Hello again So I was supposed to talk about Navigating buddy presses identity crisis, but we talked about that already sort of this morning. So What do you want to do in buddy press? So it's funny you mentioned that There are two people that are actively pursuing this Bronson quick and Ryan Fugate Ryan has Works at Web Dev Studios has been like on a rest API for buddy press for years at this point He has some scaffolding on github to just like Block out endpoints But nothing maybe activity streams he had kind of has some stuff in there My direction for them is to just Figure it out. I mean it's kind of a terrible direction, but it's there is so much that has to happen and a lot of The functionality that's in buddy press today is Largely criticized as being inspired by What you see in the theme versus what data you might actually want out of the functions themselves So if we need and we will eventually have to have some sort of restful api in it but what that looks like and how we choose to expose that data is Currently not dependent on anything Right, so it was easy when we were building buddy press to say okay Well when you're viewing a profile what do we need to get out of the database? We need Groups of fields and fields pretty simple, so you have a schema Database you map out what an object looks like you Create your crud methods to interact with it pretty simple But when you're publicly exposing that data to an endpoint that is meant to just be Spammed basically get get whatever you want from it is Different so The logical thing would be to take the functionality that we have and just one to one map it over And that might be where they start Because it's easy it gets us someplace because we are no place right now, so I can experiment and The other part of it is Largely how do our current users actually interact with a buddy press installation and it isn't Generally with some sort of Single-page front-facing, you know react-based application It's wordpress themes or buddy press themes wordpress themes that have buddy press support are already complex enough without introducing an additional abstraction layer of requesting Data for every point that you might need it to or from so is a lot of work and We have so far Avoided doing that work But if you want to do that work or help us figure out what that work Might practically look like in reality Now is a awesome time to come in and heavily influence the direction that those things should go We spent a lot of time looking at what a what everyone else is doing Facebook Twitter Path every weird social network and what GitHub what what things look like and what you get back out of them and It is an interesting case study to see just how Much or little is exposed Publicly and what those switches look like even in the settings the screen for something like github Where you've got private repos and you've got you can get can't really get repos for a user But you can loop through and like get a bunch of stuff, but not everything How do you really truly calculate and expose that data and the same goes with Profile fields visibility groups that you are a member of groups that you have requested membership to Should I be able to see the groups that you have requested access to or not? I mean right now I can't but if I can grab your end point and I am not logged in as you We have to make a bunch of decisions about what it is that we have actual access to and WordPress this ends up being Mostly flat because you have very blog-based post-based roles and They're the concept of a private post or post visibility does not really Totally exist we have post status, but that is it post visibility We have the status of publish draft we have private but Status of visibility are kind of two different things. I can have a draft post that should be private But WordPress doesn't have a column for post visibility So how do we take what we know isn't necessarily right in WordPress or could be better and then map a lot of those decisions to Public and openly available restful endpoints in buddy press. This is a lot to do and We I don't want to call what we did with early days or with buddy presses code missteps So we made like lots of happy accidents that worked out really well For example Most of buddy presses core components code wise Started off as objects. There were all very object oriented approaches towards activity streams individual activity posts Loops that you would get were already loops of objects that were individual activity stream items For scalability reasons rather than just have one flat post parent column We use MPTT so we can sort of get the breadth of an infinite depth of activity stream items So unlike with comments where you have to nest your replies like 10 deep and then it starts to scale really terribly we can sort of scale infinitely until We have to recalculate the whole tree doesn't matter ignore that but We have some other funny considerations when it comes to rest API That are not Unique to buddy press, but they are far and above unique in the word press Think of I We all hate on Facebook I Think we shouldn't because they are a team of engineers that do really awesome stuff and open source a bunch of stuff And they are built on a similar platform that we are built on See when you consider PHP largely my SQL Trying to do elaborate intersections with users and friends and friends of friends And maybe their profiles private and maybe they're they have a lockdown and maybe they don't Maybe they were in a group and they posted in a group one So you can see some stuff but not others and like how long ago did they request your friendship? But did you deny it but now you can see some of it But then their photos are public and private like the intersection of objects and privacy is huge it is an enormous graph and We can criticize them for privacy concerns and for