Good afternoon. Call the meeting of the Board of Public Utilities for the City of Santa Rosa to order. We may have a roll call, please Chairman Galvin here Vice Chair Arnone here board member badden for it Board member banister Board member Dowd here board member Grable here board member Watts Any statements of abstention by board members? Okay, we have no study sessions the minutes from July 18th. We'll be entered and we'll move to our first Or an only staff briefing Director Burke Sure, thank you. Our first staff briefing is going to be on our exciting Streets to Creeks program and Nick Sudano our senior Environmental specialist is going to give that presentation Thank You director Burke Good afternoon Chairman Gavin and members of the board. I'm here today to present a unique approach to educating residents about their Relationships with their local creeks and how simple actions can protect our watershed The streets and create the streets to creeks average campaign was developed in compliance with the outreach objectives Set forth in a national pollutant discharge elimination system or MPDS permit We also refer to that as the MS4 permit or the stormwater permit Storm drains are an extension of our local creeks and streams and our streets to creeks outreach campaign has been developed to create awareness About the effect everyday activities at home have on water quality in our local waterways a Coalition of 10 cities counties and towns that share the Russian River watershed have partnered to raise awareness About neighborhood storm drains and their connection to the vitality of our local creeks The regional partnership extends the campaign south Toronto Park in Sonoma County and as far north as Ukiah and Mendocino County The Russian River watershed is a rich and diverse region of nearly 1500 square miles and is home to approximately 360,000 people 238 streams and creeks and 63 species of fish three of which are listed as threatened or endangered Working with a local creative team and the valuable insight from our regional partners We've created a robust campaign with the following three objectives We want to start by building brand awareness, and this is more than just a logo. It's really about creating a caring and connected community The intent is to promote a behavioral change in our community as a first line of defense to mitigate potential impacts to creeks and Focus on positive actions which model simple changes and have big impacts And finally our crescendo is getting people to Take action and we started that with this campaign by focusing on four simple actions that can have immediate impacts This includes trash pet waste car washing and yard care Santa Rosa has over 100 miles of creeks that provide habitat for fish and wildlife Making a creeks a great place for the community to explore and is home to a wide variety of birds River otters and steelhead which still spawn in Santa Rosa Creek Protecting our waterways starts at home and is important for residents to make the connection to any trash yard waste landscape materials pet waste or common household Chemicals or surfactants can be carried away by wind rain or even runoff from overwatering to the nearest storm drain If not properly contained the goal of streets to creeks is to create a Connection with a community to those local creeks and empower them towards simple changes at home to prevent impacts to the creeks And ultimately the Russian River We wanted to make an emotional connection with the committee by creating a positive experience. This is accomplished through thoughtful Design elements such as a streets to creeks logo which incorporates the egret the fish and the hours to protect And then we used creek specific folk Creek specific photos featuring local creeks and associated those with zip codes to add a sense of familiarity and connection to a geographic region within our city We finally the creek names are used to encourage the community members to find and explore creeks Streets to creeks promote simple actions at home that will ensure only rain goes down the storm drain a common Misconception is that storm waters treated the simple fact is that storm water flows untreated from the street Parking lots or in some instances backyard drains into the storm drain system and directly to our creeks The initial campaign kicked off August 1st and will run through November of this year and Residents throughout the region will see and hear a multimedia campaign in both English and Spanish on social media Billboards radio videos digital advertisements and in print Santa Rosa will also be connecting with community members at our creek events including Creek stewardship Days community events and our annual Creek Week activities in September a website landing page Streets to creeks org was created to expand messaging and to provide additional information on protecting our waterways More content and information is intended to be added to this page as the campaign moves further as part of the messaging We created the following short video That I would like to play for you now Which is intended to be played at movie theaters streamed from our website in smaller snippets used for social media a Beautiful clean river doesn't start here. It starts here What we put down our storm drains goes straight from our streets into our local creeks that flow into the Russian River Simple changes can make a big impact Like when you wash your car the best solution is washing in a professional car wash But if you wash it home Divert wash water to an area where it can soak into the ground like a planter strip Also empty your bucket of dirty wash water in the sink But wash water will make its way to the treatment plant where it is clean You probably know how to pick up your pets poo when you're out on a wall After all it's the neighborly thing to do. But what about the pet waste in your backyard? Pick it up regularly and especially before rain or irrigation water washes any of it into a backyard drain Your pets poo is full of bacteria and nutrients that can contaminate our creeks Scoot the poo bag it and put it in your garbage When tending to your yard or garden check the weather and prevent over irrigation Run off of fertilizer herbicides landscape materials compost piles and leaf debris pollute our creeks Remember timing is everything Pick up any litter or trash that may get into the streets If you grab it before water or wind arrives, it doesn't have a chance of ending up in our creeps It's up to each of us to take care of our creeks and rivers They're ours to protect Find out more at streets to creeks.org We will be closely monitoring and adapting the campaign and some of the metrics for success are listed up here on the screen That eventually end up with creek and stewardship involvement in the community And you can get involved by sharing our campaign and liking us on facebook. I appreciate your time Thank you very much any questions this board member banister I uh love the campaign and uh congratulate you and the team that worked on it. Um, I think it's just great However, it's ironic that it comes a couple of days after I guess someone was Sighted for dumping waste from a mobile home over into a storm drain near the junior college area if i'm not mistaken And I suspect that the people that would do that Are not going to Get this campaign. They're not going to be on the right media or wherever And it makes me wonder if there's any thought about reaching out to the many people that are living in rvs and the like around town to With some kind of a message to them about uh, you know, I'm not sure they care But if they would and if they don't care then there's the enforcement aspect I guess so i'm just wondering if there's any way of reaching out to that community I think it's a great suggestion. I don't think we've done that just yet But it's definitely I think it's an area that we can look into And I will say that the campaign is creating an awareness in the community So that those that are getting the message will have the proper tools to notify us when those are happening So some of the media outreach or campaign that Has gone out has been bill inserts that have included spill numbers so that when those activities occur in the community Someone who is aware of what happens to the storm drain system can actually call and we can respond But I think we should be we should explore reaching out to those inside mobile Yeah, well in this instance, I guess it was a community member that saw it happening and called the police So, you know, maybe maybe that's another answer is for the community to keep their eyes on What's going on on the creeks and then in the drains in this case. Thank you Any other questions or comments or no doubt I didn't see any particular reference to Educating Children in school about this matter and that's an important way that many parents learn a lot from their kids It's a great question. Um, our permit actually does require us to do outreach to children businesses residents and also Um industrial practices as well too and so The evolution of this campaign will go on probably for a few years And children outreach is intended to be addressed in that as well too Thank you. Yeah, thank you. This is a great campaign I wanted to add on to the board member doubt's comment about outreach As there's been any outreach to landscaping companies specifically our local landscape contractors. I know, you know We went we went through The science and best practices on that with our landscape contract and it was a lengthy process There was a lot of education For us and for the contractors and when we took that out to bid But it struck me as a as something that you know in the broader broader scale would be a lot more beneficial if we had a public education campaign and outreach to Private landscape contractors dealing specifically with homeowners and commercial businesses and property management companies I understand that's a that's a heavy lift, but um, it did, you know, it strikes me as something where in terms of scalability and and and you know volume of of measurable influence on on some of these problems, especially when you mentioned surfactants and adjuvants and we're talking about pesticide use we're talking about two-stroke motors, you know things of that nature that the highest volume of Potential, you know runoff could could come from landscape contractors and other Businesses as opposed to just homeowners in the public. All right So um to answer that This is the first step is really to build that brand and that step and our idea is that now We're trying to connect people that storm drains actually go to the creeks and aren't treated And so the idea would be once that base message is out That same look and feel will go to residents that they know we're talking about storm drain It'll go to businesses like landscapes Landscapers that would know that we're talking about the storm drain system And really create that separation that that's not being treated as part of our current MTS permit we do reach to landscape companies Some of this is done through the russian river friendly landscaping And then once every permit term we actually have to reach out to those individual businesses and do a targeted outreach, which is Should happen here in the next year in your four of our permit And so I think you know again kind of looking at that with a closer eye and creating this connection. I think could be of value Thank you Especially as it relates to the ms4 permit and in compliance and so that we're Elevating what's what's you know recognize as best practices across sectors both public and private I think that You know it would be a great goal. So thank you Any other board member questions or comments? All right. Thank you very much mr. Sedano Good luck with the program We have uh two consent matters 6.1 and 6.2 or remember doubt It's merely an interest in knowing what's going on on 6.2. I'm not opposed to this at all I'm very supportive of it, but I'd like to know why it's taking so long Is there a problem