Thanks, Pushka. Yeah, Pushka is a great member of our community. He's worked on a lot of the stuff that you see today in our presentation. Cool, so let's get started. Yeah, we got somewhat of a contentious title, creating cloud-native security. What do we mean by that? Isn't cloud-native by definition intrinsically secure or meant to be? We're going to talk through the slides and during the presentation, what do we actually mean for creating cloud-native security? How to do open-source security in public, working in public, advancing the space, safeguarding the systems upon which we run critical applications and mitigating the structural risk as a whole. Brandon? Yeah, so today we're going to quickly go through who we are, how we're doing the things that understated, how we're going to secure our cloud-native security, build the whole thing. And also how we're doing it, which is very important and which we're collaborating with many different groups, both security and as almost as importantly, the non-security groups. So we're going to start off a little bit about talking about us. So who are we? We are the CNCF tax security. And the tax initially renamed from sick security exists as part of the technical oversight committee or the TOC of the CNCF. Essentially, you can think about the tax as kind of extensions, like arm extensions of the TOC in order to kind of help educate and to be able to help drive the technical decisions of the TOC. So our main scope of work, our main charter, is really create cloud-native security with essentially the goal of balancing the whole protection versus usability, right? That's the HO question with security. We concentrate a lot on common tooling. And I think this is a very essential part of, we are given this gift of having a green field with cloud-native. And we want to make sure that we build everything together as a community. We have common tooling. We have common auditability methods and so on. Our charter, just to add, informs everything we do. It informs how we engage. It informs our strategy. You've seen the cloud-native ecosystem, the interactive page where it has all these projects. A good chunk of those are security solutions. And there's no clear interface or boundary between many of these. The space and the problem domain is quite broad. There's a number of sharp tools out there. And we work with all these different projects. We prioritize work based on incoming requests from the TOC and the community. So we jump onto different projects. We do look out for common tooling. And part of it is, well, the problem is challenging because a lot of the getting started on the technologies is a high barrier of entry. These are very complex, expert-level systems. And there's not a lot of documentation. The maintainers may have a very good understanding of the failure modes, of the security boundaries, of the execution paths. But these are typically not well documented. So we do fill in for quite a bit of that. And around it, well, we're trying to fill in those blanks. And in order to fill in all these blanks, we, as a community, are not just security professionals. We work with developers, DevOps, Ops folks, the managers, engineering managers, and also folks that are coming in new to security because we are building all this for them and not for us. So we are largely community-based. We believe that this has been a successful model so far. All issues, all the PRs, all the efforts mostly have been driven by the members and participants of the community. And right now, we are almost, I think, at least over 100 members. And we come from 60 different companies. If I could get a show of hands, members of the tag who are here in the room with us. Awesome. Pretty good turnout. Some of you are security engineers. Some of you are practitioners. I see some product managers in the room. I see some tech writers. So we're a diverse group of folks. There's work for everyone. And there's just many ways to get involved, and we're going to talk through those. But yeah, part of that is democratizing security, making it accessible. So over time and the two, three years of existence of the technical advisory group, we have been very focused on outputs and artifacts. The way we work has proven successful by recent publications that have been quite timely. We have the cloud-native security map. We have the cloud-native security landscape. We have the secure software supply chain. Best practices. We have a reference architecture that is in the works. We have a number of other security resources. Cloud-native aid guiding principles for building security from the ground up. That is currently open for review. We're going to make some of these links available for posterity. We want to get as many eyes as we want on it. A lot of it is departing from security by obscurity. You can see a list here of a few other things. While the personas, the supply chain catalog, we're going to show different samples of these. Awesome. So one of the things that was initially our focus area within, this was back I think a year and a half to almost two years now, was the cloud-native security of white people. And essentially the whole idea of this was that we got a lot of people coming to us that were like, I don't really understand what cloud-native security is. How is it different from regular security, traditional security? Folks that are moving from on-prem VMs to containers are like, what's different with this? What is DevOps? How do I use it? And essentially we got together and we built the cloud-native security white paper. So the white paper is it first defines what is cloud-native security? Why is cloud-native security different enough for us to write a white paper just about it? Talking about the essential tenants and the methodology of cloud-native and how security has to evolve so adapt to them. So we go all the way from develop, distribute all the way to runtime, going from how do I develop my application? How do I do the checks? How do I publish these artifacts in cloud-native ecosystem? How do I consume and use these different artifacts? And then we talk a little bit about high-assurance things which are a bit more popular in cloud-native deployment such as zero trust. Now that essentially we are able to create Kubernetes platforms or different container platforms on top of infrastructure, how do we establish trust between the different islands? And we talk a little bit about compliance in terms of how it also affects different regulatory industries like finance, financial and federal. One cool thing is that this white paper has been very useful. We'll talk a bit about later. We've got some really good feedback that drives some of the work that we're doing. In fact, this white paper wanted to be used by, I think, in Brazil. And in Brazil there's a policy that you can only use a document for government contracts if it's written in Portuguese. So we do have a couple of folks that are translating this into Portuguese. I think we also have it, it's already translated in simplified Chinese and we have a couple that are ongoing. Obviously we also are going to adapt to some of the new things that are coming in. We are planning a version 2 white paper with the EOs coming in with this publishing the SSDF paper which has been, I think, some public command last week. We'll be looking at that and perhaps thinking about how we are going to close some gaps that I mentioned in the paper. Part of the intent here is I personally come to KubeCon and I get super excited for a lot of what I see and I tend to grasp it typically really quick, but I get back to work the following week and I struggle to be able to explain it to anyone else in my team. Particularly so if there are other security folks and let's not even talk about risk people. So the idea here is to empower individuals with a toolkit where they can become conversant and help articulate the value prop of security back to the organization and just get through those challenges of working with the different stakeholders. Yeah, and so another thing that we've done here and this was a follow up from the white paper is something we call the CloudNative Security Map. And the idea behind the CloudNative Security Map is to create a way or an interactive way for folks that are coming in to have a bit more practical guidance on things in the white paper. In the white paper we talk about general concepts or you need to sign your things, you need to verify them, you need to check the provenance of your containers and configure your runtime, but it doesn't talk about specific technologies. How do I actually go about doing this? So the CloudNative Security Map is an interactive page and it's actually hosted as a website. It's live, unfortunately it doesn't work on mobile, so don't try that. But the idea is you can navigate into the white paper and look at, okay, I'm interested as, you know, you have to start in security somewhere, right? So evaluating within your