So I had a couple people ask me about this, which is backup and restore of PFSense. Like, how do I back it up? Or how do I restore it from a crashed one? Or how do I recover the file? Because I've actually had to help a friend with that. And, you know, there's some ways you can recover it. So this is kind of a quick overview. It's not a long video, but it'll kind of get you real familiar with how the backup and restore works. So here we have my demo box, which has random things installed on it. I've got the VPN set up, for example, from my PIA video I did. And I still have Sericata and customizations and all configured in here. So obviously, everything breaks at some point you wear it out. If you're lucky, never breaks. Great. Good for you. But, you know, especially working in IT, we know things go wrong, things go awry. So we're going to go ahead and do a quick backup. Now, I do recommend you encrypt your backup, put a password on it. We're not going to do it for this video because I'm lazy. You can back up everything or specific things if you want. You can also, by default, it does not back up all the log data that's in here. So it tells you, you know, if like the R&D data. But we're just going to download the configuration data. Now this does contain package configuration as well. So we're going to go ahead and download the XML file. And there's our config. So here's this working PF SenseBox. There's the config. Let's say disaster strikes. So we're going to simulate a disaster by going ahead and dragging this over here. And just resetting to factory defaults. I could do a reload and simulate the same thing, but we're going to put this system at complete factory defaults. So we're going to go ahead here and choose option four. Yep. We're just blowing it away. Now, it does this fairly quickly on my computer and does this really on if you got a decent SSD.  If it's in your production environment, do a backup just before just in case whatever you do actually locks yourself out of it. So for example, turning on blocking on the land side. If you're playing with Sericata, you can lock yourself right out of the system. So that was the factory reset. It restarts. And then I'm going to, it's going to kick me out here in a second. And then I'll just log back in with the default admin and PF Sense. All right. So it is now right back to factory defaults. Go ahead and log back in. And it's admin and PF Sense. Just like normal. Yeah, next, next, we're going to leave everything at just absolutely default here because it doesn't matter.  Reload for new changes. Done. Then we just run over here to diagnostics backup restore. Choose file. Going to grab that file I just downloaded, which is right here. And if you notice the file contains the whole date, time exactly when you did it. So then we're just going to restore configuration and click OK. And it reboots the system. Now it's going to do something a little different when it does the restore. So when it does the restore, all the package details are going to be in there as well, including all my settings for Sericata. Because, well, I should have showed you, but I'm sure you can assume once it's that factory default, there's nothing. There's no information in here is why it ran through the wizard. So when it does this boot up, it's going to go through and find packages, redownload them and install them that I had installed. So we'll let you watch the machine here. Go ahead and do normal boot. All right. And now it's fetching all the packages. So it downloads each of the packages, extracts them, then it's going to run all the post configuration and start pushing all the rules. So the emerging set rule done, installing, updating configuration for WAN, LAN, starting the Sericata package after the configuration. And that fast, it's back up and running. So now we log back in again and we look at Sericata. Up, running, configured. The options and things like that from my last tutorial, they're all here. All the boxes are checked. The extra boxes are checked here. So it didn't do in a default install. It actually restores. And we've even done this ourselves. We replaced a hard drive in our free NAS box. We wanted a bigger SSD in it. All they did was I don't bother cloning or anything. I back up a configuration file. I push the configuration file back in. All the settings are there. Everything's right back where it was. The VPN settings for PA. Everything just goes right back to normal. And you're up and running in literally a few minutes on a fast machine. This is one of the things I really like about Be of Sense. So you don't really have to spend too much time thinking about it. Just every time we make a change, it's process procedure for clients. It's process procedure at our office. Make change, download file, add file to customer, document, and done. That way we have the latest backup based on the last change we made, and we can restore it. But what if you lose the server and it doesn't boot anymore, but maybe you can still mount the hard drive? Well, you can still get some files off of the hard drive. Specifically, you can get the critical file. So I SSH'd into the box. And we'll go ahead and open up a shell under CF. So CFConf, there's the config.xml file. Now you grab that file, and I think most everything is in there. I don't think it misses anything, but that's the file that if you wanted to restore your system and you forgot to back it up and you critically broke it, but had it, you know, such a long time or just maybe you never backed it up and you need some config files so you don't have to go through the whole process again. It's under CF.com if you grab that file. And the same thing, you just upload the config.xml file to that. It's not that hard to restore. I always prefer just to back things up so you don't have this issue. But this is really nice about PF Sense is when a box gets messed up and for whatever reason, like I don't know, a hard drive fails, I don't really have to think much about I just pop the hard drive, go to the last known good backup, put it in, it restores everything, even extensive configurations. To my knowledge, all of them, I think unless there's a note otherwise, all the different services have full support of saving their configuration into the XML file. I think there's a couple that maybe don't and there's some notes in there I haven't gone through every single one of them. But I can tell you some of the main ones, like Sericata, no problem. The config files copy right over so those packages get reinstalled without any issues at all. So that's just a quick how to backup slash restore a PF Sense box and why you don't really have to worry about cloning the hard drive or anything like that unless you are really, really go, man, I need all those extra logs and things like that. So you will lose some of that, but outside of that, you're good to go. You know, it's... I'll just lose a few log files. You can just go ahead and restore it, but if you want these somewhere else, you have the option to push them all to assist log server for other details. But if you like to content here, like to subscribe, hopefully I can just send this video to people who asked me that question. It's actually been coming up a lot of, how do you backup your PF Sense or how do I backup my PF Sense and will it restore everything? Because once you get it all configured, I know you're afraid to do it. That's why I don't mind my demo box. Just wipe it, reload it whenever I want. It's also kind of cool is I can keep multiple configurations files and just restore them as needed and I name them if I wanted to do a demo of something. So pretty simple system for doing it and thanks for watching.


What's up everyone? It's your girl Kenty here from Layton sports guards and I am ripping brand new release today of 2021 panini Don Russ optic football hobby six bucks half case break number five. Take your team New over the teams and we'll get started Adam M. Falcons Alex G. Patriots Alan T. Packers Andrew G Bears and Niners Anthony P. Bucks Anthony D Chargers Brett O. Cardinals Brian S. Seahawks Don G Ravens Browns Edgar B Jets Panthers Harper B with the Bangles and Jags Jonathan H Eagles Matthew G chiefs Matthew We got two Matthew G's Matthew G. Oh with the chiefs Matthew G. W with the Titans Michael Y Texans Miguel G Steelers Nicholas U. Saints Ryan P Washington Colts and Vikings Sean T. Giant Spencer and Lyons Stephen I Raiders Stephen W. Cowboys We got the both of the Stephen W's again. Stephen W. I. L. H. with the Cowboys Stephen W. I. L. S. with the Broncos and Rams Tim C. Dolphins and Tony Y. Bills All right best of luck everybody. Thanks for the film Here we go Let's see new case new downtowns hopefully We've uh, we haven't had a duplicate downtown yet a bunch of quarterbacks We finally pulled our first number, which was a black Pandora Saquon at the last break Beautiful. I love the black Pandora downtowns Scratch uh, Chanel to jr To 199 on the orange Simi Fajoco, we've got awkward rated rookie Luke Farrell To 99 Leaping Franks. We've got Hollow Aziz Aujalari rookie John Stevenson rookie Givante Williams. We've got the rookies insert Tray Lance Niners Aujalari Jamar Chase elite series rookie Bangles rookie Basham orange rated rookie 199 Tray McKinney Chargers Get everyone uh breaks through Wednesday are listed on the site Milo Sanders Aqua The national breaks start Tuesday Definitely check that out. They are listed through Wednesday right now Robert Tanya on the hollow Every spot that you hop into or you grab Elijah Moore Rookie Kings on the black Pandora Nash Harris Nice one there Miguel G On the nash My voice is not ready for those sheeshes yet There you go. That is so sick. I love that one 25 a 25 bookend there Beautiful Mag that one up for you Every spot you buy into one of the national breaks you do get entered for the big giveaway promos. Definitely check that out Over uh, there's a hundred total prizes They are all listed under the promo On the national under the national breaks tab. We've got silver circles rondo mora 125 cardinals Any questions let us know For all we've got lime green the 