John chapter 3 We'll begin reading here at verse 22 I'll read to verse 24 and we'll get into our study John chapter 3 verses 22 through 24 John writes after these things Jesus and his disciples came into the land of Judea and There he remained with them and baptized now John also was baptized in an anin near Salem because there was much water there and They came and were baptized for John had not yet been thrown into prison Now remember in the previous verses of John chapter 3 Jesus had presented the way of salvation to a man by the name of Nicodemus and we saw that Nicodemus was a Pharisee of the Pharisees He was a religious leader the teacher of Israel and as Jesus was speaking to him Jesus instructed him concerning The necessity of being born again and Jesus had made it clear to him that without new birth There was no hope for Nicodemus to enter into the kingdom of God Now Nicodemus's religious practices his biblical knowledge was simply not enough And so Jesus told him that there needed to be not just religious ideas and philosophy and practice But you need something that is brand-new you need an entirely new life Even though his religious devotion was commendable He needed more than good works Jesus made it clear you need a new nature and Jesus said and I can make that possible Now on the book of Galatians in chapter 6 verses 14 and 15 Paul said may I never boast except in the cross of our Lord Jesus Christ Through which the world has been crucified to me and I to the world Neither circumcision nor uncircumcision means anything what counts is a new creation See so neither circumcision nor uncircumcision religious practices and The things that are related ritually to religious faith Those aren't the things that actually count what counts. He says is a new nature. That's why Paul told us that if anyone is in Christ He's a new creation all things are passed away behold. He said all things are become new He needs a new nature and that's what Jesus was speaking to Nicodemus about And so as he did so in the first portion of chapter 3 John now returns to the ministry of another man named John a man by the name of John the Baptist Now the events that he records for us that we'll be looking at are taking place outside of the city of Jerusalem It's in the south in Judea Notice how it begins in verse 32 how he says there he remained with them and baptized He remained with them The word remain means to pass the time together or spend time in other words Jesus was using this time to develop his relationship with his disciples He remained with them so that he might pour into them Though they were his followers, they needed to understand simply who he is They needed to connect deeply with him. They needed to know him as rabbi and mentor And the best way for this to occur was for them and for us to spend time with him I think there are a lot of people who are religiously busy Who are not spending time with Jesus? They do a lot for him At least in his name they do a lot But they're so busy that they don't have quiet and personal time with him And that's one of the reason why people reasons why people burn out That's one of the reasons why people say I can't do this any longer. I need to take a break It's because they're pouring themselves out constantly, but they're not spending time in prayer and devotion to the Lord and Jesus wants us to spend time with him and that's what he did. That's how he mentored people Every couple of weeks here in this church I have a group of men that I spend almost two hours with after second service every couple weeks And that's what I'm trying to do I'm trying to use the model of Christ to spend time with the men To answer their questions to speak biblically to them and do those kinds of things and that's what the Lord did in mark 314 Mark said that Jesus appointed 12 that they might be with him And that's the way a rabbi would mentor His disciples you see spending time with them was part of their training They couldn't become what they were intended to be without spending this kind of time with him And so he was doing this he was spending time with them and he was teaching them He would teach them things that were meant just for them He would do works that only they really would see and you can read your gospel and you'll see that Because there'll be times and they speak to him. They'll say now you're now you're speaking plainly Or he would take them aside and explain a parable to them and help them to understand it or they see the Transfiguration Not everybody saw that only certain disciples saw that And so that's what he's doing here. He's spending time with them. He's teaching them things they need to know He's he's revealing things of himself that they need to know and he's spending this time with them to develop them And it says in verse 22 that he remained with them and he baptized Now when it says he remained with them and baptized all you need to do is look at chapter 4 verse 2 And that verse makes it clear That jesus wasn't the one baptizing people personally his disciples were doing the baptizing But what they did by his authority and his command was attributed to him And so this is taking place now this baptism and all in verse 23 It says john also was baptized in an ain in near Salem Because there was much water there and they came and were baptized Now the exact location Is unknown it is located somewhere in the south But when we go to israel We will go to a place called kasar al-yahud It's just uh, they're in the south outside of jerusalem And there are those many who believe that that may very well be the traditional baptismal site or What this passage is referring to But notice in verse 23 how it says he was baptized in an ainam alam Rather ain in near Salem And so the word ainan means springs when it speaks of much water That speaks of springs of water And so there he is at these springs of water baptizing and he's continuing his ministry And uh verse 24 tells us for john had not yet been thrown into prison briefly He had not yet been thrown into prison. Why was he thrown into prison for preaching? For preaching to herod And saying to herod It is not lawful for you to have your brother phillips wife Philip The brother of herod had had a beautiful wife named herodias And phillip had gone to rome and had visited And while there had started an affair with Rather herod had started an affair with phillips wife herodias and brought her back and Treated her as if She was his wife But uh, it's interesting when this is spoken of in matthew 14 It's interesting how It says that Herod was upset at john because he said to him it is unlawful for you to have your brother phillips wife And herodias is never referred to as uh herod's wife. She is referred to as His brother phillips wife And so john the baptist didn't mince words. He wasn't a man who would be on many of these christian tv programs today Because he spoke the truth in a powerful way He he spoke the truth in a way that was unmistakable He spoke truth to power And power doesn't want to hear truth I really think that we're living in a time when pastors Need to when given opportunity We need to speak the truth to those in power when given opportunity not to say that I should candidate somehow to speak into the ear of the president i'm not saying that What i'm saying is When a minister has opportunity to speak To power Or speak At any time they ought to speak the truth In a way that is not a compromising Almost apologetic thing And let me give you something that will offend somebody at least one if i don't do at least one offend Offense then i'm not doing my job um So there was a call to the churches to pray for the president this weekend All of you probably heard of it right If you didn't if i were here you would have Um i'm hoping you did i would have prayed for our president i prayed for the president why we're commanded to pray for those in authority That's what the bible teaches Right that's what the bible teaches pray for those in authority And that's what we do We're not praying because he's republican or we're not praying because he's democrat independent whatever went that's not what we're praying we're praying So that we might have peace live in peace And that god might somehow break through this This evil land that we live in and do a work That gives to us more opportunity To preach his his gospel. It's a wise thing to pray For those in authority that we might live Peaceable lives and that's what paul told timothy that we ought to do there's nothing wrong with doing that So the president trump and i know people don't like him and you ought to met in europe I have to tell you i came back loving him more than ever before and i'll tell you why They hate him In europe they really do i mean marie and i my wife and i were watching the news yesterday and i'm telling you You know it's bad enough to hear these british people that were on On the news they were being interviewed on the street and all what do you think about trump?  He said not a single thing. He's a misogynist. He's homophobic. He's a racist He's just giving all of cnn's, you know speaking points And as i'm listening to that I got really upset and i'm apolitical in many ways most of you know that you know i'm I don't tell you who to vote for i will tell you who i vote for but Vote for who you will and then pay the penalty, but um I like the fact that the remains of our korean and war veterans were brought home.  I like that I like an economy that's growing. I like that. I like the idea that the president though you may or may not like him It's up to you You're supposed to be praying for him anyway But i like the fact that he tells people we need to read the bible that he appoints conservative judges and justices That was a big issue to me. I like that.  He does a good job on his own But actually i i have a love for the man because he's doing things that i think need to be done And i and i have a love for him as a man and and and i want god to to touch his heart that Why wouldn't we want god to touch us and i was no fan of any Of obama everybody in this church knew that if you didn't let me say it I was no fan of his i didn't vote for him either time And i could tell you why but i won't just i didn't But I'll tell you why no i didn't But when given an opportunity We need to speak the truth To power and john did that John did that to herod And when john did that to herod it got herodias Herod's The woman he was living with Got herodias angry and she was looking for a convenient time to deal with john And that day came it was herod's birthday He had all his officers various political people at a birthday party and Herodias's daughter danced just a very sexually salacious dance And it got him excited and he began to bow He began to say i'll give you up to half my kingdom making this Promise to this girl so she runs off to her mom and says What should i ask for? He says i can have anything up to half the kingdom. What should i ask for? And that was herodias's chance she says I want the head of john the baptist on a platter Can you imagine? See we're very genteel we americans can't imagine i can't imagine the evil of such a request To be head a man Take his head and place it on a silver plate And to bring can can you fathom that the evil of such a request yet for his drunken oath and For the sake of his drunken oath and for the sake of the soldiers and all that were around him Though he didn't want to do it you had it done John the baptist There is a a price listen carefully i'll say this briefly, but it's important There's a price that we we will pay for loving jesus And there are a whole lot of people who are afraid To pay that price so they compromise They don't ever speak the truth They keep it to themselves. They actually get angry when the truth is spoken Isn't that amazing, but it's true They actually get angry when i was in germany i was teaching And i shared something about homosexuality and boom Woman gets up and marches out because She has been brainwashed into believing That a sexual sin like homosexuality Is approved of by god she's in church Listening to a bible study at the minute something is said that she disagrees with and you have to ask Where did you come to your point of disagreement is it in scripture somewhere?  