organization maybe I'll start with container image provenance, right? So I go into development or go into container image signing and provenance and then it will tell me basically, you know, here are the tools that I can use to go ahead with that, so it will talk about in total, it will talk about things like 6R, basically all the bunch of different tools and some general guiding principles around that. Another version tool that we have on this security map is to come up with something we call guided tours. This is still work in progress, it's about to start. The idea behind this is we want to define really what are certain tangible stories that people can take and start adopting. So let's say my boss goes to me and says, we need to do supply chain, supply chain security, right? So we will have a guided tour that says, okay, here's how you go about doing supply chain security. Here is how you're going to go about doing runtime security, doing risk management and things like that. So these guided tours will basically provide the connections between the different parts of the white paper and to put it in context of a specific technology. And we recognize those journeys are typically a progression. It maps a little bit to a crawl, walk, run almost. There's a process of discovery, there's a process of developing a better understanding from there going to a place where you can do architectural reviews and design reviews of these technologies to where you can make it part of your infrastructure topologies. So we're trying to incorporate that progression of adoption of a technology. So it's not just you go from zero to like full-blown web-scale prod, but it's gradual. It's a little bit of a couch to 5K program for security. So another project that we want to highlight here is something called the supply chain catalog. And this was put into place to kind of address and help folks understand and also show the importance of supply chain security. This catalog contains all, well, most of the supply chain security breaches over the past few years and is a good resource to kind of learn about the different types of supply chain security in the real world in the wild and also as a way to kind of convince stakeholders and high-level executives that supply chain is indeed something that's going to put you in the Wall Street Journal. One thing I'd like to mention about this piece of work, which I think this was really cool because this stemmed from a single contributor that was like, I want to do this. It was a maintainer of InTotal of Santiago and basically said, I want to do this. He proposed it to the tech. We said, cool, this is the line with what we want to do as a community. We did it.  Now, this is our living document. It's in GitHub. You know, if you find a new supply chain, something gets released. Supply chain vulnerability. Supply chain breach. You can go ahead. You can go in and just create a PR to do this. One of our other work streams very much tied to secure supply chain has been producing a codified what are the recommended practices. If you look at what are the entire set of controls mapped to risk profiles. If you are reasoning about a set of workloads that are not top secret but you still be secured and you require a variance between there's a differential between the guarantees. What are those different levels and how do you implement those in? Do you have a question? I saw you raising your arm. We produced and published the best practices white paper. This was led by Jonathan Meadows head of cyber and city collaboration with myself. We had about 15 to 20 other people who contributed and collaborated to this effort. There's a recording from KubeCon Europe where we talk about and go through the different aspects of the white paper. We have progressed from there well now that we have described a software factory end to end that incorporates security from the ground up. How do we translate that into an architecture that pieces all the different components that you can use as a reference. This is being developed with I see a number of folks in the room Marina Moore called Kennedy driving a lot of the work of well if you're reasoning about reproducible builds what's the relationship of that to like cryptographic identity. These are things that we typically don't see the relevance from one to the other but as you look into the bigger picture you need the different moving parts. As someone said yesterday you could have all the parts that make up a piano but if they're not assembled together right you can't actually play it. So it is that effort of like how to build the software factory with yes paying a lot of attention to the assembly line but ensuring that well the access point the entry of physical security of the different layers of it are also commercially secure that they're watertight. We are going to be opening it up for public comment in the coming weeks and from there then we intend to start writing some code so people could check it out and run a sample of that software factory and start building around it and on top of it. Brandon if you want to add something to that. Yeah I think this is something that really we want to as a committee show people that this is something that is attainable it's something that if you put a bit of effort there and I think Michael showed this a few others are showing this there's a lot of projects out there that can help you attain reasonable levels of supply chain security. There are gaps that need to be filled but we think that by showing this to others they'll follow suit and be able to say that this is a reasonable goal that's not adopting it in an organization. You probably have heard a lot of Salsa this week this factors and Salsa it factors different risk profiles, different security guarantees what are the compensating controls so it is very much attainable we're trying not to be overly prescriptive and say well at the current time these are the most mature or feature complete technologies in our ecosystem that you can piece together to accomplish this but we're also trying to provide alternatives and say well you could very well do this with tecton chains or you could do it with Jenkins X as an example. So we talked a little bit about what are some artifacts that we produce as a group and I want to spend a bit of time before we talk about how to contribute some of the things we do not necessarily things that end up in papers but things we do to help strengthen the security of the ecosystem and how we work together with other groups so big part of cognitive security and creating it is education and partnership this actually comes in the form of engagement of different projects and communities so an example of that the ecosystem in cncf we have something that we introduced earlier called security pals the idea is that especially with new projects coming into cncf as sandboxing or incubating we will have someone there to guide them to talk about what are the security considerations you should integrate from the start security is something you should keep in mind and not an afterthought so that is something that we are piloting it is going great we almost have our first projects done with that we also have something else that we do is security assessment and joint reviews this essentially is looking at the other cncf projects and assessing the security posture of it I won't go into much detail because Andrews will cover that in the next slide and of course we work with a lot of related groups OpenSSF, obviously Sousa for supply chain stuff we work with the Kubernetes 6 security group there is a lot of overlap with the members and this is great because we call each other out and also we want to make sure that we set realistic goals and make sure everyone is on the same page and then for our members presentations this go from presentations of projects in cncf or on security recently we had security defense, Kyver new projects coming into the cncf so that folks can get updated with it and also we have certain talks around like threat model you know behavioral security, how you manage security and organization and things like that cool, so do you want to talk about security assessments? we'll tell you about security assessments we'll start off to tell you my an anecdote really of how I got involved in security assessments I was working in the spiffy inspired projects shout out to the team, I see them here in the front seat and the project was at sandbox stage and we were pursuing trying to get to incubation and performing that due diligence and security audit security reviews where one of the requirements would have to meet in order to make that progression and the project had actually been scrutinized and reviewed and threat modeled and I quite didn't understand why would we have to do this over again and put it in a particular template format and it seemed a lot like an inconvenience so well we're security experts we know what we're doing our technology is