Hello, hello, hello, everybody. Officially day number one, I guess. Day plus one or two, if you've been to some of the co-located events. Thank you for coming. I'm Evan Gilman. I'm a maintainer on Spiffy Inspire projects, both. I've been on those projects for, since they were started, I guess, I said for five and a half years, maybe, or so, in 2017. And the title of the talk today is Don't Mind the Gap. We're gonna be talking predominantly about how to use Spiffy Identities to authenticate the third-party resources, specifically to the three major cloud providers. There's a few tricks up our sleeve. We can talk about others have kind of clued into the trick over the last year or two, which some of you may have noticed. I'm trying to keep this talk as casual as possible. I've got 20 slides, it's been running 20 minutes. If folks have questions, anything like that, please feel free to raise your hand. In the middle of the talk, I'm happy to kind of stop and answer your questions, make it personal. I've got a mic up here, there's a mic back there, or we can shout or we'll figure it out. So, we'll talk first about the Spiffy Basics, kind of, we won't go over all of Spiffy, but we'll go over the things that are important to understand for the content in this presentation. Similar thing for Spire, cover kind of at a high level, some of the important things that you'll need to kind of make sense of the rest of the talk. And then, I'll step through kind of like three examples of how to do this, AWS, Azure, and GCP. They're all kind of, they all leverage kind of the same underlying technology, but have their little quirks and differences here and there kind of thing. And then finally, we'll have hopefully plenty of time at the end for Q&A, if nobody raises their hand during my presentation, which I hope they do. So, without further ado, you can dive on, oops, wrong one, Spiffy Basics. The first thing to know about Spiffy is the Spiffy ID, and I apologize, some people here tend to be newcomers, some people tend to not be, so bear with me. Spiffy ID is kind of what it sounds like. It's basically like a username for workloads, I mean, Spiffy deals with workload identity, this is kind of like the core thing. And as you can see here, it's like a structured string, it's structured as URI, it is compatible with 3986 or whatever that URI RFC is. It does have some additional limitations placed on top of that to constrain. So there's a lot of stuff in that RFC. If you spend adequate amount of time, you'll understand that. And so there's a few kind of critical parts. The first one is, of course, the scheme, which is Spiffy, which just kind of states this is a Spiffy ID. The second is this piece we call the trust domain. The trust domain is what I would call kind of like a security domain. You use a one-to-one relationship between a trust domain name and a set of identity issuers. So when you look at a trust domain name, you should immediately know, okay, it's coming from kind of this zone or these set of issuers. And you can see because it's part of the ID, all of the Spiffy IDs are qualified by this trust domain name. And then the final piece is kind of the name of the service. And this can be, you know, you can have multiple levels in there, the same as a regular URI, you can make it hierarchical, you can make it however you want. The spec doesn't say much about restricting kind of the values of these things. This is a little bit of a choose-your-own-adventure. But given the Spiffy ID, you can kind of see immediately, you know, which authority issued this identity and what is the identity of the workload that it's supposed to represent, right? The name of the workload is supposed to represent. And then these Spiffy IDs, they get encoded into a document. Spiffy supports two documents right now. It supports a X509 certificate and it also supports JOT token, ATM machine. And so there's some spec around kind of like how you embed this ID into a SIRT or into a JOT and where you find it, how you validate it, all that kind of stuff. So that's the Spiffy ID thing. And a little bit of what we call that document in SVID, Spiffy Verifiable Identity Document. Then we have this thing called the bundle. The bundle is that collection of authority keys, you know? So when I talk about a trust domain and there's some set of authorities in the trust domain that are responsible for issuing identities, you know, they have, these authorities have a set of public-private key pair. This bundle is a collection of those things. So, you know, you'll have one bundle per trust domain and the bundle captures all the signing keys that are authoritative for that trust domain. You can see that they're specified, but it's for this kind of SVID or that kind of SVID. And these can grow, you know, we do, Spiffy supports root rotation this way, you know, so these can kind of grow and shrink as time goes on. You know, you can introduce a new key in advance, rotate to it, remove the old key, that kind of thing. So these bundles are kind of living and breathing in a way. And then, you know, the keys that are referenced in this bundle then used to sign SVIDs for that trust domain. And that's how the validation happens. So then when we talk about Spiffy Federation, what does that mean? So that's like, hey, I want to take identities from one domain or once this set of systems and talk across this boundary to another set of systems into another domain, how does that happen? That's fairly simply just this collection of kind of bundle data that we just looked at. And you'll keep this map and you'll know, hey, trust domain foo, there's the bundle, trust domain bar, here's the bundle. And when you encounter one of these SVIDs, you can kind of do this look up. You can say, okay, this SVID is this Spiffy ID, therefore it is from this trust domain. And I select the bundle for that trust domain to do the validation. By doing it this way, it's a lot different than like WebPKI, which has kind of a set of, you know, keys and certs handed down from on high that are good for anything kind of thing, right? Spiffy like delineates this and says, okay, we want only authorities to be good for certain aspects. And this gives the kind of isolation I'd mentioned earlier, a security domain. You know, if one of these trust domains is compromised, it doesn't automatically translate into another trust domain being compromised because they're totally separate signing infrastructure and totally separate keys. So we usually see people use these trust domains, things like staging production, Coke Pepsi, you know, cross org, cross environment, that kind of stuff. So that's Spiffy, or the important parts for this talk at least. We'll talk a little bit about Spire for a minute. Spire is a software implementation of the Spiffy specs. So when we talk about certs and trust domains and all this stuff, well, like who is signing those certs? You know, where do I get them from? All this kind of stuff, that's what Spire does. Spire is written in Go, it's designed to run in as many environments as possible. Spiffy is platform agnostic and Spire is kind of like, what should I say, like the darling implementation of Spiffy. And so in as much as Spiffy is intended to be run out of everywhere, Spire is as well. Runs on Linux, runs on Darwin, or run on your BSDs and as of recently it'll run on Windows too. So these are kind of the high level components on Spire. Spire has a server component and an agent component. The server component is the piece that does all the signing, it's got the keys, it's got all that good sensitive stuff. Then we have these agents, these agents run nominally on a per node basis and they're the ones who are actually providing the identities to the workloads, right? One of the really important things about Spiffy is that it solves this problem that we call secure introduction or secret zero problem.  How does it speak to the first system? You know, how does it begin that first authentication process? A lot of people try to solve this through injection of credentials, baking things in the containers and all kinds of other stuff. Spiffy doesn't require any of that. It has this concept of what we call a workload API and that's what these agents provide. So when a workload is deployed and it pops up, it talks to these agents over this workload API. The workload doesn't have to have any kind of secret or anything like that and it doesn't need a token or anything, it kind of just says, hey, who am I? And then it's the Spiffy implementations job, in this case, Spire, to figure that out and the end result of that process is the issuance of an identity. And so when we talk about doing this without any kind of secret being necessary or token or what have you, you kind of need a way to describe things, right? And you need to declare, hey, you know, Bob is Bob, Alice is Alice. So Spire has this concept of registration in order for a workload to get an identity from Spire, it must first be registered. And the registration is basically saying like, hey, look, we've got this workload, her name is Alice. She runs generally in this cluster over here. This is her general shape and look, she's this tall and whatnot. When you see this workload, you know that's Alice and you give her the Alice identity. So this is, together, this information is what we would call a registration, which is effectively that description. What is the workload's name? What does it look like? And where should it be running? Then the final piece of all this Spire component stuff is what we call the Spire OIDC Discovery Provider. This is a separate piece of software. It's shipped as part of the Spire release. It's a supporting utility. And it can run kind of next to Spire server or next to an agent, whichever makes more sense for you. And its job is to kind of massage the Spifi bundle into something that looks a little bit like OIDC. OIDC is a technology, it's OpenID Connect. So technology that was, I should say, a standard that was defined predominantly for user auth. But it's kind of a hijacked a bit here and in other places too, to do also kind of workload auth. It's a very, very simple HTTP-based process, regular web TLS protection around it. So this OIDC Discovery Provider supports ACME. So you can deploy this thing, it'll come up. It can grab a web PKI cert and it can kind of serve these keys up for you in a public fashion. And then what it does is in this massaging here, as you see, the OIDC spec is very, the Spifi, the bundle spec is very, very similar to the OIDC key spec, however, there are some minor divergences. And so what this OIDC Discovery Provider effectively does is munch this thing and expose it with a web PKI cert. So you can see here we redacted like some of the X509 related key material. And we also redact this particular use field which we have found to be problematic with some OIDC validators. So this is kind of the final piece to make the whole