or is it just that the complexity of the agreement? I Know I appreciate the question and I don't think that um this extension is in any way a reflection of um Any delay on anyone's part in the negotiations and the discussions just a recognition of the fact that there are there's a lot involved Um, I think the 180 day initial term was pretty ambitious. Um, and we may still be Being ambitious and just extending for another 180 days, but we're hopeful that Actually a next step would come to fruition within that time period and we will be working closely with we have a The liaison subcommittee We also have a negotiating team that's a subset of that and we're we have a the liaison subcommittee Next meeting on calendar. So there will be There are things happening Some of it we will be talking about in in that setting in that public setting. Some of it is still Negotiation process and so we're not sharing every detail at this point, but There are We're negotiating terms for a next step agreement that would Take place take the place of this exclusive negotiation agreement as Hopefully within the next 180 days. So hopefully that's helpful to your understanding of where we are And with with that explanation, I would move to approve the two consent items I'll second Motion by board member dowd and seconded by board member watts to approve items 6 1 and 6 2 On favor say aye. Aye any opposed? Very good. Thank you Item 7.1 is a report item on our project work order amendment Dr. Burke Thank you. So this item is An item that is going to talk about design services for a critical project for the treatment plant our uv disinfection process Previously we had given the board an update in study session on the status of this project and then Had brought this particular contract to the contract subcommittee So mark caserey our supervising engineer with our cip team is going to be giving this presentation Thank you director Burke Good afternoon chair galvin and members of the board. My name is mark caserey I'm a supervising engineer with capital projects engineering And today we're here to discuss the proposed amendment to the project work order for the design of the uv disinfection and diversion project The presentation will contain 17 slides. It'll last about 20 minutes And we will be discussing the project background We'll go over the overall project design The cost and the schedule We'll discuss the design project work order amendment And ultimately we'll be making a recommendation to the board So in 1998 we commissioned a new ultraviolet disinfection system at laguna treatment plant This replaced our previous gaseous chlorine disinfection system And it was rated for a capacity of 67 million gallons of wastewater per day This was equivalent to our peak wet weather flow Which you can think of as what would occur on a very high storm event The photo on the lower right actually shows our existing A bank of our existing uv system taken out of service for maintenance or cleaning 14 years after we commissioned our new uv system and the division of drinking water and the regional water quality control Board mandated new uv disinfection requirements Which prompted us to analyze the uv disinfection capacity at our plants The analysis determined that we were operating below our design point And as a result our system was derated to a capacity of 48.5 million gallons per day So since the derating in 2012 the city began evaluating short-term and long-term solutions to this deficiency And some of the analyses are included here They are alternatives analyses. We held workshops developed numerous reports And in 2016 we assigned an agreement with corolla engineers for the design of a new uv system and diversion system And i'll be speaking to each of these points in a little bit more detail shortly So going back to the derating in 2012 we responded by Developing a number of analyses. We looked at the treatment capacity for our existing uv system We looked at the operation and maintenance procedure And we also evaluated various treatment alternatives These analyses demonstrated two key issues First that we have insufficient wastewater capacity at the plant And that our existing uv equipment is beyond its useful life and it must be replaced So this slide shows the alternatives that we looked at They included ozone pasteurization Parasitic acid and of course ultraviolet The preferred alternative was found to be ultraviolet as it provided the most cost effective solution at addressing our loss of capacity And so in 2014 we took a closer look at this preferred alternative We did this through what's known as a disinfection suret Which you can think of as a think tank. It's a It's a Collaboration it's a collaborative effort of technical experts as well city staff to solve a problem So we looked at our preferred alternative in greater detail Taking a broader perspective We looked at various configurations of this alternative and we vetted it against the future constraints that we're considering for at the plant So this charrette included six consultants Through five separate engineering firms as well as 11 city staff composed of chief plant operators Engineers as well as deputies The best alternative consisted of augmenting the existing uv system With sodium hypochlorite to meet our capacity goals of 67 million gallons per day So this alternative provided a two-phase solution to our loss of capacity The first phase being supplementing our existing uv system with sodium hypochlorite, which is a chemical disinfection process And then the second phase being shortly after replacing our aging uv system The end result was very well vetted through this process and it represented a collective Solution between city and consultants To address our problem in the best way possible So in 2015 we began our basis of design With four conceptual analyses We generated technical memos or memorandums Studying water quality parameters such as ultraviolet transmittance We looked at the feasibility of a side stream sodium hypochlorite process We looked at on-site and diversion improvements And of course we looked at the design parameters for our new uv system And in 2016 we completed two milestones through a competitive bidding process First we selected corolla engineers For the design of the uv system and the diversion system And we also pre-selected our uv equipment supplier again through a competitive process The reason why we want to pre-select uv equipment was because of the variations between different manufacturers Some manufacturers have systems that Operate parallel to the waste stream some are perpendicular. Some manufacturers Have their systems angled and so it is Not possible to design a system without first knowing this critical equipment So we proceeded with a an agreement with calgon carbon And developed a professional services agreement and a memorandum of understanding where we locked in the equipment price for 18 months And shortly after the design we took a step back to evaluate The alternatives and where we were going and we did this through a value engineering study So the purpose of a ve study is to reassess the short-term and the long-term alternatives And we revisited this our preferred alternatives against cost looking at risk again Looking at our design parameters as well as regulation And the ve study did validate the direction we were going was the right path And it ensured that we were addressing our needs in the most economically feasible way The conclusion being that the ve study confirmed that uv supplemented with sodium hypochlorite as well as diversion Was the most effective approach Additionally, we revised design parameters Which reduced the cost of the capital replacement for the uv system So this is a timeline showing where we need to go from the original project work order starting in 2016 In february of 2017 we submitted 35% plans and shortly thereafter we performed the ve study It's important to note that in october of 2017 the wildfire Led to the benzene contamination issue which directed substantial staff efforts and caused delay to this and other projects Through 2018 and 19 we held a number of staff briefings to the board of public utilities as well as study sessions And in july of this year, we did meet with the contractor review subcommittee to go over this project work order amendment What this timeline shows is that we are essentially Three and a half years behind schedule. We were planning on commissioning the new uv system fall of this year So pending a project work order amendment approval. We anticipate the remainder of design will take 1.5 years And near the end of 2020 we're considering a potential bond sale for capital funding of the construction project We are looking at a number of other funding mechanisms as well at this time We will look to award the construction contract may of 2021 and with a 1.5 year construction period We are estimating completion at the end of year 2022 So this shows a schematic diagram of our preferred design at this point The uv system shown in the southwest quadrant of the plant in purple South of that we have the diversion tank and pump station And the diversion system provides a necessary operator flexibility to reroute a non-compliant effluent Either back to the front of the uv system or to the flow equalization basins for re-treatment This is important because currently non-compliant effluent must be circulated off-site To brown pond in which case it must be circulated back to the head of the plant for re-treatment This process is both operationally challenging and expensive And so this new system will provide additional time for plant staff to determine issues as they as they appear for the uv system And then to properly mitigate those issues onsite So moving on to the estimated project costs We are currently estimating the construction at 47 million dollars 35 million dollars is attributed to Disinfection and 12 million to diversion We are estimating 17 million dollars for project delivery, which does include design engineering services during construction construction management and inspection fees regulatory fees administration As well as an overall contingency And so the total project cost is currently estimated at 64 million dollars And I think it's important to to point out that at this time Our contracts with calgon the uv equipment supplier has since expired So you'll recall that they were willing to hold their prices for 18 months And we will need to renegotiate and renew our contracts with that uv vendor And there may be some price escalation We are not certain what that price escalation may be or if it does exist But I wanted to point out that that's not shown here Moving on to the project work order amendment The original project work order was for 2.8 million dollars And our amendment is 1.6 million It represents a 57 fee increase from the original estimate And results in a total of 4.4 million dollars The 4.4 million dollar design fee represents about 9.3 percent of construction and I'll get to that point shortly The majority of the fee increase consisted of tasks that were either added after contract execution Or design and project management efforts that were expanded early on in the design process Continuity was also added to the project at the request of the city and was discussed with the contract review subcommittee The original contract had 50 000 dollars for contingency and for a 4.4 million dollar contract that's a negligible amount And so it was our recommendation to add 200 000 dollars to the contingency It's important to note that we also looked at a number of ways to save money For this project work order amendment We learned that by combining diversion and uv disinfection into a single capital project We were able to realize the savings of over 260 000 dollars on this contract And that was because we wouldn't have to reproduce efforts to develop additional contract plans and specifications Bid separate projects and go through two separate procedures So why the increase in the design cost? The previous timeline