battle tested it runs in production I don't think we're going to do it extract much value of it and it's more something we just need to get done now we got engaged through first off being able to in order to kick off an assessment you have to produce a self assessment and you need to explain to the technical advisory group the design of your project the threat model of your project the different security attributes of it and from there on folks, the reviewers start poking holes and this engagement typically lasts between a month or two months it's 10 to 20 hours over the course of this period of time after we completed that we actually not only got a better ability of how we talked about the security and value prop of our projects we were also left with a great artifact that helped us gain a broader reach because one of the typical bottlenecks when we were helping organizations trying to adopt SPIRE was a platform engineer would get it some security engineer would get it but when they had to deal with the infosec as part of the review in order to get to production they always had to call Evan Gilman or Andrew Harding or myself to threat model the project life so now we had a document sanctioned by the CNCF that would help us to speed through this review and would actually shorten the time to get to production because yes we can come up with an idea we can develop a code we can deploy it to some cloud environment but in order to get to production the biggest gate remains to be going through a security review going through a third party audit and now we have something that drastically accelerated actually getting there and having those folks satisfied with defensible arguments so it codifies a lot of that since that I've participated and I have to pay it back and this is how I got involved with tax security as we extracted so much from this I want to help other projects in this journey I led the security assessment for Harbor it is published also the assessment for BuildPEX, Brandon you've done a few others you're actually the reviewer for the Spiffy Inspire assessment so security assessments and reviews are something that we've done way back a lot of the projects that come to us say that they like it it gives them a document to point to and also it provides kind of a boost of confidence with the TOC as well in terms of doing due diligence we also will be working to integrate this into the graduation process obviously that's always changing so we are finding the right place for it but this has been something that the TOC has always advocated and we will continue to do so I want to underline the word confidence it's not just confidence for the different stakeholders but even for the project team for the maintainers because oftentimes we suffer from imposter syndrome and until you actually restate assumptions and look at your code base and say oh we're actually doing signed binaries and we're actually following the set secure software development best practices so part of the assessment is actually filling out the rubric for the core infrastructure best practices batch and it was a huge boost for all those different projects that have gone through the process because well we understand how we stack rank against it we actually do quite a bit of it or we don't do this much but here are all the other directions that we could do that are going to give our end users trust are going to make us more trustworthy and we're again better equipping them to take this places at their respective jobs so yeah I think that's all I have to say about security reviews yeah I think that the last thing I may add is like for projects that may want to get an official security audit like a KO53 trail bits type audit is helpful so to go to us we can do an assessment and then we can also make a recommendation to the CNCF TOC that this is a security critical project we think that it should be audited and we should buy an audit for it yeah and our experience working with Q53 Q53 always gives praise because it actually helps them come up to speed much faster so you're going to be able to take more advantage better use of the professional third-party audit that the CNCF pays for once you've done the prep work produce the information it's only going to expedite the process and I'm going to give them more to work with cool so I think the last thing that we wanted to talk about today just in terms of what we do is micro-surface or surveys in general this is something we do to kind of keep a pulse on you know what's happening outside the end users you know outside the security bubble what do people think about from the outside what are some things we can work on as well as to you know go back to the TOC and say that okay here is kind of a constant pulse of what's happening and how we're trying to address it so we did this we did the cloud native security white paper survey to kind of get people's feedback on you know after understanding cloud native what do you think is lacking what do you think we can work on the results of the survey said that security faults was number 1 and then we had the cloud native 8 which was talking about security faults that Pushkar was working on which is up for public comment by the way so please take a look at it all the feedback is valuable and then based on that just recently a couple months ago we started on the cloud native micro survey and this survey was talking about what are the challenges of organizations today what are they worried about and we see a lot interesting data we saw that you know obviously supply chain is a big issue but actually not far to behind of supply chain vulnerability management was like 10% behind supply chain secret management was another one we talked about where organizations saw that there was a gap in open source so this was around like secret management vault kind of stuff HSM alternatives there were no HSM alternatives that people were kind of looking for in terms of trying to use them in their organization and then part of these surveys also we think a little bit kind of ahead to things like H and 5G we kind of ask people what their concerns are and they kind of look pretty much the same but what the regular concerns are with addition on detecting suspicious behavior because you know all these devices are in places where there is physical access cool so Andres do you want to talk a little bit about where you can jump in? I think we're coming up in time but there's plenty of ways to get involved it is a collaborative effort security is a huge responsibility but look to your right, look to your left this is a good chunk of the people in the world who are entrusted with it unmitigating like the pervasive attacks we keep on seeing that it's mind-boggling that these things continue to occur when technology is available we just haven't productionized it well enough so we have a mailing list click on it sign up, stay in the loop of our different communications come to our github repository we do our best to triage issues what's low hanging fruit what's a good first issue what areas are we looking for help we meet weekly every Wednesday over soon Cameron Cedar is regularly on the calls you can ask him and see how we work there come join us we have calls for the different working groups the supply chain call happens every Thursday come to our Slack channel if you don't want to jump into the deep a good glimpse is our roadmap the project board on github that will give you a good sense what initiatives are at play what things are in our radar that we're planning for what things are we being asked for but we haven't actually quite gotten into so there's plenty of ways to get involved if you don't see something that is immediately interesting and you have ideas propose if you are particularly passionate about something that you think we have overlooked we'd love to hear what's on your mind we would love to collaborate with you on how to engage others we're looking to participate and help us continue to secure and safeguard the cloud native ecosystem with that before I walked in and to the room I had a huge confidence boost from Cole Kennedy who has a little bit of a recent participation but I'm trying to paraphrase what you said but we could hand him a mic and share what you said so it's just not me trying to tell you the virtuosity of tax security but if you could share a little bit of your experience yeah so I first got involved with tech security through some of the work I was doing Spiffy Spire presented a little bit actually last year at KubeCon through the CNCF Slack and from that moment on I just felt like a big hog from the SIG Security and my clients that I was working with at the time when the SolarWinds happened were really affected by it it's a serious issue so the first thing I did was we didn't have the expertise to deal with that but when we got to SIG Security and started working with them and it really you know Andres brought me in he actually co-authored an