100% hands down. There's a lot of cat fighting, which we will get to that. Are you guys back together? Are you married? Some things that are probably going to be controversial. Fight and flight, instincts, addiction, alcoholism, infidelity with the history of all of this stuff has been privated.  And who I am to him. Like, I get so emotional about it because grueling. I'm not gonna be, yeah, I'm not going to sugar coat it or whatever. And he's generally like, hey, let's go get dinner. Like, and he makes sure we have a babysitter and it's been a wild ride. First things first, if you are new around here, I love this one, Liquid Stevia.  I wish that Starbucks would get their act together and get more sugar-free flavors. So this is the stuff, it's so good. So welcome to this video. I am fairly certain this video is going to be extremely, extremely long, but that's okay because it has been a long time coming.  And to be honest, I've gone through phases in the last little while where I'm like, I don't want to be on camera. I go back and forth. So we're here. And this past week, I asked you guys for some Q and A questions across like all of my social media platforms on Facebook. If you guys don't follow me on Facebook, you can definitely do that. And on Instagram and on YouTube and some of you that follow me regularly may have kind of wondered why I even asked for Q and A questions because I have been super MAA on like a lot, on like Instagram, I haven't really been around. So I'm sure it was kind of like, oh, it's really random that she's asking for these Q and A questions whenever I haven't even been like on my stories and stuff, which we will get to that. Also, I have had so little coffee in the last month, like no regular coffee, totally off of regular coffee, which might be a shocker, but it's true. And this is actually a decaf americano with just a little bit of almond milk. And then I added my stuff just because it's cold and we're having a little chat and I wanted something warm to hold. That's so yummy. I love it. So you guys came through with the questions for sure. Like I wasn't sure if I wanted to do a just like chit chat kind of video, which I think I wanna get back to doing more of those. I used to do those like a couple of years ago. I did more chatty videos and I'm definitely heading that direction along with vlogs. It's going to be for this channel. If you guys don't know, I have two channels. This is like my main channel. And then I also have a home related channel where I do lots of home organization and try to convince you guys that I have an organized house. So. But this channel I am going to be posting a lot more on. And it's going to get a bit more real. That's the word I wanna go with. I could put a lot of words on it, but I just want it to be more me and I'm ready. I'm in that position to just share a little more of my life and that kind of thing. But so I wasn't sure if I wanted to sit down and do like a chitchat video. This video, like I said, is going to be long. So if you want to grab a drink, it's going to be a minute or an hour. Not sure. Hoping I cleared off a lot of space on my camera that it holds out for me and I don't have a dead battery and all of that. So I debated on just doing a chitchat video, a chitchat video, which I did do one a couple of months ago, especially whenever I started changing the direction of my content. I went through a really big phase of doing a lot of meal prepping, which I'm still going to be doing because we'll get to that. I'm going to keep saying that until I get to like questions that are related to that. But I decided to put the Q&A question out there and you guys asked a huge variety of questions. Like we're probably not going to get to them all because most of the questions you guys asked are like opening up can of worms for each question. So I'm going to try to stay on topic and stay with each question. So I'm not doing them in any order. I know in the past when I've done Q&A sometimes I categorize them together. I'm not doing that. It's just going to be super random. So I'm going to pull up a couple questions and just start answering them and then we'll see where they go because I have a few other things that I actually want to talk about, but we're going to mix in the questions and all of that at the same time. Okay, this question is one that I get a lot. Like through the years of doing YouTube and stuff I've gotten this question a lot and that is how do your girls get along so well? So if you don't know, I have a five, six and seven year old. It is wild to even tell you or to even say that I've got children of that age, but five, six and seven year old, they're each of your part, three girls and they are actually beginning to hit a stage where there's a lot of cat fighting. I'm not going to sugarcoat it. They are just getting to a scrappy age and being a mom that I've never had these ages before, I feel like in the last six months I've begun to wonder where this is going. Are we going to get back to peace and harmony? No, I'm just kidding. They do really get along most of the time. They have been hitting a stage of a lot of very opinionated ages and also wanting their own things. And then at the same time, since they're so close in age and they're so connected at the hip, they want each other to be with the other ones all the time. So if one of them kind of is independent and goes does their own thing and only lasts for a little while and then they feel like they have to be back together, it gets a little bit crazy. But I will say this, I do feel like they do get along really well. It's just a lot of petty little stuff right now that I feel like irritates the other one. And then we're trying to sort out arguments and all of that. But at the same time, they love each other so much they can't not be together. So, and since I homeschool, we are together a lot. So I think that's another factor is just learning how to balance all of those things, particularly in a homeschool family. All right, another question I got which kind of goes along with what I just said is can you show how you are homeschooling your daughters? And yes, I think I'm going to do like a homeschool routine kind of video which not every day is the same because we are in lower grades. I mean, I have Everly in first grade and then Kailia and Hesley are both in kindergarten together. And so these are grades where we're doing a lot of repetitive stuff, a lot of simple things, learning phonics, reading, writing, math. Got multiple questions about the homeschooling and I can leave a link in the description box of this video for the website where we get our homeschool curriculum off of.  At one point, the girls, when they were little, I had them all in the same room in three cribs. Well, to do that on a affordable budget, I bought three used cribs and I sanded them down and I painted them and it was terrible. Like, if you have ever painted spindles or anything like that, it is such a headache because the paint wants to run down the spindles and you've got all, like, ton of them with cribs, especially three cribs and just, yeah. Let's just put it this way. I will never paint a crib again if I don't have to because that was definitely the hardest that comes to mind. I mean, I have painted whole houses by myself. I've done lots of DIY projects, which you guys know, but that one, I think, took the cake. I actually think I got a couple of questions on this of are the vlogs coming back? So I'm kind of shifting them to calling them day in the life. So yes, they're coming back and I've done a few here on this channel. So, and some people get really confused because they don't realize that, like, I have more than one channel and so then they're wondering, yeah, what, you know, where videos are and a lot of it, you just have to scroll back through and you'll find them. So I think I'm just gonna go ahead and tackle one of the big questions and the core questions related to this. And that is the question, are you and Corey back together? How is your marriage? How is that situation? And you guys have been really gracious because you've also said, like, don't share more than what you don't want to. And obviously I'm not going to share something here that I don't wanna share. So questions were, are you guys back together? Are you married? How is Corey? How are you? How are you faring? Especially with the holidays coming up. Okay, we're gonna see if this works. I moved my parking spot and then Corey called me and I got really waylaid. So back to what I was saying is that, so the answer to the question and I answered it kind of in my little life update video I did a couple of months ago is yes, we're married. Yes, we're together. Yes, we lived under the same roof. We actually have for quite some time now. And if you are new around here, you're probably wondering why people are asking these questions because pretty much everything to do with the history of all of this stuff has been privated. This, the first video that I ever put out was five years ago, something like that. And I was a very young mom, I'm still a young mom, but I was in a very, well, I don't even know the right word, like vulnerable point in my life between what was going on, between having three babies right in a row. There was just a lot going on. And so that first video, I know a lot of you saw and know it's not on my channel anymore so you won't be able to find it. But I was crying, there was a lot going on. And this whole process has been going on for most of our marriage. And I'm gonna go into some things that are probably going to be controversial, totally okay. You can put your opinions below, totally okay. And a lot of this is based around the fact that I'm a Christian and I live my life by standards of being a Christian. And they're one of Domino's car. So all of that to say, if you've never seen any of those videos and you are totally new around here, there's been a lot going on in our lives due to my husband and some of the struggles he's had in life and addiction and those sorts of things. And I wanna preface this by saying not everyone is supposed to do what I've done. And I think that sometimes when people hear different stories of how people handle situations, they feel like that they're supposed to follow in those footsteps or they feel pressure of some sort, pressure is the right word, of some sort that they are supposed to do what that person did. And that is just simply not the case. And I'm reinforcing that because there were times when I felt that way through the things that we've been through that I felt very pressured to do it this way or do it that way or there's always lots of opinions of different people on what they think you should do. Because a lot of these types of problems around addiction is touchy. There are things that, and addiction, I'm saying that in a very broad statement because we've been through a lot. Addiction can include obviously substances, it can include infidelity, it can include just so many things, so, so many things. And we've been through pretty much all of it. So, but it all really starts and begins with you when you are the person that is the loved one of someone going through those things. And it's kind of wild to me because back years ago when a lot of these things started surfacing and I got the question a lot, when I first started talking about all of this was, you guys, you haven't been married that long, didn't you see some of this stuff before you got married? We got married very young, very young, like we were 18, so it just is what we wanted to do and yeah, there was just a lot of things that weren't fully understood at that point in time. And not even within ourselves, even within Corey, within myself, there was a lot of stuff that we didn't even understand about ourselves. So, but as these things unfolded, I really went on a like major search to kind of look for resources for people in my position, being the loved one of someone dealing with addiction, alcoholism, all of those things. And I really couldn't find a lot. And I know that sounds kind of crazy because it's so prevalent, like addiction is something that affects everybody. You probably, anybody watching this probably knows of someone that has dealt with some sort of addiction. And so I just, I felt a bit alone in that and YouTube was a really great resource in the sense I was able to share some of the things I was going through. And then there was a lot of people there to say, you're gonna make it, you're okay, and just to cheer me on. And from the bottom of my heart, all of you that have been here since that point in our lives or in my YouTube journey, maybe so, like I just thank you so much because even to this day, I will get the most random messages from people just saying like, I was thinking of you, praying for you. I have no idea what's going on in your life now, but I just want you to know that you were on my mind. And that means so much to me.  