thing work end to end. So our previous diagram, if we replace the right-hand side with AWS, AWS can kind of stand in here and hit the Spire server and grab those keys and do validation the same way that another Spire server might be able to do this. The diagram I have here doesn't show the OIDC Discovery Provider, but it would be running kind of in this diagram co-located with the Spire server as a part of its pod or something like that. And so how exactly does this work? Oopsies. AWS has this concept of a federated web identity. There's a service in AWS called the STS. I can't remember if it's simple or secure token service. I'm pretty sure it's the last two. And what it enables you to do is to go and exchange a credential for an AWS credential. So what we can do using this endpoint is we can come to it with a Spiffy ID with a Spiffy credential and we can exchange the Spiffy credential for a time-bound temporary AWS secret access key. And the magic about this is that, hey, you know, Spiffy doesn't require you to like store secrets on disk or do anything. It does all this stuff at runtime. It doesn't require you to do secrets injection, secrets management. Any time that you have to talk to S3, for example, you're gonna need an AWS secret access key and there's a lot of pain around managing these things. Oftentimes they don't expire. People have MFA policies on their account but then they have to get the non-MFA secret access keys for their workloads because how do you do MFA with your workload? All these kinds of things. So the way that we do this is we create this mapping, this trust relationship in AWS and we set up this web identity provider and you pointed at the OIDC discovery thing that runs next to your Spire server. And once you've set this up, you can then create this mapping list. So here on the top you can see that there's a role ARN. So here what we're saying is this particular AWS IAM role is mapped to this particular Spiffy ID on the bottom right, spiffyexample.com, S3 test app. And so when somebody hits STS and they've got this particular identity and this particular audience, this is with Jot token, by the way, then the caller is entitled to receive temporary credentials for the role described at the top. And this is pretty awesome because it negates the whole where do the keys go? Where do they live? I put them in a vault. How do they get injected? How do I rotate them? Would things break if I rotate them and all this kind of stuff? So this is kind of the basic trick. It is made way cooler by this little project that Square wrote. You'll notice a theme in these integrations that all three of the cloud integrations I'm talking about today have been written and published by the community. We have a really strong, wonderful community Spiffy Aspire and people publish these kinds of things all the time and supporting code to go with it. So kind of standing on the shoulders of giants in a bit in the parts of this presentation. So Square has written and published this tool to help you do this authentication at AWS with a lot less headache. Even though we've already removed the headache with AWS secret access key, there's more headache to be removed. And the way that this works is by shipping this little utility that hooks into the standard AWS config file.  And so long as your app uses the AWS SDK to talk to S3 or Redshift or whatever else you're using, the logic to hook and look for this config file and call out and do all this stuff is already there. So these apps have this AWS SDK, they can be running anywhere, they can be running on-prem, they can be running in Azure. You name it, it can be running under your desk. So long as they're able to get a Spiffy credential, then they don't actually have to be written with the Spiffy SDK. They can just use the regular out-of-the-box AWS SDK with this little helper utility. And what this helper utility does is it knows how to talk to the workload API, grab a Spiffy identity, go talk to STS, grab the temporary STS credential, and then return it back to the app. So we have a lot of people who have migrated apps out of AWS that are none the wiser effectively because none of the app code has to be changed. All they need to do is drop these configs on disk and you're off to the races. So that's pretty cool. I'll show you a little bit about Azure, similar thing. They have a service that you can go to and it knows how to do the OIDC swap and you can bring your Spiffy jot there and they can map that back to an Azure identity. List, blog post, identity digest blog, this is an excellent blog. Uday, I believe, as an identity architect at Microsoft, he's been there almost a quarter century, wrote up this really great how-to on how to use Spiffy identities to authenticate to Azure and he also published this diagram, which is kind of, you know, spelling out the flow that I was just describing, right? You have a Spire server, you have this OIDC thing, you've got a workload, it comes up, it gets a Spiffy ID, it goes and talks to this endpoint in Azure, it does this exchange, it gets back, Azure creds. And then with the Azure creds, it can do whatever it wants. Now you know that Kubernetes cluster, that big green park there, like I said, that can be anywhere, it doesn't have to be in Azure because the Spiffy identity is platform agnostic. And then finally, we have GCP, similar trick here. This is from Christoph Grotz, he's an engineer on a Google Cloud team. Google Professional Services actually published this blog post and this utility, which is similar to, similar to the magic that Square published, this utility is designed to kind of let your on-prem instances talk back to GCP without any application modification the same way that the AWS thing does. Rather than using a file and a helper process of the call out, this integration actually turns on a proxy and this proxy steps into the Google metadata endpoint and emulates, effectively emulates the answers that the Google metadata endpoint would give you if you were running on Google Cloud. So similar to the AWS thing or software can kind of pop up but it already, or you're using the GCP SDK, it knows it can talk to this metadata API, it reaches out and it finds this proxy and this proxy has the smarts to get the Spiffy identity to go and make the exchange with GCP and then bring back your GCP cred. Question. The question was that this diagram presupposes that trust is already established. I think that you're asking about that screen from the AWS, yes it does. There's a configuration that you need to do in GCP similar to AWS where you point it back to your OIDC provider, your Spire server. There's a certificate involved there, usually one PKI certificate involved there. So this diagram presupposes that that configuration has been done already. The direction, so the question here is the direction of request is it from Cloud provider to Spire server or is it Spire server to the Cloud provider? Well, in terms of the Spire server, or Cloud provider to the Spire server. So the Cloud provider periodically will reach the Spire server, grab the recent public keys, pull them back, the workload obviously reaches into GCP. So you can see, I talked earlier kind of about how it's all kind of a similar underlying technology here that enables this with different kind of nuances on each one, different Cloud providers decide they wanna do this thing differently and so the way you can figure them, the way you can see them kind of subtly varies from case to case. However, the underlying mechanism is relatively universally applicable. A lot of software supports this kind of OIDC auth. So today we talk about AWS Azure GCP but there's a lot of off the shelf software and other third party services out there that also support OIDC auth. I hear about them all the time. And so if you're using something that supports OIDC auth it's off the shelf where it's a service or something like that. There's a good chance that it will be compatible in this way. And so the key takeaways here and number one is that Spiffy Jots are OIDC compatible.  A lot of these software support OIDC already and those that do, there's like a 90, 99% chance, 90, 95% chance that it's just gonna work out of the box. Spiffy and Spire, both platform agnostic, they can run anywhere. Spire is super, super pluggable. So all the kinds of things that Spire needs to rely on underlying platforms are all pluggable. So there's AWS plugins, there's plugins to interact with hardware TPMs, there's plugins to do all this different kind of stuff. So the real thing here is that a lot of times access to these services has been kind of gated by where you're running your workload and that is no longer. If you want to use the Google machine learning stuff from inside your data center, you can do that very easily and you don't have to fool around with any of these keys. And yeah, so that's one weird trick to avoid all the pain and management around kind of managing these tokens, storing them, encrypting them, injecting them, all this stuff. All the Spiffy identities are all kind of short-lived, fast-rotated, everything's fully automated from the root down. So this problem kind of just vanishes. If you wanna learn more about this stuff, we have obviously our GitHub repos. These are a couple of the repos I talked about today with the helper utility from AWS and Square and also the helper utility from Google Cloud Platform to do Spiffy off from anywhere. That's all I have for you today. Open up for questions. I'll leave this up for a minute but I just wanna take pictures and then I've got a QR code for talk feedback. Thank you for coming. It's great to see you all. Yeah. Nope. Here you go buddy. Thank you. So I'm in the process of trying to cook up a spire deployment for my environment right now and the challenge I'm encountering is that the list of trust domains keep growing and growing and growing. And so there's also, it appears to me, a tight relationship between trust domain and spire deployment. So let's say I'm gonna have 50 trust domains, now I have to manage 50 spire server deployments. Are there any plans to consider consolidating multiple trust domains in one server deployment? So I don't have to, I'm fixing one problem that I'm creating an operational burden on the other hand. Is there any advice or thoughts around that? Yes. Well, I have some thoughts, I don't know about advice.  The kind of exploding trust domain problem is a problem that I've seen a number of times, particularly at shops with larger scale.  