Usim Jekie, Usim Jekoskwevo Hai, you're watching your favorite show Favorite morning show Favorite breakfast show Ladies, breakfast, everything Just, guys are too late And it's favorite bus You have us Sendio At White Fire from Facebook At White Fire 4 Channel Onto the hashtag Is social for Friday I know this was orchestrated If I may talk up as I am I'd like to thank everybody involved Nime kuwana nani Good morning manu Nime kuwana, thanks Hashtag is social Friday May it go well Or at color me va And I promise to you An interview and I'm going to deliver So, mwa mwa ka letu When you remember first Alafu tumuitishae social Mi dahandos Ndom fwate raka raka Num stok stok pole pole Alafu sasa na we can get into it So, by the way, if you have a question Good morning man James If you have a question You can just throw it over there On our socials And we will direct it to her If you have a compliment Tuta ka Pichu tampea Isu zingina we katuna Katuna Hashtag social Friday Bazoot kumushe manu Tuk pata pwanda Ii anguata trafiko Ndika kwa paiko mehapa Kama kaida vidijakalip An all social media Facebook, Instagram, TikTok Ganingine tinda I have a very silly question Just before we start the interview And I know you guys Mna tunangakwa TV Mna na wow Mta kwa kwa TV Ini job tu nani We are very normal As you can see I don't even have shoes on set And I'm not feeling any kind of pain Because it's not affecting my English But Kali fani nge shuta pa sayo nge fahadne Ndika Ndika nge fahadne kama jeskia Okay, that's not breakfast talk I'm only human You see? We are only human But that's not breakfast talk Good morning Tatyada Good morning How are you? I'm fine Thank you You look fantastic Thank you so much dear Please do tell us Where we can get you on social media So that we can follow you You can find me on Instagram At real Hashtag Tatyana On Facebook Still Real Tatyana Twitter real Tatyana Actually I'm still new on Twitter I Sikuwa na fain nifan Twitter So I'm still adjusting to the world of Twitter But you can still find me there To TikTok I've just joined of course Hey Yeah, so you can still follow me there Those are my Social media platforms for now Untu asima kama nge zongia nge zahimba So neskia nge zongia vizuri So that means neskia nge zahimba vizuri I like being very practical This is a class So would you like to just sing us Just something I don't It doesn't have to be long By the way, just Wake us up nicely Let's go to vizuri Anything From your heart I'll do my song Okay Because The reason why is because There's victory You know, there's victory Respectively It doesn't matter the industry you're in This morning Probably someone is discouraged somewhere I'm just here to tell you There's victory for you So I'll say Yesumame nipa ushi ni ninajuwa Hame nipa ushi ni ninajuwa Hame nipa ushi ni jinajuwa Everywhere there's victory Victory Everywhere I'll leave her He's going to be an instrument Like in Nyan Nyan Eh We Fast It's a good day to come to work Muskeo sa uchi Sabuni aroho Wow You sound so good How is this your first song? Um Actually it's not my first song I did my first audio Kitambo like years ago I can say 10 years ago Um I was backing up someone in studio And then Could you say But Tatiana can you do a song I'll produce for you Just audio So I did my first song But at that time I was not really focused on pushing I was not interested in music I was just doing backup But this one it came Now I can say now this is my official song Because as you all know The pandemic affected a lot of people It shut down businesses I had you say yes Like most Like everyone has been affected So when I was at home and meditating And studying the word of God Because that is what the word has made me today When the Holy Spirit told me That he has given us victory I was like I Victory was in this pandemic In this situation But you know when the word of God comes It is It doesn't matter like The walls The walls that are happening at that time What you do is just You take that word and you run with it So when he gave me that word This victory And immediately after he prayed He gave me the song So I just began to Mime to mime to mime And then next week immediately I was in studio And I did the song And here it is with remarkable feedback I'm just like Sometimes it's really good to Hit to the instruction of the Holy Spirit Because of the impact of the song Right now the feedback It's just mind blowing Yeah What kind of No, who are you getting feedback from? I'm actually YouTube I have Facebook Instagram Because I've been pushing them On those platforms when I started When you look at my feedbacks From the YouTube comments Like most of them I even don't know those people You know It's not that I used to have a YouTube account I know people I am known Yeah, connected Yeah, not connected by the way So I'm just connected to God But when it comes to this Whatever things I am not So when you find someone Just commenting on the On your YouTube It means there is an impact The song has impacted them So those are the feedbacks Like I have responded to each one of them I think right now Around 200 Comments from people These are 200 people That I don't know Actually my world is very small So when you see such kind of comments You're like, wow Really the word of God works Yeah You have a family Yeah You know, usually it's in reverse Like To live I don't know what's wrong I don't know what's wrong In the life But I don't know what's wrong Why is it Like I found it like that High ancestors It's okay How is it that you have Found the strength And the time To now do what you