And it's been a wild ride. And the reason I started out with the fact that this is not, does not mean it's the road for everyone. I made a decision and I made this decision more than once, but I made a decision that I was going to stay with Corey no matter what. And along with that decision, I got a lot of counseling. I have, well, yeah, at least four years of counseling through different counselors and not because I've had problems with counselors. It's just different counselors are for different seasons.  In fact, one of my, I would call her like one of my spiritual mothers, we had a season where I talked with her a lot and really gleaned so much from her. And I remember this was last year and I remember her saying like, I think you're getting to a point where you, like our time is closing and you're gonna have someone new come into your life and speak into your life. And it's just, I appreciate that so much because that has been my story through and through is that there's been so many seasons, so many seasons because it was going through having babies. It was going through different seasons of Corey's story, which I'm not here to tell his story. Maybe sometime he will tell his story, but he, you know, his journey had so many different seasons. Some of that having to do with age, some of it having to do with just processing different things. So having different people for different seasons is 100% okay. And I think it's actually really healthy because you can sometimes get latched to one person and one person doesn't have all the answers or doesn't have all of the gifts or capabilities to help you through everything in life, especially when you are in a hard journey. All right, I gotta take a sip of coffee. So all of that to say, I felt called to stay. And like I said, I'm a Christian. I felt the Holy Spirit calling my heart to walk a very, very, very, very hard road. The hardest, if I can say it that way. And I'm like not sugarcoating it. And one of the reasons I'm not is because I know that some people watching this are going through something very similar. And I think a lot of times when there is marriage, I don't even wanna say marriage struggles because to be truth be told, our marriage has actually been relatively good beyond like the stuff that he has dealt with. Like we've always loved being together. We always loved like having each other in our lives. And I know that Corey would say the exact same thing. I wanna say it's more of an addiction journey, maybe something like that. So walking through this journey has been grueling. I'm not gonna be, yeah, I'm not going to sugarcoat it. So I relate a lot to Job in the Bible. If you guys don't know the story of Job, basically everything was taken away from him. His children were killed, his crops failed. I mean like his animals died. Even his wife was saying like, why don't you just give up and curse God? And so that story I relate a lot to. And sometimes God takes us on a road that just simply is not the easy road. And I could have said, you know what God, I'm done. I can't do this anymore. And there were moments, there were moments. But in the midst of all of that, God said, but if you fight this fight, if you continue to walk this out, I have something greater on the other side for you. And I was just reading some of my old journals the other day and like just writing down, like I would stay up during the night, like when Corey wasn't living with me and stuff like that. I would be up through the night just praying for him and writing down the things that I felt the Holy Spirit tell me. And just things like that. And I was reading through some of that and just reminded how often I heard God in the sense that you have something that I have prepared. I'm preparing something for you. And I was gonna try not to get emotional with this, but some of the things that are happening right now in our lives is truly that prophecy over us being fulfilled. And I just see how God brings you through the fire and brings you out the other side. And I believe that if God didn't call me to walk the road I've walked, that I wouldn't have had the strength to do it. Do you know what I'm saying? And also it's not that God forced me to do this. It was just that he said, if you do this, I have something big for you on the other side. And I like seeing the man that Corey is today, like right now, like it just is honestly absolutely mind blowing. Like I said, I'm not gonna tell his story. And at some point I think he will tell his story even on this platform, but like it is just mind blowing to see who he was and where he's been and where God is bringing him and where he is now and the fight that he's had. You know, I've had my own fight, but he's had his own fight. And when I say fight, I'm talking about like spiritual warfare and like I said, a lot of this stuff, there is going to be some controversial thoughts about all of this, but I know what I believe and I know where I stand. So that's all that matters, but we truly do not fight against flesh and blood, but we fight against principalities and powers that are so far beyond earthly things. And I think when we can grasp that, especially being a loved one of someone going through addiction, infidelity, I'm gonna kind of keep saying that infidelity thing because I think that's a part of our story that would be the deal breaker for a lot of people. And so standing through that and standing for a marriage and realizing that that in itself is an addiction. And it's something that people don't talk about a lot because it's a hard subject. And it's something that I probably will talk about a bit more here on my channel. I don't know. I have so many things I like to do and you all know that between my cooking and canning and housekeeping and all of those things. And I'm just really asking God where he wants me, what he wants me to share here on my channel and what you all need to hear. If there's something that is encouraging to you, I want to be that person to bring that to you if you need it. Anyways, little rabbit trail. So I chose to stay when God brought this to me. And like I said, it was more than once where different things would happen. And then I would have to come back and say, okay God, like this is what's happening. What should I do? Because I can ask people all day long, but the bottom line is I want to live my life to honor what God wants in my life. And God would again come back to me and say, I know it's hard, I know it's difficult. I really feel like I need to read verse right now. I'm going to read it. No one has greater love. No one has shown stronger affection than to lay down, give up his own life for his friends. And I remember that moment when I read that verse and I applied it to our situation and I was like, if I truly love Cory, then I will be willing to lay down things that most people would say, you have the right to do this. You have the right to do that. But lay down my emotions, lay down my desires in some sense and just give them over to God and be like, you know what, you've got this, you are taking care of me. And in that moment when I started doing that and I started saying, okay God, here's everything, here's my pain, here's my sorrow, here's my heartbreak, here's the heart-wrenching situations, here's this, here's that God was able to start to heal my heart in the midst of things. And I see how like even leading up to where we are right now, God was preparing me to have a way, a path to healing. Cause sometimes when we're in a situation where there is constant pain, when things are done against you, when things are difficult and it's not just like a one-time scenario and then you know, you say sorry and the other person says sorry and you move on or you like don't see that person, you have this cut-off closure, all of that. It's easier to just kind of like, okay, get your healing and move on. But when you are in a situation where it is ongoing, that is something that that's a, like I don't know if taboo's the right word, but that's a really, really, really hard subject because in our world, we want to remove ourselves. I just heard Milena Sensiotti talk about this on one of her videos. If you guys don't follow her, really love her videos. But she was talking about how we often are like asking God to remove us from a situation. And sometimes, sometimes God says, but if you stay, I have something on the other side for you. But if you stay, there's something awaiting you. There's a treasure that if you walk away, it's not that you won't be blessed. It's not that you won't be in God's hands, but you might miss out on something that he has planned for you. So I'm gonna go back to this thing of this path.  And so there was times where I would go up that path and I would get my healing and I would have my grounding. And then, sometime later, another thing would happen. And I'd be like, okay. And you have the initial wave of pain and you have the initial like, I need to deal with whatever's going on because if I don't, you're gonna come into unforgiveness. You're gonna come into bitterness and ultimately you're gonna end up hurting your own heart by allowing those things in. So I would come back to God and be like, okay, I need to go back up the path of healing and come back to you again. And in reality, like even if it's not coming from one person, you're going to end up with pains in life. We don't live in a pain-free world. You know, we live in a world with evil, with sin, with things that will affect us. And so understanding that way to come back to God, to come back to the Holy Spirit and say, I've got this going on, I have an open wound here and I need you to cover me and I need you to heal me. And the more you practice going up that path, the more you find that it's easier and quicker to go up that path. And I see that even now, like because there's times where with the process that we've been through, there's times where something will come up about the past that I didn't know about. All right, my battery died, I knew that was gonna happen. Or something will occur that triggers me because obviously being on the opposite end of a marriage where you've got a lot going on, you've got things that happen that will trigger. So having a method and having a way to go back to God and to gain your healing, especially in a quick manner that you're not going through healing for years and years and years and years and years and years and not being able to thrive in life and not being able to function in life and enjoy life.  