There are some tricks you can do. So the first thing is that, you know, the spire server can be deployed in what we call as nested model, so you can have multiple spire clusters participating in one larger trust domain. Oftentimes people reach for many trust domains because this is kind of like the easy thing to do with their model. For example, if I'm just stamping out a bunch of kind of like equivalent Kubernetes clusters, the easiest thing to do oftentimes is just to say, okay, well each one of these is its own trust domain. There are drawbacks with that, you know. This federated auth we talked, I talked about earlier where you look at the trust domain and you choose the correct bundle. I mean, Envoy supports this natively, other software support this natively, but not everyone does, you know. EngineX doesn't, a couple others. So anytime that you talk about this federated auth, already you're kind of talking about the cost. The other piece of this is that each one of these bundles, there's a size.  So we're exploring ways to kind of make this problem better. We do have like the largest expired deployments are over a million agents, so they're like way, way bigger than largest Kubernetes deployments. So these things can't be done, but we tend to see usually these really large deployments go for like two, three, four trust domains kind of thing. And then they lean on kind of these nested architectures and other kind of tree-like topologies to achieve the scale and reliability that their deployments need. So I would say, I guess my advice would just be like, hey, you know, the trust domain thing is kind of like a big hammer. And like kind of go about it as like, put it in the places where you really need it and not the places where, you know, that's just kind of the easiest thing to deploy. I hope that makes sense. Without knowing more about your environment, it's hard to make it more concrete. Yeah, would you be opposed to one large trust domain and the receiver of the credential, like looking at the latter part of the SPIFI ID and like dissecting that? Because it's minted in, so like, if you want an environmental segmentation, would you like, would it be okay to have one large domain? But let's say a receiver is only in like a staged environment and they could look at a bit in the URI and say, oh, this is staging and then authorize on that. Do you think, is that an anti-pattern according to you? You definitely want to check the workload ID. I mean, there are some services that it's okay to just say like anything from staging. But in general, you really want to check the workload ID. Either things I think about like NTP, DNS, things that are like centralized services, you know, that makes sense for, but I would recommend like the trust domain name should be part of your authorization policy, but so should the workload ID. Thanks. Hey, I think I have a small question. So as I understand from the SPIRO registration to the SPIRO ID, it is kind of a fixed one-to-one mapping that you specify a list of selectors and that is mapped to a specific SPIRO ID. I wonder is there any plans to make this mapping a little bit more flexible and dynamic? For example, by, it could be as simple as some like a format substitution or maybe a limited expression like which is there. So that with a single SPIRO registration that can be used to map to like maybe a thousand or a hundred like SPIRO ID for a thousand and a hundred of workloads. Let me make sure I understood your question. You're asking if it's possible, like if we've been thinking about having SPIRO break away from this kind of like one registration to one workload ID pattern and instead like be able to configure SPIRO with a Regex or something that would then issue identity from that or? Yeah, something like that. Maybe a more concrete example is for example, I have a selector service name, the value could be anything and I want to embed that service value into a SPIRO ID so that I do not need to repeat that value part. You do not want to repeat what, I'm sorry? Like the selector, the value of the service name. Yeah, yeah, yeah. One of the problems that we have with this is the security model. So SPIRO is designed to survive node compromise. So if you know any node in the Kubernetes cluster or any physical node or otherwise is compromised, the security model is such that, there's an agent running there. The security model is such that you can not just take control of this agent and go into any identity you want. And in order to put that security control in place, you kind of have to know which agents are authorized to mint which identities. And so it's difficult to kind of say hey, this agent can mint any of foo or bar namespace identity because you still need kind of need mappings for that and oftentimes the agent identity is like very disjoint from the namespace of the workload. And so this is something that I've been thinking about personally, like what could we do to avoid kind of this registration overhead, you know? In Kubernetes, we have the SPIRO controller manager, which is a controller that can watch its deployments as they're placed and will automatically manage all these registration entries for you. And you can kind of annotate or label these deployments with spiffy IDs that you would like them to take on. And so some of this overhead is negated in that way, but I think there's more we can do. And right now some of the core kind of, core design and security principles those fire make it difficult. I don't know if that's exactly what you were asking, but I feel that it's something related to like registration management and like defining identities for a large number of workloads in advance and this kind of thing. Yeah, thank you. Hey, so in the examples that you showed, it looked like you're effectively swapping your spiffy ID for like short live cloud credentials. So is there kind of any work going on or any interest in like the cloud provider supporting Svids like natively so you wouldn't have to do the dance? I have not heard of this, but you see that, you know, this GCP answer was written by Google cloud. AWS has also began to like AWS app mesh has native integration with spire. So you can bring your spire and plug it into AWS app mesh. So I haven't seen cloud providers directly trying to pick up spiffy off, maybe in the future they will, but we do see them as we do see them kind of engaging and making this story better. Any more questions? Thanks everyone. Oh, one more. One more, one more. Sorry, false start, false start. I think you skipped in the talk, but there is a process in AWS to get the trust of the OIDC provider. So what is the OIDC provider for the spiffy identity? Like how does that connection get? So you're a spire server and your OIDC provider you can ship it kind of in the same pod. The OIDC provider talks to spire server and gets all the bundle data. And then it kind of turns on a little web server that serves the OIDC discovery document and a few other kind of documents to make OIDC work. And it also munges these bundles to be kind of like aligned with the format that OIDC validators expect. It speaks Acme and grabs a web PKI cert. And so when you configure your cloud provider to talk back to this OIDC provider, part of this step is saying, here's the DNS name, you are expecting web PKI. Some of the clouds like AWS for example, will say like, hey, like paste in the thumbprint of the actual cert that you're serving over there and we'll validate that thing. So that's how the trust between the provider, the cloud provider and the OIDC on-prem stuff. All right. Thanks everyone.


All day! I can no longer speak to my girlfriend in English!  My girlfriend! Very ugly!  Hold up, I'm gonna start looking at this board, so keep... No, no, no, no, no, no, no, no, no, no! Hello! What's up, Mariah? Hello! Does that mean pool? No. No bueno? Es escúpita. Is it stupid? No, no, no, no, no. Why are you talking like that? Me gusta. Me gusta, too. Adios! Why are you talking like that? Adios! Adios! Bye! Guys, what is good, Mariah Scott? Welcome back to our channel. I could finally talk in English now. Sorry, I just came back from the gym, so my hair might be a little messed up. But all day, starting now, as you can see, I can no longer speak to my girlfriend in English! I can only speak Spanish all day today, and she has no idea. I feel like she's gonna catch on, obviously. This is not a prank, so I'm not trying to prank her, and like, trying to, like, do all that. I'm just trying to challenge myself, and she, I'm sure, is gonna figure out that I'm only speaking her in Spanish. Because I'm literally gonna be saying no words in English, guys.   I'm sorry if you're watching, and you guys are smarter than me, and I pronounce stuff wrong. Well, I don't say the right thing, because I know all day I'm gonna be on Google Translate, or doing whatever I can to speak the best that I can without her knowing. I'm literally just gonna be trying as well as I can possibly do with speaking Spanish all day. But I'm gonna make this intro super quick, because we have a lot to do today. Mariah's currently tanning, but we gotta go to the stores. I also wanna maybe get some Starbucks later, or just go to, like, a drive-thru and have her drive and me order something in Spanish, and she has to figure out what I want. So this is gonna be a crazy video. Make sure to stay tuned. Wash it all the way through, and from now on, the moment I put down this camera, I will not be speaking English until the end of this video. Maybe even not. I kinda wanna do the outro, and maybe just have her do the outro, and me still speak in Spanish. I'm gonna challenge myself from now until the end of this video. Do you think I could do it? Do you think I could, like, last the whole 24 hours speaking a different language, especially one that I don't even know? This is gonna be way harder, but hey guys, shout out to all of you for watching this video. Make sure to give it a thumbs-up right now for how bad I do. So the more thumbs-ups, the more you think I should learn the language better, and try not to, like, you know, just randomly say it. But also, if you think I'd be good, still give it a thumbs-up, because, guys, thumbs-up matters. That is how we know that you guys love watching our videos, so make sure no matter what, let's try to get this video to 15,000 likes. Let's do it for my sake, guys, because I'm gonna be trying as hard as I can to speak in Spanish all day long. But alright, that's it. Mariah's gonna be coming in a little bit, and I do not want her to hear me speaking English today. So it's gonna be really crazy. Let's go. Let's get it. Alright, now is the time that I say adios to my Marvel Squad, and I say hola to Espeñol. Alright, me gusta tu. Adios! Siiii, mm, okay. What does that mean? What is, what does that mean? No, no, no. No, no, si. Si? I look good. Siiii! Vámonos, vámonos. Vámonos. Vámonos. If you didn't understand what I just said to Mariah, I actually was calling her ugly. I did not mean that, but she has no idea.  I just wanted to tell you guys that, so make sure to look out for some of these words, and I will be telling you what the meaning is.  