I said listen in my church I usually see more than one. I actually thought I was doing good Yeah, I did it's true So what happened well, he had not yet been thrown into prison that gives us the timeline ultimately he was and lost his head so in verse 25 Then there arose a dispute between some of john's disciples and the jews about purification And they came to john and said to him rabbi He who was with you beyond the jordan to whom you have testified behold He's baptizing and all are coming to him So there's this dispute an argument And it is it's related to purification So john's men were questioned about his baptism and the baptism jesus's men performed and and the dispute upset john's disciples Now It may be that they feel that uh john the baptist is being Disrespected because notice in verse 26. It says they came to john and said to him Rabbi notice how they say this he who is with you beyond the jordan to whom you have testified behold He's baptized and they're all coming to him So it sounds as if they are upset because they think he's disrespected You started first You should be given greater honor as a matter of fact john you baptized jesus Now this kind of thing can happen between members of differing churches My church is better than your church. My pastor is better than your pastor That's called sectarianism It's the fruit of what is called carnal comparison It's interesting But the apostle paul had to deal with this kind of mentality because it existed in the church of corinth And the church there in the city of corinth that actually began to divide over their favorite teachers In in first Corinthians chapter 1 verse 12 paul said now I say this that each of you says i'm of paul or I'm of apollos or i'm of syphus or I'm of christ. They were divided over their favorite teachers in all So as a minister of the gospel paul would not have anything to do with this carnality And paul made it clear that he was simply a minister And nothing else later on in first corinthians chapter 3. He said it like this verses 2 through 4 He said to them I fed you with milk and not with solid food For until now you were not able to receive it and even now You are still not able for you are still carnal For where there are envies strife and divisions among you Are you not carnal and behaving like mere men for when one says i'm of paul And another i'm of apollos Are you not carnal When you begin to argue oh this guy is more special than that guy. He says that's just carnality So notice how he receives this and handles this question notice at verse 27 john answered and said A man can receive nothing unless it has been given to him from heaven You yourselves bear me witness that I said I am not the Christ, but I've been sent before him He who has the bride is the bridegroom But the friend of the bridegroom bridegroom who stands and hears him Rejoices greatly because of the bridegroom's voice therefore This joy of mine is fulfilled He must increase But I Must decrease A man can receive nothing unless it's been given to him from heaven Striving for preeminence striving for fame Striving for ministry greatness Is futile It's been rightly said there are few things as unattractive As a pride filled minister Prominence in the kingdom of god is not to be sought after prominence Is actually a place you're You are put into by god himself because it's god Who decides whom he will use and it is god who decides to what degree he will use them It's like what it says in psalms 75 verses 6 and 7 Exaltation comes neither from the east nor from the west nor from the south But god is the judge he puts down one And exalts another god is the one who puts a person in the place That he strategically intends him to serve in There are young pastors today And young want-to-be pastors today Who are being invited to all kinds of Seminars and conferences Where they can come and learn how to Fill the pews with people And there are promises being made To these young men that if they Will use the methodology that this individual wants to sell to them in the conference That they will one day go from 50 people to 100 people to 200 to 400 And uh, they're almost guaranteeing that they can have churches that are filled, but here's the thing Any man who wants to fill the pew and is Is not concerned with how he does it shouldn't be occupying the pulpit He shouldn't be occupying the pulpit Because he's trying to become great based on the number of people who show up At the things he does And when I began this ministry and I'll say it quickly, but when I began this ministry Back in july of 1981 We didn't begin the church. So we would be a large church. We began the church Because I wanted people to know jesus christ and that's really what you're supposed to do Is raise people up in the things of the lord and As a minister and john knew this this is what he's referring to That that ministry begins and ends with god It's john's responsibility to be faithful to what god has placed him in to do john doesn't determine Uh what he's to do he obeys god and does what god commands And john was humble And john was aware of who he was and he also was aware of who he was serving And his humility Safeguarded him from seeking glory in ministry a ministry by the way he was entrusted with Remember what he had said earlier when asked who he was and why he was baptized and in john chapter 1 verses 26 and 27 john said I baptized with water There stands one among you Whom you do not know it is he who coming after me is preferred before me Who sandal strap i'm not worthy to loose A genuine minister of the gospel realizes who they are and what they are In second carinthians 4 verse 7 we have this treasure in earthen vessels That the excellence of the power may be of god And not of us and the most valuable vessel is always going to be the broken one Because the broken vessel ministers out of brokenness And john was a man who was being used mildly by the lord and he wanted to make sure that they understood this So a man can receive nothing unless it's been given to him from heaven But he goes on in verse 28 you yourselves bear me witness that I said i'm not the christ But i've been sent before him He who has the bride is the bridegroom But the friend of the bridegroom stands and hears him rejoices greatly because of the bridegroom's voice therefore This joy of mine is fulfilled. He must increase But I must decrease And so he says in verse 28 you bear witness of me. I said i'm not the christ. I've been sent before him Remember in john 1 verse 20 how he confessed and did not deny but confessed i'm not the christ And in john 123 how he said i am the voice of one crying in the wilderness make straight the way of the lord So he wasn't seeking for himself to be known He wanted to make jesus known Notice verse 29 when it speaks of the one who has the bride is the bridegroom It's the bridegroom's friend his his uh best man the friend of the bridegroom stands and hears him rejoicing greatly Because of the bridegroom's voice therefore the joy of mine is fulfilled In other words, I have no rivalry for the affection of the bride You know, can you picture that a best man? They're trying to take off with the bride At the wedding, you know, just giving her those looks, you know, and whispering He says i'm not that way I'm not trying to steal the affection of the bride. Listen, and i'll make this this is something I speak to pastors in it I may not be able to clarify it in a general community If I were speaking to pastors, I would be saying to pastors Your job is to get out of the way so that jesus can be seen And when people begin to say oh, I have the greatest pastor Well, a pastor who doesn't point to the master Is going to have a disaster You can write that down put it in david's quotes But it's true It is the pastor's obligation and calling To direct people to jesus christ John said I am not battling for the affection of the bride. Who is the bride the church? Who is the groom jesus christ? What is his role? I'm the best man. I rejoice to hear the voice of the bridegroom I'm not here battling for the affection of people One of the problems the church has today is pastors who are so hungry to hear the church tell them how good they are And how important they are and how wise they are As they begin to steal glory from god It's a very dangerous place to be because god says i'm the lord that is my name in my glory I give to no one else neither my praise to graven images Now he is a jealous god And so it's very important for all ministers to realize that he gets all the glory John is teaching us that John is teaching us that Are you jealous for my sake? I already told you who I am I'm the best man. I'm not the groom I'm here preparing the way for him. Why because it's the people I am pointing to this man to this messiah These are the ones they need him. I they don't need me. I'm just the forerunner. He's the real deal I have no rivalry for the affection of the bride the bride belongs to the bridegroom In first grintians 11 verse 2 paul said it like this. He said i'm jealous for you with godly jealousy I have betrothed you to one husband That I may present you as a chaste virgin to christ and then he says and this is so powerful. He must increase but I must decrease He must increase I must decrease You see it's difficult gathering people who are willing to follow your lead Yet it can be even more difficult to give them up And some leaders desire attention And in doing so draw it away from jesus When that minister becomes more important than Than christ in his word in his spirit It's not a good thing You know sometimes people when they hear that their pastor is not going to be in church on sunday He's not going to be teaching Sometimes they don't come to church They'll go do something else go visit somewhere else. It's really not a healthy thing is it Because I would hope in this fellowship. I would hope I would hope all of us know enough now to say, you know, what matters is god's word What really matters is The presence of the holy spirit And an encouragement to follow christ And I I appreciate as a pastor. I appreciate the love of my congregation Some in this congregation are very warm to me and I appreciate that very much. I really do I really do and I love it In the sense that there's this love for me and I appreciate it deeply But I would prefer a greater love for christ That this church would love jesus more And that that that's the truth, you know that that that that that's the truth See see what one one day one day and i'll say this briefly again I always say i'll say this briefly and then go on for a while, but anyway um One of these days and should the lord tarry one of these days i'll have my last sermon here I know that there'll be one day that happens. I've been here a long time 38 years You know and i'm growing older. I know that and that's okay. I like it. I have a problem growing older I'm grateful. I am every day. I'm grateful for thank god for it. But one of these days The lord's gonna say i'm gonna bring in some young guy Who can handle it And i'm gonna kiss you goodbye And that's gonna happen But I want you so prepared So that when the word goes forth from the new pastor of this church That you just keep moving forward for jesus christ That's what pastors are supposed to do Is just a step out of the way so jesus can take you further And that to me is a real important thing in my life and the older i get the more i realize it I get it i do But whoever