This is stock number 10762A. We are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used car headquarters. Today we are checking out the Super Clean 2008 Hyundai Tiburon GS. This vehicle has the two liter four cylinder motor, which pumps out 138 horsepower. It has been fully safe and inspected by our service shop. It has a fresh oil and filter change. All the fluids have been checked and topped off. It has four brand new tires and this car is 100% ready to go. Black pearl is the color we shoot all of our videos in 1080p, 60 frames per second. So if you have HD capabilities on your computer, tablet or smartphone device, turn them on right now because it is definitely your best way to check out the quality and condition of the car before seeing it in person. And if you want to check out all the photos on this car in the upper right hand party screen is a link right to our website, click that and check us out there. It comes with the factory alloy rims and it comes with brand new Kelly Edge 205 55R 16 tires. It still has the little wear knobs on them. Put those on in our safety inspection. Front fender is in excellent condition, I didn't see any dents or dings on that. It comes with the projector lamp headlamps, the projector lamp fog lamps. Front bumper is in pretty nice shape, I didn't see any major dents or cracks on it. And the hood is in really nice condition, you can really get a good idea of that metal flake in there if you've got your HD capabilities on. Passengers side front fender is in excellent shape as well. And the passengers side rim, pretty nice condition, does have a couple little scuffs on there other than that, pretty nice. As you go down the passengers side, take note of how clean the body is, how reflective and mirror like that paint is, we take these HD videos so if you are far away or even if you're close by and just cannot make the trip down but you're still interested in purchasing the vehicle, you can see the car, hear the car and have confidence in what you're looking at before you even get here. So when you do get here, there's no surprises, it does have the power sunroof. That's why we offer the Summit Auto Fastpass option in the upper right hand part of your screen, a link right to our website where you can apply for financing, get pre-approved, see a payment quote, even appraise a trade-off from the comfort of your own home. I didn't see any corrosion on this car, no bubbling rust or anything like that. So that's really nice, back rims in nice shape, does have four wheel disc brakes and these back tires are brand new as well. As we come around to the back of the vehicle, rear bumpers in pretty nice shape. It does come with the chrome tipped dual exhaust, it does have a decklid spoiler, trunks in nice shape, passenger side quarter, not bad condition and the back rim for full disclosure is in nice shape as well. Down the rest of the side of the car, door looks really good. Inside the GS package gives you the black cloth interior, there are no rips or tears on the seats, really nice clean conditions, side curtain airbags. Back seats are in nice shape as well. You can see any major rips or tears and it does have the latch child safety system if you want to try and get a car seat back there. Let's take a quick look in the trunk.  This one does come with a spare tire. Those seats do fold down for extra storage.  So that's pretty nice as well and the trunk lid shuts nicely. Power windows, power locks, power mirrors. As we hop inside the car here you can see that this one has 46,526 miles instrument cluster. It's very nice and clean. Steering wheels in pretty nice shape. It does have cruise controls. It has a Kenwood factory AM FM CD player and the dash is in nice shape. You got your climate controls there. Air conditioning works great. I can vote for that. Passenger side format and seat are in excellent condition as well. No rips or tears and this one does come with the power sunroof. You get bluetooth buttons and capabilities up there and map lights up there as well. Once again, carpeting, floor mat all look really good and we'll take a quick look under the hood. I mean the car is not perfect but really nice and clean and the body's in really nice shape. Under the hood we have the two liter dual overhead cam fourth cylinder motor. Engine bay is very clean, runs very smooth. Like I said before this car has been fully safe to be inspected by our service shop. It has a fresh oil and filter change. All the fluids have been checked and tapped off and this car is 100 percent ready to go. To see more pictures of this car or one of our other 450 new and used cars, trucks, SUVs, minivans, Wranglers, you name it we got to go to our website www.summitauto.com full pictures and descriptions of every single vehicle from two locations all at www.summitauto.com and if you'd like to check out more HD videos you can go to www.youtube.com slash www.summitauto.com. Remember to like, subscribe, and share on this video and all the videos that you see there. In fact in a second you will see a link to subscribe to our YouTube channel on your left. It links more Tiberon vehicles like this one on your right if you have not been to our website on the bottom link to this vehicle on our website. Click those check us out and we really look forward to helping you with this super clean 2008 Hyundai Tiberon GS in black pearl. Thanks again.


Hello! Welcome to this CNCF webinar where we are going to talk about trustedboot and specifically how the Keros project implements trustedboot. First, we are going to have a look, generally speaking, at trustedboot and what are the ingredients and what are the challenges that it tries to solve. Then we are going to have a look at how links handle the booting process and most specifically how trustedboot differs here and how Keros implements booting. Then we are going to have a deep dive on the measurement versus encryption and we are going to have some security consideration on the implementation that we have taken. Then it will follow up a short demo where we will see booting of a trustedboot system and sort of examples to underline the security consideration why we pick it up, some of the design choices that we did. First of all, yeah, I'd like to introduce myself. I'm Petra Di Giucinto. I'm head of open source aspect to cloud. I've been involved with open source for almost 18 years, wearing different hats. So I'm also a developer again to Linux developer and I had my last team was at Suisse. So what is all the fun about cloud and the Edge? So Edge is becoming very much important lately because it's being used almost everywhere. Also the computation, it's moving not only to the cloud but also closer to the real use cases. So we can think about Edge at retail shops, for instance, also to government or public sector deployments, trains, of course on ATM. So it's not only about Kubernetes, even if there is a strong push towards using Kubernetes everywhere. Edge by itself of its own set of challenges because as you can imagine, there are different use cases which requires different set of features. So for instance, high availability or that encryption to ensure that the data is kept secured, preventing from cold boot attacks or physical attacks, setup and maintenance. So maintenance is also a very strong point where everybody can allow to have technical or skillet people closer to those machines where they are actually running the workloads. So it's very important to have a sort of management plan but as well it's very important to have a mechanism that prevents from theft or cold boot attacks or where people can actually mingle with the device physically. And this is very important that we are going to see why trusted boot is important and solves a critical issue in this field. So why we're talking about trusted boot, what are the goals and what are we trying to solve here. So what we are going to solve is preventing modification to the system and that is both runtime and offline. So we are going to have a very deep dive into what we're trying to do and why and prevent of course the theft of the customer data. So whatever it's actually a device or trying to process at the edge, we don't want anybody to have access to it. So if somebody steals the device, power it off and walk away with the device, they shouldn't be capable of reverse it, reverse engineering in another location. So we want to also keep the simple UX as we have today because we are going to see how Keros does things differently and where it sets it apart from other distributions. What are not goals here of the conversation is to prevent the theft of the device. So we are not talking about physical security layer, but rather a softer security layer that prevents physical attacks. What are the most important gotchas that we would like to underline here. And there is a key difference between measurement and encryption. So measurement in the way that we are discussing it here guarantees immutability and verifies the software integrity. So when we talk about measurement, we talk about a very complex topic. So I'm trying to simplify it here in this conversation, but the outcome of it is trying to make sure that the software is run against measurement. And most importantly, so if the device is equipped with a certain software, we don't want the device to overrun again if that software is modified. So the system has to somehow assess itself during the good process to be able to know if it wasn't modified by anything. So it has to be of course tamper proof both online and offline. So we are going to deep delve on why we took some design choices to make sure that we are also tamper proof online. Or at least it's not possible to change the system online as well. Encryption is different, right? So with encryption, we refer to the fact that the data is readable offline. So if somebody steals a device or take off the disk from the system, they cannot see the data. Of course encryption doesn't give you the guarantee that the data is immutable because when the system is in runtime, the data can be manipulated. So there are other security frameworks that are taking care of encryption of data also online like confidential computing, but this is out of scope of this conversation. So what are the ingredients to make Trusted Boot work and how we can solve the challenges at the edge? So we're going to see how Trusted Boot is split into several components. Some of them are already touched. One of the main components is what we call UKI, which is unified image or USI, unified system image. So from a technical standpoint, Keros chooses USI and we are going to see later what is the difference. Secure Boot, measured boot are key ingredient as well. Secure Boot is a security framework that is very well established in the firmware since the past at least almost 20 years. So we have seen Secure Boot growing in adoption. Now basically any recent hardware should have support for Secure Boot and most importantly for a weak UFI. So since the BIOS was in from the beginning of the computers, the attackers basically challenged the security system of the BIOS. UFI was standing as a security mechanism to make sure that we boot secure part of the systems. Now we are going to see how this concept is extended a little bit to make sure that we adopt Secure Boot to boot larger FAA files. And also another key ingredient is TPM, which can be both discrete or emulated by firmware. So we are not constrained to an hardware implementation. However, the hardware implementation seems to be moderately more safe. Of course, verified kernels, since they are assigned kernels are part of this as well, and encryption of this with TPM, which is not something new. Again, also Secure Boot is not something new, but the way all of this is implemented together, you can read more of the references being the docs of KBOS and also on the fantastic blog post by Leonard Pottering, the author of System New, Brave New Trusted Bootport. So where are we looking at here? It's time to make a difference between