article that we posted on our company blog and he was working for VMware at the time so not only did I feel that personal hug he also helped my company deliver value to our customer she didn't need to do what the security tag can do for you is both elevate not only you on a personal level by including you but also on a business aspect right you have some of the greatest security experts in the world ready to answer like any questions that you want and that's a really powerful tool to use to help your customers and your initiatives that you have within your organization to ensure that you're more secure so what it is is that when you do get involved when you come to places like CubeCon there hasn't been one dull moment here I've been invited to dinners every single night I've been here I don't know how many hugs I got from pop and bananas so if you have issues with your cloud native deployments or questions from your regulators about the security come in and ask your questions I promise you'll be welcome thanks so much we're available to your disposal consider as your security friends yeah and just like a reminder again we drive everything to GitHub very community focused again open to whether you're someone that's new to security someone that's keen to learn our community is very friendly we need folks all types of folks to give different perspectives and ideas and yeah as the leadership team the co-chairs and the TLs are always open to your DM so message us just ping us on the Slack channel what questions or feedback do you all have for us this is our mascot by the way any questions one in the back thank you for talking what are your thoughts on getting a pen test traditionally done on your servers to test your security in the context of Kubernetes like clusters something that's viable worth considering I'm gonna try to say back to you what I understand your question is do we conduct pen tests and if not is it something we could be doing just your opinions on it like if it's good practice doing pen tests absolutely you want to stress test systems you want to measure them for their resiliency and how fragile they are and understand which different ways can they break a lot of what we do with the security audits is produce the information that will inform pen testers so we talked about the third party security audit that CNCF gives as a service to the projects I don't know if it's something they're going to be doing with the new credits program but a few different of the projects I've been involved they put in a very sophisticated crew of individuals to black box attack your project I don't know if you would come in here in front recently went through one of those I don't know if you would mind saying a word or two about that I'll pass the microphone up here great question thank you thanks Andres yeah so our projects went through I wouldn't quite call it penetration test but it was the cure 53 security audit that was referred to earlier it was like half way kind of I guess it was half way between white box and black box but it's one of the benefits of being incubation of a project in CNCF is that you're able to do this audit and the CNCF will cover cost our experience going through that process was actually very good and those folks knew exactly what they were doing they uncovered a few pretty nasty things that we were able to respond to quickly luckily but we learned a lot in that process and it was hugely, hugely valuable probably one of the most valuable security review processes we've gone through and so you know I cannot recommend it highly enough I'm not sure if that's exactly what you're referring to it with the pen testing you know I know that there are different opinions on the effectiveness of live pen testing on production environments but the experience that we had going through CNCF sponsor security review was second to none and I cannot recommend it high enough yeah there's actually, thank you Evan for that that's very insightful there's one distinction in there of the usefulness of a pen test of a runtime system and when we talk about the ephemerality of things and like systems that should be immutable there shouldn't be any runtime drift arguably a pen test would be poking a little bit into those wounds if those things are not there but it can surface additional information the audit is a little bit more like not in production to say but yeah all right so I love the enthusiasm but we are out of time so I request everyone to go and chat with any of the tax security members including me on the hallway thank you Brandon and Andres for the session hope you all enjoyed it yeah thank you


Well, this is the new chapter, or this is the title, that is the reproduction. Or we will read the reproduction, we will read the types of reproduction, or we will read the reproductive systems as a type of human or till birth. So, all the processes, all the events we will study which are related with the process of reproduction. So, first we have to understand what reproduction is. Reproduction, it can be defined as the process, as the life process, in which new individuals are formed by their, like their parents, like their parents. So, reproduction is the basic characteristic of living things. So, all living things we produce, they give rise to the individuals like their parents. Or this character is very important, in fact, for the continuation of the species. So, the individuals they are dying, and until they are replaced with a new one, those species ultimately it will come to an end. So, there are two types of reproduction. One is called asexo, the other is sexual reproduction. Or asexo reproduction is a process in which there is no involvement of the fusion of gametes. There is a simple organism, the best example is a produce one for example. So, it divides mitotically, in animals there is no meiosis, which is produced asexually. So, and the organism reproduced by mitotic deviants, producing offspring that are identical to their parents. Or it does not involve the fusion of gametes. So, organisms that reproduce asexually, they are usually found in stable environment. So, in a stable environment, in which they say that they are the best suited, they can well, that is live comfortably. So, because these animals, they cannot maintain themselves. That is thermoregulate, temperature wise they cannot regulate themselves. They are the same, because as the temperature is of water, the same temperature is of animals. But they cannot tolerate extreme conditions. So, they will be living in a very, as a environment where there is very little, very little fluctuation. Or as an example, those asexually reproduced animals, there are so many produce ones which are reproduced asexually.   What are these other reproductive cells? Or they are produced in their reproductive organs. Or these gametes, they are fused together to form again a single cell. There are two cells, one coming from the one parent, the other comes from the other parent. They are fused together to form a single cell, which we call the zygote. This zygote that develops to form is unique, that is a new individual, having two kinds of cells. There are somatic cells and germs. And this zygote that is formed, half of the chromosomes come from the one parent and the other half comes from the other parent. So, it becomes a deployed cell. And this deployed cell, when it develops and becomes an individual, then these individuals have two different cells. One is called somatic cells, the other is called body cells and the other is called germ cells. Then the gametes are formed. As we can see in this diagram, there is a myosys in the reproductive organs. And as a result of this myosys, there are eggs and sperms. These, they unite together. It is called the fertilization process. And then it becomes a deployed cell. And this deployed cell is called zygote. It has mitosis and it becomes an individual. So, germ cells that are deployed, which are deployed, they have myosys in them and then they become gametes as a result of myosys. And gametes, we call them as, they may be the sperms and eggs. They may be sperms and eggs. Then they unite together to form the zygote. So, ovum and sperm, they fuse to form zygote. The zygote then divides by mitotic deviants to produce large number of cells that differentiate to form different organs. It is a very interesting thing that zygote then divides repeatedly and then from different stages, it becomes an individual who becomes an adult. And the reproductive organs of that adult individual, who then have these germ cells, which we will read in detail, those are the gametes, the spermed gametes, then they undergo the process of myosys to form sperms and eggs. Again, they unite together to form the new individual. This is what is called as a sexual reproduction.  And then I am telling you that this is, in fact, it is a very important characteristic for the continuation of the species. So, this is reproduction and its types.