comes in here There's gonna be an important thing i'll say it right now They have to love the lord jesus christ with all of their heart. They have to love his word They have to walk in his spirit, but they have to love you Because I would not and my church To anybody who didn't love you That to me matters. He needs to love you i'm serious Because I never did but anyway He must increase I must decrease he who comes from above is above all He who is of the earth is earthly and speaks of the earth he who comes from heaven Is above all so jesus is the one who's from above He is superior to all things that are of the earth John cannot speak of heavenly things, but christ can John is limited, but jesus is not In verse 32 and he says what he has seen in herdy testifies Uh, that simply speaks of the fact that jesus is an eyewitness And even though jesus is an eyewitness many disregarded his testimony But it says in verse 33 He who receives it received his testimony has certified that god is true So when it says he who has received his testimony It's speaking of a one time for all time decision of the will to receive He's saying jesus is delivering the absolute truth And those who receive it Believe god because god is truthful So they receive that In verse 34 for he whom god has sent speaks the words of god for god does not give the spirit by measure So many prophets were sent by god to speak his words to a lost and dying world And each of these prophets was anointed for their task They had what is referred to as a measure of the spirit But in the case of jesus there was no limit to the work of the spirit in him Remember as we've been in Colossians in chapter 1 verse 19 Remember how paul said it pleased the father that in jesus in him all the fullness should dwell And he goes on in verse 35 the father loves the son and has given all things into his hand The father loves the son Loves him beyond the most faithful servants the father loves the son much more than he loved john the baptist And his affection was much different Than the affection that god had for the others his affection for jesus was different Jesus's father made him the greatest prophet The greatest priest and the greatest greatest king He made him the greatest judge Because all things including judgment Are his all things are in his hand when we get to chapter 5 verse 27 We will read the father has given him authority to execute judgment also because he's the son of man So the prophets had various gifts they performed miracles they Received visions and dreams they had revelation of the future yet none possessed all the spiritual gifts jesus alone has all power And then in verse 36 he who believes in the sun has everlasting life And he who does not believe the sun shall not see life But the wrath of god abides on him And we'll look at this for a moment and close When it says he who believes the word believe is a greek word It speaks of faith that has been deposited in jesus christ And when your faith has been deposited in jesus christ in other words Like he had earlier said in chapter 3 When you've been born again when the holy spirit of god has come to dwell within you when you turned from your sin And confessed your need for god and asked for forgiveness and repented And you trusted in jesus he came and dwelt within you you became the temple of the holy spirit of god Your name is now written on the lamb's book of life and you're sealed by the spirit into the day of redemption When you became a believer Your eternal life became a present tense possession you have it now You have it now If you're born again, you have everlasting life now. It's not something you're awaiting It's something you're already possessing You're already walking in life That's part of what it means to grow in your knowledge and understanding of the ways of the lord because There's so much that god has already given to us that we we sometimes fail to realize he's already He's already poured out all those Amazing blessings on us. We just we just don't understand that that god has given to us so much We're we're we're like children who are playing next to a water Hydrant that we turned on during the summer and we're splashing around with the water Because we can't even visualize within our mind how beautiful it would be to be able to be on a Hawaiian beach So we play in the gutter You know, it's enough water and make me cool and it's fun and my friends are with me But but god says but I have something greater than that.  No, you know, this water's fine. No I've got something greater than that It's yours and it's in christ. You have it It's everlasting life. It's abundant life.  It's he's he's there through your trials. He's there through your pains He's there in your joys He's there for no matter what when your friends forsake you and your mom and your dad have nothing to do with you He lifts you up and you understand that and you go through one thing after another But you're never feeling alone because he's with you That's that's that's that's a christian who is growing I heard about a guy Who was in the military and he was sending his This is in world war two. He's sending his mom cashiers checks he would he would cash his Paycheck and he'd get a cashiers check and he would send it home And he did that for all the months that he was serving And so he served for several years and he finally got out of the the army and when he came home He he hadn't been home. He came home And as he walked up the sidewalk towards his mom's house The little fence she had in the front was rickety. It was falling apart when he opened up the gate It almost came off the hinge that needed painting The the grass was dead and there were weeds and and the plants were overgrown He walked up to the wooden porch and it was creaking. It almost gave way under his weight He gets this the screen door opens it up the screen is Falling out and he opens the door and mom. I'm home and oh son. It's so good to see you and Mom What happened to the house? Well, honey, I didn't have the money to keep the house up. I had barely enough just to survive. What do you mean? What do you mean? Honey, I didn't have any money. Yes, you did mama every month. I sent you cashier check She said cashiers check What is that? He said you don't know what a cashiers check is She goes no What did you do with those pieces of paper that I sent you? Oh She takes them into a room and she had used those checks as wallpaper The whole room was wallpapered with cashiers checks Is is your life like that? Filled with uncashed checks Where god is it? No, I told you I'll provide for you.  He doesn't abandon you He walks beside you. He carries you through because he loves you And all the enemy has to do is whisper in your ear.  It's just me. He won't bless But the bible doesn't teach that The bible teaches that my god shall provide all my need according to his riches in christ jesus that god is with me And though all may forsake me yet he never will and he provides for me And he loves me And that's what you need to understand And when jesus rather john is speaking here in verse 36 when he says he who believes in the sun has everlasting life That is something you presently have But it says he who does not believe the sun shall not see life But what do you have if you don't believe in jesus the wrath of god Abides on you The wrath of god continually abides on those who reject him Psalm 7 verse 11 God is a just judge God is angry with the wicked every day And robins 2 4 through 6 paul said Do you despise the riches of his goodness? Forbearance and long suffering Not knowing that the goodness of god leads you to repentance But in accordance with your hardness and your impenitent heart You are treasuring up for yourself wrath and the day of wrath and revelation Of the righteous judgment of god Who will render to each one According to his deeds So it's very clear if you believe in the sun you have everlasting life If you don't The wrath of god abides on you The wrath of god abides on you As for myself I believe I gave my heart to christ He washed me of my sins. He gave me a new life Before his wrath was on me Now his smile is on me It's up to you


All right, everyone. Welcome to the last session of the conference. How's everyone doing? Everyone holding up? It's good. It's good. All right, so welcome to When the Going Gets Tough, Get Tough Going. I'm Riaz, and I work at the security team at Docker. And today, I'd like to share some of our work that we feel is particularly relevant to securing Linux package managers and software updates in general. So firstly, I'll start with the construction of a package manager and explain that if you're using just TLS and GPG, you're going to have a really bad time. Then I'll introduce Tough, which is short hand for the update framework. And it's a full-fledged framework for delivering secure updates. We'll dive into what it does underneath the hood and see how it's being used today to be further integrated. And lastly, we'll end with the idea of hermetic builds. So something we've been dreaming about at Docker. And Tough brings us really close to delivering hermetic builds. And I want to save the best for last at the end of the talk. So but first, before we get too deep into what Tough is and how it's being used, I want to start with a question. And so let's take a step back and ask, where does software come from? And the reason why I pose this question is because when many of us think about buggy software and software security, we're thinking about SQL injections. We're thinking about cross-site scripting bugs. But really, you have some buggy software, and you've got that buggy software somehow, and it's somehow running on your computer. And as many of us know, a computer is a general-purpose machine. So this Apple, I don't get my computer with all of the software it ever need pre-installed when I buy this computer. I have to go acquire, install, and update my software. I can't just send this back to Apple and say, hey, I need the new keynote. When can you ship it back to me? I need to download that. And this process of acquiring, updating, and installing software presents us with interesting security challenges. Because at some point, we have to trust somebody to send us a piece of software that we want to trust. And we need to break down the types of guarantees we need to establish that trust. So let's think of this in a different setting first.  You follow orders. And if you do your job well, you'll get paid by the end of the month. So as you can imagine, you wouldn't necessarily obey any orders that anyone random on the street has to you, right? Like they could be trying to trick you or have you carry an illegitimate order.  