and very excited to be the question asker, as I'm calling myself, of this series today. It is my pleasure to be presenting the Stories Women Carry, which is a six episode long series that will take place every Monday from this week. Highlighting creative practice of African women on the continent. With me today, before I introduce our panelists, I just want to highlight that this is actually the first series that the Howlbrown Theatre Commons is hosting, that has both Kenyan Sign Language and American Sign Language interpretation. So, thank you so much to Rory, who is here as our American Sign Language representative. Later on, Rafael, who will be switching out with her, who are both our Kenyan Sign Language interpreters. And without further ado, I want to also introduce our panelists for today, our first panelists for this series. Now, this person, it's very hard to introduce this person and do it justice because a bio is not enough, a speech is not enough, and we could be sitting here for the whole hour, and I'm just still talking about this person. But I'd like to start off by saying, hi Satawa, thank you for being here. Thank you for taking the time to be one of our panelists for this series and for starting us off. Thank you so much, Karishma. I'm so, so thrilled to be here with you and welcome everybody who is on the team, as well as anybody who comes to listen. Yeah, yeah. So, folks, just to tell you a little bit about Satawa. I first met Satawa, not even been two years, but it feels like we have ancestrally and generationally known each other since we were even conceptions in our parents' minds. Ambassador Satawa now, actually, is what we should be calling her. And Ambassador Satawa, you'll be telling us about why we should be calling you Ambassador shortly. But Satawa, aside from being a veteran artist within our Kenyan theater scene here, is a poet, a performer, a writer, a storyteller in all sense of the word, and a fun fact about her is that she represented Kenya nationally and internationally in both hockey and in tennis. So we have quite the multidisciplinary artist, truly drawing from her cultural diplomacy work, her sports into her art. So it's very exciting to have you. And again, as I said, no introduction will do you justice. So I'm just going to throw it off to you and tell us why we should be calling you Ambassador today. And all the other wonderful things you've been up to. Great. So I have always wanted to be called Ambassador. I've always wanted to be an Ambassador of something. And finally, last week I got the call from Docky Box, Judy Kibinge and Mudamba Mudamba asked me to be the Ambassador for Good Pitch this year, which is happening on the 12th of November. So in 10 days time, and what Good Pitch does is that it creates a venue, an opportunity, an event that allows documentary film producers, people who produced a documentary film as under the Docky Box process. And they get to pitch to an audience of a very diverse audience. And they get to pitch to ask for something, the other things that they may need. So they've gotten some seed money, they've produced a film and then they get to ask for more money for the film, for example, or partnerships in some shape or form. Because these are films, these are documentary films that are intended to make a difference and to really transform society. And some of the films are just extraordinary. This year, one of them is looking, is Deryl and Kimathi, Kenya's freedom, a hero, whom we don't know where he is buried. So his daughter sets off to discover where he's buried and two Kenyan women are making the film about that. And there's another one from South Sudan which is Garan's daughter, who follows her mother, who is a filmmaker. And the film is about following her mother as her mother becomes a politician. She's one of the vice presidents in South Sudan. There's an Ethiopian film that is about the red terror. A young woman goes back to look for her aunt's legacy. Who disappeared during the red terror when she was about 23. She joined the freedom and communist struggle and she disappeared. So this young woman, Hanice, is going back to find her. So very diverse films and really exciting. Yeah. Thank you, Ambassador. That's why I'm the ambassador. It's very, that's why you're the ambassador. Yeah. Being championing and really being a part of this community of new work creators, eh? So I'm just going to stick with Ambassador because I love the sound of that, right? So Ambassador, tell us a lot of these stories that you've just spoken about, have this moment of going back or going back to rediscover things. And I know from knowing you and our conversations that you have a very strong connection to your roots. So tell us about the roots that make this tree that is Ambassador Sitawa. Who are you? Who are you as an artist? Where do you come from? What is your story? You're going to, Karishma, can you just ask me that again? Cause you went in and out. So I'm not quite. Sorry about that. Sorry about that. Yeah, nice. I said, so what are the roots that make this tree that is Ambassador Sitawa? Who are you? What is your practice? What is your story? You know, I had such an interesting experience this morning. I went to the funeral service of some very dear friends of mine. Their father passed away and I went to the service and they were incredibly generous in that they gave us this incredible view into this amazing man's life. And he comes from a similar community as I come from which is in Western Kenya. And it was extraordinary to listen to this and the parallels, cause my father passed away in 2017. And the parallels, I've known this man for many years since I was a child, but I didn't realize how much they had in common. Like how, you know, with my father, how similar they were, how proud they were of their roots. And so, you know, as a colonized person, one of the things that has happened is that we've been disconnected. And, you know, many families have not really taken time to connect their children and give them that legacy. And I was very fortunate in that I had a father who did that, he gave me my legacy. And I was listening and they was talking about a very similar, so my legacy on my father's side you know, he gave me 10 generations on his father's side and then he gave me four on his mother's side. So I have these people behind me and I have their names and I, you know, and then he was very much a storyteller, although this is not what he did for a living. But he told me stories.  And you listen to about the past, about various relatives, you know, important moments in, you know, cultural moments, et cetera. And I listened, when I sat and listened to him, I also got the storytelling technique. So he had an amazing storytelling technique. And of course, you're imbibing this without even realizing you're imbibing it. And then I am of the generation that I'm on the, I had the traditional society and traditional world or, you know, I was part of it or it was part of me, even though we then when became very westernized and, you know, with the education and everything. But because my father and my mother were the first people to do well in their community, they then became like a magnet and lots of people, they were very generous. So they supported, you know, the usual African stories. So they supported lots of relatives. So our home was a hub where lots and lots of relatives would come, lots of people would come. And one of the things they brought was stories. So I was constantly told stories, traditional stories. And I just feel so lucky that I just had, you know, constantly being told these stories. And then my parents were very, both of them were very, you know, very, very progressive. So they gave all of us children everything that we needed. And, you know, were very excited about our academic, you know, for them, the academic was really important. And so, you know, I had, you know, really great, I went to really great schools. And in those schools, there was so much, so many opportunities. So, you know, to find yourself, to try out new things, art and music and theater and sport. And interestingly enough, the sport was actually also my father's legacy to me, to us, to his family, to his kids, because he was very, very good academically and he was very, very good at sports. So when I started playing, when I got interested in sports, you know, I had somebody who just supported me, you know, and would give me the things that I needed to, you know, make my, you know, to get to become as good as I needed to become. Yeah, so that is the, that is a background a bit, a little bit. Just a bit, but we'll dive more into that actually.  How did that influence the kind of artist you are today? You know, can you tell us a little bit about some of the work that you have been making, some of the work you make and how that influenced it at all, your practice? Absolutely. I mean, I really was lucky, it was happening, I wasn't aware that it was happening but I was clearly imbibing it. So one of the things that when I set off and became a writer, a poet, a playwright, I had this repository of stories and then, and I also had technique with me. So one of the things, one of the things that I have always been interested in is the whole decolonizing. You know, I remember sitting in history classes as an absolutely hating history because the history was sitting in there and the history teacher says, speak, discover this and Livingstone did that, discovered the other and grant and whoever and I'd sit there and I'd think, if I accept what they're saying, it negates me, you know?  