messing it up and for making it really complicated But it is complicated and they do a decent job of boiling all of that down into a way that doesn't Openly expose everyone's I mean millions and billions of people's photos and information just openly to the web So that's really why buddy presses Skipped privacy completely because it's just it it's intimidating. It is a large amount of things to figure out and So it's a cart cart before the horse before the cart. Do we build restful endpoints and then? build privacy on that or do we build privacy and build restful on top like which which which one would we want first and why and A long time ago actually an old contributor We did we just I just refreshed the about page on buddy press the org So the about page used to just be about buddy press like where we're a plug-in for wordpress de-de-de-de-de and So we added the column on the far edge to sort of outline who is behind the project itself and The Sort of our alumni developers that we've added here Andy pealing being sort of the lead original project lead engineer went on to work at Automatic works on wordpress.com responsible for a large portion of calypso that they open sourced and everything Pete wings brilliant super good guy But jeff seyer Wrote a plug-in of very complex BP privacy plug-in that would have been the Alternative for buddy press core if it was going to be the thing that we would roll in for privacy and that was five years ago and Just to a point where is this a thing that everybody press installation should have? Really is it a thing that the majority will want We have friends in here and a majority of people don't want it. So is privacy in there as like the next possible thing? Sure, I mean that code is still there. It's still good. There's nothing wrong with it It just wasn't the direction that we took back then and so that code is still out there. Jeff is still cool and Even though he has moved on to other cool things that would be a potential thing Bert adds it even Haven't really talked or thought about Bert much in a long time, but he I Really in the early days before buddy press was ever single site before Wordpress had the big merge between multi site and single site He did a ton of just bizarre buddy press experiments with like taxonomy tables and global shared meta and like Just things that would have enabled things like privacy to be a little bit easier for us And to this day we still have a ton of like pre-existing Code and experiments that we can learn from when it comes time to implement something that would be restful I was talking a little bit about at lunch where The thing that is fascinating to me about a rest api with buddy press specifically is it would end up exposing a lot more of the Simplistic or sort of application this of buddy press where right now plugins and themes They are they are part of wordpress php just includes that file and you are on the metal with the rest of wordpress You are intertwined into actions and filters, but on a rest api You have an end point wordpress sort of loads it up spools itself up It pulls in what it needs to and then you're responsible for handling that end point on your own Wordpress is going to handle its own for core objects like posts and users and taxonomies and stuff But for buddy press data our end point is literally okay. Well now that you're here How are we grabbing our own content from our own database tables in our own way to then spit that back out to a user? So rather than it being this integration deeply with a theme or with wp-admin and looping into meta boxes and Trying to display things and escape it and sanitize it and all this stuff that you're used to doing with wp-admin and working in that One interface is literally now almost a separate application. It just happens to hover on top of Wordpress's endpoint registration system. So from that aspect Because we have an almost unlimited number of directions that we can go with that data We aren't playing with it. It's the best non-answer that I can give I guess Does anybody want to help? Is that a thing that anyone in the room currently like super is on point and cares about that? We can have beers. I got nothing but time That would be cool it would be super cool we When we were building the first mobile version of flocks Build everything piecemeal. It was all of the restful endpoints that we have Were again, they were so closely coupled to what the theme at the time needed that it It was a learning experience about just how many endpoints that we would need to have in order to Get activity stream items pull to refresh to only get deltas on updates to figure out what your what the ranges that you might need for an activity stream Whether or not you want children whether or not you want how many levels deep worth of children in an activity stream item Do you want likes and favorites? You need user data for each one of those things because you have to get avatars forum user IDs Which means you have to go out and get every user. It's like you end up doing 50 restful requests to get user and user and user and user or whatever that The payloads are so bizarre That it was okay well We have we have confirmed that this is going to be as gnarly as we expected for it to be and hence we will Use what we have in a private way and then keep continue to learn what we can and try to apply that to What will eventually be in buddy press core? BB press on the other hand will just largely inherit what we get from custom post types and taxonomies because BB presses topics and replies our posts and Forums are currently posts, but they will not be for much longer. They will be a taxonomy They were it should have always been that way It'll be all of the code. I know this I know because I wrote it It like is a thing that I get excited about because no one else really knows But all of the forum code