So this guarantee that you can trust the provenance of your orders is known as authenticity. Likewise, you also don't want to execute orders if they've been tampered with on route, no matter how trustworthy the messenger is. You want some kind of guarantee that from issuance of the order to delivery, there was no tampering of the actual order contents themselves. So this is referred to as data integrity. And lastly, you don't want to execute orders if they're out of date, since they may no longer be relevant and, in fact, may actually be actively harmful. So you want some kind of expiration date or timestamp, after which you can understand that the order is no longer valid and should not be executed. So you want a freshness guarantee. And all of these guarantees translate over to computer speak. So when you want to install a package foo from any package manager, you want your computer to execute relevant, accurate, and trustworthy orders. So you can trust the package foo itself. So now that we've thought about the soldier analogy, let's think about how we can get the same guarantees in a strawman package manager. So one idea is that we can use TLS, right? We can use TLS to download our packages when we're installing and we're updating our software. And so, for example, apt clients can be configured to use TLS. You must also configure the mirror. And many other package managers do this. And as you may already know, TLS is short for transport layer security. And it provides us with authenticity and integrity guarantees for data over a network. So if you think of back to our soldier analogy, that's over our messenger character. But this is only over the transport layer. So we clearly trust the messenger, which is our transport layer, and the data the messenger carries. But what do we know about the origin of our orders? Where, why, and how did the messenger get this data in the first place? And importantly, who is the author, right? Are they malintentioned? So while we're using TLS for data, may offer authenticity and integrity guarantees over the wire and over the messenger, our transport layer, we don't really know anything about our content layer. Who's our author here? So how do we trust this data that the original author published? So in computer speak, what we're wondering is how did the package manager even get the package that we're installing in the first place? Well, someone on the internet set up the repository and then someone, maybe the same person or someone else, at some point, upload the package that you're installing. And in many cases, many existing package managers' permissions to upload or delete packages are granted to user accounts. And these user accounts can be compromised. So for example, on app, you have private package archive accounts, PPAs. So how can you be sure that the package you installed wasn't uploaded by some untrusted third party who might have compromised its accounts? So perhaps digital signing with GPG can help us. Apped and Yum both have support for uploading GPG signatures to company packages. But however, while GPG signatures do provide us with stronger authenticity and integrity guarantees, they're just a cryptographic primitive, a building block that provides authenticity and integrity property over a bunch of bytes without any additional context. So even assuming that a key and this signature can be reliably and accurately associated with a particular person, all you know is that person signed at some point for some reason over some bytes. You know neither the reason nor that that person should have been able to sign those bytes in the first place. And this leaves us with some challenges in a software updating system. So one such challenge is, for example, GPG alone does not provide enough context to protect against freeze and rollback attacks. So an indefinite freeze attack occurs when attackers are able to freeze clients by sending them the same version of metadata over and over again. So you can imagine you have version 7 and you keep on getting metadata for version 7, 7, 7, over and over again. And a rollback attack is where you actually are tricked into installing an older version. So you may roll back from version 7 to version 6. And these are both essentially replay attacks. In both cases, because the GPG signature over the bytes of the message or the package alone, do not provide any expiry or version context, the client is vulnerable and can be starved to fresh updates. In addition, in the case of GPG, it's quite difficult to recover from a lost key. Unless you properly tinker and set up subkeys ahead of time, it's still quite difficult to do that. And even so, losing a massive GPG is fatal to the security of the system. So signing keys may be compromised or lost. So systems must be designed in order to be flexible and recoverable from key compromise. So in the example of our soldier, our general, our author, he might pass on. So who should take his or her place? How do we facilitate the transition? In the United States, for example, we have an election coming up in November. And the United States president is the commander-in-chief. How do we, in software updating systems, provide a similar transition between generals and administrators? So as such, GPG alone does not provide a very strong story for survival of key compromise. And lastly, there are some orders that are so important. You might want just more than one signature. You might want a quorum of signatures. So for example, launching a nuclear missile. In the United States, we have Air Force. It's a concept of a two-man concept. So you might have seen it in movies where you need two people, two authorized operators, to each retrieve their own key, simultaneously place them in locks, which are far enough to where, even if you're a well-player, you can't reach both, and turn the keys simultaneously in order to authorize a nuclear missile launch. And even so, in addition to that, in many cases, you also require another two operators in a separate location to do the exact same procedure. So again, very important decision, but we have a threshold of people authorizing that decision. So by default, GPG, you can very easily append signatures, but you have to do some wiring up to yourself to get this thresholding property. So let's add survival key compromise and thresholding to our desired guarantees. So if you couple together TLS and GPG alone, they're essentially just two building blocks, and you really care about these guarantees in the best case scenario, you achieve some level of authenticity and integrity, but you don't have any built-in freshness. And likewise, you have survival key compromise through subkeys, but we need some extra work for thresholding in addition to just append signatures. And of course, GPG isn't considered the most easy software to use. If you're familiar with the papers, why Johnny can't encrypt, why Johnny still can't encrypt, and even last year, there was a why Johnny still still can't encrypt for understanding the usability of PGP, the last two were for emails, but even so, GPG is not considered the easiest system to use when managing keys, dealing with subkeys, and let alone if you wanna get thresholding to work here, it's going to require some work. And ultimately, what we've learned so far is that for a software distribution, it's a pretty tough problem, and in order to better understand the intent behind updates to fend off against all the problems we've identified so far and many, many more, we're gonna need a signing framework instead of just building blocks. And so from the talk title, since the going has started to get tough, it's just about time to get tough going. So I'd like to introduce Tuff, the update framework, which is a security framework designed to secure content distribution, which can be any kind of content. So for instance, application updates, we used Tuff for Docker images, and we could also use Tuff for Linux packages, as we'll see later in the talk. Tuff has a pretty interesting history as it actually originated from the Tor project. So it's actually based on Fandy, which is the update system for Tor that was released in 2008. And Fandy is particularly interesting because it was refined by fire, right? Tor needed a secure update system that could withstand nation-state actors, right? And while withstanding those actors still ensuring anonymity over its network. And so I think the best way to capture how amazing Fandy is, I'm going to read from the blog post of when Fandy was released in the words of Nick Matheson of the Tor project. He says, I'm especially happy with Fandy security architecture. We assume an adversary who can operate compromised mirrors and who can possibly compromise the main repository. At worst, such an adversary can DOS users updates in a way that users can detect. Unlike lots of other software update tools where immune to rollback attacks, we can detect frozen mirrors and we can even handle key compromise relatively gracefully. Most encouragingly, the fact that Fandy is both decently secure and well-specified has garnered us some attention from some mysterious security researchers. And those researchers were the folks that put together the update framework.  What the update framework does over Fandy is it generalizes Fandy. So Fandy was just for Tor, just one application. The update framework is for any application, any kind of content. Today, there's a living spec document for the update framework. It's all open source and you can check it out in your own time. In addition, concepts and iterations from the update framework have been published in peer-reviewed academic papers at some top notch conferences. So for example, at CCS, if you're familiar with computer and communication security and NSDI, which is the use next symposium on network design and implementation. So I've bored you enough of the history. You may be wondering, okay, I understand kind of where it came from, but what is tough? So tough specifies a signed metadata structure. So rather than signing the actual packages themselves like source tar balls, you're signing contextual information about them. And so as such, a tough repository consists of a linked set of signed metadata files that together describe a collection of distributions that you trust. The packages themselves are separate from the tough repository and can live anywhere. So they can live in a CDN, can live in a mirror, can live on disk, any combination, it doesn't matter. The way that a tough enabled package manner would work is that you would first download that tougher repository metadata that we have in the scrolls. You would validate and verify the signatures and other metadata for the repository and then get checksum sizes and be able to properly identify which package you want to install. So let's dive into exactly what's in each of these scrolls. So in the set of metadata, we have five roles. We have the root, timestamp, snapshot, targets, and delegation. And each role in our repository provides us with a certain set of guarantees for our trust. So we'll use these icons. There's the talk to keep track of them. So let's start with the root top. So the metadata for the root file specifies the public keys for all the other roles. So it anchors trust for the keys for all the other roles in our repository. And self-referentially, specifies its own keys. So the root file has its own root key specified and it's signed by that root key. Moreover, I had this little pin because the first time that you ever see a root for a tough repository, you pin that root as the anchor of trust similar to how Chrome pin certificates the first time you see them. And as we mentioned earlier, we were interested in thresholding. It's possible that you can have multiple keys per role. So you can imagine that you have five root keys and require a threshold of three, a majority in order for the root to be valid. And it's a particularly motivating example would be, you can imagine that in the Apple versus FBI case, if the FBI was to coerce Apple engineers in San Francisco to sign in a back door into iOS, they would have one signature. But could they get signatures from collaborators who could be in China or in Switzerland or other countries? So tough has no restriction over where the keys are located because it's client side signing. And so since the root is the anchor of trust for repository, it's very important to keep the key very safe. So it's recommended to back it up in a bank vault and when you do need to bring it online, you can use the Yubi key or a Nitro key, some kind of hardware signing module when you actually need to use the key to plug it in your computer, sign, and bring it back offline. So with the root, we understand how we manage keys in tough. But now you may be wondering, okay, I have keys, where do I get packages from? So that is the job of the targets. So that was the bullseye. So the metadata for the targets file lists all packages for a tough repository. And so in this targets metadata, we have a mapping from package