Welcome back everybody. Every other video in this collection of videos is going to be for chapter 16, and chapter 16 is going to talk about protein molecules. Before I get to protein molecules and before I get to any more chemistry, this is a thought exercise that might be a little bit relevant in a little bit. Usually I show this to my on-ground students and I say, here's two stacks of Legos and I try to get in an argument with people and I say, are these two stacks of Legos identical to each other? Obviously the students say no, which is the correct answer, but I try to argue about it and I say no, they're the same thing because you've got red, green, white, yellow, you've got red, green, white, yellow, so they must be identical to each other. Obviously that's not true and the reason it's not true is because there's a difference between the top of the stack and the bottom. If you have ever used Legos, and maybe you have, maybe you haven't, but you can see the top part of the molecule has these little knobs that point out of the block and the bottom doesn't. The bottom actually has little indentations that point into the block. The point I'm trying to make is that it's not just the order of the colors, right? The order of the colors is the same, red, green, white, yellow, red, green, white, yellow. It's the order of the colors and who's on the top and who's on the bottom, who's on the left side and who's on the right side. This is the left side, this side here and the right side, they aren't the same thing. One has little knobs that point out and one has little indentations that point in. So it matters where you start and where you end up as far as the colors are concerned. Now this obviously doesn't really have to do with proteins, but I'm going to try to make it relevant to protein molecules in a little bit. So keep this in the back of your mind. This chapter is on protein molecules, but before we get to protein molecules we have to talk about a kind of molecule called an amino acid. This is a generic amino acid molecule and all of the amino acid molecules that I'm going to talk about in these lectures have these features in common. And this part here, this part if you remember from a couple of weeks ago, is called an amine functional group. They also have this part here, if you remember from a few weeks ago, this part here is called a carboxylic acid functional group. And those two functional groups are why amino acids are called amino acids, because they have an amine and they have an acid functional group.  This carbon atom here has a special name. It's called an alpha carbon. This is the Greek letter alpha. I don't expect you to know that, but I may say alpha carbon in some of the videos, so it's just a fair warning. So every amino acid molecule that I'm going to talk about, like I said, has this functional group, this functional group, carbon in between the two. This carbon, the alpha carbon, always has a hydrogen attached to it as well, and it has R attached to it.   So hopefully you didn't spend too much time looking at the periodic table.  It's like a placeholder. What this means, what R means is there will be, there are many different amino acids, and what makes them different from each other is the atoms that go in place of R. Sometimes you can have very simple replacement for R, or you can have really complicated replacements, and every different kind of replacement gives you a different kind of amino acid molecule. And I'm going to show you some examples of different amino acid molecules. Just to emphasize, all of the amino acid molecules that I am going to show you, they have this part that I'm putting in this red shape. They all have that part in common. All of the amino acids that I'm going to show you, they all have whatever goes here different from each other. Like I said, there are many different things that can take the place of R. What's taking the place of R here? You can pause the video and think about it. Unpausing the video, well, it's the simplest replacement that you can have. It's a hydrogen atom because that's the simplest atom that we have as well. This particular amino acid molecule has a name. It's called glycine. I do not expect you to know that. I do not expect you to memorize what glycine looks like. I'm just telling you what's got a name. And this is what's taking place of R. There's a different amino acid. I'm just going to show you a different one. Again, these are the parts. This is the part that it has in common with all of the other amino acids. And this part here is what's taking place of R. This is a little more complicated, right? Carbon atom with some hydrogens, then you have an alcohol at the end. So this molecule here is certainly more complicated than glycine. This amino acid here is called serine. You don't need to know that again. I'm just telling you it's got a name. This is a little bit complicated for what's replacing R. You can have really complicated stuff, too. This is an amino acid molecule called tryptophan. And all of this stuff here is taking the place of R. So that's a relatively complicated amino acid molecule. I think this is the stuff that they say makes you sleepy when you eat too much of it at Thanksgiving. I don't know if that's really true. At least that's what some people say. So these are three different amino acid molecules. There are many others. These are not the only three different amino acid molecules that exist. In fact, there are 17 more amino acid molecules that are called universal amino acids. There are 17 more plus these three. So what that means is there are 20 universal amino acid molecules. What universal means is that as far as we can tell, every single organism that we have looked at has 20 different amino acid molecules. And they are these three plus another 17. And we find them in all living organisms. And we think we're pretty sure they are in all living organisms. There are more than 20 amino acids. There are more than 20 different kinds of amino acids. But 20 of them, as far as we know, are found in all living organisms. Now, there's a couple of phrases or words that I want to point out here. The atoms that are taking the place of whatever R is, they're usually referred to in a couple of special ways. Sometimes people will call the atoms that are taking the place of R. They will call them the R group of the amino acid. And that just means the group of atoms that's taking the place of R. So if I said, what's the R group for glycine? You'd say, oh, the R group is very simple for glycine. It's just a hydrogen. If I said, what's the R group for serine, you'd say, ah, it's a little more complicated. It's a CH2 connected to an alcohol, something like that. There is another phrase that is also used to describe the atoms that are taking the place of R in an amino acid. Those atoms are sometimes called the side chain for the amino acid molecule. Side chain just means the chain of atoms that's coming out of the side of the amino acid molecule. So if I said, what's the side chain of glycine? It's the same thing as me saying, what's the R group for glycine? If I said, what's the side chain for glycine? I'd say, oh, it's a hydrogen. What's the side chain for serine? It's a CH2 connected to an alcohol. Same kind of thing. And I want you to know those two phrases because they might get used.  