What is up, guys? Making Spanish to me all day, and I'm already getting going. No! No too. Muy feo. Está bien. I just want to say one thing, when I took Spanish class in high school, and I didn't really do very well, so today's gonna be a very, very difficult day for me, because I have no idea what he's gonna be saying. So our first destination for the day is, we're actually taking Snap to get his ears clean, and his nails trimmed. Snap, say hi. Is that being cat? Does gado mean cat? That better not be something mean. I'm gonna look it up. Could I use my Google translator? Can I use my Google translator? No. So one cat. No. This is gonna be probably the most stressful day. So we just got done at the nail trimming place. He got his ears clean, his nails done, and guys, we walked in there, and there was 15 cats in there, and we started freaking out. They were so 12, right? Yeah. Or 15. Doce. Two? So 12. So there was 12 cats in there. Doce peros. Were you happy? Yeah. Weren't they so cute? Very cute. Not cute? Very cute. So you liked it? Very cute. She's crazy. I'm crazy. Very crazy. I'm really crazy. Very crazy. Crazy. Snap did so good. I've never seen him get his nails trimmed before, because usually they take him back and they do it. Okay, we're still proud of him. So now we're gonna take him home. Snap. Guys, I'm not sure what he said, but what I think he might have said was that we dropped off Snap. Okay, and we're going to get food. Okay, perfect. Wait, hold on. Jimmy John. Am I going to have to guess what you're going to get? Jimmy John's? Okay. Maybe we just made it to Jimmy John's, so you're going to need to help me. Number 9. Hi. Number 9. 9. Italian. 9? I'm crazy. Can I get the number 2? Number 9. Italian. 8? 8. Can I get 2 small bags of chips? Ay, ay, ay. Senorita is very annoying. That means I'm doing... Very annoying. Yes, a water. Thank you. Can I get a water please? Two cups of water? Yes, it's very good. Yes. Now that we ate. We ate. Very good. Yes. Ay, ay, ay. She's crazy. We only have food. Food. Silence. Silence, please. Silence. Food? No, Spanish. No, Spanish. English. Silence. You need your food. You need your food. Ay, ay, ay. Adios, amigos. Ay, es un loco. Me muy comida. So I'm crazy in your call. Si. Senorita. Can I get this? No, no. Can I get this? No. Can I get this? You're paying with your car to get this? No. For my face. Oh, you and she have a face? For my face. You're going to go sit in the car? No. Can I get this? Pay it. Please. Can I get this? I asked if you wanted me to hold it. No. You paid it? Si. We also need an assistant to help us over here. I don't know. IDK. IDK. IDK, Spanish. Ok. ¿Qué? Loco. Loco, loco. Muy loco. He's loco. Loco, coco. Too fail. Too fail. Too fail. Fail. Fail, hold this for me please. I'm going to start looking at these words. No, no, no, no. No, no. No, no, no. You ugly. You're too fail. Too fail. How rude is he being mean to me? You know what? Muy bueno. Guys, I'm trying as hard as I can. And she started looking up the words. So I have to be very careful with what I say. Otherwise she'll look up and I'll be calling her annoying or something. Stay tuned. I have a big, big thing. Si. Señorita. ¿Te gusta la música español? So you want to play music in español? No, te gusta. ¿Te gusta la música español? Si, si, si. Oh, dance. Have you got a dance? ¿Qué? Muy bueno. Si, si. Danse. Si, si. Despacito. Despacito. ¿Te gusta la música español? Si, I like it. ¿Te gusta? ¿Te gusta? Me gusta. Me gusta la música español mucho. Mucho, mucho. Muy bueno. Muy, muy, muy bueno. I give you lots of credit because I can't believe you know this much of Spanish. Señorita. Señorita, what? Yo, muy español. Yo es español. I'm sorry babe, I'm actually getting excited. Doing this challenge because I have no idea what you're saying. ¿Qué? Oh my. ¿Qué? ¿Qué? ¿Qué? ¿Qué? ¿Qué? ¿Qué? ¿Qué? ¿Qué? ¿Qué? ¿Qué? No, you gave me it. Ok, so I made a deal to the Momma Squad. I was going to try to do the outro in everything in Spanish. Ok. You just said that I can end in here. You should have looked it up, babe. You said I couldn't look it up. You couldn't look it up. You looked up the other word.  I'm sorry, I'm glad that I said C because I was getting real excited. Guys. Trying to figure out what the heck you were saying. I am so sorry. I do not try to offend any Hispanic speaking person or you know anyone that knows Spanish well. I know I said everything wrong except A as muy feo. Ok, that's just you know. See? That's just the truth. That's how I really know it's C and O last. I was calling her... No, do you want her funny in the bathroom earlier? What I was saying that you're very... I was saying you're very cute or whatever. I was actually saying you were very annoying. And you'll see that after you watch this video. I was going to say I probably shouldn't say anything more after you looked up feo because I was calling you some names today and you had no idea. I knew you knew what I was doing right away. Guys, did you enjoy this video? I really hope you did. I try to go all day. As you can tell the sun, you can't really tell the video but it's actually setting right now. It is currently 7.30 at night. The sun sets at 8.30 in Florida here. But I went pretty much all day. I went from morning to from like 9 o'clock to 7.30 at night. So that was almost a full day time. A credit because I don't... I don't think I would have been able to do it. Oh my God, it was so hard. I had to look up half the stuff I was saying and I know I didn't even say it right. But I actually knew a lot of words. You did a good job.  Honestly, if you speak Spanish, comment down below if he said some of the words right. Because I know like... Yeah, see. If there's a different way of like saying each word and like have an accent. Do you know what I mean? Diaz, how did I do? 9 out of 10, did I do? Yes. Or 9 out of 10. 9 out of 10. 9 out of 10. I feel like you did a 10 out of 10 but I'm not super smart with Spanish so I could be wrong. Hey, comment down below how I did. If you don't speak Spanish and you didn't know what I was saying the whole time. Basically, I was just like calling her funny names and saying funny things to confuse her. And the order when I was ordering at Jimmy Jazz that was pretty funny. But I did want to tell you there was this guy. We went to CVS. We had to go to the pharmacy and the dude literally like... Speak Spanish. Speak fluent Spanish. He literally looked like a dude like me. Someone came up to him and started speaking Spanish. He was like, Oh, hola. See ya.  Give me some lessons. I was about to put them in the video but I didn't want to like, you know, put them on the spot right there. Guys, I know I've been rambling this whole video. I really hope you guys enjoyed it. Like I said in the beginning, give this video a thumbs up depending on if I did good or bad. Either way, give it a thumbs up for just my effort into putting into this video. Mariah has... Her stomach has been hurting today a little bit. My period. So yeah, she's getting her little, you know, time of the month so if she has seen her... I haven't been feeling very well. If you have seen her face expressions kind of like, eh, that's because of that. She's really, she's being a trooper today. You know what I mean? You're beautiful. I tried going to the gym. Oh my God. I just remembered the beautiful word in Spanish. What? Bonita. Oh. Tu muy bonita. Oh. Muy, muy, muy bonita. Thank you. Caliente. Senuelita is muy caliente. Caliente. What does that mean? I don't know. I'm hot. Yes. Hey, you're good. This is the end of the video with our positive vacation channel. Shout out. And this shout out goes to Omar of U.L. Wafa. So shout out to you. Shout out to you. Thank you for being a part of our channel and we will see you in the next video. But until then, peace. Love you guys.


work indeed it could be Joe Chicho it was your video about why you can't divide by zero okay yeah that one yeah indeed that was great that was a really good video actually I liked it I really thought about you know should I make this video why not and I said it helped me and it was it was why we can't divide by zero me sitting there with with my goatee with a two con I believe I had a nice light set beside me was at our at our old place sitting on on our little table that we had and I had the paper saying and by the way Joe when it really occurred to me that realization in that paper I don't know if I mentioned this in that video okay but I had that paper on the electro dynamics of moving bodies printed off that was the exact same I was at the exact same maybe it was another copy but I printed it off and I gang in the bathroom I have reading material and it was in the bathroom I was rereading Einstein's paper on the electro dynamics of moving bodies reading look at the formulas looking at the this this this this this all of a sudden I went so I had my epiphany realization sitting on the toilet reading Einstein's electro dynamics of moving bodies I had no idea how long I was sitting there for really I was just immersed in it what no way I was like oh and for the longest amount of time I had a pen paper now I'm a pen and paper by the toilet as well just in case I had to take notes so it was it was beautiful good bowel movement


A very quick background about myself. I'm Anand Bagmar. I've been in the quality space for more than 20 years now. I've worked with very different type of organizations in this time, product and services across the globe. I'm also a big proponent of open source software and have built many different open source tools myself. Along with this, I'm a small contributor on the Selenium project and I try to help out as much as I can in other Selenium project activities from a community perspective. And I've made a lot of mistakes in different roles that I have played. What I'm hoping is that I have learned from those mistakes and try to get better and avoid repeating the same mistake every time. In this keynote, I want to talk about some of those mistakes that I myself have made in the past when it comes to functional automation and why those mistakes actually created problems for me downstream in the deliverables. This talk is about understanding the anti-patterns of test automation. The shortcuts that we typically end up taking without even thinking about it, but how that impacts the overall deliverable of automation from a maintainable, scalable perspective for the teams. But just talking about anti-patterns is not sufficient. What I really want to talk about is what you can do to avoid those and take better decisions going forward. This is what I mean by the title changing tires in a moving car. The teams are moving at a very fast pace in delivering automation suites to determine the quality of the product. But in the process of that fast pace, they're trying to maintain and make sure the framework continues to go and give the value as it's expected. And it's not a good situation to be in. I hope this talk gives you some insights how you can avoid those anti-patterns and take better decisions from the first step itself and make this valuable for you.