showed that we did extend the project by over three years Which does result in a proportional increase to staff time as well as project management The ve study and follow-up assessments Did expand the scope and contribute to The additional timeline To the 35 design process we also needed to make some changes to the design to accommodate The new uv equipment for example, we had to relocate a construction trailer as well as some treatment equipment We had to add onsite stormwater improvements to accommodate our diversion system And we also added a flood wall Coordination task for the ongoing flood wall at the plant. So currently we're building We're designing a flood wall to protect the the plant from flooding This is within close proximity to our project the uv project And so we need to provide coordination between the consultants so that there's no conflicts during construction Finally, this project work order increases the design labor rates from the consultants by 10 to bring their rates from 2015 up to 2019 they held the rates for nearly four years and This project work order provides a mechanism for paying current salary We compared the design fee Against construction cost, which is a typical way to determine if the design fees are within expectations So for a 47 million dollar construction project A design fee of 4.4 million Or 9.3 percent is well within our expectations The industry standard shows that design fees range between 8 and 12 percent for a project of this size Additionally, we looked at the cip benchmark study in the state of california Which is a study that compares design and construction management or inspection costs To corresponding construction costs on public works throughout the state of california So this benchmark study is performed annually by a number of cities long beach la san diego oakland and Those studies showed that design represented upwards of 15 percent of construction cost So our 9.3 percent fee of construction is still well within our expectations Additionally We're estimating between 15 and upwards of 20 000 hours of design effort To give you an idea of magnitude A person will work 2000 hours per year. So this is a massive effort If we do not move forward with the design The LTP the Laguna treatment plant will see heightened issues and risk And some immediate concerns that we have Are that the fact That the uv system does not have sufficient capacity at periods of high flow and low ultraviolet transmittance Which results in costly recirculation of non-compliant effluent Additionally the regional board has requested a compliance schedule To inform them when we do plan on replacing our system. So we need to respond to that Our system does not have sufficient capacity during high flow events Which can cause issues if there's failure of the equipment during the winter months Additionally, we'll see increased resources and cost attributed to maintaining an aging uv system And additionally we have we'll see greater risk of the equipment supplier no longer supporting the antiquated equipment So pending the approval of a project work order amendment Our anticipated timeline includes a number of workshops that we will hold through the design process We plan on working closely with the uv Vendor that we selected previously through the design process and in december of this year We will engage with calgon for renewing our contracts Through 2020 we'll hold a number of design workshops to go over the 75 and 90 percent submittals And to make sure that we're on track with budget and scope and of course our schedule In may of 2021 we plan to bring three items to the board Those three items include the construction contract We will bring a separate cm and inspection contract And additionally we will amend our pw o This this project work order for engineering services during construction So engineering services during construction is a task typically allocated on the design engineering Contract to account for changes in construction as well as the submittal process and request for information However early on in the design process. It's very difficult to Um estimate what that effort is going to be It's much More efficient to estimate it after we go through the design process and we're getting closer to bidding so that we can Then amend this contract one final time So with that it is the recommendation of transportation and public works department as well as the contract review subcommittee that the board of public utilities approve amendment number one to the disinfection and diversion project In the amount of one million $484,655 Approve a $200,000 contingency And for a total not to exceed fee of four million three hundred eighty eight thousand $254 And I'd like to add that we do have city staff and consultants in the audience We've got uh mark solomon with hazen and doug wing with corolla engineers That may be able to answer any questions you have that i may not be able to answer Thank you Thank you for your presentation board member questions or comments As was noted, uh, this matter did come before the contract review subcommittee Um, and we met and received the same presentation and it was partly our recommendation that that contingency be Up to two hundred thousand dollars. So it was a unanimous recommendation from the uh committee to have this matter Put on the agenda Board member gable Yeah, thank you. I just had a couple of questions on this. Um One being is this In the equipment that we already installed whatever 14 years ago or whenever it was Is that when you determined that that we were ending, uh That we were nearing the end of the useful lifespan Does that fall within kind of the The normative lifespan, you know In in comparison to other jurisdictions that that have similar population capacities and flows or is Is that abnormal? So I can speak. I cannot speak to other agencies But for ultraviolet disinfection equipment, it is um complex equipment That's highly energy intensive and so you will see a shorter useful service life as you would see to a Pipeline installation for example, which can last 50 years or even longer So the original installation was 1998. So it's been about 21 years Which does fall within our expectation for this equipment Okay, and then my other question was about delays. So say, you know, for instance, we had a two-year delay on getting this Going at least right? And you said that related to disaster recovery stuff The staff time obviously that we diverted to disaster recovery some of that is within our At least a request for FEMA reimbursement. Is that is that correct? Yes, that's correct. Okay, because it does seem to me that That's that's a significant delay for something that is, you know, seemingly pretty urgent And if then it takes another Three years to get equipment on the ground and implemented at a significant cost It I just wanted to make sure that that was that there was some At least a request to FEMA for for that that staff time I mean, I know that there was some but it just seemed like there's an opportunity cost there as well I know that that can't really be be billed to FEMA, but it's it's significant. It seems like um My other question was related to The cost of of the of the design and the new equipment those other jurisdictions you mentioned where you did a cost comparison Those seem like like much larger jurisdictions. Is that And I know we were we were still below in terms of percentage of overall construction budget for design But it did were you able to look at any other, you know I like to see more comparable city sizes when you're doing cost comparisons as opposed to, you know, for instance, San Diego It's more useful to me to see cities of similar population and Capacities that they're plants for instance Did you do any cost comparisons with cities of of comparable size and capacity? So as part of this analysis, we didn't I personally didn't look at Cities of this similar size and the cip benchmark study is a multi agency study that's adopted by the state of california It does include a number of smaller municipalities Not as small as santa rosa But we did look at the design fee from a number of angles So we did compare it to this benchmark study We compared it to what we know to be an acceptable design fee for a project upwards of 50 million dollars Which is about 10 so a 9 design fee does fall within our expectations as well as the industry standard Additionally, we looked at it on a per construction sheet basis. That's another way of accounting for the design fee you could expect a design fee per sheet between 14 and 15 thousand dollars Our construction sheets are about 300 and it results in a unit cost of about 14 700 dollars That too falls within our expectations And we also looked at it on an hourly basis to to justify the cost as well And I only ask because when we're doing our due diligence with rate payer funds and looking at, you know A contingency a significant contingency of 50, you know, some percent, but also the overall cost It does seem to me that when there is any kind of public scrutiny on a process like this and and You know funds of that magnitude being used rate payer funds It does seem to me that that we should have To prove our due diligence in the process some comparisons with with jurisdictions or cities of comparable size because otherwise to me It it doesn't it doesn't look like we're comparing apples to apples So that would be that would be useful for me in the future But thank you for the The detail and I know this is a lot of work. So Thanks Other board member questions or comments hearing none Call for a motion I would move that the Board approve the amendment to project work order A010014 under the master professional services agreement To approve a $200,000 contingency for a total contract doctor at seed 4.388 million I'll second Motion by board member banister seconded by board member watts all in favor say aye. Hi any opposed? Very good. Thank you for your presentation. Thank you Item 7.2 is a report on a sole source contract specification director Burke Thank you. So this item is Before the board for a sole source specification for equipment for a future project at the treatment plant And brian heinzelman our associate civil engineer with cip will be doing this presentation Good afternoon chairman galvin members of the board My name is brian heinzelman I'm here on behalf of transportation public works and the water department for the city of santa rosa To recommend the approval of sole source specification Of a programmable logic controller for the laguna treatment plant chillers and climate control upgrades At the administration and annex buildings I'd like to start to say this project is critical to plant operations As the plant laboratory is located within the administration building And climate control is essential for state mandated testing to assure plant effluent water quality Meets and complies with our npdes discharge permit And then I'd like to give you some background on the project. So there was a 2016 water chiller assessment By cost to engineering out of napa and that assessment found that the chillers at both the administration building and the annex buildings Have reached the end of their useful life and They should be replaced That same assessment also went on to say that the Controllers for the climate control system Should be upgraded from the existing apogee system to the new s7 system in order to conform with the rest of the controllers at the plant And since this assessment The Boilers at the administration building have also reached the end of their useful life In fact, one of the two boilers is no longer operable and the remaining boiler is undersized and overtaxed So this project will replace two 50 ton chillers at the administration building Two boilers also at the administration building one 15 ton chiller at the annex building And the programmable logic controller or plc for the climate control system This project is currently ready to advertise for bids However, the authority to prove this proposed sole