the standard Linux booting on the left and the KBOS booting mechanism on the right. So KBOS already does a little bit of distinction between the booting from a standard Linux distribution standpoint. By looking at the left picture, we can see how the boot starts, starts from the firmware and then goes to the boot partition, which is typically unencrypted. And then you have the grab bootloader taking in. Of course, you could have different bootloaders, but now specifically we are looking at grab because it's most commonly used and been there since a long time. And then from grab or another bootloader that you like to use there, you can jump basically directly to the kernel and then to the NITRD. The NITRD is just a very small system that has the proper tools in order to mount necessary mount points to switch to the real system. And typically the real system can also be small or big. It really depends. It can be in a partition, a different partition, and of course it can be encrypted as well. So it really depends on the use case here because it could be an encrypted partition, for instance, with a simple pass phrase that we entered with the keyboard. It can be a PIN, so it can even be a PIN mixed with the TPM chip and that allows you to another degree of security. However, this kind of setup requires a human interaction. Of course, there are other mechanisms to avoid user interaction and you can also use TPM chips for that directly to encrypt the partition with grab. But now on the right, we're going to see the difference with Keros. So the Keros approach is slightly different because it starts with a boot partition, which is indeed containing grab as a bootloader. But then the real system, it's a single image already. So that's including the kernel, the NITRD, and the root at first. So when we do the pivot route, we actually do the pivot route, but it's inside the same image and we rely, for instance, on grab to be able to mount those image file as loopback devices. That it's very different because then the system is a single unit and this is represented by a single file. And this is very important because we are reusing this concept during the upgrades or the resets or during the life cycle of the machine. So this is tremendously important because separate the different life cycle usage of the box, streamlined use by having less operation Of course, when you have to upgrade the machine, you need to rebuild the image from scratch. And this is why we talk about immutability a lot in the context of Keros. We think this is a very important aspect and it helps during the management of various thousands of nodes because you build one image once and you deploy it across different devices. And they expect to be all the same. So there are no snowflakes during the upgrades. So we don't use a page manager during the upgrade, but we use the package manager during the build of the image used for the upgrade. And now we are going to see closer what's the difference in the UTI approach. It's not too much different from the standpoint that we still have a single image file. In this case, the image file, it's a kernel and a root fs. And the boot loader in this case, it's changing. So from grab, we switch it over to SystemD boot because SystemD have a tight integration with trusted boot. So they have most of the softer pieces already tied together to provide the best out of the trusted boot implementation. And the file are still resigning in the boot partition, which is unencrypted so it can be accessible. And the FCA file are composed by the kernel and the root fs. So here we can do a distinction between UTI and USI because by specification UTI files are only kernel and in interim fs. So it's meant to switch over to another system. So pivoting, like we basically have in the legacy Linux system over here. So when we do the pivoting here, we are basically switching over to the software into another image. And that can be, for instance, switching to another SystemD which is included over this partition or root fs that we'd like to limit. And of course, there can be different given kernel models. So when we do a pivot route, we are switching the context of the system. So the thing, we are also ending over the init process. So the pit one is going to end over the execution to another thing. So the only thing which is not moving during a pivot route, it's the kernel. Everything gets it's moving. So in our approach, instead, which we call USI, it's unified system image. There is no pivot route. So we jump from the kernel directly to the root fs. And then from there, we mount the system and overlay that on top of encrypted user data. And this is what stands this apart from implementing exactly UTI. So we call this unified system image. Now let's have a look at what are the differences with a measured boot process. So a measured boot process helps the difference that it stores each of the measurements in what we call TPMPCR registries. There is a certified root of trust model. And that one is the first thing that boots even before the FEI. So that's going to do its own measurement and store the measurement in the TPMPCR registries. Now each one of those steps you see here, which are going to store the measurement, are actually extending the measurement, creating the fact to a chain of measurements. So each measurement depends on the measurement of the other block. And this is done transparently by the TPMPCR. You cannot really store anything else, which is not extended. That allows basically to, whenever we do the boot process and pass by to one of the steps that are applied here. So we go from CRTM to the FEI bias to the boot order and finally to the OS. All the measurements have to match a certain expectation. And this is where the challenge comes. So when we build the OS, we build the OS in a way that we pre-compute the measurement so they cannot really be modified and the OS is going to refuse to boot if those are going to change. So this is the core of how the boot measurement process works. Now, what's inside the unified system image? There is nothing really confidential in there. So all the data which is continued into a U.S. public so we can think about it as an interim affairs, but actually it's the whole root affairs. So there is a kernel, so there is a system D sending it system. There are file system tools needed actually to discover the partition in the system and be able to mount that. And then there are precalice components which are needed in order to set up the immutable system or for instance configure the machine with the cloud configs and a locking partition. So there is nothing really important here to see, but everything to find in a U.S. image is already public. And how does it work all together? So we can think about it in two steps because there is a signature verification. The step that is done basically because since it's a single FEI file, we are able to sign it with secure boot and make sure that this file is the only one that should be booted in the system. And it is very important because if somebody tries to change the file with a wrong signature and the signature verification phase, the system won't be able to boot and this is gated by the secure boot mechanism. Then the TPM enters into the stage, so to say, because then we decrypt the target and the encrypted portion of the disk only if the measurement are matching and if that's matching the PCR policy keys. So the PCR policy key is another important aspect of all of this because when we generate those USA images, we're going to generate first a set of keys that are going to be needed along the life cycle of the box and those certificates are going to be needed every time that we're going to build a new image. For instance, if we replace the PCR policy keys, then the system cannot be able to decrypt the disk anymore because they have to measure it. And this is what makes it tamper proof. So whenever we do a modification to the system, that's going to be detected by the measurements and it needs also to have the PCR policies in order to... policy keys in order to decrypt correctly the portion of the disk. So the target that we see here is the system after we boot with the UKI. The target is a mixture of what is inside the USI plus the overlaid content from the encrypted portion of the disk to be able to decrypt the process. So why we don't switch to the second route is very important because switching to a second route which is not measured would be a security flaw because switching to a second image will not measure it. It means that in doing runtime a malware or route keep could actually modify and tamper it and it would go unnoticed. So it's very important to have the measured first mindset in this case because it allows to have a very much stronger security posture rather than lying on the fact that you can modify the second stage and get unnoticed. It's not possible to measure the switch route, the second stage in it now. For various reasons, one of those is also because it's not easy to measure that big chunk of files with the TPM chip. So possibly in the future there will be an enhancement on this area but the choice here is also to make things very simple because it makes also the maintenance very simple to have one single file which is signed and measured at the same time. We do have a much more security posture in this case. So how they are composed of those USI files are unencrypted first. They are containing, as we were speaking, not something which is confidential so the content of those files are public. So the first section we have a system disk tab which actually allows to the API file to be booted directly from the firmware without any bootloader. Then there is a panel and then it comes in fast. There are other portion of the API file which I've kept, not dislike, make things much more simple. However, taking into consideration those are the biggest, the most important part of the API file that we care about and how we can create the API file. So what we do basically is run a UQFI tool which is a part of system D which takes as input different portions of the API file. So they need to manifest the kernel, let's release the ename and cmdline for instance because also this cmdline cannot be tampered so we cannot boot an API file with a different cmdline which wasn't signed against. So this is very important which makes it stand apart also because now the system that we're going to have cannot be booted differently than it was supposed to be when it constructs. So they need some fs in the specific case of K-ROS it's not a need some fs but it's the full root fs and which makes it much stronger. And how this is split is shown in this following slide. So the whole API file is signed with secure boot. And the portions which are measured are the kernel, the root fs, the cmdline, this release the ename and others which are also there are smaller components that can be also measured as well like the splash image or the device tree database. And those are actually the measurements of those parts are signed with a private key. In the public key it's then made part of the FIA file and we have also the PCR policies which are seen in the parts of the PPM banks that are responsible to decrypting the disk. So only if the measurement and the sign letters are matching then we can actually unseal the PPM PCR banks that allows to decrypt the portion of the disk that we are interested in. Now we're going to see a small demo where first we generate the keys required to build the OS and in the specific case the installer ISO but those keys are actually also needed to build the other ways to install the system. So the keys are needed also to create the FIA file or a container image used for the upgrade. So the same keys are used for the whole life cycle of the box or the boxes or the cluster. And then next we are going to see a booting system so all digitalized in a VM how the ISO is going to be putted how then it's going to be installed and then a deeper look on how our system looks