So the stories then also acted like a buffer. So then when I started to be really interested in decolonizing and making sense, like reading Boogie with Yongo, decolonizing the mind was wonderful because I was like, oh, this is what's happening to me. You know, I understood so much. I had this buffer and I also had technique that I didn't even realize I had. So now my job is to constantly remove this Western, you know, these lenses and the system that we have been immersed in and go back and it's a process, it's like peeling an onion. So you remove one so that another next layer, it becomes possible to remove the next layer and then it becomes possible to remove the next layer, right? So this is one of the things that I'm constantly doing. So if you look at some of my earlier poems, they were much more in the Western tradition and they're very like, you know, you can see my hands, they're much more in a box and now the work that I do is much freer. You know, so some of my latest work, for example, is, you know, after about 14 years now, I've been doing this for 14 years, is now much more, it's much closer to our traditions. So there's a lot of flow and the rhythm and the music is greater. There's an interesting link to nature, you know, which I find very interesting that there's a greater link to nature. You know, so some of the work that I've done recently, for example, from taking, it's one of the pieces called Taking My Father Home and it's told from a perspective of rivers, you know, a very specific river that talks and you can just see the nature all around telling the story, even telling the story about me playing tennis, but it's nature, you know, that is imbued, you know, and that speaks. And it's a process. I mean, I'm excited to continue working on myself and removing again the layers and seeing what will I look like? What will my work look like in two years' time? Yeah, yeah, you know, there's a very interesting thing when I'm experiencing your work or when I'm watching you speak or when I've had these conversations with you that what I find fascinating is it's not just in the work but also in your process and also in your technique. There's this sort of stripping down, the peeling of the onion that is manifesting, you know, in its own way, shape and form. Could you speak a little bit more about what the stripping down of the technique of making work looks like for you? I'm curious, I mean, yes, the product and, you know, we'll get to see it later, but I'm curious how your practice or your process is non-western. Okay. I'm very fortunate that I've had people write about my process because, you know, you're just, I'm just in the process doing whatever it is that I'm doing. And it really helps when other people say, oh, this is what you're doing. So one of the things that I learned when I started to write is I have a very collaborative way of working. And if I write a poem, a new Karishma, I think can attest to this. I may call somebody and I will share it and I'm staring at it because when it bounces off another human being, even when they're not physically present, I can hear it. I can hear what's working or not working. It's like music. I can hear the wrong notes, I can hear it. And so I actually need that, that's one of the things. So, you know, individual pieces, this is one of the things that I do. I think another thing is that the practice, that the product is as important as the process to produce the product. So when I write, when I'm writing something specific, it's coming out of a new layer. So I've taken off a layer. And that layer then makes that kind of work possible, the new kind of work possible. And so I know that working with them, when I did my first production, cut off my tongue, I automatically set off, got a cast. And then everybody in the cast created with me. I wrote the poetry, I wrote the show. But each piece was taken and owned and transformed by individuals, not necessarily in the writing, in the interpretation, in the performance itself. So there was a lot of collaboration, there was a lot of discussion, you know? And one of the things that somebody said to me is, but my process is very horizontal. So I'm not the boss, yeah? You are part, everybody is part of the process. Opinions, every opinion, I want your opinion. I know what I know.  So you know, this is what I think about something. But I want to know what is it you think? And what can I take from what you think and add it onto what I think? And then create a much more complex and true representation of what the world is. So I think another thing that one of the people said, and that I also agree with is that I embrace complexity. So I'm not expecting easy answers or writing pieces that are, you know, just see one side of an issue. I do want complexity. And sometimes you can, sometimes there's a sentence that can be heard, understood in several ways. And I really love that. And sometimes it works, a sentence can work with one above it to create one understanding and then the one below it to create another understanding. So very layered, very complex, but not confusing and not incomprehensible. You know, the idea of poetry, which I love as well. I mean, I love all forms of poetry. And sometimes people say, oh, we can't understand it. People can understand my work. I want you to understand it. But I also want you to understand the layers and not to go away thinking, she's gonna give, I'm not gonna give you the answers. You know, I'm not interested in the answers. You, everybody around has got the answers that fit their life and their understanding and whatever they're dealing with at the moment. So working, you know, so a lot of my work is, as I said, begins with me and where I am at the moment. And that taking off that layer allows another way of seeing another insight that you cannot get if you are, you know, when I was, you know, 16, you know, I wouldn't have had the insight that I am now, that I have now. I'm much older, I've seen much more in life. You know, so I'm constantly bringing myself to the table. As well, as a work of art. Right, and you are a work of art in every sense of the word, right? I mean, just for the folks listening in, the first time, I mean, a few days ago when Satawa and I were having a conversation, I said to her, her very existence, like with the way she dresses up is a work of art. All Satawa has to do is walk out of her house and that is art. And for those that know her personally and have tuned in, know that, understand that feeling of like, yes, these Satawa, the ambassador Satawa, the Fed Namwalya, has walked out of her room and art is being made. And not only her, but she brings the spirits of her entire family, her entire ancestry with her, which I find very, very, very interesting. Not only in the technique and the process, but also in the work. Satawa, what topics interest you? What, I mean, you know, you've already started telling me about taking my father home. I know about Room of Lost Names, there's topics we like writing about or do you like performing or presenting about and why? Okay, I have written a lot of poetry around many, many issues and it depends on what is happening in the moment. I'm constantly listening and, you know, listening to stories and things that touch me. So, you know, taking my father home, I started to write in 2017 when my father passed away. He and I were very close and, you know, he just gave me so much and so I started to watch this as we journeyed home. And so what we do in my community, we spend, first of all, when you pass away, we spend in peacetime when there's no COVID, there's two weeks of planning, you know, the people come together, somebody said, somebody, a person buries themselves and that is so true. So, people come, you know, to support you and they contribute money, they contribute ideas, they contribute time and we, you know, like we'll have a budget and we raise whatever we needed to raise. And then we set off now and went for the actual burial. And as we set off, I started to write and it was just so fascinating for me.  But when we have weddings and when we have funerals, when we have birth, a birth of children, that is when the culture becomes alive. And so we're living this culture and all sorts of incredible things were happening. There was a point during the day of the funeral where some of my male cousins came to me and said, they're gonna stop the funeral because my father died in the house and we have to pay a fine. And, you know, it was very, very, very dramatic. And if you'd seen me, you'd have thought, oh my goodness, she's so upset and, you know, so I sort of played along. And then it got resolved, you know, and then also something happened and, you know, so I'm watching this and it's like, it was a feast as a writer, it was a feast. So then I set off to write about it, to capture some of that. And I was also capturing it because there is this sense that these funeral practices are backward. We shouldn't do that or they waste money, you know.  And we did, we've got lots of people and, you know, because my father was a prominent person in the community and in Kenya. And so if we did, we fed them, but we don't do it by yourself. Your community is actually coming and supporting you. And I wanted people to understand that this is a valuable, valuable culture. These are valuable cultural practices and we need to, you know, reconcile ourselves with them and, you know, go back to understanding, what are we doing? What is the purpose of these many steps that we take?  You know, there's so many ways in which we allegedly waste money and we know we're not. Right? So this is for me, these are some of the cultural practices that I would like protected, that we need to protect and understand and understand that we have a mourning process that is not, you don't have to, when I hear about what happened to the West, that a person dies and then the families are left alone. I think how sad, because the family comes together, your friends come together, you know, and you're not alone and there are people to hold you. So, you know, that's one of the things. I mean, one of the other pieces that I've just recently written is Kim Pavita discovering an incredible Congolese woman, incredible who was born in 1684 and burnt at the stake by the Catholic church in Congo at age 22, because she told them that she could see, she had visions and she could see black saints walking hand in hand with white saints in paradise, in before God, and they were like, what? Not possible, among other things, you know, she was just an extraordinary, extraordinary woman and I'm gonna say it again, Kim Pavita, Google her, I don't need to tell you, just extraordinary people that we have on this continent. Yeah. Thanks, Satawa, thanks. I, you know, what you just said about funerals and marriages and the birth of children, what we'd call a Harambe here, like this coming together of community, whether it's for fundraising or whether it's, you know, to celebrate something or mourn a death, to me, sounds very much like the experience of what we would call going to the theater, right? You know, what you've explained is the idea of the West coming in and having a different understanding of what theater looks like is so different from the way the performance exists within these ritual practices, right? And then a play comes out of it, but the performance