Let's get the obvious out of the way right out of the gates. The Tomorrow War is in no way shape or form the edge of tomorrow. The Tomorrow War stars Chris Pratt doing his best Tom Cruise impression throughout the film. Pratt is essentially the character he makes fun of in Guardians of the Galaxy constantly. He does a lot of steely-eyed looks at the camera just just a kind of a closer-up shot of him just going This is most of the movie. This movie like so many others has very lofty aspirations It's a Amazon Prime exclusive, I think. I don't know. I didn't even know existed until like two days ago I didn't see a trailer. All I saw was the cover art of Pratt again looking like he's trying to be Tom Cruise Has a very edge of tomorrow aka live-die repeat aesthetic to it The film certainly doesn't but that I think is what they were trying to go off of. The script has kind of a Terminator in reverse storyline. It's kind of clever. I mean the premise is good The premise is solid. Instead of sending someone to the past to kill someone They're sending groups of people to the future to fight in a war that's gonna take place 30 years from now From 2022 I think is when the film starts.  The script even has the audacity to point out that if they send people at certain times They will cause a paradox This whole goddamn movie's a paradox Essentially Chris Pratt gets drafted to go to the future where he's gonna see a grown-up version of his daughter Who's played by the hot chick from Chuck and Handmaid's tale Yvonne Strahovsky. I believe is how you pronounce the name She's acting her heart out here. She's crying. She's she's tough. She's independent She's a strong female lead Chris Pratt, however because he doesn't have the comedy to fall back on I think he has a hard time pulling off the drama. It could be the director. It could be the incompetent script I don't know but there's a scene early on when he meets his father Played by J.K. Simmons who's always always phenomenal But there's no music in the background and it's just these two having an intimate moment together sharing, you know past Trauma and whatever and Pratt. I'm just not buying it. He's just trying so hard to be stoic all the time Even kind of giving the cadence of the whisper talking that Cruz is known for he can't pull it off It reminded me of Brie Larson as Captain Marvel where she's just a lot of time posing and not really becoming a character She's just doing what she thinks superheroes should look and act like that's what Pratt's doing for the sci-fi Action role and we can break this down a million different ways and I know it's an action movie at the end of the day It's it's kind of a sci-fi fun, you know, nonsensical thing The problem is it's not having any fun There's there is a comic relief character He's sparsely used though and there's just no there's no real excitement or joy out of watching this type of movie It's kind of like watching two and a half hours of video game cutscenes Which I brought up previously and fast in the Furious 9 I think it's just gonna be an issue movies have going forward when we get so much reliance on CG work that we don't put anything into actual sets About puppeteering, you know character design that you can see physically Everything is just an actor in front of a green screen. So nothing has weight Nothing has emotion now if you just want two-plus hours of spectacle with bombastic music that feels awfully out of place And by the way that music the theme song is cool. I don't think it really fits here at all It's way too way too powerful It reminds me of a different movie and I can't for the life of me remember, but if you watch this film Let me know in the comments if you know a movie I'm thinking of but it came out around the 90s action film and it just has almost an identical sound to the score It bothers me that I can't think of it, but that's all I have to give you to go on There's clearly money put into this movie. There's explosions everywhere. There's a big scale to it yet Somehow it still has a massive cheapness to it all I don't know if it's just the lighting or the lack of atmosphere, but something is way off in this It feels like a movie that should be straight to DVD that's ripping off the popular version Which I guess would be edge of tomorrow This is like the the fake version of edge of tomorrow used to find at movie store rentals at the top shelf And you pick it up and it have like Casper Van Dion as the main actor No one under the age of 30 is gonna know what the hell I'm talking about But anyway, it'd be like anaconda the movie with J.Lo and then the one that went straight to DVD was Viper and Python those were the knockoffs. There was always a knockoff. This is the knockoff They just have more budget behind it and some bigger names. The action is varied though There is a lot of it. It's inconsistent as all hell of course early on these aliens I can't remember what they're called white white shooters or Nail pushers or massive inconsistencies when battling these aliens too. Some of them are bullet sponges early on They shoot this their little talon spike things constantly. They're fast They're tough to hit and then later They're just kind of like picking them off after a couple shots each the worst culprit those when they're escaping from a Lab or a hospital something and they're on the streets and they're running across these open Platforms and the heavy-set gentleman who doesn't know anything about firearms or saving himself That's fair. These are all just people regular Joe's thrown into the mix. He falls down to clearly his doom as Hundreds of aliens pour after them and Chris Pratt to be in America's heroes like whoa I got to save this guy that fell like 30 feet down into question mark area While aliens are running after us and while bombs are dropping. I need to go down there and save this guy I met like two hours ago What?  I just I couldn't wrap my mind around it I also don't understand the logic behind the people in the future.  Especially ones that don't know what they're doing at all Why wouldn't you send them back earlier in time to stop the event? It takes Chris Pratt's wife to come up with the suggestion just some regular housewife.  You have time travel Are you telling me you can come up with better weapons than the standard like AR-15s or whatever?  Those are pretty cool.  I eat that up sound design is probably the best part of the film Sound sound design. That's where we're at and JK Simmons JK Simmons is always the best part of the film though Thank you for finally allowing JK Simmons to show off his jacked body that he spent months and months training for So he could have like one minute of time in Batman v Superman and Justice League What a waste What an absolute waste Every single cliche you've seen in a movie of this type is present here You have the constant people self-sacrificing when they really don't need to like oh There's a wave of aliens coming and bombs are falling.  It's supposed to be escapism I brought up edge of tomorrow a few times because there's obvious comparisons It wants to be like that movie but that movie is fantastic I would almost consider doing a movie feuds between this film and edge of tomorrow just to you know Glow a little bit more about that film and do the comparison thing, but I don't think anybody cares about this I think I think within a week no one remembers this exists and we move on with our day the dudes doing the CG work here Must have had carte blanche to just do whatever they wanted. They're clearly having a good time There's there's scenes where there's just Thousands of aliens running up these buildings after the people and then immediately in the next scene when it's when it's cut To actual shots of actors. They're shooting like two of them for the entire time They're fighting two aliens when the shots before we're seeing tons and tons of these things They would have been overwhelmed at any second But there's just inconsistencies all over this thing CG animators told to make a chopper go flying overhead So he's like oh god. Yeah Chopper goes by and then you can see the animators like Let's do it again.  This would be fine it's just I look back in movies like Independence day which clearly have aged, but there's just such a charm to it and there's such likeable characters Characters even if they are one-dimensional and there's tons of cliches in that one, too It's done so well and with such a fun spirit to it all and with some epic lines and with with these cool Alien designs and stuff that it just all the all the like top layer bullshit just melts away And you're left with a really cool movie here. They had the concept I think the concept was sound but the lifeless dialogue the uninteresting cliched characters the Weird color palette choices the lack of any energy and momentum to the picture and the constant head-scratching Decisions with the storyline really just pull you out of the film I mean would it have been that hard for the people from the future to be like we're gonna share our Technology with you and we're gonna show you how to use time travel and stuff.  That's a big deal That's a big deal and to just gloss over it and have the audience kind of scratching their heads for so much of the film thinking like How does this make sense? What are we doing here? How is he with her right now? It's not a good. It's not a good look. It's not a good play since this movie did remind me of fast 9 the fast saga I guess I'll give it the same score. I'm gonna do 4 out of 10 alien talons Because one of the guy one of the people collects them For for reasons, I don't know Thanks for watching the video. Hope you enjoyed the rant I have plenty more on this channel along with my flagship show movie feuds where I take two movies pin them head-to-head You can find me on patreon at patreon.com slash Adam does movies. I have a second channel called Adam Olinger I'm on tiktok. I'm all over. I'm all over the place