So I've trained over the course of my career hundreds of people on how to respond to an opioid overdose. I've trained people who are actively using, I've trained medical professionals, and I've trained people in the community and I tell them, be calm, you can do this. Well, turns out not so easy to do. Your nerves take over, your nothing is where it's supposed to be, people who are responding are unclear of their roles and it is just scary. We responded where we found a young woman non-responsive with her baby in a stroller right next to her. It's frightening. It's really frightening. Yeah, and upsetting.  Those are the times you realize you need to have a plan, your entire staff needs to be aware of the plan, and part of the plan should definitely include a post-event staff debrief. People who use drugs may seek out restrooms or other hidden areas. They are usually looking for a safe place to use drugs. This includes restrooms inside health care buildings like hospitals that are often clean, well-lit, and staffed with nearby professionals who can provide help if needed. Health care professionals need to be prepared to respond to overdoses in their facilities, particularly in hidden areas such as restrooms. Like other emergency situations, a safe and swift response to an overdose requires a clear protocol. Staff must be trained on how to carry out the protocol. The American Heart Association incorporates early naloxone administration into its basic life support response for an unresponsive patient. Health care professionals may want to develop specific measures to make restrooms safer in the event of an overdose. Educational messages about reducing the risk of overdose can be posted near restrooms. Restrooms can be outfitted with a secure sharps container to help patients and staff avoid needle sticks. Health care organizations like hospitals can put in place a monitoring program such as regular checks of restrooms by staff, installing timers, or implementing an alert system using sensors that detect a lack of motion. Place all emergency equipment needed to manage a respiratory arrest near restrooms or other areas at risk for overdoses. When an overdose response is initiated, early responders will have the tools needed to perform basic life support until additional help arrives. When staff arrive at an overdose response, they need to survey the scene for safety. Sharps must be found and disposed of immediately. Contrary to common belief, the presence of a powder poses minuscule risk to responders. For an unresponsive person, naloxone should be administered as soon as possible, followed by the basic life support response that follows protocol. A person who has received naloxone is often disoriented and frightened as he or she regains consciousness. Responders should give the person space, reassurance that he or she is safe and offer help. It is unusual for a rescued person to lash out. More commonly, the person may want to flee. Every effort should be made to offer a next step for the rescued person. Tell the person that he or she can receive treatment on demand if it is available. A post-event debrief is recommended to improve response to an on-site overdose and help staff process a difficult emotional event. An incident report should be filed following the event based on organizational guidelines. Having formal overdose response training can help prepare staff to respond to overdoses and reduce stigma associated with people who use drugs. Advanced planning and regular overdose response drills are an essential part of preparing staff. It is important to include non-clinical personnel in overdose response training as they are often the first to witness a potential overdose. Health care organizations need to be prepared to respond to an overdose at any time. Make a plan. Practice the plan. Implement the plan.


Thank you and welcome to the second annual BC Tech Summit we have 5,000 people here which is double the number that we had for our first summit last year and I think it shows that British Columbia's reputation as a place where tech companies can grow and thrive is really gaining momentum and thank you to the to the Coast Salish First Nations for welcoming us onto your traditional territory so warmly and thanks to them and thanks to all of you for coming welcome to what we think is the most beautiful place anywhere in the world we love living here we love that it's diverse in its population that our communities are clean and they're safe we love it that we are blessed with the most magnificent natural environment you'll find anywhere in the world this is a very beautiful place and it offers a great lifestyle but you know the thing is there are a lot of beautiful places in the world and there are a lot of places that have an interesting lifestyle great culture great outdoor opportunities and so in British Columbia we can't just be a great place to live we need to be a great place to do business we need to differentiate ourselves from other places around the world and what I want to talk about today is how in British Columbia we intend to differentiate ourselves how we intend to take what I think is an absolutely unique moment in history to make the tech industry the center of our economy around the world we all see it every day countries are looking inward and that is a terrible tragic trend but it is also for us as Canadians and us in British Columbia an opportunity it's an opportunity for us to do the opposite while other countries are looking in let's be a country and a province that is looking out that is reaching out to the world that is building bridges to the world that is welcoming people in the best and the brightest from every corner around the globe that's how we will be different so at this moment in history how will we seize it for our communities for jobs here for businesses here for imagining people who imagine and create well what you've told me is you need four things four fundamentals you need money you need markets you need ideas and you need talent most of all so let's start with money startups need better access to capital we heard you so last year we announced a hundred million dollar venture capital fund that's entirely government backed we have made our first two investments already and we are going to continue to grow that investment in startups that are going to create BC jobs companies that might not otherwise be able to find that capital but we want to be there because we know that access to money matters second you need globally competitive taxes we already have some of the lowest tax rates in North America here and this year we did more in our budget in February to lighten the burden for tech and one of those things that we did was grant an augmented reality and virtual reality tax credit for entertainment purposes that was a big change but wait for it today we're announcing that we're going to expand the augmented reality and virtual reality tax credit so that it's for more than just entertainment so that it is for all applications in technology and we know that this can become the world's center for AR and VR we know that it can so we intend to invest early with a tax regime that will invite that investment and help you grow right now as this industry really begins to take off and last on this point I am a firm believer that lightening your tax load is always a good idea because there's one thing that I know for sure it's that government cannot spend your money better than you can if we let you keep more of your money I know what you'll do with it you'll invest it in capital you'll invest it in jobs if we leave that money in your business and in your pockets you'll spend that growing jobs right here in British Columbia and you need ideas you need world-class universities that are going to produce the thinking and the creativity that you need to grow because every innovative enterprise starts with the seed of a great idea so yesterday I hope many of you heard from Dr. Santa Ono the president of UBC he was talking about how we can coordinate our post-secondary education planning and seats better with what the private sector needs you want well-trained people I want citizens that can go into jobs that they they will find fulfilling and that they will love going to every single day that's how Santa Ono is going to help us make it happen jobs for people workers for businesses Santa Ono was going to be BC's number one matchmaker we're creating a center for data-driven innovation a single safe platform for government data it's going to be protected by our very strict privacy laws here in Canada as it should be but it's going to allow you to get on that platform and help us spend our 51 billion dollar budget better and it'll also allow you to help us make sure that our services that we provide to citizens are always getting better and more efficient that progress our progress on the on the data platform will be going live within the year third students need places to learn and so this year we're investing 400 million dollars in STEM related physical infrastructure at our universities and colleges all across British Columbia fourth this year we are funding 10 new STEM research chairs at universities and colleges in our province these 10 new chairs will attract the best and the brightest thinkers from around the world where they will bring their ideas and their determination and their grad students to a place where they know they will be welcomed you need markets and in British Columbia we have a big market it's called government and we spend 51 billion dollars a year so we need to radically change the way we do procurement in BC that means starting up a startup in residents program that will give BC companies a chance to co-develop inside government ideas that are going to make government more efficient ideas for problems that government has identified but hasn't yet figured out how to fix we're also going to start an innovation ideas fund which is going to do a similar thing but it's going to invite small BC companies to come into government and help us fix problems that we don't know exist yet a chance for small companies to get a first crack at a big market in selling their product for the very first time we're going to open trade offices in Seattle and in Silicon Valley and in both of those offices we are going to work hard to attract new businesses to come to British Columbia we are going to sell the assets of this province down south like we never have before but we're also going to sell British Columbia products and companies to the Americans to help our companies get connected in the bigger world of technology down south and we're going to make that easier by supporting the Cascadia corridor