itself is that sense of community, is that way of life, is that preservation of that ritual tradition. Right. How do you navigate, you know, the balance then, because, you know, you have performed extensively across the country, but you're also an internationally acclaimed performer, how do you navigate the balance between what is happening on stage and understand the ritual practice or rituality around what is being presented? Hiroshma, just say that again. Okay, we're in the tech. Close, yeah. No problem. Just go ahead again. No problem. There's a part of me that's like, we're both in Nairobi, we should be doing this in the same room, I think. But here's to technology. You know, let's try. Next time, next time. Thank you to everybody for bearing with us. I'm just going to take a breath here so we can have, make sure we're all on the same page with technology. And I will ask my question now. What I was asking was how you navigate, given that you have performed internationally and extensively in the region as well, how do you navigate performing pieces that are understood as ritual practice in some parts of the world, but not necessarily in the same way in others? What has the audience response been? How have you made it more relevant to the audiences? If at all, have you, I guess? Right. Okay. Okay, so first of all, I don't think about an audience. I actually don't think about an audience. Because if I was going to think about an audience, who would I be thinking about? Which one? What I, but I do, but I have explored, I remember when I did cut off my tongue and we're getting incredible responses in Kenya and then we went to the UK and in four places, performed in four places, including the Hay Festival. And at the Hay Festival, most of the people who came were elderly Welsh people, you know, and they were responding in the same way as the Kenyans and then in Kenya, we performed it in a Langata women prison and Mthega Club, two polar opposites.  I almost wanted to say, hold on, hold on. Why are you laughing? Why are you laughing?  Why are you laughing? Okay. And I think the thing I've understood is, tell your truth, your truth. If you tell your truth, it is a human truth and it connects to everybody. So I've got a poem called, we leave our house to go, a long narrative poem called, we leave our house to go home. And I remember when I set off to write it, it was about the experience of, in a, okay, just for the non Kenyans. In Kenya, we have a home and we have a house. So Nairobi, where I live right now, this is my home, but where I come from, I mean, it's my house, but where I come from, right? So where my, you know, my ancestors come from, where my, when we were children would go back there and that is the home, right? So we leave our house to go home. And it's a whole journey. And it was an, you know, when I was a child, it was seven hours away, seven, eight hours away. They claimed it was seven, but I think sometimes it was like 10 hours away, you know, difficult.  I think we first went from Nairobi when I was eight or nine and we're squeezing a VW Beetle, there's five of us, five of us children, and then a mom and a dad and a cousin made. And then there's the luggage, you know, because we also used to take all our food with us. And we're traveling across the country to the Western part of Kenya, near the Uganda border. And we've got, we get punctures on the way and we are hungry and we are tired and we're squashed. And it was an incredible, and then we arrived in this place and, you know, these strange people who they told us were our relatives, you know, and, because it doesn't take long to forget, particularly if you're a child, to become used to something totally different. And they're so happy to see us and I remember them asking, they asked this irritating question. I can't tell you how irritated I used to get. Do you know me? And sometimes somebody would say, do you know, in my language, do you know me? I held you when your eyes were closed. Do you know me? I'm like, well, you've just told me that my eyes were closed. How would I know you? Right? So, and then there's a way in which, the traditional way in which they shake hands, you know? And they shake hands like this. And then they say this long thing. Swa, swa, swa, te, te, te, no, no, no, no. You know, they're going on and on. And I remember at some stage, my brothers would be like, mom, dad, tell them to stop. My hand is tired. So, and I would be bratishness. Yeah, so, that poem, listen to how specific it is to me. And then I perform it and shock, everybody gets it. Everybody gets it, because it's actually about dislocation. And we're all, your childhood is not who you are today. Even if you stayed in the same place, that childhood is not what does not, the present doesn't look anything like your childhood, right? And then many of us have moved. What is home?  You know, we were a source of constant amusement. People would laugh at us all the time at the things we didn't know. We didn't know how to carry water on our heads anymore. Where I come from, you carry your heads on a large, very heavy pot on your head.   And they would just be rolling on the ground laughing. You know, I think, if you think about it, I mean, I read when I was growing up, the other thing that I did that I was very fortunate, that when I was growing up, I read a lot. You know, again, my father was a reader. So everybody in our family, we just read. And I got a serious, I became a serious addict. And so I'm reading lots and lots and lots of stuff. And, you know, I was reading Indian stories and Chinese and British and American and, you know, from everywhere. And if the story, if the person who the writer told their truth, it didn't matter that I've never, that I don't know, I've never seen, I've never been to China. I would get it. And I think that's the same thing. Yeah. Beautiful. Thank you, Satawa. I mean, yeah, the minute you started speaking about the idea of displacement, you know, there's so much happening right now in the world where that specific poem, which didn't necessarily come from that space, could speak to refugee crisis, for example, the immigrant crisis or so many other things that are happening within our various contexts. You also started, you know, this, I guess, will be my last question before we move into our little gift presentation moment. You're speaking a lot about your father and also about how you're an avid reader and these other influences in your life that have shaped you as an artist. Could you speak a little bit more about who you are as a sportswoman and as an ambassador and a cultural diplomat and all of these other, these other hats that you wear? How do they influence you as an artist, as a maker? OK. OK. So I'll just talk about, first of all, being an environmentalist and working in development. So I'm an environmentalist. And when I was 14, I have very many epiphanies, OK? So when I was 14, I'm sitting in class and the teacher starts talking about the environment. And I was like, this is it. This thing that this woman has just said is it. I'm going to become an environmentalist. And over the years, somehow, I managed to maintain interest and I actually went to the US to study environmental studies. I did a master's degree in environmental studies. I got a scholarship to do a degree in environmental studies. I sometimes can't believe it, but it's true I did. And I worked in it for several years. And it really was amazing and it was very, very satisfying. I'm particularly working with communities. I was working with the United Nations, with working with communities, and getting them to use and managing their natural resources so they could meet their own needs. So school fees and so forth. So I had a whole range of different types of projects that I supported, from water projects around the country to biogas, energy projects, biogas, and livestock projects. And I think some of the most amazing butterfly project at the coast, the Kipepe project at the coast, which you may know, is one of the ones I supported. Organic farming was one of my favorite, really, really incredible. So just a whole range. In Pocotland, I remember supporting the Pocot farmers to reestablish an indigenous system of taking water from down in a valley and bringing it right up onto a hill and to irrigate their crops. So just an incredible experience. However, one of the things that pushed me towards becoming an artist or becoming a poet. Well, first of all, because it was my dream from when I was a child, which I didn't think I could do. But then as I continued working in development, in environment, in governance issues, women's rights issues, et cetera, human rights issues, I began to see that our problem was in our minds, what you think is what you create. And I began to see that we were adept at recreating poverty because the ideas that we had about ourselves, our colonial legacy, and then post-colonial, and all the stuff that has happened to us means that we very often recreate something negative rather than something positive. And then I thought, well, I'm going after the mind. So here I am. I'm after your minds. Yeah? If it comes to when it comes to sports, that's one of the things I really loved. And as I reflect on that, it was so interesting because I went to a particular school. And I wasn't very good at sports in that school. Everybody was much better than me. And then I had this experience where my mother moved us unceremoniously to a new school.  And we were very, very few Africans. And I arrived in the school and they put me somewhere. And I interpreted it as they're relegating me. And I sat there in that school. And I said to myself, you will see. And the school was very, very good at sports and very good academically. And within a term, I was on the hockey team. I was on the tennis team. And when I think about it now, I was like, what happened? I don't know what happened. But I felt exactly. I just thought because I suppose the incentive, because I thought I was being relegated to a nonsense, to a like putting me in the garbage, I rebelled. I was like, forget it. You're not going to do that to me. Watch this space. And I think it was, I mean, I loved absolutely love sports. I mean, I think it saved me in terms of even academically. My parents would tell me if I didn't do well in school, in my academics, they would stop me from playing sports. So wow, you know. So, you know, serious incentive and just and you know, the two sports are very different. So hockey is very physical.  