If I say, what's the side chain of this amino acid molecule? Same question. Now, we're actually gonna talk about some chemical reactions. Suppose that this molecule, this amino acid, and this amino acid molecule are bouncing around next to each other in one of yourselves. And for whatever reason, your cell wants to connect these two molecules together. One of the most common ways that it can do this is it can rip out the OH here and it can rip out one of the hydrogens here. So you can see there are two hydrogens there. You can rip out one of them. So I'm gonna just turn it to an H. And if I do that, if I take out an OH and an H, do you remember what I make, right? That makes water. If I do that, this carbon atom is now missing an attachment. If I rip out the OH and the H. And this nitrogen is also missing an attachment. But what I can do then to make them both happy again is I can connect the carbon to the nitrogen. And if I do that, they end up connected. I made a bigger molecule. If you remember from last week, we already talked about this kind of reaction. This kind of reaction is called dehydration synthesis. It's called dehydration because we ripped out pieces of water from the two molecules. It's called synthesis. Synthesis basically means you make something. But here, they kind of mean we made something bigger. This is the most common way that living organisms connect different amino acid molecules to each other. It doesn't just have to be between glycine and serine. We could have also connected serine to tryptophan the same way. We could rip out this OH, rip out one of those hydrogens, connect this carbon to that nitrogen, et cetera, et cetera. So the way what you should do is you should think of this as the way that amino acid molecules are connected to each other. Now I know I'm not really explaining what this chemistry is for and any of that, that will come. But there's a lot of information to cover. Now I am going to show you these two molecules once they are connected to each other by the reaction that I just showed you. Those two molecules are down here, or the one molecule is down here. Once I take the glycine and connect it to the serine, I make this molecule. This carbon here is this carbon there. This oxygen is this oxygen. This nitrogen is this one. And this connection here is the one that got made when I connected the two little molecules to each other to make this bigger molecule.  I want you to know how this reaction takes place. I want you to also know, may recognize this functional group from a couple of weeks ago. This is called an amide functional group, or amide or amide, however you want to say it. And a couple of weeks ago I said, hey, if you notice, the amide functional group looks a little bit like the carboxylic acid. It looks a little bit like the amine. And I said that's not a coincidence because a lot of times that's how you make an amide group or an amide functional group. And that's just what we did here. We took a carboxylic acid, we took an amine and we fused them together and we made an amide functional group. There's another word that I want you to know. Unfortunately, there's a lot that I want you to know here. This bond, the connection that got made, this single bond here has a special name. It is called a peptide bond. Don't worry about where the name peptide comes from. It is a very old name and it's just kind of stuck with us. But I want you to know, if I show you two amino acids connected to each other and I point to this particular bond, the actual bond that connected them to each other, you should know that that's called a peptide bond. Now, another thing that I want to point out. A couple of minutes ago, I connected glycine to serine by ripping out this OH, ripping out one of those hydrogens. But what if I did it in reverse? In other words, what if I took the serine and I moved it over here and I wanted to connect them in the opposite way? And that's shown here. What you notice here is that I have flipped around the serine and the glycine molecules. This time the serine is on the left. But let's say that I want to connect them this way. I can do this as well. I can rip out this OH, I can rip out one of these hydrogens, I make water with the stuff that I ripped out. This carbon is missing an attachment and I can connect it to the nitrogen like that. But this time the serine is on the left and the glycine is on the right side. And I'm going to show you that once you make the connection, you make this molecule here. So this is serine connected to glycine. Over here, this is glycine connected to serine. Same kind of chemical reaction except different things is on the left side in each case. The question I want to ask and you can pause the video and think about this is, are these two molecules, is this molecule here and this one here, are they identical to each other? If you unpause the video, the answer is no. For some hopefully pretty obvious reasons. This is the side chain for glycine and it's close to this amine group in this molecule on the left. But over here in this molecule, this is the side chain for glycine and it's way far away from this amine group. So these two molecules can't be the same thing because the atoms are in different spots. So these are isomers of each other. They don't really have a special name. They're not cis and trans, they're not stereoisomers or anything like that even though they look a little bit like stereoisomers, they are not. But this is getting back to the Legos. If you remember, I said these two stacks of Legos were not identical because the left side of the stack and the right side of the stack were not the same. Same thing here, right? The left side of this molecule has an amine functional group. The right side has a carboxylic acid functional group and here this hydrogen, which is this one is close to the amine and here the same hydrogen is far away. So if they're in different spots, they have to be different molecules and the reason is basically the same as the reason why the Lego stacks are different. The left side of this molecule and the right side of this molecule are not the same thing. So it matters what order you connect the amino acids in. This again, I know it sounds ridiculous but at least it's important in chemistry and biology. It may not be important to you but I'll talk about this in a little more detail on the next slide. So here's the three amino acids that we've been talking about. Let's say I wanna connect all three to each other. I can rip out this OH, I can rip out one of the hydrogens there and I can connect the carbon to the nitrogen. If I wanna connect, now this is a bigger molecule. If I wanna connect this bigger molecule to the tryptophan, I can rip out this OH, you can rip out one of the hydrogens, I make another water molecule and I can connect this carbon to that nitrogen. Once I do that, I've made a pretty big molecule from three little amino acid molecules and it would look like this. Here's my bigger molecule once all of the connections are made. This is a peptide bond, that's also a peptide bond. Now, these peptide bonds are stretched out just to show you for emphasis where they are. They're not really stretched out in real life but this is how you connect a bunch of amino acid molecules to each other if you wanted to and your cell does this all the time. See these three little dots here? What that is trying to tell you is that you don't have to stop at three amino acids. I could connect a hundred or I could connect a thousand amino acid molecules to each other by doing the same procedure over and over again. Rip out the pieces of the water, connect the carbon to a nitrogen. Rip out the pieces of the water, connect another carbon to a nitrogen on another amino acid molecule. I could go on for a really long time in this direction. In a sense, I could go in the other direction as well. Another thing that I wanna point out when I made these connections, right, when I connected the glycine to the serine to the tryptophan. This used to be a carboxylic acid functional group but I destroyed it because I ripped out the OH. This used to be an amine but I also kind of destroyed it and I connected the carbon to the nitrogen. Same thing, I destroyed this carboxylic acid, destroyed that amine. Now you should look at the molecule that we made down here. Is there any place where an amine functional group did not get destroyed? You can pause the video and think about that. You can also ask yourself, is there any place where a carboxylic acid functional group did not get destroyed? You can think about that as well. If you unpause the video, over here on the left side, that's the only place where an amine functional group did not get destroyed. Over here on the other side, this is the only place where the carboxylic acid didn't get destroyed because we stopped at three. So when one end of this molecule has an amine functional group that is still intact, the other end of the molecule