like after installation. So the key generation actually allows us to generate keys for secure boot but also the PCR policies which are responsible for the decryption of the partition which are encrypted in the system. And in order to do that we will use a container image which is being published by the Kerosene and this container image has all the tools needed to generate specific artifacts. Here we can see the keys have been generated and between the keys needed which is the secure boot certificate and the keys needed to actually boot the FUKI files and there is also all the certificate and other base needed to do the outer enrollment for the installer ISO. So right afterwards we can go and see how it looks like the process of building an installer ISO. We'll embed part of the public part of the certificates which are also needed to do the GFI enrollment for the secure boot artifacts. So we can see here we start from Maconimus in this case and then we have a tool called a US Builder which is one of the artifacts built by the Kerosene to actually create an installer ISO. The installer ISO is built off of a container image as I just explained and the container image can actually be used as a source and allow for the customization of the simple Docker file. The input of this process is both the container image and the keys that we generate in few steps and this also means that whenever we have to build again another container image for the upgrades of the system we will need to supply the same keys. Now we are going to boot ISO and do the installation. So in order to boot the ISO we are going to create a simple Docker container which contains the key more dependencies so we will start this in at the end. So the command that you see here are available in documentation of the Keros website and you can check out here it's just the M commands which basically is a wrapper to avoid to install any dependencies in the system. So we build this container image and this container image actually is used for two things. The first one which we've seen in the top pane is to start an emulation of the TPM chip so we're going to emulate the TPM chip and on the bottom one we're going to start the key more ISO that we have just built. The commands are documented in the Keros website and you can reproduce the same as well locally. In this case we are specifying the CD-ROM and the ISO that we have just built and you can see here how the system is also automatically enrolling the secure boot keys from the directories available in ISO. So all the certificates that we use have been regenerated from the first steps we're going to be using now. So you can see the ICD which is now boot and the FCI file it's going to build. So the FCI file here, it's a UTI image so it has the kernel and the unit 30 included the unit 30 in this case it's all who has so the approach that Keros takes here it's to have a unified system image so the single FCI file it's the whole OS so the OS is signed in as an FCI file with the secure boot and also measured by the TPM chip. So now we are going to the installation process the installation process of Keros can happen in different ways and this one it's the interactive installer that you're going to see. So just a bunch of questions and we can answer and we have straight away a full installation. So you can see the installation is very quick because in this case we have to just copy the FCI file and encrypt the partitions. We can have a quick look and we can see now here the TPM and the persistent partition which are like those are very Keros specific partition OEM contains the configuration of the system along the cloud configs and the persistent partition instead contains everything else which is the user data accumulated to the use of the OS. So we can also see balancing with LSDLK the partitions and now we are going to stop the system reboot and check what happens to the first boot and have a more deep dive on what are the partition how they are used in the system. So the booting is happening and you can see also in the top pane the operation is terminated by the TPM chip. So now we start the first boot basically what it means we are going to restart again the TPM chip emulation process and on the bottom on pane we are going to boot the virtual machine without the CD-ROP so it's only booting from the disk you can see there are three entries active passive recovery which are common to a Keros system so now we have selected the active entry and we will see the system booting you can see now a bunch of DMSG or output directly because this is running from Kim from the console but now we will be able to login into the system and we have installed it with the Keros it's a Keros password just to test things out and you can see there is a federal Linux container image displayed in the welcome message so now we can actually now list the partition and we can see that the OEM and the system are encrypted with the crypto type over there also see a list with the LS, BLK and the mount how actually they are used in the system so as a reminder in the Keros system we have part of the mount points overlaid on top of the running system and this is for instance home OPD use local it's entirely on the persistent partition ATC it's a femoral and all the parts you see in there are overlaid on the encrypted portion of the disk now after the demo we can have a little bit of understanding how those pieces are fitting together and we have also seen how it's very nice in demo to start from a container image so I think that's a very nice part of Keros because it allows a higher degree of customization so you can customize the system before I had with the Dockerfine and add the tools that you like and at the same time it keeps the flow very simple because it goes straight from generating the piece to building ISO and then booting there so what are the consequences of using a USI image rather than having a UTI image so let's imagine a malware rootkit attack so something that hits the system remotely that can be for instance if we have a class that's exposed outside somehow or there is an application bug anything that can be used by a remote attacker so let's say that remote attacker also manages to run a malware inside a rootkit then we have a much higher degree of security because if they modify the FAFI the system won't boot anymore and they cannot even modify anything about it because the system is completely loaded and mounted only so they cannot modify the system as it's seen by the booting OS and they cannot even tamper it afterwards because they cannot tamper the file that are used to boot because the FAFI are entirely measured and let's say even if they manage to get the secure boot keys still the system is measured so it won't be able to decrypt the encrypted portion of the disk which is one of the most important things that we want to protect here so what happens if somebody has physical access instead so they try to insert for instance a live CD or even try to hack around those nice duck db keys which are compatible and for instance a Fripper 0 can emulate a keyboard and let's say the attacker manages to have security hold inside and leverage security hold inside the box with emulating USB drive so something lower level that can trigger a bug from the kernel standpoint or driver standpoint in that case we are still secure because they can read the content of the FAFI even if they take the box with them but they cannot read the content of the system which is the encrypted part of the disk which is the most important part because that part is being overlaid from the encrypted partition now specifically when we look at for instance how the user passwords are stored in Keros we store those into the OEM partition because they are part of the cloud config so everything in ATC in Keros is ephemeral including the password D or shadow file and so that means that any modification to those are going to thrown away during the boot cycle that means the only way to persist those information the system is to re-apply the configuration over and over again during the boot processing and those configuration parts are part of the OEM partition which is encrypted so what sets apart these from using stage 2 so here that we see here in the slide it's the internal component of Keros which is responsible to set up the system in a mutable manner and it's responsible also to do different things like decrypt the partitions so stage 1 it's what we call stage 1 which is a USI so we have the FEI file including the kernel and the whole interface and that's going to be booted then what happens in this good process is that there is a handover to system D but still done in the same root effect so there is no real switch stage 2 is that there would be another step which would be after decrypting the partition we prepare another environment or actually another partition then we switch root that one so even the context of system D would change and when we boot to switching it means that there could be another system D version inside the stage 2 and that would go completely unnoticed because that cannot be measured so what are the implications of that so let's say in the same case that we talked about before there is a malware or a root heat attack remotely so body having getting access to the system would change the stage 2 in a way that it would get unnoticed so they could replace for instance the system D version with a backdoor and nobody would actually notice that in the same way if somebody have great access physical access to the machine they cannot decrypt an encrypted portion of disk they can manipulate the stage 2 during grand time so let's say that they cannot manipulate that from a live CD standpoint from the machine D turn it down turn it off with a different system but if the system is up and they manage to rely for instance on a kernel bug or a driver bug and bypass and get a console from the running system then they can do any manipulation and that wouldn't get unnoticed at all so what's the future so what we are looking after all of this work so we are looking in a way to measure system this is extension because we think the security is very much important we don't want to sacrifice that so we would like to have a mechanism to overlay that extend the OS with additional packages which are not part of the USI that is for instance if we want to have a big chunk or large modification to the OS and add very large packages and this is also for UX standpoint we would like to have support to overlay portion of the disk from encrypted disk and then we would like to have a way to have a measured default so this is not something we are receiving completely so we are still looking at that with a grain of salt because we think one big image is still better for maintenance however we would like to export ways we can do that if at least from a security standpoint we can allow that we would like to improve the UX on top of this it's already quite easy to get this started by following our talks but we would like to improve the UX even faster and we would like to extend the support of more levels so currently this is working only from Fedora and Ubuntu and we would like to extend the support for all distros that we already have and then we would like to blend this this concept with the remote measurement and be able to control also the booting of the machine from the management control plane thanks for watching you can visit keros.io to learn more you can try already the trusted boot experience at what we have been discussing a year by following the documentation the keros website you can see the link over here you can learn more about the trusted boot by checking out the architecture page and the keros website and then you can engage with the community so we have regular office hours, we have monthly meetups where we share updates as planned for the next releases and then you can hook up with your team with Slack or Matrix or GitHub for discussion. Thanks for watching and have a nice day.


