Hi, I'm Rodrigo. I'm a software engineer at Microsoft. Hi, I'm Marga. I'm director of engineering at ISOvalent. We are here today to talk about a new feature that has just been added to Kubernetes that will help us run our workloads more securely called user namespaces. Rodrigo, can you share with us a bit of background of what motivated this new feature? Yeah, you know how in Linux distributions, most applications run with their own user and group? Sure, yes. For example, NCinex or MariaDB or BIND, they all run with their own users and groups. This has been the case for many years because it limits the permissions for each application running on the machine. Right, exactly. But when we're running our applications inside containers, they usually run as root. And this root in the container is also root on the host. Yeah, that doesn't sound like a good idea, does it? Indeed. This can be a serious problem. For example, if there is a vulnerability that allows a container break out, like the CV in 2019 5736, this was a vulnerability rated with high severity that allowed someone controlling the image of a newly created container to override the run-c binary on the host. That sounds scary. The attacker would basically have root privileges on the host and could then move on to compromising the whole cluster. Yes, and what is interesting is that the whole problem could be completely avoided if Kubernetes had support for user namespaces, as that mitigates the CV and many others as well. So cool. Can you tell us about another one? Sure. Very recently, while we're already doing the work of adding user namespaces to Kubernetes, another CV rated high was discovered. This CV was in the year 2022, and the number is 0492. In this case, a malicious container could trick the kernel into executing a certain binary file as root after a process finished, allowing them to get root access on the host, and with user namespaces, the CV is also completely mitigated. In short, running our containers as root is a problem because whenever there is a vulnerability that allows escaping the container, the malicious process can compromise the host, other pods, and even maybe use it as a stepping stone for a more cluster-wide attack. Right. In the end, the technologies we use to isolate our containers are also software, and as all software, they help us. So the least privilege that we use to run our software, the better. And user namespaces is a very important step in this direction. But before jumping into the details of user namespaces, let's clarify that with namespaces, we don't refer to the namespace parameter we use in Kube CTL. That is just a logical grouping of pods. During this talk, we refer to the Linux kernel feature for process isolation. There are actually quite a few Linux namespaces that we use when we start a pod in Kubernetes. Let's take a look at them. For example, we use a UTS namespace to give a unique hostname to each pod. This way, the pod doesn't have the same hostname as the host it is running on. We also have a network namespace. In this case, all containers in the pod have the same networking namespace that allows them to communicate over the local host interface. But they need to use the virtual network to communicate with containers running in other pods. That way, pods only see the network traffic that they are supposed to see. There's also a PID namespace. The process visible in each container will run are limited to the process inside each container. Each container only sees processes from their own container. And similarly, with other namespaces, like the mount namespace, the IPC namespace, or the cgroup namespace. But of course, the focus of this talk is user namespaces. So let's talk about how those work. As we said at the beginning, before Kubernetes 125, the user running inside the container was always the same user as the one outside. So whenever we run a process in our containers of root, they were running as root on the host as well. On top of this, if we were using an unprivileged user and granting a specific capability to it instead of using the root user, the capability granted to the container were running in the host as well. Now, when we enable user namespaces, the user in the container is no longer the user on the host. The processes in the container can still run as root, but all interactions with the system will be mapped to a different user. A user namespace isolates security-related identifiers and attributes of a process. In particular, user and group IDs, keys, and capabilities. The way to use them in Linux is to split all of the available IDs and assign subsets to different user namespaces. The whole range of UIDs available is a 32-bit number. In the Kubernetes implementation, we reserve the first range of 16 bits to the host, from AD0 to 65535. This means processes and files in the host should use this range for UIDs and GIDs. The 16-bit range of UIDs after that can be assigned to the first pod in the node using user namespaces. We map UID0 and GID0 inside the pod to UID65536 in the host, so root in the container is an unprivileged user in the host. Inside a pod, the range of UIDs goes from 0 to 65535 or 16 bits. And all the settings in the pod spec that refer to a user or group ID, like RANAS user, RANAS group, FS group, and so on, refer to the ID inside the container. So the whole space of user IDs is split into 65,000 chunks of 65,000 UIDs each. The IDs assigned to a pod are chosen automatically by the QLED. No two pods have the same range of IDs. There is no overlap. You can think of this a little bit like node port on a service. You leave it empty and some free port will be assigned. Usually, you don't really care which one as long as it's that free port. The same applies here. Some range will be assigned. We don't really care which one as long as it doesn't overlap with the ranges assigned to other pods. Because of this mapping, the amount of damage a rogue pod can do to the host and to other pods is very limited. And obviously, a pod will never be mapped to the host ID