My very first Commodore Amiga. Hey ho, ho, that's bad. That's garbage. Ah, good grief, this is crusty. Now, nice and clean, this was all scrubbed. So I'm going to try and go through that pile of floppy disks to see if I can find a workbench disk. Okay, here we are. It is up and running. I have a big tangle of cables as this is going off to a video capture device. It doesn't seem to like the Amiga output very much as it just produces a black screen. But if anything shows up, I'll composite that on to get a better look. I went through the floppy disks. There's a lot of really filthy disks including copy of workbench. Four different copies of Xcopy. A couple of rather disturbing disks with scribbled on labels, so let me just try sticking a workbench disk in and see what happens. It doesn't really go in very well, I have to say. Bad noise, that's not registering. So, what's making the scraping noise? Is it the disk rotating? I mean, it looks clean enough. Ooh, that side doesn't look clean. It's got corrosion on it. Well, one pristine workbench disk in the bin. What about this one? That's dirty. That's dirty and bent. Can you see here? What's this side got? Well, okay, workbench gains collection. This is a magazine disk. When the days when you've got floppy disks given away in the front of magazines. This looks better to be honest. Is that going to pick anything up? That's going to try power cycling the machine. That will be a no. It's not actually even registering as a disk present. The Amiga's supposed to have automatic disk detection. I don't know if you can hear, I'll hold the microphone close. That noise, do that again with the microphone in place, that noise is it checking for the presence of a disk. And it drives you insane after a while. The case could be more firmly closed. You think the drive is faulty? Okay, that's another one. This may just be a printer driver, but it is labeled workbench 2.0. So let's take a look at the disk. That's not in great shape. That's quite dirty. Ew. Of course it's the inside that matters. It's not brilliant. Right, the disk is not actually going into place properly. Let's try that again with this. Yeah, I'm going to have to take this apart and fiddle with the floppy drive. Which is annoying. Okay, here we have it open and running with the lid removed. This gives me rather better access to the floppy drive, which is somewhat buried inside the machine. So that's not actually going in. Yeah, that is what I would call broken. So I was able to actually just pop the lid on the drive without having to unscrew it all, which reveals some rather interesting things, such as when you insert the disk, it gets about as far as here. It's supposed to then click into place and drop down. You notice that this moves. That's not supposed to do that. I think it's rather bent. Oh, that's better. Have I managed to cope this back into position? Well, the only way to find out is to plug her in and try. There was a plastic thing here that just popped back into place. So possibly that was it. Right, now it's popped back out again. Yeah, this is not a happy floppy drive. Okay, let's see what happens when we power on. Well, that's making better noises, but it's not booting. This, you can see the head moving. That's the disk auto detection. Right, it's spinning but isn't booting. Let's try one of the other disks. This is the one labeled workbench. Hey, it's actually working. We do have a AmigaDOS screen. I had unplugged the mouse. Let's plug that back in again. There's no keyboard. This is the original Commodore mouse. And I will actually post a picture up here of the mouse ball as I was cleaning it. That is why you need to clean your mouse balls.  I don't think that's the Amiga's fault. Workbench 2.0 has a checksum error on disk block 1738. So either that's a bad disk or a bad drive and it's wedged. Okay, let's try the games. I need to power cycle. This is clearly not a bootable disk or it's just too badly damaged for the computer to read or the floppy disk drive is damaged. These disks are revolting. Yeah, that's also not bootable. Okay, I did not find a Workbench disk in there. I think I'm going to go away and go and try and make one. So here is a copy of Workbench 2.05, which should work with Kickstart 2.0. I made this using Flux Engine. I downloaded a CryoFlux stream from... That was quick. From archive.org, decoded it to an ADF with Flux Engine and then wrote the ADF back to a floppy disk using Flux Engine. And... Well, I've got something. If DIR doesn't work, I really don't know where to go. Here in the selection of disks, I found a copy of Treasure Island Dizzy that looks reasonably clean. So this should be a booted game. So let's see what it does. Looks like it's booting. I'm not particularly convinced by the noises the floppy disk is making. Also the way it's just hung. So while I was rummaging through disks, this happened. So clearly it was just thinking, probably decompressing something. Does it work? Probably want a joystick, of which I don't have. So here we have Lotus Turbo Challenge 2, CBM Amiga, Piracy's Theft Gremlin. This seems to be reasonably happy so far. I think on the whole this machine does work fine. I need to find a workbench for it. I probably also need to upgrade Kickstart if I'm going to use a hard drive. The version of Kickstart in this apparently doesn't work properly with small hard drives. Sorry, with large hard drives. Which means any hard drive you're going to get these days. So I'm probably going to need to upgrade it to 3.x, which is the latest version, which you have to actually pay money for. That'll give me lots of bug fixes and some new features. And then I'm going to have to find a copy workbench and install that and then figure out how it all works etc etc. One of the reasons for getting this was to learn more about Amiga's and AmigaDOS, which I don't know much about. I can't think of anything to say while this loads. It's only 800k. That's a bad noise. Right, bad disk. Yeah, most of these disks are going to be pretty dreadful. This one doesn't even have a disk shutter. I think it was... It might have been made like that. Or somebody just pulled it off. But I think I'm going to call this done. I'll just... This is the best I have at actual workbench. Just wait for the... So something is not right about it. I can at least type, which lets me know the keyboard works. However, there don't appear to be any commands available. You notice the caps lock key has an LED in it, which is nice. These two interesting two blank keys, this one doesn't seem to do anything. This one produces a character that's too small to read in this tiny screen. Anyway, we see, DIR does nothing. I don't actually know any... Well, that does something. I believe that's told me what directory I'm currently in. The... Yeah. The AmigaDOS directory structure isn't the same as Unix. I'm going to have to go and read up on that. Anyway, I am going to call this done. There's some work to do. I need a kickstart ROM, workbench floppies, a Amiga to VGA video adapter so that I can use the proper monitor that's up here rather than this. This is doing a decent enough job, but it's just not big enough to read. The mouse works, which is nice. This is the original Commodore mouse. I haven't tried the other one yet. And above all else, figure out how this is actually supposed to work. Look what just showed up. This is a package of goodies for my new Amiga 600. So what we've got here is a kickstart 3.1 ROM, a copy of the operating system itself, workbench on floppy disk, plus a pre-formatted compact flash card, should be 4GB, an instruction manual, a... Hopefully this is... Yup, this is an IDE to compact flash adapter. So these are going to work as the hard drive. This will replace the old broken hard drive with something that is quieter, more reliable, less power hungry, etc. I've actually got the hard drive here. This is the one that was originally in the machine. A nice old Connor... I think it was... 60 megabytes. Mega, not giga. Sadly, it's completely