Schenle Laboratories, producer of Penicillin Schenle and Schenle Pharmaceuticals, presents the Encore Theater. The Encore Theater play tonight, now Voyager. Our star is Maureen O'Sullivan. Tonight, Schenle Laboratories presents another in a new series of great dramatic programs. Some of our stories are fact. The struggles and accomplishments of great men of medicine. Others are fiction. Stories of devotion to an ideal, individual heroism or courage. By these programs, Schenle Laboratories would remind you that medical science and progress is not cold in personal research or pages of statistics, but a warm human story told in living terms. Whether it's the life of one of medicine's immortals or the everyday record of service rendered by your own physician. Now Voyager, starring Maureen O'Sullivan with George Zuko and Elliot Lewis. In his study in his great sanitarium at Cascades, New York, the world-renowned psychiatrist Dr. Henry Jackwood sits, writing in his journal. I met Charlotte Vale for the first time in her own home. Her sister Lisa had come to me and asked me if I would consider taking Charlotte's case. There were details about it that interested me, so I went to Boston. The moment I met Charlotte's mother, I began to understand a lot of things. Charlotte was a late child, Dr. Jackwood. The child of my old age, I've always called her. I was well into my 40s when she was born. Her father passed on soon after.  Of course, it's true that all late-in-life children are marked. Well, often such children are not wanted. That can mark them. I've kept her close by me always. When she was young, foolish, I made decisions for her and always the right decisions. You would think a child would wish to repay your mother's love and kindness. Yes, mother. Hello, Lisa. Charlotte, darling. This is my very good friend, Dr. Jackwood. I wanted him to see you. How do you do, Miss Vale? Dr. Jackwood. Well, Lisa feels that your recent peculiarities, your fits of crying, your secretiveness indicate that you're on the verge of a nervous breakdown. Is that what you're trying to achieve? I know. No, it doesn't. Dr. Jackwood has a sanitarium in Vermont, I believe. Probably one of those places with a high-wire fence and yelling inmates. Well, now, I wouldn't want anyone to have that mistaken notion. Cascade is just a place in the country. People come there when they're tired. You go to the seashore, they come there. The very word psychiatry, Dr. Jackwood. Doesn't that feel you with shame, Charlotte? My daughter, a member of our family. There's nothing shameful in my work or frightening or anything else. It's very simple, really, what I try to do. People walk along a road, they come to a fork in the road. They're confused. They don't know which way to take. I just put up a signpost. Not that way. This way. If you'll excuse me, I... Miss Vale, wait. Don't run away. Look, I wonder if I might ask you a favor. Will you be nice enough to show me around the house? It's such a beautiful place and one doesn't often get the chance to see these old Boston houses. I'd rather like to see what your room is like. I'm not your patient yet, Doctor. Of course not. I've seen the rooms of a lot of people who aren't my patients. My friends. I'd hope that you and I... but of course, if you'd rather not. It's on the floor above. When I was 17, I stayed out once until after midnight. That stair tread hasn't been fixed since. Here we are. She locks her door. Make a note of it, Doctor. That's significant, isn't it? Well, it signifies it's your door. I've never heard it said that a woman's home is not her castle. Here it is, Doctor. My castle. Her castle. A set of mahogany furniture selected by her mother. Very obviously selected by her mother. A picture of the Coliseum by moonlight. An etching of pigeons since Mark Square. A Gloucester sea scene. On one side of the room was a workbench complete with a set of tools for carving ivory. On the bench, there was some raw ivory. A half-finished figurine. And two exquisitely designed boxes. Did you do this? Why shouldn't I? The point is how you could. They're beautiful. I have a very real admiration for people who are clever with their hands. You may have one of them, if you like. I would indeed. Well, that's very kind of you. I'm very fond of such things. You wouldn't have to have a cigarette hidden away someplace, would you? Do you think I hide cigarettes in my room, Doctor? No, it isn't that. But I must have left mine in my car. Where do I hide them, Doctor? On the shelves behind the books? Cigarettes and medicated sherry and the books that my mother would never allow me to read? A whole secret life hidden up here behind a locked door? You're very perceiving, Doctor.   When I was 20, I fell in love. But the man wasn't good enough for a veil of Boston. What man is suitable, Doctor? She never found one. What man would come along and look at me and say, I want you? I'm fat. My mother disapproves of the falderals of diet. Look at these shoes. My mother approves of sensible shoes. Look at the books on my shelves. My mother approves of good, solid books. I'm my mother's well-loved daughter. I'm her companion, her servant.   Doctor Jackwin, can you help me? When we were talking downstairs, you talked about a fork in the road. There are so many other forks further along the road. So many.   Weeks of sun and rest and dietary childhood fail. Weeks while her tears retreated and her hands became more steady. As time passed with her sister Lisa's help, her appearance was changed. The sensible shoes disappeared for more attractive ones. A hair was cut to hang loose on her shoulders and her clothes were chosen to set off her new personality. Outwardly, she was a completely poised, lovely woman. But inwardly... Hello, Charlotte. Hello, Lisa. Dr. Jackwith. Certainly is beautiful out here in the gardens. Oh, yes, isn't it? Dr. Jackwith tells me you're almost well. She is. Lisa says I'm well enough to leave here now, but I've got to go home. Oh, Lisa, I dread it. I dread it horribly. It's awful, I suppose, not to want to go home and be with her, but... Stop, look and listen. New England conscience on the track. Well, you may not have to go home. May I tell her, Dr. Jackwith? Oh, later, maybe. You'll see how she behaves. We have a scheme, your relative and I. What is it? You will find it out in good time. This morning, Charlotte, during your office appointment with me, I referred to a quotation, remember? Well, you said it was from Walt Whitman, but you couldn't quote it. Oh, that's right. Well, I've had it looked up and typed for you on a strip of paper. If old Walt didn't have you in mind when he wrote this, he had hundreds of others like you. He's put into words, but I'd like to say to you now, and far better than I could ever express it. Here, read it. Untold want, by life and land near-granted. Now, voyagers, sailed our forth to seek and find. She was nervous when she started on the cruise to South America, and she kept pretty much to herself. The first night, she didn't have the courage to go down to dinner, but on the second, she remembered that I had said, Pull your own weight.  Be interested in everything and everybody. Be nice to every human being who crosses your path. This is your table, Miss Vail. Thank you. Miss Vail, may I present Mr. Durant. How do you do? I hope you don't mind sharing a table, but since you were both traveling alone. No, no, not at all. My name is Jeremiah DuVaux Durant. If you'd like to hear it in its silly entirety. I was JD in college. My wife calls me J. DuVaux, and I'm Jerry to my friends. How about you? Who are you? What are you? Where do you come from? Well, I'm not quite sure who I am. If clothes make the man, then at present I'm my sister Lisa. If it's the shoes, I'm her sister June, her daughter June. She picked mine. They were the same size, you see. But if it's I, whom inside? I? Well, I appear on the passenger list to Charlotte Vail. Boston, Massachusetts. I've heard of Boston. And the name Vail, like Bunker Hill, rings a familiar bell. Will you go dancing in the lounge with me after dinner, Miss Charlotte, of Boston? I'm afraid I'm not a very good dancer. Neither am I, but I have a feeling about us. I have a feeling we're going to dance very well together. I have a wonderful feeling about you and me, Miss Charlotte. It's wonderful up here on deck, isn't it? The air has a taste to it. Great intoxication, I'm afraid. The ship will be in Rio all day tomorrow. Will you have lunch with me and help me do some shopping for my daughters? Your daughters? Here, I'll show you a picture. Who is that knitting? That's Isabelle, my wife. The picture isn't very good of Isabelle. She'd only looked up and smiled. That's Beatrice by her. And that's Tina sitting with her legs crossed. We hope she won't have to wear glasses always. Tina wouldn't smile for me either.  Does Tina know she wasn't wanted? That's an odd remark. Oh, I'm sorry. I really shouldn't have said that. It's odd because it hit so close to the truth. Even before she was born, her mother said... Never mind that. By the way, I have something for you. I don't know the first thing about perfumery, but the clerk said this was all right. It's a... It's a mixture of several kinds of flowers. It's called Jolie Fleur. Jerry. It reminded me of you. Oh, Jerry. Jerry. You know this is the first... You're the first man. This is my first present from a man. I'm glad I could give you your first present. I'm glad I could be the first man to give you one. I wish things were different. I wish I could be the last man and all the others in between. I was right. The air is intoxicating. It isn't the air, my darling. It's the moment. And it's you. Our other friends of Jerry Durant is on the ship, a young couple who had been friends of his for years. On the morning of the ship, Dr. Freo, Jerry and Mack were playing deck tennis. And Charlotte and Mack's wife, Deb, sat talking. Oh, I haven't heard Jerry laugh like that in years. You're good for him, Charlotte. Oh, honestly, when I see what a woman like Isabelle can do to a man like Jerry, it makes me boil. She doesn't love him or her children. She doesn't love anyone but herself. Deb, please, do you mind? I don't want to hear any more about it. Well, I think you should. Why, she even made Jerry give up his architecture because she wanted him to do something that would bring in money more quickly. And he could have been a fine architect. Hey, what are you two getting so clubby about? Oh, wait. Just talking. Play with me, Mack. But I can bet you need you to get... Jerry, we're getting into the harbor. Look, this is the one side in the world at this moment, Jerry. There's only one first sailing into real harbor. See you over there? This is my getting off place. Your boat goes on in three days. Will I see you? Not unless you pay more attention to your guide. Thank you. On your left over there... Sugarloaf? That's right. We'll take a cable car to the top. Up on that mountain, there's something to please your architect's heart. Did Deb tell you I used to be an architect? Look at it, Jerry. The Christus statue. You wouldn't think from here that there's a way to get to the top, but they say that it's the closest... the closest that you can get to heaven. In a moment we'll return to our play, now Voyager and our star, Moreno Sullivan. But first, an important message from our sponsor concerning one of humanity's great healing aids. A sound mind in a sound body. Down through the ages, physicians everywhere have dedicated themselves, their lives, their studies to the end that more and more people