zero. This means a pod with username spaces will never run as privileged on the host. Also, the capabilities granted to the pod are only valid inside the pod. For example, if we grant Capsis admin, often considered a new route, the capability is only valid inside the pod and very useful there. But if the process breaks out of the container to the host, the capability is not valid. Additionally, there are some capabilities that are just not usable when inside a username space. One of these is Capsis module needed to load a kernel module. If you grant Capsis module to a pod using username spaces, you still won't be able to load a kernel module. So, Rodrigo, how do we enable this super cool feature? To use this feature in Kubernetes, we just need to add the host user field to the pod spec. We set it to false to indicate that we don't want to use the host users. This will create a username space so the users are isolated. This follows the same syntax as other namespaces like host network or host IPC. And what is super interesting about this is that the vast majority of workloads can enable this without doing any changes in the app and just benefit from the extra security. So cool. So what are the current requirements and limitations for enabling username spaces? That's a great question because we have a bunch of them now. But we'll work on removing some of them in the coming versions. First, as we already mentioned a couple of times, we need at least Kubernetes 125. Then we need supporting the container runtime to use this feature too. Do we have the supporter ready? It depends on the runtime. If you're using cryo version 125 already includes this. If you're using container D, the patches have not been merged yet, but we're aiming to merge them for the one seven release that is expected this year. And if you're still using Docker, you can't use this feature today and there are no plans from them to implement it, at least for now. I see. And how do user namespaces interact with other namespaces that we can also enable or disable in Kubernetes? When we enable user namespaces, we can't use any other host namespace. This means we cannot mix host users' falls with host.network.true, host.ipc.true, or host.pid.true. Makes sense. The behavior otherwise would be quite confusing. Now, we mentioned that all interactions with the system are mapped back to a different UID in the host. On Linux, UIDs are used by the OS to enforce file access permissions. So how does this affect accessing data on shared volumes? If my pod creates a file in a shared volume, will other pods be able to read it? Right. That's the tricky part. If we just allow volumes with no further thought, it won't work. Because as we said, pods running in different namespaces will be mapped to different UIDs in the host. The files created by one pod would be owned by one UID, but other pods would run as completely different ones, so it will be impossible to share a volume, for example. So for now, we only support stateless pods. In the future, we plan to support stateful pods, probably using a new Linux kernel feature created by my co-worker, Kerstin Browner, called idMapMouse. This feature was created to solve these very specific problems that contain your face with volumes and user namespaces. Wait, so what do you mean exactly with stateless pods? I mean pods, either without volumes or pods that use simple volumes that are tied to the life cycle of the pod, so there's no real persistency. The current implementation supports these types of volumes, Secrets, ConfigMap, Network API, Projector, or EmptyDeer. And finally, another limitation to consider is that the files on mounted volumes will always have permission for the group. So if we want to store an SSH key and in a secret and mounted, we won't be able to use it as applications typically enforce that the SSH key doesn't have permissions for the group, right? Right, yes, this is the limitation of the current implementation. Solving this and adding support for stateful pods is on our roadmap for future releases. And another limitation that we're looking to solve in future releases, too, is that some files are mounted by the cubelet, like etcresolve.com, and those files are owned by routing the host, so they cannot be written by routing inside the container today. Right, there's always more work to be done. So how about we see how this looks in action in a demo? Sure, let's do a demo, just a comment. This demo is on my laptop, but I want to highlight that we will make this available in Azure as soon as it's feasible. Now, without further ado, let's see the demo. Here's a Kubernetes cluster running Kubernetes 125. It's also using Continuity with our patches that are not yet nursed. So what do you think if we start creating a pod? What will the pod do? The pod will not do anything interesting. It just will slip, but it will have the Capsis Admin capability. Yeah, so it can do whatever if I... It can do whatever, yeah. And we'll excite into the pod to execute our exploit. All right. This pod is not running username spaces. It doesn't have the host is a false field. So let's just first create... Apply this demo after. Let's wait until the pod is running. Let's see. Yeah, it's running. Let's see that this common is indeed running as put in the host. So the slip infinity. Yeah, and it's running as wrote. Yeah, the slip infinity is running as put in the host. So let's see the script I created to exploit this CVE. It's based on the CVE and some things I found on the Internet. The CVE works in the following way. With C Groups D1, you can have the possibility to register a release agent. There is a script that will be executed when there are no C Groups, no process in a C Group. And this will be executed as wrote. The vulnerability was that this could be written without checking the proper permissions. So here we're creating first an empty file as the release agent. And then we're adding these lines to the file. One to print the capabilities. And another one to print as which user this is running. And we leave