source lies with the board of public utilities And if your board votes to approve the sole source, it'll be included within the specs And we're going to go ahead and advertise for bids We'll later return to bpu to award the contract Here you can see on the screen the annex building with the 15 ton chiller located just outside And also the 50 the 250 ton chillers located at the northwest corner of the administration building The boilers are located in the maintenance room, which is inside the administration building just south of the 50 ton chillers Plant staff has requested the sole source of the Siemens plc Which consists of the power supply the control processing unit the input and output modules And the operator interface terminal Here you can see the existing apigee plc Within its case in the administration building California public contract code section 3400 Doesn't allow specifying a particular brand name or trade name product unless that specification is followed by the words or equal So that bidders may furnish any equal material product or service This code is set up to save taxpayers or in this case ratepayers dollars However section 3400 does make several exceptions to its sole source rule including including exception number two which i've highlighted here Which says basically you can Specify a particular product as long as that product is in order to match Other products in use on a particular public improvement either completed or in the course of completion In plant staff have determined that they qualify for exception number two for a number of reasons Including the fact that the plant uses exclusively Siemens controllers They have 98 of them in fact in service at this time The plant technicians are all Siemens factory trained So they'll have They're on call 24 7 365 and they're able to go in and make any repairs that are needed without calling in a special technician Also the plant maintains an inventory of Siemens parts and for these reasons We recommend that the board of public utilities by resolution approve the sole source of the Siemens program of logic controllers For the ligand treatment plant chillers and climate control upgrades at the administration and annex buildings I can take any questions you have thanks Thank you. Mr. Heidselman board member questions or comments board member doubt Once uh bids are received Is there enough information out there in the general marketplace of treatment systems that We can feel confident that the pricing that we're getting through the Siemens will be Be able to be evaluated that it's competitive I I have not looked into that particular aspect, but I know that Siemens is used throughout many systems and We can definitely research that And and give you get back to you This information and it's it's not something that I would expect now It's once you once you receive the proposal That you can verify that in fact it's a reasonably fair Proposal for our ratepayers and those of the whole sub regional system I believe that would be the case yes Thank you Any other board member questions or comments? If not, we have a resolution I'll move a resolution the board of public utilities approving the sole source specification for Siemens programmable logic controllers for ligand treatment plant chillers and climate control upgrades at administration and annex buildings And waive the reading of the text second Motion by vice chair Arnone seconded by board member grable all in favor say aye. Aye. Any opposed? Very good resolutions approved Thank you Thank you item number eight is public comments on non-agenda matters Seeing no one rise. We have no referrals. We received electronically the written communication on the monthly rate revenue and usage report subcommittee reports none board member reports vice chair Arnone I had the pleasure of attending the north coast regional quality water quality board meeting yesterday morning and offering some comments from the city of san rosa on their total daily maximum load amendments And suggested some changes to their rec one Treatment having to do with changing the requirements and the standards depending on seasonal issues and flow rates I think director Burke will report that the results of the hearing were that Our our comments were received but not implemented Um, but it's not the end of the discussion because there are other steps in the process for we'll have an opportunity to to further advocate for that point of view so it was um, I appreciated the help of staff putting together the comments and um, I think this those comments highlighted the fact that san rosa is a very good partner in reducing the loads and the Russian river watershed and I think the board appreciated hearing those comments And I want to thank you vice chair Arnone for Going to that meeting yesterday morning as I had a conflict. So I appreciate you stepping in any other board member reports Directors report Thank you. Um, so I also would like to echo the thanks to vice chair Arnone for attending The russian river pathogen tmdl hearing yesterday at the regional board um, I think you You characterized and reported out very well on our experience there. We did provide comments on our concerns about um compliance year round with uh, sort of a Rec one determination which basically means it's available for all recreational activities year round and not recognizing um, the variability and seasonality of Water flows in the russian river And having exemptions be available During those high flow seasons as vice chair Arnone reported The regional board did adopt the tmdl as proposed and didn't address our comments, but There are other opportunities It does have to go to the state water board and I think we're also looking at other options for how we might be able to build this into our compliance requirements in the future Uh, a couple other things just to update the board on one Wanted to give a brief update on the activities that we have been doing in relation to considering and Setting a recycle water fee for agricultural uses I think the board knows uh that we've been working on this for quite some time It's been a bit of a lengthy process and we really appreciate those that have been serving on our ag ad hoc committee The good news is is that we have really Put out a lot of information and worked very closely with the agricultural community both through an ag users group as well as Through emails written communications setting up a specific website Most recently we mailed a letter With the proposed fee as well as a draft of the standardized agreement To every single one of our recycle water customers Included in that letter was information on a meeting at the farm bureau We worked with the executive director of the farm bureau to secure a time To hold the meeting to update the members there if interested We held the meeting the evening of july 22nd and even with letting all the customers know in a direct mail letter as well as information being in the farm bureau's newsletter and other communications Only one person showed up And he was very grateful and positive about the interactions and the process and where we've gotten We have really only received positive feedback from all of the outreach that we have done And we believe that we've come to a successful Resolution that meets the needs of the water department and still recognizes the value that our agricultural customers Provide so we will be holding a final agricultural ad hoc meeting to Discuss that more to come on getting that scheduled We were hoping sometime this month if possible And then we will be going through a public hearing process at the board. Hopefully in september I also wanted to give the board a update You've probably been hearing a lot of information about the PG&E public safety power shutoffs or psps There has been a lot of information sent out by PG&E. There's been articles in the paper There was also some Presentations by both city and county staff as well as PG&E at the board of supervisors and at the city council We are also Looking at this very critically not only as a city, but the water department in particular To ensure that in the event of a public safety power shutoff That could last for multiple days. We will be able to continue to run our facilities Both on the water and the wastewater side To that end just wanted to let the board know a couple things All of our water pump stations have backup generators And nearly all of our sewer lift stations have generators We do test these monthly and all of our generators can run a minimum of 24 hours without needing refueling We are also calculating the amount of time our distribution crews are calculating the amount of time each generator can run On a full tank of fuel. So we're wanting to make sure we have enough contingencies in place We also have mobile generators and portable pumpers that can help provide us with some additional resiliency And we are working on operating procedures for refueling the generators Not only for the water department, but the city as a whole and looking at various options to ensure that we have fuel deliveries so Just wanted to let the board know we are we are looking at this very seriously and We I think we have some good plans in place, but we're continuing to work on this so that in the event of a psps We will be able to continue to operate our systems Not only throughout the city, but also at the treatment plant as well In addition, I will also note we have put some information out That in those events we will be messaging encouraging our customers to reduce their water use At if at all possible cease irrigating outdoors and really limiting their indoor water use as well And then last And I'm afraid that I might put your this name. So I apologize in advance but we wanted to Introduce the board to one of our newest engineers on our cip team David fredelizio Hopefully I did that pretty good Is a licensed civil engineer with a bs in civil and environmental engineering From cal polysandlose visbo and has four years of professional design and management experience with various civil and water engineered Systems and also serves in the national guard as an engineer platoon leader And we're very happy to have him join our cip team. So That's all I have for you Any questions for the director? If not, we will be adjourned. Have a good afternoon