And whereas tennis gets very intellectual and, you know, strategic and whatever. And also hockey is very dangerous. And that's one of the things I loved about it. I love that it was so dangerous, which I don't know what it says about me, but, you know, I'm sure it says a lot.   And then you learn how to, I mean, I hardly ever, ever got into trouble. I hardly ever got hit or because you learn how to, you're playing with danger. So you learn how to evade it. And the only times that I did get into problems was when we, we went to, you know, like my school and my team, a couple of times won the national Nairobi League and we then went to represent Nairobi, the national, national sports competition. And the other kids hated us because we came, you know, we were incredibly elite.    And, you know, there was a time when we actually quit. We're like, this is too dangerous. We're leaving. The tennis was much more, yeah.  Here you are telling a story. Here I am telling a story. And then tennis was much, much more, you know, it allowed a lot of travel. So I ended up traveling a lot from when I was pretty young out of Kenya, within Kenya, out of Kenya. And, but both of them, one of the things that was happening for us, because I was among the first generation, we were literally decolonizing the sport and getting a lot of, so we got a lot of flak, a lot of resistance. So we're in white spaces where, you know, these were white sports in Kenya and there we are.  So we were on our own, you know, battling these battles. I don't even think, I hardly ever told my parents. During the time it was happening, I never told them anything. I never told them a single thing about the experiences I was going through. Stuff just happened and you had to deal with it.  And you just, you just, it's amazing now when I think about it, we just like, okay, we talk about it among ourselves, like, you know, that is really unfair, no, no, no, no, I actually won. But you didn't make a fuss and you just, okay, this is it.  You know, and in the end it was. You're a dangerous woman and it taught you how to fight and it's what you are today and it's very clear, right? Like there are so many experiences beyond your art that have made you the artist that you are. In every sense of the word. Yeah, absolutely. Speaking about your artistry, you know, Satawai, this is my most, I've been waiting for this for a while now but just to share with our audiences, Satawai has something special prepared for us that she'd like to share. So as I mentioned, it'll be my last sort of question and I want to hand it over to you to give us the gift that is your work, Satawai. Absolutely. Absolutely. Okay, so give me a moment. Take your time. I had it all set up. Oh, there it is. Okay, yeah, set up. I was looking at the wrong script. So I'm going to share with you an excerpt from Taking My Father Home. And some of it I've performed but some of it I haven't. So I've been reworking the script and so I'm going to share this with you. And I just want to mention that it's just a part of it. So let me tell you about River Lusumu. Where I come from in Western Kenya, there's a river, River Lusumu, which used to be an incredibly huge river. It still is and incredibly significant for me and my people, the Banyala Bandombi. And one of the things that happened was that as we migrated from the West, from Uganda and came and ended up coming into Kenya, we used to live in forests. And for some reason the Kabaka wanted us out of the forest and we wouldn't get out of the forest. So he sent an army and they say something I read that was recorded of that time that the river, the Banyala were killed in such numbers that River Lusumu was red with the blood of the Banyala. So that's just a little snippet from history, many, many, in the 19th century. So Taking My Father Home. River Lusumu squeezes herself into a narrow channel. She becomes a thin ribbon of water and I hear her complaining and fighting to get past the rocks in her way. She stops her struggle to speak to me. You have done well. You have done well to bring your father home. Not everyone does the right thing. The sun glints off her surface. Her voice whispers with relief. He's back home. You have done well. He's been gone for years, building a life on airplanes in boardrooms, chairing meetings, advising governments, building institutions, leading the way. She continues in a low whisper. I have to strain to hear. Your father was the beginning of things. When you are the beginning of things, where do you find the center of a trail to lead you? When you're the beginning of things, to whom do you confide when your new life stares? When you are the beginning of things, how do you make your way back home? River Lusumu turns into a bully, spreads herself into a vast marsh, only to reappear again as a rhythmic waterfall, thundering over a steep cliff into an endless gorge. I am taking my father home. A daughter's loss. I know you pay the price sometimes for your father's success. I look up to find River Lusumu cradling my old sorrows in a warm, soft voice. She continues. You remember the many times your father was absent at crucial moments in your life? I remember. I nod too scared to speak in case the heartache of so many years ago breaks through. I remember. He wasn't home for my old levels. He wasn't home for my A-levels either. I remain silent in fear of betraying my father's memory. River Lusumu has no such worries and continues to speak quite freely. Let's go to your tennis career. Remember how your dream began to soar and you became the girl to beat? I smile and remember as memories of one tennis match after another slide passed, stopping every so often it's a special momentous match. River Lusumu continues with my memories and then that one match.  Six love for one. Remember? I remember. I was winning. You made the mistake of moving on before you had finished the job, before the final ball had flown past your opponent. I remember. River Lusumu shouts, her words admonish me for this long ago slip up. Your mind swaggered. It cast itself in the guise of a winner. Did it not? At just six love for one, ripples interrupt the smooth flow of the river. 40-15 game. 4-2. It's okay.  Your mind was dismissive and self assured. Wasn't it? Deuce advantage you. Your smug mind actually smugged. River Lusumu sigh is knowing all too well what is to follow. I remember. Deuce advantage her. Game 4-3. Whispers broadcast your imminent fall and a gloating crowd gathers. I remember. Just like that with no warning at all. The crowd signaled. I was no longer there darling. I was yesterday's news. They demanded a fresh new champion. I bristled with resistance. Only River Lusumu was on my side. Deuce advantage you. You stared down that crowd. One girl versus many eyes demanding her fall. I remember. Deuce advantage her. Game 4-all. I remember. I remember. The crowd jumps up and leashing noisy ecstasy and gobbling up all my confidence. It was in that moment that I discovered what it is to choke. I am choking. Rigamotti sets in and my body loses its natural flow. Remember? River Lusumu finishes the story. In the last set, your arms rebelled. They refuse to take orders from your derelict mind. There was a brief moment when you want to games in a row under hostile crowd. Crowd growled. The final point road passed you. The crowd erupted in celebration. In that moment, my eyes reached out in search of my father. Only to find myself alone in a world full of enemies reveling in my fall. I remember. I remember. River Lusumu flows so smoothly. She almost stands still. I am taking my father home. And now he's back home. The river is ecstatic. She bounces on pebbles with glee. The river goes into reflection whirling and dredging up old memories, gathering streams, brooks and rivulets of memory. The river sighs in relief. He is home. Now listen to the tributes flowing, flowing, pouring, filling every pot, overflowing every vessel. When he left, he looked just like these villagers come to mourn him. There he is, a two-year-old boy, looking at light through wide open eyes. Then he becomes that child of six, herding cows and sheep with casual ease. River Lusumu whispers a secret in his herd.  But the bull is no match for your father and his seasoned expertise. The river laughs at this runaway memory. There, look there. I look and I see a thin young boy of 15 standing in the distance, anchored to the ground by only the all-knowing confidence of a teenager. The river has already moved on and is now pointing out the new young man about to stride out into the world in a borrowed jacket, patched trousers, worn and ironed to a shine. Well, all these my father wants. I am taking my father home. I will stop there. Thank you. Thank you so much, Satawa. There's no better way for us to call it a wrap here, just leaving us with so many questions and so much to take away and think about. I'm lost for words myself as you can see. So I, thank you. Thank you very much, Satawa. Thank you. I, you know, yeah. I just want to also thank Rory and Raphael and Lucy. Thank you so much for being here and communicating the story using different words and different language with our other, you know, our audience members. Thank you so much to the HowlRound Commons for hosting us on this series and to the Merribee Musical Theatre Initiative and the Tiberias Foundation as well for being co-producers. And Satawa, just thank you for the gift that you are for us, the young ones on, and old ones and everybody here in Kenya and my whole family, you know. Maybe if you could just share with us what is the best way to follow your work so that our other audience members and listeners can follow you, let us know. OK. OK, I mean, I'm on social media and you can follow my work there. I've been doing quite a lot of work online lately, which is a lot of fun. And I will have new initiatives quite soon. Yeah. I look forward to engaging with all of you and thank you, everybody. Thank you for the whole team and such a great initiative. It's been an incredible session. Thank you so much. Thank you, Satawa. And so we'll sign off here, but feel free to tune in for our conversation next week. It's the same time, same place at the comfort of your couch. We have another wonderful panelist joining us next week. So I hope to see you all soon at 8 p.m. East Africa time. I believe that's 12 p.m. New York time and 9 p.m. California time. So it's 9 a.m. California time. Sorry, see you all then. OK, take care.