a slip process lingering there. We're writing all of this to this file on the host. So on good on the host. And when will this be executed? So this is script triggers that there are no C Groups. And in the last line that there are no process in the C Group in the last line. So as soon as we execute the script, everything should happen and this file should exist. If we are vulnerable to the exploit that we expect. Yeah, let's see. Yeah, let's copy the script to the path. And let's execute the script now. Now output. This is probably a bad signal. Let's see if the file was created. The file is created and it's owned by root of the new ID and group ID. Let's see the content of the file. Will it have the capabilities? Yes, it has all the capabilities. And it says that it's running as route. And it's running everything as a route. And let's see if the slip process is also lingering there. And yes, it is indeed lingering there. It's running as route. End of the world disaster. So let's try again now with the user name spaces. Yes. So here is the same. The same pod Yano. We just added this field. The host user's fault. With this field, it should enable user in spaces. And therefore it should not be running as route on the host. That's what should happen. Let's see if the, if the pod is ready, running. The pod is running already. And is it running as route? Or is it running as a user? Let's check. So it's also running in slip infinity. And it's running on this, this unfinished user. So this is a good sign. So there is a thing to take into account when executing. This is the very same script. We just executed. But as you can see, start with a mountain line. The thing is we cannot mount inside this pod. But we can create a nested user name space where we have all the capabilities needed. And we can mount there. So let's first copy the script to the, to the pod. And let's verify that this line will not work. Okay. So just to be sure. Yeah, so this line doesn't work permission deny. So let's execute this. This is like technicality that doesn't really matter. But if we use this, we can execute all the lines there. So here we can see that the mount was executed correctly. However, basically most things that try to create files or directories have permission denied. The most interesting one to check is this one because we couldn't create the release agent file. This is the binary binary that will be executed as such. So we couldn't create the file things. Mells like this didn't work. But let's see if the file exists. The file doesn't exist. The content of the file is of course. If it doesn't exist, there will be no content. Yes. Yeah. And there's no sleep process lingering there either. Right. Yeah. Yeah. So we couldn't break out of the container. Yeah. With this exploit. Yeah. Just adding this simple ball in the pod and the pod spec. Did all the difference because the container doesn't run as good on the host now and these files can only be written by root on the host. So this is a very good thing because a lot of images that need to run as good. In most cases can continue to run as good fine and modify if user spaces are enabled, but just have this extra protection as they don't really need to run as good on the whole. Amazing. So to recap, since we are running several applications in the same host, we need a way to isolate the users. We're already isolating the network, the view of processes, the file systems, etc. But until now, we were not isolating the users. This left behind a lesson learned by Linux distributions many years ago to run processes as different users with the least privilege possible. In the user name spaces, we bring some of those best practices back if our applications run as written in the container. They become more secure because the process is actually running as an unproduced and privileged user in the house. If a vulnerability allows an attacker to escape the container, the damage is limited as the user is unproduced and doesn't have any additional capabilities and enable user name spaces doesn't require changes in the app for the vast majority of workloads. This means that several vulnerabilities are no longer exploitable with user name spaces enabled. For example, the first three V is in this list are completely mitigated. They can't be exploited if the pod is using a user name space. The other two are partially mitigated. Those CVs allow attackers to read arbitrary files from the host. And when the user in the host is unprivileged, we can only read files that have read permissions for others without user name spaces. We could read any file in the host. And these are just a few examples. There have been more vulnerabilities relating to accessing files in the host and most of them are mitigated as they are based on the same underlying issue exposing the host file system to the container. With user name spaces, we never run as written and so we can only read files if they have permission for others. If we don't want an application to run as privileged, we shouldn't run it as root in the host. Today, we run most of them as root and try to limit what root can do with SecComp and AppArmor. Instead, we can now run them as root, not root, with users that aren't privileged outside the pod. And we can still apply SecComp and other Linux security models for additional isolation. Exactly. Before we go, I'd like to thank Giuseppe Scrivano from Red Hat, who is co-author of the CEP with me. We both work in the Kubernetes implementation. I'm working in the container use support too with some members of the community and he also worked in the Cryo implementation. I would also like to thank people from the Signal and Sync storage community that helped to move this CEP, which was first started seven years ago by other engineers. And a lot of thanks to Derek, Manuel, Dawn, Sergei, Hem and Tim. And thanks to MicroWorkers and Microsoft, Mauricio and Albon that helped me with some early revisions of this CEP. Indeed, many thanks to everyone that helped make this a reality. And thank you for watching.