name, human readable name to hash. And that hash allows us to self verify the package itself. And as we signed the root metadata with the root key, we signed the targets metadata file with the targets key. In addition, the targets metadata can also specify collaborators. So we could have two collaborators, for example, we could have Alice and Bob. We specify their public keys. So we have Alice public key, Bob's public key, and we can scope the packages for each collaborator. So for example, maybe imagine that Alice is a release captain for Java package, and Bob is a release captain for open SSL. We can restrict the signing capability for Alice to only signing packages prefixed by Java, and Bob for packages only prefixed by open SSL. And in doing so, we actually create two delegation roles. Do you remember the heart from our scrolls? One for Java and Alice, and one for open SSL and Bob. And basically, as we did in the targets file, we list, again, the package name to hash translation. So we have Java for Alice, open SSL for Bob. And as before, we sign with our delegation keys. So the open SSL delegation sign by Bob and the Java is signed by Alice. And so now instead of listing all the packages and just the targets file itself, you can have a tree where you specify collaborators in your targets, maybe some packages, but you can also, in specifying collaborators, have a tree of delegation roles. And this tree can be arbitrarily nested. So for example, imagine that Charlie is Alice's co-worker and is responsible for packaging the JDK for Java. Alice can further subdelegates to Charlie to only allow signing packages of Java JDK, and for herself, keep Java jerry. And of course, as we have a root, we could also have thresholding. So imagine that, like many projects, you may have a LGTM threshold, right? You want two of three maintainers for a package to say, this release is good, thumbs up, ship it. You can imagine that we have multiple collaborators for open SSL, we have Bob, Daniela, Edward, say LGTM, these releases are good, I'll sign off. So a tough package manager grants fine-grained control over which collaborators can sign for which packages. It requires that a collaborator's key be explicitly authorized by a tougher repository administrator, their roots or targets, and provides extra context around the signing primitive. And all because we don't have any extra tooling or opt-ins, it's all by default, this provides better authenticity with a very nice ease of use. Moreover, because a collaborator is required to sign in package hashes along with the exact package name with their non-root key, in their own metadata, as opposed to a global file, this provides easier to use package guarantees for integrity by default. And additionally, we saw for both root and delegations that you can do it across any of the role, we have very nice thresholding guarantees. So we've unraveled some of those goals so far, I want to take a step back and see what we've had so far in the picture. In this larger view, we have our root and we have our targets, which points to an arbitrarily nested delegations tree. So let's check out the snapshot next. So, I chose the camera for the snapshot, because the way you should think of the snapshot is it tells you a valid picture of a tough repository. And to do that, what it does is it points to hashes of every metadata file. And those hashes are over the signed metadata file. So for example, the root to its hash is the hash of the actual, including all the signatures, including if we had a threshold of quorum signatures. And so if there's any change to any one of these files, so for example, we added a new collaborator, new delegation role, we added a new key to the root file. You would also update the picture, our snapshot. So you can imagine, as you're rolling these scrolls, you want to draw a link between these rolls, the snapshot links to your root, your targets and your delegations, in the same way that your targets can link to arbitrary delegations. So this gives you integrity guarantees of almost every single metadata file except for one, which is the timestamp. And the way you should think of the timestamp is that if our snapshot gives us a picture of the repository, the timestamp tells us what's the latest picture that I trust. And to do that, what it does is you have, in the same way that the snapshot links to other metadata files by hash, the timestamp links to the snapshot by hash. In addition, I've kind of been putting this off for now, but until now, you may have noticed that every scroll has had this expiry at the bottom. So each piece of metadata does have its own expiry. And that is, when we verify a tough repository, we're not only verifying signatures, but we're also verifying that the metadata itself was not expired. So in the case of a timestamp, it's very natural to have a very small expiry window because you always want to make sure you have constant picture, like a constant view of the latest picture. And so if the timestamp was to expire, what would happen is that since this piece of metadata would also be expired and be invalidated, we actually would not have a link to a snapshot. So we wouldn't be able to get a snapshot. This is a pretty strong guarantee. It's a little different for delegations, though, because in delegation, we also have this tree similar to how a timestamp links to snapshot, which has its own tree. The targets to delegation tree is similar, and we could have individual delegations, such as the open SSL delegation that expires. In this case, if open SSL was expired, but not all the Java delegations, just the open SSL packages would be considered invalid. So you would, if you were able to list all the valid repositories in our tough package manager, you would see all the Java packages, but the open SSL ones would be considered invalid if that delegation was expired. So this gives us really nice fresh guarantees, even when we're in an offline mode. And it's interesting as well, because you have fine-grained freshers controls so we can have different expires for different metadata files. So thumbs up. So if we just take this up back again, we have our full picture of a tough repository. We have a timestamp pointing to a snapshot by hash and snapshot by hash pointing to our root, targets, and delegations. So now that we have a full picture of how this is all linked together, let's just run through a single update flow of how we might download a tough repository and check that it's valid and figure out which package to download. So imagine we're looking for the open SSL, one of the newest versions. And imagine that we've also seen the repository before. So we have a pinned root. So again, not the first time you're gonna download the open SSL, we have the pinned root, just how Chrome pinned certificates. The first thing we do is we ask for the latest pictures. We ask for a timestamp. We download the timestamp, we verify that it's not expired, we verify that its signature is correct against the timestamp key, we get the timestamp key from our pinned root. From that timestamp, if it's valid, we have a hash for a snapshot. Now what's interesting is that we could, an attacker could have compromised our database or our mirror and try to put in a snapshot with a higher version than the valid one. But that's not gonna matter because the timestamp will reference a snapshot by hash. So even if there's some modified metadata in our CDN that's holding our tough repository or some server, we're still gonna look for that snapshot by hash and the content just away. So we get our snapshot. Again, check that it's not expired, check the signatures, assuming it's good. We now have hashes for our root and targets. In this case, since we have our root on disk, we check that the hash is the same as the one on disk and verify that root. In this case, we're gonna assume that the root didn't change, so it checks out. And we also check our target's file. Then from our target's file, we wanna look for open SSL, right? So if we imagine the tree we had before, we had two delegations, we could have potentially more. All we need to do now is just look for that single delegation role, which we have a reference to by hash. And as before, check the expiry, check the signatures. In that delegation, we have our name to hash mapping for the package and now we can retrieve that package from some CDN, some mirror, some disk. And so that's our full flow. So that's one flow. How does this work out over a long lifetime, right? Like you're gonna be running a package manager for months and years. So how does this play out in the long run? And how do we keep our guarantees? So we're gonna use this graph to run through a lifetime. So we're gonna have each of the expiries represented by these bars. As we went over earlier, the timestamp should have the shortest expiry because you always want the freshest look at your repository. Followed by the snapshot, since it references every single other piece of metadata. Targets and delegations, you might not be signing in packages very often, so that lasts for longer. And root should last for a very long time because ideally you're not changing your keys around too much for the other roles because you're keeping your keys safe. So assuming that, what could possibly happen is that we don't actually change anything for a while. Like you can imagine that we don't sign in any new packages, maybe we don't have any new releases. So within 24 hours maybe our snapshot or timestamp rather expires. And that's totally okay because it's important to differentiate between software that's decommissioned and software that's just old, but it's still supported. Right, and so in the case that we still want software to be considered valid, that it's just an older version, we can just sign a new timestamp. And that timestamp can still reference the same snapshot which in turn references the same packages, right? So totally valid, you can just sign a new timestamp. You can imagine this goes on for a while, maybe we're not signing much and our snapshot expires. Again, no problem, we can just sign a new snapshot to point to our software. We then also need a new timestamp to point to the latest picture, the latest snapshot. And then we can keep on going. So okay, we gone over if you're not doing any publishing but what if we wanna publish something, right? We're gonna cut a new version open SSL. We're gonna sign in a new hash, so a new name to hash mapping in our target to delegation file. Now that the picture of the repository has changed, we need a new snapshot. And now to make sure we get the latest picture, a new timestamp. And you can imagine this goes on for a while, you have this chain of targets to snapshot to timestamp and whatever you need to, whichever level you're going to sign in at targets, just targets, snapshot or timestamp, updating accordingly. So okay, situation normal, we're doing pretty good, but what happens if things aren't going so well? What happens if you think something's been compromised? Like he's been compromised. And so I think one big, tough way from tough, big takeaway from tough that is very important is that it takes into account that compromise is not if, it's when, right? While being never compromised is a beautiful dream, it's impossible to keep everything perfectly safe. And you have to do the best that you can and react quickly, but luckily the tough spec writers took this into account. And so it's not the end of the world event when a key is compromised. So how do we recover? If you remember back to our route, it serves as the anchor of trust for our repository. The root file specified all the keys for the rest of their repository. And all clients anchor their trust on this root key. So as long as this is secure, we can very easily simply create new keys and sign them into the repo. So for example, we had our