has a carboxylic acid functional group that is still intact. There is a special name for the ends of this kind of molecule. This end here has a special name. It is called the aminoterminus. Terminus just means end. It's just a fancy word for end. Amino just means amine functional group. So what they're saying, if I call this the aminoterminus, that's the end that has the amine functional group. Sometimes chemists and biologists can get lazy and they don't wanna say this mouthful. And so sometimes they just call it the n-terminus. That's the end of the molecule that has a nitrogen there. That's what n-terminus means. The other end, again, you might not be able to guess specifically what it's called, but that end is called the carboxyterminus. So again, terminus means end. Carboxy just means the end that has the carboxylic acid functional group. And again, if you are lazy, like most chemists and biologists are, you can call that end the C-terminus because that end has a carbon there. So I want you to know that. The left end of these molecules when you connect amino acid molecules to each other is not the same as the right end. One of the ends will be called the n-terminus or the aminoterminus. The other end will be called the C-terminus or the carboxyterminus. Now, you can look at this molecule and this is relatively small compared to what your cell can make with a bunch of amino acid molecules.  To draw all of the atoms out like that. So a lot of times people don't do that. And instead they just list the names. But if you're gonna list the names, you probably should tell them which end is the n-terminus and which end is the C-terminus. And a lot of times it's written like this. So if I wanted to tell people that I was talking about this molecule here, but I didn't want to draw every single atom out, you could just write n, that's this end here. And I could write the names of the molecules, glycine connected to serine connected to dritophan. And I could write a C at the very end. That's a little bit easier. It was probably a lot of it easier than drawing every single atom like this. What you're gonna see is there are improvements on this. There are simpler ways of writing amino acids connected to each other as well. And again, just to emphasize, if I connected these amino acid molecules to each other in reverse order, if the tryptophan, this one was way over here on the left, and I would write it like this. Because the tryptophan now is near the n-terminus and the glycine, if this glycine was moved over here, then the glycine would be near the c-terminus. So here's a summary slide. Amino acid molecules are attached to each other. And I've just shown you how that's done by dehydration synthesis. There are 20 universal amino acids found in living organisms. I have shown you three. I will show you the other 17 soon. Your body attaches amino acids to each other by what, everybody? By dehydration synthesis. When you do the dehydration synthesis to connect amino acid molecules to each other, make an amide functional group, and the connection that actually gets made is called a peptide bond. If you attach enough amino acid molecules to each other by this process, which we have been talking about, you make many peptide bonds. And if you make many peptide bonds, the molecule that you make is a lot of times called a polypeptide. Poly means many, and peptide just means the kind of bond that we've been talking about.  Finally, a lot of times, polypeptide molecules are just called protein molecules. So this chapter is on protein molecules. Protein molecules are just collections of amino acid molecules connected to each other by peptide bonds. It took us 20 minutes to get here, but the reason that I started talking about amino acid molecules is because amino acid molecules are used to make protein molecules. So the punchline here, and this is the end of this video, is yourself use amino acid molecules to make protein molecules. And you should understand the chemistry of how that works. See you in the next video. I'm sick, this is my bed, I'm sick.


Inspector Gadget for Super Nintendo is a pretty interesting game for a lot of reasons. For example, anyone that remembers the cartoon knows Gadget to be a bumbling doofus who just kind of lucks his way into solving cases while his niece Penny and her dog Brain bail him out at every turn. Of course it'd be kind of difficult to coherently structure a game like this especially back then, so what we get is a standard 2D action platformer with Gadget on a quest to save Penny after she gets kidnapped by Dr. Claw. And Gadget for all intents and purposes is a perfectly competent character here using all sorts of power-ups and various gadgets to help him defeat enemies across six levels. And the game does a good job representing the show with one glaring exception I'll get to later. The settings here are straight from episodes out of the TV series like King Tut's Tomb, Cuckoo Clock Maker's Clock Tower, and of course Dr. Claw's Castle. You've also got the chief getting blown up a bunch of times too, you gotta love that. The development was handled by the same folks who worked on other licensed games like Swat Cats and Fivle Goes West, and those games did a nice job representing their source material as well. The primary glaring flaw in Inspector Gadget however, is...  It's seriously up there with Ninja Turtles as one of the catchiest and most memorable TV show themes ever, and they couldn't spring for it to be in the game, such a bomber. Anyway, despite that, Inspector Gadget is actually a decent game, mostly due to all the power-ups you get to use. It's a propeller that enables Gadget to fly, there's an extendable hand coming out of your hat, there's suction cup arrows that help climb walls, and of course there's a special item that extends the length of your arms and legs. The interface is smartly set up here too. Just press the L and R buttons to scroll through, and A to activate. You get a limited amount of each item however, and you have to collect hats for ammo so to speak. The damage system is the same as Ghosts and Goblins.  While the power-ups are fun, the level design is hit or miss. Some levels are pretty straightforward, but some are just outright annoying, like this snow level where you have to contend with both slippery platforms and high-velocity wins, come on. That part of the game is a chore to get through. There's other sections too, like outside King Tut's Tomb in Egypt where you're just bouncing on these platforms, helplessly flailing around. It's this big sprawling layout and it can be tough to get a feel for where to go. No saves or passwords either.  Gadget has the ability to search for clues, you know, just like an Inspector would, or at least a cartoon Inspector. Just press down until Gadget takes out the magnifying glass to find hidden blocks that you can smash. To be honest, there's no real rhyme or reason to where these hidden areas might be, I mean this isn't exactly Donkey Kong Country 2, but it's still a nice addition that adds a bit of replay value. One other thing I should point out quickly is that for the final boss fight against Dr. Claw, they actually show his face. Wait, what? I don't think the cartoon ever actually did that. But yeah, you actually get to see Dr. Claw at the end of this game, so that's interesting. So yeah, Inspector Gadget is kind of middle of the pack. It's certainly better than painfully generic stuff like Tom and Jerry or the Pink Panther games, but it's nowhere near as good as say, any of the Disney Capcom platformers. It's got a lot going for it, like all the special items, the boss fights, all the different settings from the TV show. And yeah, if you liked the cartoon growing up, you'll get a big kick out of this game. It's just that the controls can definitely feel way too slippery and sensitive at times, the level layouts seem to be way too big for their own good, and for God's sake, there's no Inspector Gadget theme, that's such a downer. Other than that glaring flaw, I'd say this one is worth checking out. And I want to thank you for watching and I hope you have a great rest of your day.