70 or to 35 Dak Prescott the cowboys We break in from both the national and here back at the shop. Micah parson's raider rookie hollow Jonathan Taylor Tuesday will be just here and then wednesday. I'll be all day at the national trailance raider rookie And then daytime thursday friday and a new saturday. I'm our rogers retro series brett far Sonny senior jr. Red the 99 brandon cooks Brandon cooks the 99 Brandon cooks the 99 We've got blue de hop to 179 cardinals drill cocks We've got blue raider rookie auto remandre stevenson for the patriots that one was not backwards snuck up on us There you go. Pat's that is out of 40 28 of 40 There you go PS2 last pass box one Got zack wilson and hollow white rookies hot white hot rookies mac jones Patriots Nice first box We've got dominators derrick henry Najee Harris raider rookie blue eric ebron to 179 Rizorike orange to 199 marcus may jets Got Ian book rookie blue raider rookie auto chuba hover to 40 Go panthers This one's out of 99 50 out of 99 It's blue. It's out of 40 Same color number. Uh, definitely Should I smack rookie? Christian bar more of legendary logos hollow karson wintz for the colts baltimore colts, uh, a little bit there Finally wallets. We've got aqua raider rookie andry sisco to 299 Right perkins. We've got lamb jack on the silver circles 125 For now powell hollow raider rookie chris evans bangles Sure, right the rookies jaylin waddle dolphins Chase the horn red raider rookie to 99 gibbon holland dolphin Got shrubber warrants raider rookie blue davis mills to 179 Nice one there's taxons Nice mills that is 59 out of 179 My that one What's up, brandy? Here's marshall jr. We've got george kiddell hollow shot bateman jelly, we've got global, uh, joseph aside bangles around tree orange patrick queen to 199 etn um aqua jeff acuda 299 morrig Hollow de marcus lorenz monra last pass box two jurit patterson box three ready rookie chover lorenz aqua tua on the second year to 299 I think he's gonna have to come back here. I think they'll say healthy that is Christian barmore nico collins hollow raider rookie texas Far Tyler Wallace rookie running perkins gifted rookies of divante smith Eagles Bateman we've got rated rookie pink velocity elijah vera tucker jets See well, we've got aqua to 299 dk metcalf Tray McKinney silver circles to 125 is that cunningham texas It's been pretty good so far randy. We had one half case that had what was it four three or three or four Uh downtown so it was crazy hollow justin herbert for the chargers Shelley we've got some rookie kings on the black velocity travis etn jr You go nice one there Not numbered on the velocity The jacks Round tree got rising suns of cooper cup ramps Got blue erin jones to 179 orange to 199 justin jefferson Monroe st. Brown We've got marcus colston hollow ashon right jc horn global hollow santos for the baron now pal we've got purple to 50 cornell pal chiefs Patterson orange to 199 rookie rachon slater chargers Tranka, we've got a givante williams rookie auto for the broncos that is out of 150 51 of 150 you know broncos It's gonna have a big year onion nausea harris raider rookie stealers last pack box three There's rikeh legendary logos givante williams ricky The nice ending there box four Downtown yet, but we do have a gold here jake funk mom big raider rookie We've got a keen and allen for the chargers back to back golds for the chargers And a herby labs break now the keen and allen Nice that is seven of ten No chargers on the golds Or so we've got darren waller to 179 raiders Get everyone force will be live at five tonight kyle pits. We've got purple hunter long raider rookie auto Dolphins with the next auto here That is 22 of 25 Hunter long His optics football is sold out so just baseball and basketball breaks left for today with him tonight And then personals will resume after that as well Harris Got rookies just in fields for the bears Grant retro series hollow of terrell davis What more optic look forward tomorrow's breaks with kaleb jalen waddle and aqua jc hornet 299 Panthers We should have some more Tomorrow night sunday night group breaks red in 99 calvin ridley Falcons on the color match Sermon hollow gray newson the second Bears standing on hunter long raider rookie Dolphin joseph we've got tray lance my house Niners Stokes we got aqua to 299 david johnson texas kyle trash rookie pink velocity raider rookie hunter long dolphins I know yeah, blaine. That's the only color. We haven't seen is the gold vinyl seen every other color Very well so far john holland or devon single Devon single terry hollow Truba hollard rookie Just need the gold vinyl. Let me see how many tremble. We've got rishad beatman on the gifted rookies insert lime green curtis samuel the 35 commanders 100 orange raider rookie Cornell pow to 1.99 Sheeps Phillips hollow tj watts stealers Last pack box four. That's kaderi. It's tony ridder rookie Box five here. Just a few minutes from her. Ain't everybody nothing crazy. We'll be all right Again, also the nationals breaks are listed through Wednesday. We've got ronnell more orange pink manning to 1.99 be sure to check those out Some nice breaks for sure. We've got aqua to 299 cheese claypool stealers Every spot you buy into one of the national breaks will get you entered into the promo giveaway a little mac hollow 100 prizes ranging from free wax to $10,000 Shopping spree Here in the shop because you'll get flown out To the lse headquarters. We got trailance the rookies That came out with us Be a guest breaker go to dinner with some of us. Micah parson's raider rookie We've got red jimmy graham to 99 bears A lot of fun while you're in Orlando. Be sure to check out disney Got trailance purple two on the second year to 50 dolphins You got free almanac spots for a year well Here it is One of one remandre stevens and cold vinyl auto two. I didn't even notice That there you go, patreon. It's one of one auto beautiful cold vinyl auto Take take sander breath. I'm sure he would love that mickey Yeah, I guess you just had to ask for lane, huh? Wow Nice hit there congrats again alex on the one of one Mag that one for you scratch rookie Singles inventory Sumi fohoco red hot rookies hollow nausea here Just in fields. We've got pink velocity raider rookie to 79 cadarius tony You know giants We've got lime green in booked at 35. There you go saints Nice one. They are 10 out of 35 and yeah some at Five spots in one break. I believe that's five different entries right lane or is it every different break? That's no If buying two different breaks or is it just spots per national break? I think it's just per per spot you buy one of the national break breaks Got retro series hollow ricky waters Daffae. Oh, we've got orange to 199 blake martina's giants One spot in the national promo per break spot. Okay, so that would be five. Yep We've got awkward at 299 jeffa kuta lions Aja lari. We've got chess serrat hollow rookie vikings Gotcha. Okay. I figured Yeah, so that'll get you five entries. Nico Collins raider rookie last pack box five here Farrell rising suns of cooper cup Ramps all right last box last box. Let's see if we get a downtown out of this one I don't know. Hopefully because we pulled what was it four or five downtowns in the last case It doesn't mean we're gonna be missing some in the next few Sure. Hope that's not how it works gifted rookies trevor lorenz.  Absolutely. Don't want to miss those giveaways We've got legendary logos hollow matt stafford rams rams starting heat up here. Geez Pretty pay orange to 199 david montgomery bears Got mad jones raided rookie And aqua shon alexander to 299 seahawks barrett talker jaylin dartin hollow rookie Bucks davis mills rookie texas You know farley retro series steve young bucks Jamar chase rookie blue to 179 michael pittman jr. Colts So con matcha saman collins aqua raided rookie owosuko armoa 299 browns Ronnie brown adams felon roller Chester rat rookie laundry stevenson uh windfield jr. Rising suns chris evans we've got pink velocity to 79 korean hunt browns Greg newson the second blue to 179 jameson crowded jets A few packs left and we'll do a recap Heat Werner hollow alvin kamara right bar And wallow let's do a recap here Got some color in our autos Our rising sun cooper cup windfield jr. Miles garret curtiff samuel dak fredscott keenon allen on the gold to 10 Owosu kora moa luke ferrell andre sisco jacy horn trey mckitty rishon slater cornell pal silver circles of ron delmore javon holland vera tucker hunter long kaderious tony cornell pal ian book etan jr. On the uh rookie king velocity our autos javonte williams broncos jacob harris rams chuba hubbard panthers remandre stevenson patriots hunter long dolphins And then our magt car magt cars. We had the davis mills blue to 179 uh texans these silver circles to 125 trey lance niners A rookie king's black pandora of nausea harris to 25 steelers and the one of one gold vinyl remandre stevenson elite series rookie auto Congrats again patriots All right, that'll do it for this half case. We got more coming right up


It's a big week for all techs dueling barrels distillery here in Pikeville. The grand opening is coming up and tours are starting later this week. We're really excited about opening up our doors and letting people come in and see what we've been working on. Wednesday, June 27th, we will be having our ribbon cutting. That is invitation only and that will be from 11 to 1 and then from 2 to 4 we'll have an open house which is invitation only as well. That's just for some of the state and local leaders that have supported us in the beginning and worked on this project with us. So we wanted to have them come in and then let them get a look at the place and see what we've been doing. And then the very next day, Thursday the 28th, we will be open to the public for tours of the brewery and the distillery. Our gift shop will be open and then we'll also be doing sampling and tastings at our tasting bar on the first floor. For more information about tours and upcoming events, visit their website listed on the screen or visit them at their Hambly Boulevard location. Reporting in Pikeville, I'm Polly Hopkins for EKB News.