Hello everyone, it's your girl Kenzie here from Lane Sports Cards and I'm ripping 10 box Tuesdays 10 box prism first off the line basketball mixer number 114 random teams. Again, here's a look at the random results. You can always find these at LaneSportsCards.com underneath the results tab and the link is also in chat for you. Alrighty, here we go again, we've got prism first off the line and hobby. See first off the line sticker there impeccable contenders, origins, prism draft choice in H2, multi-sello pack optic and wildcard illumination. All right, we're going to start with the draft picks. Here we go and pull up Google just in case. Draft picks here first. Good luck everybody. Got blue disco, Jalen Johnson-Rookie and Silver John Collins. Nope, still room left. MB plenty room left. We've got red, Andre Drummond disco and fireworks disco. Being we've got a Cade Cunningham on the blue disco. Nice one there pistons and auto out of 39. We've got purple Johnny Wang. Johnny Wang, I believe this is going to be a random to all. Looks like he did not get drafted. Playing in the Drew League, but I don't think that has an NBA affiliation. Yeah, I think it's going to be a random to all. Johnny Wang, Josh Giddy. We've got purple Franz Wagner magic on that one to 50 and Zyre Williams rookie, rookie Silver. We got Johnny Wang. We've got blue disco, Jeremiah Robinson-Earl and widescreen KD on the disco. Up next, we're going to do some choice. Dr. Jane Springer auto. We've got to 88th red disco of Moses Wrights. Moses Wrights. Dallas Mavs, Mavs on this one. Our choice exclusive. We've got Cherie Cooper, Damian Liller, Tray Murphy, the third. We've got a red Kai Jones to 88th and our tiger is a JT Thor rookie. Nice. Love the tiger stripes. Such a cool looking card. We're going to go wild card next. I have not ripped any of this yet. Wild card illumination. See what this is all about. I can get it open. We've got our first auto-adjusted Minaya to 50. Are these? All right, he's in the Hornets summer league. Hornets there to 50. Rising Sun, Franz Wagner to 18. Nice on there. Yeah, that was pretty cool, huh? Aaron Sharp, Millie Kahl, Drew Timmy out of 99. I've seen some of these names before. Thank God. Davion Mitchell to 99. Usmanga Ruba, comics of Jason Preston to 60. We've got Max Christie to 35. Lakers auto here. Lakers to 35. Boogie Ellis to 99. Nice name there. Boogie. All right. We've got comics of Trey Murphy, the third. Franz Wagner to 20. Ayo, Dosumu to 10 on that one. Here you go, bowls. We've got Jeremiah Robinson Earl to 49. There you go, Thunder to 49. Millie Kahl to 250. Of illumination. I don't understand why these are like summer put backwards. Some are Rising Sun, Dosumu to 125. ProStar to 50 of Jason Preston. We've got some comics, Jason Preston to 85. A Kendall Brown to 99. Pacers. Pacers hit here on the Kendall Brown. Got Franz Wagner to 99. There you go, Magic. Nice one there. And Tyrese Martin to 99. All right. That'll do it for illumination. Up next, we're going to go Optic. Sabin Lee, Luba Donchich Splash. Isaiah Stewart. Peyton Pritchard, Raider Rookie. And Purple, My House, Steph Curry. Raider Rookie, Anthony Edwards. So you got Tee Wolves. Purple, John Wall. Raider Rookie, Cassius Stanley. Ben Wallace. Malachi Flynn. Splash, Purple, D. Russell. Patrick Williams, Raider Rookie. Christian Wood. Jordan Noora, Air Defense. Kawhi Leonard. Garrett Naismith, Express Lane. Jamal Murray. We've got Raider Rookie. What are the second? Josh Richardson, Optic. All right, Hollow. Sorry. RJ Hampton, Raider Rookie. Nuggets. Devin Booker, T-minus. Raider Rookie, Theo Maldon. And Cassius Stanley on the Raider Rookie Pacers. Penny of the Kobe White. Raider Rookie, Jamiahs Ramsey. Kyle Lowry, Winner State. City Bay, My House, Glukodonchich. Raider Rookie, Devin Bissell. Kemba Walker. Raider Rookie, Skyler Marys. Air Defense, Hollow. LeBron. There you go, Lakers. Tyrese Maxi, Raider Rookie. Sixers, My House, Trey Young. Hey, Jason. Terrell Terry, Spencer Denwitte. I don't have too much knowledge on that, Jason, but I'm sure if you shoot us an email with some questions, we can definitely answer those for you. Kangwoo and Gina McDaniels on the Purple. Raider Rookie, not too knowledgeable on that one, unfortunately. Let's do some origins. Organs Town. We've got Trey Murphy, the third rookie. Jalen Johnson, rookie. Hey, Scotty Barnes there for the Raptors. We've got DeVion Mitchell on the Red Parallel Kings and Gold. One of ten, James Booknight, Rookie Hornets. He's Gold. We've got Celtics, patched to 25, Jalen Brown on the two-color patch there. Jalen Brown. We've got Wizards, Rookie Encard Auto, Cory Kisperz. Wizards. Nice one there, Wizards. We're gonna do Prism, Multicellar Pack. What do you mean, Toke? You don't love these? Thanks for subscribing, Aiden. Toke's just drinking, he puts headphones on and turns the volume all the way up when I'm opening the Multicellar Pack. Hey, if you're enjoying the stream, hit that like button. Yeah, thumbs up. Appreciate it. Helps us out. Yup. 175 people watching, 34 likes. Come on, give us some more likes in that. Help us out. Help us out. Silver, Berea, Green, Mitchell Robinson. Xavier Tillman. We've got Peyton Critchard Rookie. Van Viet. Silver, Dennis Rodman. Green, Rookie, Isaiah Stewart. Pistons. Sabin Lee. Kevin Love. Say some nice KDs here for us and Victor. Yeah, give me some. Give me some. Silver, Colin Sexton. Green, Julius Randall. A.D. Malachi Flynn. Rodney Hood. Silver, Jeff Green. Green, Okogi. Got Patrick Williams Rookie. Serge Abaka. Silver, Tarian Prince. Green, Bruce Brown. Dominance Yanis. Josh Green. Silver, Kauai Leonard. Green, Dwayne Bacon. RJ Hampton Emergence. We've got a Lamello Ball Rookie Base. Hornets. Ricky Rubio Rookie. Silver, Shemette. Green, Troy Brown Jr. Dominance, Donovan Mitchell. Steve Bay. Isaac Acoro Rookie Cavs. Silver, Malmurray. Green, Ennis Kenter. Zeke Naji. Neko Okangwu. Silver, Rookie. Erin Naismith. Celtics. Green, Denwitte. Carol Lewis Jr. and RJ Hampton. Nuggets. Silver, Rosier. Intelinka. Jornawara, Bradley Beale. Silver, Noelle. Green, Rookie Emmanuel. Quickly for the Knicks. Okay, Flynn Emergence. Gina McDaniels. Jalen Smith and Anthony Edwards. Rookie Base. The T-Wolves. All right, last regular pack. Then we'll get into the bonus. Red, white, and blues. Silver, Rookie Ozabuki. Jess. Green, Jeremy Lam. Denny of the Tyrese Halliburton Rookie. And Jabari Parkerer. Red, white, and blue time here. Cassius Stanley. Portas. Come on, let's see some rookies here. Shamias Ramsey Rookie. Kings. Devon Vaselle. Spurs. Isaiah Stewart. Pistons. There's been a few, Synvicta. There was a few colors of Nets in the regular packs. Couple greens, couple silvers. Yannis and a Lamello Ball. Red, white, and blue. There you go, Hornets. Very nice set. On top of Bradley, we got Precious of Chua Rookie. Precious one. And Trell Terry Mavs. All right, so we're going to go contenders next. Sweet Shots. Julius Randall. Got Lottery Ticket. James Booknights. Got Jimmy Buckets on the foil here. Not number. MVP contenders. Foil. Got Rookie of the Year. Joshua Primo. First round ticket to 149. Deandre Aten. Sons. Lottery Ticket of Christo Arte. Pacers. We've got Usman Garuba. Encard Rookie Ticket Auto. Rockets. Garuba with the Rockets. Lottery Ticket of Joshua Primo. Spurs. Got Clippers. Brandon Boston Jr. Rookie Ticket Auto. We have LeBron on the superstar die cut Lakers. Off ticket to 249. Blake Griffin. Nets. One for each of the two. And we've got a case hit. How about a permit to dominate James Booknights? Hornet seen up here. The red, white, and blue mellow. And now a case hit. Permit to dominate. What's up, MOOC? Base. All right. We're going to do a regular prism. Mike, I have no idea. I didn't even realize that was a thing, man. Impeccable. We've got Cade Cunningham. Rookie. Pistons. Silver. Buddy Heald. Purple. Max Cleaver. Max. Zantad. We've got Pulsar. Brandon Ingram Pelicans. Purple Ice. Ben Wallace. Pistons. Mindset LeBron. There you go. Mitchell. Jalen. Impeccable. Yeah. The blue is impeccable. Got Jalen Johnson. Silver Hawks. Chris Weber. On the hyper. Miles McBride. Zuragowski. Red Bam out of bio. I usually go by Price. Luca. Sire Williams. Silver. Hassan Whiteside. Fearless Silver of Chris Weber Kings. We've got Clippers Auto. Danny Manning. Clips with the first auto. Wise Camp. We've got a Franz Wagner Rookie. Magic. Fred Wave. Tracy McGrady. Magic. Piper of Kyle Anderson. Grizzlies. Jaw Fearless. Josh Giddy Rookie. Thunder. Silver by Donovitch. Blue Rookie Charles. Bassie for the Sixers. Little color match there. Chris Duarte. 75 Anniversary. Jalen Suggs Rookie. Kai Jones. We have a Ty Jerome Red Wave. Thunder. Blue Ice Trey Young for the Hawks. Nice. JT Thor. Van Vleet Silver. Rajon Rondo Hyper. Kai Reprismatic. Got Bones Highlands. Rookie. Chris Duarte Rookie. They follow each other. We've got, this is just backwards. Give me one second, y'all. Just take these. I'll just give me those. Fearless Hyper Jonorant Grizzlies. Just backwards. We've got Bowls. Sensational Signatures Rookie Auto. Io Dosunmo. Nice one there. Josh Christopher. Herbert Jones. Rookie. Silver Julius Randall. Red Wave. K.P. Jank. Silver Prismatic. Zion. A pack. We'll get into first off the line next. Escano Anderson. Edwards. Benton on the Rookie Hyper Raptors. All right. First off the line. You see the sticker right there? See some nice shimmers. I haven't ripped any first off the line yet. See a big black 101 shimmer. Silver Joharis Hyper. Precious Atua. Prismatic Hawaii. That was out of order. Cade Cunningham. Rookie Base. Pistons. We've got to 10 for the Magic Gold Shimmer Markel Colts. The magic on the gold shimmer. Magic. Hyper Mindset. K.D. And we've got a Jonathan Cumminga. Rookie Otto in the same pack. Warriors. Nice. Isaiah Todd. Yes. We'll see a black shimmer. 101. Hampton. Bullock. Got Prismatic Silver. Lebron. Lebron Mindset. Isaiah Jackson. Quickly. Got Dwayne Bacon. Pulsar. Corey Kispert Rookie Hyper. Prismatic Kairi. Silver Steve Nash. Blue. Jailin' the Well. T-Wolves. There's Harden. Zyre Williams. Joe Weisskamp. We've got to 10. A Trayman Gold Shimmer. Okay, C. Very nice hit. Thunder. Thunder was Mike B. Heck yeah. We'll mag that man. Jeremy Grant Red. Franz Wagner. It's a Villy. Very nice. Red Wave of Royce O'Neill. Derek Rose Hyper. Prismatic James Wiseman. Toscano Anderson. Ray Allen Silver. We've got Red Zyre Williams Rookie. Grizzlies. 75th Anniversary. Deer and Fox. Josh Christopher. Herbert Jones. Nasry. We've got Red Siminovich. For the Bulls. Purple Rookie. Evan Mobley. For the Cavs. To 99. Very nice Mobley. To 99. We'll mag that one for you for sure. Fearless A.D. Kessler Edwards. Josh Gitty Rookie. And nice first off the line box here. Yeah, that's what I'm saying, TB. Dust get into my nose. Josh Hart. Got Miles Turner. Hyper Pacers. Sheen Wallace. Jailin Suggs. John Stockton. Got Red Wave. Robert Covington Blazers. Orange Collins Sexton on the Orange Wave to 60 Cavs. Trey Jones. JT Thorne. Last pack. Then we'll get into Impeccable. Silver Lou Dork for the Thunder. Silver Mindset. Trey Young. We've got Poppy Portis on these sensational signatures for the Bucks. Bobby Portis. Miles McBride. All right, last but not least. Impeccable time. Good luck everybody. Let's see a gold bar. That'd be something, huh? Well, we did get a bar. So hey, it's possible. Let's go. Let's go. Man of dust. My nose. All right, here we go. Redemption on the bottom. We've got Blake Griffin to 99 Nets. Green to 35. Victor Aladipo Heats. And Moses Moody to 75. Warriors. First hit up. We've got to 99 of Jonas Valenkunas. Pelicans to 99. We've got Pacers to 25. Jalen Rose. Pacers going back to the Pacers out of 79. Rookie on card medal card. Isaiah Jackson on card. Metal rookie. Nice. Pacers back to back hits. We've got Kings. Davion Mitchell RPA here to 99. Kings. And we've got five of 10. Wow. Look how beautiful this card is. Gold. Oscar Robertson for the Bucks. That is nasty. Out of 10. Milwaukee. You to see. That is sick. We'll mag that for sure. Wow. All right. Metal card. Last one here. And then I'll do the random for the Johnny Wang. All right. What do we have? 75th anniversary to 20. Kevin Garnett and Charles Barkley. T-Wolves and Sixers. T-Wolves is Nam Koo-El and Sixers is Zach E. I will do a random for this one as well. Seven out of 20. So yes. That will be another random. Give me just one second to get get the teams copied here. So we had the Johnny Wang auto and then dual bar car, which was T-Wolves 76ers. T-Wolves 76ers. Six in one is seven. Seven again. Whatever team is on top after the first random we'll get the Johnny Wang and then between the T-Wolves and Sixers, whoever's on top we'll get that one. All right. Good luck. Everybody gonna do the Johnny Wang here first again. Seven times. Top team will take it home. One, two, three, four, five, six, seven. Sixers taking it home. Sixers and seven times on the dual bar card again. T-Wolves and Sixers. Good luck. One, two, three, four, five, six, seven. Going to the T-Wolves with KG. T-Wolves getting that one. All right. Let's do a recap here. We had Jalen Brown Celtics, Johnny Wang again going to the Sixers, Isaiah Jackson Pacers, Davion Mitchell-Kings, Pelikunus Pelicans, Jalen Rose Pacers, Bobby Portas-Bucks, Kominga Warriors, Don Sumu Bulls, Danny Manning Clippers, Brandon Boston Jr. Clippers, Guzman Gruber Rockets, Corey Kispert-Wizards, Franz Wagner Magic, a Kendall Brown Pacers, Robinson Earl, OKC, Max Christie, Lakers, Justin Minea, Hornets, Moses Wright for the Masks. Then we had the Gold Oscar Robertson to 10. Beautiful card there, Bucks. Purple to 99, Evan Mobley-Caps, Gold Shimmer Rookie to 10, Trayman Thunder, and a dual 75th anniversary to 20 of Kevin Garnett and Charles Barkley. That'll do it for basketball, everyone. Football coming up in a few.


