medicine is not standardized the standardized form We have to learn for school is not the most effective form of Chinese medicine It's kind of what had to be the group consensus for us to be licensed The best practitioners I've ever found were ones with a strong lineage that they had been taught down or an oral tradition Now it seems crazy that even in this day and age with research and double-blind placebo studies that an oral tradition would be valuable But the oral tradition is really people passing on for hundreds of years. We've seen this work We've seen this not work. So go with what works and I find that the best practitioners that got me results again, remember this was not for relaxation So it's not for a spa treatment. I had 29 years of digestive illness that are now gone and Because of meeting a practitioner that had that skill with herbs So for me, you know, sometimes you find one practitioner that treats a problem through the liver and the other one will treat it through the kidney Completely different treatment approach and that difference may not be in a textbook anywhere in the world It may be their clinical experience may be their lineage that their mentor the physician that taught them said I find that it doesn't work when you treat it like that when you treat it like this. It does work The second thing to consider is to find someone that knows herbal formulas. Well, I'm personally very biased towards herbal formulas Because I have a natural interest and inclination in them And also it was the only thing that worked to resolve a 29 year digestive illness and I'd seen all the Western doctors I'd been through a lot of different alternative practitioners and the only thing I cared about was results That's it. I wanted my problems gone and one practitioner was good enough to do that And so I'm obviously biased towards herbal formulas because I find that you can get a very high rate of success Including clinical remission of symptoms using herbal formulas in conjunction with acupuncture So if you're not getting results find someone who's skilled with Chinese herbal formulas Specifically with Chinese herbal formulas and not someone who's giving you just generic supplements like fish oil or these five HTTP melatonin combinations to sleep Find someone that truly knows Chinese herbal formulas well and that's been my experience in terms of those practitioners tend to not only be very highly educated and very skilled The added modality of using herbs is has been one of the bread and butters of Chinese medicine for over 2000 years, so why not use what's been time-tested the most? So I hope that helps that's my opinion in my two cents on why acupuncture works or doesn't work highly dependent on the individual and Sometimes you just need to see another person in the same field that sees it differently or as more experience or different experience So again if you'd like to download that free infographic five Chinese medicine practices to add ten years to your life It's the first link in the description. Also, you can check out my recent related videos right there and right there


Good morning, Hank, it's Tuesday, and I am tired. I don't mean just physically tired, although I am that. I mean, like, metaphysically tired. I feel like my brain and also my voice are kind of limping to the finish line of 2017. This is eventually going to be a happy and celebratory video, but first, I have to tell you what's wrong with me. Some of it is just my mental health problem. Too much work and travel and not enough sleep and exercise are bad for my OCD. But there are also larger forces at work. Like, lately I feel compelled to scroll through my social media feeds for hours on end, even though the scrolling generally makes me feel worse. Because of my mental illness, I've often felt like a passenger in my own consciousness, with no sovereignty over the thoughts that are called mine. And lately, scrolling through the social internet, I tend to feel like a passenger in the larger consciousness, as if history isn't something that we make together, but instead is something that's happening to us. James Joyce called history a nightmare from which I am trying to awake, and the history unfolding around us these days does often feel like a nightmare to me. I don't know if this is true for other people, but I often feel powerless in the face of injustice and inequality and violence, and also social and political structures that don't just allow for oppression, but in some cases actively encourage it. I mean, I'm just one person, and I tire easily, and I feel like I can't do anything except scroll. But that is a lie, and this weekend I was reminded that it's a lie when thousands of people came together from all over the world for the 11th annual Project for Awesome, which, as I'm recording this, has raised almost $2 million for charity. By the way, you can still donate until midnight tonight at projectforawesome.com slash donate, where there are still great perks available, including New Zealand nickels and Project for Awesome socks and signed copies of my book, Turtles All the Way Down. And also at dftba.com, you can get this amazing Project for Awesome t-shirt. All proceeds go to charity. But whether you participated in the Project for Awesome by donating, or by making a Project for Awesome video, or by commenting, or by joining us in the livestream, thank you. Thank you for reminding me that the social internet is not only about passive scrolling, it's also about hearing stories we wouldn't otherwise hear, and becoming better informed, and making deeper connections with each other.  And along the way, you reminded me of something else. It's not just that we as individuals can change the world, we are changing the world every day, each of us, through the choices we make. The world isn't somehow separate from our actions and passions and beliefs. The world is made out of our actions and passions and beliefs. During the first half of the Project for Awesome this year, we raised money for two great organizations, Save the Children and Last Mile Health. And the CEO of Last Mile Health, Raj Punjabi, who grew up in Liberia, shared with us something his father often told him. No condition is permanent. Not the good conditions, and not the bad ones. Inequality of access to healthcare and educational opportunities are not permanent conditions. We know this because we've seen dramatic reductions around the world. But political and social stability also aren't permanent conditions, nor is peace or progress. No condition is permanent. And while there are big forces acting upon and within us, we are not mere passengers in history. The human story isn't something we're scrolling through. It's something we're part of. Thanks for reminding me of that. Hank, I'll see you on Friday.