Well, it's good to have you here as we continue our series of CUBE conversations and the AWS startup showcase. Today, our focus is on Hacker One and the CEO of Hacker One, Martin Mikos joins us. Martin, thanks for being with us. We appreciate the time. Good to see you here on theCUBE today. Thanks for inviting me, John. Yeah, let's talk about Hacker One. Global digital security leader. You are taking care of everybody's worst digital nightmares these days. And so congratulations on that front, but I know you've got your hands full. Let's go back for those who are watching that don't know a lot about your history and just tell us about the origination, about how you gathered this stable of hackers, if you will, for good, ethical hacking, we might call that and how that began and where that path has led you. Yes, thank you, John. You mentioned it already.  The worst nightmare we all now have is that we get hacked. We all have to worry as consumers, companies, governments that criminals will break into our system. And then when you start thinking rationally, think, okay, if the worst nightmare is a cyber crime and getting breached, what is then a medication potent enough to rise to that same level? What can stop your software vulnerabilities from being exploited by criminals? And the world has built a lot of testing software, procedures, scanners, all kinds of things to get there, but none have risen to the level of true criminal activity. But then this movement of ethical hacking has people with the same skill and same passion and same ability to come from the outside and break in, except one difference, they have good intent. So we have a collection, a community of all the ethical hackers in the world, over a million of them who are all ready to go in and in a way think the bad and do the good. So they approach your system as if they were attacking you and when they find a hole, they tell you and you can fix it. And it turns out that there's no other way of finding all the ways in which a bad guy could break in. You can do all the other things and you should do all the testing and scanning and whatnot, but it won't rise to that same level. It won't find all the vulnerabilities. It won't think as expansively as a criminal will think, but the ethical hackers do and they're unstoppable. And there are many more ethical hackers than there are bad hackers in the world. We have 1.2 million in our community. That's more than there are black hats or criminal hackers in the whole world. Yeah, that's an incredible number. I mean, 1.2 million. And growing hackers. How did you go about building that community and vetting that community, right?  So how do you know that everybody in that 1.2 million, which again, just a phenomenal number, is of the same cloth, if you will, of good intent and willing to help? They would never sign up if they didn't have good intent because we know about them. We can see where they came from.  So we know their intent. They're of course varying in terms of skill and drive and passion and abilities. So we have a ranking system where we can learn about their skills and we test them so we can out of that giant community find the ones who are truly outstanding. Because like in any endeavor in life, some are just natural talent. Some work hard to become the top talent. And most of us are just regular mediocre players in whatever sports we are in, like I am. But we have, we managed to find the most talented hackers in the whole world and through sort of a social competition we caused them to learn more, get better and just better and better. And here's the other dimension. So the first dimension is that we have to have a cure that is as strong, as potent as the risk. So we have to find vulnerabilities at the same level as criminals will find. Well, our hackers will do that. The second thing is it's a moving target. Whatever you learned in cybersecurity yesterday may already be outdated. Whatever technology you are catching up with may already be different than it was yesterday. But thanks to our giant community we have this sort of evolution inside the community where new talent is always coming in with new skill and replacing the old ones. So as a hacker, of course, you compete with all your other friendly hackers to be the best, but one day you'll get beaten by a new guy, a new person, a new hacker who has figured out the new technology. And that's how we stay current. Like there's no risk of the knowledge being outdated or stagnated because the people revolve in this community and it's always the freshest, most accurate current talent that's being deployed in our programs. You know, we've had a lot of conversations with cybersecurity experts over the years here on theCUBE and generally there's been a theme of, I wouldn't say resignation, that's too strong. I'd say almost acceptance that there are going to be challenges and sometimes bad guys win. Sometimes vulnerabilities do yield results with Ilan 10. So how do you match the skill level on your side with the skill level and the motivation of the criminal actors on the other side and keep up with that? Because there's great financial motivation on the bad side in order to ransomware. Great example of that. But how do you continue to fortify the hackers on your side to match that motivation that is so deeply embedded on the ill side? You brought up many good points. So let me start from the back end of them. So first of all, when we say that it's very lucrative to do cybercrime, I don't think it is lucrative for the actual doers. Like in ransomware, a lot of money is changing hands but I think it ends up in very few hands. So a lot of the technical cyber criminals who are conducting it are probably not making much money. In opposition of this, in our ethical hacking community, we already have 14 hackers who have earned more than a million dollars by working on our programs. That is a lot of money. It's a lot of money even for criminals. If you are enlisted by an euphorist government or other nefarious organization to work for them, they don't necessarily pay you well but working as a white hat, you can earn much, much more. So I do think the economics is rigged the right way, especially as human beings inherently want to do good and they are ready to do good even if their pay is much lower. Now the pay isn't lower but even if it were, the propensity to do good overpowers the likelihood of somebody becoming a criminal. So as long as we work together and pool our defenses, we'll be much stronger than any criminals. So let's turn the page then to, you've established the talent pool, very deep, great bench. You've got a lot of people doing really good work. So let's talk about the work they are doing in terms of vulnerabilities that they're citing, whether it's app security, cloud security, whatever the case may be. Generally, what are you finding? What are you seeing? Like where are the mistakes being made generally in your client base? What kinds of things are you pinpointing to them that you're finding through your work that they can shore up and build those defenses a little stronger? Broadly speaking, when you look at the industry today, every organization is undergoing digital transformation and some do it from a primitive standpoint. Some are already running on software but there's a digital transformation going on. Most organizations are moving workloads to the cloud, to a public cloud. When that happens, the nature of your application workload changes, the nature of the threat changes and the possibilities for mistakes will be different. When you deploy workloads on a public cloud, you may have configuration issues, you may leave secrets in public repositories. There are new threats that come to you but at the same time, it's a more uniform space because everybody's running on the same cloud and the cloud itself is secure. So we have devised specific services for those who run on cloud, where we go and say, we know AWS, we know Google Cloud, we know Microsoft Azure, we will find the specific typical vulnerabilities that you have there and we will tell you about them so you can fix them.  We've trained our hackers in identifying them. When we find them in with one company, we learn and we can look for the same in some other company. So the pace of learning is much faster in our system and that's how we can bring companies to a higher level of security when they're on the public cloud than they were before. So actually, like when you said that many are resigned in front of this situation, the ship is already turning. It's important to look the threats in the eye and be unafraid of it and just meet it, but we don't have to be resigned anymore. We have the powers in the cloud vendors in the ethical hacking community in software automation to now build proper systems that are broadly speaking very secure. So how do you, yeah, how do we, we look at the ransomware incidents that continue to occur and yet, and that frightens a lot of people in the corporate world, municipal public sector and private citizens even, right? But you sound, if I'm hearing you right, a little more optimistic that we're getting to be a little more adept at security, if you will, and of citing vulnerabilities and finding these loopholes and whatever. So you're not as pessimistic as some might be. You're thinking that perhaps we are starting to turn the corner a little bit and maybe some of these things that have been big threats are being somewhat more mitigated now. Well, I believe that whether you think you can fight cyber crime or not, you are correct. Meaning you must have a belief of the power that you have with your other defenders. And today we can create a defense that's strong enough. Nobody is 100% safe ever. You can take any vaccinations you like, you may still get the virus. So like as a metaphor, it's the same with software. You can never get 100% safety but you can get much better than you were before. And you do it step by step with boring, small steps. It's not, there's no silver bullet. There's nothing that in one change will make you secure. But if you every day fix one little thing, soon you are more secure than your competitors and soon you are among the most secure in the industry. So, you know, as Martin, it is almost, I think about the old saying, if you can't beat them, join them. This is like, if you can't beat them, have them join you, right? No, it is. If you can't beat them, keep beating them, keep beating at them. Like criminal activity is very bad. The nefarious actors that are out there, there's nothing good with them. And whether they are operating voluntarily or mandated by somebody's power over them, it's really, really bad. But in terms of numbers of people, they are already in a minority. They have vast resources. They have as technical resources and skills, but we have more people lined up on the defense. And pool defense will always overpower an asymmetric threat. Well, it's a great story. What hacker one has done in just a very short period of time over the past seven, eight years, it's important work, it's vital work, and you're doing it very well. And so thanks for being with us here on theCUBE. And I wish you all the best down the road too. We want the companies to do well. That's when we do well and they are very secure. So thank you very much, John. This was a wonderful conversation. I appreciate the time. Martin Mikos joining us to CEO of Hacker One. You've been watching theCUBE conversation part of the AWS startup showcase.