Hey, guess what when I uploaded the mermaid images for you to purchase and download and color up earlier this week I hadn't yet colored them at the time But now that I have I included a fully colored version of each one So when you download it, you'll have that one to either use by itself You can print it out and use it for your project or just use this coloration for inspiration


from the pandemic ashes rises the phoenix of all events so these are the typical steps that i would go through just couldn't be fucked a very surprising feedback was i really love his ah shit a little bit nervous oh my god this is amazing that's how you plan and execute on a conference oh i think that made my day really and action i'm speaking at a conference so what am i going to do if you've never done a public speaking event before it might be hard to figure out where to start how do you prepare your material make sure your slides are good what goes into the planning process i will hopefully shed light on how you actually plan to speak at a conference what sort of process i go through here's what i'm going to do first thing is first let's do some planning i was working on something else we want to first think about personas who is the audience that we want to cater to and what do we know about them what kind of language do we use and what sort of information will they find useful personas done then brainstorming about topics how do we then map their needs to what we know about the subject we want to talk about i wrote brainstorming brainstorming done how do we then group that together to make sure it's more coherent and then our different ideas can start to form their shape and maybe tell a narrative affinity diagram done and of course research what existing literature is out there what is in the wild that we can then use to make our content a bit more concise but also do a quick little poll on facebook to see what our users want and that will then map back to our personas to validate if they are correct or research done then all that information will help us write our article i want to do this step because i feel like the talk is not long enough for us to really deep dive into some of these areas and then what we need to do is just trim down and then actually give that presentation article finally done i haven't done a conference in a while so i want to refresh my memory in terms of best practices when you're giving a presentation what effective presentations in terms of visuals can help guide the audience through best practices done after that actually create the slides and create the visual assets boy this took ages slides done and i want to do a couple of dry runs and iterating on those dry runs is very very important of course holy shit 100 slides so i'm about to do my first dry run and if you don't know what a dry run is it's basically a practice run to simulate the real environment of your presentation and the reason i like to do this is because you can help iron out the kinks of your presentation it's good for getting feedback and see if it works if the message came across and also the pace of delivery so you get warmed up on the content maybe you're saying too many filler words we don't have the luxury of cutting every time like on camera a little bit nervous hopefully it goes good and action hi everyone thanks for joining i present the ux getting started guide and good luck thank you i just finished my first dry run and i done it went well from 39 minutes i got it down to 33 minutes but i got some really good feedback i want to share some of these with you guys and of course i've written them down i had feedback about content so leaving out different parts or condensing different parts feedback about the flow how one section flows to another section so make that a bit more natural and then finally a very surprising feedback was actually be more crisp so uh but overall that went great i'm ready to now iterate tomorrow i actually have another dry run with the organizers to make sure i'm on top form today's dry run number two dry runs and iterations done presentation all right presentations ah shit it's tomorrow excited for tomorrow anyway conference day today's the day everything has been culminating to today let's get today started first of course coffee the setup the mic laptop and another screen for slack or any troubleshooting issues of the event yeah i'm kind of nervous nervous welcome back let's welcome christmas to our stage hey are we live so i just want to dive straight in if that's okay with you shan and thanks for the introduction okay here we go so if this all sounds interesting to you i present to you guys the ux getting started guide six simple steps to get you started in user experience design good luck and thank you hello hello we're now welcome our two panelists oh my god tell you a story yet again sorry i'm full of stories because i'm an old man holy shit oh christ is amazing like bruce lee says if you want to learn to swim get in the water okay the last and very crucial step is the final feedback round which we call debrief i'm gonna just go through the comments and i'll be recording them and giving you guys my reaction oh someone said i really love his presentation oh yeah your voice sounds great oh thank you love the use of emojis you're done no great presentation great great she wrote it three times love your talk easy for approach easy come on ux i asked the question why is chris so handsome and i tricked the host into asking that question this is amazing chris why are you so handsome oh this is my dude overwhelming amount of thank yous and i appreciate y'all and i'm glad it's useful i'm so happy okay so this is what i did right just scrolling the comments as you do and it's like it's like dinnertime or whatever so someone says dinner i go send foods not nudes and then everyone's just like getting in on it and then the ad mid goes i'm sending you the code of conduct asap the head of design at grab has this crazy moustache so my question was does having moustache improve design leadership skills 11 lights that's oh god he's gonna ask it this question is blowing up but dude moustache guy i'm sorry i did it again this guy doesn't have a moustache oh god this is too fun this is koi vin a world famous designer that's vietnamese leadership positions in new york times and a bunch of startups he's built by himself and other co-founders currently he's a senior director of product design at adobe so basically he's hot shit this is my question to him presentation done debrief done done fuck it's now 10 p.m and the day is finished it was a great success everybody was so awesome and i had a lot of fun the event organizers were amazing uh can't say thank you to them enough for being a part of this my actual talk and panel discussion will be linked down below but this is really just uh behind the scenes the whole planning of it and also using design thinking just to help you prepare for your next conference so i guess i'm gonna leave you guys with this and uh follow me on youtube yes please jay


Hello, welcome to KubeCon. Today I'm going to be talking about Setcomp, what it can do for you. I'm going to talk all about what we've been doing in Setcomp in the container ecosystem and what is it and why does it matter and what is there, what work is there to do in the future. So, I'm just in Cormac. I'm an engineer at Docker in Cambridge and I'm also on the CNCFTSC and a naturey maintainer. And I'm very much involved in the container security ecosystem. So, what is Setcomp anyway and why does it matter? Setcomp is a thing that stands for secure computing, which sounds like a really great thing. It's a bit of an ambitious name, perhaps. Back in 2005, when it was first created, it was basically an extreme sandboxing method when extreme sandboxing wasn't actually that common a thing. It was really just for code that just does computer operations and could only read or write from existing files and basically exit. It wasn't used very much because there actually aren't very many programs that literally just read and write from files and can't, for example, make new network connections or anything like that at all. So, in 2013, a more general version was introduced which is called Setcomp BPF, but it's usually just called Setcomp because it's the most commonly used version. And this last small BPF program, so BPF is a technique originally used in the network stack. You've probably heard about recently about its grown up EBPF extended version, but BPF is the kind of original simple version. It lets you write very simple programs to decide if system calls should be allowed or not or if they're not allowed to whether they should error or be logged or kill the process that's running them. So, effectively, because system calls are the interface between applications and the kernel, this is basically is a method of controlling what programs can actually do outside just computing stuff. So, what kind of interaction they have with the outside world, which sounds really useful. So, in theory, you can take a look at what the program's doing. System calls are shown by Strace, so I've shown the Strace of just doing LS. And for each of these system calls, you can basically say, yeah, that's fine. No, that's not fine. You haven't got permission to do that. You can pretend the system call doesn't exist at all, which is enosys or any other kind of operation. So, that's the theory. In practice, it's not quite like that. So, for our examples there, when you open a file, with set compute, you don't actually get, your program doesn't actually get to see what the file name was, unfortunately, because it just sees the direct arguments of the system call. And the argument for a open system call isn't directly a string. It's actually just a pointer to a string. And all you get is the pointer and you can't follow the pointer to see what it pointed at, which is the name. So, you have to make decisions actually based on quite limited information compared to what you might want. And so, this is kind of limiting. You also can't know what kind of file descriptor's been used if someone's doing a read. It could be read from a network or read from a local file and you might want to allow one and not the other. You can't do that. There's also weird peculiarities. And you also didn't really get any context. You're just called every time the system call and you can't actually keep state in between those. So, you can't say you can do this after you do that but not before or anything like that pretty easily.  The history of it applied to the container ecosystem. Back in early 2016, one of the first things I worked on when I started Docker with Jesse Frizzelle was adding second-comp support for Docker and it was enabled by default, which was a nice thing to have done and most people don't disable it. So, most people have had the benefit of using it since then. Kubernetes spent a long time working out on its implementation and really only in 119, so not very long ago now, finalized the API and it does not enable it by default. And it's still somewhat complicated to manage in Kubernetes is because second profiles tend to be at the moment very long files like the Docker default one is 800 lines long and apparently 800 more lines of YAML was seen as too much. So, you have to work out how to distribute files with this configuration on if you want to customize this. Or you can just use the runtime default setting which will give you something that's pretty much like the Docker set up basically as given you by the runtime. It'll be the Docker one if you're using Docker, if you're using container D it'll be or cryo it'll be similar but due to kind of maintenance things are not exactly the same. In the sort of OCI sort of structure of hierarchy we have in the container thing where we have Kubernetes and then CRI and then we have runtimes. It's kind of complicated set up because and we'll talk about this a little bit more later but there's a bunch of abstraction layers this goes through effectively everything's just passed down all the way to RunC which then it calls the go binding to Libset Comp which is a simplified version of what the actual set comp BPF looks like. And these simplified calls are generated from a JSON config that is slightly, it's basically abstract again the kind of rules that you can use with Libset Comp. So there's this weird and then the runtime actually might have a different form of the JSON which has different runtime customizations. So it's a kind of messy kind of process of converting JSON to JSON to go to see to BPF to run in the kernel. So it's a bit kind of messy. What's the point of this? What are we actually trying to achieve? I think it's very important to understand that. There's some system calls in Linux which are not really considered safe isolated programs to use. Some of these have