Oh my gosh in February and And I explore alternate hair options. I have thinning hair and I'm you know going through some using some products to try to help my hair a Somewhat healthy. I am also taking a medicine for preventive for breast cancer That has some certain side effects and one of them is also thinning hair So it's a full boat of stuff that that I'm going through and that I'm dealing with with my hair So I have had a number of wig videos because I do like wearing alternate hair


What if we move forward before we go back to the drum ball for the next team and try to play cleaner football? And how tough was it, you know, the challenge today against the 49ers? They may pose different challenges, you know, kind of getting you to give you one look they've shown for weeks and then play kind of something off of it, so at the end of the day you got to learn exactly what you're doing no matter what situation or whatever formation and play cleaner football. What I'm going to do on the flight? What are you going to stew on the most? Oh, just, you know, a couple of plays I wish I had back, but at the end of the day, you know, I'm a football player, so kind of replaying the game in my head already, get on to the next week, more football to be played. How do you know if there's a chance? I mean, if there's a chance, there's a chance. I don't really care how small they are. If there's a chance, you might say they're improbable. They might say there's a chance, so we're going to keep fighting and make sure that we do our part in order to try to make the playoffs here.  In 71, the athletic dude, he does well getting out in a space on blocks. He does well getting up to the second level. I think he's a pretty athletic player and, I mean, it definitely helps them with the way they want to kind of stretch and puncture and stuff, so it's good for their scheme for sure. When you say, you know, do you kind of look at big picture? Hey, we're probably going to even win out to ensure there is... Yeah, every game at a time, you can't lose, obviously, so I wanted to take, you know, Lions obviously came off a big win this week. I've been saying, you know, they can do some a lot of stuff as long as they play clean football, they're a hell of a team, so we're going to have to come in with our best foot forward and get that W at home. Thank you.


All right, I think it is about time for us to get started. Thank you for making the track out to the event center. I know this is probably the farthest room away from the banquet hall. This is the SIG-Auth deep dive. So I'm Mike. This is Margo. Hello, I'm Margo. I'm a software engineer for VMware Tanzu. Which is part of Tanzu's authentication sack. And I'm Mike. I'm a software engineer at Google. I've been working on GK and Kubernetes for almost seven years, actually over seven years now. And I am a co-chair and TL of SIG-Auth. So this afternoon, I'm going to give you a little bit of an intro to SIG-Auth, walk through, review what we did over the last year or year and a half, and then highlight a couple enhancements that are underway that I think are interesting. And then I'm going to hand it off to Margo. She's going to walk through an implementation of a client go exec auth plugin to give you a feel of how to extend human control client authentication. And yeah, and then we'll wrap it up and go to questions. So SIG-Auth, what we do, this is our patron XKCD comic. The Kubernetes community is very inventive. They're doing a lot of cool things all the time. I consider SIG-Auth's responsibility to make sure that operators and security administrators are able to draw, I guess, guardrails around what engineers are doing. Examples of maybe auth relevant features in Kubernetes are new flags in the security context of a pod that an administrator might want to control, maybe cross namespace, PVC references, where this is the volume claim references, maybe taints and tolerations that are used for node isolation. So this is our mission statement. So SIG-Auth is responsible for features in Kubernetes that control and protect access to the API and other core components. This includes authentication and authorization, but also encompasses features like out logging and security policy. So this is on paper what the SIG-Auth mission statement is. Over the last many years that SIG-Auth has existed and been meeting, we've adopted ownership of various things that don't really fit neatly into this definition. And we can talk about those later. If you aren't aware already, there's a newly established, as of in the last year, SIG called the SIG Security, who might take over various things that have fallen on the SIG-Auth community in the past. So this is a full list of sub-projects. On the left side, these are sub-projects that are in Kubernetes Core or Codebase, so github.com, Kubernetes, Kubernetes, audit logging sub-system, all authenticators, authorizers, including RBAC, ABAC, Node Authorizer, certificates API and related infrastructure. So any entry signers or approvers for the infrastructure that Kubelet uses to do certificate rotation for both its server and client certificates. Encryption at rest, so that would be the KMS plug-in for encrypting data stored in NCD at rest. Node isolation and identity. So the authorizer and admission controller responsible for preventing cross-node escalations. Policy management, such as RBAC and also pod security admission. And anything Kubernetes service can't relate it. So out of tree, we have kind of a multi-tenancy working group. And they have kind of incubator project. Out of that incubator came the hierarchical namespace controller, which is a project that is focused on synchronizing policy across a hierarchy of namespaces. And the secret store CSI driver, which is a CSI driver that integrates with various secret stores, I think Azure, GCP, AWS, and Vault right now all have plug-ins. And they expose kind of a secrets API, but rather than having the secrets be stored in NCD, they are stored in your secret manager of choice. And coming soon, so this is a recently, I guess, currently going through induction sub-project. So the Kube RBAC proxy is a pretty widely used, popular project. And we have recently decided to make it an official Sega sub-project. Not sure if I said it, but at any point, just raise your hand if you have questions. So what have we done in the last year and a half? So pod security admission is GA in 125, which is the upcoming release of Kubernetes. We also just recently merged APR to delete pod security policy from the Kubernetes code base. So that's a huge accomplishment. Certificates API went to GA with a couple new features, specifically like signer partitioning. The exec auth plugin, which we keep control credential providers, are now GA. That's what Margot will be speaking on later. Token request is GA, and Secret Store CSI driver is GA. So looking forward, I have a couple kept stylite. The first one is going through review right now. It's something called trust anchor sets. So right now, various things like Kubernetes itself, Istio, there's a certificate manager need to have a common need to distribute certificate bundles to all pods in a cluster. Right now, the state of the art to do that is a config map, since config maps can only be referenced by pods in the same namespace as the config map, you end up synchronizing config maps like that have the same data across many namespaces, has presented a scalability issues in clusters with many namespaces because that data is stored in SCD and has to be scanned and read into QBPi server memory. So I would think of this trust anchor set as a global object so that that data can be stored once and referenced across the entire cluster. If you've ever written a dynamic web hook configuration, you also have to embed a certificate for QBPi server