snapshot key was compromised. It's specified in our root file. So all we need to do is generate a new key, sign it into our root metadata file. So we need the root key to come online and assign in this new snapshot key. And then also sign a new set, re-sign the snapshot metadata with our new key. And now clients will immediately trust this because they also have anchor trust in the root key. So if we think back to how this would look in our flow, this is before we'd first sign in a new snapshot key into our root, then sign a new snapshot to point to this root. So we have a new picture and then sign in a new timestamp to point at that new picture. So the latest picture with our new snapshot key. So tough provides better authenticity, even if it's been man in the middle to compromise entirely and also provides survival key compromised. And so here we have a tough enabled package manager. The bars aren't exactly the scale. It's just a general more or less. But as you can see across the board, we have very strong guarantees for what we've been trying to get after here. And as you may have noticed, I've been putting off ease of use, but we'll get back to that in just a little bit. But one additional property that we haven't gone over that I wanted to mention that we do get with tough is a notion of auditability. So everyone who installs a tough repo has the same copy of the repository, all the metadata files. And they can, all these clients can detect when keys change or when packages change. And so this gives users similar auditing capabilities. Similarly, it's very reminiscent to certificate transparency, right? And so this seems really nice. So can we just put tough into all the package managers just right now and call it a day and we're done here and go home? There are some questions, right? So I was talking about a lot of roles and a lot of keys and it seems intimidating on how we might map this over into a real existing package manager, right? And so an example of this that you might be thinking of is, okay, who gets the root key, right? The root key is our most important anchor of trust. Does the package manager maintainer own the root key or should the package maintainers themselves, the people who are releasing OpenSSL Java, should they have a root key? So we'll go over construction where the package manager maintainers have the root key. Both are possible. There are actually are two peps that are proposed for PyPy that have both designs and we'll go over the root key being package manager maintainer later in the talk. So how can we start using tough, right? Like even though it's not currently integrated into a Linux package manager, doesn't mean you can't start using it because at Docker we've actually worked on this project called Notary. Notary is a separate component project from Docker itself so it doesn't have to be on Docker images. It can work over any kind of data and it's our own opinionated implementation of the update framework. So it's, you can check it out. It's under active development though we've cut a few releases. We've also integrated parts of Notary into Docker itself. So I wanted to get back to this ease of use thing because I've been putting it out for a while and I think the best way to show you how easy Docker, tough is to use and notary is to use, I'd like to show you a demo. So let's start with the video. So I can explain as it walks through. There we go. So I'm gonna initialize a notary repository. So notary is just a command line interface. So you notary init when it's con demo. I already have root key on disk that I wanted to use. So just ask me to decrypt it because all keys are encrypted on disk. And it also generates a new targets key and a new snapshot key and asks me to encrypt them with a passphrase on disk. And I do this list. List shows me all the packages I've signed in. Right now I haven't initialized anything. I need to actually publish for the notary server to get the initial set of data. And then I list, I have no targets present, right? And so, okay, we have nothing in the repository. Let's try adding something. So I wanna add this file, Docker, Couse, HelloLinuxCon. So all I need to do is do notary add, the repository name, linuxcon demo, the target name, it's like the package name, hellolinuxcon, and the file that I want to use. So you can also specify a hash directly, but in this case notary just takes the hash of the hellolinuxcon file. So it stages it and then we can publish. And when I publish, it'll ask for my targets key because I'm signing in a package into my targets file and also my snapshot key because I've changed the picture of a repository. So now when we do a list, we'll see the hellolinuxcon target package as well as the digest, the checksum, and also the size. And it's signed into the targets role because I haven't set up the allegations to keep it simple. So, okay. So you can imagine that maybe I'm in the business of distributing fun Docker scripts on my website. So maybe we can crawl from my website directly, do a notary verify, which will check that it's actually signed to my repository and then piped sh. And what you'll see is that notary verify, what it's doing is under the hood, it's going through the full update flow that we saw earlier with all the files. But and if that succeeds, it'll actually just push through the content that the curl retrieved. So if I try doing a notary verify on some other script or maybe it's the same script, it's been modified.  Let's see what happens. So notary verify will tell us that, hey, I don't know what this package is. It doesn't match the checksum for the target that you told me to verify against, which was hellolinuxcon in my repository. And similarly, if I try verifying as the target that doesn't exist, so I try doing verify against non-existent hellolinuxcon, notary verify will tell me that there's no trust data for this package. So even if I'm doing curl to SH, right, with notary in the middle, we're able to achieve the full, tough guarantees. So it's super easy to use. And moreover, I talked about managing subkeys, rotating keys and GBG being hard, but in notary and in tough, super easy. So all I'm gonna do is notary key rotate, the repository name and the key. It's asking for a new key passphrase because it's gonna encrypt it on disk. I'm changing the root file and I'm changing the keys. And because I changed the root file, I changed the picture of the repository. So I'm gonna assign a new snapshot. So let me prove to you that I actually rotated the keys. So I'm gonna do an add and publish. So I'm adding other target, or there you go, to my repository. When I do a notary publish, we're gonna see that the key ID matches the rotated key. So I type in that passphrase. I also type in the snapshot so I've signed this in, have a new picture. Publish, when I list, I see both targets. So I see both original, HellenicsCon, and this new other target. So as you can see, super easy to use and I encourage you to play with it. And we have a very quick fire, Docker-composed setup that you can get started in a couple of minutes with notary and it spins up a server and you have the client and you have it getting started. And I think even today it was interesting. I saw that Cloudflare was working on using notary in a secure Secrets Bootstrapper. So people are using it, it's exciting. I encourage you to check it out at github.com slash Docker slash notary. So as I mentioned before, we've also implemented Tough in notary but also in Docker. So if you export Docker content trust equals one, Docker will enter content trust mode where it's actually using notary under the hood to do the same implementation of Tough. And so it's kind of interesting how we put together Docker content trust in the context of our key hierarchy. I wanted to explain it to you guys to motivate how we might do so for Linux package manager. So we're getting back to this hierarchy of our roles with our root as the anchor and by the way you can use UB keys in both notary and content trust. So maybe with the UB key at the root. Docker content trust has repository scoped to the root. So it could have been organizations at the root but that would have meant that, and images as targets, but that would have meant that any private images within an organization would have been leaked. And so you would have known all the images that if they were private, their existence in the metadata. So we have on a per repository level. And this way ensures that Docker users have control of their own root keys. And so I picked Alpine, but all official images in Docker Hub, so Ubuntu, Nginx, MySQL are also signed by content trust. So if we have the repository at the root, the targets and optional delegations have a mapping from Docker tags to manifest hashes. And so the manifest hashes are content addressable referring to Docker manifest and that manifest has hashes for each of the layers. So you have a Merkle tree with notary doing and content trust doing name resolution for getting the head of that Merkle tree. So you're getting the manifest and that manifest in a content addressable way that buys all the layers. So we talk a lot about how content trust uses tough. How might a package manager that exists today or a new one use tough? So some design goals that I picked and could change, but we'll use these for this thought exercise that you wanna root of trust in the package maintainer, package manager maintainers, right? So like maintainers of apt, maintainers of yum, and ideally with fresh holding because there are probably more than one maintainer. You want freshness guarantees. You wanna sign index of all the packages in the package manager and you want signed package targets for like Java, OpenSSL and individual packages by the maintainers. And again, this is a name to half resolution and ideally with fresh holding. So we can have like two LGTMs, okay, signed to my repository. So you think about these guarantees, they actually map really nicely to tough. So we can have the maintainers with multiple UB keys, multiple root keys at the root level. The timestamp key and role provides freshness. The snapshot is our entire picture of all the packages. We have a signed index of our packages. We can have delegations for our maintainer keys, similar to how we saw Alice and Bob for OpenSSL and Java. We can have a threshold of those keys, specifying a name of OpenSSL, package name to hash. So it maps over quite nicely. And again, there are peps open for both this design and design that has a slightly different configuration with package maintainers at the root. So I think we're pretty close. And for future work, at the beginning of the talk, I mentioned this idea of hermetic builds. So if you aren't familiar with the word hermetic, it's often used in the context of hermetic seal, meaning airtight. And so I guess if you think of tough and all the guarantees you get about authenticity, integrity, you're really amazing guarantees for software installation updates. And if you think of a Docker file, you have a from some image, a bunch of runs or ads. If you're using official images or Docker kind of trust, the from is already secured. You have tough over the from statement. But what if we could have tough on the subsequent runs or the subsequent lines? And so imagine that every line in the Docker file is secured by tough or a similar framework. This is something that the team at Docker we've been thinking about and are really excited about. And I think with tough, we're really close to getting this shipped out there and making it a reality. So I encourage you to take a look at tough and notary and content trust. As I mentioned, the living spec for tough is online in this GitHub repository. It's very easy to digest that it's a little, it's like 10, 20, 10, 15 pages. So it's a little long, but very digestible. And with that, thank you very much.