enjoy mental as well as physical health. Your own family doctor, through his training and his understanding, is directing his energies toward the attainment of this ideal. He is also reading and studying constantly the findings of research workers in laboratories all over America. Laboratories such as those maintained by Schenle. At Schenle Laboratories, an extensive program of continuing research has developed many specialized penicillin product, penicillin tablets and trochies, penicillin ointment and a thalmic ointment for the treatment of certain infections of the eye. In the future as well, Schenle Laboratories will continue to voting its interests to the cause of medical progress. In studying the healing possibilities of drugs derived from fermentation processes and other drugs as well, Schenle hopes sincerely to contribute a share in expanding the frontiers of medical knowledge and thereby to aid your doctor in his work of keeping you well. Now, the second act of Now Voyager starring Maureen O'Sullivan with George Zuko and Elliot Lewis. In the study of his sanitary McCaskades, the great psychiatrist Dr. Jackwith sits, writing in his journal, Charlotte Vale was definitely on the mend. No more hysteria, no more grief. But she was up against a great problem now and her future peace of mind depended completely on her response to the problem. The Voyager had sailed forth, had sought, had found. On the third day that the ship had remained in Rio, she and Jerry went for a ride high in the mountains above Rio. The driver missed a turn and the car rolled over the mountain to a small plateau halfway down the mountain. I am mother in heaven. What have I done? I said, go forward. The car she's went back with. You killed her. You hurt this.  Are you dead? Let me help you out.  Oh, God. Oh, God. Oh, the car. The family's so beautiful. Oh, man. Well, don't cry. It's all right. It's all right. I tell her to go forward. She's gone back. Please send you. I will descend into the valley to get the caballo record. Well, send you and send you to remain the car. Excuse me. Caballo record. Caballo record. What did he say? I hope he said he'll get a horse and a rope. Uh-oh. Uh-oh. It's beginning to storm. There's some sort of a shelter over there. Well, come on. We'll run for it. You must have been a boy scout. That's a beautiful file. You're very quiet. What are you thinking about? I was pretending. Or wishing. You might even call it praying. I was thinking how wonderful it would be if you and I were the only two people in the world. We could stay here forever. When you get to be my age, you don't pretend anymore. You know there are no such things as fairy tales or happy endings. We'll be friends, you and I. All our lives. Do you really believe that? Yes. At least I want to believe it. I want to believe that there's a chance for such happiness as this to be carried on somehow, somewhere. There isn't. In a few days, this will be gone. My footprints in the snow. Leaving no trace when the snow melts. Leaving nothing. Except what we remember. All our lives. Wherever you are, wherever I am. We are what our memories are. Whoever gave us this chance to be near each other will give us only one chance. Darling, why are you crying? Don't you know what I'm saying? Don't you realize I love you? I know. I know, and I can't believe it. I suppose these are really tears of gratitude. An old maid's gratitude for the crumbs offered. Please don't talk like that. No one ever called me darling before you did. Darling. It never was any more than that.  But the two people who lived it would never be the same again. They had the intelligence to recognize love. They had the strength to put it by. Charlotte Vale came back a vibrant, glowing, confident person. And one that seemed completely happy. If you didn't look too deeply in her eyes. She was very lonely for what she'd found. And lost. She came to Cascades for a few weeks of rest before going home. And there she met Tina Durance, Jerry's child. I didn't know at that time she knew Durance. And it was completely accidental that Tina was in the next room to Charlotte. She heard Tina crying. And she opened the door and went in. Oh hello.  You do? Who am I? You're my new nurse. You're wrong. I'm your new neighbor. How long have you been at Cascade? Ten days. And you don't like it very much do you? No. Well neither did I at the end of ten days. But the first two weeks are the worst. What's that you have there? Jigsaw puzzle? Uh huh. Will you let me help you work it? Tina darling, what's the matter? Can I sleep in here with you? Of course you can. Oh, something happened? Something terrible. Oh. That awful Miss Warner said there would be a nurse here for me tomorrow night. My age has nursed a shame. No, no Tina. Tina, listen to me. Listen Tina. I'll talk to them tomorrow. I'll ask them to give you another trial without a nurse, hmm? I'm an old friend of Dr. Jackwiths and I'll tell him too. You leave it to me, will you? Why are you so good to me? Oh, lots of reasons. But one is enough. There was someone who was good to me once when I needed someone. I'll go to sleep Tina and I'll tell you a story. Here. I'll turn the bed down. Now then.  Eh, that's better.  Once upon a time there was a little girl and she was a girl. Dr. Jackwith, I have a proposition to make. My nurse is telling me you're running cascades now. Oh. You had Tina hiking, dancing, playing tennis. I thought you came up here to have another nervous breakdown. Well, I decided not to have it if it was all the same to you. I'm not doing anything with my time. Couldn't I take care of Tina instead of a nurse? I promise to ask you about everything. I've already cancelled the nurse. Just go ahead, tell me what you'd do. Oh, I'd just be with her and I'd pay her attention and make her feel wanted and important. Then as soon as you let me, I'd take her to Boston for a holiday. Why do you take such great personal interest in Tina? Well, I know her father. He was on my cruise. I thought perhaps you knew. Well, I don't see how you could know except that you seem to know so many things. No, I didn't know. If I had known, I certainly wouldn't have advised you to come to cascades at present. No? I had no idea you'd ever met a durance. I don't know how emotionally involved you are with him, but I can't work in the dark when there's a child in the picture. Well, I'll tell you everything. It's over. That's everything in two words, Doctor. It's over. Dr. Jackwith, Tina needs me and I need her. Well, I'm crazy. But if you promise to behave yourself. Oh, I'll tell her. But you're only on probation. Remember what it says in the Bible, the Lord give it and the Lord take it away. How does it feel to be the Lord? Not so very wonderful since the free will bill was passed. Too little power. I love you, Dr. Jackwith. I love you, Charlotte Vale. Charlotte and Tina brought great good to one another and great happiness. Charlotte found the child she had missed and Tina, the mother. I got permission from the Durants for Tina to go to Boston with Charlotte, and many months later I took him down with me to visit them. I was a little nervous about that meeting and more than a little apprehensive when Charlotte and Jerry went in the library and closed the door. How do you like your daughter, Jerry? She's lovely. But, Charlotte, I'm going to take her home. Oh, no. No, you can't. Oh, Dr. Jackwith said it would be the worst thing in the world for Tina to go home now. I don't care what he says. No self-respecting man could allow such self-sacrifice as yours to go on indefinitely.  I simply don't know you. I can't go on forever taking, taking, taking from you and giving nothing, darling. Jerry, don't you see? You will be giving. Don't you know that to take is to give sometimes? The most beautiful way in the world of two people love each other? Oh, besides, Jerry, you will be giving me Tina. Every single day I'll be taking, taking, taking and you'll be giving.  Oh, so that's it. Some man to make me happy. Here have I been living under the delusion that you and I were so in sympathy that you knew without being told of what would make me happy. When Tina wanted to come home with me and stay, it was like a miracle happening and I allowed myself to indulge in the fancy that both of us loving her and doing what was best for her together would make her seem actually like our child after a while.  Wait a minute, Miss Pepperpot. Pull that go off me. Now I know.  Do what we will. Ignore it. Neglect it. Starve it. It's stronger than both of us together. Oh, Charlotte. Let me go, Jerry. Jerry, Dr. Jackwith knows about us. When he let me take Tina, he said you're on probation. You know what he means. He allowed me this visit of yours, but it's a test. If I can't stand such tests, I'll lose Tina in time and we'll lose each other. Jerry, Jerry, will you help me? Shall... shall we just have a cigarette on it? May I come here sometimes? Whatever you like. It's your home too. People who love you live here.  Of course. We can always light our cigarettes from the same flame. That is, if you'll help me keep what we have. If we both try hard to protect that little strip of territory that's been given to us, I can talk to you once in a while about your child. Our child? Thank you. And will you be happy, Charlotte? Will it be enough? I will be happy, Jerry. It must be enough. And so the case was concluded. The patient dismissed. The voyager had reached his destination. In a moment, we'll bring back our star, Moreno Sullivan. Ladies and gentlemen, Schenle Laboratories' maker of penicillin Schenle would remind you that the emergent standard of health is higher than that of any country in the world. But, warning, danger ahead. That is the meaning of a recurring ache or pain or chronic underpire feeling. It is of utmost importance to you to heed this warning and see your family physician immediately. Serious diseases may often be arrested when detected and treated in their incipient stage. Schenle Laboratories urges you to take advantage of the years your doctor has invested in gaining knowledge and experience that will benefit you. Consult your doctor regularly. And now, ladies and gentlemen, Miss Moreno Sullivan. Ladies and gentlemen, to sum up the spirit of the Schenle Laboratories' program, this simple and beautiful prayer of the physician, written centuries ago by my monadies, seems to me to be apt and fitting. The eternal providence has appointed me to watch over the life and death of all thy creatures. May I always see in the patient a fellow creature in pain. Grant me strength and opportunity always to extend the domain of my craft. This is the prayer of the physician. It is ages old, yet today it is as new as the hope for a peaceful way of life for all the world. May we invite you to listen again next week, at the same time when Schenle Laboratories presents Dr. Ulrich's magic bullet, starring Charles Bigford, a great star in a great story. Good night. Now, Voyager was produced and directed by Bill Lawrence and was presented to the courtesy of Warner Brothers, who this year is celebrating the 20th anniversary of sound pictures. It was a Gene Holloway adaptation. We are most grateful to Moreno Sullivan, who stepped in at the last minute, to replace Loretta Young, whose illness made it impossible for her to appear tonight. This is Frank Graham, speaking for Schenle Laboratories, producer of Penicillin Schenle, and inviting you to listen next Tuesday, at the same time when you'll hear Charles Bigford in Dr. Ulrich's magic bullet. This is CBS, The Columbia Broadcasting System.