to establish a connection to the web hook. So these will also be referenceable, and you won't have to do that. I know that the current mechanism is gross and not super portable. It's hard to write Helm charts that have dynamic web hook configs for that reason. The next one is KMSV2. So this is the extension point that is used for encryption at rest. The current KMS extension point has been alpha for a very long time. It had over the years of working with it, a couple of issues have come up. It is hard for an administrator to understand what the storage version of a secret that might be encrypted is what key. It was encrypted at the health check right now that QBPi server does on the KMS plug-in is to do it. Encrypt, decrypt, it's not actually potentially very thorough. And there is a fundamental scalability limit with the current model because right now when QBPi server starts and it loads its secret cache, there could be 10,000 secrets, it will serially decrypt each one of those. And each one of those has to make a round trip to the KMS provider, which could be a remote service that's expensive. So this enhancement plans to solve all of these problems. And we will be introducing a V2 alpha 1 version of that KMS plug-in API that should address most of these major issues. And so as I mentioned, token requests and bound service count tokens are now GA. So I think as of 1.23, rather than getting a secret backed token in your pod, you will get a bound service count token that is rotated by the Q-blit. It's time-bound. It's audience-bound. So while that is awesome, those secrets are still, those old service count token secrets are still created, which is not a great thing. But we can't just turn off the token controller because we expect that some users are still using, taking those tokens and maybe putting them in Jenkins or have action to authenticate to the QBPi server. So we are planning on trying to stop auto creation and remove unused tokens basically by trying to detect whether those tokens are in use somewhere else. And with that, I will hand it over to Margo. Hey, everyone.  So what is a Client Go credential plugin? So it's a way for Client Go to call out to an external command to get user credentials out of band. So the plugin can implement some kind of protocol specific logic, like for example, an LDAP login or an OAuth login, and then pass back opaque credentials for Client Go to use. And by extension, QPCTL to use typically. Usually then on the server side, that requires a web hook of educator to interpret the credential to take that opaque token and make it into something meaningful for the Kubernetes API server. So when a user executes a QPCTL command, they're invoking the QPCTL binary, which is then in turn executing Client Go. Client Go takes that QPCTL command and makes a request to the Kubernetes API server based on that command. When you add a credential plugin into the mix, before you make that request to the Kubernetes API server, Client Go invokes the credential plugin, which then does some out-of-band authentication and returns a credential to Client Go. And so this is kind of a nice way to extend Kubernetes because Kubernetes can't necessarily natively support every OAuth protocol out there. There's just a lot of different ways that people do things, SAML, LDAP. And so people can bring their own out-of-band authentication and still be able to use that with Kubernetes. And so then once that credential plugin returns the credential to Client Go, it gives us this opaque token. Client Go makes the request to the Kubernetes API server, and now it has a bare token attached to that request. And then after that happens, the Kubernetes API server is typically set up with a Webhook Authenticator, or maybe an OIC Authenticator. The token itself is opaque to Kubernetes. So then Kubernetes makes this token review that the Webhook Authenticator is then waiting to see, and it sees that this token review has this bare token, and it's able to interpret the token so that the Kubernetes API server can use it for things like access control, take this user info that is now interpreted to tell us the username and use that for whatever it needs. Typically, the way this is set up is your user has a kube config, and that kube config has the exact field. And within that, it's calling some command. So this is a patch of some binary that exists on the machine. It's got an API version. It's got some arguments that are called with the command that you're calling. And then it's got some information about whether this needs to be interactive, so whether when kube CTL is invoked, it needs to be in an environment with a TTY. And it's also got an install hint. So when you call this binary, if it's not found in the user's path, it's just a little helper to tell them maybe where to go to install it. So I'm going to walk through the simple plugin now. This is based on my experience with Pindiped, the project that I work on. But it's pretty simplified. So this one is written in Go, but you don't necessarily have to write the plugin in Go because the inputs and outputs are all through standard out. So if you wanted to write a credential plugin in any other programming language, that's also totally possible. This one is going to be done using the OIDC password grant. So it's going to take the user's username and password from the CLI. And then it's going to take some information about the OIDC configuration. It's going to get an ID token, and then it's going to package it in an exact credential, which is the format that Clanko expects to see this credential so that it can send to the Kubernetes API server. So the entry point for this is just going to be a pretty simple Cobra command. So this is just a pretty common way for Go command line utilities to be created. It's going to have two flags. Both of them are going to be required in this case. And when you run this command, it's going to run this command called run OIDC login, taking those flags and passing them in as parameters to the function. Another thing that's typically part of that initialization is the Kubernetes exec info. So when Clanko invokes a plug-in, it passes some data via the Kubernetes exec info environment variable. So this data comes directly from the Qt config, and it contains stuff like information about the target cluster. So this should be useful, for example, if you have a cluster or some educator on your cluster that's looking for a specific audience, and that information is based on which cluster it's running on, then in order to allow your credential plug-in to craft the token correctly, it needs to know some information about the cluster. So another important thing to think about when you're creating one of these credential plug-ins is caching. So we need to cache credentials so you don't have to fetch the same token every single time you make a Qtctl request.  So maintaining that state somehow so you don't have to repeat yourself is pretty important. This is going to be stored on the local file system. So just like within the user's home directory, they're going to have some config.yaml file, and it's going to be keyed off of the arguments sent to the command. So in this case, it's going to be the issuer and the client ID. So if you issue the same command with the exact same arguments, you should get the same token back from your file system. So this is what we're going to do to get the file from the cache. So we're going to create this cache key based on the issuer, the client ID, and the scopes. So some of this is pretty OIDC-specific, but in any case, you want to have some way to keep track of how it was called. It's going to get the token in this cache.cat token. It's just a helper that gets it from the local file system, parses at yaml. And then if there is a value in your cache, then it's going to get it. It's going to check whether it's expired. If you have a cache, but it's been like several days or something since you've used it, then you want to make sure that you're not just passing back this out-of-date cache token just because you have a value in the cache. So you're doing that check. And then if that's the case, then we're good. We don't need to redo a network request to your OIDC identity provider, or in the case of a different identity provider than that out-of-band authentication either. And then at the end, if you did have to get a new token, then we'll come back to that. But at the end, you can put the token back at the cache key so that the next time the process is invoked, you can get it back out, and you don't have to do it all over again. Another important thing that you may need to do as part of a credential plugin is reading information from standard in. So maybe use my name and password. So if you do want to read from standard in, you can set the interactive mode in your Kube config. So that can be to if available or