Ychydig yw hyn o'ch cyflaid i'w ddweud o'r parwyddioliau, a oedd i'n gweld â chyfyddiad yw'r ddweud. Ymweithio'r corffedysau, rhai eich cyflaid ar y cyflaid ffordd. Mae'r cyflaid yw'r ddweud o'r cyfflaid, mae'n cyflaid i'r cyfeirio ar gyfer y cyflaid o'r cyflaid yw'r cyflaid. Ymweithio ar gyfer cyflaid, mae'n cyflaid nrhyw gyfer yn gyflaid ddweud, ac mae'n cyflaid ar gyfer gyfer yn gyflaid, a gennym o'r meddwl, os yw'r cyfle yn ei wneud o'r ystod ar y llaw, a'r ganwch i'r gweithio i'r gweithio, yw'r hyn yn anon gyda'r rhaglen. O'r ystod, ydych chi'n ddiddordeb yn ddiddordeb yn rai yw ymddangos i gael y gweithio ar y cyfrifeth, a'n gweithio o'r rwyf yn y context o ysgolau o'r ysgolau a'r gweithio bydd angen, a'r drwy'n gweithio yn rai ymdwyllfa mewn i'r ddiffanol. Mae'n gweithio i chi'n ddifanol. roi o'r cwmhysgwyd y dyfodol yn ddylwg yma. So mae'n ffordd allan os rhai i'w gweithio'r cyffredinol. Mae'n gweithio i gydag ar y gwaith yn 30 ymyddol. Felly mae'n gweithio i ddweud o'r concept wrth i ddiwedd angen i ddechrau'r cyffredinol. Mae'r idea iddyn nhw i ddweud ychydig o'r gyffredinol, i ddim yn ei wneud i ddim yn rhaid i ddim yn yng Ngôr Gweith Gwmhannol. Just talking about some of the things that are available to you. Some of the things you might already know. Hopefully some of them you don't yet, otherwise it's not going to be very interesting talk for you. So, historically infrastructure was reasonably static. IP addresses were statically allocated. So you could reasonably use these to represent your identity. Firewalls used IP and port combinations. IP addresses were used in X599 certificates. Secrets and certificates were manually deployed to machines by admins. You might have used protocols like Kerberos to initiate trust between machines if you didn't really like yourself very much. But then a cloud computing fundamentally changed the way that we do infrastructure. IP addresses are no longer a useful identifier. Workloads come and go. Your workload will get a different IP address as it gets restarted. You could have multiple instances of your workload so they've got multiple IP addresses at the same time. Secrets distribution becomes a much harder problem with these dynamic workloads. How do you get the secrets on there? With more services wanting to communicate with each other. The old IP and boundary-based approaches, they no longer work. Secrets management solutions like HashiCorp Vault, Cloud Secrets Managers, Cloud KMS, they help with the secrets distribution, but in order to access the secrets, we need a secret to get access to the secrets management solution. This is commonly referred to as secret zero, and that's synonymous with workload identity. This thing that workloads can use to prove who they are. So what do we need? We need a trusted third party issuing workloads with their identities. We need a way for these subjects to retrieve their identities in a secure manner without the need to have a secret in the first place and possibly without any knowledge of the identity that they're being issued. We want these identity documents to be short-lived and we want the acquisition to be seamless and simple for these workloads. We need a way for the relying party to be able to verify the correctness and the validity of these identity documents. Ideally, the basis for that verifiability is cryptography and the format of choice for those identity documents will be JWTs, Jots and X599 certificates. So that all sounds great, but how do you get one? How do you get this secret zero, this workload identity? So we'll start simple with something that you're probably already familiar with and then we'll build on that. So who's running workloads on Kubernetes at the moment? Quick show, help me out a little show of hands. Yeah, loads of you. Excellent. Who's heard of the Token Review API? That's surprising. I thought we'd have more hands for that one. So basically we've got two service accounts, the subject and the relying party. They've both got service account tokens and we can use the Token Review API to verify that token and obtain some information about the subject. It's a simple API call, the subject's token in the payload there and then the relying party's token in the authorization bearer field there. We can just make this API call. If you're passing Jots around when you're making API calls and things like that, you want to make sure you're using a secure channel to protect yourself against interception and replay attacks. Once you've made that API call, from the response you can get information back about the subject. The username, the fully qualified name of the service account there. You might use the groups and now you can use this information to start to make authorization decisions. This is the most common way of integrating Kubernetes workloads with HashiCorp Vault, a Kubernetes authentication method. Now we can get dynamic secrets, passwords, API keys, certificates from Vault. That's pretty cool. The trust domain here is rooted in your Kubernetes cluster. Kubernetes is your identity provider. If you're building something that's going to run in a single Kubernetes cluster, you can build on this API yourself. It's not complex and you can use this to then start to make authorization decisions. If you are passing these service account tokens around, you need to be careful about this. The tokens themselves, they exist for the lifetime of that service account. They're replaced if you delete the token, but they're not rotated. So there's some things we can do to kind of restrict the usefulness of a compromised token. Have you heard of the bound service account tokens? They're sometimes called projected service account tokens. They use the projected volume functionality. They're bound by audience and time. So in this example here, if our demo service is malicious and we pass it our service account token, it can't use our token to impersonate us to another service because it's bound by that audience there. This works within a single Kubernetes cluster. Let's say we've got Volt outside a cluster and a service account in the cluster talking to Volt. Volt needs to verify this token, but it can't use a bound service account token because it's not in that Kubernetes cluster. So now we need to create a long-lived service account token and share that with Volt in order to be able to validate our token. So now we've got a sequence management problem again. We can reduce the risk around that token by just giving it permissions to create token reviews. But can we do something so that Volt or any other relying party doesn't need a token to validate our tokens? Well, unsurprisingly, we can. So since version 1.12 of Kubernetes and stable since 1.20, the service account issue discovery feature was added. Quickshare of hands, have anybody heard of this before? Quite a few. But in my experience, this isn't quite as well known as the token review API. But it's based on the OIDC discovery protocol, which gives you the means to dynamically retrieve the details you need to validate these tokens. And you can have it set up so that you don't need any authorization in order to get this information. So you can verify the identity from the token and you can get basic profile information stored in the claims in your jot. Your relying party should maintain a white list of trusted issuers, otherwise anybody with an OIDC compatible issuer can authenticate. So now you can start to extend your trust domain. And in order to really understand how this works, we need to understand what's in a jot. So it's a simple serialization format. We've got a header, a payload, and a signature. Base 64 URL encoded and separated with a period. So we can pipe that through JQ if we want to look at the claims in the payload of a token. You can't decode the signature because it's not UTF-8 encoded, but you're generally interested in the payload. You want to see what claims are when you mess them up with tokens. You might be interested in the header. So there's no need for you to copy your service account tokens and paste them into JWTIO just to see what claims are in there. You're welcome. Okay, so here's a decoded token. It's in the header there. We've got the algorithm and the ID for the signing key. We'll come back to that in a sec. And then in the payload we've got various claims for the token there. So we've got some around the validity of the token, the expiry time, not before, the issue that time. And then we've got information about the subject and also the audience. So who is this token valid for? But key to the OIDC discovery is this issuer field. So we'll go back to the previous slide. So with that issuer field, you can append this well-known suffix onto there, and that will give you the discovery document. And from that, we can extract the URL to get the JSON Web Keyset, which allows us to validate the signature. And then we know it's a valid token, and then we can trust the claims that are encoded in that token. It's a fixed URL out of the box with vanilla Kubernetes, but it is customisable. And it's also protected with vanilla Kubernetes. So if you tweak that URL, you need to tweak your RBAC so that you can access it. Or you make that unauthenticated. But it's also now supported by your major cloud providers with their managed Kubernetes offerings. It's previewing in Azure because they went off in a different direction initially, but they've now course corrected and are going down the OIDC route. So what does it look like? Just to reinforce this simple protocol, we'll go through an example and look at the data structures for each of the major cloud providers. So that's the payload for GKE. You can see the issuer. You can tell from that that it's a GKE cluster. We append the well-known URL on the end of that, and then we get the discovery document. We can see some metadata in there. And the key one is that JWKS URI. And if we do a get on that, we get the key set. So you can see there the key ID. We talked about a little bit earlier. The algorithm. And then we've got the modulus and the exponent for the RSA public key. And then we can reconstitute that public key and verify the signature. EKS looks the same. Take that issuer filled. Stick the well-known URL on the end. Get the discovery document. Slightly different metadata, but the same kind of thing. The key field again is that JWKS URI. And we get the key set. And for AKS, same sort of thing. Notice the trailing forward slash on the issuer field there. If you're building something yourself, it's a simple protocol. Get, extract, get. And you can validate these. And the OIDC spec tells you to check for that trailing slash so that you can get it. So you can build yourself a simple code to get the keys that you need to verify these tokens and extract the claims. So there's the discovery document and the key set. So in the key sets that we've seen so far, you've only got one key in there, but periodically these will be rotated so that you will see more keys in that list there. And that's why the key ID is important. You need to make sure that you're getting the right key. Otherwise, your signature's not going to validate even if your token is valid. So that key ID is very important. I guess that's all well and good. What can we do with it? Well, you can use it with anything that supports OIDC discovery. It's a widely used protocol. All the major cloud providers allow you to hook that in to their Web Identity Federation. So you can take this token and swap it for temporary cloud credentials. So you can access cloud secret stores, cloud KMS, basically all of the cloud APIs. So now you can start to run your infrastructure as code pipelines on your Kubernetes clusters with temporary cloud credentials. You're not having to put long-lived cloud credentials into secrets in your Kubernetes cluster. You can exchange your token for these temporary credentials. And you can go cross cloud providers as well. So, for example, you could run in GKE and you can access AWS. So IAM roles for service accounts from AWS that builds on this OIDC discovery and this Web Identity Federation. So there's a mutating webhook that AWS provides. You can install this into your GKE cluster and then you annotate your service account with the IAM role that you want to get credentials for. And then when you do a deployment it will mutate your pod and it will automatically mutate it and add the bound service account token for you and also the environment variables required to use the AWS to authenticate for the AWS APIs. So this is all seamless to your workload just with that webhook in there. Your workload can just use the AWS APIs without having to worry about it. It's pretty cool, right? You can use OPA to enforce access control based on bearer tokens in your API calls. So you can verify the token and make policy decisions based on the subject, the audience and the issuer. You should probably not just as I mentioned earlier not just trust any issuer. You probably want to maintain a list of trusted issuers and check against that. But that's so we can get cloud credentials if we're passing tokens between services we can do authorisation using OPA. But now we're in the OIDC space we can start looking outside of Kubernetes so your identity provider doesn't have to be Kubernetes. It could be GitHub. So we can run