There's still gonna be things going on. There's still going to be times where you have a trigger. You, yeah, just something will happen that's kind of out of like Cori and I's control. And what will it take to get back to that place where you are grounded, you have faith, you have peace, peace is a big one. Because I would take peace over happiness any day. But I wanted to talk about that healing aspect because with my story, it's easy for me to say about, God, this is where I felt God leading me. This is what steps I felt he told me to take. But a lot of people will say, but what about? What about all the pain? What about infidelity? What about alcoholism? What about substance abuse? What about all of those things? Like those things don't just happen with no one having some bruises coming out. So talking about that healing process is very, very important. And I, at some point, I'm not gonna go into great detail cause I feel like I'm already got so much going on in this video, but at some point, I think I would love to have a video where I talk about the topic of healing and what it takes for healing. Because there are, when it's stuff that is ongoing, especially ongoing subjects or ongoing situations, that is a whole nother ball game than having a specific hurt that happened and then, you know, going from there. So all of that to say, how Corey and I are doing now, we are doing so good. Like if I can say one thing, I am just absolutely amazed at the man that I'm married to and who he is for me. And I think the beauty of it is, is that through all of the years of trial and heartache and all of those things, I was that person that stood there for him and was there kind of no matter what and chose to be his rock in some sense, not totally but in some sense and how the season of life that we are in right now, like I get so emotional about it because he's being that for me.  And he's right there to remind me of my value and to remind me of who I am and who I am to him. It's just, it's like, it's so beautiful and to see who he is to his children and to see the choices that he is making to protect what we have cultivated and what we have healed in some sense and of course there's always more healing and there's always more growth that can happen but I just marvel at the love and the protection that he has over me as his wife and just the days that, you know, he will say thank you. Thank you so much for loving me so unconditionally and just being able to kind of be on the other side. And I think I mentioned that a little bit in my life update video is being on the other side, kind of feeling like we're coming down off the mountain on the other side of our lives and to be able to see some of that golden treasure on the other side that God had promised me for so many years. So now that I've talked a little bit about that, I'm gonna kind of slide into the next thing I wanna talk about and then I'll see if I can wrap up a few more questions you guys had. So another component to my life and this has affected YouTube a lot in my life in the last little while but I have had some health issues going on and I know I've mentioned them a little bit in the past but I feel like particularly this year those health issues kind of came to a head and it was like I have to make a decision on how I want to treat this and how I want to kind of proceed from here and Corey's been a really big part of this too and kind of helping me navigate what to do with it and it's all gonna make a lot of sense with what I just said also. But I have problems amongst a few others but I have problems with adrenal fatigue. If you don't know what that is, I'm gonna do it real fast because I'm not gonna go into some scientific whatever. So adrenals are a organ, I think they're an organ, it would be considered an organ, an organ that sits on top of your kidneys and they produce something called cortisol. Cortisol is the thing when you wake up in the morning you are supposed to feel awake.  So what can cause adrenal fatigue is severe stress which obviously with my life and everything that we've walked out and all of that plays a massive part in it. Being a single parent for a while, being the sole provider through those years, all of those things, it just has taken a toll. And so when your adrenals are not functioning properly, it affects a lot of other things because the job of your adrenals is to help you handle stress.    It's a lot. It's a lot on my plate. My plate is very full, has been very, very full, especially through difficult years. So what has brought this to a head and what has happened this year is I was getting to the point where I actually realized that coffee was masking like 90% of my problems. Like I was literally living off of coffee, living. This is a decaf coffee and it's a special treat because I snuck out of the house to go do this, but I so rarely ever get coffee. Like a typical day for me was wake up, crawl to the coffee maker and make my coffee and literally drink coffee all day long. I would drink so much coffee just to stay like awake. Like I know that sounds crazy, but if you are somebody that deals with this, you know exactly how I feel. And then I would get to the point at like 10 o'clock at night where I had drank so much coffee all day I couldn't sleep and like the cycle would start the next day. And then on top of it this year, I started getting like these weird episodes where I would get like really, really dizzy.  And they would come out of the blue. Like I wouldn't have one for even a few weeks and then all of a sudden I'd have one and then three days later I have another one and all of this stuff. So we managed to figure out that it was the coffee. I think that a lot of those episodes were linked to caffeine addiction and just being on way too much caffeine. So I cut out caffeine and that detox was, I should have vlogged that honestly. I should have like done a whole thing on my coffee detox because Cory was very supportive just because of the own detoxes he's had to go through. And he was like, you can do it. Like you're all right. And he would be like, just go sleep. Like if you can't handle stuff, I'll take care of everything. He's been amazing at taking care of me. And so that had to happen. The coffee detox had to happen first. And so now I am on like a, I'm doing it naturally. I'm doing it without medication but I am on a like adrenal rebuild kind of thing because my adrenals were just blatantly not functioning at all. And when they're not functioning you're not creating any cortisol. You're so tired and or you'll have spikes of like cortisol and then you'd be awake at night. Which was the other thing that was happening to me is that even after I got off the coffee suddenly I would wake up at like one in the morning and be awake for hours. And so obviously that was not okay either. So I just had a lot of like crazy stuff going on. So I'm on, I'm doing a natural adrenal aid regimen. I make a certain adrenal aid drink which I wanna share with you guys. It's a yellow drink, it's really, really good. I try to drink that like twice a day. Just different things. I'm not gonna go into major details but between that and also cutting out stress, making decisions for things that are causing stress in my life. And Corey's been very, very helpful with that just like wanting me to cut back on anything that's over stressing me. So that stuff has made such a difference compared to several years ago when things were not okay. So having him there to take care of me and to be so incredibly sweet and just to make me create a space for me to physically heal, to physically regain like some of the things I've lost has been so amazing. And then on top of that, I'm also eating a very low inflammatory diet. So I do eat a lot of things that are kind of keto related just because sugar and gluten inflame my body like crazy stress my body really, really badly. And I've done some of that through the years but now it's more serious. Now it's more like, okay, you have to do something about this. It's not just gonna like go away which is what I usually do. I'm kind of like one of those when the light goes on on my dashboard on my car and like, well it hasn't broken yet so we'll just keep going. Corey's like, why are you telling me? But yeah, so doing all of those things so you're gonna see even in some of my meal preps that I am prepping some food that is specifically for me and a lot of that has to do with low sugar and gluten free. I do do some dairy even though dairy is something that can inflame you, it can be inflammatory. I just do some cheese and stuff just to like get by because I'm not able to have some of the other stuff but I don't like drink milk or anything like that. So if you're watching my meal preps and you're thinking about the stuff I'm saying that is what some of my thought process is with some of that. So that being said, that is why also I have had a lot of gaps in my YouTube upload schedule or like history in the last couple of months is because there has been times where I have simply been incapable of like filming and uploading and all of that stuff and I've just had a lot of struggles with it. So all of that to say, I am feeling a lot better. I'm having a lot of trial and error with my eating. I'm writing down like everything I'm eating so that like if I wake up the next day and I'm like, oh, whatever I ate, I'm not okay then I can kind of rule that out or else change something if I need to. So that's currently where I'm at right now. Like I said, I'm following holistic advice on how to treat this and just walking it out and all of that. So when you see me either not upload or maybe something be a little bit different that is 100% what it's related to right now is just trying to learn how to not overstress my body and my mind, because my mind's connected to my body obviously that's all connected and just kind of chill out trying to take life a little bit simpler. Obviously I'm homeschooling so I have that priority in life and all of that. So we're gonna get back to some questions now but I wanted to talk a little bit about that because it will be something I'll probably will continue on talking about in the future. So along with talking about Corey and stuff, a question is how often do you have date nights and how do you create time for each other? So we are extremely time oriented people. I don't know if you know the love languages but we both have, most people have two dominant love languages and we both have that in our two dominant love languages. So spending time together is something that we do often and are very good about prioritizing it. Corey is actually very, very good about prioritizing it. I told him not that long ago like how he will even recognize me getting stressed out or whatever and he's generally like, hey, let's go get dinner. And he makes sure we have a babysitter and all of that. So our time and date nights and all of that are very regular. In fact, probably more regular