always. In the case of always, if you do not have a TTY available and these are not going to be able to type something into standard in, then the Kube CTL command will immediately fail, and it won't even try to invoke the plugin. If you don't want to do interactive mode, there's other ways you can get some information from a file or from environment variables. So there are other ways that you can have one of these plugins that don't involve interaction. So I'm going to actually try to do this in my IDE. So bear with me while I try to switch into GoLand, sort of. We had technical difficulties with this before the talk, so. Yeah, we tried to figure it all out, but. Yeah. All right, I feel less bad now. There we go. OK. Figure font. All right, cool. Yeah, perfect. Zoom in. Yeah. Even better, Command Plus, maybe? Sorry. I don't know why Command Plus isn't operating like I expected to. So is this, I could try to, if this is super unreadable, try to do it via. We should have caught this before. Yeah. Command Shift S? No. Close. Do you want to just talk through it verbously? Yeah, sure. I could just, yeah, try to keep it. So this getUserNameAndPassword function is, in this case, it's for OIDC password grant, so it's going to take these values, and then it's going to pass them to an OIDC identity provider that's going to give us a token back with some information about the user. This function actually works both in interactive and non-interactive environments, so there's a way to get it from an environment variable. For example, if you have some machine identity and you're trying to run something in your CI system and you want your server's account to authenticate, you can just pass these environment variables through. But if you have a human user who's just trying to log in, then we're going to prompt them for value. So that here is, it's getting, calling OS.getN under the hood, and then it's running this prompt for value there with me because this is a little bit indirect for testing reasons. So we can do dependency injection. But the actual implementation here is this prompt for value function is first checking whether we have a terminal. It's printing out a prompt saying, like, enter your username here, basically. And then it's creating a channel with the result of the user typing in their username. And then in this separate process, it's waiting here for the user to type your username and then press Enter. And then it's passing it back to that channel. And at the end of that, it's just going to trim spaces and return the value once it gets that result. There is a little bit of a different way that you have to handle passwords from usernames. You can imagine people, when they're typing their username, they want to see it as they're typing it. But that's not what you want for passwords. You want that to be hidden as you're typing it. You don't want to just see your password in plain text as you're writing it. And there's actually a built-in Go Standard library function called readPassword that hides local echo so that you don't have that displayed as you're typing it. And other than that, it's kind of similar. Time check. I'm going to attempt going back to Firefox. Command Shift F. And then hit Slide Show. Beautiful. All right. Yeah. And then the last step here is we're going to package the token into an exact credential, which is the format expected by Client Go. This is using Client Go's libraries because it's in Go Lang, which is pretty handy. We take that token that we get back, which I'm kind of going to hand wave over because that's pretty specific to OIDC. And you'd do that differently if you were using a different type of auth. But yeah, so you take that, and then you serialize it and send it to standard out. And Client Go can then do all that stuff to send it to the APS over. Awesome. Thank you, Margo. So yeah, I wanted to do one more highlight. So while what Margo just talked about is a GA feature of Kubernetes, we actually have some future plans for it. This is the last highlight. So Client Exec Proxy Auth is currently a proposal. That is under review. It allows for richer support for authentication protocols, such as request signing protocols, for example, AWS before, or Kerberos. And I kind of think of it as the kind of part of authenticating proxies, which is a model for extending Kubernetes authentication that some users use. And that concludes our content. So these slides will be posted on the website, if you guys want to click through on any of the links that you saw. But so we have a Slack channel. If you want to get ahold of us, Sigoth, we meet every two weeks, Wednesday, 11 Pacific time. We have a mailing list that you can join and a really long agenda doc. Feel free to drop an agenda item on at any time. Join our meeting. We love having new people and a lot of exciting stuff going on. So with that, I think we have five minutes for questions. Can you hear me now? Yep. All right. So one question about the credentials authentication. So I've been using it for a while now. But I've been experiencing issues when it comes to the authentication failing. So in my case, I'm using another CLI in the background to grab the token and Azure CLI in this case. And when the Azure CLI needs to be authenticated, you need to do that out of band. And this means that if I do fail this binary, the client executable will try to run it multiple times. So it will try to run five, six times in a row. And there is no way to tell it that you shouldn't retry. You should just stop and wait. Do you understand the question? Yeah. I think I recall this GitHub issue. So the idea was initially to on 401 to re-exec the plug-in. And keeping track of multiple clients within a process has been a problem. But yeah, basically, we try to fix those as we find them, like people creating two clients with two authenticators. But sometimes those re-creep in. And we haven't figured out a holistic solution for it yet. So just follow GitHub issues. And yeah. All right. Thank you. Any other questions? Kevill. Hi. Thanks for the good talk. I have a question about the trust anchor sets and kind of like a high-level question. So I understand that this is also going to be used to distribute CAs for TLS between workloads. So I'm kind of interested why does it make sense to include this entry? And like in general, how do you maybe decide? Because for upstream, there wasn't really functionality that much in upstream for workload. TLS, I'm interested whether you already have a model for which bits it makes sense to include entry and what should be out of three and why? Yeah. So that's a great question. So I think if we were trying to accomplish this for just, for example, like cert manager, maybe a CSI driver makes sense because then somebody can accomplish that out of three. I think my main motivation for implementing stuff within the Kubernetes code base is one to make use of it in core Kubernetes. So we have cert bundles that we are distributing to every single namespace. And that does present a scalability issue with Kubernetes itself. So that motivates me to have an entry. Also for an entry API to reference it, it really needs to be at least the API defined within the Kubernetes core code base. So yeah, so I guess at a high level, if we want to use it from core API groups or for core functionality of Kubernetes, we usually try to implement an entry. And then otherwise, definitely prototype outside until we find some rationale to bring it in. Maybe the other motivation might be if everybody in the world is using a specific out of three thing, then it probably makes sense to bring an entry. Yeah. Hey, thank you for the nice presentation and the demo. I'm very excited about that because I'm working on something similar at the moment for 2FA especially because that's something also a little bit, finicky topic on the command line usually. Do you have a repo or some docs available somewhere with this kind of sample code that you just showed? Like also the whole workflow with both on the client side and then also the server side, maybe what needs to be done there and what needs to be set up? So a lot of the client side code is taken from the project that I work on, which is PIDAPED, although I should warn you there's a lot of other complicated stuff that's hidden away there. I don't know if you have a better answer for some of the sample of a web hook authenticator and that side of things. So that link on the bottom is the cap. It's actually fairly thorough documentation on the design of these plugins and how we expect them to work. I think we should probably also add to this slide a link to the code that you walked through, which is on GitHub. And then we will post these slides on the schedule after this. So yeah, one other. OK, we're out of time. So if you have other questions, just come grab me. I'll be right outside. Awesome, thank you so much, everyone.