So, but Nino is overpowering BJ. So I'm battling these alter egos, bruh. Cause soon my phone rang, I'm out in the street. I'm, I'm, I'm in it. I'm, and then I'm in a motherfucking meeting, man. Two days later, you know what I'm saying? So I had to really tell myself. You can really see how the foundation of that kind of behavior leads up to people like the nipsies of the world and people like that. Exactly, bruh. You can just see how that. And he, and it's, it's crazy.  He was in his stage where he was building that to where it would have pulled him away from a density collectively. Cause he didn't have to be there. He built that already. He ain't had no minutes there and he didn't have to be there. Yeah, we on boss talk one-on-one, one-on-one. Yeah, we gon' talk. So I, um, I was summons to this meeting. Me and Rat Dogg, Willie Dogg, AK Rat Dogg, rest in peace. You know what I mean? My, my, my, my potting and crying, my road, our everything. We summons to this meeting. So me having a broad mind again, like I do and that's why they bought me to the meeting. Cause they know this A1, he had torpedo, two, he, he, he own point and he smart about it. So if we send him and he go, he gon' go right. He ain't gon' go with the boys. So he gon' make everything work. This is why I was bought in. Big homies bought me and laced me.  Yeah, I heard the nigga, man. I heard the fat boy, man. He football player slash, did a few bounces for Bobby Brown and then what about the nigga?   And really get myself about this situation. Cause I'm, I'm sitting on a lease a meal ticket, man, about the street's dirty. And I just put the peace treaty together in 1992 with other cats collectively out to join downs, pure courts, high senior villas. So I'm one of the advocates to represent the Da Mousa from this peace treaty. So I'm now, I'm torn between, like I said, a part of me still BJ in the streets and then I'm developing this Nino cappuccino characteristics. You feel what I'm saying? So, but Nino is overpowering BJ. So I'm battling these alter egos, bro. Cause soon my phone rang, I'm out on the street. I'm, I'm in it, and then I'm in a motherfucking meeting, man, two days later. You know what I'm saying? So I had to really tell myself. You can really see how the foundation of that kind of behavior leads up to people like the nipsies of the world and people like that. Exactly, bro. You can just see how that.  He was in his stage where he was building that to where it would have pulled him away from a density collectively. Cause he didn't have to be there. He built that already. He ain't had no business there and he didn't have to be there. But it was the foundation of the family of it, the community. He's doing the same thing I'm doing here. Right. The exact same thing. That's why I went to his store. But yeah, you gotta remember though. Jealousy, envy, all these things that part, bro, niggas. I don't got any. Yeah, you don't got it.  It ain't my fault. You know what I'm saying? Yeah, we on boss talk one-on-one, one-on-one. Yeah, we gonna talk.


Hello, I'm Betsy Alice, Executive Director of the Sheboygan County Chamber, and I'd like to welcome you to this edition of Love Where You Live, a monthly magazine of the best things that we have in Sheboygan County. And speaking of some of those best things, our first guest today is Matt Weersbach. He is Program Director of SEAS, the Sailing Education Association of Sheboygan. I'm so used to calling it SEAS, Matt, that it almost eluded me what the actual name is, but it does have some meaning. Welcome to the program. Thank you. Good morning, Betsy. And yeah, the name slips me up a little bit once in a while, too. Yeah, yep. Takes a little getting used to. Well, it's a busy place these days, and I would guess that probably a lot of people in our county don't know much about it. So if you could share with us maybe the mission, the vision, what is SEAS today, that would be really helpful, I think, for me as well as for our audience. Of course. Sailing Education Association of Sheboygan, SEAS, was formed a few years ago, and it's kind of a conglomeration of the non-profits that have already existed in Sheboygan for a while. The Sheboygan Youth Sailing Center started 25 years ago. Sales Sheboygan has been around since about 2000, and a lot of these organizations have started some really good projects in the sailing and boating realm. But moving forward, we were trying to help organize that a little bit better. They were all individual organizations, and they still maintain their own non-profits to this day. But we're trying to help share resources, we're trying to help actually move programming forward and do more for the community than was currently being done. Our goals are very large, and we want to get a lot accomplished. I love that. That's a great, great place to start. So our actual mission is boating for everybody. And our goal is to get anybody who wants to go on Lake Michigan out on the water. And we think it's a real shame if you've lived in Sheboygan and you've never been on Lake Michigan. It's such an amazing resource, and it's right there in our backyards. I completely agree with you. When I first moved here, I had to talk a few people into going swimming. They hadn't been swimming in 20 years. So, yeah, I'm a huge Lake Michigan fan. So tell me a little more about your adaptive sailing program. That's fascinating, and it sounds like it's growing and doing some amazing things. Yeah, adaptive sailing is one of our newer programs, and that's something Seas has started to take on in particular. While Seosha Boygan does a lot of major regattas, including world-class events, and New Sealing Club's done a great job teaching youth and adults for, as I said, 25 years, nobody had really been working with people with disabilities. And that's something that Seas actually took up in 2014 when we hosted the World Blind Match Racing Championships. So everybody on the boat was blind. So we had three blind competitors. Their coach was on a boat following behind, and they were using soundmarks to get around the course and to find out where the other boat was. There was a group in Houston, Texas who had originally decided they were going to host that event in 2014, and they backed out. And I'm not sure the reasoning why, but I think part of it was some of the other organizations were intimidated. So World Sailing was looking for a place to host this event, and they came to us because our reputation was