Welcome to my snake oil sales pitch. I hope you're excited to have a chance to purchase an easy cure for all of your security woes. If you call right now, then I'll throw in an instant service mesh, just add water. I want to know, who here knows pretty much all of the Kubernetes security settings that are on by default? And also, which ones are needed by all of your applications? And please keep your hand up if you've never copied and pasted from one manifest to another. I never made a mistake in a YAML file, and nobody except you has access to create or modify workloads. It's just me, and I'm lying. So I have nothing to teach you if you still got your hand up. But for everybody else, let's go look for some foot guns. That's me, also me. I've been breaking systems since I was a kid, and my professional experience in security started in the military doing intrusion detection systems. I was a senior consultant for an MSSP for a while with these big government and financial sector clients. And so it was a huge relief in 2017 when I joined Shopify and got to work on this new fangled Kubernetes thing that just about all of my other clients would have been terrified of. But Kubernetes and I have both come a long way since then, and I've learned quite a bit in that time. I'm really excited to be here with Danny as well. Danny? Yeah. Thank you, Shane. Hi, I'm Danny Santos. I work at Shopify with Shane in the Infrasact team. I joined back in 2020. And from the time I joined until now, the security attack landscape has changed considerably, especially with a lot of companies opting for the remote work approach. And I've learned a thing or two about Kubernetes over these years and how we can harden our clusters to avoid takeovers. I hope by the end of this talk, you will walk away with some ideas on how to mitigate some risks. So here's the agenda. We're going to start talking about why we should care about misconfiguration. And then we're going to talk about Cubotted, a tool that we use internally. And the security principles it implements. And then we're going to run a little demo where we're going to show you the simple trick. You're going to see Cubotted in action. And we're going to run some attack-defense scenarios. And then we're going to talk about how exactly we use Cubotted at Shopify. And then we're going to finish by sharing some additional resources. Well, every year, Red Hat releases a report which analyzes emerging trends in container Kubernetes and cloud native security. It's called the State of Kubernetes Security Report. The latest one was released last year. It was a survey conducted with more than 300 engineering professionals and security professionals as well. And pretty much the companies use this report to benchmark themselves against the findings to determine how they can accelerate their efforts to apply security controls. And as you can see here in the key findings, 53% of respondents have witnessed incidents related to misconfiguration in Kubernetes in the 12 months prior to this study. So this goes to show how common misconfiguration incidents are. It is a top concern. They mentioned in this report that respondents worry about it above all other security concerns. And the reason being is configuration management is hard. It poses difficult challenges for the security practitioners. Because a lot of times, the people responsible for configuring the workloads may not understand all the security implications of the different settings within Kubernetes. In February 2021, Robert Abba from Hacker One mentioned customers paid out over $150,000 in bounties in just a few weeks due to misconfiguration. So not properly setting your configurations can be very expensive. But it can be even more so if it hits production. Let's take a look at one example of possible misconfiguration attack. Back in September 2021, Palo Alto Network's research team, Unit 42 Threat Intelligence, identified the very first non-vulnerability that allowed the user of a public cloud service to break out of their environment and execute code and environment belonging to other users in the same public cloud service. TLDR, cross account takeover. This vulnerability was coined Azure Escape because the cloud provider in question was Azure, and Escape because the attack started from a container escape. We don't mean to put Azure or Microsoft on the spot here. We're bringing this example to your attention just because it's really scary and interesting. By the way, luckily, there's no record of this attack being exploited in the wild, at least not that we know of. And that's due to the fact that Microsoft and team acted super fast. As soon as the researchers flagged it, they packed their containers. So the researchers managed to escape the containers through unknown vulnerability in RunC. RunC is the low-level container runtime which uses native features of Linux to create and run containers. This EV was two years old already, and it had not been patched. And that was a patch. With that, they were able to perform, the researchers performed RCE on customer containers. And the problem with this is that the attacker could gain complete control over servers, accessing all data and secrets towards the environment, allowing for platform infrastructure views of all sorts. But for the CVE to be exploited, root access in containers was required because the RunC binary is owned by root. And the question we can ask ourselves is, what if folks had leveraged security contacts in Kubernetes configuration to avoid containers running as privileged? Or what if they had set Run as user to something other than user zero, say, user 1,000? Yeah. So I think it's clear that Kubernetes is not inherently secure out of the box. And there's a pretty good reason for this. Kubernetes needs to be very flexible and needs to support a huge variety of workloads and privileges that are necessary for one workload. For example, Damon said optimizing a system for a database workload. It could be inherently unsafe for those same privileges to be applied to another. For instance, a public web server. And we're not the first ones to point this out. The flexibility means that it just can't be secure for every different kind of workload, but there are plethora of security tools that are available to us that can make it secure. We just have the challenge of knowing which ones to use and when. It's not easy to get this right every single time at scale. And we discovered this pretty early on, I think, in 2017. We saw that we were going to need some automation for this. We saw that we were going to need some rigorous controls around this. And at the time, we couldn't find anything on the market. We couldn't find anything open source. So we made our own. There are a lot of great tools now, some I think we're starting around the same time, but we've sort of found a niche with Kubot it. So it's actually used by several companies in open source projects. And I was really excited when we were preparing for this talk because Danny pointed out that Kubernetes Go, which is an awesome tutorial for learning Cate's security, actually recommends this in one of its tutorials. So let's take a look at what Kubot it could have done to help with Azure Escape. That was a pretty scary vulnerability. We're lucky that it probably wasn't exploited in the wild, but it wasn't necessary that even with that vulnerability, bad things had to happen if it had been released in the wild. This Azure Escape vulnerability was only exploitable in root containers with high privileges, and Kubot it actually flags both of those. It also flags containers with capabilities that are not required by most workloads. Since those are more likely to be exploited and when they are exploited, the danger is much greater. There's nothing that Kubot it does though that you couldn't apply yourself. So it's actually a lot more important in my opinion that you understand and use the principles that we put into creating Kubot it. Doing this at scale though, it requires automation, it requires tooling to help with that, and Kubot it is just one of a whole bunch of tools you can use for this. You should have a comprehensive security posture, so I would never rely on just one tool, but the crux of this is that pods shouldn't have more privileges than they need to do their job, and so that's least privilege, and then you should have separation of duties where the thing that does one job should not share a workload with a thing that does another job because they have different requirements for different permissions, and above all, none of those workloads should share resources with the hosts that they're running on itself or the infrastructure that's running those workloads. So it wouldn't make sense for my web server to have complete access to the Kubernetes API, but there are many smaller examples of things that do not require the same privileges that actually have them just because they're baked into the same pod or the same container. So this is the closest thing that we have to one simple trick to solving your security problems. The left is a little bit prettier, it's more concise, but it's also a lot more insecure. It uses a lot of defaults that are not necessarily the best for most workloads. The right one, on the other hand, mitigates a whole bunch of vulnerabilities, as we'll see in a minute, and so this is the closest thing we have to one simple trick, it's Kubota auto fix, and in manifest mode, this is showing that it can automatically patch insecure configurations. So we've set up a demo website to see how this might be exploited. To be clear, this is not how Shopify works, it just so happened that when I asked all of my friends what kind of website to build for my demo, they all said e-commerce. So, okay, that's what I see. Going to show you this website. So