Wel prynhawn ddain me'th eto ichi gyd. This week after so many difficult weeks and months we have seen a glimmer of hope. The first COVID-19 vaccine is ready for use in the UK and we hope that the next one will follow soon. Here in Wales our plans have been thoroughly tested. We expect to receive the first supplies in the next couple of days. We have trained staff ready to give the vaccine and I'm pleased to be able to say this afternoon that we are planning to begin vaccinating people from Tuesday of next week. Now we hope of course that this marks a turning point in the pandemic and that it will put us onto what is going to be a long path back to normality. Because while the vaccine offers hope for the future, the position today in Wales remains very serious. Almost two-thirds of our local authorities have a seven-day incidence rate of 150 cases per 100,000 people or higher. In two areas the rate has now exceeded 400 cases per 100,000 and the rates are rising in all but two local authorities in Wales. A week ago the All Wales figure was 188 cases per 100,000 people. Yesterday it was nearly 50 percentage points higher than that. The percentage of tests which are positive, the test positivity rates, are also increasing. This slide shows that following a dumb turn after the firebreak period we are now experiencing an unmistakable rise in coronavirus once again and that pattern is now true of all ages here in Wales, both those aged under 25 but also this week now in the over 60 age group. The result is that every day we are seeing more and more people admitted to hospital with coronavirus symptoms. In the last week we have seen a record number of coronavirus related patients in our hospitals and these numbers are increasing and many of these patients will be in hospital for three weeks or longer. The epidemic is putting our health service under a significant and sustained pressure. Yesterday the Welsh ambulance service declared a critical incident, the first real visible sign of the impact of coronavirus on day to day care. The problem was not so much ambulances or crews being unavailable but that hospitals in some parts of Wales are now so full of patients with coronavirus that it simply wasn't possible for our ambulance service to attend to other people's emergencies in the way that we would want and expect. Now fortunately that position has improved today but yesterday the impact of coronavirus in our health service was absolutely real and making a difference in the care we were able to offer to people suffering from strokes or heart attacks or having broken limbs and of course as we know we continue to see high numbers of deaths each day and each week. My thoughts continue to be as ever with the families and friends of all of those who have loved a lost a loved one to this awful virus and for all to protect your health to make sure the NHS can look after all our health needs to slow the spread of this virus and to save lives. It is for these reasons that we must act now to strengthen our package of national measures as we face the winter period ahead. As you know from 6 p.m. tonight the coronavirus regulations will be amended. They will require the closure of all indoor entertainment and other visitor attractions or pubs bars cafes and restaurants will have to close their doors at 6 p.m. every day and no alcohol can be sold. I want to be clear that if Wales were in another part of the United Kingdom our coronavirus situation would mean that we would be subject to the English tier three regime or level three restrictions in Scotland and difficult as these new restrictions are they simply bring Wales into line with those areas of Scotland that face similar challenges and indeed they are less restrictive than those faced by similar areas in England. And to help with all of that we are providing a £340 million package of support to help businesses through this difficult period and that includes a £180 million package of funding expressly for the hospitality and tourism sectors. Across the combined package an average sized single site hospitality business employing six people will be able to claim up to £14,000 to help with their fixed costs and that is in addition to the wage support schemes available from the UK government. A calculator will be available next week on the business Wales website to allow businesses to work out how much help they will be able to obtain from the most generous package of support anywhere in the United Kingdom. Of course these are incredibly difficult decisions there have been no easy choices this year especially when we are making decisions which affect people's businesses and livelihoods but throughout the pandemic this government has taken the decisions that are necessary to protect your health and the health and well-being of your family. It is my responsibility to do whatever is needed to save the lives of people here in Wales and I want you to know that the government that I lead is a government that will never shirk our duty to discharge the responsibilities that lie in our hands however difficult and however challenging those decisions may be. Now before I take questions I want to update you about two important developments in our response to coronavirus. We're starting the process of offering all health and social care staff including people working in hospices, regular testing, these using the new rapid lateral flow devices now available to us in Wales. Everyone will be offered one of those rapid tests twice a week starting with people working in higher risk patient facing areas. Testing will be available to everyone in health and social care by January of next year and we have agreed an important addition to the Christmas arrangements to make sure that people living alone, single parents and those with caring responsibilities are not left out. As you know we agreed with the other governments of the United Kingdom to have a common set of arrangements between the 23rd and the 27th of December to enable three households to join together to form a single Christmas bubble. Now here in Wales that Christmas bubble can be joined by a single person, a single parent or somebody with caring responsibilities to make sure that they are not left alone for that five day period.  It thrives on our normal human behaviour and all those places and opportunities where we come together. We've worked together throughout the pandemic here in Wales to make a real difference to the course of the virus and ultimately to save people's lives. I'm asking for your help to do that again in the days and weeks ahead. It is only by acting together that we can keep Wales safe. Diolch yn fawr iawn wrth gwrs i chi gyd. I'll take questions now and as usual all the answers will be broadcast live on our own social media channels and first this afternoon over to Adrian Masters at ITV Wales. Thank you First Minister. I wonder if I could pick you up on the financial package that you've mentioned and you mentioned that the calculator will be available from next week and that what business Wales calls a triage service will begin for businesses but the applications don't open until the 11th of January now. Last week and earlier this week you made clear that it was intended that that money would be available by Christmas for businesses so has there been a mistake and will you rectify it? No there's no mistake Adrian it's important as I said in my statement to recognise that there are two parts to the package that we are providing. The £180 million specifically for tourism and hospitality industries will require businesses to provide evidence and to provide information to allow payments to be made and that's what the triage checker will provide. The remainder of the money is being delivered through local authorities using rateable values and the same system that we have used twice already during the pandemic and our local authority colleagues are working hard to make sure that those payments that part of the help will be available before Christmas. Thank you and could I ask you about foreign travel? The current restrictions I understand will remain in place until January and that means essential travel only i i no holidays no flights for holidays. Can you confirm that that's the case and can you explain it and could you also explain why you're not looking at the test and release scheme that has been introduced in England? So this is quite complicated so I'm going to just make sure that I get it's completely right for people. The regulations in Wales will prevent people leaving Wales to go to high incidence areas tier three and level three areas in Scotland or England or from coming into Wales from those high incidence areas. The regulations will not prevent people leaving Wales to go to lower tiers in England or Scotland although the advice of the Welsh Government is clear that people shouldn't travel unless they have a very good reason for doing so. Because people are able to travel into let us say tier two areas in England they will be able to go to airports in England that are open because the English Government has resumed international travel so people in Wales will be able to travel if they take that route. Our advice to them is not to do it because you put yourself and you put others at risk. What has not changed however is the regime in Wales for when you return. When you return from international travel you will still be subject to a 14-day quarantine period and that is to make sure that people returning from elsewhere in the world don't bring the virus back to Wales and cause a difficulty for others and we definitely saw that at the very start of the pandemic. You remember that the earliest cases we saw were largely people who'd been on holiday during the February half term to other parts of Europe where the virus was already in circulation and they returned to Wales and they were already infected. So the part of the travel restrictions that has not changed is the quarantine on return. We advise people, strongly advise people in Wales to avoid travel other than where it is necessary. So technically they could go to Gatwick say which is who says in tier two that you would advise against it. It will not be illegal for people in Wales to do that, but the strong advice is that going on holiday is not a good reason for leaving Wales during a pandemic with all the additional risks that that will cause. Thank you. Over to James Williams of BBC Wales. Can I get these answers in Welsh and English please? Can I start with the vaccine? Can you just give us an outline of your thinking on how far down the priority list we need to go before you start loosening, before it has an impact on the level of restrictions? Is it your thinking that if the vulnerable and the elderly are vaccinated but there's still high prevalence amongst younger people that we all go back to normal? Can you just sort of outline your thinking on this? Thanks James. It's important to explain to people that we will still need to take a precautionary approach until we have sufficient number of people vaccinated to be sure that the risks that are posed to our health service and to people falling ill with a vaccine has been effectively suppressed and that is not going to happen quickly. Even with the vaccines that are coming our way fastest you have to have two doses of them three weeks apart. They're not effective until after the second dose so even those people who will be vaccinated in Wales in December will not see the benefit of that vaccine until into the new year. It will then, James, I think be a combination of two or three different factors. How quickly the supply of vaccine comes into the United Kingdom? How quickly the other vaccines that are in the pipeline obtain approval from the regulator and then how quickly we are able to deliver it on the ground and it will be, we will need to be able to come down those tiers of vulnerability before we see a difference, the vaccine making a difference in our daily lives but that at least is a path of progress. That at least is a path where things are moving towards getting better and we will as ever be guided by the advice of our chief medical officer and other advisors as to the point at which things are safe enough for us to be able to lift restrictions, get back to something more approaching what was previously normality. So mae'n dibynnu ar ni fel o bethau, mae'n dibynnu ar ffeint o'r ybrychiad sydd ar gael un i yma yn y denysyn edrych ac yn cymry, mae'n dibynnu ar posibliadau newydd sy'n dod trwy'r system a mae'n dibynnu ar y cyflomder gyda ni'n gallu defnyddio i rhoi ybrychiad mas i'r bobl. Fel arfer, yma yn y Llywodraeth yng Nghymru byddwn ni'n fynd i dibynnu ar y cangor y prif swyddog megyddol a pobl eraill sy'n cynghori ni am pryd yn y proses na byddwn ni'n