than most normal, not normal, what's the word? Most average relationships. We go out for dinner at least once a week, sometimes twice a week. Just him and I, we put the kids to bed and then we'll order in like some kind of appetizers or something like that. We find TV shows we like to watch together. We watch football together. That's something that we really enjoy doing or baseball or hockey really. I like, I'm not a sporty person but I like watching sports a lot. And he's trying to get me, he had me set up with fantasy football. If you guys don't know what that is, it's just a game that's related to football this year. And so he's trying to like get me to understand that since I have my own team and everything. So, but so we really do a lot together. We, I got golf clubs this year. We go, we haven't started but I would ride along golfing and now I just got my own golf set of golf clubs. So I want to practice, see if I can golf a little bit. But we go shopping. We've been kind of starting to do some grocery shopping. Like he'll go with me, which is, I love that because having three children and you like the experience of the trip of getting out of the house but then you get there and you're like, this is a little crazy with three children. So we like with his business, he is a fence builder and does like general construction. So I will go on the job with him. He helps me with stuff around the house. Like sometimes I'm getting ready to film something. He'll help me with cleaning up or you know, whatever we're gonna do. And I know you guys have seen him in the background of like meal preps and stuff like that. But yeah, so we like date nights, like I don't know, we're actually, Cory just said that this like yesterday or the day before he said something about like we're always honeymooning. We're always date nighting. Like that's our lives now. And it's kind of true. Like we always pick each other over everybody else and we just make time and or we live a life of centered around prioritizing our relationship. And I think that is why we make so much time for each other. Somebody asked about Christmas or like holidays just because years past they've been difficult with things and we are so excited for this Christmas. Like I can't even express it. Like we are so excited. I know Cory and I keep talking about it. Just how like we know that this Christmas is gonna be so amazing and so different and just exciting. So yeah, so this holiday we are very excited for. So can you show your freezer and how much food you keep in it? So I have my freezer in my fridge and I actually have three deep freezers. They are not big. They're small deep freezers. I'm more of the type of person that likes having small deep freezers because big deep freezers for kind of two big reasons. One, I don't think I could manage to not lose stuff and have stuff be freezer rent in a large freezer, deep freezer. And then two, if you like say you're getting to the end of the season and only half of your freezer is full then you're running a lot of energy that you don't need to be running. If you have multiple small freezers then you know you can kind of condense things and turn off a freezer, which is very helpful. So I will probably show my deep freezers in the tour that I do of my seller and like all of our home canned goods and all of that stuff because we do a lot of canning. So which you all have kind of picked that up but yeah, so I'll show the freezers whenever I do that. Okay, do you have plans to buy land and build? I got this question a couple of times along with the question about having more kids which I'll get to that in a second. But Cory, probably like twice a month is always looking at stuff. We go back and forth. We go back and forth between like really wanting to buy and also maybe just waiting like another year or two. So I don't know, it's in the balance. You guys will have to wait and see like what comes up? We did look at a house not that long ago and I don't know. The answer is I don't know. And the other thing too is we do lean a bit more towards buying a house, a structure that we could potentially like remodel versus buying land and building just because I love the idea of old houses a lot. Like I would love a farmhouse. But I don't know, I don't know. I'm just gonna leave it at I don't know. It's in the air. We're thinking about stuff. We are really happy with where we're at but there isn't much of a yard there which I've said that before but like we'll see. We'll just see. And Cory just keeps saying God will have something for us. It's just gonna come to us whatever's gonna happen and I'm like, yeah, I know which I'm more of the planner type. So I just have to trust God and trust him and the way we'll leave it. So the other question since I just mentioned it is about are you gonna have more kids? So as of right now, the answer is no but I do get baby fever.  And but the answer is I don't know. And again, just trusting God with all of that stuff and whatever. So I feel like these are such funny questions sometimes because like you don't always have the answers. Like nobody has their life completely planned out like every single month, every single year is gonna be this, it's gonna be that. We all have ideas and goals and things like that but it's never something set in stone. So some of these questions make me kind of giggle because it would be like somebody asking you that question, you know? Like if I asked you watching this, what are you gonna be doing next year? You don't always have the answer to that. And I had some questions about budget meals and like dealing with all of the prices that are crazy right now. And that is really my goal and my drive to showing you guys how we eat and how we do a lot of our meal prepping and things like that because it is wild how you can buy something in bulk like a bag of potatoes for example, because I can potatoes. The price per pound for like buying a 50 pound bag of potatoes and processing them and doing them yourself versus buying just like a five pound bag at the store is insane. Like the last time I checked it was less than 50%. So that would mean, you know, that's how big of a discount you're getting just by buying a larger quantity of something and processing it yourself. So that is my goal with doing the budget meal preps and stuff is to be showing you guys that there are alternative ways to feeding your families healthy wholesome meals without breaking the bank and just it's really not that difficult. It's a skill, it's a skill but it's not that difficult once you have that skill mastered or you learn about that skills like anything else in life. All right, so I had some questions on planners, cookbooks, bullet journals. I'm just seeing another one here and wanting me to talk more about that. So maybe I will do that at some point. I love, love, love bullet journaling. If you guys didn't know, I used to, I've tried so many methods of planning and bullet journaling is just the best and I have lots of cookbooks I can recommend. I also have a certain way that I write my own recipes in a cookbook. So that's something that maybe we can do at some point. There's so many questions you guys and I feel like this video has gotta be over an hour long. Hopefully it's not two hours long. And I wanna keep going but what I'm gonna do, I am going to have you guys put questions in the comments of this video for my next Q and A or chatty video, whatever we're gonna call these. I knew I would need some silence and that's why I ended up in the car today because I was like, you know what? I am just going to go get myself a coffee. We're gonna do it this way instead of trying to navigate between three very chatty little girls. So there is one question I'm seeing here that I wanna give this tip because it has to do with decorating. And it said, what would you recommend someone on a strict budget to do to get the boho look on a fraction of the cost? And one thing I can highly, highly recommend is paint your walls white. And everything else in your room is gonna look totally different. And I know that everybody might be really tired of the white walls. And in fact, when I went to paint the living room, Corey was like, please do something besides white. So I painted the living room gray. If you guys are subscribed to my home channel, then you know that. But I recommend painting your walls white even if you end up changing the wall color. Paint your walls white.  Your furniture and the things, and I don't even know if this is quote unquote boho because I don't even think my style is like super boho. It's all kinds of things. It's like farmhouse, little mid-century model and a little boho, just whatever I like. But I think a lot of times people look at pictures and most of the time when they see the boho look or even the farmhouse look, the walls are white. And so I think it gives you a good base. And that's actually what I used to do whenever all the houses we've ever lived in, I think I painted all white, to just kind of get a grasp on my style is to start out with a blank canvas. I know it sounds a little cliche, but it's just the best advice I have for you. So all that to say, I'm going to tell you guys, leave questions in the comments of this video because I will do another video like this because I feel like a lot of the stuff I said today is going to bring on a lot more questions and a lot more just comments, things that we can talk about. And I'm really looking forward, and I know I said this a few months ago, but I'm in even another, I'm in another season even now that I was even a couple months ago. And I'm excited to kind of reconnect with my audience, reconnect with you guys that have been here since the difficult days and have followed my story even whenever I've taken steps backs, steps backs. Okay, it's time to stop. I'm starting to have some problems talking. When I've taken steps back, you guys have been so supportive and so loving from the behind your side of the screen. And I just appreciate that so much. And I may even come back to Instagram. I've been debating about it. That has been a huge component. I've gotten like, for the most part, I literally had to download the social media apps on my phone to read off those questions because I have pretty much made my smartphone into a dumb phone and like, have only used it for calling and things like that. Because being on YouTube, Facebook, Instagram, all of those things, I realized how much that was even playing into a part of my adrenal fatigue and feeling tired. It just drains you. And being on social media too much can do that. So yeah, so thank you for respecting my privacy a little bit, I guess is the right word. Like whenever I've taken steps back and gone through different seasons and things like that. And I just appreciate you all so much. And I'm excited for this season of life that God has us in because it is a season of abundance. And it's something to be excited about. And I am ready to start sharing like my journey a little more than what I have. So anyway, I feel like I'm saying goodbye to a friend now. And I'm excited to hear you guys, your just thoughts in the comments. Leave them in the comments. I will be reading through them and responding to them. And I think I'm actually gonna go home and make this video live. So guys, we'll be seeing it pretty much the same day. I just can't be more grateful for the subscribers that I have had through a lot. So anyways, I will see you guys in my next video.