defunct. And very importantly, we've got this, which if I can get it open, is a Amiga 2 VGA adapter. It doesn't do scan doubling, so it'll only work on the VGA frequency and screen modes, but hopefully it should give me a rather better workbench experience. You notice here the... This has been sliced away, because the Amiga video socket is a really weird size and you can't get them anymore. They're not in production. So to make these, they have to buy a larger connector and saw off the remaining bits. So, yes. And I got all these from amigastore.eu Nice and quickly. So, I'm going to install it. So first, we want to look at the instructions. Yes, those are instructions. Remove the ROM chip. Plug the new ROM chip in. Put the notch in the obvious place. Yeah, those are instructions. Okay, let's get the Amiga out and have a go. So before doing anything, I'm actually going to verify that it does still work, which it does. I'm using the little composite monitor again, that's what I've got. And we can see here, it says this is 2.0 ROM version 37.300 in rather small writing. Actually, I thought this was 2.1. I thought I had Amiga workbench 2.1 on floppy somewhere. But anyway, now let's turn it all off and open it up. And what we've got here is a really simple job. This is the old IDE cable, so all we need to do is to plug this in. And then we plug the compact flash card into it. So, and it would be nice to have somewhere to screw it down. It should screw onto this bracket and the bracket is not actually held in by anything. It just sits in slots on the motherboard. And then this top piece here and here are pressed against the top of the case, which both helps keep the case rigid and holds this in position. So, what have we got screw-wise? We've got metal on the bottom, which isn't a good start. I think screws are probably out of the question. I think I'm going to need to use a sticky pad, so I think I've got some somewhere. Let me go look. Here we are. These are like decades old. I'm not really a fan of these because they're quite hard to get off once you put them on. So, but they will do nicely for this job. So what we're going to do, if I can figure out how to get them off, is stick a couple of these on here and here. Pretty crudely. And then we push it down onto the bracket. I wasn't really worried I wanted to put it, to be honest, but it's stuck now. This is a little bit cramped. I'm going to come off again. No. So that is fairly solid. Right. The next thing is to replace the ROM chip. And the ROM has a huge serial number on top, which I'm going to have to pixelate out laboriously in the video. This is all, Workbench is all still commercial software, which is kind of weird for retro computing. But it's never been open source and you do actually have to get the ROM component and these cost money to make. So I will prevent people from stealing serial number. I need a good way to get this out. You can do this with a screwdriver if you're very careful. This one is stiff, really stiff. But you've got to be very careful what you're levering against. So I'm trying to go for the... That's not working. I'm trying to go for the chip socket itself and not end up levering against, for example, this irreplaceable chip here, which I do not want to damage. Just need a little bit of clearance. Get some leverage. I don't have a chip remover tool. I should probably get one. Fantastic. Let's find a smaller screwdriver. The pins will have welded slightly to the socket because it's been years since this thing has been removed. So once it moves a little, it will start moving more, which it's done. It's all unstuck now. Of course, if I lever up on one side, it levers down on the other. Anyway, it's out on that side. So here we go. Just being very gentle. Right. That is out. How does it look? The chip legs are a little bit discoloured. I'm going to give it a squirt of contact cleaner just to loosen things up a bit. So I will go and grab that. Yeah, after some time spent looking in my liquid drawer for the contact cleaner, I forgot that I had not actually put it away since the last Amiga video. So anyway, let's stick it on. Okay, that's all it needs. So we now take the Neurom and the legs need a little bit of bending inwards to make them fit because they always ship a little bit splayed for no readily apparent reason. Make sure the notch lines up with the notch on the socket and push. Done. Okay, so I'll put the 2.05, 37.300. I don't think this was the... Was that what the ROM was reporting when I booted it? So put this away and now we put the keyboard back on. And power. So signal is on. It should be booting from the floppy drive rather than going into the floppy boot process. So this should actually be doing a full hard drive boot. It hasn't done anything. Now it's possible it's actually gone into a screen mode but this thing doesn't support. So I'm going to just unplug this and plug it back in again. Yeah, I haven't seen the thing light up so I suspect it's gone into an invalid screen mode. I would have thought to be honest that it would have started up in the same TV compatible screen mode that you would... that the old Amigos would have but maybe that's not the case. So let's just plug in the video connector These... Those pins are in a terrible state so let's just put some of this in. I mean, there's nothing wrong with the contacts on this but they should clean up the video pins a little. And find where I put the VGA cable which is here for my workbench monitor. Plug that in. Okay, and power turn on. The monitor did just flash up. I don't think anything's happening. Yeah, we've got no signal there either. Right. That's not brilliant to be honest. Let's have a quick flip through the manual again. I'm relatively certain as I put the ROM in the right place I'll check that in a moment. So these pictures do not actually match here. Oh right, this is just how to remove ROMs. These are pictures from an A4000. This is from an A600. There's nothing useful there. Okay. Yes, I put the ROM in the wrong place.  It's quite warm. I hope I haven't broken it. So the problem is that when the... If it's plugged in the wrong place then the 5 volt power connector is actually attached to a data pin. So it ends up short-circuiting through the ROM. Well, maybe I'm going to have to get a new one.  What have we got now? Got a bit of a signal. Right, this monitor is complaining this is the wrong screen mode. So some software has running because it's actually trying to enable the video. Still nothing here.  So... It's definitely cooling down. It's in the right place now. However, there's also a possibility that I've fried something else. So let us remove it. So much easier to get out now that I've applied the contact cleaner. And then reinsert our old AmigaOS 2.0 ROM here making sure that the hole's on the left empty and now apply power and see what happens. Good. That is a relief. Since this is now working it means that the Amiga itself is fine but the problem is mostly it's going to be probably this is dead. Well... Yeah, it was my own fault. I'm not going to dwell on it. I did actually notice that the ROM doesn't occupy all the holes in the socket. I just completely forgot about it when plugging the thing in. Yep, I think it's dead. I will try dumping the ROM using my ROM dumper to the actual PC and just see what comes out. I should be able to at least check some of it to make sure that it contains what it thinks it does. Given that I actually have a license hence all the pixelation I may be able to get a cheap replacement. Fabulous. Anyway, so we're going to plug this in and I'm going to put this back in just to see what happens. Now, that copy of workbench probably isn't going to work with AmigaOS 2 but I'll be interested to see what happens. Right, not a DOS disk in device GDH0. It's seen the PCMCA it's seen the compact flash card but it doesn't recognise what's on it presumably because it's just not going to do anything at all now. Okay, well looks like I've got some work to do I suppose I shall report back.