an agreement that we've made with Washington state that will allow businesses and labor to flow more seamlessly across the border between us money ideas markets and most important of all the thing that every tech business needs talent and talent comes from two places it comes from at home and it comes from abroad so let's start with abroad Martha Salkedine is here Martha do you want to stand up for a second Martha Martha is the first female dean of mechanical engineering at University anywhere in Canada she's a World War two refugee from Romania she's 82 years old she's still taking on grad students she revel in her career she revolutionized the pulp and paper industry she also designed the cooling system that keeps the turbines on airplanes that we take from melting thanks Martha for that I really we all we all really appreciate that that was a good thing to do thank goodness Martha came here from Romania chose British Columbia in Canada all those years ago and on the other end of the spectrum Magna Lohia is with us is Magna is Magna nearby to Magna is 16 years old there she is she's sitting up there you go 16 years old she's shy she's a coder and she owns her own tech business she started it when she was 15 she designed by the way the snapchat filter for the summit here and that's what she's doing this year next year next year she's next year when Magna is going to come back she won't be designing the filter for a snapchat she's going to be designing the next snapchat I'm pretty sure about that abroad and at home so what are we going to do to support people at home what are we going to do to grow more homegrown talent for you well as we said in the introduction as I told you last year we have begun the program to make sure that every child in British Columbia when they graduate from a high school here speaks the you world universal language that is not English it is not French and it is not Mandarin the world's universal language is coding let's make sure that every British Columbia child speaks that when they graduate from a high school here and I should finish this by saying not just every child but every boy will be a coder and every girl will be a coder we want to make it a lot easier for tech companies in the world and in this country to be able to hire and make sure that your companies are entirely gender equal we need more STEM grads from post-secondary institutions so we're announcing today that we're increasing the number of STEM grads in BC by a thousand seats in our province per year those grads will be spread out at institutions all across the province they will be in diverse fields and you know from the work that dr. Ono and his group are doing we will be striving to make sure that the grads we produce are ones that meet the changing needs of the industry as you evolve in British Columbia third there are seven thousand co-op student placements today in BC we are going to double that there will be fourteen thousand co-op co-op students in British Columbia and we will be providing money to companies to help you hire more grads we'll be requiring all we will be requiring all tech programs at universities to allow and support co-op programs in their offerings and the thing about co-ops is it's a great way for you to be able to recruit new talent but it's also a great way for all that emerging new talent to find their way into a great first job fourth we're increasing our investment in my tax by two-thirds now if you haven't heard of my tax they're an organization that works all across western Canada based at UBC focused on finding grad students locally and from around the world and placing them in industries here in Canada where they will solve real-world problems at real-world businesses and the great thing about my tax is it helps you but it helps Canada because when those kids come from overseas and they get settled here so many of them most of them in fact find their way to becoming citizens they become Canadians and they contribute this country just like Martha has for the rest of their working lives and last we're investing in the First Nations Technology Council we need to help First Nations people find the skills that they need to get into technology as business owners and as employees the First Nations population is the fastest growing demographic in Canada today it is a vast and underutilized talent pool we want to support that because those communities deserve a fair shake at economic opportunity and you need more people to make sure that your businesses can grow so last on talent you know we can't grow it all here we can't produce enough megas on our own so we need to go and find some more marthas around the world and that means that Canada must open its doors wider to highly skilled immigrants in the tech field so that we can bring more marthas into this country to help us build this country together and I know there's lots of talk in the US about how Canada's immigration system is way better than America's and that is absolutely true but it's a low bar and it's getting lower we don't need to be better we need to be way better than the Americans are at immigration we need to be faster at processing and approving applications for highly skilled workers we need to be better at listening to your needs to make sure that we are bringing the right workers in when you need them so Ottawa needs to expand our PNP program let us invite as many people as we need in technology who are highly skilled as many as we need in this province who can come in and help us create Canadian jobs and why not throw out the process of application all together if somebody's earning a PhD at a Canadian University let's staple their citizenship onto their PhD certificate on the day they cross the stage so when Santa Ono gives them that certificate they'll can become a Canadian citizen the exact same day but we're working on these changes working hard federal government needs to make them and they are listening we are hopeful but in the meantime we know that we need to make some changes ourselves we need to double the number of tech specialists that we allow under our current PMP program today whether or not the program overall is expanded we need to create a concierge service to help businesses large and small find your way through this arcane and sometimes very frustratingly complex immigration system that we have in this country and we're going to do that and the reason we're going to do all of the things that I've talked about with money and ideas and markets and talent is because I really do believe that we are at a unique moment in British Columbia and Canada's history when others are turning inward we are going to turn outward when others are withdrawing from free trade we are going to reach out around the world and find new connections for business and for people when others are isolating themselves and closing their doors to immigrants we are going to invite people into our country and welcome them here to a place that is not tolerant but a place that is embracing them a place that says no matter where you are from your faith your creed your origin your language you are welcome in British Columbia you are welcome to come and help us build not just a thriving tech industry but to work shoulder and shoulder to shoulder with Canadians who came here before you to build what we think will become the greatest country in the world and that will be the difference for British Columbia we will invest in educating all of the Magnus and all of the Marthas and we will say to people from around the world and people here at home let's get to work let's get to work and let's build British Columbia together thank you


Welcome to present Inner Sanctum Mystery. Good evening friends of the Inner Sanctum.  Friends, would you like to fly through the air with a great speed? Do you think you're enjoying invisible? Oh, it's easy.  And to become a ghost, all you have to do is accentuate the ectoplasm and eliminate the protoplasm. Man, if that doesn't work, we'll introduce you to one of the characters on our show. He'll take care of you. And that's the truth. What awful people on this show. Where ever do you find them, Mr. Raymond? Well, it's simple. All you have to do is turn over a rock and out they come crawling. And just suppose you were looking for decent people, how would you find them? Oh well now Mary, you were the one who showed me how I'd just go snooping around houses, peering into windows, and I'd find all the nice people drinking Lipton Tea. Oh dear, there you go making fun again.  Yes, there's something so warming and cheerful about Lipton. I guess that's why lots of folks drink it not only at mealtimes, but between meals. Or whenever they get a chance to sit down and enjoy Lipton's famous brisk flavor. That word brisk, B-R-I-S-K, explains a lot when it comes to tea flavor. Brisk means that Lipton Tea always tastes tangy and bracing. It's never flat or wishy-washy. That's right. You just don't know how good tea can be, till you know how good Lipton's is. All right Mary, as long as you're in the kitchen, you'd better sharpen up a couple of knives. As our main character tonight is going to use them. A story is called Song of the Slasher. It's an original radio play by Milton Lewis, and stars Arnold Moss in the role of Detective Dan Miller. Are you ready? Then gather close and listen. You'll find you're getting too many chills and just sitting on fire.  Streets are deserted. The buildings loom like tombstones in the cemetery. No living soul can be seen. Because people who sense stay behind locked doors. Slasher has murdered and mutilated his fifth victim in eight days. In a drab, lonely little room, a young woman suddenly looks up and she hears a door close. Well, what's the matter? Can't you speak? Hey, you get away from me.  That knife! What are you doing with that knife? You're that slasher! It's the slasher! What are you talking about? He's here! 12 Docks Street, he's upstairs! Mr. Lewis Department, I can hear it screaming now! He's withered!  