Salamu alaykum wa rahmatullah wa barakatuh. Welcome to Ahkam S.O.S. A show that discusses Islamic duties and practices by His Eminence, the Grand Ayatullah, Sayyed Sadik Shirazi, may Allah put it on his life. I'm your host, Mohsin Shah, and joining me as always is Sheikh Ali Ma'ash. Salamu alaykum Sheikh Ma'ash. Salamun alaykum wa rahmatullah. Sheikh Rao, we've been discussing Jama'a Salah and also the Imam of the Jama'a Salah. And the question I wanted to ask you was, is it sufficient for us when we identify an Imam for the Salah, that he knows between Haram and Halal and he knows the Ahkaab laws, is that sufficient? And we know a little bit about his background. Is that okay, or do we have to do a very, very thorough background check on his Adalah and on his knowledge of Islam? I seek refuge with Allah from Satan. In the name of Allah, the Gracious, the Merciful. All praise be to Allah, Lord of all the worlds. I seek refuge with Allah from the accursed. Well, with regard to your question, yes, you can rely on this aspect of, I mean, the righteousness of this person. Overall, you have friends who, let's say, pray behind him, or you know the Imam roughly, that he is a person, a pious person, he comes to the Marqas or to the Mosque. And in overall, you know that this person's conduct and character is a good character and conduct. You can rely on it and pray behind him, that's fine, there's no issue with it. And what if I doubt the Imam, if I doubt that, oh, this person may not be righteous or he might not have the correct Qara'ah and maybe he'll make mistakes in Salah, is it okay for me to follow this Imam in the Jama'a or should I pray Farada? With regard to the first part of the question, you must achieve and you must acquire the Adalah of this individual, this Imam. In other words, you cannot just follow an Imam that you're in doubt of. You never know him and those who pray behind him, you don't know them.  You cannot just follow that Imam, an individual and pray behind him. So you have to acquire and attain that this person has Adalah and he's righteous. Otherwise you cannot pray. Unless we have in Frikh what is known as Ihrāz-ul-Adalah, that you have to attain the Adalah, that he has these features and conditions of the Adalah mentioned in the last episode. With regard to the second part of the question, there's no issue with it if you have doubts about that if he read correctly or not. No, that's fine, you can follow him. I mean, the Salā is correct, there's no issue with it. It's just a doubt about his recitation. There's no issue. Unless it's real, you can hear him that he's reading the words or letters mistakenly, then you have to correct it by yourself. And if that continues, then you cannot follow this Imam because he's not reading properly. He doesn't know the rules and the qawā'id of the Arabic language, for example. The Quranic language, the Quranic verses. In this case, you cannot follow him. That's right, that's right. Shaykhna, a bit of a controversial question. There is an individual who meets the criteria of being an Imam of the Jama'a. Maybe he's righteous and he knows all the Ahqām and all the other guys to Salā. But he follows a marjah that some may say is questionable or some may say is not a marjah of Adālā or a marjah of qualification. Is it okay for me to pray behind this individual? The Sayyid says that you have to go back to the conditions and the criteria of the Adālā. If he meets those criteria, that's fine, you can follow him. Regardless of who he follows as a marjah. For example, his adolescence, he's sane, he's Shi'at-Nu'ashari, he's adil of legitimate birth and he performs the Salā correctly without any mistakes. In this case, you can follow him, that's fine. Whoever he follows as a marjah, there's no issue with it. So based on that also, giving the benefit of the doubt and making sure that this person is trustworthy and so forth. What about if I visited a new mosque and I don't know the Imam of the Jama'a? But I see that quite a lot of people are praying behind this person. So is that okay for me to join? Is that enough indication that this person is trustworthy and worthy of being prayed behind? Because obviously I haven't got time to actually go and investigate. And the Jama'a has already started as well, the Salā has already started. So is that okay for me to join that Jama'a? You see, as mentioned many times with regard to this condition that righteousness or the adālah is to do with practicing the good and obligatory acts such as Salā, psalām and so forth and refraining from the evil acts such as drinking alcohol, listening to music and so forth. If the Imam is adil, in other words, has taqwa, piety and he refrains from these forbidden acts and he applies and implements the wajib acts and in overall he is recognized through good practices. People know him that he is of good akhlaq, of good practice in amal. In overall you can follow that Imam, that's fine. As I've said, you must achieve and attain that he is adil by looking at the people around him, maybe by asking him for example or asking others about him and so forth. That should really solve the situation and we don't have to go through in-depth research about his background and what he did, what he was. It's just the apparent adālah will be sufficient. What happens when I follow an Imam in Salā? But the Imam was praying a nafila prayer or he wasn't praying, he was praying a different prayer to me. Do I have to repeat my Salā? No, it is not wajib and obligatory for the one who prayed behind an Imam who used to pray nafila to repeat the Salā, that's fine. There's no issue with it. Because your intention was to follow the Imam in the obligatory Salā and he was praying nafila, so that's fine. You follow and pray whatever you prayed and the Imam, whatever he prayed, that's fine. Sheikh Naqt, we are praying behind an Imam and this person's Imam recites some of the words incorrectly. What are we supposed to do as followers of the Jama'at? In this case, if these words were recited mistakenly in the wrong way then you as a follower, as a ma'amūm, should correct it by reciting by yourself. So you correct it by for yourself. So let's say if he said, ma'alaka yawmud-dīn, not ma'alaka yawmud-dīn. So you have to recite by yourself ma'alaka yawmud-dīn. So correct that mistake that the Imam did by reading it in the right way. Sheikh Naqt, what happens if I'm praying behind an Imam, I'm praying Maghrib Salā and I'm not 100% happy with the Imam that he prayed the Maghrib prayer correctly. Am I supposed to repeat my prayer? Not at all because you have doubts about this issue.  That's fine. There's no issue. There's no repeat for it. Sheikh Naqt, what is the duty of a ma'amūm when he notices or identifies that the Imam has mispronounced or said something incorrectly in the Salā? Should he correct the Imam or should he just correct himself? Sometimes you see the Imam, he forgets for example to do the act of Qunūt for example or he stands up for the third raka'a without doing tashahūt. In this case, as I've said, you cannot follow the Imam in his mistakes but the best thing is to remind the Imam by saying Allahu Akbar for example you try to remind the Imam and telling him that you should stand or sit in this position or do the Qunūt or leave the Qunūt if it's not in its right location. Just to remind him that what you did was not in the right place and usually the Imam would recognize quickly and they would try to correct the fault straight away. What about if it's like a Quranic verse, if they're reciting the Surah and maybe they forget an aya or something, is it mandatory upon us to indicate and identify that you've said something wrong? For example, they might say, should we be saying should we be sharing that out to the Imam? As I've said, you have to for yourself read out this incorrect or missed aya for yourself. So you read this out for yourself and the Imam has his own haqqum because he didn't know or he didn't actually, he just made a mistake in which he didn't recognize. So for yourself, you read the aya again and you correct it. Sheikhla, how do we pray foradah jama'a? I mean when we come into the mosque and we want to pray foradah, is it okay to stand with the congregation but pray foradah or should we be separate and pray separately on our own? We have to make sure that when we go for such places where the jama'a prayer is held and people are praying in jama'a and I want to pray quickly and leave the mosque. I have to make sure that I do not insult the Imam of the jama'a or the jama'a itself or the mosque itself by praying alone and foradah away from the jama'a. Sometimes it brings some kind of, it gives a bad image to the mosque for example that there is a jama'a and this individual is praying alone or sometimes you see there are two groups, one group foradah, one group jama'a and that's of course not accepted if it's causing some kind of harm to the Imam of the jama'a or some kind of insult, disrespect for example. No, you cannot actually do this. The best thing is to pray somewhere else or after the jama'a when they finish or the best thing is to pray with the jama'a to get the reward and it's just a few minutes you would be more delayed unless you are in an urgent situation then maybe you can pray at home or somewhere else away from this jama'a because if you break the sanctity of the mosque and the jama'a then that's by itself some kind of disobedience and that's not right. So we try to either pray the jama'a or stay away from this jama'a and pray somewhere else and keep the sanctity of the jama'a prayer in that center of that mosque. Shehna what if I've come into the mosque and jama'a Salat is going on and if I'm in a hurry and I know I can pray foradah before the jama'a finishes this Salat however the me praying foradah will lead to insulting the imam or the congregation am I still allowed to pray foradah? You cannot insult the imam jama'a or the group who are following the imam no you cannot. So you have to make sure as I've said to find somewhere else and pray or pray afterwards when they finish or pray between the two Salah when they do the kure tasbihat al-Zahra alaihi s-salam you start praying your wajah prayer and then you leave straight away. That's it thank you very much Shehna and thank you to all the viewers for joining us on this discussion inshallah we'll have new topics and more discussions in the following Ahqam SOS episodes until then we would like to encourage you guys to join the jama'a and not to pray foradah inshallah with your brothers and sisters to create some sort of unity and community with the Shia inshallah until the next episode Asalaamu alaikum warahmatullahi wabarakatuh


Okay, hello everyone. I'm sorry if I sound a bit out of breath. We just did a talk six minutes ago and had to run from quite far away, so apologies.  