Okay, I think I'm going to start so I will gain five minutes more for me and Have you ever heard about at CD? Sure. You know what it's at CD. Yes Yes, yes, okay, perfect So, okay, first of all, good afternoon everyone I will like to thank the organizers for accepting this talk and today we're going to talk about About how to post exploit a compromise at CD But first let me introduce myself. I'm Luis Toro and I start on the offensive side of security in 2019 and for the past two years I've been working as a security consultant at NCC group and here you have some details about me and some budgets and And the thing is the core concept behind this technique is not completely shiny new Yep, and there have been other talks in past editions of Qcon that have already discussed the importance of at CD within the cluster and You have here just a couple of examples in the first talk Joe Betts release Tool that has been the center of focus for developing this technique and I will talk about this tool later on and For those you may not be familiar with cyber security terms It's important to define what post exploitation means and It refers to the techniques that an attacker employs after gaining an author right access to a system So consequently post exploitation techniques always come at the end of the of the workflow of the Security exercises because it implies that at this stage we have already compromised one asset and we want to establish maybe persistence or We try to jump to another asset in the same network But before that being in into details I would like to highlight these points as we already said this is a post-acquisition technique which means that we should already have a compromise asset and It should provide us the the following requirements. So first we need to have the certificates obviously to to get authenticated in at CD and The second requirement is the at CD service must be reachable it could be locally or or remotely and It's worth noting that this technique only works in self-managed environments and also it works in environments Where at CD is implemented as a cluster. We just need to compromise one of the at CD nodes and However, we won't be able to apply this technique in managed environments because you already know at CD is not reachable in control planes that are configured by the cloud providers and Here's a brief reminder about what is what is at CD and as you know, it's a key value store And it's usually located in in a control plane node or bound to the control plane node in another host and Kubernetes it uses at CD for baking up all the cluster data So we can consider at CD as a kind of living backup And it's constantly updating the state of the cluster components and talking about backups we What what should happen? What would happen if we have a legacy system on Which we have backups or dams that are not encrypted or are not encode or not serialized We have just backups in in Row data, so what would happen if someone have access to these backup files? Well, most likely an attacker could use these files to obtain of course sensitive information Let's say hard-coded patch words in configuration files, or maybe could retrieve private keys for SSH or even worse It could modify or inject malicious files waiting for this backup to be restored and gain a compromise Asset within the network so based on this principle. I was obsessed kind of into finding a way to Reproduce this the same principle in in at CD But first things first and how does actually work and as we mentioned is a key value store which is a simple concept you can add keys and values which are associated to to those keys and You can if you know a key path you can retrieve its value or delete the key and basically that's all it's quite simple Then what happens when for example we create a pot? Well, the API server will take our request and will instruct the hcd to store this value in in a specific key In this case it will use all the information of the pot manifest as a value and the key will be located usually at Slash registry slash ports slash default slash and jinx in this example and This is just an example. You know that not all resources in Kubernetes are namespace it So not all resources will follow this path a structure However, most of the namespaces objects like deployments or stateful sets or service accounts will be safe following this this structure But that was just a high-level overview of the entire process It's actually more complex and this workflow is much more detail. I want detail every single step here I just want to highlight that the API server is in constant communication with the hcd at every single step and When the API communicates with the scheduler, for example, it updates the state in hcd when the API server communicates with the cubelet it tried to updates the information in hcd even when the cubelet receives some updated information in Sorry, I lost my mouse okay, right here even when the QAPI server received information from the cubelet it also tries again to update this information in in hcd So as you can see hcd is in the middle of every single communication managed by the API server So we can agree that it's a key component in in the cluster, right? now we can retrieve this information about the newly created pod from hcd and It's quite simple with this command we specify where the service is is located in this case It's in exposures in in the local host But if we have the hcd in in a remote cluster, we should just change the endpoint and and We also have to specify the files that we use for for the authentication against hcd and finally we indicate with With the command get that we want to obtain the value of the following key in this case it's our pod call and jinx and We have this if we take all the information from hcd we get this string and It appears to be something like a JSON, but it also contains a special non readable characters. It's strange But this is actually the pod data serialized with a protobuf format And you may wonder what is protobuf and and how does it works? Well, it's just to put simple here is just an example on how to use protobuf how to serialize data from from a person in this case and First first of all We'll need a protofile that will define this structure of the data that we want to serialize in this case we want for example to include the name age and an email and Then with the command below you can create a module that can be imported into your Python script And there we can create the serialized object and here at the right you have the output in byte format But what happens if we want to serialize? Another thing not a person what if we want to serialize a book or a car then These objects do not have the same parameters as a person so we should create additional Protofiles and and more structures and this is the problem that we have in in Kubernetes we have several objects and all of them are defined in a different ways as You know a service account is not defined with the same parameters as an equal policy And a pod is not defined with the same parameters as a role binding. So what happens if we want to serialize these different objects? because we will need to know the the structure of everyone and fortunately for me there is already a tool available that allows us to Serialize and deserialize entries in it CD and it's the tool that I mentioned in in the beginning and was presented by Joves at KubeCon North America in 2018 and this tool basically enables us to pass a serialized object through a pipe and it converts into a yaml or or adjacent and Similarly, we can manually modify this yaml file and then we can try to serialize it again and put it back into it CD Quite simple Basically, this is what we start from at CD and the previous tool out here will return us this beautiful yaml crazy so I'll start playing with this tool testing some changes in those extracted yaml files and Then put it back into at CD just to see how the cluster reacts and I found some Interesting results. So I thought that it would be a good idea to create a wrapper for this tool that automates the the entire process and You can see here in the middle that say tricks and I'm gonna explain and detail. What are those tricks? So here I've detailed the entire workflow of this wrapper called Kube at CD along with some of the tricks involved and first we need to select our resource that is already in the cluster and we'll use this resource as a template this tool does not work with row yamls and At the moment, I've only implemented pots, but this could be done with any other resource in in the cluster Then the first we deserialize this pot template We take the yaml and the first trick is that we need to create a new UID which can be randomized and If we do not change this UID it may create some cross-reference between