that is in the current version of the bd press plugin Is designed to be gutted out and replaced by taxonomies Because a lot of what's in there is a terrible compromise of like a Post type on top of a post type hierarchy to walk a tree that doesn't really exist. It's really terrible Knowing that taxonomy meta Was going to come and save the day eventually and so now that it has landed in but in wordpress core We can take all of that heart for forums out And make forums a taxonomy for topics and replies And then we can count topics and replies easier because we know what forum that they belong in Whereas we didn't previously and we had to crawl this it was terrible So bd press will get cool updates eventually And then the rest full end points will just be what custom post type end points at wordpress provides The buddy press is more more difficult Funny that you ask that actually So because it is inside of wordpress We largely use the tools that every other person would use to do any type of Look up on queries or performance or cache hits or misses The debug bar plugin does a really good job of giving you a ui. I think There's a query monitor plugin. There is a specific plugin that we'll use just just to Uh give us a convenient ui for What database queries are actually happening and did this actually hit the cache or is it any better? Some things like anything else we Way the pros and cons We will introduce things for wordpress for parity with wordpress like meta queries or Like loose taxonomy queries where we know they're going to kind of be crappy queries But we want that parity for that object And then The The most popular caching plugins And i'm thinking like the memcached plugin by civil and rain boran Wp supercache batcache for full page output Um The batcache part of it we We largely avoid because most users are logged in so you're not getting cached full page output We have talked about and implemented some little optimizations in terms of just functionality to allow for Fragment caching to a certain degree But we don't have our fragments in a way that really makes it work all of our template parts still include so much Time-based markup 30 seconds ago five minutes ago someone requested you as a friend well You can't cache that output because five minutes ago is 10 minutes ago now so it doesn't work But we do have functions for essentially shove a get in the big output buffer And then giving you the option to cache that buffer and then putting it in place with a unique key if you want But There is or what came in a Potential security vulnerability not necessarily with buddy press but with an incompatibility with a caching plugin and that Dove me very very deep into Several caching plugins very popular ones to figure out. What do their object cache drop-ins look like? What are they caching? How are they caching it? When are they caching it? And then how is buddy press sitting on top of it and making sure that everything is going okay? And in that digging deep Really out of necessity Looked into building a tool to try and give me some of that data back out And so last week I published the results of that which is a plugin called wp spider cache And so this plugin not really too unique is Largely based on one a fork of backcache Some weird little buddy press specific optimizations and stuff for what that output might look like Some filtering of unique keys with bp underscore prefixes so that we can put Buddy press cached objects in their own buckets to make them easier to expire later or flush And then another drop-in for Object caching is based largely on board and civil's memcache drop-in A lot of the memcache specific stuff ended up getting stripped out so that you could potentially drop in readers or whatever else But None of that really is all that useful if you can't see what's in the cache And that's always really the problem that I have maybe just because I I'd like to the world is through and through I need to touch it so I can see that it exists And uh when you can't see what's you can't you can't verify that something is in the cache Like I can't see the cache and talk to memcache and get out what's in there Makes it very hard to validate that What's in the cache is true to the database or that there's something is it polluted or out of sync and then to be able to identify that This query has occurred and it actually did populate the cache when I wanted it to And that when an update happens it flushes it correctly and spits the right result back out so A lot of it in the code is very Straightforward you we know when to flush a cache We know when to write to the cache Because we know that these operations are just they are occur right this is the place where that needs to happen But uh scott taylor who is the wordpress 4 4 release lead Years ago wrote Uh the foundation of a plugin called johnny cache Yeah, uh and it was a very basic UI for memcache And it didn't really look very wordpressy Didn't really sort of fit in where it needed to fit And so with a little bit of polish and a little bit of buddy press on top of it to make sure that it would kind of look And feel the part Uh spider cache comes with a fork of johnny cache's UI to talk and see directly back and forth with uh with memcache so I hesitate to try and do a live demo right now, but you know if we were gonna try we may as well Ramp this back up So what you get is just a list of whatever memcache servers you have registered of course you can have many or several Remote local whatever you've got and then uh What you'll get is Everything that is in memcached So if we were going to say, okay, give me what's in buddy press Here is beat buddy presses cached objects and groups So from here we can say, okay, show me what's In this it's going to probably die, but some stuff hopefully will work No, let's see live demo is probably broken but At