this is the Kuberware Emporium, and if you're looking for custom attire for shipping and style, then we have all of your Kubernetes attire needs, and we can add images on here, and they will appear on the t-shirt, just like magic, and so you have the ability to customize this, and for the sake of this t-shirt store, we're using image magic to render the image on the shirt. It's a really popular tool, it's used all over the place, and unfortunately with its flexibility, it's also prone to vulnerabilities. It's called image tragic, and basically you could embed a payload inside an image, and it would just execute the script that you put in there. Now, we didn't want to use an old and secure version of image magic, so we've just skipped the pretense of trying to render an image, and instead, whenever we upload a script, our purposely vulnerable application is just going to execute whatever we put in there, and the point of this is we want to focus on Kubernetes security. We know that your application eventually is going to have vulnerabilities, and we want to focus on what you can do to minimize the impact of those and prevent escalation or traversal when that happens. So, I'm running a proxy here because our application is so woefully insecure I didn't want to put it on the public internet, other than that, you can see we're just running it on localhost, and I'm going to SSH into an attacker machine because I think that it's probably more realistic if you're able to catch a reverse shell than that. The pod itself would just be open to the public internet, so I'm going to fire up this listener, and we're going to listen for any incoming traffic on my attacker machine, head back here, upload that script, and what do you know, we got a connection. So, you can see from the host name here, this isn't my attacker.eu machine anymore, we're now inside of a pod, and we can poke around and see what's in here, and I can see like, oh, look, there's the index.html file, and I can do sort of a trivial example of how we might mess with that as an attacker, so I'm just going to put that in there. Typing is harder in front of people, and I'm not that good at it to begin with, and let's see what that did. So, we're going to go back to our webpage, reload it, and it's going to be really hard to sell t-shirts if this is all we can see on our webpage. Fortunately for us, there is a way to fix it. Danny's going to show that. Oh my God, I've been paged. We cannot sell t-shirts. What happened? They were able to write, so likely they have some permissions that they shouldn't have. Luckily, I'm going to use Cubotted to automatically fix stuff. So, I'm going to run autofix on this, sorry. I think you just need to hold the M over. Oh yeah, if only I could type. And just to show you the difference after applying the changes, forgot the L. As you can see here, after running Cubotted autofix, read-only-root-file-system is set to true, so he can no longer write, he can only read. I'm going to apply the changes and deploy the fix. All right, should be live. Okay, so we'll go back to our page, reload that, and it might take a second if the Wi-Fi is not perfect. Well, we're waiting for that to finish creating the pod. The reason that this is not enabled by default is lots of workloads do require the permission to change the root-file-system, but ideally, containers should be as close to immutable on the root-file-system as they can be, and then you can mount tempters or other things as necessary so that you can write to the places that should not have set at content. With these changes, you can see they're live now. I'm just going to leave that old reverse shell, start listening for new ones, fire off that malicious workload again, and we've got the reverse shell, and I'll just go up here and I'm going to copy and paste exactly the same command as before, and this time, it does absolutely nothing because we're on a read-only-file-system, so this is best practice if the contents of the root-file-system is static, but it's not turned on by default, and just by turning that on with autofix, you can completely mitigate that particular attack. It's a bit trivial, but let's see another example. So we're gonna go ahead and apply another vulnerability as you've probably guessed from the title. This one's gonna have host network enabled. That is not enabled by default. You shouldn't have it enabled for most of your workloads, but I've seen this a number of times where people are following a tutorial or they're following something that they saw in a manifest somewhere. They're copying and pasting, and they turn this on because they want to hear from a number of different pods that are running on the same system, maybe for observability workloads or even other security functionality. This is really problematic though, because if you have host network enabled, it's going to share the network with the host itself, as you might guess. That can bypass all network policies, so anything that should isolate this workload from the other tenants in your cluster are going to be bypassed, and unfortunately it's also going to bypass about five years of improvements we've made in the metadata service that runs on just about every cloud provider, and you can see here, this is my host name now, it's different from the shop web pod that I was in before because we're sharing the network with the host itself, and if you're familiar with the instance metadata service, this is the same address on every cloud provider that I'm aware of, and it's pretty useful. It can tell you where in the world you are, and it can give you tokens that you should have access to, or in this case, because we've got host network enabled, tokens that we should not have access to, so I'm going to go ahead and copy that, and I'm going to exit my reverse shell there, save that token on my attacker machine, and at this point I would, as an attacker, have to kind of go through and enumerate my privileges, it would take some time, but we're going to skip demonstrating the reconnaissance, and I'll just go ahead and show you what would happen once I found something that I had privileges to access, so in this case, I found that the account that the host was running had access to a shop demo PCI keep out bucket, which sounds very interesting to me as an attacker, and I'm going to go ahead and look at what's in there using just that token that I got, if I can type that is. Okay, so this is going to be a really big problem in your next PCI audit, and it's probably going to upset a lot of your customers, because of course, here we've got all of the historical transactions that were processed by the shop. Now, there's no reason that some new person buying that needs to have access to all of this old data, so it should be blocked, but in our case it wasn't, and of course there's a fix that Danny can show you. Yeah, once again, you bought an audit fix to the rescue. You have the difference? Yeah, as you can see now, like it's back to the default, which is host network set to false, and then Shane's going to see if he can attack our GCS bucket this time, unlikely, I'm going to apply the changes. Okay, so this time it went a little bit quicker, thankfully, that container is up and running.  This time you can see it just has the pod ID, and I'm going to run the same curl command, and what I expect is I am going to get a token, but this time instead of the host's identity, it's just going to have the identity that it should have of the pod itself, so it'll have the privileges necessary to sell those t-shirts. It won't have the permissions required to do just about anything else. So there it is, running the same command again with my new token file, and of course we get a forbidden error because this service account doesn't have those permissions, so this is implementing the least privilege that we talked about, and finally, we'll go on to our third demo. So the first one was extremely trivial, and attempting to modify that would only really affect the very first replica, or the one that you had access to in that first pod. If you were running dozens or even hundreds of replicas, then there's a very low chance that any given user would hit the one that you've attacked, and also the defender could just replace the whole deployment, and it would replace all of your changes. The second one, we still don't have persistence, we didn't really change a whole lot, but we were able to get a lot of historical data, and exfiltrate that, and that would be extremely valuable, but if we really want to take over the whole cluster, then we can take advantage of privilege containers. Now, it might seem strange that you would run a container as root, or enable all of these additional privileges, but even the nginx container, the nginx image on Docker Hub by default runs as root for some reason, and so if you're just copying and pasting, if you're following a tutorial, even if you've done this a hundred times and you just didn't think of it, you just said from nginx, you're going to get a root container. For this example, we've also got hostpid turned on to make it go a little faster. That shares the process space with the host, and is also problematic, but even if we didn't have that, it would just take about 10 more minutes to use a container escape that was demonstrated at Black Hat 19, and that would allow you to skip the whole hostpid part of it and do exactly what we're going to do with just privileged. So we can see our container is running, and I'm going to listen for that. Reverse shell again. Fire off our malicious payload. Okay, and I caught it, and we're going to see right away this looks really different. If we take a look at the file system, this isn't the container file system anymore. It's got everything the container's got. It's also got everything that