Now I'm excited about this next one. Please help me welcome Professor Panish Puranam from INSEAD. In a distributed virtual or asynchronous environment, learning takes on new importance and new challenges. Any parent, student, or instructor who was involved with the sudden shift to remote learning in 2020 certainly saw firsthand what that really means. But what about organizational learning? What lessons can we take from the past year and how can we use this experience to create better learning environments? Panish is a leading expert in organizational science with new research to share. This talk will explore how to excel at distributed learning by not just addressing its challenges, but also seizing its opportunities. Hi, my name is Panish Puranam, and I'm here to talk to you about organizational learning in the age of distributed work. I'm a professor at INSEAD and I hold the Roland Burger Chair in Strategy and Organization Design at INSEAD. I've been working there for about a decade now before which I was also at London Business School, also for about a decade after getting my PhD at the Wharton School. I've been actively involved in doctoral program supervision both at London Business School and at INSEAD. My broad areas of interest are around organizational design, and as you might imagine, the great organizational design experiment that all of us have been through since the beginning of the pandemic last year has been an opportunity both to cope with personal disruption and difficulty, but also as a source of interest to learn what we can about this extraordinary experiment and remote working that has been affecting the organization designs of companies all over the world. And that's what my collaborators and I have been working on for the last 18 months or so. The kind of work I do is not possible without collaborators. And I think it's a good point to stop and acknowledge some of them, all of them in fact, who are associated with the topic of distributed work. And you'll notice two things from this panel of collaborators that I'm showing you here. They're themselves highly distributed. So a few of them are here on the island of Singapore with me, but many of them are not. Some are in the US and many are in Europe. So we kind of live our own work in the sense we're all working on distributed work of various kinds, but we're doing it in a distributed way. And this team has been working on software development using distributed models, much like our friends at GitLab do, open source communities as well, and innovation contests. So these are all different forms of collaboration where people are not co-located. And that's been the theme of the lot of the work that we have been doing as a team for several years now. In fact, our engagement with GitLab precedes the COVID shock. So some of us on this page were actually working on developing a case to understand how an all remote organization like GitLab might work. And we started work on that a good six months before the pandemic hit. So in some sense we were missing it. Now, when people talk about remote collaboration, and very often I think these are the two extremes that people might have in mind. So on one end is the case of all remote where everybody is off working in their own little isolated unit. And the contrast is that of everybody being co-located and in one space. And maybe the picture on the left is a bit of an exaggeration because even before the pandemic of course what was much more common was not everybody in one location but clusters of people in different locations. So that for instance would have been the typical organizational design if you like of a multinational company or even a national company which was regionally distributed in different parts of a country. What I'm convinced about having observed everything I have over the last year and a half is that these extreme cases where everybody's all remote or everybody's in one location, they are not going to be the model that most of us will employ. So most of us are going to live somewhere in the middle and that could be something like the picture here where we have clusters of people or it could be something a bit more like teleworking or it could even be something that looks like the picture on the right here but is changing over time. By which I mean different people come into work on different days or we even change the sets of people who see each other face to face by rotating through who comes into work face to face and who does not. So there's an entire space of possibilities between these two extremes of all located in one place or all remote. And I think for most of us the action is going to be about finding and tuning the distributed work model that is just right for you. That's really the core point that I want to make in this talk that we want to think about the organizational design challenge going ahead not as how do we transition everybody to this model or how do we go back as quickly as possible to that one but how do we find the right spot for you in the spectrum of distributed working? So it's really about understanding the distribution in statistical terms of distributed working. So that's why I call this the distribution of distribution and finding out where in that distribution you want to rely. So locating that point and tuning yourself to be on that point using data is really going to be the core point that I want to make. Now some of my arguments are going to draw on the research I've done but some will also come from the research others have done as well as my observations as an educator. So INSEAD in that sense is a very unusual organization because we were very distributed much before the pandemic ever hit. So as you might know it's one of the few global business schools in the world which really has global footprint. So we have offices in Singapore, in France in Abu Dhabi and in San Francisco now. So we've been working remotely for a long time and when I was running the PhD program people would ask me from our peer schools how can you run a doctoral program in a remote collaboration model? And the answer is well we figured out how to do it because our doctoral students were absolutely world class and were being placed in the top universities around the world as professors. So we know a thing or two about working in a distributed fashion even at the institutional level but the big push going forward as I said is to help develop tools and ideas that can help any organization figure out exactly where in this distribution of distribution is the right spot for them. When the pandemic hit last year one of the first things that we decided to do in our research team was to dig a bit deeper into exactly how the first responses were shaping up around the world to this pandemic. So in a survey that I conducted along with my collaborator Marco Minermini who's here at INSEAD as a postdoc we ended up surveying close to a thousand people from around the world. Mostly INSEAD alumni and people who look like INSEAD alumni by which I mean people working in consulting or in banking or in senior managerial positions mostly knowledge work but from all around the world. And we discovered a few very interesting things and this was very early in the pandemic somewhere around March or April last year and we learned that here's a pretty systematic bunch of correlates of self-reported productivity. Okay, perhaps the high level message to emphasize here is that the hierarchical level of our respondent and the previous experience of working remotely were much more important in predicting whether they would be productive or not in distributed working models. Then the industry they were in the company size that they were working in or even the nature of work. And that was quite surprising for many people because most people thought there must be huge industry differences. So some industries are gonna get hit very hard and some not so much. The reality actually was that once you get past a couple of layers in the managerial hierarchy, right? It really doesn't matter whether you're in healthcare transportation or consulting or research. Once you are a few levels above the direct contact point with either the customer or with a supply chain or with some other external entity. Then we're talking about managers. Management is knowledge work and knowledge work looks roughly the same across different industries. So we found for instance that being higher in the hierarchy was correlated with more self-reported productivity. Having previous work experience in working remotely was correlated with higher productivity. Better work-life balance which was accomplished because of working remotely was correlated with higher self-reported productivity. And of course the big one avoiding commuting that was correlated with higher productivity as well. So what acted as a drag on productivity in this distributed world that was forced on us after the pandemic? First missing social interaction. So this was extremely important and very repeatedly emphasized to us in our survey that one of the big downsides of this new way of working was the missing out on the social interaction that people took for granted. And the other which actually is a very unequal affliction in the sense it doesn't affect everybody the same is the extent to which you are beset by distractions at home. And here there's a worrying factor to keep in mind that distributed working might actually accentuate some of the pre-existing inequality. So people who don't have a large home or who don't have enough space or who don't have the capacity to hire help to take care of their children for instance have to take primary responsibility in these roles. And in many cases this falls unfairly heavily on women rather than on men. Then distributed working can actually be a force that accentuates inequality rather than democratizes the workplace. And as I already mentioned, the surprising thing is neither the industry nor the company size or the nature of work were able to predict variations in self-reported productivity. So just to sum up, where we are today is the following. We now understand I think with a fair degree of confidence what the trade-offs are to distributed working. The big positive of course that we all learned about and have found quite heady and addictive almost is flexibility. We want to discover that we can be just as productive as before or sometimes even more but with significantly more flexibility in how we allocate our time when we do what we are supposed to do and exactly how we balance our work and our life and that's been great for most people. The idea that by being distributed one can expand enormously the talent market that one can access is of course not new. This was well known even in the world of offshore software development two decades ago or in offshoring and outsourcing 15 years