least you get an idea of Uh What our cache groups are what our unique keys are And then which component what it all is and without I feel like without an interface to see the cache It's one thing for me to To query a page and then see what cache is hit and miss that's informative on a page load But if I want to validate that I got this Stuff and I put it in that bucket. I want to look in the bucket and see that it's in there, right? Like so without a UI I think You're you're caching stuff blindly and so The forks of three things come together make one plug-in put it out and call it a thing This I think was is really instrumental in Not necessarily doing what I think is the popular and obvious thing Which is writing a bunch of automated tests to put it in the cache check the cache whatever else for that We're just doing what everybody else does by a bunch of php unit tests that all just get dumped and ran and then Hopefully they pass right But this gives real world while we're developing while we're building something Touch and feel Without needing to necessarily write the test validate a test write the code Make sure the code works. Did it is it in there run the test suite again? That takes a while break it all put it all break it all down It is I can just I just want to see it give me give me something to look at This plugin isn't buddy press specific it works really well with Essentially like everything I don't know why everything is airing right now because that's just the nature of live demonstrations, I guess, but Yeah, that's terrible. I don't know why that is You know, okay, so that's working. So blog details works It's not very pretty right it's just a dumb text area with the contents of a memcache key values store, but Um You get an idea of What Ended up helping us to be able to see some of that stuff For us the caching improvements Were They're easier to add because they largely didn't exist Like we didn't cash a bunch of stuff we we didn't cash friends or groups or activities We just go get it you're logged in they're logged in probably or they were at some point the data You're going to want something as close to live as possible. Anyways, so for a lot of it There's nothing to cash. Give me what you give me what is in there and I and that's it So now we have strategically looked at objects and queries and when we can flush what's in there a little bit more Accurately Because we had built all these things as objects Then all the crud actions are the places where we can Put all the cache purges and get some deletes. So Yep easy easy to do because It it's not like we were making it we weren't making the caching better. We were just adding it finally and on some of this stuff too Was pretty heavily dependent on Some multi site improvements to wordpress A long time ago we made the decision to Maybe let me take a step back Because buddy press can run in so many different environments and installation types. It might be multi site If it's multi site, it might be in an mu plugins folder, which means it's always included It might be In your plugins folder and network activated, but you might have multiple networks that it could be activated on or not In that case, is it running globally on the entire installation? Meaning the database tables are global database tables Like multi site global like database tables would be Or is it running on a site or a series of sites where those tables are not global There's like all of these permutations and Originally we stored all of our configuration settings In wp site meta because it was supposed to be multi site only And they were going to be site options and then When the merge happened Wp site meta or like wp add Wp get site meta get update site meta If you're a single site, but you call get site meta It'll still work, but it'll default to the only site that you have So you can call get site meta on a single site install and it will still work So then it was like okay well we can If your single site and buddy press is installed Then we'll store the data in the root blog of the installation because what if you switch from single site to multi site We're not going to migrate all the data to It's like this is so stupid It's like it was impossible to try and navigate how this works. So we Actively decided to move and migrate all of our site options Into the root blog or the main primary blog of a multi site install So regardless of what site on a multi site installation that you're on Buddy press switches the blog id one or whatever the primary define is Gets buddy presses options out of the cache or out of the object cache And then switches back to whatever site that you're on and continues doing whatever it's doing So we had to wait for a bunch of caching improvements to switch to blog Before we could really go down that road of storing options that way Because otherwise every time you'd switch from site to site to site Wordpress would query the database directly with a completely uncached query to the blog's table to get blog look up data To then get the meta so that it knew what site to switch to So if we wanted to switch three or four times Uncached query uncached query uncached query and there was a while Well while we were doing it buddy presses like a thousand queries like Wordpress.org is freaking out because we're trying to you know Make it work right and then it helps identify these little places where wordpress can get better so Like along the same lines of where we're talking about The idea of using custom post types for stuff and even like david's example for conferencing Which i know he likes to like talk down about like it's not cool, but it is pretty cool Uh all of him like all of his like pulling in tweets Pulling in photos storing them and like extra invisible sites all over the place That's exactly what we would have done for buddy press core if we