the root file system has, and we can go ahead and use Anna Center. This is going to change our namespace from the default one that we were running in as the container, and because we had that hostpid and we are running as a privileged root user, we can escape the container completely and change into the host's namespace, and we can take a look at this. So we're running as root here. Now that we've done this, we can do whatever we want. So one thing you might want to do in this case is add your own SSH public key to any authorized keys files you find on the system so that you get complete persistence. You can go back and log in as any user you want. That also makes it hard to attribute anything if defenders do find that you've been accessing it later, then it might look like somebody else was doing what you've actually been doing. So we're going to enumerate the containers. If this was a real attack, I would have to take some time to look at the permissions of all of these. In my case, I know that this one here happens to run in kubesystem, and it has a whole bunch of extra privileges. And once we're in there, you can see this is the stuff that's inside that pod directory, and I'm just going to look for the token, and there it is. So this is the Kubernetes service account token for this kubesystem highly privileged workload, and I'm going to steal that token. I'm going to save it in an environment variable, I just noticed my proxy stopped here, so I'm gonna start it again. I'm going to save it in an environment variable because what better place to store a secret than there? And once I've got that, I can copy, I'm not going to try to type this whole thing live. It's about five lines if it was condensed, but it would be very painful for all of us. I think if I tried to type this out live, so this is a pretty simple curl command, it's just broken down to make it a little bit easier to see, and you can see in here, we're just replacing it with our own image, so I'm gonna take that and run that command, and this is some ugly JSON, you don't need to read it all. The important part is this part here, the message replica set has successfully progressed. So that means whatever command we just ran has replaced the running image for every single replica everywhere in the world with the one that we as the attacker have chosen. And of course, we've completely defaced this webpage, something terrible has happened, Fippy has turned to a life of cyber crime because we failed to defend our cluster, and it's going to be really hard to sell t-shirts now, or it may be easier, but for the attacker. So this has obviously been defaced, but what a real attacker would more likely do is they might run a coin miner on your website using your compute resources to generate money for them, or they might go ahead and leave the appearance exactly the same, but just put a credit card skimmer on there that's going to send all of your customers credit card numbers to them, or it might do something even more nefarious, they've got complete persistence because they are able to take advantage of that, and it can easily be done if your workloads do not have the lockdown permissions that we recommend, and unfortunately by default, so many of them don't. So of course, we're going to see how you can defend against that.  Okay, to my defense, this is not my computer, so I'm having a hard time. What have I missed? Okay, I see, I see, I see that show, yeah.  Oh, have to deploy, just deploy. And in the pod security context, having run is not root is important because it means that even if the Docker image itself has specified that it's going to run as a root user, that will not be allowed by Kubernetes, it will refuse to allow that to run unless you add run as user and change it to something other than root, if the Dockerfault doesn't specify it, then it's trivial to just run as a specified user in the Kubernetes YAML, it's really up to you where you apply it, but it is, of course, important that you apply it. There are very few workloads that really need those privileges, that really need to run as root on your systems, and so I would almost never recommend doing this. In cases where it's just assumed that there are root privileges, there are usually ways of getting around that. I know Greg Castle's gonna talk about some of the work that Google did to try to de-escalate those privileges at Google, and so I'm just gonna go ahead and run the exact same NS-enter command that I ran before that allowed me to escape onto the host, and of course I'm gonna get permission denied because I'm not root. I don't have those privileges. I can't do any of that anymore. All right, so easy, right? I just run autofix and all our problems are gone. It's not, oh, yep. But in fact, we actually have bad news. There's no simple trick. It's not the only thing you have to do in order to keep a complex system like this secure. That might be enough for this simple architecture that we just demoed here, but in the actual production clusters, such as those of Shopify, where you have thousands of transactions per day, there are many other aspects we need to address in order to make sure all holes in the castle are properly patched and the walls are safe. You can enhance your infrastructure security at different stages of the software development life cycle. For example, at CI, there's been a lot of talk about shifting security left and how important it is to surface security concerns as early as possible. For example, you can add a step in your build to run some tools to catch vulnerabilities in container images early on. Image scanning tools provided by SNCC, Trevi, and Encore can be really helpful here. Even cloud providers like Google Cloud offer container image scanning as a service. We can also run SAS tools, static application security testing tools, such as SAMGRAP at CI. They will flag vulnerabilities in the code. We can also run tools like Qbot at CI, which will flag vulnerabilities in your Kubernetes infrastructure as code. And that's exactly how we use it at Shopify. In fact, there are many layers in the security on it. I'd like to mention that we do have secure defaults. We have custom templating system and we have base Kubernetes components with configurations that conforms to the best security practices. However, we trust and empower the developers. They can craft their pods and containers if they believe it is needed. So they can modify the base component and deviate from the happy path, and that's when problems may come up. We currently have over 17,000 repos at Shopify. And how do we make sure developers are continuously integrating changes and not introducing this config? In other words, how do we make sure developers are aware of potential risks when they push changes? We believe it's important to raise security awareness. If developers are, for example, running their containers as privilege or something nasty could happen, as Shane has just demonstrated here, maybe they don't really want to need this. Maybe they might just go for something a little less permissive. They're just not aware of it. So we have an additional step where we scan the Kubernetes manifest with kubotit. We generate a serif report. Serif is the format that several code scanning tools use to share results, including GitHub code scanning. So we generate the serif report. We upload it to GitHub, and we let GitHub code scanning do its magic. If there are critical or high-risk vulnerabilities, we see a failing check at CI. And then folks are able to read more about why it failed, there's a link to documentation, more information on the offending configuration, and why it poses a security risk. And with GitHub code scanning, it's very easy for developers to opt out if the alert is not applicable. They can choose among one fix, false positive, or used in tests, and even add a comment to justify or provide feedback. They can also use custom Kubernetes, kubotit, sorry, not kubotit, it's kubotit configuration, disabling some of the checks, or even kubotit override labels. So this is collaborative security rather than adversarial security. With this flow, developers are security allies. We also have monitoring plays to observe how often the alerts are dismissed, and these metrics are relevant because it allows us to fine-tune our alerts and avoid presenting false positives to devs. And the reason this matters is because alert fatigue reduces devs trust. And we want to avoid the boy who cried wolf behavior.  