Here's the chance you've been waiting for. The slasher's at 12 Dock Street, right around the corner from here. On my way, Captain. It's how it started. A detective has asked to do some queer things in the line of duty. I didn't mind moving down to the dump at the waterfront with my wife. If it would help catch the slasher. So when I got the call, I rushed out of my joint and beat it down to 12 Dock Street. Oh. Where is he? Where'd he go? Listen, I... Don't do that! I'll get you a doctor! Listen to me, sister! Sonnel, her name is... Are they going to send an ambulance? Yeah, yeah, but I won't do it no good. He was too late. Did you see the guy who did it? I saw nobody. He can't be far, he was here a minute ago. I heard someone go out the back way. When? A minute ago. It's coming from that alley down there. So thick you can't see two feet ahead of you. The back way goes into the alley. Well then... Then it's him. The slasher! I got down to the alley, the radio cars and the men from the precinct were coming. We went through that neighborhood with a sieve. But we couldn't find the guy who whistled that queer tune. Is that you, Danny? Yeah. Oh, what happened? You shouldn't have got out of bed, baby. I was worried. He got away. Did he kill enough? Yeah, yeah, another dame. It wasn't so foggy I could have seen him, that's how close it was. He closed? No, nothing to speak of. Hey, look, look, baby, don't you worry about this.  I'm frightened, Danny. That man is somewhere in this neighborhood and us living here. I shouldn't have brought you down here. You're going back to our old place tomorrow. No, I'm not. I don't want you here alone and I want to stay with you.  Danny. Listen, you hear that, don't you?  Danny, what are you... Answer me, answer me. I want to make sure I ain't hearing... Well, of course I hear it. It's someone whistling. But why are you acting like this? He, the... The slasher whistles that tune. Yeah, yeah, I heard him tonight. And the killer. The slasher must be somewhere around here. I'm going out, baby. Locked the door. The whistling was somewhere in the building. I listened. Where was it coming from? It was gone. I looked at my watch. 4.30 in the morning. I walked down the stairs, listening for the whistle. I walked down my toes, listened at the other flats. I didn't hear a thing. I went down into the cellar. There was someone there, all right. Oh! Who's there? It was Sykes or Janitor. I came closer. Oh, you, Mr. Miller. Yeah, yeah, Mr. Sykes. Hey, what's the matter?  You frightened me. Why? I thought you were the slasher. Yeah? He's around here, you know. He might be hiding in these shallows. He might be anywhere. Everybody's afraid of him. Everybody. Yeah, yeah. So I hear, uh... Sam, did you come down here? 4.30. Like I do every morning. Why? Is there any stranger in the building? No. I didn't see anyone. Who lives in the flat below us? Mr. Trevelyan. Reginald Trevelyan. What a funny name. He's a funny fella. Never sleeps at night. He wanders around the building whistling to himself. Whistling to himself? Yeah. He writes music or something. He got a piano in his place today. He talks crazy sometimes. I think he's up there now. Yeah, he never sleeps. Here. $20. Yeah, yeah, it's for you. Why are you giving this to me?  Do you get it? Yeah, but... But why? I ain't paying you $20 to ask questions. Miller, Mr. Miller. Yes? What is it, Mr. Miller? My wife and I live upstairs. I know it's kind of late, but, uh... Can I come in here for a minute? Of course. Hope I'm not disturbing you. No, it's quite all right. You're the people who moved in a few days ago. That's right. Glad to know you. My name is Reginald Trevelyan. Dan Miller's mine. You've been up all night? Yes. Why do you ask? Because maybe you can help me. Someone tried to break into our place at about 4.30 this morning. Really? Mr. Miller. You think your wife would be very annoyed if I played the piano now? No. No, I don't think so. She likes music. Does she? She seemed like a charming girl. I noticed her when you first moved in. Very lucky to have such an attractive wife. But you wish for yourself like that very often? Especially when I'm working on a new composition. Wait a moment. I think I have it. I know I got that passage all night. Mr. Miller, please get out of here. I want to be alone. I'm not interested in your opinion. Marla, what are you waiting for? Get out of here! Get out of here! I've lost it! What? What? That passage. Do you see what you've done? It's been lately. I keep forgetting things. I'm sorry. I was rude to you. I didn't mean to be. Good night. Mr. Miller. Is it really true what it says in the papers about the slasher? That he has the whole neighborhood crumbling in terror? Yes. Lovely.    The slasher was. I'd embrace him and give him every penny I had. Why?  Because they laugh at me. I phoned headquarters told them to check on Trevelyan. Oh, he was a queer one, all right. So queer, I didn't tell Laura about him. I didn't want to scare her. Couldn't arrest him. I didn't have anything on him yet. I lay down a rest. In my dream. Maybe not. I heard that whistling again. That same tune. I think that's what woke me. I looked around. Laura. She was gone. And the door was open. The hall was filled with thick fog. In the yellow light I saw a crumpled heap on the floor. I recognized Laura's bathroom. Oh, the slasher. That's my boy. He's not the type of low character who goes around murdering his friends and relatives. No, he's so big hearted he murders anyone. Even people he's never introduced to. He's no snob. Snob? He's much worse than a snob. He's a lunatic. Oh, Mary, you're so unsympathetic. He's just lonely. He wants to get close to people. With a knife. Well, if he's so lonely, then why does he go around cutting people? You see, Mr. Raymond, I can say the same kind of things you do.  You can't frighten me, Mr. Raymond. But as a matter of fact, I do have something practical to say. I'm going to suggest that all the folks who drink Lipton tea should buy the larger, more economical-sized packages. Not only because they're thriftier, but for another reason. You see, if you have a large package of Lipton's at home, then you're not likely to run out just when you need it. For instance, when folks happen to drop in unexpectedly some evening. And, of course, Lipton's is a grand drink to serve your guests. It goes so well with cake or sandwiches. It just seems to make everything taste better. So, folks, be sure to have a good supply of that brisk Lipton tea on hand. Yeah, I'll do that. And while you're at it, be sure to have an extra hand on hand because a slasher may want to collect one for a souvenir. Well, we've kept the blood from flowing long enough on with the murders. Listen, as we hear Arnold Moss's Dan Miller finish that story. Laura was alive in a dead fate. I scooped her up in my arms and rushed her back to our flat. She opened her eyes a few minutes later. Dan. You're OK, baby.  Yeah, yeah. Take some of this. Oh, Danny, it was awful. What happened? Well, you were asleep. I went out to get the milk, and I heard someone whistling. Do you remember what? That same queer melody we heard before, the one the slasher whistled. So I thought I'd help you. Help me? I thought I'd see him. I walked quietly down the hall and there was no one there. Then I turned the corner. Yeah? I saw the knife gleam. Someone was hiding in the shadows. He grabbed my neck and I screamed. I screamed, Danny. I screamed so I thought I'd burst my throat and then it all went flat. Did you see him? No, but I fell his hands on my throat. They were strong hands, fingers like steel, and I... Sorry, I can't even talk about it. Now, lie down. Lie down. You'll be all right. But when you think that he's right here, maybe living in this building... Well, he won't be here long. I'm calling headquarters. You know who he is. I got a good idea. Now just let me get on that phone and... Oh, Danny, maybe that's him. Take it easy. Who's there? Just a janitor, baby. Oh. What do you want? He went out. Provided? Yeah. Okay. Lori, get dressed. I want to get you out of here before the trouble starts. I'll be gone for a few minutes. Where are you going? With Mr. Sykes. You got a key, Sykes? Yeah, but I'll have to go along with you. You can't take anything. You know what this badge means? You were detective? Yeah, yeah. Now let's go. What are you doing here? Looking for the slasher? I'll write you a book about it, pal. And here's his choice. Open the door. All right. But you'll have to hurry. He might come back any minute. All I want is enough evidence. I'll take care of him when we get it. The door's open. Come on in. It was eight in the morning. But it could have been eight at night. The fog was so thick. I knew this was it. I couldn't take any chances. I had to get all the evidence on it before I nabbed him. And I had to get it without him being wise. What are you looking for? Knives. We know he's got at least three. I don't see none. Neither do I. Maybe it's a bomb steer. I could be wrong. Hey, what's this? Music. He's always writing. I used to be a choir boy once. They taught me how to read them notes. I wonder if I still can. Why? Because I think this may be a tune I'm looking for. Let me see. For? Yeah. I bet you did. He's always whistling it. I heard of myself when he killed the last one. You've got to find those knives. You better hurry. I think he just went out to get some breakfast. I looked everywhere. I couldn't find the knives. I couldn't bring a guy in just because I heard a song.  They were trunk keys. But there was no trunk. I think I hear him coming. Never mind what you think. Keep his trunk. In the storeroom in the cellar. He's always going down there for things. Hold it, hold it. There's room behind this upright piano for both of us.   Get behind it. All right. Play the queer arrangement of the same tune that led me to one. I reached for my gun just in case. Suddenly sweat oozed out of me. It was sweat that felt like ice. I didn't have my gun. I remember I took it off when I laid down the rest. Wrong. Oh, wrong. Why can't I get it right? Again, come on, Sykes. I told you to hurry before. I hear him going down those stairs. It's safe to go now. All right, Sykes. We're going to open that trunk in the store. This key should open it. The knives? Yeah. The knives. Look at them. Look at them. Covered with blood. Sykes, go to the police precinct. Tell them Miller sent you. Tell them to come over here with as many men as they can spare. All right. All right. I took the knives and put them under my coat. Went up to my room. Yes, I'm leaving. I'll be home soon. I can hear Laura talking on the phone with someone. I opened the door. Oh, of course. Oh, I better hang up now. Danny just came in. Goodbye, Dowdy. What were you talking to? Mother, I'm ready to go. Wait a minute. Wait a minute. There's no rush. Is that man at the piano? Sounds like the slasher song. Yeah. What have you got there? My gun. Come on, baby. We're going. That man playing the piano.  Yeah. Positive. Oh, Danny. You're hurting my arm. Oh, I'm sorry. I'm nervous. That's his place. Come on in with me. Come in with me. Yeah. Yeah. I figured out a way to trap him. I'm scared, baby. You'll be OK. Oh. You. Yeah. Yeah, Mr. Trevelyan. I'd like to meet my wife. I'm delighted. Would you like to hear something? It's a composition I've just completed. I've had a great deal of trouble with it. But I think I've got it right now. Gun. Yeah. You've got it coming to your slasher. You.  