our infrastructure code pipelines in GitHub and get temporary cloud credentials and create infrastructure. So in this example we're configuring GCP to get temporary credentials so you need to create a service account a workload identity pool an OIDC provider and then you do some mapping between the claims in the GitHub token and then bind that to the GCP service account that you want to impersonate. And then Google provide a GitHub auth action that allows you to exchange that token for credentials so you can get an access token to use in authorisation bearer field for making API calls you can get a credentials file and in this case we're just getting an ID taken which is the same as the Kubernetes jobs that we've been looking at just so that it kind of looks the same and if we pipe that through JQ we can see a similar set of claims that we were getting from the Kubernetes cluster that subject field there that long numeric string that's the OAuth2 client ID for your service account and you can look in the console and verify that that's correct. What if you need more than this what if you want a meaningful name in that subject field unlike that numeric value we just looked at or the fully qualified name of your Kubernetes service account you might have multiple Kubernetes clusters and you want to simplify validation of those tokens between workloads you might want to use the same workload identity across multiple clusters your clusters might be repaved regularly and that issue of fields might change and you don't want to have to automatically keep changing that configuration for the IDC provider you might want to extend your trust domain over multiple Kubernetes clusters or you might want to have separate trust domains for each Kubernetes cluster but you want to federate them so that you can simplify verifying those tokens across those Kubernetes clusters you might not even be running in Kubernetes you might be running on VMs you might have IoT devices so we need something a little bit more we can't just rely on that that Kubernetes is the identity provider and that's where Spiffy Inspire come in so Spiffy defines the standards for an identity framework the Spiffy ID basically the format the representation of that that identifier it's a URI and it's made up of the Spiffy protocol the trust domain in this example acme.com and then an arbitrary string on the end as your workload identifier building.payments here those the Spiffy verifiable identity documents are short lived and rotated frequently the trust domain itself provides you with a bundle which is basically the root keys that allow you to verify that Svid and it could be a job but it could also be an X509 certificate the workload API that's how your workloads get these identity documents and other workloads can get the trust bundles identity documents and Spire is the implementation of these Spiffy standards Spire has a Spire server then you've got agents that run on nodes and they attest themselves to the server and then the workloads will attest themselves to the agent running on the node that they're running on and use the registration API to map selectors data depending on how they attest themselves to the workload and you map that to Spiffy IDs and when you're creating your Spiffy IDs for your workloads you map them to the Spiffy ID of the agent so now you're tying your workload identities to the nodes that they can run on and then the workloads just use the API to get their Svid and they don't need any secrets up front just by virtue of the attestation they can get these identity documents so we've got a list of the plugins listed in the documentation there so the node ones agent to server top three there are pre-shared secrets the next two are for Kubernetes the SAT is a regular service count token the PSAT is a bound service count token and then the next three are cloud identity documents so you can use kind of information that this node already has or that you've pre-populated and stored on there and then for workload attestation three key ones there UNIX Docker and Kubernetes and the the selectors so for the UNIX for example the selectors might be user ID, username, group ID group name for the process that's running that workload could be the path to the binary on the final system the digest of that binary itself for Docker it'll be things like the image ID labels environment variables for Kubernetes it's your service account, your namespace the image things like that just metadata about these running workloads and then when the workloads come up and talk to the nodes they're just attesting themselves the nodes checking for this metadata mapping it knowing which identity to assign so in this example deployment we're running on a single Kubernetes cluster using the projected service count token for the node attestation now under the covers that's the token review API that we saw at the start of the talk same as the bolt authentication the workloads because we're running on a Kubernetes cluster we're just using the Kubernetes workload attestation the OIDC discovery provider that's an optional component and that exposes the endpoints to retrieve the discovery document and the JWKS URL let's have a look and see what that looks like unsurprisingly the tokens look the same the discovery document looks very similar and the keyset looks very similar so we talked about X5 and 9 S-fids as well we focused primarily on jox before and the reasoning for that was because you can get these from your Kubernetes cluster you don't need to install anything else if you're running Kubernetes you've got some administration of that Kubernetes cluster but with the service count issue of discovery stuff you can start to use the tokens that your Kubernetes cluster is assigning to authenticate to things outside of your cluster it's not free because you've got to manage your Kubernetes cluster but it's freer than installing a spire server and agent somewhere else so that's just some of the information in the X5 and 9 S-fids you can see in the URI sand field there we've got the SPIFI ID so trust domain, arbitrary, worked out identifier and if we're running that's kind of different to service count names it's a nice meaningful identifier so that's kind of useful we can see that we can use the certificate for server and client authentication so we can now start to use this for mutual TLS we can log into vault with this X5 and 9 certificate or anything else that supports certificate based authentication spire itself implements Envoy's secret discovery service SDS so Envoy if you're running Envoy kind of as a lightweight service mesh that can retrieve these X5 and 9 S-fids and use those for your mutual TLS and now you're using the same identity for your for your certificate, for your TLS that you'd be using if you were going to pass your JOTS around whereas if you're running a service mesh like Istio Istio is issuing different identifiers for your certificates then Kubernetes would be issuing for your JOTS and again you can plug Envoy into OPA for policy based authorization decisions so I did say something about hardware root of trust so the rest of the rest of this deck gives an indication of where I think kind of workload identity is heading trying to tie that trust down to the hardware level there's been a couple of interest in talks already this week Wednesday there was talk about the confidential containers project using running Kubernetes workloads in trusted execution environments there was a talk this morning about running Kubernetes in trusted execution environments really kind of interesting stuff like right down to to hardware level attestation security this is something I'm just starting to look at so please don't ask me any difficult questions at the end about this but I wanted to just give you some information about some of the things that you might want to go away and look at and keep an eye on and say it's an evolving field and so some of this stuff isn't quite production ready so don't think you can go home and start to run this stuff but it's definitely worth keeping an eye on so trusted execution environments will leave that guys who know what they're talking about much more than I do have already spoken about that this week actually I've just scuppered myself there because I'm making up some of this stuff as I go along so TPMs quick show of hands, who knows what a trusted platform module is that's interesting, more people know about that than know about the Kubernetes token review API so you can't make assumptions when you come and do things like this so TPM is a cryptographic device it does things like secure generation and storage of keys and these keys can't leave that TPM in an unencrypted form so that's really that's a really useful property for tying things down to a specific machine so earlier we saw that you could use an X599 certificate to attest a node to Spire but if I get hold of that certificate and walk off with it and put it on another another machine I can impersonate that node with the keys from a TPM they're encrypted outside of that TPM and you have to load them into the TPM to decrypt them and use them so I can't steal your certificate and pretend to be you I have to be you with that TPM so that's quite a nice property PCRs their special registers you can read from them but you don't directly write to them you basically extend them so they store a hash of something so the new hash is the old hash plus the new measurement and keyline really interesting to look at so this uses it with the Linux IMA subsystem and so it's doing remote attestation so you can you can use that to scan the files on your node stick that the hash of that into the PCR and then keyline can remotely check that so that gives you the ability to continuously verify the integrity of your remote machines and on the keyline site they've got a nice little demo of removing a compromised LCD node from a cluster so we can use this with with Spire now I only came across this last week I'm fantastically playing around with it trying to get it to work I could get it in here but it's pretty cool so you've got a local device ID which is a public and private key in a certificate provisioned out of band and then they come out of the TPM the TPM encrypted and then in the attestation process the agent loads them into the TPM the server will then go through a challenge process to see if if you've got the keys in the TPM decrypted so now we can we can provide harder guarantees that that node is the node that we thought it is the spiffy ID uses the fingerprint of the certificate so it's very predictable just like the X509 and the SSH certificate attestation methods so that's it's not I only found it last week because it's not on the main documentation site for the for the Spire stuff it looks pretty interesting and that's it so key takeaways from my ramblin this afternoon you might already have a workload identity if you're running on Kubernetes you've got your service account taken and depending on what you're trying to do your Kubernetes cluster might work as your identity provider if you're running on Kubernetes and just talking to Vault on the same Kubernetes cluster then the token review API might be fine if you're just running Kubernetes workloads and you want to get temporary cloud credentials then maybe the OIDC stuff works to just swap your token for that if you would kind of go into the wider fields where you want to use the same job and the same identity in your job and your X5-9 certificate then you might want to think about Spiff Inspire you've got more complexity and an operational and administrative overhead to run Spire but if you need the extra capabilities that that gives you it's certainly worth thinking about it so yeah, consider Spiff Inspire see if your needs really require that and investigate things like TPMs, keyline and trusted execution environments and that's me done