My name is James Callahan. I'm a principal consultant at Control Plane, and I'm here with my esteemed colleague, Torrin. At Control Plane we are a cloud native security consultancy established in 2017. We are security specialists in Kubernetes, cloud and container security, but we do this for highly regulated organisations. We're over 50 people now across the UK, Northern Europe and Australia, and we are still expanding. So what will we talk about today? First of all, we'll start off with a quick introduction to what threat modelling is and why it's a good idea to do it. We always think about our scope when we threat model, and it's important to say that this threat model report was first of all commissioned by Linux Foundation, and it's not an audit of the Argo CD project itself. It's not a red team engagement or anything like that. What it is is focused on end users and people deploying Argo CD in production. What are we building is the first of four fundamental threat modelling questions that we must ask, so Torrin later will give you an architecture overview of our sample multi-tenant implementation. Data, of course, is the thing that we care about protecting. It's the heart of threat modelling. So we need to understand our data and a data dictionary so we can understand the impacts of a compromise of any of those data elements. How do we model it? We do this through data flow diagrams. This is where we start to catastrophise and ask the question, what can go wrong and codify these catastrophisations in attack trees? Finally, we ask the question, what are we going to do about it? This is where we devise our recommendations. These are the end user aspects of what you can do to harden our example infrastructure. Finally, just to note that threat modelling is iterative. We always have to ask ourselves, are we doing a good job? Is the threat environment changing? Are our assumptions sound and are our controls working? A threat modelling overview. Threat modelling is a systematic approach we can take to our IT systems where we codify what can go wrong and devise mitigations which end up reducing risk. Threats can lead to risks, risks can be quantified and we will always be left with some element of residual risk. It's the purpose of threat modelling to reduce these residual risks in line with something which will be acceptable in our risk management framework and in line with our risk appetite as an organisation. It aids in finding and addressing security risks based on attack chains and attack trees which Torrin will show some good examples of later on and controls, most importantly, will be quantifiable. We can understand the impact of implementing or not implementing certain controls and communicate this with assurance, compliance teams and ensure that we are within that risk appetite. Finally, most importantly, we can enhance developer retention because people don't spend lots of time re-implementing the same fixes and fixing things which are broken, basically. So, why threat modelling? Because we identify security flaws early on. We should threat modelling as early as possible but any time now is better than if you haven't started at the start, now is the best time. We can save time and money again. We don't consume complex redesigns and lots of new tickets to fix things which are broken. We identify data flows and complex risks which we might miss otherwise. And then finally, yes, we focus security requirements and enhance developer retention. The threat modelling process, we touched on it in the first slide but we follow a simple four-step process, kind of a spouse by Adam Shostack and co. The first question, what are we building, involves understanding our data, our use cases, our adversaries and our architecture. So, artefacts that can help us here, our data flow diagrams, system architecture diagrams, information flow matrices, all of these things can be put on the table because looking at the system from different viewpoints can often elucidate threats which might otherwise be missed. What can go wrong is the next step. This is where our little world is exploding. We are catastrophising. We are using threat intelligence sources as inspiration. We can use brainstorming techniques such as Stride to make sure we're not missing any threats and we can put all of this stuff together in attack trees to see how an attacker would get from some level of access or some credentials to actually doing something which matters and results in data being compromised. What will we do about it is the next question and this is where we devise our controls. Everything, as I said before, has to link back to a risk management strategy. We have to devise controls which mitigate our risks within the context of this strategy. Finally, did we do a good job? This is the iterative aspect. We can do things like map controls to attack trees to see if any branches are not covered. We can write automated tests which test not the implementation of a control but its actual genuine effectiveness in a representative system. Finally, we can revisit our threat model regularly if threat environment, threat landscape changes. There are many reasons why we might want to revisit our threat model. In terms of outputs, threats are the key. Threats can be codified in attack paths. Attack paths lead to attack trees and attack trees are the means for devising our controls. Finally, this is an example of an attack tree but we won't go through this one in detail. Torrin will go through a much more detailed example in a few slides time. All we will say here is that all the attack trees in this report use deciduous, a tool by Kelly Shortridge. We can do things like introduce controls so the blue security controls as indicated here break that can possibly break parts of the attack tree and make some paths non traversable. Attack trees really help with visualisation. We can annotate nodes to provide extra context and also we can even quantify things with likelihoods, impacts and do things which would feed attack trees into an overarching risk assessment. With that, I would to Torrin for a bit of project background. Awesome, thank you very much James. To get started here we need to understand what our scope is and what we are actually trying to threat model here. For our project, as mentioned by James, we are not doing a security audit or a view of the Argo project itself. Instead we are focusing on end user security considerations for actually deploying and managing Argo CD. To do this, we have created a sample deployment architecture in multi-tenant mode set up between a operations cluster or ops and the multiple, in our case three, tenant clusters that it is synchronising application state to. In scope for our project here is that architecture that I previously mentioned as well as the Argo CD interactions with the cluster components that it works with directly and as well the Getty source control management and actually managing the source repos for each of the applications. Out of scope, we are not looking at a security assessment of peripheral case components as well as the developments and building of the actual applications that are being shipped by Argo CD. For our case, we are setting up the deployment architecture with demo apps but we are not looking actually at the assessment of the applications that are shipped themselves. On top of that, we are not performing a penetration test or any sort of offset analysis of the system and we are not looking to provide a hardening guide towards specific data classifications whether that is PCI, PII or HIPAA. So what is the project overall? For those interested, we have the demo architecture on our public repository although right now it is in a state of becoming open source so stay tuned for that in the coming days and week so you guys can actually set up that yourself but what that architecture looks like is Argo CD deployed to a private EKS cluster with an ops cluster that hosts the Argo CD control plane and I will get into the architecture specifics in a moment but then is synchronizing to three different tenant clusters within that EKS cluster. So for those interested, feel free once that is open source to try it out and test your hand at deploying it as well as even trying your hand at developing some attack trees and numerating some threats. So for our threat modeling exercise our published report is on the Argo project GitHub repository right now so feel free to check that out as well if you want to see the detailed run-through of not only what we performed as far as security analysts but also the controls and mitigations that we have provided as recommendations for what we found. And for our findings here and the key threats and recommendations we are going to demo some attack trees and show how they enumerate some of the threats and map them out in a specific exploit chain later in this presentation. And those are mapped primarily on critical, high, medium and low severities to provide a risk strategy for actually prioritizing and categorizing them. So a few key assumptions starting here tenants are strategically assigned app teams within the same org and currently for our deployment sake we have tenant zero, tenant one and tenant two to simulate the multi-tenant mode deployment of ArgoCD. And ArgoCD deployment itself is deployed using Terraform modules and ArgoCD is running its control plane on the ops cluster and is synchronizing state to the tenant clusters but is not actually installed on the tenant clusters themselves. It is maintaining a synchronization between the ops cluster and the GT source control for those repos. For repository organization we have a GT server hosted on the ops cluster itself and we have one CD repository per application team with separate folder for the manifest stored within that repository itself. For the synchronization process we have auto sync set up for each of the tenants and that is triggered based on commits to the main so whenever commits are being pushed to the main repository of each of those app repos hosted on GT then auto sync will be triggered and then pushed downstream to each of our tenant clusters to update and to synchronize that state. So what are we building here? Let's look a little into the architecture that we're working with before we can actually understand the scope and to see how we threat models our system. So as I mentioned previously we are deploying this on an AWS eKS cluster which is hosted in a virtual private cloud. As far as access is concerned and if you run through the demo itself you'll be able to SSH through a secure bastion host that actually allows you to issue commands from your local machine or that's through the API directly or through Qtl to interface with the clusters to see what's going on and to investigate. For the setup we have, as I mentioned, we have three different tenant clusters with tenant cluster one, two and three which are being synchronized up to the ops cluster itself which holds not only ArgoCD control plane but also the GT server for source control management where we actually are storing the application repositories themselves. So in multi-tenant mode and as many of you may be familiar with in deploying ArgoCD we have set it up between our three tenants and running the tenants as app project resources and the applications as the application resource in ArgoCD. So I provided a sample of the actual app project and the application resource manifests and you can see how we're actually setting the destinations here so in the app project itself the destination of the tenant zero cluster and all namespaces providing ArgoCD with cluster wide access to synchronizing the state of those applications. In our other clusters so in tenant two and tenant three those are actually being synchronized at sorry, in tenant one and tenant two those are being synchronized on namespace level only and not cluster wide. You can also see the selection of the source repos that we're actually using in creating in GT and when you run through the demo you can create these over the UI or create them through CLI commands whichever way you prefer. They are linked through the application itself defining which ones should be synchronized to each application. So an overview of what this looks like and many of you might be intimately familiar with the UI offered by ArgoCD but you'll see that we have our app one, two, three and four applications each of them healthy and synchronized to the app cluster itself and the ArgoCD control plane hosted within it. Here you'll be able to update and configure the manifests and the configuration for the apps as well as the app projects itself to play around with the demo itself. So after we understand the architecture overview we need to understand what our critical data assets are. So what we are actually concerned with protecting and what a simulated attacker or a malicious threat actor might be interested in compromising. So to do this we create what is called a data dictionary which is essentially acts as a blueprint of your critical data assets. So to model your dictionary you need to answer a few questions. So what data is crucial to your system functionality what data or secrets are used to secure your system this could in many cases by default is Kubernetes secrets or some sort of API token and then what data if misused could alter or disrupt the system itself. All important questions in their own right that allow you to fine tune and focus on the actual critical data assets that are ported into your system in our case to ArgoCD and Getty synchronizing app state. So once you identify this you can then begin to categorize each of the identifier assets. In our case we use the RAG approach or the red amber green which associates red with high and then amber with medium and then green with low risk levels for our data assets. This is not the only approach that we took for this threat model exercise. So I'll do kind of a quick run through this but for those interested there is a detailed run through on the Argo project end user threat model report that you can find that runs through each of these but these are some of the enumerated critical data assets for ArgoCD. So for example the Kubernetes service count token for ArgoCD as well as the init admin password for actually setting up different users and configuring ArgoCD from startup and we also enumerate local user credentials we will actually accessing and manipulating the applications and app projects within