a very, very large attack surface and there've been a lot of CVEs around them. Perf event open is one of those username spaces within BPF we'll talk about a bit later. These are just very large subsystems that in general most containers don't actually need to use. Often these are used by runtimes and other sort of software rather than actually end user applications. And there've been a lot of CVEs that basically meant that you can escape from a container if you can access these CIS calls. So blocking them is actually proven to be useful. We'll talk about specific examples of where there's been a benefit later. Some CIS calls can disable security features such as the PRCuttle Adrenaline Randomize which basically the disables ASLR address based layout randomization which is a security feature that's been added for good reasons. So applications can simply turn it off which is really unhelpful. And some things are obsolete. There's a CIScuttle as opposed to using CISFS which in Linux has historically been generally has been deprecated for some decades now and has some attack surface and is not really maintained. It's some distros I think have removed this now but all of them. And then there's always been some things that have not been namespaced. Time namespaces are very, very new and it came out a few months ago and key ring namespaces don't exist yet. So there's a bunch of stuff that in a container system it makes sense to just remove the ability of applications to use it. So what have we succeeded in doing with the Seccom subsystem? Username spaces. There's this quote from Andrew Lytmurski who's one of the channel maintainers. You know, basically saying that the huge attack surface from username spaces is huge risk and if unprivileged users can program IP tables they're bound to be some privileged escalations. He said this was before this was, you know, this was actually quite a few years ago before when this functionality was kind of new and shortly after that, I think the same year we saw CV 2016, 33, 134 and a bunch of related CVs here where indeed the IP tables code had some bounce checks missing and you could basically exploit this to get a full provision container escape. Normally this needs CapNet admin which is not granted. So normally it's safe but if you have username namespaces you get CapNet admin in your username space. You can call these commands in your username space. You can't change root IP tables functions but you can compromise the kernel so it doesn't really matter whether it's actually which namespace it's in. This was mitigated by Docker's default policy and so users using that were not affected. More recently, again, the BPF Verifier which again is a new feature for extended BPF. I had some bounce checks on 32 bit operations that were not enforced and you could read and write kernel memory which basically means you can control the entire host. Again, an unprivileged user with access to the BPF Cisco could do this again. The Docker policy blocks use the BPF by default unless you actually grant CapSys admin which is basically a privileged access anyway. So this sounds good. What went wrong? Actually, we caused a lot of problems for users during the last five years with SecComp. I had a bit of a war on Emacs. I stopped people running Emacs in containers with SecComp enabled for many years. This was a really strange story. It really surprised me when the complaints came in about this quite early on. Emacs had this very, very strange thing that a lot of people didn't like for other reasons. The muscle lip see maintainer was against it because it didn't work with muscle lip see as well. But basically, in order to make startup of Emacs faster, it used to, during a build time, it would start running the binary, then dump the output and then instead of rerunning the code that generated the initial set up, it would just load the memory snapshot basically. But the way it required to do this was very normal but it required memory locations to be loaded exactly the same way as they were before. And if you had ASLR, this was not the case because memory locations would be randomized and so it wouldn't work. So it disabled it by disabling randomization but this was one of the things that explicitly blocked because this basically is allowing applications to bypass a security mitigation. Eventually Emacs realized that, well, computers were fast enough that you could just run the startup code normally like a normal application and not stop being so quite so weird. And so this problem has gone away and now you can happily run Emacs in containers. But really, I just felt it was not worth changing the default policy to basically reduce security for everyone just so that Emacs could be run more effectively with its weird things in a container. Worse than that though, worse than breaking Emacs, I also broke Steam. This was not on purpose and not something I wanted to do. Linux has made a bunch of changes to 32-bit, Cisco API, and Steam happens to run 32-bit binaries and is widely used in containers. And this was something that happened really quite early on that Debian, I think, has a habit of doing these things first. They changed from the old socket call Cisco that was a weird multiplex Cisco that could do socket or bind or connect or any of the other socket calls and switch to separate Cisco's. And we hadn't actually allowed for this change. And I think Debian did it early. And they did the same thing with 64-bit time support on those two-bit systems. They again, they switched early before it was officially upstream and these were all temporarily blocked by Sec Comp until we fixed this problem. So it is a problem and a fragility issue with Sec Comp because it requires exact Cisco lists when some new set of Cisco's that suddenly everyone starts using to come along, you really have to update the code quickly, which is really problematic and apologies to the Steam users. There's also a performance issue. There's actually a lot of rules because we list the Cisco's you can use and not the ones you can't use. And the list is very long and it's not processed terribly efficiently for reasons that has mostly somewhat fixable but require a lot of work. Only really IO intensive applications will notice this. And so actually very few people complain but a few people have and they've generally disabled Sec Comp rather than actually fixing it. And then there's some interesting areas, security issues where Sec Comp didn't actually help at all and we didn't do anything to help users. One of which is probably my favorite kernel CVE that Jan Horne found. This is a really interesting security issue and the next is a cache invalidation bug. Basically, there was a 32 bit counter and if you did the right thing at the point at which the counter wrapped round back to zero again, you could basically exploit the kernel and escape your container. And all you had to do to do this was some memory mapping and some cloning of processes which is all totally normal stuff that we couldn't possibly block with Sec Comp. So there was just no way we could protect against this kind of thing. Eventually it was fixed by changing a counter to be 64 bits. 32 bits is too small for any kind of security on anything you can always overflow a 32 bit counter but overflowing a 64 bit counter is pretty impossible because it's so huge. Actually, it was actually interesting that there were, this is still a really interesting CV and worth looking at but it was hard to exploit without having some additional source of information to know when exactly you'd hit the conditions for the exploit. And so actually we fixed an information leak that made it actually relatively exploitable in containers because of the information leak rather than actually because of the Sec Comp but Sec Comp could definitely not protect you against that. The question now is like, should we be using Sec Comp in this way in the container ecosystem? Why is the container platform basically responsible for the poor kind of state of lens, kernel security and the fact that there are container escape vulnerabilities in Linux and why isn't that the kernels problem? And generally I think the answer is that we do want efficient isolation without going into using virtual machines for everything. It's actually relatively the number of container escapes has been, exploits has been not too bad over the years for most people, this level of security is actually kind of fine. And also most of our applications don't use the whole Linux, this call space. Most applications use a kind of a narrower subset that doesn't include, you know the sort of specialized things you get in Linux, doesn't most people's code doesn't run, most application code doesn't run BPF, it doesn't run username, namespaces. Those things are being used for security critical applications and often for control plane applications but end user applications basically just use networking and storage. I mean, some people would say they should just use the POSIX subset and the Linux call space is just way too expansive. I mean, I think there's arguments about what the boundaries of what normal applications should care about are but and this does change over time with kind of performance reasons that for using different system calls and so on. But there is actually a kind of set of things that most applications don't use and it's sensible for us to isolate them off for security because the common system calls are basically mostly most of the time other than that CVE I just pointed you at generally are actually safe. Second was designed that every application would write its own profile but this is really and really, really difficult for user to do. It was not designed for kind of platform administrators and like if you read the documentation we're kind of doing it wrong in the container space but it's actually too difficult for end user applications to use and you only find very, very specialist applications things like, you know, Firecracker use it and a few other things but the number of general applications that actually have second profiles is really, really small and it's incredibly difficult to use for that function so I'm not really surprised. I'm going to go through the things that we could do choose your adventure, what future paths could we take what should we do in this space? I think it's definitely the case that things need doing I'll talk about whether they will be done later. One option is almost the status quo really is that almost no one will use second especially with Kubernetes is it's optional. There's a few large companies I know who take it very seriously and think it's important. Docker users got it by default but gradually as people shift over to using, you know, Kubernetes directly and things like that where even if you're using Kubernetes with Docker Kubernetes disables the Docker second policy. Docker is mostly now a development platform so I'm not sure it makes sense for Docker to enforce it anymore. If you're not going to use it I recommend you update your kernel weekly. That's a burden. Maybe using set comp means you can do it less often than that. Maybe you get a higher rate of zero days but the rates relatively low maybe you can live with it. I suspect that a lot of people are going to just continue to ignore it and just live with the vulnerabilities. I don't think we could actually rationalize the policy. We went for and allow this, not a block list at the beginning because of the whole issue. I mean, it's the recommended thing with set comp. It's the recommended thing with most security things. Just, you know, you know what's safe, you list what's safe and then everything else is blocked and so if there's a new dangerous syscall added and many arguably the new syscalls often do have security issues more than the old ones then you're safe. However, the list of things we block is now quite small and writing the block policy is much easier and it's easier to understand. It's less likely to break something when new safe syscalls are added like the time 64 ones for 32 bit systems which were, you know, these things, it turns out that there's new safe syscalls added a lot of the time partly because of stupid things like there weren't enough flags allocated on syscalls and there's now new syscalls with more flags being added for everything, things like that. These block policies would be easier to understand because you can see what they do rather than try and work out the negative of what they do. They wouldn't be 800 lines long. They would be maybe 10 lines long so we could actually inline them in the yaml which would have to obviously change the Kubernetes sitcom format again to do this but you know, I think this would be kind of a nice review could say allow BPF to remove the default block list approach to BPF and that would be the one line you need allow BPF allow open