were going to have custom post types Shove it somewhere just put it in a site make sure that those database tables Are going they're only doing one thing They're there for groups every time you want to get a group switch to blog groups get your group switch back Not that expensive anymore So what david's doing with just using wordpress sites for arbitrary data storage is exactly what we had talked about the And i i i talk about it Probably more than i should but that's Similar to the way that jetpack works jetpack stores a copy of your site on wordpress.com just in a different site See you never see it That's how it knows What your comments and posts and stuff are like it's the easiest way to just pipes your content back up into the cloud into wordpress.com's Big cloud of servers so it can serve your content for you It's not grabbing your post from your site every time it shows up in someone else's dashboard It's pulling it from the place that it can it caches your posts locally so it can just deliver them more quickly So we could eventually see buddy press broken up You know a long enough timeline right into components that store data in different sites and switch around to get that data in optimized ways so Trying to think of anything else that might be neat sure so I touched briefly on it right at least joked about it earlier where The In order to do that we need to rest api but More and more java script goes into the theme side stuff and every iteration of buddy presses template pack the default templates that are in there Largely because it is an expectation of users to have things happen without the page refreshing when it comes down to Javascript deeply or integrating or using it more For us today It mostly just means a hybrid style theme. It means a theme that You are rolling your own restful endpoints or you're rolling your own ajax endpoints Maybe you're using mustache or react or angular or framework seven or any ionic any of the other popular things But you're still digging into php You're still writing something to get you the data that you need to get that list of activity streams or users or whatever And then you're ducking back out with a template part to spit it back out on the page That's what that means today It should be better. I guess I'm I'm old school. So if you if you want me to separate my personal opinion from the direction that I think Buddy press should go Sometimes those are two different answers Because And I guess I've got time right one of you up 15 minutes Okay, good. I've got more or less. I've got I've got 10 minutes for a rant then Yeah, uh-oh so Here here here is my problem with this Is If this has a name Someone tell me If it doesn't we should give it one today Because Like Every time like my apple tv Is terrible with this with netflix with the photos app with the music app with the movies app every app At one point had made a restful request out Got something and then cached it locally on the apple tv I will switch out of netflix and go to music It will show me the cached version that is locally of whatever images that were there I can still interact with the interface. I can scroll up to go view my photos New photos show up because it made another fresh request and shows me the new content That sucks It is terrible. It does it for every app. It does it on the xbox one the same exact thing It shows up stuff out of the feed you load up a video game It shows you kind of the screenshot from where it thought it cached a screenshot from before And then you actually go to play the game and boop it's in a different screen in a different place And you're like you can still navigate it and all of a sudden the console refreshes It makes another request out and you're out of your game and you're in a different place Why is it like that? I know why it's like that but it's a terrible experience facebook is like You go to search in the facebook mobile app You search it types down you type somebody's name or whatever you're searching for the group It shows some results right away That you had searched for last time that were cached and then the second you go to tap it Here pop up some new results and you tap the wrong thing every single time And it's because we are building everything in a restful way That caches these results locally so that they're speedy But then your experience of actually using it is Terrible all the time we used to call it with fonts. What was the font one where fonts would take a second to load? the like The flash of one. Yeah, right. We have that with rest with like every restful app That's what happens and with a hybrid sort of solution or like an even native apps are usually terrible at it But the way that we use the web Maybe maybe whether or not it's right or wrong. We are used to Something like you click it and then maybe you get some crappy chunky load, but you're waiting For that result to happen. John has his hand raised, but i'm going to end my rant first and then it'll be your turn Flash of old data food. I love it food Flash of old data That's also good Food flash of what was it? flash of old data that's good because it's uh It is it is it is pandemic across every single ios or android app that you interact with And it's like the more data that there is is the worse that it gets if it's your music library if it's a photo like Like apple photos for me. I've got 5 000 or something photos and like the photos in the cloud thing that it is Not terrible except for on the apple tv apple tv It like has like some photos but not others and it's it's random totally random so my fear And whatever it is that we build for arrestful endpoints or for whatever a buddy press specific style mobile experience might look like Is not having that problem And i don't because i can't imagine a restful solution to that problem I personally not the buddy press project as a whole