ago but the distributed working of the last year and a half has really made that very salient for everybody. Even in my world I'm getting internship requests from students all around the world every year and I used to get them before but I never took them very seriously because I was implicitly worried about how would I supervise them, would they do a good job, would I be able to monitor them but now I can't do any of those things even for interns who are in Singapore. So once that constraint was relaxed of course I'm thinking why can't I use the smartest kids from anywhere in the world who want to spend a month working for me on a research project so that's what I'm doing. The unstated advantage which I think requires thinking a little bit about is sustainability and perhaps you've made the connection in your mind perhaps you've not but there's a TEDx talk that I gave relatively recently that you might want to look up where I make the argument, a very simple argument that if you just look at the impact on the environment that working from home has had it's going to be very difficult to go back after the pandemic to a world where we assume the default is lots of commuting and lots of business traffic that just will not cut it. Our impact on the environment in terms of carbon emissions through commuting and business travel is not trivial just to give you a rough back of the envelope type calculation. If you travel 10 miles each way, five days a week. You're adding about four tons per annum of carbon to the environment and just to put that in perspective that's roughly between a third to a half of total carbon emissions for a person living in Western Europe or the United States. So that's just the commute. Now through in a long distance business journey something like between our campuses in Singapore and France which I do routinely or used to do routinely about three to four times a year and you could end up with the same magnitude of carbon footprint as that commute that you were doing throughout the year. So this is significant. So even if we had no other reasons such as cutting down on real estate costs or improving flexibility for employees or talent market access just improving our footprint on the environment and pushing the sustainability agenda suggests that distributed working is here to stay. There's no real way to get away from that. Now there are downsides and I think we've all begun thinking harder about them in the last few months I should say. Firstly, what's distributed working going to do to learning? Can people learn as well in distributed environments? And this is both learning in classrooms like we do in NCI but also within organizations and at the hybrid junction of the two when we have execs come to our classrooms for instance in our exec at program settings here. What does distributed working do for creativity? It's one thing to execute on fairly standardized organized work in a completely distributed environment but what about when groups have to come up with new solutions and new creative ways of solving a problem? Is that still possible in a distributed work environment? What's going to happen to our organizational culture and our networks? And this is really a very important point to underline which is in some sense the last year and a half we've all been drawing down on the stock of our culture and networks that we built up when we used to work face to face. Think of it like money in the bank. So we've been drawing it down over the last year and a half with very few opportunities for putting anything back in. And that means at some point we might run out. So this is really a problem going forward if you're going to bring people on board who've never met each other and who will continue to work with each other without necessarily meeting each other face to face for long periods of time. So how do we manage that? And there have been great strides made on this by different organizations over the last couple of years but GitLab has been doing this for even longer which is to think about onboarding people and building a culture on a completely online context. And I'll talk a little bit about that as well. There's also some work I want to shout out here which is in management science which appeared a couple of years ago where a collaborator Julian Clemore and I worked on this idea of the formal structure in most organizations really playing a very important role in being a random encounter generator. What I mean by that is that a big role of the organization design is not just determining who sits next to whom and who reports with whom or who reports to whom but also about creating opportunities for spontaneous unanticipated interactions between people in different parts of the organization. So think about meetings, think about the water cooler, think about the lift lobby and of course think about the annual picnic. So many of these events are really designed to create random encounters between people and that is so crucial because very often innovation comes when people who were not meant to be talking to each other end up talking to each other. So let me talk a little bit about what we know about the impact of distributed working in particular on learning and creativity. This has been a very important question for us not just because we know it matters for organizations but it's very important even in the work we do. As academics we are trying to work as a team to learn something about the world and be creative as we're doing it and we've had to rely very extensively on distributed working because we had no choice and so it became partly a self-interest driven process of trying to answer questions about learning and creativity but here's what we've been spending our time on over the last year. We're trying to answer the question does restricting social interactions which is obviously one of the negative consequences of being distributed. Does that suppress creativity and learning and by how much and why? And the intuition is pretty clear. One assumes that being able to interact rapidly in real time and with sufficient bandwidth in terms of getting all the signals not just of the words but also the body language and the facial expression. All of that goes into the process of coming up with creative new ideas and learning from experience that groups routinely engage in whether we are talking about contexts which are within a company or within a classroom. So the question is if you were to impose restrictions on social interaction, the simplest form of restriction just might be that you can only work through Zoom as we are doing now or some format like that. A more complex form of restriction might be that you don't even use cameras. You work mostly asynchronously. So people contribute to a knowledge product at different times from different places in the world. So there's very little direct real time interaction. That's for instance very common in open source software development. That's also a big part of how our friends at GitLab work. So that could be a different way of thinking about restricting social interaction. So these are different ways in which social interaction gets curtailed once we have to work in a distributed fashion. And the naive intuition might be that we try to minimize that restriction as much as possible. In other words, if we could, we'd all use virtual reality and holograms so that we could completely simulate being in each other's physical presence. That's my intuition. And what we wanted to do with this research was to push that and ask, is that really true? Does restriction necessarily suppress creativity and work? So here's what we did. We looked at a contest that you might have heard about called Kaggle. So Kaggle is a data scientist's dream in the sense that what we have in this is a contest platform where companies and individuals can post their data and teams of individuals from all around the world will compete to try and find the patterns in the data using machine learning algorithms. So what we did was we essentially got hold of the data on literally tens of thousands of teams and individuals who participate in these contests and did one simple statistical trick. We compared real teams in Kaggle, which are groups of people who work together as a team to solve a problem with what we call synthetic teams. So these synthetic teams are composed of individuals, each of whom looks like a statistical twin of an individual in the real team. So that's the advantage of Kaggle. There are people contesting in these competitions as teams, but also as individuals. So for every real team, we could find a statistical twin, in other words, somebody who looks statistically like this individual and created a synthetic team. So the synthetic team is actually just a bunch of individuals competing in these contests who have no social interaction with each other and they don't even know of the existence of the other, which is obvious because they didn't compete as a group. They were competing as individuals, but we could run this experiment essentially of comparing these real teams to these synthetic teams. And because Kaggle is such a well-structured problem domain where creativity and learning are fully measurable because you're literally looking at groups of people trying to solve a hard technical problem so we can measure how creative and how successful they've been. We can measure how much they learned. We can measure how effective their learning was. Everything is available data-wise and at enormous scale. So we're talking about really tens of thousands of teams. So this is big data brought to bear to organization design, a theme that I'll come back to. And what we found here in this work with Marco Minervini and Tia Nuhay at NCL, is the following. When you move from a real team to a synthetic team, you get less effort, which means social interaction is probably a big driver of motivation. So people do get motivated through the social interactions they experience with each other, which is hard to replicate in distributed work, not impossible, but harder. But on the other hand, they actually get more variety in their solutions. So that's really surprising, right? Because what it says is restricting social interaction might actually make groups more creative, not less. Even though the resulting groups where you restrict social interaction might not work as hard because they feel less motivated. So that's an interesting trade-off. And of course, the advantage of something like Kaggle is we have so much data. It's very natural in a context where people are competing for high stakes. So it is about the real world, but we don't have control. By which I mean, we cannot really account for the possibility that the people who compete as real teams are just different from the people who compete as individuals. Now we try to make them as