ArgoCD and then we assign them their RAG classification or their high, medium and low risk priority and we put that against the CIA tryout. So the impact of confidentiality, integrity and availability of end user data is then mapped to our RAG approach which is put into our data dictionary and allows us to begin the threat modeling exercise and start moving into attack trees. But before we actually touch into attack trees themselves we need to still kind of model how data procedurally moves through the system and to do this we create data flow diagrams and this acts or answers the next question of how you model your system and to begin you want to start with an architecture overview but once you understand the system you're actually creating and modeling and you'll understand how data is actually moving and flowing through it. So to do this we've created two levels of increasing granularity of the system itself and you'll notice that the dotted green line that moves between the system itself is denoting the trust boundaries, right? So the namespace trust boundaries and as well as the cluster trust boundaries that needs to be transcended for data to move in and out of your system and interact with the different components and interact and synchronize with the downstream applications. So here we have our ArgoCD hosted in the ArgoCD namespace and Getty in the Getty namespace both within the operations cluster and to move out of the cluster itself you need to transcend first the namespace and then cluster trust boundaries to synchronize to each of the tenant clusters which we'll see in the next data flow diagram. So level one gets a little bit more granular so it shows each of the components as well and how they are operating within ArgoCD and the tenant clusters, right? So after transcending the operations cluster boundary then the autosync will trigger into each of the tenant clusters in the case of tenant cluster one that is cluster wide, right? So ArgoCD has access to the entire cluster and is able to synchronize across namespaces in our case with app one and app two namespaces. Tenants one, or sorry, tenants, yeah, tenant two and tenant three those are namespace scopes so it's two specific namespaces in our case for application three and application four is what ArgoCD actually has permission and is directed to synchronize. So once we understand how data is moving in our system we understand our architecture overview we can get into the catastrophisation kind of as James had mentioned with creating attack trees. So what can go wrong? What is our doomsday scenarios? What is a potential threat actor looking to exploit in our system? So to begin I'm going to give one of our larger threat model attack trees for this specific use case which maps out five high priority threats in our case in different out-of-the-box configuration as well as different threats we've enumerated from this threat modelling exercise. And a key note before I kind of get into one of the specific attack chains here is the reality step, right? You start at the left-hand side here of the reality where the attacker is and typically you'll break this out into an external and internal attacker internal might look something like your infrastructure provider or your cluster operator or system administrator whereas external attacker is someone outward looking in on your system itself. But there's a lot going on here, right? So we're going to break this down into a specific attack chain and see how an external attacker might move through the system. So from an external attacker's standpoint they are looking at an eventual takeover of a tenant cluster on our simulated infrastructure. So to begin to do that they first need to enumerate some credentials and a critical asset to doing that is the ArgoCD service account token to be able to maliciously configure or otherwise enumerate secrets within ArgoCD's deployment itself. So moving from the chain you can see that after the attacker first enumerates the cube config credentials they need somehow to access the secure Bastion host, right? That might look like socially engineering a developer to get their credentials to SSH into the system itself or some sort of phishing effort and once they do that they then can access the network itself and can begin to issue malicious commands on your tenant clusters. So at this stage the attacker has cluster admin permissions. So after lifting the cube config credentials and being able to steal the SSH credentials of in this case the app developer they then can move further and transcend your trust boundaries in your system and now are operating on your ops cluster. And from here they will look to maliciously configure your downstream tenants and try in our case to deploy a malicious deployment to those tenant clusters. So once the service account token is compromised the sensitive information about the ARGO CD deployment can be enumerated. This looks like something like the init password which is not deleted by default but is suggested so by the project as well as other secrets and tokens stored on your clusters. So from here the attackers now have cluster wide access, right? So then they can move from your ops cluster into your downstream tenant clusters and begin to attempt a malicious deployment into your tenant clusters. So in this case the end goal for the attacker is a full cluster takeover which is possible through the steps that we've outlined and ran through here after reading the cluster wide secrets enumerated on the ops cluster then they can move and transcend to the tenant cluster itself. So this is a larger example of a mapping of a few of our high-party threats but I'm going to look after this into a more granular focus on one of our other attack trees. So this attack tree looks at the tenant cluster takeover due to the unrestricted default project of ArgoCD. So starting out you have your reality, right? And from reality the attacker can then begin to enumerate some of the initial passwords and specifically the initial admin password of ArgoCD to maliciously configure ArgoCD. And I see we're running a little bit or low on minutes so I will glance over this one and then we'll look at some of the security threats and recommendations that we've enumerated off of this. So what can we do about it? So what are our controls? What are our mitigations that come from this threat modeling exercise? So some security threats and considerations follow a few key questions here, right? So who can access or who can ArgoCD access? In this case looking at giving ArgoCD namespace specific or namespace scope access as opposed to cluster wide access and limiting the permission of service account tokens in ArgoCD's deployment itself. As well as using workload identity this could look something like Spiffy Inspire and there's a lot of other implementations as well to connect to the tenant clusters themselves securely and on the second question who can actually access ArgoCD. So this kind of gets into our multi-tenant deployment as well as disabling some of the out-of-box configurations. Specifically the local admin user that's actually created with admin level access to ArgoCD to create other users and modify your app project and application resources to protect the credentials themselves using an external key management service and then using SSO to enforce MFA if it is applicable and is not overkill in your use case. As well as limiting user accounts on RBAC this can be done natively through Kubernetes as well in our demo deployment. And then finally how does ArgoCD actually manage applications. So in our case app projects and application sets the first recommendation here is actually deleting the default ArgoCD project as it has a lot of insecure out-of-box configurations that are very useful for setting up but should be deleted and at least controlled if it is not deleted to begin with. As well as limiting the repos and clusters that app projects can manage to limit the blast radius of an attack if it were to be realized.  This kind of gets into the principle of least privilege here at the end. So there's a few high priority findings given we're kind of short on time here I won't run through each one of them on the ArgoCD and user threat model reports on the Argo project repository and it will go through each one of these and kind of give you some recommendation strategies on them. So to the last question on how can we improve and we need to first kind of understand did we do a good job to iteratively approve, right? So through the exercise that we performed on ArgoCD, we generated 19 threats six of them being high priority based on the stride approach and provided recommendations and mitigation strategies for each of them and key to note here is the actual mapping of the high priority threats on our two attack trees and implementing controls to break those attack chains. So a quick thank you to the Linux foundation and the Intuit team for helping us with this and thank you everyone for listening in.


Hello, and welcome to this CUBE special presentation of the AWS industry tech partner showcase. This is season one, episode two, kick off the ongoing series covering the exciting partners from the AWS ecosystem. And this session is about enabling global collaboration in game development. I'm your host, John Furrier with theCUBE. And today we're excited to be joined by Duncan Huffman, who's the director of product marketing for Incredibild. They're building a great product at a great cloud and on-prem solution around making those build times great and making developers productive and actually making them more creative and more, give them free time. Duncan, great to have you on theCUBE here. Talk about game development. John, thanks for having us. So, you know, obviously cloud, everyone loves the cloud, what it did, democratizes more access to code. Now, next gen cloud, you're seeing a lot more things happening with AI and other things and the velocity of code, the velocity of new features are coming out all the time. And in game development, you're seeing that same trajectory going on for this used to be a complex, hard thing to do to be faster and looks a lot like traditional classic CIC to pipeline development and more, right? There's a lot going on in game development. So set the table for us. You guys are in the market with a product that serves game developers, C++ and game engine developers that are building large products and engaging products. Take us through to what you guys do. What's your core product? Yeah, we've focused down on one problem, which is the long build times. So long build times are a pain and have been a pain for since there've been build times. And so we free up developers to do other things. We crush those long build times down sometimes as much as 10X or more. And we, obviously for large projects like games, that can be the difference between getting out on time and having a delayed project. How did it all originate? What was the motivation behind it? Was it just, you guys stumbled upon the fact that C++ and game engines were heavy. What was the initiation? It started with a small team about 20 years ago. Incredible was actually one of the first partners that got embedded into Visual Studio because build times were such a problem for folks even back then. And now we've grown much different and we've got a platform or products that help with distribution and caching and with speeding up builds on the cloud, on Linux, on Windows, you name it. We've got the build times covered. So we're the leading platform for speeding up development. We're deeply embedded in the Unreal Engine. We work with the engineers there at Epic and we can crush those times by about 80 or 90%. That's awesome. And I can imagine that the people must be having a parade for you guys every time. They roll this out because you can see the benefit arduous task of these build times can be big. I got to ask you, can you just describe how it works? How does Incredibill for the cloud reduce the build times so dramatically? Yeah, so we take a couple of strategies there and actually you don't have to pick the strategy, which is good. You can use both. We do sort of standard distribution which is using spare processes, laptops, servers, obviously cloud instances to expand the capabilities of your machine at build time. But we also do caching. So we enable your system to store data so that you don't have to build more than once. You only build what changes. So this combination of distribution and caching at the same time is really the advantage of using something like Incredibill. And you can use any part of the platform. You can use