but i have a hard time really Being a hundred percent committed to like investing the time to build out restful endpoints to make these The middleware possible to make the separation possible Because i don't see a positive outcome that i would want to use And the outcome that i want to use because i'm You know getting getting older every day. I kind of don't mind the hybrid app model of like go out To a server get the output that i want get get cash query whatever you want to do Give me the part fully rendered that i'm working with And then plug that into the place where it belongs because that's what we expect that's we You know we're used to tangible remotes with buttons on it if that button Disappeared it's like having a bowl of soup or cereal and every time you dig your spoon in to get a lucky charm The lucky charms on the other side of the bowl Then every once in a while you go to take a spoonful and the bowl moves three feet over and you don't know why This is what we have worked towards We have invested like man our is techno like the best developers in the world are working towards that I think it's terrible That's my rant about what to do with that So in our experience, it's okay In our experience of testing buddy press on php7 it is okay We haven't It is okay because wordpress is okay if wordpress wasn't okay buddy press would not be okay because of the whole my sql deprecation thing We don't do anything real fancy in buddy press in terms of database queries or anything that might break outside of like wordpress's anticipated norms So we're okay. I know that The wp engine folks have had some issues with it, but I don't know exactly what those are so live stream phone a friend I guess let me know if I can help or what that is John has his hand up so that's helpful right yeah and so that So for the live stream no mem cached extension for php7 So what that means is any persistent objects that wouldn't have changed that you can save the load of having to go out and get You no longer get to save the load and you have to go out and get every time and so for buddy press Is a big deal because let's say you have an activity stream of 100 users that have posted and commented and If you can cash all of those 100 users because they haven't logged in recently cash them throw them somewhere never get them again When you have to get them every single page load You know everything is going to spike and buddy press is funny It is it is an anomaly in the wordpress world because everyone for largely stereotyping but Is used to dealing with heavily cached WordPress pages and posts Comments would be the thing that like screws up everybody's world occasionally, but we all hate comments now. So that doesn't even really matter When you when you're used to living in a world where you can dodge wordpress entirely Render the content throw it and varnish and never touch wordpress for that page post or page again Is a different world than what you live in with buddy press or with logged in users You log in and now you're not caching anything. So when all of your users aren't logged in or all of your users are logged in Your caching strategy is 100 totally different. So object caching is a requirement And persistent object caching would be a would be almost a requirement for most buddy press sites. And so without that You're you're waiting or you're using something else Am I wrong is my rant totally wrong? I feel like i'm vulnerable right now like a live stream in a room of people I know Sure Oh Again, I guess i'm i'm sort of old school I I have a tendency to just go as straight as close. Yeah as close to my sequel as you can go anything else is For like is for convenience sake Is to give you something pretty in a place to feel more comfortable about it But I would just dump it It's the same thing with like writing migration scripts and stuff like I get that like crawling websites And everything else is like fun and exciting and you get to do and learn and do neat things But even bb presses forum converter So steven edgar largely Built the current version of the converter and maintains it to this day, but bb press 2 Comes with Like a really sweet converter tool for almost every type of actively developed forum database schema And rather than it be this like go out and make all these requests to get data from endpoints And then pull them in and pour them over to post table and stuff to Whole technique is if this is your forum and you have ownership of the data Get the database tables on the same server Just run the queries and convert the data because it's your data And it will be fast and it will work very well and we can recreate indexes and stuff on the fly So that write queries aren't slow and we can prevent locked tables and everything like The tables are just going to be where it's going to be the fastest. I also like how like Who here has heard like apple like apple metal? All right It's like add their whole thing last year of like this whole metal like running close to architecture and making everything fast and stuff. It's like You don't write more code and more abstraction to make something faster It's just another tool booth in the way to get nowhere trying to go The only way to make it faster and get closer to the metal is to work Closer to the metal so The closest that you can get to to the database for dumping that stuff is the best you can do you end up very traditional though Master slave type stuff so that you can copy stuff without locking stuff copies that are already relatively live Maybe trying to have deltas so that you can keep something up to date If once it gets big enough you're going to end up probably doing backups off of A copy of master so that your actual master isn't going to Be in the way and get locked Nothing that I think would be anything unique to wordpress or buddy press specifically Relatively