cyrraedd at y point ble ni'n gallu llacio cyfaniaedau achos mae'r brychiad nawr yn digon yna i warchod ni i gyd o'r iwrth y coronavirus. Thank you. Your health minister didn't have the figures to hand this morning on Radio Wales but you know how many of the around 84,000 cases in Wales can be tracked back to emanating from pubs and restaurants and hospitality venues and can you just give us an indication of where you need to be over the next fortnight when you review the new restrictions for you to change the rules around pubs and restaurants and for the boos ban to to to be reversed? Where do you need to be do you think? I don't have the first set of figures but on the second point we would need to see figures coming down across Wales. We'd need to see a sustained fall in those numbers so we will be clear that the trajectory is heading down as well and we would need to see Wales in terms of the number of people falling ill with coronavirus coming more into line with the levels that are used to determine level 2 and level and tier 2 in England and in Scotland because if that were to be the case then the flow of people into our hospital system and the pressures that are currently being created there would be being mitigated but those are the sorts of things that we would need to see before we would be in a position to do anything to lessen the restrictions that we have to have in place in Wales in order to bring the virus under control to see the number of people who are dying from it decline and to allow our health service the room it needs to deal not just with coronavirus but with all the other things that we rely on it to respond to in our lives. So, mae'n jyst yn dibynnu ar y ffagarau os mae nifer o bobl sy'n dioddau o coronavirus yn Cymru yn dod lawer os mae hwnna yn digwydd mewn ffordd canoladwy, byddwn ni'n gallu dweud hwnna yn digwydd ni'n just am un dŵarnod ond ni'n gallu weld y patrymae sy'n mynd at y dyfodol a bydd rhaid i ni weld y ffagarau yma yn Cymru dod fwy yn aile ble mae'r ti'r ddau a lefel, ddau ar Albanac yn Lloigyr a ffagarau mae'n nhw'n dangos i bod yn y lefel nâ. A chos yn y lefel nâ, ni'n gallu bod yn digon hedderus bydd yn nifer o bobl sy'n marw oherwydd coronavirus yn mynd lawr ac y pwysau ar y gwasanaethau iechyd yma yn Cymru yn codi ac allwn ni fod yn hedderus bydd y gwasanaethau iechyd yn gallu ymdopi ni'n just gyda coronavirus ond gyda popeth arall i'n edrych at y gwasanaethau iechyd i roi unig id. James, thank you very much over to Will Hayward at Wales Online. Thank you First Minister and there's been widespread criticism on the new rules of hospitality but given the number of hospital admissions we're seeing and the fact it will take a week for us to see the impact of the new measures is there a risk that the Welsh Government will actually have to bring in more restrictions at its review on December 17th rather than relax the ones in place and if you do have to bring in more restrictions what would be the next things to close? Well when I stood here a week ago I was reporting to people the way in which we had more people in hospital than ever before because of coronavirus and a week later the only thing that has happened to those numbers is they've gone up relentlessly every day so while I was sure last week that we had made the right decision in principle I am even more certain today that had we not taken those actions if we were not introducing the extra restrictions controversial as they have been in some places the impact on lives and on our health service in Wales would have been beyond what we would have been able to bear. Now I hope and remain the advice that we have remains that provided we do these things now on the 17th of December we will not need to introduce further measures but as I said in my opening remarks difficult as these decisions are the Welsh Government will do the right thing not the thing that is easy and if we were to be faced with a need to do more in the future then that is what we would do we're not expecting or anticipating that that will be the case on the 17th of December. Thank you I also want to ask you about the support for businesses is there enough money for every business in Wales who is eligible to access the funds or will it be on a first come first serve basis and can you just say specifically when will this be available for people to apply and what is the deadline for application and if I could also ask the current R8 for Wales that would be great thank you. Thank you well so the money is not on a first come first serve basis the sums have been drawn together on the basis that we can provide for all 8,000 hospitality businesses in Wales and all 2,000 businesses in the supply chain from the £180 million that we have set aside for that strand in the £340 million package. So the other part of the package the £160 million people are already working to get those payments out to people this side of Christmas. We are expecting next week that Business Wales will have up on its website all the information that other businesses will need to make their application and we're expecting those applications to open early in January. I don't have in my head how long the application window will be open but I'm sure that that will be available to people next week. On the R number then as ever there are a variety of calculations of it. The one that we published in our TAC yesterday the TAC report yesterday which is the sort of consensus statement is that it's 1.1 but there are some there are some estimates we'll put it as high as 1.4. Well thank you very much over to Mike Hughes at Global. Diolch yn fawr Prif Weinidog. Can I ask you are you concerned about the public's reaction to the vaccine? What do you think it's going to take to win over those people that are sceptical about its effectiveness and what's contained in it and are you prepared to take the vaccine yourself in public to win people over? Well I think you have to divide the public into a number of different groups. There are sadly some people who we will never convince and who've become captured by those sort of conspiracy theorists of the far right and I don't think it's possible to persuade that small group of people. What we have to concentrate on are those people in the middle who will want to be sure that the vaccine is safe, who will want to be sure that the vaccine is effective and there I think we have everything that we need in terms of the evidence from the regulator, from the manufacturer and we will be working with the UK government on a common advertising campaign and information giving campaign to be able to offer those people, those people who are not against vaccination per se but just need to make sure in their own minds that they've got the information they need to come forward for this vaccine, we'll be working with other nations in the United Kingdom to make sure that that is available to them. I'm not expecting myself to be in an early priority group for the vaccine but I can absolutely assure you that as soon as the vaccine becomes available to my part of the population I will be there making sure that I get the benefit of it. Thank you very much indeed. I'm sure you're acutely aware now of the frustration among businesses in the hospitality sector given that heaven and earth appears to have been moved to allow the five days relaxed restrictions over Christmas but there's still no yet clear commitment to lifting the alcohol ban on the 17th of December.  I've got no anxieties of that sort. Might I take the decisions that I do because I know that they are the right decisions and that they will save lives here in Wales and even when the decisions are difficult so long as I can look at myself in the mirror and know that I am doing what I believe with all the evidence that we draw on and the advice that we get that I am doing and this government is doing the right thing that is what has to matter to me and not whether it is in a temporary way unpopular or that other people might take a different view. I'm keen to answer your question nobody should have an expectation that by the 17th of December all these rules are likely to be lifted. In my answer to James Williams' question I made it clear what we would need to see by the 17th of December to make any change. The numbers of people that we see suffering from coronavirus are going up every day. We will have to see that go into reverse. Not only would the numbers have to start coming down we would have to be confident that they are coming down in a reliable way and that the trajectory continues to be down and we'd have to be confident that the actions we are taking are sufficient to safeguard our health service from the sort of pressures that I reported yesterday when ambulances simply weren't able to get to people who needed their help in a timely way because of the weight of coronavirus in the system. So the 17th of December is a review day. It's one of those regular review days that we commit to throughout the coronavirus period. Nobody should read a sort of easy lesson off it that somehow on the 17th of December these restrictions are bound to be lifted. Thanks Mike Dothlodd i Adam Hale of PA. The summary of advice that you've used to justify the restrictions for hospitality while referring to other associations between hospitality infections and super spreader events don't appear to explicitly back up the specifics of the measures that you've introduced. Do you accept that to an extent that these latest rules represent a hit in hope of having the expectation of rather hitting hope than an expectation of the desired effect of lowering the R-rate? Now I think that is absolutely not the case at all. If you read the TAC report and if you read the SAGE advice of the earlier in November they are clear that tier three and level three restrictions in Scotland have been effective in turning back the virus. Level two restrictions not effective. Level three restrictions are effective. What was missing from our repertoire of restrictions to put us in line with tier two or level tier three or level three restrictions elsewhere the fact that we had the most generous set of rules in relation to hospitality? That's why we have plugged the gap. That's why it is not hit in hope at all. It is drawing directly on experience elsewhere. The advice from the most senior scientists that we have, our own chief medical officer, all of whom say this is the right thing to do. That is why we are doing it. Thank you. What is to stop currently people from areas of Wales with high levels of coronavirus piling into English towns and cities for a drink with a substantial meal? Of course, where pubs and bars remain open. Are you just relying on them doing the right thing at the moment if you are? Why couldn't that confidence in people be used to keep pubs here open to be used responsibly? Well, the law would not require people in Wales not to travel to a level two or tier two area outside Wales. The advice of the Welsh Government, the clear and ambiguous advice to people is not to do it because to do it is to add to the risks that we are already facing and those risks are already driving coronavirus rates rapidly upwards in Wales. So please don't do it. It is not good for you. It is not good for anybody you know. It is not good for the rest of the population of Wales and I think there is a very big difference myself between the idea of people getting in their cars, travelling long distances to do that when you rather than simply being able to take advantage of hospitality open on your doorstep. So that is the position. Legally, it is not preventable but in every other way it is not to be advised. Diolch, Adam. Over to Rupert Evelyn ITV. Thank you, First Minister. I join you from an Indian restaurant, contemporary Indian restaurant here in Swansea where the owner told me this morning just what a financial impact your policies are having on his business. He wanted to know quite specifically why it was that his business here has had no COVID cases connected it to it whatsoever. He understands that your policies are about protecting people from ultimately from dying but wanted to know why you are killing his business and so many others. Well, I am afraid he is simply asking the wrong question and it is a question I faced many times during the whole of this pandemic. Why are you doing this to my particular bit of the world? Why can't this happen? Why can't that open? And the answer is because collectively and cumulatively all those individual examples add up to the position that we see in Wales today. The rates of infection in Swansea went up to 357 per 100,000 in the population overnight. The positivity rate in Swansea rose as well to 22.3%. The risks of coronavirus in Swansea are absolutely real and they are more real in