just the distribution if you needed or both, we have some on-prem product as well as bursting to the cloud, for example. So depending on where you have those extra resources or where you need to spend that time, we can speed up your builds. I like that kind of intelligence aspect to it. Can you, this introduction of caching and distribution strategies as cool, how do developers benefit by not having to choose between the two? Can you talk about what that means to the developer? Yeah, I think for existing products, if your product was already ready to be parallelized, that's a very hard word to pronounce. So if you're ready for parallel distribution, we're ready to help you there. And if you're already built for caching, we're ready to help you there. And we can help with distribution there as well. So the idea is if you've built your project with that sort of strategy in mind, we can accommodate you. One of the big advantages of Incredibill is that you don't have to change your code. You don't have to change your tool chain. You don't have to change your processes. We actually work the way you work. And so that's what this is all about, not having to choose one or the other and then bring in a tool to help you build it. It's wherever you are, Incredibill can help you. That's awesome. Agility, no code changes. You can use existing tools and processes workflows. That probably hits a lot of seamless integration hot buttons there, right? I mean, that's one of the core problems is how do you seamlessly integrate tools in these complex environments? Is that kind of what that addresses? Absolutely. In addition, I mean, since you mentioned it, we do integrate tightly with TeamCity, with Jenkins, with all of CI-CD tools that you can imagine so that we're not forcing you to change your processes or learn something new or stop your team to go into training for a whole new set of systems. We work with whatever processes you have. You know, I mean, developers, I can see in the old days used to rely on local hardware to do their builds. What's the benefits of the distributed teams getting into the cloud? Because I can see all kinds of benefits popping in my head here. Can you just take us through? I can see the transition. What it's been like. Can you take us through what it means from being from the local hardware too? Now I got distributed teams and you got the cloud on AWS with IncrediBuild. Yeah, I mean, you highlighted it there in the question. You don't have that kind of hardware laying around. So think about infinite power in the cloud that's available at your fingertips and we can scale that appropriately. So you're not under provisioned or over provisioned for what you need at any given time. So when I hit build and I'm in a team in Brazil helping you build your game, for example, as long as I have just a hundred megabits of bandwidth I can hit build. And that experience for me is just as fast as it is as if I had 10 or 20 or 30 servers in my room or as many as we need. So that's the difference. I don't have to distribute those, that hardware around the world to teams who need to act nimble and fast and get things done. Can you give any kind of order of magnitude throughput or performance gain or what's the with credit build? What have you seen? Let's give us a feel. I'll give you an example without and with. Yeah, no, it's a good question. We've got, so just to anchor on some things that folks may have already used. So if you're working in an Unreal Engine on Unreal Engine 5.3 there's a sample game in there called Lyra. And without in credit build on basic machines we're running at about 96 minutes for a build. So it's about three hours that'll push you through to build, it'll take about 96 minutes. With incredible, we can take that down to about 19 minutes or less. So around an 80% time savings just on that sample game. And that's pretty simple. Things like source code compile we can go even faster, 89 or 90% increase in time. So down from about an hour to about seven minutes. Okay, you guys have a smart compatibility layer piece. And I know that's a big part of what you do. I got to bring up the whole cost side because you're seeing that come up a lot of people with AI conversations that were like, oh, it's cost too much. Yeah, always cost is an issue. With Cloud you obviously got variable costs, it's elastic, it's all great. What's the cost savings? What's the impact on the dollars? Yeah, so we have two strategies there. One is that our smart scaling, our auto scaling already helps not over provision or under provision what you're trying to build. So it automatically scales spot instances for example, for just what you need and then spins them down when you don't need them. So you're not spending any resources to spin up long-term instances or over provisioning for a build. The other thing that you mentioned though is a new feature of our product which we're going into a closed beta right now. I would love to invite anybody listening who wants to experiment with that to join us. And that's our smart compatibility layer. This is really exciting because for those of you who know Windows instances can be more expensive than Linux instances. So what we'll do is with the smart compatibility layer we can take your Windows instances and run those builds in the cloud on Linux instances which are significantly cheaper. Automatically, you don't need to know anything about Linux. You don't need to get new administrators. You don't need to change your strategy. You don't need to change your code. It will just spin that up and run that on a less expensive Linux instance for you. And you can cut down about 40 to 70% of the expected cost there even above where we are with Incredibles. So that's a pretty significant new feature. We're actually just announcing it here. I wanted to take advantage of the microphone to say, hey, we're doing this in closed beta. We'd love for some folks to come and join us on that. And as we get into open beta later in the year. There you go. We've got an Easter egg here inside the video. If you made it this far, you got access to the closed beta which is really a great privilege because you're being to be part of a really kind of an intimate group of design partners with you guys. So it's a really benefit. Take advantage of it. You heard it here in the cube. Smart compatibility layer beta for Windows instances which you can be a challenge. And it sounds like you guys have a good, good solution here with smart compatibility layer and love the auto scaling. Super excited. I mean, everyone just loves the cloud. That's one of the benefits cloud is, is auto scaling and managing all that infrastructure. So that's awesome. Just in general, how do you see your customers going forward with you guys? What's the current state of the art with Incredibles? Obviously the task that the big task of building large C++ and game engine projects is a key thing. Got that check cost effective in the cloud, accelerating key. What are they working on now? What are the key things that your customers are going to take us through the day of a life dunking of your customers? What they feel, what they go through and some of the benefits? It's funny because some of our customers are AWS, for example, Epic is not just a partner of ours, but Epic is one of our customers as well. Microsoft is also one of our customers. So these are folks who are building the future of technology and they rely on Incredibles to speed them up and to free up their teams. I think a lot of big dev teams are focused on developer productivity and developer velocity. And that is something that we can help with very directly.   Yeah, it's incredible. It's incredible, credibility. I mean, you've got the revolutionary approach this takes, I mean, it turns any machine you have on your network and the cloud into a supercomputer powerhouse, unlimited course. I mean, basically it's like unlimited compute. Yeah, and that's how we feel about it. And I think the move to the cloud, not just because I'm talking to AWS, but that is what I'm seeing in the conversations with our customers is they're really interested in getting off-prem and more distributed teams. So they've got teams all over the world building different parts of gigantic games, for example. And how do we enable those guys and empower them to get the kind of productivity that a team sitting in the same office would have gotten last year or the year before?  I call it next gen cloud. I'm going to see Adam Sileski a couple of weeks before reinvent for my exclusive. Last year I kind of tried to poke him on this and said, hey, you know, next gen clouds. Yeah, I wouldn't call it next gen. It's just sass. Well, it's kind of next gen. You got ecosystems, all kinds of new environmental impact teams. And so, you know, this year you're seeing a lot more impact of solutions like yours that change the team configuration. You got remote work, for example, taking center stage. Developers don't need to be hampered by all this prolonged build time. So that's going to free up more creativity. You're seeing more creatives being on teams, less dev because of automation and AI. So you're starting to see that change over where things like bandwidth, build times, all those tasks are going to be intelligently automated to change. What are you seeing on remote teams? You're seeing some team changes because we're hearing a lot in the game world that it's looking a lot like traditional development and cloud scale and a lot more creatives on the team emerging because it opens up the aperture of talent of developers. What are you seeing? Yeah, it's actually one of the big reasons we went after the caching feature of our product is where our build cache really does enable you to empower your teams to really work remotely and get that work from home angle covered because we saw that move in the industry, obviously during COVID, but now sustained and distributed teams are the norm. So building something over and over again and even in the cloud that has already been built is sort of unnecessary and a lot of wasted time. So our build cache feature enables you to just cache the entire build and then just build what has changed collectively as a group and really empower that work from home. And the cloud really gives you guys that innovation layer. I got to ask you real quick. I know that Windows thing is a great announcement to close beta, check it out. Windows users, Windows servers, Windows instances has always been kind of a challenge. The other challenge has been bandwidth, right? Those are areas you guys are tackling. Can you just quickly talk about how you guys take on those challenges? Yeah, so the core bandwidth we're looking for is ideally about 100 megabits. Now, you can definitely do things with less bandwidth and many of our customers do, but if you got about 100 megabits of throughput, you should be able to get just as much speed as anyone else. So that's the first thing that we try to keep things throttled to that level. But the other thing I got to go back to our build cache technology, you're only pushing up the pipe what changed. So if you were just changing an asset and hitting a build to see how that asset impacts your project, you don't have to push the entire project up the pipe and that's really where this comes in handy. That's really intelligent too. That's key value and a lot of data is moving through the data, so there. So all right, great. So final question for you, reinvent. You guys got some specials. How do people find out more with you guys? How do people get involved? People watching here want to take advantage of the closed beta, give a quick commercial on how they can get in touch with you guys and anything you guys got for features, any credits, how do people get involved? Yeah, so we do have all of those things. They should get ahold of our sales teams and our incredible teams are standing by waiting to catch the folks who are listening to this. So incredible.com is the place to go and to get information on where we're gonna be, when we're gonna be there. And there are a lot of matching credits from AWS, you guys are super generous. So if you guys have been hesitating to go to the cloud, worried about going to the cloud, incredible it's here to help you and we can facilitate that entire process. Thank you so much for taking the time coming on the showcase. Really appreciate it. Episode two of season one of the tech focused tech partner showcase. Thanks for coming on. John, thanks so much. Okay, we'll be back with more coverage here at theCUBE. This is the presentation of season one episode two. I'm John Furrier, your host. Thanks for watching.