perf event, that kind of thing. So I think that would be easier to understand. There would be less maintenance work, wouldn't get people complaining things don't work and needing to suddenly fix them. A lot of these problems have been like cross architecture problems with architectures have different syscalls and new changes and people running a distro that expects one kernel on another and it behaves differently. So those kind of issues could be improved. The error support would probably be better with things like that. So the downside is there's potentially the block list the default block list goes very small because everyone decides that these things are okay. So but I think this is attractive and I think it's definitely worth considering. We have a huge problem in the Kubernetes ecosystem about whose problem is this should users really have to understand about set comp? No. Should applications have to understand it too difficult? Is it, but should it be done at the Kubernetes level where you have to configure it now or should it be the responsibility of the CRI or run or the sort of run C type layer of the actual container runtime? Currently we're pushing responsibility up to the user which is kind of terrible. We why don't we have runtimes that provide actual security guarantees instead of just letting you configure it and making it your choice? We are starting to see some of these runtimes. I mean arguably GVisa, which I talked about in a second and VM runtimes are basically trying to make better security guarantees. But why have we pushed down this whole idea that you list a bunch of CIS calls in JSON which is or CIS call handling rules in JSON which is what we're doing. It's not a good design and there's definitely a layering and responsibility issue that we need to solve. GVisa is a really interesting response to this. It basically re-implements large portions of Linux in Go. Basically it kind of has a Go TCP stack and everything it basically says well, Linux wasn't very secure. We kind of re-implemented it in Go in user space in a memory safe language and then we're going to wrap this up. We're going to use that comp internally in it just to make, because it doesn't actually use many CIS calls. It has a performance hit and it potentially has compatibility hit but it's just like cut out all this security issues from Linux as a solution. It's a really interesting solution and definitely worth looking at. Something that I call the Lambda-like solution. My job is Lambda kind of solved a lot of these problems by having a very restricted as a container runtime. It's strict. I mean, people don't think of it as a container but it's a very similar like a problem space. It uses set comp. I haven't actually probed this policy to see what exactly what it doesn't doesn't allow. It has a custom Linux kernel with features removed which is what a lot of people who run secure systems do is just disable a lot of parts of the Linux kernel. This has thousands and thousands of subsystems that are not generally very secure and you can often access them from user space by opening weird kinds of sockets that you don't really use in practice much and things like that. But the Linux distros are very general purpose and they tend to ship with a kernel that does everything has everything as a module loads anything because you know, the general purpose you might want to do anything. Not many people have locked down this kernel configs. Again, you probably should consider doing this but everyone's kind of lives with their vendor conflicts for support reasons and stuff like that and the vendors are not actually necessarily acting in your security interests all the time. Also in Lambda, no applications can run as root full stop. It just doesn't allow it. Again, in container space, we haven't forced that. Again, it's left to the user to enforce that. You know, there's a restricted runtime API. Most of the file systems not writable and things like that in Lambda. We could do something very much like this. We could have a container runtime that made these choices and had a clear delineation of what you can and can't do and a security model and testing and things like that. In a way, the sandbox flag proposal for Kubernetes is kind of like this, but it doesn't define any kind of specification. It's a bit kind of, some things can be sandboxed and some things might not be, but then they can decide what sandboxing is, but there's no kind of Linux runtime that makes these decisions. In effect, the things like the Firecracker container do effectively kind of make those decisions for you. Ish, but there isn't a kind of normal container runtime that does that. As of Linux 5.7, there's something that we've been talking about for a really, really long time that got merged with the EBPF LSM. LSM is the security module. These are things like SE Linux and App Armor. But SE Linux and App Armor give you a kind of general purpose way of configuring these security hooks in Linux for general purpose systems. The EBPF LSM basically says you can inject at each of the decision points in the kernel where it decides can a user do or not do something. And there are a lot of these points. They're much more than just at the syscall there. They're all sorts of places like, and you get much more specific information about what's going on at these places as well than you do at the syscall ABI. You can basically run an EBPF program that can make real programmatic decisions about can this application do this at this point and it can maintain more state and can basically have much more information to make these decisions. This is not simple. I think as I said, it's a startup size problem potentially or perhaps an NSA size problem. I think the NSA wrote SE Linux in the first place and basically defined the kind of shape of what it looks like. And the NSA is an organization that's interested in this type of problem. But yeah, it's the sort of thing that you could potentially do with a medium-sized team and work on this problem for a few years. This is very much looking at it as a technical solution. It doesn't solve the human problems of really what kind of policies do you need to enforce and what kind of model you've actually got here and how does the human communicate intent over this problem, things like that. So there's still a lot of human problems that you have to solve there. So what is going to happen with SECOMB? My prediction is that if you look at the state of the container ecosystem now, there's a continuing lack of investment in the low levels of the stack. There's really not many people working on these problems. It's not clear who's going to work on these problems. Most people seem to expect someone else to do it and not get involved themselves. I think setting up an eBPFLSM container security startup is probably quite easy to get funded, but the other options might not even happen. The serious service providers like the cloud providers are basically just using VMs. And so that's why you're seeing quite mature things like Firecracker. The problem is that most other users of containers are running their containers in VMs already. They're either running VMware on-prem or they're running in cloud provider VMs and not cloud provider bare metal or other bare metal. So most of them don't have the option of using VMs for containers at this point. So even though their stack is becoming relatively mature, most people are simply not using it. So we'll probably see the split where more and more people are using provider services, cloud provider services, and they will just use VMs, VM-based containers via providers or things like that. The Fargate containers of Kubernetes and AWS, things like that, which are all VM-based and just scale as containers rather than as hosts. We're not seeing security vendors solving this type of problem. There's lots of reasons for this. Thomas Dalyan's done a bunch of talks on it, which are interesting. Talk to me if you're interested in the question about why the security industry isn't interested in this kind of problem. And end user, as if Kubernetes is finding it difficult to contribute back to this sort of problem because these problems are quite technically difficult. There's not a lot of people who have the right kind of expertise around the Linux kernel and how things actually work in container run times and have time to work on these problems and have other pressing problems to work on. It's kind of difficult. I mean, even very large end users tend to have very little Linux kernel expertise and they tend to work mostly higher up in the stack. So we're not really seeing much at the moment, much end user contribution to solving these problems. So I'm actually not optimistic that a lot of this stuff will happen quickly. It's taken a long time to get where we are and there's been little investment in it. So thanks very much for that. And I'll be around to answer questions and hope you enjoyed that talk. And it's been fun working on Setcom but I think there's a lot of interesting problems that could be solved and actually aren't being so. If you're looking for a fun problem to work on, it's absolutely open for doing that.


Can you take me through those last couple of seconds of the game? And what did you see, and then how it led to that, the Coro three-pointer? Oh, I mean, obviously, Don had missed the free throw. Well, it's on purpose, and I don't know. But it was short. He was able to get it back up on the glass. You know, then obviously scramble, Karris got the ball, me and Royce were out there with him. It was 200 ball, because we were obviously all chasing the loose ball. Vert got it. And yeah, I mean, he did a good job finding, you know, a Coro in the corner who was spaced. Nick got a late contest. But yeah, I mean, he obviously had to worry about Jared underneath, because it was only a one. So it wasn't like no three defense at that point in time. And a Coro hit it. Overall, as a group, you guys had a good fourth quarter where the three started falling. It looked like the pace had picked up. What did you see that change in those last couple of minutes of the game, wherein Cleveland was able to regain that lead? I mean, obviously, we had a couple of turnovers. You know, I tried to dish it to Nick inside. That was one of them. Tried to kind of throw a dough open out the trap. I was another one. And then, you know, Kale went baseline. And Karris got a steal. So it's three turnovers. Specifically on the one, the trap with DFS, I mean, what happened on that one specifically, just the one where you're trying to kind of throw him out of the trap? Well, I mean, obviously, when you get in the trap, you're supposed to have a couple guys flash to the ball. It was a little bit delayed. And so sometimes you try to throw a guy open. On hot inside, I should just call the timeout. So except full responsibility for that. It's not on Dota Summit. Yeah, I mean, he hadn't been in the game, so it's not him. And did you think Donovan left early for his rebound? I haven't seen it. I mean, I would assume so since he got the rebound. But at the end of the day, man, like, I mean, listen, I'm as hard on the rest as anybody. But we had to get to that point. You feel me? And that's a bang, bang play. That's not like he shoved somebody out of bounds or something crazy. And we got super slighted. Like we had to have a cascade of events that even got there. So we got to be accountable for that one. Was there any conversation in the timeout before the last turnover about if there is a trap in the back court, just what was said in that timeout? Not specifically about that.  I mean, we just played two teams that blissed the pick and roll. And you know, we got to get our flash guys in there. I mean, but again, it's happening fast. I understand the guys are probably running down court. I'm at the end of the day, I should just call the timeout, let it be what it is instead of trying to break the press the way I did and the way I saw it at the time. It's that simple. So that's not JV this. Not dope, like I said, he wasn't in at all in the fourth. So didn't really have a feel. That's, I should just call the timeout. How do you guys keep, I guess, like the spirits and confidence high even though you guys are riding this little mini skid that you're on right now? I mean, at the end of the day, we've been in every game. So there's positive to take. Obviously, you want results. And we're trying to do this at an accelerated pace, right? We basically in training camp for this group. You know what I mean?  It's bang, bang, everybody, you just break it, boom, boom.  People have seen that all the time. That's not the case. And so like I said, sometimes just got to slow down, maybe even overly cautious, I'm not trying to fit, you know what I'm saying? Pass in tight windows. Just call the timeout and let it fire another day.