Why did you come here and dance? My music. Not even listened down. Danny. You murdered him. Yeah. Why? You'll find out. What are you going to do with that knife? It's one of his knives. Stand still, Laura. Danny, do me. In a minute. Danny, what's the matter with you?  I didn't know who you were talking about on that phone. It wasn't your old lady. What? I was Jerry Boyd, that guy who lives next door. Wasn't it answer me? Wasn't it? No, no. Lie to me. So this is why you made me come down here with you. You planned this all along. That's right, baby. And that's why I had you insured for 40 grand. Oh. You made one bad mistake. You married a smart cookie.  Yeah. No. When it was over, I wiped the knife clean of fingerprints. And then I smeared Trevelyan's hand over the handle. I knew what to do. Made it look good. Made it look perfect. There's a way to get away with murder. And I found it. I thought. Go on with the report, Noah. What, Captain Quinne? After I sent psychs to the precinct, I went upstairs to my gun. My wife wasn't there. I got the gun. I heard a scream. I rushed to his place. I opened the door. I saw Laura. The second I thought I'd pass out. Yeah? He grabbed a knife and come at me. And I shot him and killed him. Oh, Laura. She was insured for $40,000, wasn't she? Yeah. Yeah. Yeah. Well, what difference does that make now? A lot of difference, Noah. I want you to meet someone. Come in, Sacks. Yes, Captain. Did you hear Detective Miller's report clearly? Yes, sir. Was he telling the truth? No. He lied. What are you talking about? I didn't go to the police when you told me. I hid in the cellar. I saw you go upstairs. I saw you get your wife and go to Travellion's place. I listened at the door.  Captain, the man's insane. Yes, Miller. A homicidal maniac. I'll take away his coat. You see? He's handcuffed. I don't get it. He's the slasher. He? It's impossible. I told you about that melody. Why, it's still on Travellion's piano. I didn't copy down that melody after he heard Sacks whistle it. Yeah. I whistled the whole thing for him. Put the knives I found in Travellion's trunk. I put them there. I know who you were. Sacks was trying to frame Travellion. He's made a complete confession, Miller. But how did you find out that... When you asked us to check on Travellion, we discovered that he's quite a famous suffix-centric composer. I checked up on the other people in the building at the same time. I found out that Sacks escaped from the state institute for the insane two years ago. He's confessed. Yeah. I'm the slasher. Why should Travellion become famous for what I'd done? You had a perfect crime all figured out, Miller. But you made one little mistake. You decided the wrong person was the slasher. Even a copper can pull a perfect one, Miller.  In ten minutes, I will be able to tell nobody anything. Ever since I made my report, I've been... I've been hearing that song in my head. Like somebody whistling it. Soon I won't hear that either. Oh, for tonight's story is... Never quarrel with your wife. Avoid strife. If that doesn't work, get a carving knife. Now, there's the perfect formula for domestic bliss. Don't you think so, Mary? I do not. Oh, then I'll give you another one. I love this one. Beat her till she's black and blue. Break her arms and legs in two. Then tell her to brew a cup of Lipton tea for you. Oh, I give up. All I can hope is that folks don't pay any attention to all these peculiar things you say about Lipton. And I guess they don't. The proof is that more people drink Lipton tea than any other brand. But if any of you folks haven't tried Lipton, why don't you do so now before Mr. Raymond says a word more about it? Why not let that famous brisk flavor speak for itself?  It's about a beautiful woman who holds her hand, tells you about the future. Of course she's kind of pessimistic. She sees a man with a knife stuck in his throat, the girl waving gaily from the gallows. And listen to this. Our star will be the glamorous motion picture actress Wendy Berry. Let's make it a day now. Oh, by the way, this month's inter-sanctum mystery novel is The Lucky Stiff by Craig Wright. And now I guess it's really time to close that squeaking door until next week, the same time when Lipton Tea and Lipton Soup bring you another inter-sanctum mystery directed by Hyman Brown. So until then, good night. Folks, if you'd like to try a modern food with a real old-fashioned flavor, then try Lipton's noodle soup. You see, Lipton comes in an envelope, and all you have to do is empty the content in the boiling water, and in no time at all, soups are. And what a delicious, chicken-y tasting soup it is. It really tastes homemade, and it's brimming with golden, tender egg noodles. Lipton's is economical, too. It costs less and makes more than canned soups. So folks, don't forget to try Lipton's noodle soup. And don't forget to tune in next Tuesday night for another inter-sanctum mystery. This is CBS, the Columbia Broadcasting System. Thanks for watching.


Now we're ready to look at a calculus-based version of the instantaneous velocity. We've already defined our instantaneous velocity to be the velocity at a specific point in time, given the symbol v. And we can compare this to the average velocity where we were working with a time span. Now graphically, when I was looking at the average velocity over a particular time span, I could connect two individual points and the slope of that line define both the time span and the displacement, giving us our average velocity. Well, if I reduce that time span but keep my same initial point, what I find is that as I reduce it, it changes the slope. But that slope is approaching a value, which is the tangent to the curve at that specific point in time. To put it into words, as the time span gets smaller, the estimate of that tangent gets better. And the exact value would happen when the time span goes to zero. Now mathematically, we represent that as the limit as delta t goes to zero of dx divided by dt. But in order to actually solve that equation, we need to use calculus. And it's called the derivative when we do that limit. Now this derivative equation here, a common mistake with beginning students, is how to think about what this equation is really saying. Shorthand will say v equals dx dt. But it's not the derivative of the position divided by the derivative of the time. Instead, it's the derivative of the position with respect to time. Another way this can be written to kind of highlight the fact that this derivative is a mathematical operation, and you're performing that operation on a specific variable of the position. Now we also want to remember that that position and that velocity are both functions of time. So when I take the derivative of the position with respect to time, I'm working with some function of time for the position, and I'm going to get some function of time for the velocity. Practically speaking, when I'm solving these kinds of problems, there's sort of three step process we're going through. You have to start with the position equation, so you have to have that function of time. Then you can take the derivative of that position equation with respect to time. And then you evaluate that at specific times to get the velocity at a specific time. Start off with the position equation. Here's one example we could use, and this is a simple polynomial type equation. Now a lot of textbooks will sort of strip out the units for you, so you can see very clearly that this is a function of time. Don't forget, however, even if you're working with this simplified form, that these are physical quantities and they really do have units associated with each and every one of those numbers. Once we've got our equation, then we can take the derivative with respect to time. So you can think of it as here's your derivative operation symbol, and you just plug in your function of position with respect to time. Now if you're well-practiced on your derivatives, then you would simply see that this derivative works out to be this equation. You may need to practice this a little bit, though, to remind yourself that that two meters is a constant, so the derivative disappears. The three t becomes just three. The four t squared becomes eight t. And notice that the units on these terms stick around. They don't get changed when you take the derivative. Now that you've got the equation for velocity as a function of time, to find specific velocities, you would just plug in the specific time that you're looking for. So we take our equation, but time becomes replaced with our variable two seconds. And as you multiply this all out, we would find that I've got 19 meters per second. Now here's where I say keeping your units in gives you an advantage, because you can double-check that yes, these really do have the correct units when I work everything out. And as I plug that in, it has the dimensions that I expect for a velocity. So that's your introduction to instantaneous velocity from a calculus-based perspective. You'll get plenty of practice working with this.


It's about one in the morning here in Jerusalem during the intermediate days of Pesach. I'm wearing this light full Hawaiian top so I look like a nature videographer. I started bringing out my Canon XA40 wherever I go because you never know what you're going to find. Something that people who've never visited Jerusalem or lived in Jerusalem might not be aware of is the fact that the city has a massive population of cats, wild cats, you know, not domesticated cats. Just wandering the streets, various theories about how they came to be. I've done a podcast about it before but irrespective of that, I was walking home and I found a few cats and I just took out my video camera and one particular cat seemed to be pretty much happy with me filming him so I kind of tracked him for a while so here is some footage of a random Jerusalem street cat doing his thing and seemingly enjoying being on camera.


In 1949, Secretary of Defense Louis Johnson announced the creation of Armed Forces Day to replace separate service days for the five military branches. The single day celebration was created 65 years ago to symbolize the armed forces coming under one department, the Department of Defense. Armed Forces Day is celebrated annually on the third Saturday of May. This year, that falls on May 17th. Individual states and cities honor the men and women in uniform with parades, open houses, receptions and air shows. Check with your Community Events page to find out how they're celebrating the spirit of the First Armed Forces Day and honoring our service members. From the Defense Media Activity, I'm Petty Officer Jen Blake.