Hey friends today, I am hanging out at Disney's Coronado Springs resort It just recently reopened if you're not aware it was housing the NBA for a while But now it's opened up to us regular folks So I got a reservation at Rick's and we're just gonna hang out and check out the resort. I love it here It's got some beautiful views. So let's go do this. I'm not quite sure what is open I know that Rick's is open because I was able to grab a reservation I've seen some photos of three bridges, but like I said, we're just gonna explore Maybe we can go all the way up and just get a look at the view because this is a beautiful day Absolutely stunning I'm gonna actually start at the Grand Estino Tower and then make my way down to Rick's is but I absolutely love this resort I remember tracking the progress of the construction for probably months and years before it was actually ready And now look at it and all of its glory It's always had such an amazing smell in here, and I just love the way this resort looks It's beautiful. These lights change on the column. I Actually miss this place It's good to be back And without doubt, I would say it has probably the prettiest check-in area out of all the Disney World resorts Doesn't it just look so stunning and those lights all change like on Christmas time It gets green and red and then they have an amazing Christmas tree here in the lobby The Christmas tree is usually like right down there and you're not gonna be able to see it But underneath us is a lounge that serves like beer and cocktails and even some coffee So we're gonna go down there and see if that's open yet Looks like the lounge is open just for coffee and quick snacks The whole entire like full service bar is not open yet And it looks like it's open from 7 a.m. To 11 a.m. Just basically like breakfast hour And you can get all of those special coffee drinks that I was talking about before. Oh Yeah, I've had plenty of these and they are very delicious So basically it's just running as kind of like a breakfast quick service location 7 a.m. To 11 a.m This was always one of my favorite places kind of just hang out and have a cocktail or a Coffee at the end of the day. I'm sure it'll get back there eventually just you know in time and Hopefully in time for Christmas because usually they have a massive Christmas tree That's right here that goes all the way up and it's a great spot to just come listen to Christmas music Look at the lights and like I said have a like coffee or a cocoa or beer a light Now we're gonna see if the elevator is gonna grant us access to the 16th floor Which is the top because they have a restaurant in a lounge up there that has stunning views But I don't know if it's open or for a loud up there I mean if we hit 16 and it takes us up we have been granted access if not then that's a no-go. I Also like the elevator situation here at the grandestino All right, let's see if we're gonna be getting access 16 oh I Think we're granted access look at that We're going all the way up You raise me up that was actually the fifth floor. I feel like a fool You raise me up so I can see the 16 And we're up on the 16th floor. It looks like it's all closed. I don't think we're open for service yet It just seems so strange that We're allowed up here. Here's the lounge. This is what I was talking about Wait to see these views. I wonder if these doors are even locked But like they're set up with all their signage and like their social distance markers Yeah, see so they're definitely expecting to open if they're not already open Let's just give it a tug or a pull push It's open. Oh, yeah, awesome. Oh Wow, I've missed this view Look at this guys Beautiful up here I'm gonna give you Basically a guide of all of your sightseeing from the top of the grandestino because there's a lot to take in here First of all, we've got Epcot and spaceship birth and the swan and dolphin and then to the right here We've got the Tower of Terror and all of Hollywood Studios and even an amazing look at Galaxy's Edge right there and Then you can see the water park and even Expedition Everest look at that. I think that's like the best view of expedition ever she can get really can't do any better Oh, you can actually see the floating mountains and Pandora from here, too That's really neat I'm gonna have to talk to a cast member when I go back downstairs to see if this is actually open Because it normally doesn't open till four o'clock So I don't know if it's not open yet because of the closure or if it's not open because it's not four o'clock yet But we're gonna find out I'm gonna get some answers Because boy, oh boy, let me tell you what if it does open at four o'clock I will definitely come back one of these days and just hang out here because like I said This is like one of my favorite views out of all the Disney World resorts I mean, you know the top of the contemporary is up there because you get to stare at Magic Kingdom But you get Animal Kingdom you get Hollywood Studios you get Epcot and he just it's kind of just beautiful with the whole trees and everything It started to get a little bit windy out there. So I came back in but can we just appreciate how beautiful this lounge is Just look at how cool the furniture looks and even the light fixtures. I love it in here I love all the lighting they put in here and the bar stools are actually very nifty All these great photos of Walt himself This has a lot to do with the actual hotel and I when I first came up here and seen this I was like wow That's pretty amazing. I absolutely love it in here I would actually show you the inside of here, but it's kind of partially blocked off So I don't know if I'm allowed in but I know I'm probably allowed up to this part So I'll just give you a look see this is a beautiful restaurant as well like look at that up there Very nice. I remember coming here opening night. It was so beautiful Well as fun as it is up here I think we're gonna head back downstairs because it's also kind of creepy that we're up here all by herself And I thought somebody would come out. Maybe say hi, but I don't think there's anybody on the 16th floor with me here. Oh Actually, I hear the elevator Nope. Nope. Just me. All right. Let's go Lobby, please II II is for the way That was magical We're gonna head on over by ricks, but I think I'm gonna walk outside I like the fact that they have this walkway and you can walk through the old lobby, but it's just beautiful outside So yeah, we're gonna walk by the water Isn't it so nice? This is a much better little stroll than actually going through like you know the covered walkway That's that's very handy if it's raining, but not on a beautiful day like this Something else just kind of registered in my head. I have not seen one single guest Maybe I've seen one But this is like seeming like kind of strange actually like I had to think like am I supposed to be here? It kind of feels like I'm walking around an abandoned resort by now Normally I would definitely see people walking up and down out here, but like I said, this is just so strange