objects and may result in inconsistencies and malfunctions of the API logic, yeah API server logic and there is an interesting aspect here When the pots reach the running a state and neo-hash will be created and link it to this pot And also it serves as the container ID as well and we can simply remove this hash and everything will go fine perfect and Now we have modified the template we have changed the UID we have Removed the hash now we have the bare minimum the basis to create a new pot and make some some changes for example, let's say we could modify the creation timestamp could be or we can turn in a regular pot into a privileged one and We can also experiment with some creating Creating some inconsistencies, which I will show you shortly and After making these changes We can serialize this modified object and we try to put it back into hcd So here we fire so here we have the first example. It's nothing really harmful and We have our pot and jinx running and with the wrapper cubetcd we can simply modify the creation timestamp and Suddenly as you can see here the pot appears to be running for 23 years without a restart And it's a remarkable achievement because it has been running even before the Kubernetes was was created and Want to take a picture of this? Yeah A second scenario and I was thinking about what would happen if if the name in the pot In the pot manifest does not match with the name in the hcd path Look here. We create a new pot called and jinx persistent and Then I implement the dash p argument to create a custom path In this case the path will be called random entry, but could be any any name So if we list the the pots we can see the and jinx persistent pot running However, if we try to delete this pot We'll get an error telling that this pot is not found and That's normal because from the API Logics perspective this pot does not exist because the real name in hcd is random entry and It does not match with the name in the manifest So in this case, we won't be able to remove the pot using The API server through kubectl or any other client instead of we must delete the spot Deadly from hcd. It's the only way to remove this pot from from the cluster And I found these previews a scenario of funny So I thought hey what happened if I change the namespace So here I create a new pot call and jinx hidden and now you can guess what will happen Let's gonna try to find this pot So we have just created our pot in a non-existent namespace So if we check the default namespace, we cannot see our pot. It's not here It's not in the default namespace apparently and if we're trying to find our new invisible namespace that we defined in the previous slide right here and It doesn't exist either so where is our pot? Any guess Any guesses, you know, where is the pot? It's in the in the heaven of the pot No, it's in the default namespace Our pot has been always in the default namespace Because we didn't change this value in the in the manifest. It's just changed the hcd path So when we run kubectl get pots the API server iterates over the default namespace path in hcd and this pot is not under this path However, it will list all the pots in all namespaces. It will iterate Over the the pots path and that's how we can find our pot here Well as a security consultant when a customer seeks a Kubernetes assessment one of my main concerns is deploying secure workloads and you already know that kubernetes has some built-in features for deploying secure workloads such as you know security contacts and all its parameters and We can also apply second up armor selenux and furthermore we have also cool third-party solutions to protect our cluster But for now we'll focus on on on built-in features But you know nobody is perfect and We could miss setting these configurations in accordance with our security standards of our organization So we need to implement some policies to to ensure and to enforce that our design configuration Will be applied and this is where the admission controllers come into play You already know that About the deprecation of pot security policies now we have the pot security admissions which define three pot security standards and as in names indicates the most restrictive is the restricted standard and it requires many security parameters and as a validation and mission controller we must comply every single of its Directives if we want our world low to be to be deployed As you already know pot security admissions apply only to namespaces, so let's create the most restrictive namespace ever call restricted namespace restricted NS and Here you have the definition and What happens if we try to deploy just a single part? It's not even a privileged part. Well the policy admission will not validate this insecure configuration and This pot won't be deployed in this restricted namespace Here I just highlight some of the missing configurations It's it's we have to disallow the privilege escalation the capabilities and the run as non-root and Do you think it's possible to deploy a privileged pot in a restricted namespace Because it is if we deploy that early through at city in so here I implemented the privilege flag to turn any Template into a into a privileged one and as you can see here We managed to deploy a privileged bot in a restricted namespace by by passing completely the pot security admissions defined in the namespace and Time for a demo. I think I'm going so fast Let me show the internet with my because I need to pull some images Hold on and Demo time Okay, you have to see okay the same Screen as me and I should connect my iPhone. Yeah Please don't hack my iPhone And Okay, now we have three Three panels and here we have the administrator console. This is the cluster admin. It's legit. Nothing wrong Here then we have a compromise control plane. So the HDD is running here And we have another remote machine that belongs to the to the attacker So that's gonna see what is running here. We have just an an engines That's gonna see what we have We have many things running. We have key burn also implemented Nothing nothing really harmful everything in place Okay, so now here from the compromised Control plane we can run Oh, let me show you something. I'm gonna try to run Privilege and jinx of course it doesn't works because the cube CTL We have implemented a cuba in a policies to avoid privileged pots in all the the cluster so it doesn't matter the the namespace and Here with this fancy wrapper, I will cuba CD. I will create a pot That I will call it and jinx brief. Let's say I will use the the running and jinx Pot as a template and I will say a I wanted privilege That's gonna try this thing. I'm gonna use a Watch yes, you can see what it's happening on real time Okay And cross finger and here it's creating the pot pulling the image It's running and the big question is is this pot really privileged? Okay. Let's get Keep CTL get and jinx brief and And I will get this in demo. I Don't have the mouse here And jinx brief get oh get pot and here if we find the second contacts Thank you context should be run here Here we have it we have a privilege pot running in a Kibirno protected cluster and In addition, we have I've also had not only This flag but it's also sharing the these namespaces IPC network and PID Well, that's crazy, right? but We can do More fancy things That's gonna say a I want a Reverse shell In to an external machine. I'll try to get My IP I think it's check It's not this one Remember that this demo is running in in kind so I'm looking for the docker IP the docker zero interface IP Okay, please click more. Thank you Okay, anyway, I will be listening on this board and Here I should have in the history Okay, got it got it. Okay Here with this command, I will try to get reverse shell that early from from inside the The iPod and we'll try to create a fake namespace and also will try to use a Fake name for the at CD path. We'll try to watch again What's happening in the cluster and That's gonna do this what happened We have here a remote shell as you can see we have no news pods here. There is nothing Of course Ctd get pods slash a Let me check. Let me reduce this we have here the new pod remote shell in the default namespace, but as a Legit cluster. I mean, I will try to delete the spot call and jinx remote shell. I Cannot So Okay, let me check where I am. I cannot use this one Post name I'm barely in the worker. I've also in the parameters. I add the option to mount The root file system in in this file system in host and Despite this error we have All access SF in it. Oh, no, sorry. Oh I lost my Anyway, I have full access to the control I'll try again That's it. We have root access full access to the control to the node. Sorry and This could be also. There is another flag Telling a I want to move to another note. That's quite simple just