Good morning you fine person sitting right there It's another video. How's it going? Have you subscribed to the channel yet? We make new videos almost every day, so don't forget to subscribe so you don't miss one today We're in Rothsley, Minnesota, and we're making our way towards St. Paul, Minnesota, which is Minneapolis I always just call the whole thing Minneapolis, but I guess technically it is Minneapolis and St. Paul We're going to St. Paul today got to unload the lumber that's on my trailer We had that flat tire yesterday which delayed us a little bit, but we're still on time We're going to make it. We're gonna get unloaded and then I got to run back to Thief River Falls Where there's a reload waiting for me on another trailer. Got to drop this empty pick up that loaded tie it down And zip it home. That'll get me home for the weekend So let's get moving Home is not getting any closer just sitting here Friday's is supposed to be the weekend Summertime you get a lot of traffic going on to the cabins taking to clean up their cabins and cottages too So they might be headed out there for you know one of the last weekends of the season It's too early for that. I don't know. I don't got a boat. I wish I had a boat, but when would I use it? That's the thing like I'd love to have it Como Avenue, that's the one this is St. Paul population 311 something was a sharp exit. Oh my slight right and then slight right Slight right Karen slight right max speed five miles an hour a yield sign here to my right destination on the left one of those Deliveries again. Just quick quick quick. I know most of my deliveries are pretty quick And I have to take the time to take my straps off and roll them up So I don't always have time to quickly go run grab the camera But I know a lot of you are asking you want to see the unloading process. I'll explain it to you in detail There was a yellow forklift with two forks and it came and it took everything off the trailer There now you're all filled in. That's what you missed So I have this empty trailer. Let's go bring this trailer to thief River Falls and Grab a different one with some stuff on it. I like it better when the trailer has stuff on it Makes me feel better Makes my bank account feel better All right, we are in St. Paul It's a big city Minneapolis St. Paul. I don't know if you can see it. There's a Downtown is right behind those buildings over there. It's Minneapolis St. Paul's downtown is that way Can't see it from here. I want to go home Enough talking north of here Trees are all change of color and everything leaves are falling Minnesota. It hasn't quite hit them as hard yet You see a lot of green trees here. Yeah a week or two behind us. Of course, there is US 59 Which is gonna take us up north to thief River Falls Trying to figure out what town we're rolling through here. We are in Minnesota I can't find any town names here anywhere. Usually it says it on these like flags in the middle of a I can't tell This Detroit Lakes Maybe Detroit Lakes. I recognize it because I come through here all the time. I just think of the name right now We're in a town in Minnesota town. They're all very nice I've said it before but I love small town America I will take a small town over a big city any day any day like visiting the cities But I I just I don't think I could live there with the hustle and bustle and you know, it's a different culture It's a different lifestyle. It's a different different in a lot of ways And I can't help my preferences. Oh, this is definitely not Detroit Lakes. Yeah, no Definitely not way too small for that I can't find any town names anywhere. There's central lakes college staples campus. Is this staples then that this name of this town Staples Staples, Minnesota Pretty sure that's what the town's called is where we turn north on the 59. Ah, that's an hour ahead. I should have known that Should have known new trailer behind me with the load on it. I'm tired though I'm gonna go to bed right here and go home in the morning Thanks for hanging out with me today There's a rush rush kind of day. We got quite a bit in we got 828 kilometers done. So a little over 500 miles Not bad. We have two and a half hours left to drive back home to back to the yard tomorrow I'll drop this load off in the air Burn me in the yard with the trailer the trailer and the load drop both off there And it'll probably get unloaded Monday. I'm guessing and then I'll head home I'm headed back there to bed now. Remember to be safe.


This paper investigates the sentiment of tweets related to the COVID-19 pandemic in Saudi Arabia. It uses convolutional neural networks, CNNs, and bi-directional long-short-term memory, bi-LSTM, deep-learning algorithms to classify the sentiment of Arabic tweets. The results show that the performance of CNN was 92.8 percent, while the performance of bi-LSTM was 91.9 percent. Additionally, the study found that there was an increase in negative sentiments during the pandemic compared to the negative sentiments prior to the pandemic. This article was authored by Arwa Al-Kharni and Adaraman.


What's good YouTube this your boy Chi world back at y'all again with another speed art video If you're new to the channel go ahead and hit that like button Comment subscribe make sure you click post notifications So you will be notified every time I drop some heat in today's video I decided to draw something from stretch because I've been doing a lot of video art And it's been a lot of people Commenting that it's not real or the thinking I can't draw for real. So I just decided to Do it from stress to show you guys I really do this. You know, I'm saying I got the idea from 98 baby Mikey That's his name on Instagram I guess well he gave me the idea to draw NBA young boy as the jump man And I decided that would be a good idea and I can use this video to show you guys Me drawing something like what did it look like if I just know? Tracing know nothing just straight straight going from my idea on to the paper And I just want to let you know everybody who do do Victor art is still a former art I don't know why a lot of people try to downplay it like it's not art It's still our artists just being able to express yourself any type of way You don't even have to be like a artist artist You can be a type of person that like to take pictures and put it in Photoshop and add different filters Art is just the way that people express themselves artists being creative. So Never try to downplay somebody's style or the way they create their work because They make it different from you or they got different methods Just I think everybody should respect all forms of art to become a great artist themselves Without further ado, I'm finna let y'all watch this video more heat coming soon for all my supporters Thank you guys for your love and support. I wouldn't have no channel if it wasn't for you guys You motivate me man, and it means a lot to me to have all y'all supporting me come in and leaving your positive vows Just thank y'all for the support and I'm out


Russell Conwell, who was the founder of Temple University, a Baptist preacher, gave a speech. He was a public speaker at the time and he gave the same speech, believe this, that there's no television or internet, so he had to give the same speech over and over, something like 9,000 times in the space of 20 years. And it was called Acres of Diamonds. And this I think is the paradigm example of the Christian idea of self-making. Acres of Diamonds was a speech where a Baptist preacher said, God says there is a duty to be rich. Why? Well, because only the rich man can do good works. If you're poor, how can you do charity? How can you do this altruistic service to your fellow man if you're not rich? So this is the purpose, right? Number one, you have to overcome your own base desires and your own materialistic interests. And number two, the Christian self-maker said, you have to do this for a limited purpose. The purpose is basically to deny yourself, right? To build up riches not for your own enjoyment or for the enjoyment of those that you value, your spouse, your children, et cetera, but for others. It's only morally good, they said, to make yourself, to make something of yourself, to go from rags to riches if you do so in the service of others. Now, the consequences of this are incredibly damaging. This is why, for example, people criticize Steve Jobs for not giving away enough of his money, or for not doing so in as public a way, say, as Bill Gates has done in his family. This is why people say you're only good if, once you rise to the top, you help out those that got you there, right, those who really built that, right? Whether you've been the one struggling, sweating, working hard, building the business, overcoming the obstacles, filling out the government bureaucrats' forms, all these other things. You're the one that did all that, but when you get to the top, they say, you've got to pay your pound of flesh, not only to the government now, but also to everyone beneath you. The Christian view of self-making in the 19th century context, this idea that you have a duty to be rich so that you can do Christian service is incredibly damaging because it takes the self out of self-making. The self-made man is no longer a self-made man. You're almost a vehicle, a vessel through which society can build up wealth and then transmit it to those who need it or who can claim it. Now, this is very, very damaging. Imagine motivating someone. Imagine yourself saying, well, I could start a business. I've got this great idea, an entrepreneurial idea. Someone on the internet hasn't figured out how to sell blank. I mean, if I knew an actual example, well, I wouldn't share it with you, first of all, because I'd be the one that wanted to do it. But if I knew an actual example, somebody probably would have already tried it. But there's a lot of things, arbitraging debt or selling different things or figuring out ways of using this technology to make money. You look at that and you say, I've got this great idea to make money. But then you realize if the context is, if the culture is, that's only good for you if you do so in the service of others. Well, when you're up against the wall, right? When you're staying up 18 hours a day doing the coding or the programming or making the business deals, what's going to motivate you? Clearly it's not yourself. And so it detaches the self from that process. And that's incredibly damaging because I think ultimately what that means is that it doesn't work. You can't motivate someone in that extrinsic way, in that external way because if you're telling them to improve themselves for someone else, they're not getting anything out of it. There's a disconnect between the idea of self-making. Why not be one of the recipients?  