I never put my hands on anybody. I never raised my voice too loud. Like this was one of them times where it was like According to recent reports Canadian rapper Tori Lane's is gonna be spending a lot more time inside over the next few weeks As a judge has ordered him to be placed under house arrest until his trial against Megan Thee Stallion finally begins at the end of November. This developing story has left many of Tori's fans wondering where exactly it is He'll be keeping a low profile over the next month. Will it be in his condo apartment in Florida? Or how about a formal rental home not far from there that he celebrated his birthday in last year? Also Michael and I have dropped our own house tour of our new home that we moved into this year So go ahead and subscribe to our personal channel if you want to see where we're living and more of what we're up to In these videos we don't reveal any addresses and even though I've done a house tour of my own place Please do not show up at any private residences because it's not safe for anyone We'll dive more into which of those two properties it might be in a few more minutes But first a little background in regards to what's going on with Tori in the first place at this point I probably don't really need to go over his feud with Megan Thee Stallion Tori's one-time friend and rumored flame So here's a little bit of notes on what happened in the summer of 2020 a violent Altercation erupted in the backseat of an SUV between these two which would end with Megan accusing Tori of having shot her in the feet They've been waiting on the trial to unfold ever since Unfortunately for Tori he recently got involved in another alleged incident with yet another celebrity this time It was Augustel Sina and his recent house arrest orders stemmed directly from this Altercation in which he was said to have beaten up the R&B singer in Chicago a few weeks ago back on September 18th Augustel Sina would take to social media to claim he had been assaulted by Tori after crossing pass with the rapper backstage at the concert The story goes that Tori approached the singer and offered to shake his hand after the two had exchanged some bitter words on Twitter During the weeks before rather than take the offer all of branch August walked away That's apparently when everything broke loose video would later surface of the incident and while it doesn't show the fight itself It does reveal Tori walking after August and later reappearing on screen as someone else says Cory said he just knocked Augustel Sina right out one punch crushed him August would then post images of the aftermath of the fight to Instagram and it certainly looks like someone did a solid number on him after the images leaked Tori would maintain his innocence claiming he had no idea what August was talking about No doubt because he was already facing some serious present time after being charged for assault with a Semi-automatic weapon in connection to what went down with Megan a few months ago in April Tori was even Taken into custody for violating a restraining order was in place to protect Megan from coming into contact with him Tori wound up having to pay $350,000 in bail and was then released now Megan's lawyers are arguing the Tori deserves to be remanded into custody after being involved in another violent incident with El Sina as far as his Prosecutors are concerned Tori's attack on El Sina violated the conditions of his bail and Megan's case and they've accused the rapper of posing a threat to Public safety Tori's attorney has of course pushed back against these demands Noting that no charges have been filed by El Sina against Tori and that as far as anyone knows the singers claims are only Allegations so what wound up happening? Well the judge split the difference rather than locked Tori up in a prison cell The decision was made to confine the rapper to his home with a GPS monitor attached to his ankle beginning on Friday, October 28 Tori must remain under house arrest until November 28th the start date of his trial against Megan the stallion If he winds up being convicted as charged Tori could face a possible max sentence of 22 years and eight months in state prison Something that Megan would be perfectly happy with she told Rolling Stone earlier this year I want him to go to jail. Well, where is it exactly that Tori might be spending the next four weeks? Let's check out a couple of his options The most likely suspect when it comes to our Tori will be crashing for the next month or so as a corner penthouse condo on the 49th floor of Brickle Heights East in Miami, Florida Tori purchased this three bedroom and three-bath unit in late 2018 for a reported $1.8 million the apartment boasts 2,182 square feet of space and features what said to be some breathtaking views of the nearby Biscayne Bay Not to mention some amazing skyline vistas when this unit was originally up for sale a few years ago It was marketed as the absolute best according to the listing information I said to include details like contemporary Italian cabinets imported stone countertops and Florida ceiling tinted glass walls That surround the dramatic open concept living space consisting of the living room and kitchen better yet The building itself comes with its own rooftop pool spa a fully loaded gym and plenty of gathering spaces for throwing a celebration or two Something that Tori no doubt took advantage of while living here but here's the thing Tori's ownership of this condo has actually fallen into question over the past few months and Paperwork filed in Miami-Dade County would suggest that Tori's facing foreclosure on his home The rapper whose real name is Daystar Peterson as mentioned in a notice of foreclosure That was filed with the clerk of courts on February 4th 2022 as well as a separate lawsuit that was filed one month later in March the notice and lawsuit were both filed by BH 4908 Which is a limited liability company registered in Florida owned by the people who sold the condo to Tori Legal documents show that Tori took out a promissory note with the LLC for 1.26 million dollars in 2018 This was said to include interest-only payments in the monthly amount of around 11k as well as a balloon payment of 1.237 million dollars it was to be due on December 1st 2021 well unfortunately for Tori with everything that's been going on in his life Since summer 2020 making that balloon payment seemed to have slipped his mind According to the complaint filed by the LLC Tori made only the monthly payments But failed to pony up when it came to that million dollar payout as a result the complaint filed with the court includes two counts Mortgage foreclosure and the breach of this promissory note The LLC is asked the court to be allowed to sell Tori's property and pay off the loan if this were to happen Tori would be left without a residence in Miami In fact, he may be left without a permanent residence anywhere in the United States is this is the only home He has a paper trail connecting him to in late March 2022 Tori's roommate in Florida Sebastian Rompotis a songwriter that Tori's worked with many times was the only one in the condo So he wound up being served with this 1.2 million dollar lawsuit as a result The lawsuit can now move forward, but Lane's has yet to respond to the case His apartment also hasn't popped up on any listings as I can tell which should mean that he could probably still own it and Spend the next month or so waiting out his house arrest as his trial against Megan gets ready to proceed But even if Tori ends up winning that case He's still got this lawsuit against the former owners of his condo to deal with in other words It doesn't seem like Tori lanes can catch a break if Tori does wind up getting kicked out of his Florida condo before the end Of November another place he might be able to head is a Florida home He rented only a few months ago when Tori was looking to celebrate his 29th birthday in the summer of 2021 He's heard no expense securing himself this stunning looking rental estate Which he advertised across social media as a celebration in which only women could RSVP While I'm sure all those women enjoyed celebrating his big day with some loud music in front of this Gorgeous grand entrance of that home with its towering palm trees stunning lawn and that monster-sized pullout back There's almost no chance that Tori lanes will be laying low at this property since it's not actually his to begin with All right, everyone that is gonna bring this house tour to a close before we head out though Do me one favor and ask yourselves this question if you had a potential 22 year charge hanging over your head Would you be laying as low as possible or out there living your best life just in case you don't get a second chance to do? So let me know what you would do in the comments down below Otherwise like subscribe and turn on your notifications My name is Kara the Vampire Slayer follow me on Instagram to chat further and I'll see you all in another one. Bye


In this video, I want to talk about the so-called quotient rule for derivatives because the derivative of the quotient is a little bit more complicated than that of a product. So the formula is going to look like the following. If f and g are differentiable functions and g of x does not go to zero at the point we're interested in, because division by zero of course would throw everything out the window there. And with those assumptions, the derivative of f divided by g. So f divided by g prime is going to look like g of x times f prime of x minus f of x times g prime of x divided by g of x squared. So we're going to take the bottom function and we square it here in the denominator. There are some important things to pay attention to here. The original function was a quotient of two other functions. The derivative will likewise be a quotient as well. The function that was on the bottom is going to be in the bottom squared. We're not taking the derivative there. It's just g of x squared. So as you square the original one, that usually is pretty easy to remember. The part that you have to watch out for when it comes to the quotient rule is this minus sign right here. There's a subtraction going on. And when you look at the numerator, it's like I got g of x times f prime of x times f of x times g prime of x. And so when you look at that expression, the gf prime minus fg prime, that looks a lot like the product rule we saw before. It's like, okay, I got it. You got one factor times the derivative of the other and then you have that other one times the derivative of the other. That's similar, but unlike the product rule because sums and products are commutative, you can mix things up and it doesn't really matter too much. But the quotient rule is going to be a big deal. If you move this minus sign, that'll give you the wrong derivative. So who do we take the derivative of first and who do you take the derivative of second? We have to pay attention to that. Well, one way of remembering it is whoever was on top, the numerator, you're going to take the derivative of it first. And then who's on the denominator, you take the derivative of that. So there is sort of like an order to it. Like the top has a higher priority, so you take its derivative first. That's one way of remembering it. Another way is to think of the following poem because honestly for me, I mix these things up all the time. Even after keeping calculus for many, many years, I still remember the nice little poem I learned when I took my first calculus course. So if we write things a little bit differently, right? So we're going to write this as g of x and then instead of saying f prime, I'm going to say dx of f of x there. So d stands for derivative here. So we take g of x df and we're going to take fdg. That's going to do where the denominator stays the same. Why make that modification? Because then with that modification, you get the following little couplet. It's a poem for which we're going to say low d high minus high d low square the bottom and here we go. So you can leave once you have that correctly. So what does that mean? Low d high. So the function on the bottom is clearly the lower one. The one on the top is the higher one. So we read that as low d high. So you're going to take the denominator function times the derivative of the numerator. So low d high minus that's fairly straightforward. And then you're going to end up with high d low. So you take the numerator function times the derivative of the denominator function. So that gets you the correct order you want. Low d high minus high d low and then square the bottom. Here we go. You need to square the bottom. Why do we say here we go? Well, it rhymes with low. So we make sure we get things in the correct order. So say one more time low d high minus high d low square the bottom. Here we go. If you remember this poem, then you'll remember the quotient. Well, that'll be very helpful to you in the future when you have to do this. Now, if you're like me, you can put this. You can put this poem to a song to music if you prefer me personally. I think like the the square kind of makes me think of a square dance. So it's kind of like low d high minus high d low square at the bottom. Here we go. You can of course choose whatever tune is appropriate for you to remember it. And so this is a very common poem to help people remember the quotient rule. Less common is the second verse to this to this song here, which goes something like the following high d low minus low d high square the bottom. Now you die. So you want to remember that one because the thing is, if you mix up the first line that makes this messes things up. That's the part that we have to look out for. So you have to make sure that low rhymes with go. On the other hand, high rhymes with dies.  