using no name I'm not sure if this will be You will work Not sure not sure not sure not sure. No anyway the thing is I'm gonna Stop this and turning back to the presentation Nope, not this Okay, and here comes the big question. Why does this work? Why this happens and to be honest I have not analyzed the Kubernetes code But all the tests demonstrate that the implementation of HCD in the Kubernetes architecture provides a level of reliability regarding the API that Kubernetes clients do not have and as a users we are subject to authentication to authorization process based on roles and Finally to admission controllers that even cluster admins cannot bypass without disabling them however HCD only needs its certificates to get authenticated and then everything it it's In HCD will be trusted as as valid and The thing is how can we mitigate this threat? Is that possible because attackers here have an advantage and this technique affects you know a very specific environments and there are At least to my knowledge. There are no a wildly Adopted solution that serve as as the factor standard for checking the integrity of HCD and We have to respond a security ends incident that exploit this technique the the The events on Kubernetes. They are also storing HCD. So they are completely compromised Even we have root access to the node so if the logs are safe in any note of the cluster could be also compromised and However, we have runtime security solutions that could provide early hours. It's something unusual it's happening in the cluster as your tool and Especially, you know end point security runtime security solutions could detect easily Processes that are running on the node. For example, obtaining a remote shell. It's it's obvious and We have seen gaining root shell access on any cluster. No, it's quite easy Even using images that are not intended for offensive exercise Remember that this image use its jinx latest. There is no offensive image at all So finally let's rub up some conclusions here as we have seen this technique When all the requirements are met is it's very powerful and It can compromise the entire cluster in in a matter of seconds And if you check any book or blog post or anything related on how to exploit a compromise at CD You will find that in most of cases They treat at CD just as a database from which we can retrieve six secrets But now we have demonstrate that at CD is a key component of the Kubernetes architecture and perhaps it's the most important and the most critical one and Suddenly despite all this remember that this technique it won't work on managing environments And now I would like to pose a question to you and the community I won't answer it and the thing is should the trusted position that at CD currently holds in the Kubernetes architecture should be reconsider What do you think and I hope you catch me out there and share your thoughts about it and that's all. Thank you That was You have any question Yep, yep, okay Yeah, it is yes Well indeed it was not a screenshot. It was my calling indeed. Yeah A question Now I have Now I have a technique to exploit the atcd. So, how do I get access to the atcd? In other ways What's the common pitfalls in Current to KBS management to let the attacker have the access to the you say atcd database You sorry, you are asking if we have anything to to to be safe against this technique I'm asking is there any common pitfalls to let the attacker access the atcd database. I Don't know to be honest So how do I to exploit this is the atcd? The with what's the common ways to? Yeah, usually the common way is just to if you get the the credentials. I mean the certificates Usually if you check some blog posts and and books and All the information we have in the internet most of times they are treating atcd just a place where you can retrieve secrets and that's all Okay, so That's the it is it is certificates is stored in the worker node. Yeah. Okay. Yeah. Okay. I get I get the point Yes, for sure. Yeah, first you have to compromise the the control plane or the atcd node But this is not covered by this presentation. Yeah. Yeah. Okay. I got it. Okay. Thank you It wouldn't be it wouldn't be easy to compromise for sure, but Sometimes, you know, some system administrators will like to put some services in in the same node and you know and the thing is Security is is multilayer. I mean if let's it's an example If we have an image that it's it's configure to run To run a user that is not root it's image that it's properly Configured in the docker file It doesn't mean that we do not have to use a mission controllers to avoid running Pots or containers running as root. I mean it's okay. It's pretty difficult to to Compromise a control plane. It's pretty difficult to compromise an atcd node that only runs it city but the things works until It doesn't works. I mean Vulnerabilities are always a rise every day. We we have already seen the supply chain attacks I think this could be also secure in in any sense Atcd should be in my opinion Also Restricted by the mission controllers Yeah, that's the point Hi, you basically answered my question. So thanks Hi, I have a question In a demo we notice that we created a pod with a path that Invisible name space in the past. So I wonder why we can use kubu kado get a pause dash a to show the pod But we cannot delete of this part Sorry, I don't get it. Okay. Let me Reproduce my question. So you created a part Directly through atcd your kubu atcd with a path The name space name is invisible. Yeah. Yeah, so we cannot Get the part of without a dash a yes what's But but with dash a we can see that part. Oh, yes, because yeah, yeah, yeah. Okay. Got it The thing is when you run a slash a with getting all the information the the API Goes to atcd and go to slash registry slash pots and Iterates over this path and it gets everything on this path Okay, so when we try to delete this part Can we or because we don't have a name space named invisible so we cannot delete it It's in the atcd path. It's a slash registry slash pot slash invisible But the thing is when in kubectl, we try to remove this pot or to check this pot it's Taking the value of the name space from the manifest and it doesn't matter it creates an inconsistency and You cannot find with with other command. Okay. Thank you. Thank you. Yep. Ready Thank you


Well, as you noticed, that went over and it was perfectly fine that went over the time a lot. That was wonderful. Thank you so much for coming. What a great session to end this. Our mission at the Vogel Center is to expand John Vogel's legacy by promoting the principles of successful investing and financial well-being through education and community. I mean, nothing embodies it more than what you just did. Thank you so much for that. It was wonderful. Also to thank people. If the volunteers could stand up, all the people who have volunteered, please stand up. Any local chapter coordinators out there, local chapter coordinators, forum monitors. Can stand up. Thank you. Board members. Any board members here? Former board members? Alan. Alan Roth. Stand up. Gail, please stand up. Thank you all and anybody else who has spread the word. Thank you all very much. We all greatly appreciate all of your help. Several people have already approached us to how they can help going forward. Of course, we need all types of people. One thing I forgot to mention because I had this conversation twice when I was in the hallway talking with people are the visionaries. The visionaries. You have a vision for how you can create something within the Vogel Center. We were talking about maybe a Vogel Heads fire movement of some sort. Whatever it is that you say, hey, we should have this. This would help. I could help do that. Not only are we looking for workers and volunteers and people to help with technology, we're looking for visionaries. We're looking to grow this organization, not only in the United States, but around the world. If you have a vision of where we might be able to go with this and you are willing to take action on that vision, we certainly want to hear from you and certainly would like you to have that conversation. So now, actually, eight minutes early, the moment you have all been waiting for, not yet. The moment hasn't arrived yet. This is the general location, not the exact location, but think of this as where we are, are in Chicago, but we're not really in Chicago. When we pop this up on the screen of where the next Vogel Heads conference will be in 2023, it is the general location. And the general location is Christine Washington, D.C., hey, mid-October. David Gravener, are you here, David? And there's going to be our local chapter coordinator who will be helping us pick the place in the time. So see you all there next year. That's it. Thank you very much for coming.