great, and we do have a little bit of a reputation of trying new things around here. So we hosted the event. After we agreed to it, we realized, well, we've never actually worked with anybody who is visually impaired or with any sort of real needs outside of the traditional sailing structures. So we looked for partners with the local Lions Clubs, and we learned a lot as we went, and we've continued that on to this day, and we'll actually be hosting that same event again this year in the fall. Wow, that's exciting. That was a great event. I remember, because they used the sound, there was a construction truck on South Pier during one of the events that had the reverse beeping sound, and it kind of created a little bit of havoc, but they got over it quickly. Yep, and Coast Guard Helicopter did a training mission not too far away, too, and then they couldn't hear anything, so there were some obstacles to overcome that week. Well, pretty amazing event, and what a great community service for you to provide. You recently announced the building kind of across from the Chamber of Commerce down the way a bit, the old Alliant building that's right on the river across from Spreckers that you're going to be developing something there. Can you tell us the plans for that property and what you can expect? Our plans are to tear the old building down. We had originally hoped to use it as is, but it's just too big of a project to fit it to our needs. So hopefully in July we're going to tear down the old building, and in the next year or so build a new facility that's specially designed for all the things that we're trying to accomplish. We really are looking for a space that meets our needs, which are a little bit unique to sailing and boating and programming. So the goal is to have a new building by the spring of 2017, but as anybody knows that could happen or it could take a little longer, it is building. There is a lot happening in the spring of 2017. That's when a lot of the apartment complexes downtown will be completed as well. So we'll have a lot more people downtown. Yep. Tell me a little, I'd like a little more detail on that building if you can share. The kind of spaces, will there be public spaces? Will it be primarily for boat storage? How does it look? So we're looking at classroom space, some conference room space. It will be open to the public. Everything we do we want the public to be engaged in, and we don't want anybody to be afraid of coming down and meeting us and being engaged in the voting community. We are not a private club by any means. While we're friends with the Schwergen Yacht Club, we are not Yacht Club-affiliated officially. So there's no reason that somebody can't walk in and ask us what's going on. Space will be available to groups if they need anything. The administrative offices will be there as well as some classroom space. The boat storage is probably the more complicated part, and we're working on developing that. The actual work zones are, that's the biggest challenge, developing some spaces so we can do our own maintenance in our own shop. Okay, well great addition to downtown, as are many of the developments that are happening here. So we're, you know, this year a new project for SEAS, well there are probably several new projects for SEAS this year, right Matt? Oh yes. I believe Sherboyton County has probably the best Independence Day celebration of any that I have ever experienced, not just in our area, but I think even nationally. I think we have a phenomenal set of things that goes on that weekend. And I'd like you to tell us how SEAS is going to be involved in that this year. Yep, I'm sure a lot of the viewers are familiar with the Art Armada, which a lot of locals have called the Garbo Borgata for years. The Art Center came to us and said they weren't interested in doing it again this year, and our chairman Leslie Kohler decided that we would try to make it happen, and we have. We are going to be hosting the event much like last year. We've changed the name, it is now going to be SEAS Water Sports, and we're sticking with themes just like the Art Center used to do. This year's theme will be the Salute to the Military. Okay, and tell me how that's going to look. Yep, we're keeping a lot of it the same as we used to. The open class will still be the class designing and building their boats before the actual day of the event. We're inviting them to take their boats out into the parade as well, just like in the traditional sense. We are making some space available in our storage facility on Monday and Wednesday nights in June. So if people need space to work on their boats, we'll be down there, and they can use our facilities and store them there while they're in the construction phase. Saturday mornings will be the same, and we're really hoping to get some community clubs and churches and organizations like that involved. Kind of a different spin. They used to focus on getting industries and companies involved, and while we still invite them to, we thought it might be more fun to try to get some of the more civic and social groups together and see if they'll build. And a lot of them are involved in the parade that day, so that is the kind of thing they enjoy doing. Yep, it would be great. It's a great showcase with a lot of people down there. We're also doing the traditional, what do we call it, the Drifter division, which is the build it as you come down.  Which is always my favorite, as a spectator, because they sink pretty fast. But it's a lot of fun, and they always have a lot of smiles on their faces. And so does the audience. Exactly. Last year I was across the river in a crowd, I mean a crowd of people watching that from the other vantage point, the year before last. It was fabulous. So I'm just going to play this out a little bit. If I have never done this before and I have no idea what it entails or how to participate, how do I get started? Well, all our information for the event is on our website. It's at ccheboygan.org slash watersports. The guidelines are there, the registration is there, and our contact information is there. So if anybody wants to get some insight from a human being rather than just a document, they can send us an email. One of us will respond from the staff and we'll help you through the process. My advice first, find a team. I've seen a few people do it by themselves, but it seems to be a lot more fun when you get a team together of a couple people. Could