That's the long the wrong quotient rule there. So unlike the product rule, I'm not going to actually prove the quotient rule at this moment. It turns out that when we equip the product rule with the chain rule, we actually can prove the quotient rule quite easily. And so to avoid a cumbersome proof, we're going to do that later. So right now what I want to do is actually apply the quotient rule to compute the derivative of the rational function 2x minus one over 4x plus three. So the high function, of course, is going to be 2x plus minus one. The low function is going to be 4x plus three. So if we want to compute the derivative of f of x, think of the poem here. We're going to get low d high minus high d low square the bottom. Here we go. We always have to do the second half of the poem so we know that we are doing the right one. So it needs to rhyme correctly without death, of course. So now we've put everything together. Now we're going to try to compute some derivatives for which the derivatives are going to be simple enough with these ones. The derivative of 2x minus one by rules we've already seen would be two. The derivative of 4x plus three is just going to be four. The derivative of linear function is just a slope. This then sits above the 4x plus three squared. So the mistake that students make the most often when they use the cultural, they mix up the cultural, the negative sign gets in the wrong spot. If you remember the poem, that solves all of your problems. The other thing I have to caution you about is when you look at something like this, temptation comes upon many of students at this moment where they're like, ooh, I have a 4x plus three. Ooh, I have a 4x plus three. I can cancel them out and I've simplified it. No, no, no, no, no. That's not right at all. Notice if I did something like the following. If I take two plus three over two, the temptation is like, I'm going to cancel out the two. I'm going to cancel out the two. This is equal to three or one plus three, which equals four or something like that. Neither of those is correct. Notice, of course, two plus three is five over two is it would be five halves or 2.5. Notice 2.5 is neither three nor four. You can't cancel terms across a fraction bar. You can only cancel common divisors. So if you had something like three times three plus two all over three, then by all means cancel the three. That's okay. The advisor can cancel on top and bottom, but not just a common term.  So the temptation to cancel the 4x plus three right here is going to be very tempting. Do not do it. That's not an acceptable cancellation because after all, if we could, if we could cancel something like that, think of the quotient rule formula f of x times, excuse me, g of x times f of x prime minus f of x times g prime of x all over g of x. If you could always unilaterally just cancel out that g right there. Why would we not just do it right here in the formula? Have a simpler formula. Why would we use a formula that always simplifies up because it doesn't. So watch out for those things. Okay. That's that's that's a very common mistake with these type of things. So what we're going to do instead, you know, we're going to do like like what I like to call the right way is we're going to distribute this to we're going to distribute this for so that we can combine like terms in the numerator. We're going to get an 8x plus six. Then we're going to get a minus here an 8x minus four. Do make sure that minus sign distributes on to all of the pieces in the second part, right? This negative sign is inclusive here. So you're going to see that there's an 8x minus an 8x. They're going to cancel each other out and that'll leave behind a six from the first one and then you're going to get a negative negative four. So that's actually a positive four that combines to give us a 10 over 4x plus three squared, which is then the derivative of this function using the quotient rule that we just learned about. With one last example, let's find the equation of the tangent line to the curve given as y equals e to the x over one plus x squared. And we want to find this tangent line at the point one comma e over two. You'll notice that if we take the x quarter to equal one, we're going to end up with e to the first over one plus one squared. One plus one squared, of course, is two, so we end up with e over two. So that's the point that they're given right there. Now recall that to find the equation of the tangent line, we have to use the formula y minus f of a is equal to f prime at a times x minus a. We're in this case, our function is f of x right here, right? So the a coordinate that value is given us a here is going to equal one. So we can plug that into the formula and go with it there. We're going to get an x minus one like so. And f of one, which is what we would be computing over here is already been computed for us as well. That's going to be this e over two that we need to compute. So what's left for us mysterious still is the f prime at one. So we need to compute what that is. That's going to be our goal at the moment. So let's compute the derivative of the function f using the quotient because it is a quotient of functions going on here, right? We have this f of x equals e to the x over one plus x squared. The quotient rule is necessary for the derivative here. So we'll compute it using our poem here. So we get low d high minus high d low square at the bottom. Here we go. And so we're going to take one plus x squared and we're going to square the entire thing, which really we're going to leave it factored. So it won't be too much of a consequence for us here. So recall that when you take the derivative of e to the x, it's equal to its own derivative. So the derivative will be itself e to the x. So we get one plus x squared times e to the x. Then we're going to subtract from that e to the x times when we take the derivative of one plus x squared, the derivative of a constant is going to be zero. And the derivative of x squared is going to be a two x like so. This all sits above the one plus x squared quantity squared right there. For which if we wanted to, we could simplify this a little bit more. Notice that there's this common factor of e to the x. I'm going to factor that thing out of this expression. And so we end up with e to the x multiplied by one minus two x plus x squared. This sits above one plus x squared quantity squared. And it turns out one minus two x plus x squared that actually does factor. That's going to factor as a one minus x quantity squared. So e to the x times one minus x squared all over one plus x squared quantity squared. So we can't really, we can't really simplify the fraction in more than it is, but this would give us the correct derivative. Now our goal is not to find the derivative per se. We're trying to find the tangent line, which we know a specific slope. So we found the derivative dy over dx, but we need to evaluate it at the value x equals one. Or in other words, we're looking for f prime at one like we said a moment ago. In which case if we plug in x equals one into our function here, we'd end up with e to the first times one minus one squared all over one plus one squared. For which we simplify this, we end up with e times zero over, we're going to get a two squared, which this is all just going to equal zero. This tells us that the slope of the tangent line here is zero. It turns out that x equals one, we have now obtained a horizontal tangent line. So let's erase this and insert our slope of zero right there. Well, anything times zero is going to give us zero. So we have a y minus e over two is equal to zero. To solve for y to put it in slope intercept form, we're going to add e halves to both sides of the equation. And we end up with the equation of the tangent line will just be y equals e over two. And again, we see that this is a horizontal tangent line because it has the form y equals some constant.


Yeah, I can do that. OK, so we've got 43 slides, 10 minutes, no problem. OK, here we go. This is a very speculative talk. It is not a product we have built. It is just an idea. It's not specifically E-Life. It's an idea that we encountered in the last few months. And I think this community has something which could really contribute to this. So a talk called Threads. We even get the scholarly text, literature, using an annotation-based approach. So I'm going to talk about the ideas. Essentially, could we build a storify for science? I'm going to tell you where the idea comes from, why E-Life is interested in it, what we've done heading in that direction, what problems there are with the idea, and what happens next from our point of view. I'm here to ask you how you think it should be built, what the problems are that I'm missing, and would anybody be interested in doing it? But that's why I'm here, basically. So one of the problems is science sucks at getting better at doing science. Essentially, since the 1660s, we've been stuck with the same method of communicating with each other since this guy, Henry Oldenburg, invented the academic journal on peer review. Scientists have adopted a few improvements. Email, PDF. Now, PDF, I think you could think of as being a very lightweight version of paper. It doesn't weigh very much, but it provides you the same affordances as paper. It's got durability, readability, printability, annotatability. I think that's one of the reasons why scientists haven't moved away from it as much. And if you look at the kinds of tools that we've built to try and replace it, they kind of suck, too. So that is one of the reasons why I think many researchers don't read articles that much online. But I think that we're missing a big trick by not utilizing the web to communicate science as well as we all know in this room that we could. And so threads is an idea which I think has the potential to help a little bit, just a little bit. So where did it come from? There was a research project which landed sometime last year called the ENCODE project. I'm not gonna talk about that at all, but I'll just point out that it was a big project. 3,000 experiments, over 400 authors, and they, in the end, published six high-profile papers and 35 companion papers. So you kind of can, that they were all published at exactly the same moment. You kind of think of these papers as a flotilla of papers wending their way through the peer-review system and then they all landed at the same time. Some of them had to get it re-reviewed and they waited for them and then they caught up and then they landed and it was this big publishing event. And they wanted to do something really innovative around that. And they had these three innovations that they were looking for. They introduced interactive figures, they provided a virtual machine with all the analysis and then they did this thing. It's almost a side thought called threads and it turned out to be really popular with them as researchers and with readers. So what is a thread? Like I said, it's like a store for science. You take articles, there's three articles there with components. You pull out components and then you just publish those components in their own individual, new published object. This is the thread. And they built a very nice web interface with nature. So you see on one side is the left side. Left side, you have the 13 curated threads that were curated by the PIs. And one of the ideas here was to try and bring a relationship between those key papers and the supporting papers and show what that relationship was. So you click on a thread, you go to a web page and you've got on one side the blob and on the other side the provenance of that blob. They thought they didn't need to peer review the thread because all of the components came from peer reviewed articles. But how do they do it? The way they built this is they got the PIs to cut and paste sections from the submitted manuscripts or the peer reviewed manuscripts into a Word document. That Word document was sent to editorial staff at Nature who then checked that the text in the Word document actually matched the text in the papers and then it went into production and then it hit the web page. So the idea is a great idea but the implementation could possibly be improved. I think one of the other interesting and compelling things about the threads idea is often researchers actually build papers from the inside out rather than the outside in. So you often get, particularly in the biomedical literature, you'll get people who start with their three figures and then build out the rest of the paper from those three figures. So if you think about a threads kind of way, it's sort of gross, gross annotation. So at a very broad level. But if you think about it, it matches the way that many researchers actually think about how they interact with components of literature. So it has this sort of immediate affordance of working in the way that people like to work. So why am I interested in this? Well, this guy, Ewan Burney, who's the Associate Director of the EBI in Cambridge gave talk in January to the Eli staff, to the Plas staff. He was involved in those innovations I mentioned earlier. And he basically pointed out that in order to make those threads work, all of those publications have to be made CCBI because of the remixing that happened with that content. And he said, it was his first experience as a scientist where he saw the value of electronic publishing over print publishing, the whole process. And he said, you guys, as publishers, as open access publishers in particular, this is what you should be building. And I liked the idea. And at Eli, we liked the idea. And the reason I'm standing here today is I think this community could build this idea pretty cheaply, pretty quickly. So building a thread gives the overview of the topic to the person who's doing it. It could give credit to the composer of the thread. The readers could benefit from well-constructed threads. They're easier to create than review articles. They explicitly show the upside of open access content. I think one of the gaps of dismissing with CCBI content is we don't have compelling use cases that would make researchers think that they