standard my sql optimization backup stuff Probably not the answer you're looking for there are awesome like there are like tons of awesome awesome wordpress companies that only Backup buddy iThemes guys have incredible stuff. There are awesome tools to do it Eventually though you just have too much data and you got to Do it the old school way These are good questions. I appreciate things. He's just fun And I guess I don't know how are we on time? I got one minute, but uh Yeah, so we were thinking about Trying to do a google hangout and see who of the buddy press Core development team we can get all in a hangout at the At the same time and So if you want to do your talk then soon and then I can See who I can wrangle You know, so I am also not on The wi-fi and I don't know if the wi-fi here is any better or worse. I'm just tethered to my ipad So Okay So that might be my thought is we'll use A machine that we know has been Trying true on the wi-fi then try and make that work Any other questions anything else anything I can help with or do or solve or say or I can be Sure That's fine Cool. All right, and even if i'm just Floating around then just grab me and we'll yeah, that's fine too You're welcome We actually have over uh It's awesome. Yeah, did that happen really? Oh


He's asking what is Fatima's Mas'af and who holds it? Yes, the Mas'af of Fatima brings about a lot of controversy because people assume when they hear the word Mas'af, they assume that it's the Quran of Fatima and that couldn't be further from the truth. After Rasulullah sallallahu alayhi wa alaah died as a form of consolation, a form of consoling Fatima to al-Zahra because of that sadness that had enveloped her, Allah subhanahu wa ta'ala would provide her through the dictations of the angel in the same way Maryam received from Jibra'il. Likewise Fatima is a muhadith and that this particular book, the Mas'af of Fatima is seen as being three times the length of the Holy Quran, three times the size of the Holy Quran. But it doesn't contain a single verse from the Holy Quran. Rather it talks about events that are to happen at the present and at the future and different types of knowledge which is given to Ahlul Bayt, and the person who helps us describe with this is Imam Ali ibn Mitalab, and this remains with Ahlul Muhammad sallallahu alayhi wa alaah. So the current holder would be Imam Mahdi.


So How many of you here are familiar with?  I've gotten so used to Google slides and here I am in PowerPoint So how many of you have heard of magic eye illusions? Only yeah fair amount fair amount so Magic Eye is actually a company and this is a trademark thing So but it turns out there's a free tool that you can use to build these for yourself So I use this free tool To create this particular illusion, right? So there's Images there's an image hidden behind this now I also learned that it's actually really hard to see these on a computer screen So if I'd learned that soon enough, I would have printed out versions for everybody to try and use yourself But you know when the slides are posted if you feel like it you can print And take a look it also turns out that not everybody is able to actually see the images that are in a magic eye illusion and That's because not everybody's eyes work well together and To see everything it's kind of a stereogram to see this You really need to have your eyes work well together and to have them work well with the brain and And I think of this as being really apropos for how we need to work together To deliver cloud native security, right? So we have to think from the security perspective That's really important and it is absolutely true that not all developers understand that And we have to think about it from the app developer perspective and the business needs as well And it's a balancing act. It's a risk management act to figure out How do I meet the business needs which include a good security posture? Well, also enabling the app dev team to do what they need to do and to deliver quickly so Also, there's this ever-expanding guidance that is coming at all of us You know NIST 800 190 that's been out there for a while CNCF open source to Kubernetes security audit in 2019 Awesome really great content and there's another one in progress, right that I hope we'll see in 2022 There's guidance from analysts like Gartner, right? We need to think differently about how we protect cloud workloads Especially since they're ephemeral and they move around as was noted, right? We're not we're not dealing with IP addresses There's the new executive order which has created this intense focus on the need to create software but bill of material and the way to create and and to improve security in your supply chain Again, some great talks yesterday if you didn't get to the supply chain security con Watch the recordings and then of course the NSA cisa guidance for hardening Kubernetes Honestly, it overlaps a good bit with the CIS Kubernetes hardening guide. That's great but it's a lot for everybody to absorb and When you kind of look at this and put it all together I do think that the guidance really comes down to the need for a dev sec ops approach to securing both the platform and the workloads that run on the platform Right, we need to control application security in the CICD process We need to protect the platform at deploy time the platform Ensuring that it's configured correctly Kubernetes is complex Also ensuring that you've got protections in place to check workloads as they're deployed and Then we know that we can't avoid every there. They're unknown threats So we do need that visibility that observability that we just heard about earlier to help us detect and Respond to runtime threats and part of that response one of the things I see kind of when I talked to people about dev sec ops I see a lot of emphasis on shift left, which is