be a big family. Yep, a family would be great. For your first time, I might recommend doing the Drifter Division because come down that day, all the stuff's there, and you'll kind of get an idea of what it's going to take to build one. Yeah, and you'll learn how to go into the water so that you're prepared for the advanced level next year. We'll provide life jackets. We'll provide the paddles. We'll do everything we can to make it a safe, fun experience. We have chase boats in the water that'll pick you up if you sink and don't want to swim back. Most people swim back. Well, you know, if you're not going to participate, watching it is really fun. So bring your family down, come to see all that's going on down there with that event. It's a great event. So we're really pleased that you picked it up and that you're expanding it and making it a little, putting your own twist on it. But thank you for that. The biggest addition this year is going to be our partnership with EOS, too. We're going to do some paddleboard racing this year as well. Kind of having noticed over the years that there's usually a little bit of a gap between each flight of the Carver boat we've got. Well, in those little gaps, we're going to use a little relay team with the paddleboarding. Wow, that's great. Great stuff.  Let's go back a little bit and talk about your programs. And what's coming up in the future, even into the wintertime? What happens with SEAS during those seasons? Yeah, we've got a lot of programming going and we're trying to be year-round. We have really taken an initiative into powerboat training. We have one of the few powerboat courses that offers on-the-water training as well as meets national standards for safe powerboat operation. So basically what we do is prepare people if they want to get their state certification. We're not officially authorized to provide the certification from the state yet, but if you take the course, everything that's going to be covered is covered and there's on-the-water time. Part of that requirement is eight hours of on-the-water training and a written test at the end. That proves you've met national standards with U.S. powerboating. Are there boats available for this? Is that how it works? Yes, you just signed up for the course. We provide everything. You come down and get out on the water and learn how to be a safe powerboat operator. Wow, that sounds great. Our other big initiatives, especially in the winter when we have a little bit of time and we want to do something but it's a little cold to go sailing, will bring in speakers. Rochelle Pennington, who's an author who's written on a lot of great topics, is one of our favorites to bring in. But we're open to many different maritime topics. Anything that ties into nautical history, especially if it's regional, those are some of our favorites. And definitely some of the community favorites as well, especially now with the marine sanctuary potentially in our future, that will become more and more important. One of our favorite topics that Rochelle's done for many years is on the Christmas tree ship, which would actually fall within that nautical sanctuary. Nice, very nice. Yeah, I've seen the notices for that. And speaking of that, how do you publicize these events? How will people find out when they're happening? Yep, we try to get it out through all the local sources. It's usually in any of the community connections, sort of radio advertisements or in the paper. We also have it all listed on our website and we have a monthly newsletter that goes out. So anybody who's interested in finding out kind of our data, well, month to month, we ask that they sign up and they'll be enrolled on our automatic newsletter. Oh, that's a great way to find things out about organizations. I know. So any other plans in the future that you can share with us? Any new programs that are out there that you're trying to work on? It's really trying to get more people on the water right now. One of our initiatives this summer is to get 100-plus adaptive sailors out for an experience. I've got about 70 signed up at this moment. So what we're really looking for are groups to come together and come as a group, but we'll also take individuals if they really want to experience this and we can handle whatever needs are required. We've got some equipment developed already. We had a gentleman with ALS out sailing last year. And after that challenge, I think we're ready to handle a lot of different things. And moving forward, we want to expand that offering. We really want to have a vibrant sailing community for just everybody that wants to participate down here. Absolutely. And I've heard, you know, I have heard Leslie Kohler talk about the importance of everyone, you know, from the smallest children to the oldest adult getting out on the water, learning to do it safely and having a lot of fun. Yep. It's in that classes. I always tell people about the sailing classes that we offer in this community because they are so inexpensive and accessible. Yep. I actually learned through the Shiboygan Youth Sailing Club as a young kid. I've had some family who have sailed, but my parents weren't boaters, not particularly at least. And I learned through the Shiboygan Youth Sailing Center, became an instructor when I was a teenager. And it all kind of developed where I started working for seas a number of years later, of course. Yeah. And I'm very, very proud of what we've got here in Shiboygan. It's a very high level program that kids can start at seven or eight years old. Right. And really, it's a sport that you can do the rest of your life in all different directions. Racing is just part of it. And we have a great racing heritage here in Shiboygan with sail Shiboygan, but you don't have to be a racer to enjoy the water and go sailing. You can just go out and go for a sail with your friends and family. And I like to try to remind people that. You don't have to be rich to own a boat. You don't have to even own a boat to get out on the water. You just have to find a friend, either come down to our programming or meet somebody over at the Marina or the Aqlub. A lot of boat owners love to take people up for a ride. And that was a wonderful surprise for me too when I moved here, finding that kind of camaraderie and being able to go out and watch the sailing competition with some instruction. So I knew what the heck was going on. It was a wonderful experience. So I encourage everyone