ought to publish their articles as CCBI. If threads became a compelling tool that they were using, that might help with that process. It might be great to not have to do this in word, just a thought. So why is Eli interested in this? Well, we are supported by three of the world's largest research funders. I'm not going to talk about Eli in great detail in this talk. I'll just say we have three areas of concern that they have told us that we should be going and looking at. One is to help early-stage researchers. We've got two young people who went on to become two of the greatest scientists in history here. We want to help people who are at that early stage in their career and help those become some of the greatest researchers in history going forward. We want to promote open access and we want to innovate, which from my point of view means having lots of coffee. So we think that the threads idea is an idea. How much time does that mean I have? Oh, I've got loads of time. So we're looking at a number of product ideas that could help with the innovation aspect of our mission. We are going through a process of looking at threads as a potential product. We are trying to do an analysis of how we could get involved in helping with that idea emerge. We're doing a couple of things on the technology side, which made us think initially, actually this might not be that difficult to build. So I'd like to talk to you, I spent two minutes just talking about some of the stuff that we're doing on the technology side that made us be interested in this. We're currently creating an API into our own content using a system called Fluid Info, which is a key value store. We're creating objects in this database and you can query over rest any of the metadata from our articles. And it returns a nice big long JSON blob. And essentially what you get is this key value set, but you can create any key value pairs with any attributes in that data store. And so we thought actually, a thread could just be a bag of metadata in this data store, which we're already running with, which is quite nice. So you could see how that could potentially be something that might work. You can get information about our API there. We're also looking at a new way of thinking about how the underlying XML of an article has these intrinsic relationships, but they're implicit, they're not explicit. We're trying to figure out how to make those relationships between bits of an article explicit, expressive. So we're converting XML currently from our published articles into a JSON blob. And so this is where I was thinking about threads as potentially being something that could be done through an annotation approach. This is the JSON that we're creating. It has these indices of the pieces of the article. You look at the nodes of the article, and then you look at the annotations which ties some of those nodes together. And so it allows us to create a view. This is very experimental at the moment we think it could work in peer review. I'm just gonna switch to here. So this is kind of a demo of this viewer. If I look at a section of text on one side and I highlight it like so, I can see all the figures that that section is referring to on the right. If I highlight on a particular para here, we see on the left, we see that this is the one reference that's relating to that paragraph, but that reference is also relating to this paragraph up here. And that's by atomizing the XML and looking at the XML's set of relationships between each of those pieces. If we thought of threads as just being more of those nodes, you could possibly think about how you could build it using this kind of system. So back to my talk. There are some problems for people. How do you make the system easy to use? Most still use paper, many still use paper, most still use PDFs. What would be a sufficient volume of content to provide value with this tool? How do you get the researcher to care that you've created this product? How would you find worthwhile threads? There are technical problems to overcome. Going from a DOI to the underlying XML is not trivial. That's how we thought we might approach this. XML is not uniform anyway, sad face. No workflow tool will integrate today, like Mendeley, Zotero. If we turn around to those guys and say, hey, do threads, they'd be like, yeah, we've got all this other stuff that we need to do as well. Where would we store them? We don't know any of the answers to these sorts of questions. Well, we know some of the answers, but we don't know many of the answers. So our next step is we're gonna go back to the EBI, talk to them a little bit about where they see the potential for investing in the idea. And I'm here to ask you guys how you think it should be built, what problems were missing, and would you be interested in helping? And that's my talk. Thank you.


Welcome back to the AI for Good Global Summit here in Geneva, where I'm now joined by Stefan Germann, who is the CEO of the Fondation Bottner Swiss Space Foundation. Am I correct so far? Absolutely great. Okay, it'll go downhill from here. But anyway, tell me, people who don't know, what is the Bottner Foundation? So Fondation Bottner is a Swiss-based foundation that has a strategic focus on how to leverage AI and Frontier's digital technologies to improve the health and well-being of young people, specifically adolescents. And then most adolescents today are living in urban settings, so we have a particular focus on cities, young people in cities. But I thought that cities in particular are the privileged ones. They're the ones who actually have the doctors, who have access to hospitals and healthcare. It's more of rural areas facing the suffering. I think that's actually slightly a misconception, whilst there are issues, definitely issues in terms of access in rural areas and where digital solutions like teleprimary health or AI-enabled diagnostics will make a tremendous effort. There's major issues within many of the urban settings in terms of accessing. So even if you look within an urban setup, especially in low- and middle-income countries, a lot of people in the disadvantaged communities still struggle tremendously to access health services and a lot of the current sort of primary services are totally overcrowded because the majority of people, and they stated that up to 90% of people going into the clinical settings and seeing GPs actually don't need to go there in the first place. And that's where really the power of AI comes in in terms of physician support, in terms of diagnostics, in the space of self-care, pre-primary care, and then as well, primary care settings. You take, for example, the NHS in the UK. Even in the UK, they did a couple of years back a massive survey of millions of people who went into the NHS system, and about 90% of those would not really need to go if they would have adequate sort of information to take the right self-care decision or the pre-primary care decision. And what happens then is that we are burdening the very sort of stretched health systems and the limited resources with things that really don't need to be dealt with. And that's where we sort of see tremendous power of AI. And so we just had, we are a partner of the AI for Good Summit, and we had a partner's workshop this morning that's still going on whilst I'm here. And it focuses on how can we use smart AI and integrate it into community health systems. And the key is really integration. At the moment, one of the problems is there's a lot of fragmentation. We have a thousand and one apps that is sort of trying to build in machine learning at the back end, but it's quite fragmented. Of course, people are listening to what you're saying now and say, Oh, actually, you're finding solutions to make health care even cheaper, because you're not if 90% of the time they don't have to go for a checkup. I mean, the administrators of hospitals will go, This is great news. Exactly. I mean, there is a cost factor. However, on the terms of the tools to actually measure the cost effectiveness, specifically in the digital health space is still quite weak. One of our panelists is from the World Bank, and they are actually working at the moment together with a group of donors in the digital health space, looking at what is sort of the methodology to establish a return on investment for health related digital solutions. That's absolutely critical because if I'm the Minister of Health, let's say in Zimbabwe, you spend a lot of time in Zimbabwe and health. And I know sort of what I buy with one dollar worth of antibiotics, but I don't quite know what I get with one dollar worth of AI or digital health. And so I think to really get that to scale and to have public money starting to invest into AI solutions, we really need to invest in finding ways to get a good sort of sense on the economic benefit of it. I think also just having talked to other people who are in the health care area of AI, you have to harmonize all of you together, right? Yeah. Now, there's a lot of issues, especially on the data side, but there is actually a grouping now for, I can't remember how many, but more than a hundred sort of actors globally that have endorsed the principles for digital development. I'm on the advisory council of this effort on principle of digital development. These are nine principles, and some of them are really about the interoperational ability which has to do with the question of harmonization. So on the data side, and I think people underestimate that AI is incredibly data hungry. But if we look at sort of the future, let's say 20 years from now, what is happening at the moment is sort of three convergence technologies. The first one being a data explosion from social media to wearables, clinical data, genomics, geospatial data, environmental data. Huge explosion, all having to do with health and well-being. On the other hand, we have increasingly sophistication of AI technologies with natural language processing. We'll make advances in deep learning. And then in the next 30 years, we will see super computing, maybe one day even quantum computing, which is 100 million times faster. So put that together. We will have for the first time in human history an unprecedented understanding of well-being. However, the big issue is data and data governance. And unless we get together as a global community and figure out how we deal with health data governance, and as a foundation, we strongly believe that health data should be a global public good. Okay.  Has it been worth it? Absolutely. Now, I mean, if we take sort of, we've been here now the third time, and it's the third time it runs. And I must say, I mean, it was great to start with. But this year is like really in terms of not only a number of people, but as well in terms of substance of the conference has been phenomenal. And we definitely will be here next year again, and probably step up our engagement with the ITU. We just became actually an affiliated member of the ITU, which is good news, the Swiss government who needs to approve these affiliation for, if you're a Swiss entity, just approved that last week. So we're really pleased to work with the ITU on that. Okay. Well, that was Stefan Germain of the foundation, Portna CEO. And from what he just said, he'll be back here next year. Thank you. Thank you.


this arrived in the late yesterday's mail it says here it's from something called black box which which means I know who it's from and what it's for but I don't know exactly what's in the thing there Mystery Science Theater 3000 this is from the MST 3k revival Kickstarter that I donated to some time ago but again I don't know what precisely is in the box it's like postcards well yeah it says right there postcard set postcards we have here one two three seven eight nine ten eleven twelve twelve it looks like okay I guess these are reproductions of the cover art for the DVD releases of these Puma Man radar Secret Service Warrior of the Lost World Manos the Hands of Fate Dadio final sacrifice Master Ninja 1 laser blast Santa Claus kitten with a whip final justice danger of death ray looking at the backs of these the they have these black and white screen caps okay there's Torgo Dadio all right there's a roused hour okay I recognize his face but I can't can't name the character this Santa Claus of course Mitchell knows final justice these are these are okay I guess I'm not that jazzed about them the the edges of the cards are crude like they've been hand-cut with a with a paper cutter anyway there we are the bring back MST 3k postcard set see you next unboxing whatever that might be


So, question from Twitter, Mafuja Parvin, who asks, what specific programs are available to help young science and technology entrepreneurs succeed? So, each of you can probably share some insights or some key programs that you participate in that are great for science and technology entrepreneurs that would be great for Mafuja. Okay, so, basically I participated in GIST's Tech Eye competition. It's a yearly program that holds alongside with the GAS. So, it's open for science and technology entrepreneurs. So, you must have something very innovative and that has a good impact on the society. So, you can apply for it. It's every year and it goes wherever GAS goes. So, that's one of the programs.