important But I think of that as dev sec right a lot of that focuses. How do I integrate security tools? Into my CICD pipeline There's sort of this assumption that sec ops, right? We kind of know what we're doing and yet It's really true that kubernetes and declare the declarative environment the fact that containers are ephemeral Even if it's a long-lived workload sorry you can That that where that pod is deployed can change right so you can never fix a running container You need to rebuild and redeploy Which really means that we have to think through how do we close that dev sec ops loops? How do we feed that information back to the development team? so Red Hat has done this survey on Contain on the state of kubernetes security and one of the things we hear and I've also actually seen it in survey results from IDC a lot of people Say that they are doing dev sec ops that they have strong death sec ops adoption now I think that that's true for folks who are more on the bleeding edge and I think that enterprises who are still in their cloud adoption journey May think they're doing dev sec ops, but they're really just kind of doing that shift left I've got vulnerability scanning in my CI process and that's about the extent of it So I think you know one of the things we really have to think about is how can we as a community? help organizations Demystify What they need to do, but also help and operationalize their use of cloud native workloads, but also kind of We're all here looking at a lot of different capabilities a lot of new tools and things that we can do to address these key requirements But that comes with its own set of complexity Right, so we need to be thinking about not just technology and tools We need to be thinking about process in people as well So how do we help ensure that that process is agile and how do we help the companies that we support? Future-proof what they're doing Think about solutions that can apply no matter where somebody is running Kubernetes or their container Workloads or their cloud workloads right a cloud can be on-premises as well as in public cloud providers so Technology people process all of these remain key and it's important that we think about the people in the process as much as the technology So some of the future investments again, I love this that this community is investing In many many different ways right when it comes to application integrity and that CI CD process The sig store project has just kind of exploded. How many of you are familiar with sig store? Right, so one of the things I love about sig store is how it makes it simpler for The tool chain to sign artifacts if the artifacts are moving through the tool chain most signing solutions That enterprises are used to using aren't designed to be work to be used in a pipeline It also includes a transparency signature log right the recourse so that you can check and make sure that and verify your signature Tecton CD chains again another way to kind of document and log how things have gone through the process Encrypted containers storing and running encrypted containers ads to The ability to manage application security and then rootless builds right there are many There are some build solutions that require you to have privileges to build that container image Be much better if you didn't need to do that, especially if you're running your builds on Kubernetes Integrity integrity for the platform. How do I attest the host the nodes in my coop cluster? How do I? invest in Things like Kubernetes support for username spaces This is something that you know, we've been talking about for a while. It hasn't been delivered yet And you know, there's still conversations ongoing about the complexity required there But most of the customers I talked to are looking for that additional protection Because it's really hard, especially in certain verticals as they move workloads to the cloud Some of them need privileges this this they aren't able to rearchitect everything to be truly microservice-based or cloud native And so in particular in telco as you see containerized native network functions delivered those often require the ability to for a certain level of privilege that is better protected with username spaces and Then also honestly one of the biggest attack vectors for any coop cluster is the cluster admin privs and This is a place where we don't yet have Genuine separation between the control plane and the data plane and this is an area that Red Hat's investing in and I Would love to see the community invest in as well With the runtime again deep observability as was mentioned earlier absolutely key and the ability to use that data That's collected to automate response to what you discover not just network policy Which is a great thing to help automate it confuses Our network security teams. How do they get visibility? How do they understand also? Automated response to vulnerabilities in the runtime environment and a better risk assessment, right? Are those vulnerabilities in pods that are actually exposed to the network or not? What's my level of risk so that I can really? kind of triage those things better and then So active recommendations really key And and again just that ability to respond We look to the community to help deliver on all of these things again lots of great work happening and I think one of our big challenges is going to be how do we help our customers our end-users? Operationalize everything that we talk about everything that we're working on have them work together as Us as a whole solution and how do we help them bridge? The silos that still exist Between the different teams security ops Aptev right that's that's a people thing that I think we should be thinking about as well so that's it for me, thank you very much and Not sure what who's whether we're we have time for questions or somebody's up next