to consider at least exploring the sailing lessons, looking at participating in the new name for the Armada. Seas Water Sports. The Seas Water Sports activities around the fourth. And also coming up for some of those speakers, because I've been to a couple of those and they're very well done. This is a wonderful resource in our community. I thank you and all the staff at SEAS for providing that. I really appreciate it. And I appreciate you being here today. Thank you for having us. You're so welcome, Matt. Thanks. So we're going to be taking a short break now. And I would like to invite you back when we are here to talk with Stefano Villietti, who has recently been named the Culinary Star by the Sheboydon County Chamber of Commerce. And as you know, operates a number of fine restaurants in our area. Look forward to talking with Stefano when I see you back here. Welcome back to Love Where You Live, a monthly magazine of the best parts of Sheboydon County. I'm Betsy Alice. I'm the executive director of the Sheboydon County Chamber. And this is our way of sharing the news that we find in the community. I am very pleased to welcome today one of our Chamber champion award winners, our Culinary Star. Stefano Villietti and his wife Whitney, one walked away with the big award of the year for the restaurant business this year in February. And he's here on our program today. Thanks so much for taking some time out of your prep time. Probably. I'm guessing this is morning that we're recording this. So yeah, we're happy to always run away from work, though, and come to do something fun like this. So happy to be here. Okay, good. Thanks for being here.  But that's okay. It always gets better. And my favorite, I have to say my favorite thing is that even if I don't think I'm going to order a special, I always have them express those to me because I love to hear them say them. Absolutely. So you have some magic going there with that kind of presentation. Could you please tell the audience a little bit about each of the restaurants that you own or operate in Sheboydon? Yes. Traderia Stefano would be the original location. And we've been there for 22 years. And it seems it has flown and the city has changed a lot. And that's kind of a multi-regional Italian restaurant. So we don't really say we're Tuscan or we're Sicilian, but we sort of grab from all regions of Italy. So I would call it multi-regional Italian food. Very authentic. We only sell Italian wine. So we're very specific about trying to match our cuisine. We then did the fifth certified Neapolitan pizzeria in the year 2000. Fifth in the nation. Fifth in the nation. Correct.  So we wanted to do it. It was what I enjoy. I like all pizzas, but this is the one that inspired me. So we did that one in the year 2000. Brought a pizza maker and we do pizzas, wood-fired pizzas and paninis and things. And it joins a small store, which leads you over to our third place called Field to Fork. So between Il Retrobo the pizzeria and Field to Fork, which is a daytime cafe, we have a small store. Field to Fork is really a breakfast and lunch place serving familiar foods. The difference being these are sourced locally. We spent almost a million dollars last year within about 75 miles sourcing ingredients, whole stear, whole pigs, fresh eggs, fresh lamb, pastured lamb, produce, things like that. So that's a really great thing for us. And then the Duke of Devon is an English gastropub, which is down on the river, a beautiful location along the Sheboygan River. And we've been doing that. So it's kind of, we've got the classics, the fish and chip and the bangers and mash and all those great English things. But it's just a great atmosphere to sit and have a pint of beer and watch the boats go by. Even mushy peas. Even mushy peas. You gotta have that post-World War II mushy pea. And July 3rd, the evening of July 3rd, my husband and I always scrambled to get there to get a site out on the deck to see the lighted rig out on the creek. It's a great vantage point. It's a beautiful location. It really is. It is a fabulous location. So how'd this all start for you? At what point in your life did you kind of develop a passion for cooking or feeding people so well? Well, I would probably say that growing up in a household that really valued family meals together, had a big guard. My mother was a great provider in the home. She eventually became a nurse and worked, but she was really there for us every night. We came home to a beautiful meal. And so that was the beginning. My father ran a company here locally that had some business in Italy. So at a young age, I was very fortunate to be able to travel to Italy several times. So I kind of had this love for all things Italian at a pretty young age. I was either going to teach. I thought maybe going to teaching after college. I was a history major with a minor in economics and I thought about possibly teaching or maybe going into business. I wasn't sure. But I always found myself running home to cook and getting more excited about that than anything on earth. So when I was doing real estate in Chicago, I was running home, running to the store, running into cook. And I said, wouldn't it be neat if I could do this, which I seem to love and make a living? So that was kind of the beginning. It was probably high school college starting to think about it, but really after college is when it really hit me. Wow. And really the other question I had just naturally is from what I heard, you really didn't have experience running a restaurant before you opened one. None, yeah. I don't know if that was the right or wrong move. I think it was refreshing in a sense that it felt sort of like a dysfunctional home when you came to a restaurant. Maybe that's a good or a bad thing, I'm not sure. But with my lovely wife Whitney, who is my business partner, and she was able to, we just decided to try it. And I had to learn a lot very quickly. I did hire a chef initially to help me learn. But we decided that there was something refreshing and unique about doing it that way. It didn't feel like a concept or like too polished. So it was kind of a neat thing. It was really like coming to our home. We lived upstairs. We had a toaster in our bed and that was about it. You lived upstairs. We lived upstairs above the Traderie for the first couple of years and got up at 4 a.m., went to bed at midnight and did that for, we didn't miss a shift for seven years. Oh my gosh. So it took good early sacrifice, but it was well worth it. Yeah, because you really have become a destination restaurant. Yeah, it's been wonderful. But Sheboygan has become that destination too. So we're lucky to sort of coat tail along with that. But when you look at some, there's so many reasons to come to Sheboygan. We just became another one. There were so many reasons, whether it's the lake or the Kettle Marine or the Gulf or all these other things that are going on. So we sort of slid in there and said, well, hopefully we'll be the destination too. Yeah, we'll feed all those people. That's right, exactly. So sourcing locally, you mentioned it before. Tell us why this is so important to you and what you think this adds to the experience. Well, you know, a lot of people have a lot of reasons for doing it.  