Well, of course, we know the problem is if you just, everyone turns around and says this, there is no wealth created and we might as well go back to when we all do what our parents did. There's no social mobility in the sense that you have to do it for others. Now the other major flaw, the other characteristic error that the 19th century produced in the idea of self-making, on the one hand was the Christian idea, what would be called something like the duty-based version of self-making. You have a duty to improve yourself. Even if you don't like it, even if it's not good, even if it isn't one of your values, you go do it. Andrew Carnegie even had this. In his so-called, he wrote a piece called The Gospel of Wealth. Andrew Carnegie said basically wealth has no value except in as much as you can give it to other people. Except that you can endow libraries and schools and do things. Now he had a slightly more pro-self idea. He said, you've got to help those who can help themselves. He was opposed to just blanket charity, giving people money. He said, you give them the tools with which they can make themselves. But he still morally justified it as giving to others. Now the other error is what I would call the kind of subjectivist, the me generation if you want to call it that, the idea of self-making that's all just about the subjective whim. You don't like the world as it is. You don't like conditions as they are. So you just figure out a way to feel better about it. This is the opposite pole. This is self-making as a psychological indulgence. And this literature also becomes popular. In the early part of the 20th century, probably the three most popular self-help books. Norman Vincent Peel's Think and Grow, or no. He wrote this down, so I wouldn't forget. Yeah, the power of positive thinking. Norman Vincent Peel. And then Napoleon Hill wrote Think and Grow Rich. And then everybody's favorite, probably the most famous, Dale Carnegie's, How to Win Friends and Influence People. And what do these individuals, this is the post-Freudian world. This is the post-Deweyian world. So Sigmund Freud, the whole cycle analysis, that it's all a matter of how you think about yourself and repress all of your edible complexes, et cetera. And it's also doing in the sense that it's not really about the self. It's about how you reflect the self in society. And this is all really focused on the self. It doesn't make the same error that the Christian self-makers do of divorcing the self from the process of self-making. But it detaches self-making from any visible external goal. The idea of this self-making is entirely focused around some psychological characteristic. Now, of course, these self-help manuals still promise riches on the other end. Think and Grow Rich, Win Friends and Influence People, positive thinking.  And there was a famous, famously, there was a boxer who claimed that reading this book was what allowed him to defeat Muhammad Ali. Now, I think probably his left hook or maybe a good jab was what allowed him to defeat. But it's all the psychological sense. Now, in some context, this psychological self-making can be a part of proper self-making. The problem is that it completely detaches itself from any real values in the world. Why should you make yourself? What should you make yourself into? Well, I don't know, whatever you want. If you want to make yourself into, you do some kind of self-indulgent, pop some drugs, sit on a hill, and figure out who you are, that's just as much self-making as, say, coming up with a great idea, succeeding in the world, and accomplishing something for yourself, pursuing real values, health, wealth, et cetera. So there's this divergence in the 19th century. By the 20th century, what this means is that the literature and the idea culturally of self-making has become very confused. We see some individuals, great athletes, for example, who pick themselves up from being cut from their basketball team, et cetera, Michael Jordan kind of story. You get cut from your basketball team. What do you do?  You work even harder. You become more determined. You change yourself. You adapt to circumstances. You figure out what is necessary to your success, to your goal. And Michael Jordan's goal obviously was to be the best basketball player ever. And many would argue he probably achieved that, at least within his generation.


Bonjour tout le monde. Good afternoon. Welcome to the fifth daily press conference of this week with me. I'm joined here today by Minister Jolie and virtually by Deputy Prime Minister Freeland and Minister Zanand, Fraser Sajan, to announce further measures in response to the tragedy in Ukraine. The world is witnessing the horrors of President Putin's war of choice. This is a brutal, needless attack on a sovereign, democratic country. It is an atrocity for Ukraine's over 40 million innocent citizens and for the world. The price of President Putin for freedom, democracy, international law and human life must have consequences. Today, I had a meeting with our NATO allies. I also had a call with Prime Minister Boris Johnson to talk about our concerted actions in response to the situation that deteriorates quickly. As we clearly know, Canada, with its allies and partners, is ready to intensify its response and impose even heavier consequences on President Putin and those who help him. Today, Canada is announcing our third set of severe, coordinated sanctions. First, we will be imposing sanctions on President Putin and his fellow architects of this barbaric war, his chief of staff and Foreign Minister Sergei Lavrov. These men bear the greatest responsibility for the death and destruction occurring in Ukraine. Additionally, I am confirming Canada's support to remove Russia from the swift payment system, a critical part of the global banking system. We've made it clear that all options are on the table when it comes to imposing steep costs on Russia's unjustified and unprovoked invasion, and that includes taking steps to exclude Russia from making financial transactions around the world. Excluding Russian banks from swift would make it even more difficult for President Putin to finance his brutalities. Canada is also announcing that we will levy additional sanctions on Belarus and its leaders for abetting President Putin's invasion of a free and sovereign nation. These will target 57 individuals and are in addition to the dozens of existing strong sanctions already leveled against Alexander Lukashenko's regime for their repeated systematic human rights violations and decades of oppression of their own people. Today, Canada is announcing a third series of concerted sanctions. These sanctions target President Putin, his chief of staff, and his Foreign Affairs Minister Sergei Lavrov. It also targets the Belarusian regime, which has facilitated this invasion. Moreover, Canada is also announcing strongly the retreat of Russia from the swift banking system. The human cost of this crisis is enormous. The world is witness to the tragic scenes of bombings and massive movements. President Putin provokes a refugee crisis in Europe. I know that it is in the nature of Canadians wanting to help. But Canadians are always ready to do their part to be generous for the most vulnerable people. Today, we are announcing that our government will give an equivalent sum for each dollar given to the Canadian Red Cross in response to the humanitarian crisis in Ukraine, up to a $10 million. Today, we are announcing that our government will match every donation you make to the Canadian Red Cross, Ukraine humanitarian crisis appeal, up to $10 million. This money will go directly to supporting relief efforts in the region. This is in addition to the $50 million for development humanitarian aid previously announced and the $620 million in sovereign loans we have made available to Ukraine's government. On a more personal note, let me just say that I've had the pleasure of getting to know Vladimir Zelensky, the President of Ukraine quite well over the past number of years. Like I told him when we spoke yesterday, I am inspired by his resolve and his devotion to his country. He is the embodiment of the courage of Ukrainian people and just like him, Ukrainian people are showing incredible strength and resilience. President Putin's war on Ukraine is a war on freedom, on democracy, and on the rights of Ukrainians and all people to determine their own future. President Putin has opened the darkest chapter yet in his assault on the Ukrainian people, but he has made a grave miscalculation. People around the world, including in the streets of Moscow and St. Petersburg, are standing against his brutal and unnecessary war. They are standing with Ukraine, as are all of us. Canada and increasingly the world stand united and unwavering in our support of Ukraine. Thank you.