Good morning Nerd Fam, and welcome back to Las Vegas, Nevada. We're here at Google Cloud Next. It is midway through day two of three days of coverage here on theCUBE. My name's Savannah Peterson and I'm joined by the brilliant souls that power the analyst engine as well as the entire business. John Furrier, back at night. Rob Schutze, thank you all for being here. We are all buzzing. We're still smiling midway through. We've already done about 20 interviews which is really impressive. Rob, I'm going to turn to you first since you're on my right. What is your first impression, take away, theme of the show, bonus points if you don't say Gen AI? That's good, because I wasn't going there. So I think the vibrancy of the community that is here and the fact that so many partners are here, I think ones that we've had on the show, ones that are not even on the show, and a lot of what is going on where there's just a sense of partnership with Google that I'm not sure that I saw back in the fall when we were at Google Next 2023, which again was only eight months ago, but I think the 30,000 people here, it's basically twice as many that were at the previous show. A lot of energy, just a lot more energy than we saw in San Francisco. Yeah, it really is buzzing. Rebecca, what about you? I am struck by all of those things, Rob, and also just the dizzying number of product announcements and updates and the pace of innovation. I'm going to say a Gen AI. Yeah, go for it. And really that we are on the cusp of this real AI driven workplace in that you cannot not know how to work with Gen AI because it is going to, if it doesn't replace your job, it will change your job. And so these are really important topics that we're discussing, really important themes. So I'm a buzz. I love it. John, what about you? Hot take? Well, the keynote going on today is mostly developer, it's a little bit less exciting in the sense of the announcements aren't really there, but it's really, it gets under the hood. Couple of things that have jumped out at me is I'll say I love the Gen AI enterprise use cases because we follow that heavily and it's really it's most important that's under a lot of change that's going to cause a lot of disruption. So the enterprise under the covers use cases is going to cause all kinds of disruption and there'll be winners and losers. We talk about that all the time. But the whole AI editing with photos, I think is a big popular item today. You're going to see AI editing and then the water marketing that came out yesterday, a little nuanced point, that's going to be like, what's real? What's real? What's synthetic? That's big.  So you got Google really hitting the user experience with workspace. So that speaks to the chat GPT wave and then you got the underlying new infrastructure and then everything in between like little tools like editing photos. Google Vance, I think the fact that you can do a whole video with prompt is amazing. There's a cool factor here that that's go, okay, that's cool.  Like so there's a lot of that going on in this event. And I'm impressed with Google. Like I said, last year they had a good direction. This year they followed it up on the sizzle and they had brought a lot of steak to the table. But the other area is the ecosystem. And if Google continues to get traction with the partners, Rob, this is where I see a little bit of, I won't say Amazon level partnership ecosystem, but they're standing tall, but are they confident? All right, so they haven't parties. We're going to the parties. You see in the partners, it really, really step up and they're standing tall. So I think if that continues for one more year, Google will have a legit ecosystem. And so that's going to be the big watch for us. Yeah, I think so.  They shared some stats. 90% of GenAI unicorns are Google Cloud customers. 60% of GenAI startups use the Google Cloud platform. So if we're looking at that, that is quite a bit of saturation in this new emerging market. I think one of the things that struck me all week is the level of collaboration across teams within these large organizations. We've talked to PWC, to Deloitte, and to McKinsey, each one of them talking about how they've combined their Cloud and AI teams now to solve problems for customers at scale, which I think is really interesting. Sometimes new tech stays in its silo or in a different division of the business. They've got to be careful on the stats. When they quote those numbers, a lot of those unicorn numbers, they're not really full Cloud customers sometimes. So I'm suspect of those numbers because they might be workspace users. So you got to look at, say, pure IaaS to Amazon. That's a tough compare, platform to platform. Isn't workspace in the Cloud though? Well, Azure does the same thing Office 365, they call that Cloud numbers. So there's always that apples to oranges. I'm not hammering Google too hard, but they do have a good uptake, but full Cloud adoption, they're definitely not as high as they are. But I also look at, to your exact point, that's not the interesting number to me. Like the Gen AI startups and being in there and foundation models being built, that's great and all, but I think some of the discussions we've been having around the use cases that customers are really using. And I think we're going to have some great exploration of that this afternoon because to your point on what we're seeing is a lot of them are leaning into that dev first, engineering first use case. And I think, Rebecca, we were talking about this a couple of times yesterday and today around the, what is the replacement? And what is this going to do to the workforce and to the people? And in fact, there's been some caution, cautionary tales around that as well. Well, exactly. The New York Times has a great story today all about entry-level jobs on Wall Street pretty much going away because of the fact that Gen AI can do all the data crunching, can make all the PowerPoints, can do all the scutwork that these junior bankers were doing that they used to do for many years and it was the worst jobs on Wall Street, but it was your golden ticket to the greatest jobs on Wall Street. And I'm really curious, because I think that that is getting a little bit lost in this discussion in terms of what will happen to those younger people, they will find other jobs. But how do they get the training? How do they learn the business? And this applies to investment banking, but also other roles, other industries. I mean, I love the New York Times, but up a little, I love the New York Times. Here's what comes next. I don't buy that whole, their narrative on the job things losses. Yes, people will lose their jobs and bankers, well, my traders, all my heart bleeds for them. But if you think about the other side of the coin, what does AI bring opportunities for people that don't kick at those jobs? Okay, so they'll go away in the grunt areas, the grunt work, entry level, but it also shifts. So we've seen that with big data before. The real thing that I love was the Hitachi interview I did earlier today where the society benefits. So you say, okay, underrepresented minorities, people who can level up with AI and saying, hey, I don't need to go to college or some pedigree school or I can move from poverty to more productive, better living. So I think the argument should be more focused on what AI does there. And everyone focuses on the job loss.  Well, not really, so. You know. It's not the job loss. I'm talking about the training and the on-the-job learning that you do early in your career. If you're not getting that foundation, that basis, that's the question I'm bringing up. Because I think you're right. You cover future work, I'll ask you the question. So there's a bit of narrative around going back to the office because the junior mentoring dynamic has come in. That's come up a lot. What's your angle on that? What's the report say there? Because I buy that argument, by the way, that having that mentorship, but also just to come through the office, is there tools for that? So that's a tough, that's not my wheelhouse, but what's your view on that one? That is absolutely a concern. And I think that those entry-level workers are missing out on a lot of mentorship, on a lot of networking, on a lot of learning that they can get from older, more seasoned, more veteran employees who don't want to go into the office because they've got kids or they're traveling or they're doing other things in their lives. And so there really is a lot of research that shows that it is hurting the younger generations, absolutely.  