There's sort of a, I don't know, there's a lot of reasons to do it.  And I would travel to Italy every year. We've taken 55 people to Italy. We've done a lot of different things over the years to try to learn and teach and sort of have continuing education in that sense. But I would come back and I would try to recreate these dishes with conventional foods that came through the normal stream of distribution. And they never tasted the same. And so I would start, I started going to Madison to the farmers markets and talking to farmers and people. And I kind of said, what's wrong? And I won't go into exactly what the pork farmer told me, but he said, if you laid around on a barn lying in X and Y, you wouldn't taste very good either. So we began sourcing things that were done the way they're done in Italy. My cousin raises the pigs. My friend over here raises steer. This guy grows vegetables for me. So we started really, in Wisconsin, had so much going on. We didn't realize, well, Madison being sort of the focal point of it all. But wow, what an advanced farming culture here. And even on a small, not just big farms, but small, diverse farms. So we started to tap into that. And once we did, it just, everything was different. So for me, it was a huge source of inspiration. And why should I give money to someone five states away and truck something when I can give it to a farmer who's 20 miles away and they come and eat my restaurant and it tastes 50 times better? And it's actually cost competitive. When you do it the way we do it by buying whole animals and doing it a certain way, you can achieve economies of scale, which can actually make you very competitive. And the economics of it are so broad-based because those farmers benefit by this too. Absolutely. So we all do, ultimately. Right, it creates an economy in itself. I couldn't see any reason not to do it. Yeah, no. It was a very simple decision. It's a little more work, but it's worth it. When I moved here, I was amazed at the bi-local ethic that already existed here. I came from an area in Michigan near Traverse City where they used it as a huge marketing piece. And over here, people were just used to it. It was part of life that you sourced locally. Just makes sense. Yeah, it's wonderful that you do that. And it does make a difference. Sure. So what now, Stefano? You have four restaurants, a food truck, anything else in the works? We're always kind of looking and thinking, and we're sort of almost outgrowing our bakery facility right now. So a little part of me wants to... We've brought the smell of roasting coffee back to downtown, which we used to have. And we've, you know, to drive up each morning and smell bread, baking, and coffee roasting is a pretty wonderful thing. So I've kind of got this itch to do a bakery. And we've been looking at some spots. I've got a few ideas of maybe being able to connect to a local educational facility and maybe do some things with a school here locally to tie into their culinary program. And at the same time, have something for all the citizens of Chaboygan while improving the education of bakers and bread bakers and sweets bakers in the city. So there's a little, I think we need that still. There are a couple of great bakers here in Chaboygan, but I think one more could probably fit in. And right in that downtown area would be great. I think it'd be great to have a downtown. I mean, when you're in Europe or in Italy or France, I mean, if there's a bakery in every single downtown, so I think we should maybe be looking at that. So that's maybe percolating in our minds a little bit. Well, fun to know, good. Now the audience knows and now it's out on the table. Right. But boy, I congratulate you for the award, but most of all, we congratulate you for the kind of investment that you've made in this community. It is phenomenal. We are very fortunate and we know that. So thank you and keep up the fabulous work and the culture that you've created in your restaurants, because they are just a joy to visit. And thank you for being on the program today. Thank you, Bessie, and thanks for all that you do and the energy you bring to Chaboygan. Well, you're welcome. Thank you. Thanks, Stefano. And I encourage everyone in our audience to give a try to these restaurants. If you have not been in one of them, you're in for a real treat, not just for special occasions, you know, but they're an everyday pleasure. I want to thank the station and I will see you again next month. I appreciate the time here. Again, I'm Betsy Alice with the Chaboygan County Chamber of Commerce and this is Love Where You Live.


The study assesses the impact of climate and human factors on total water storage, TWS, variability in 14 major aquifers in the United States using gray satellite data, drought severity, and irrigation water use. Results show that long-term TWS trends are dominated by inter-annual variability in most aquifers, with depletion in semi-arid regions driven by droughts and switching to groundwater irrigation. The study highlights the importance of sustainable groundwater management through conjunctive use of surface water and groundwater, efficient irrigation practices, and managed aquifer recharge for future water development. This article was authored by Bridget Uskanlin, Ashraf Rehtab, Donald Appall, and others.


The hysteresis loop in the concentration effect curve can be collapsed using the semi-compartmental model. This model does not require pharmacokinetic parameters to estimate pharmacodynamic parameters and COOZERO, making it suitable when compartmental models are unavailable or inconvenient. This article was authored by Sunghee Ki.