similar as possible using the statistical matching methodology, but we can only match on the things we observe. We can't match on the things we can't observe. So there is a limit to how much we can make these two things comparable. And one way to get around that is to instead use a technique which probably many of you are familiar with as A-B testing. But in the world of academia, we call these randomized control trials. So what we did was essentially create an A-B test in which we're able to contrast teams of people who are put into these two different structures and they're engaged in a creative problem-solving task. So this is research with the same team, Tia Nuhay, Marco Minervini, and also ads Professor Jay Narayanan from NUS here in Singapore. And we ran this with both undergrad students as well as senior managers on training programs at NCI. So it's really spanning the range of relatively inexperienced entrance to the labor market to fairly senior, sophisticated people who have been working both remotely and face-to-face in senior roles for a long time. And here the experiment was to compare how groups which were randomly put into these two structures did in terms of creativity and in terms of the problem-solving they engage in. So on the left, we have a structure which one might think of as a Slack-based team. So I'm putting Slack in quotes because it doesn't have to be Slack. It could be Microsoft Teams or it could be GitHub or even any other product like that where essentially everybody can communicate with everybody else and leaves a complete written record of the conversation. So these are essentially like Slack channels. That's why we call these Slack-based teams. And on the right, we have teams which have the same authority structure as the one on the left.  But the difference is that here the subordinates cannot directly communicate with each other. Instead, there's a series of dyadic exchanges more like an email-based team where the leader is communicating dyadically with every team member. So in some sense, pre-pandemic, most organizations which had not yet adopted techniques like Slack or Microsoft Teams looked like this. And post-pandemic, because of the opportunities created by the adoption of technologies like Slack or like Microsoft Teams, many more teams now look like this. So again, the question is, is there a difference between the two? Because the one on the left has unrestricted social interaction. The one on the right restricts it. It's kind of a Harvard-spoke system where everything has to go through the leader. And that can create silos and bottlenecks as we understand them. But the question really was, would it have an effect on creativity? And we found quite remarkably the same pattern that we had before. So as you move to these email teams or if you compare these Slack teams to the email teams, what you get is less integration of ideas. So the ideas tend to be a lot of unique kind of bundles with very little coherence across them. This is an idea formation task we put them in. But you get a lot more variety. Again, the same surprising result, which is when you put restrictions on social interaction, far from dampening creativity, it actually seems to increase the variation and the variety of ideas that people come up with. Even though of course this is not entirely free of cost. When we looked at Kaggle, what we found is that teams without social interaction worked a little less hard. So they just put in less effort because they were less motivated. And in this context we found that the email teams, which were essentially working in a hub and spoke system without complete transparent communication among themselves, were producing ideas that on aggregate were less integrated. Because in some sense, the entire burden of integration fell on the leader, whereas everybody was doing it on the structures in the lab. But they were producing more varied and diverse ideas. In other words, they were being in some sense more creative. So what's going on? Why do we get this surprising result? The answer lies in a very old idea in social psychology, which needs to be very widely known and appreciated, in my view, given what we can do today in terms of tuning our organization designs to work remotely. Here's the point. The challenge is something called the Curse of Conformity. And you might be familiar with this in the guise of the line experiment or the ash experiment, but it dates back to the 1950s. And what you see here is an experiment where a group of people are looking at a screen and they're actually looking at the screen that we see on the right. And the question being asked is, which line is the same length as the line on the left? Now, looking at it, it's pretty obvious that it's line A, right? But people would systematically end up saying it's B. So how could you get this insane result where people would say, in fact, B is like the line on the left when it's so obvious to us looking at this that it's actually A? There's no visual illusion here, right? So we're not trying to play with your visual system or your optics in any way. What's going on here is a purely social phenomenon. There was one person in this group that you look at here who's the real subject of this study. The rest are confederates of the experimenter. And what these confederates are saying is telling this one real individual who's actually the subject that we think the answer is B. So for that one individual to defy the crowd and go with their own private opinion that in fact it's A is quite hard. So effectively, what the two experiments that I just discussed and described to you are telling us is that in the world of distributed work, we might lose out on social interaction and that might come with some real costs, no doubt. But it might carry the silver lining of releasing some of the pressure of conformity, which might allow our groups to become in some sense more creative because of the social restrictions that we are placing on interaction between them. So does restricting social interaction suppress creativity and learning? Our answer at this point is not always. We can use the restrictions posed by distributed work to tune up the variation in ideas that we would normally get just by having people all located at one setting. And the point about tuning I think is really important because when we work in a distributed way because we're all working electronically, the tuning of the social system is actually a lot more feasible than one could do if everybody is face to face. Imagine how weird it would be to tell people in the same office to not meet each other when they are in the ideation phase, right? This is not news. People knew about this from the literature on brainstorming a long time ago, that in the early ideation phase, it's better to work quietly and silently. But that comes hard for us. We are social creatures. If you put us in a room, the temptation is to talk, the temptation is to chat and that's what makes us human. But it also acts as a source of potential conformity that might restrict the variation in the ideas we come up with when we are in that social group. There is a point in time that we want to switch to that social group which is around execution, which is around converging on one among several creative ideas. But at the ideation stage, actually we can use the restrictions that distributed work offers us to tune up the variation in ideas. That's really the core and I think somewhat surprising result of what we'll be doing. So to wrap it up, if you think back to this point I made about the distribution of distribution that the world is not just going to end up after the pandemic being either here or here, but it's really about finding the point in the middle which is exactly right for us. Then it's finding and tuning the distributed work model that's right for you. I think that's going to be where the action for the future of work and organization design, that's where it's going to lie in the next coming few years and months. To help with that process, I also want to share with you a resource which is a book on organizational analytics. This is a free book which is available for free download from the link I show you here, written by Julian Clemore at Stanford University. And what we do is we try to give a guide to data-driven organization design which allows anybody, even with somebody with zero background in data science to understand what the opportunities are to use data, for instance, from networks, for from surveys, from sources like Glassdoor, which are fantastic sources of data about the culture of an organization because employees like to use from running AB tests. So this is really where the frontiers of data-driven organization design are. And our goal is to bring any reader, regardless of prior background knowledge of statistics of these techniques to the forefront of thinking about how to use these different techniques, particularly to tune their own organizations and their organization designs. Let me conclude by pointing out that we are sitting at a particularly unique point in the history of thinking about organizations. And that unique point comes in some measure because of the pandemic and the force move to distribution. Why do I say that? Historically, the kind of data we had to rely on for organizational design and development was restricted to non-scalable data. By which I mean, you could run some surveys, but it's very hard to get high response rates. You could interview people, but that's even harder to scale. But now, because over the last year, we've all been working remotely in various degrees, it's meant we've been working electronically. And that's left an enormous digital exhaust, if you like, of data on networks, of text, of interaction, of video, which using the right guidelines, both for data privacy and protection, with the right kind of filters, the right kind of aggregation, the right kind of anonymization, is really opening up a goldmine of opportunities for how to do data-driven organization design. That's where I think the future of work is headed, and that's where I think working remotely is nudging us towards moving going forward. Thanks very much. I hope you enjoyed listening. There are a few other resources which are available through our slides here, which I welcome you to take a look at. In particular, at NCAD, I want to point out the work of my colleague, Professor Ithaista, who's developed a fantastic teaching experience based on virtual reality. Again, this was before the pandemic hit us, but as you can imagine, this has become of great interest now, where he's developed entire courses, entire cases that people can take in virtual settings from anywhere in the world. And here are a few other resources that you might find useful that you can click through. And I hope you enjoy the rest of the conference.