Let's talk a little bit about the show floor. Have you seen anything that's excited you? I was over playing with the Gemini model that they have that lets you travel to anywhere in the world to learn about the animals, which was very cool. You can learn all about, I was learning about the hawksbill turtle and what it eats. And I don't know, I think sometimes when we think about tech, we think about, we think about stuff, where we think about these literal applications. We've talked a lot about what the stack looks like for these companies who are trying to scale. But to our point, we're still on the precipice of making AI real actually in terms of everyday consumer lives. And I think the education piece is really interesting. That's a great point about the, looking at experience about the environment because I think AI is going to help sustainability in a big way because a lot of that number crunching, super computer power is going to come in. And there's a lot of underfunded NGOs and nonprofits that are doing all this work. But also, there's also a cool element of like say the rainforest. I saw at the NVIDIA conference, they had this exhibit where this is virtual walls is going to come out, it's going to be shown in LA.  But that immersive experience really hit home there. So you got the AI for good and then the AI immersive experience. So I think the photo stuff and the graphics and the videos we're going to see a whole nother metaverse level like thing come out, I think augmented reality will probably go to the next level from this. So that's why I think meta is all in on their side because- Because everyone goes to the metaverse? The four users of the metaverse? I think they were a little bit early on the whole meta. They should have called it GNAI instead of Facebook. You know? But I think what you're saying and what I think is so exciting about this event is that they're speaking to different personas here this week. I mean, yesterday was more of the CIO and executive level. Today's more of the developer and how you get into your hands dirty. And I think they're playing both sides of the fence with who they're really targeting, Google is. And I think that what's really interesting is that people are talking about getting to production. They're not talking about trying something out with GNAI now. And I think a lot of that is GNAI may not be a prompt. It may be behind the scenes, behind the UX and have that kind of, you know, be part of the data app, but it's not the prompt. You're not interacting with it that way. I think the GNAI news here is, I know they got a bad launch wrap and I hate to see that because I think there's some people jumped on that and wanted to kill Google on that. But the GNAI 1.5 is good. I played with it last night and it was really phenomenal. And how they're integrating it into the apps is good. And the million token window is only going to get better. We heard last night that it could go up to 10 million. And so that was an internal number. It wasn't out for public usage. But that means- Well, had we just made it public? Well, I mean, that's what you hear when you're hallway. When you got the press land, you got to be careful who you talk to. But if that's true, and I do believe that that's the headroom you'll see, that means everything's going to be tokenized. Now remember, Jensen at NVIDIA, the CEO of NVIDIA said, we're living in a token world and tokens will be the currency of AI. So I think Google is showing to me that with that kind of horsepower and Gemini performance, it might be ready for prime time to be on smaller footprint machines. So what I'm watching is how much backend horsepower will be needed to power the AI apps. And if Gemini can be more efficient, then you're going to have more distributed use cases around your phone, your lightweight machine, your laptop- Your Edge devices, baby. Edge devices, you know, IoT, Savannah, your wheelhouse. So I think that's a promising look and the Vertex, obviously, they got the 130 model. So, and the BigQuery, really kind of a storage data analytics might seem a little bit boring, but their pitch is strong, Rob. One place to do everything with the vectors there and everything's there and open to multi-cloud. That's a compelling pitch, I got to say. Yeah, I like that they've rebranded Anthos and all of the different things, like, you know, on-premise stuff to distributed cloud. And I think they've, another thing that's been very consistent throughout all of the discussions here has been multi-cloud. Not just about having your data live here. In fact, we had that discussion earlier today about how you connect up things into BigQuery, into the semantic layer inside of Google Cloud from other clouds. And I think that is something that you really hadn't heard out of Google and you certainly will not hear out of, you know, Microsoft or out of Amazon, for that matter. So I think, again, I like the messaging. Now it's, let's see the delivery of that. And I think that's the interesting part. Yeah, I agree with that. I'm glad you brought up cross-cloud networking. I also really enjoyed the interview that we did with PWC a minute ago when he said no is not an answer. Yes. When it comes to implementing AI within your organization or leveraging these tools. And it's, I've kind of been thinking about that ever since. What did he say, rewind what he said? He literally just said, when it comes to making a decision about AI within your organization, making any decisions about AI, no isn't an answer. You have to have the right people from cross teams making that decision. But what's interesting about that is my point where I'm driving here is typically when we see new tech emerge we see the tech industry adopted or we see one vert adopted with much greater saturation first at least in the early adoption phase. Right now we're seeing companies ranging from life sciences to retail to the big hyperscalers. And so everyone really is all in. And so I think in a sense the hype is really intense right now but I also think that everyone is feeling that in a way that is very cross market which is really, it's interesting. I think that's been one of the things I noticed here is how many players are already a few steps down the path and about start realizing goals. Well I mean I think, I mean the thing about these shows Savannah is you get excited, it's booming. And Rob we've talked about this many times at AWS. At some point you become a victim of your success where you got to hit GA for all these preview products. So if you look at all the announcements Savannah it's like a lot of previews. So. It's a great point John. And then the rebranding so Google's going to have to continue to navigate through how do they manage that naming conventions, how to make it easier for the consumption side. So you know you've still got to follow through and there's a competitive world out there. There's a competitive world. I think this has been a really great show though. It's my first time, I feel like I'm learning. I feel like there's a lot of exciting stuff. There's puppies, there's donuts. I'm not sure why donuts are such a thing. We're going to have a great swag segment for you all in a little bit. Don't worry about that. You know it's going to be good. Rebecca, John, Rob, what a pleasure. Yeah. Well I will say there's one other thing, just sorry. No. Not to throw everybody off. We need to hear them. I think one of the interesting thing is also the ecosystem partners around here. So there's announcements out of Chronosphere. There's announcements out of Dynatrace. Dynatrace is actually now running on Google Cloud. So I think to John's earlier point, there is a lot more coming in to the ecosystem and I think that's something to watch around. This is ecosystem. And they got to sustain it because it looks good now. They're here. They're planting their flag. They're saying we're here at the booth. We have a party. They want to engage. If they can sustain it for one more year, Rob, then to me I think it's legit. You'll be a believer. I mean it's legit now because they're making, they're spending money. At the end of the day, if partners aren't getting value out of it, doing business and Google's not going to do business with the partner, this is a market where Google will do business through the partnerships and the partners do business on Google. So that's the ecosystem flywheel here and it's a good sign that they're here. So I said that's again, that's one of those points where that's the enterprise angle. That's interesting. Great. Yeah. Well, it's going to be fun to watch. Can't wait to be sitting here with you all at the next Google Cloud Next. And thank all of you for tuning in to our live coverage here for three days at Google Cloud Next in fabulous Las Vegas, Nevada. My name's Savannah Peterson. You're watching theCUBE, the leading source for enterprise tech news.