the BAME community than almost any other part of our society. And while there may be individual examples where people can say we haven't had a problem here, collectively the people of Swansea face a coronavirus crisis. That is why we are having to act in the way we are but that is why we have mobilised the £340 million pounds worth of help which I hope will while not compensating I know for everything that is lost when a business cannot operate will allow that business to survive through the coming weeks so that it is there to resume trading and to resume being a successful business once coronavirus conditions allow. Thank you for answering that. My second question in a sense repeats I know what you have already been asked but listening to your language around what may or may not happen on the 17th of December when you have your three weekly review everything you are saying points towards easing of restrictions being unlikely and strengthening of restrictions being more likely. Are there any scenarios as you stand there now where you think actually this particular sector might see some easing of restrictions come at the middle or later this month? Well what we will do is we will review the situation as it appears here in Wales as we come up to the 17th of December coronavirus has caught us by surprise in many ways it got worse much faster than we had expected you know I don't want to preempt it I want to be guided by the advice the science and the evidence at the time what I don't want though is for people to imagine that there is somehow an easy way in which things are likely to get better quickly and allow us to lift restrictions in Wales if the conditions allowed it to happen that is what we would do but we'll have to wait until we're closer to the 17th see the evidence then but the bar is not a low one it has to be that the figures that I am looking at and reported to you in relation to Swansea that the day on day rise that we have seen for nearly two weeks now is reversed and reversed in a sustainable reliable way thank you over to Harry Evans of the Daily Post. Prif Weinidog have you worked up any forecasts for the economic impact the new rules on hospitality will have in terms of businesses and jobs being lost? Yes of course we have those we I think they will be next week a publication by our technical advisory group which draws together a whole range of those economic indicators we had to have preliminary at least ideas of that in order to put together the package of help that we have announced this week because behind those headlines lie the sort of figures that we have had to work through in order to know how much help would be needed. Diolch and how certain you that the science you've relied on to make this decision proves that hospitality is causing the spread of the virus? Well I'm as confident as I can be because the advice we get is not just from one source it's from all the different sources that we rely on so it is the same advice that we get from the scientific advisory committee for emergencies which is a UK body which advises us and the UK government it's the same advice from our own technical advisory group so those are the scientists that we rely on here in Wales it's the same advice from our chief medical officer it's the same advice from our chief scientific officer every source of advice that we have directly available to us is telling us the same thing that we have to act in the way we have in relation to hospitality when people get together the virus spreads hospitality is designed to bring people together that's why that's why we go there is to socialise and to be with other human beings very sadly and very cruelly this virus hits us in the places where we are at our most human and it's because of that and because the advice is not just from one strand or one source but from them all that we've come to the decisions that we have. Over to Rob Taylor at rexham.com Good afternoon is it possible to get the latest on the outbreak at the hospital in rexham and given the slowness of all staff testing during the first outbreak how confident are you that a vaccine rollout to staff and patients who are eligible can be carried out swiftly? Okay thanks Rob I came with the figures on rexham this morning so overnight there are a small number of patients and staff that have been newly tested as positive they're in single figures in both cases four wards are currently closed at the miler as a result of the outbreak and measures are being taken as you know across the hospital to reduce staff and patient movement to step up staff testing and to make sure that the most stringent infection prevention and control measures are in place. In relation to the vaccine it's a it's a sensible question because the Pfizer vaccine in particular does pose some challenges in its distribution and its delivery has as you know got to be stored at below 70 degrees centigrade it can only be taken from the store for a fixed number of hours. The regulator set a minimum batch level and said that you couldn't break up a batch of the vaccine below that level so safety and effectiveness of the vaccine does have to be very carefully thought through but here in Wales we had a big exercise in the NHS only a week or so a go to test all of those things whereas confident as we can be that when the vaccine arrives and we start vaccinating on Tuesday that we will be able to deliver it to those frontline staff and those most vulnerable people who we want to get to first. Thank you I'm going back to your remarks comparing Wales to a tier three area in England in the hospitality sense. How does that stack up against the wording of your new travel regulations because those regulations refer to restricted UK areas or tier three in England? If Wales itself is effectively tier three doesn't that mean that the loosening of travel restrictions in and out shouldn't have happened? The regulations will prevent people going from Wales or coming to Wales from a tier three area in England or a level three area in Scotland. Our legal powers are such that we can regulate what happens inside Wales. When people leave Wales it is for the country that people are going to to take the actions that are necessary to prevent infection to their population. In England the government relies entirely on guidance. There are no regulations there and we are therefore acting in the same way. We are providing guidance to people in Wales not to leave Wales to go to a level two or tier two area elsewhere but its guidance or regulations prevent people from going to or from a tier three area because that's the tier that we are ourselves in Wales. Thanks Rob to Elgin Hearn at the local democracy reporting service or maybe not. We'll go to Alan Evans at Llanelli online. First Minister. Yes okay we'll go back to Elgin. We'll go to you first. Sorry about that first minister. I apologise for going back over old territory here but since you just said earlier on that effectively Wales is a tier three country okay is it fair that parts of Wales such as Powys where I'm in and north Wales and other parts of mid Wales have been treated the same way as southeast Wales where the instance rates of coronavirus are far higher. Look it's a perfectly fair question again and I've answered it before so in north Wales as you mentioned three of the six local authority areas in north Wales have worsened the position again today. No apologies that's amongst 25 year olds five of the six local authorities in north Wales the position has worsened today the position has worsened in Powys today. The reason why we are treating Wales as a single area is to protect those places because if we weren't taking the same actions in those parts of Wales where for now the virus is lower than it is in the worst affected areas all that would happen would be that those areas would catch up with everywhere else even faster. Tier two and level two restrictions in Scotland and England were found by the sage research not to be effective why would I offer people in Powys a set of protections that I know will not protect them it simply wouldn't be right and it simply wouldn't make sense and although it means that they're having to live with these restrictions a bit earlier than the numbers at the moment would suggest it will help people in Powys not to suffer the impact of the virus that we are already seeing in other parts of Wales. My second question really would be right a lot of people living close to the border are used to shopping in England and many people I know have looked forward to the end of the lockdown restriction in England which will allow them to go Christmas shopping in towns such as Shrewsbury, Hairyford or Oswr Street would you be telling these people not to go Christmas shopping in these towns this year? Well I think all three places that you mentioned are in tier two areas in England so the law in Wales will not prevent people from going there. The advice of the Welsh Government is not to do it because the further you travel and the more other people you mix with elsewhere the greater the risk you pose. This is a year to go Christmas shopping in Wales because that and close to home because in that way you can both celebrate Christmas and you can do it without posing a risk to yourself and others. Ergan dyf yn fawr i'r ffordd. Once again but finally for today to Allen Evans at Llanelli online. Y Llywydd Minister, always the bride's made never the bride in Llanelli here. We'll put that right next week.  Well Allen some of the names that you read out are people for whom I have a lot of respect and I'm always happy to engage in discussion and challenge and all all the rest of it. There are others and they were names on your list as well who I think belong in a different part of the political spectrum who are not interested in genuine dialogue who try and convince people of things that are simply not the case. So we're a democracy people are entitled to make whatever challenge they like to the government. My preference is always to engage with people where I think what they're trying to do is to make a genuine contribution to getting best decisions made here in Wales and where there are people who are genuine in that dialogue I am very keen to respond genuinely to them where I think there are people who are not interested in that sort of discussion but are simply there to try to scare people or frighten them into thinking they have a government who's not on their side then I'm afraid I won't be spending a lot of my time engaging with them. And your critics have made some points which on the surface seem quite reasonable when identifying the positives of models of dealing with a pandemic in other parts of the world. Switzerland's policies and approach have been successful the models based on individual responsibility as your mantra is really rather than prohibition and controls. How much of what is happening working in other parts of the world is being implemented here in Wales what are you taking from that? Well I think this is a complex area first of all to say we are very interested in what goes on in the rest of the world and we're very lucky with Public Health Wales it's always been an organisation with very strong international links through some very senior staff who work there and I know our own chief medical officer for example has had direct discussions with South Korea and other countries which appeared to be very successful trying to make sure we learn the lessons here. The problem is though Alan that over the course of this pandemic some countries that were thought of at some points to have had very successful replies to coronavirus have then found themselves in trouble again so various points I remember early on in the pandemic being told that we should be following South Korea that we should be following Israel both of those countries have significantly faced difficulties subsequently. I've been regularly told on the floor of the Senate by some members that we should have done what Sweden did and yet Sweden is having to take completely different measures today and yes the Swiss example is a very interesting one we should look to see what we can learn from them but then you have to think about the very different cultures that different places have and I am responsible for Wales I have to respond to the way in which people in Wales go about our daily business the extent to which people in Wales will be prepared to go along with things that people in other parts of the world go along with drawing the lessons where we can but never thinking that you can just simply drag and drop pick up what somebody else has done and make it happen here in Wales it's just sadly a bit more complicated and difficult than that. Diolch yn fawr. Thank you all very much indeed.