We'll definitely have to make our way across there. It looks like three bridges is open I mean, I don't know. We'll check it out, but we'll also check out the pool area I see the waters running. So maybe that's open too. This is just a beautiful resort a massively huge resort if you can't tell like all the rooms go all the way around this lake and they actually just Added this little part right here And that restaurant or the lounge where you can walk across the lake But you used to have to travel all the way around but first let's take a look inside first, you know I like this area. This is like original Coronado Springs for me. This is uh, you know This is what it was before the grandestino tower and I came here plenty of times and just hung out Especially at night when they turn these lights on the Laguna bar was always my spot very very cool here Ah and Pancitos is open actually. That's awesome, right? This is one of my favorite water fountains as well I like the little pineapple, but this place this used to be the main lobby area and last time I was here They didn't have this little thing here, but this is really cool. Isn't it? This is where you used to check in Oh, and then also a little hidden Mickey up there if you can't see it I don't know why I'm like showing you a resort that it's been here for a while But it's like seeing it with fresh eyes when it's been closed for a while and you get all excited Like I get super excited Pancitos actually garden the 2020 March, you know, it's by one get one free so Yeah, he's definitely doing a good job. Keep it up my friend We're gonna move along. This is where I have a reservation I would love to see if three bridges is open. I mean I grab a drink and a snack at both of them But wow, oh the rich cafe is not open though Huh, so I wonder even if I can get into the sports bar or ricks is because uh My reservation isn't till two Oh, yeah, it's open, but the marketplace is actually closed That looks so beautiful back there So we're gonna actually hop in real quick. We're a little bit early, but looks like they have plenty of room Now the screen might be going on the fritz here, but this is the menu They got some burgers some appetizers some sandwiches a natural hot chicken sandwich Oh, and there's the hours. Wow. That kind of like went perfectly So this is where everyone must have been there. They're all over here at ricks And they got some amazing beer here. Of course. I got to go with the ricks red I'm so excited. I absolutely love this beer. Look at that Nice frosty glass. This is the spot This is such a delicious beer. How many of you guys ever hung out at ricks before? I mean, this is always a popular spot. I remember walking past here Many times at like 10 o'clock at night and it is jam packed So like I know this is like a favorite if you stay at corn out all the time You've definitely visited ricks once or twice I just found out that three bridges is actually not open until four o'clock But at least we know it is open. So I'm going to get myself some lunch here And they said that they actually make the tenders in the house So I decided to get the fried chicken tender basket with waffle fries You know just to give it a test.  I know I've said that before but it's exclusive. It's the ricks red Oh, thank you Here it is and look at those waffle fries. They look fantastic. I'm not a big fan of coleslaw. So No, thank you, but I don't know. I think this is uh, this is gonna be pretty good I'm not sure if these are actually reddit in the house But I have to say they are definitely different than the normal disney chicken tender or like the resort chicken tenders So I'm dipping in some buffalo sauce a little natural hot sauce. They call it and uh, give it a go Oh Yeah, definitely not your normal disney tender, but very very delicious The sauce is really delicious Definitely a little bit on the spicy side. I like it though good with the fries and the chicken I just finished up at bricks. Like I said, the chicken tenders were pretty good. They were just, you know, chicken tenders Uh, I don't know if they were actually hand breaded there like as a special item But they were different than regular disney chicken tenders and the sauce was really delicious So it was actually enjoyable and I always love my ricks red. So now we're just going to keep moving along I want to cut through three bridges and check out the pool area It's just really nice actually walking on the bridge here Because you're like, you know, it's it's pretty you're surrounded by water and water fountains Good views, but it must be really tough if you get stuck and it starts raining and you don't have an umbrella Oh boy, can you imagine if it started raining right now? I'd be taken off like oh no Or once if it started raining while you're right in the middle Look at the tower from here. Isn't it beautiful? Looks like we got a little rain clouds coming. Glad I knocked on wood It'll mark me safe for the moment Here is three bridges Like I said, it's not open yet. They said uh four o'clock. It opens up But I would have loved to come over here I really love the food that they have here and I love like just hanging out here on the water drinking some beer It's a really cool atmosphere But now we're gonna head on over to the dig site. I love that pool area. That's one of my favorite pools actually I don't know if I can like say it's my favorite because uh beach club pool is definitely my favorite But this one comes in at a close second Well, the pool is definitely open and so is siesta's the pool bar area, you know I always said that Coronado Springs has the most places where you can get drinks and food And even with the restrictions now, they still have the most like that's unbelievable I think you can even order food out here too And yeah, they are still serving food out here So you can get like the fried shrimp and the pretzel bites and the chicken tenders and stuff like that That's really good to know. Like I said, they definitely have the most food options even with all the restrictions And then any other resort and definitely the most lounges because you can always say they have ricks Then they have here you can get a drink and then you can also get a drink at the Dolly Lounge If that opens at four o'clock And also three bridges. So that's amazing. Isn't it? They also have one of the coolest water slides. This pool is definitely up there as my favorite pools I love it And with that, I think that's going to do it for me here today. My glasses are really falling down my face there Ooh Anyhoo, it's nice to be back at Coronado Springs. This is such an amazing resort and right now It just seems like it's an amazing empty resort.  I enjoyed making it. We'll see you next time. Bye No way guys look at this and now it is pouring out We missed it by like 30 seconds if I just was 30 seconds sooner I would have made it to my car without even having to worry about the rain Now we're just gonna have to run for it Is this the only way? Oh, yeah, it's a Bruin I really think I know when I need to leave look at this holy moly