So that's what we're doing at Shopify. What else are we doing? What can you do? Once your manifests are secure, you need to branch out. You need to look at how you can apply those same principles at build time, deploy time, run time, all the time. Build a trust model for your cluster. These are some of the things you can start working on. And then here is how you can sort of map what you've done to what you need to do. So this is just one example. This is the MITRE attack framework. There are many like it. Sands has some good recommendations for how you can do this. And the idea is that you want to figure out where you're succeeding already, what you've neglected, and where you're just not sure. And by using maps like these, you can figure that out and then prioritize the rest of the work that remains. You can also look at things like the OWASP top 10, and that'll tell you what's actually being exploited in the wild so that you can evaluate your own defenses and find out if you are going to successfully be able to defend against those. So we're gonna make the repo available if you wanna look at this yourself. We've added a whole bunch of other resources there. We've seen a few ways today that Cates can go wrong. And if we want Cates to go right, then we need to apply these security principles. To apply them effectively, it's gotta be automated, it's gotta be flexible, and it has to be collaborative. There's no simple trick that's going to work all of the time in every situation. So please try to apply these principles in your own environment, share your lessons with us, or even share our tooling. PRs are always welcome, and we hope that you'll help us to secure all of our software. Thank you. Unfortunately, we have time for questions. One minute. Can we get the mic turned on for questions? Hello, hello. Thank you for your awesome presentation with the attack response. It was awesome. Can you elaborate a little bit more about how we can use Cubudit with either Helm operators, maybe plug-in and code editors, GitOps, things like this, do you understand what I mean? Yeah, of course. So we don't specifically use Helm at Shopify, but you can scan any Kubernetes manifest either in a file or in the cluster using Cubudit. I mean, you can do the same with Trivi and Sneak have similar tools. What we found is Cubudit focuses on a small niche number of things that we thought were the most important. And so I think it would be probably good to implement with something like Helm, not using the auto-fix mode, but using it in cluster mode. So once Helm has deployed it, you could use Cubudit to monitor what it is that you're already running. And that would be both a good tool for identifying what's wrong as well as for seeing what you can do next because it's going to show you the things that Helm did by default that are insecure. And I can almost guarantee that with any workload, you're going to find some things that don't follow best practices. And then in some sort of staging or test environment, you could try turning those off, editing your Helm files, and seeing if you can make security improvements that way. And in many cases, even contribute those back to Helm if the Helm workload was overprivileged to begin with. It would be awesome to have an integration in VS code or things like this to linter or real-time when you're writing your manifest, for example. I agree. We've had a hard time deciding on exactly the best place to implement this. So originally it was running just in cluster mode, and then we found that actually we really want to identify those problems before they're running in production. So that's why at Shopify, we're using it in GitHub. So as soon as you commit it, you might have done something wrong. But once you push that up to GitHub, RCI is going to scan it as soon as it reaches GitHub. And that's going to run it on the file and tell you or the developer what may be insecure about that. And as we saw in the screenshot that Danny showed, it then has the ability for the developer to tell us, like, actually, you got this completely wrong and we can see that feedback. Or if it's right, they can just apply that and move on with a more secure workload with very little work on their part. Thanks. Hello. So the question is, we use GitHub. Is there an option to use GitLab as well? And our own integration at Shopify only uses GitHub, but Kubot it would work just fine with any provider.  And that's where you would have to do the work yourself is to have the ability for the developers to give you that feedback or create the automatic implementation of whatever change you've made. You could do that if you wanted a completely vendor-neutral platform. You could do it with Git pre-commit hooks if you really wanted to. I don't see any more questions. Thanks, everyone. Thank you.


So we're at McNary Dam today. We're doing a remotely operated vehicle inspection of all of McNary's main unit intake trash racks. We were asked to look at inspecting the trash racks so engineering and the project could come up with a better estimate of what it would take to refurbish the trash racks and if there's any debris at the bottom of the trash racks that would need to be removed, what kind of volume it is. The ROV is a great option. We don't like to put divers in the water unless absolutely necessary. So we're always looking for any way to do an inspection or work without putting divers in the water just because of the risk factors. You don't have a diver down there that is either put in harm's way or gets cold or meets their decompression obligation. It has a capability of going down to close to a thousand feet but it's mainly set up to do underwater inspections utilizing both the high definition camera and we have a couple of different sonar on it that allow us to see through zero visibility water as well as some underwater measuring tools. The biggest thing is to make sure everything is done correctly and safely. We have certain guidelines that we use to prepare an area prior to operating in. It's all to operate in a safer environment.


announcements today. But first, a little bit of background. We have an abundance of research and scientific literature today. The problem is that our human brains are limited so we cannot read and understand everything. And that is why we are building an AI researcher. What we're doing today very concretely is that we're semi-automating the researchers process. About a year ago we launched the first phase, which is taking a problem statement and broadly exploring the research field. And we've proven through peer-reviewed open access papers that we, using our tool, researchers using our tool consistently outperform teams using, for example, Scholar or PubMed, which is very exciting. And this leads us to our first announcement of the day, that the second step of the researchers process, which is taking all of that content and narrowing it down to a precise reading list, that tool was launched to our first-better clients last week. And that is a tool that iterates between the tool and the user to filter down. We can save you 90% of your time in doing this with about an 85% precision and recall, which is a lot better than what you can do in industry today. So that is our first announcement that that tool is live. Thank you. The second announcement that we're going to make now is that every quarter this year we have been doubling our revenues. And actually for the month of January and that month alone we are actually cash flow positive, which is very exciting. And then the third announcement, which is the bigger one and the one that makes us go, whew, finally, is that as of this week we have closed our seed funding round and together with Nordic Impact and a bunch of amazing, amazing individuals that really believe in us, we have raised a total of $2 million, which properly positions us to go out into the world and do some really exciting stuff. But there is one more thing, because yes, we do have access to more scientific content than ever before. But we have politicians that doubts its legitimacy. We have publishing houses that hides a lot of it behind paywalls, going after those who breach those with deadly force. We have academics that are struggling for lack of resources and funding in time to communicate across different disciplines. Openness and transparency and fighting biases has always been a core value of what we do. The problem is that we are finding it really hard to live up to that. Yes, we work with amazing corporates, but looking at the VC scene and trying to get funding and working with those corporates, we find ourselves trapped and delivering that as opposed to going out and delivering our tools freely to everyone who needs it.  If we want to make a massive impact in the world, we have to uproot an entire industry and we cannot do that alone. And about a year ago, we launched our AI trainer platform. Since then, we've had 8,000 individuals sign up to help our tool learn. People who contribute and volunteer their time and tell us that what we do is important. And we've been asking ourselves over the past few months, how can we give back? How can we give value back to these people and show them that what they do matter to us? And thanks to new technology and new opportunities arise. And I'm happy to announce today that we are going to enable our AI trainer community and everyone else working with us by tokenizing access to our tool. And what this is looking like is that every AI trainer who builds annotated data sets with us, every coder and quality assurer that helps contribute to our increasing open access code base and longer term researchers using our tools to publish their research open access will be rewarded tokens, tokens that they can spend directly into the core services of our tool. We will ask this community to hold us accountable for openness, for fighting biases, for being transparent in how the tool works. And as we continue to play with big corporates and they purchase access to the tool, and of course as the algorithms continue to improve thanks to the community, the value of the tokens to the community will increase. Scientific research is the ultimate decentralized body of information that we have. And decentralizing access to it allows us to empower a community that otherwise would not have been able to do so. Doing that will allow us to take power away from the big publishing houses. It will allow us more transparency and prove a really important balance to the big software players that are seemingly impossible to hold accountable for their algorithms and their implications on the world. And we can show the very, very revenue focused VCs that actually there are other ways of doing this or other ways of building incredibly profitable companies where you can open up the tool to as many people as possible. So with that, we will be releasing a full white paper in 2018 with a full functionality of the tokenization of the platform. Until then, I hope that everyone here who loves science will join our community, join our efforts and please let us know what you think because this is going to be a community effort. Thank you very much.