I think we'll start this out with the demo.  I'm going to drive him in the clouds.  We might be wrong. We're funny, but it's not always a challenge. You know what I mean. Good video, folks. Actually, it's just an introduction to punishment. A few things I want you to worry about. Basically, well, no, it's punishment. So I want you to worry about everything. This is one of those hot topics in the field. People are like, oh, don't use punishment. Oh, no, no, no, no. There are all sorts of things about punishment. There's some misconceptions about punishment. There's some non-misconcept. There's some genuine concerns. So obviously, we're going to do quite a few videos on them just to make sure that you understand what's going on and how to understand the concept of punishment and the different types of punishment and under what conditions it's useful and some of the things we want to watch out for. So again, this is just kind of an introduction to the topic. So let's just go over a few things. I'm really worried about me stomping on this thing because it might get punished. In other words, my behavior of stomping might actually be reduced as I start to feel this thing wiggle underneath me. It doesn't feel completely safe. But that's OK. We'll pretty much do anything here for making the point about what punishment or anything is as far as behavior analysis goes. So, all right, so punishment. Here we go. The contingent application or removal of a stimulus that results in the reduction of a response. So in the future, of course. So this contingency stuff, when we talk about it, it's always about future behavior. It's never about something in the past. Sometimes that confuses folks. So one of the things we need to remember with punishment is going to reduce behavior. That's what it is.  If I crack you on the bum and you say, ha, ha, ha, ha, that was fun, probably not a punishment. You have to look and see. You have to find out, is the behavior reducing? And there's all sorts of different types of punishment. We know that there's tons of them. And you know most of them, that's a punishment. Could be a punishment. So adding a spanking is a type of punishment. Taking something away from someone to reduce a behavior, that's punishment as well. So you got positive punishment. You got negative punishment. So it follows the pattern with reinforcement as well. So positive and negative in the world of punishment is more about, it is about adding something. It's not about moral value or subtracting something. It's not about moral value. So it's not positive and negative as in good and bad. It's in mathematical. Added or removed. It's that simple. So positive punishment, something's been added to reduce a behavior. Negative punishment, something's been removed. Yeah, removed to reduce a behavior. One more quick little, maybe two more. I don't know. We'll see where I get with this. Another thing to talk about with regard to punishment is to think of it as suppression. You see, when I, my hands do this for reasons because it prompts me to remind myself that punishment is really suppression. It pushes down on that behavior. It holds it down for a little while. As long as the contingency operating or maintaining or as long as the contingency delivering the punishers is in place. When you remove that contingency, when you remove the punisher, if you will, guess what's going to happen to the behavior? It's going to pop right back up. Punishment isn't like extinction. Extinction tends to have a more lasting effect on behavior. Once the behave is gone, it tends to be that way. You can get your spontaneous recovery and all that. I get it. But it tends to be more permanent. Punishment is definitely not. In fact, what often happens with punishment is a discriminated punishment, a situation where you learn that in this context, in this context alone, that particular behavior is going to be punished. We've got tons of examples of this over time. If you think about, if I'm driving fast, I tend to drive a little bit faster than probably what I should. But it's a discriminated situation. I know that behavior is going to be punished if there's the presence of a police officer, most likely. So it doesn't seem to control my behavior, though. So maybe if I see a cop or see what I think is a cop, then maybe I will reduce my behavior of speeding. But not too often. It doesn't seem to have that much of an effect. And anyway, what is the police officer pulling you over? And let's take it the full length.  Is it positive punishment or negative punishment? Well, I would probably argue it's negative punishment. You're going, what? You've added a ticket to your crazy man. No, I'm not crazy. The ticket itself doesn't do anything. It's the loss of money that's associated with a ticket. It's the loss of money that's associated with the insurance that goes up. So I think that a ticket is ideally really working on a negative punishment procedure. At least that's what the hypothesis would be when the cop's pulling you over. He's like, don't do that again. They're even telling you, don't do that again. Reduce your behavior. We don't want you to engage in it. You're going to hurt someone. I've also argued that maybe getting pulled over is a positive punishment, too. How? Because it's kind of embarrassing. You're adding this, hey, Ryan's been pulled off on the side of the road. Here you go. So anyway, keep in mind that we have punishment. We've got a couple of different types, the positive negative punishment. And it's really about suppression, folks. We're really just holding that behavior down. It happens very sensitively in terms of a discrimination. So you end up discriminating when that punisher is going to be in place. So it's not a real good tool to control a lot of behavior. We always like to focus on reinforcement. One more real big point as to why. Punishers do not teach a new response.  If I'm not teaching you what to do, then I'm not being a good behavior analyst. See you.


KB you are not new to the Pro Bowl but you are new to the Pro Bowl in Las Vegas. Being here having this experience, what's it been like so far? It's been awesome. Super excited by the practice today with some of the guys and honestly just being around some of the best players in the league talking to those guys. Not necessarily picking their brains but just talking having different conversations. It's been awesome. The fans are great so just excited to be here. There's a big group of Titans here between the coaching staff and also three other Titans teammates of yours. They've never been to the Pro Bowl before so what do you tell them about this experience and what to expect and how to really take advantage of it? Yeah well you know our biggest thing with the Titans is you know effort and finish. I pretty much told them in the Pro Bowl don't be too concerned about the effort and finish you know I'm saying we're out here having a good time but no it feels like home honestly.  Like I said just excited especially excited to have you know Jeff Harold and Roger be able to come down here with me as well. Does this really feel like it's the cherry on top of what was an excellent season for the Tennessee Titans in 2021? Yeah for sure I mean obviously the season didn't end the way we wanted to. I mean it's pretty much the same thing for all. It's going to be 31 teams. It's going to have the same type of feeling at the end of the year but having a little bit of time to reflect is definitely a great you know time to be able to kind of think about the good year having like I said talking to other players that I've been around. See how good of a season we've had so it's definitely a cherry on top for sure. You're with guys like Jeffrey Simmons and Harold Landry who are younger guys. Do you feel like this is just one of many Pro Bowls that those two are going to be at? Oh absolutely. I know for a fact Jeff and Harold and obviously I mean Roger finally getting his pro but not which is great but Jeff and Harold they'll come to multiple Pro Bowls so I'm super excited about that and hopefully I'll be coming to multiple with them as well so hopefully we can make this every year thing to get voted in but not playing because we're playing in the Super Bowl. Are we keeping these shades on for the entirety of the week like are these a staple because I'm really enjoying them. Yeah I might keep these on all day all night. We might hit the strip a little bit with these uh with these shades as well so like I said I'm just enjoying the moment enjoying the time being I heard my guys.