What Doing 10 years ago With a family With a baby and a husband How are you managing others? Actually number one Priority Knowing how to prioritize things in life Because I believe women we have the ability You know, when I say manganomi They cannot multitask But women we can't It's just that How you organize yourself How you organize things Because I'm not just a mom Like I'm a wife I'm a mother of two children We're two adults One year Three years So they are in a stage That really need my attention Those ones that bounce off the walls with energy But in Watawuku You know they are just everywhere But you see With the grace of God I'm able But apart from all those things Priority Knowing to prioritize things Like in my life My family You know they come fast I have to put my family fast I know the time Like I'm supposed to be in studio At this time I'm supposed to be at home At this time I have a schedule Whereby that I need to follow it And it cannot like distract me Like can I tell my husband No Can I say if I am busy No Or I tell my kids Like mum is not here No When I'm at home Is mum like I have responsibilities But when I'm in studio Now is Tatiana This is business The same way as you Me diava Like when you're at home Man say you're talking And all that Na jwa No makeup Na jwa But when you're at work Now is work Like deal with it Like work So that's how I manage it And like the way you ask me So many people have asked me How do you manage Apart from that You're into business You're doing this and this And all Everything in your life is running So when You just prioritize You pray Because most of all You get guidance from God You cannot do anything Without the ability of God Without the wisdom of God And yes That is what has made me stand out And to be able to handle everything at once Yes How do you look so good though? No Do you have to choose Miss Jazan Na ni Hoku na awili How did you do it? How did you do it? Okay Like I just Let me say I have that body Like when I even gave birth To my first child daughter I was like Three months from I down the line My body had just gone back It's not because of that It's not because of But one thing Me am a Christian Let me tell you the secret In the way Part of the secret thing That I believe the power of words In over the years I've been confessing I have the best body You know I don't have to have Like veracity Go on and all that But you see the confession Whatever you say will come to pass If you can put the word of God In any circumstance It can work for your body It's possible So I confess Like I miss him Like she beat I refuse to age I mean the edgeless zone So that is what like You know your words Your life locates your words So whatever that thing you say In a kufuata too When I come to you Like a 5-year-old and I enjoy you as a mum Like let's say 5 months old So wherever they see you They follow you When I crawl or kufuata That's how your words Your words will always follow you So if you say you Manze misina bodipua That is how your life will be But say I have the best body I'm edgeless I'm not aging You know I'm I'm fearful and unawentafuly made I'm beautiful all the day Like those are the kind of confessions I make So it's more than just Now the things we do And you know Is first of all what do you see Kus you might be saying something negative But you're putting so much energy and resources on Now buying products That don't work Why? Because of your words So the words that you say every day to yourself To your body To your health They really matter They will automatically come to fruition Khalifa it's time to practice We say we are practical Say repeat after me Nikona pesa I have money Money follow me Like banana No Money follow me So say it Manze damiwa ni? Wey sit in the center to confess This confession It's the form of confession Ura se meiwa nakuna watu Nye sayina manapa biliwa manza kutumaman bm Nitu mii ele pesa kuwaiti amba Oy Wey like we have gone No no we can't help you now Khalifa Okay so How is it? How did you expect it to be like this? Did you expect the feedback?  Okay I would say in terms of fame I would not say What I was figuring out the way Like I received the song I knew it's a song that will hit so many people Because as I said earlier The pandemic has affected a lot of people So right now Akunam 20a tukuski ya korona korona Manze mii chusha that one You know So everyone wants to hear that word That will lift them up Everyone wants to hear that word And you irrespective of all this God cares for me And God has me in mind Because sometimes even Christians themselves Wako in this situation in ya wanna doubt But I knew when I'm releasing this song By the spirit of God It will lift so many souls So I saw it reaching and exploding Like even right now Bado It has to explode like really Because it's a word from God It is a song that has been born from the spirit So and something that has been born from the spirit Nothing can stop it So I'm looking forward to more feedbacks More testimonies You know Like we sell in biosong And immediately like I was telling people The more you say that song The Lord has given me victory Mind you, it's a testimony It's a confession So the more you sing it out Kamu kwa sekula muka It doesn't matter The more you sing it You begin to experience victory in your life Automatically I like that you brought in the sekula aspect Because very recently In the industry to mona Kospel na sekula kifanya kolabo Of the top of my head Neza Fkiriya Masterpiece na Papa Jones And I think it's To me Why don't come shoot me This is not an opinion for Y254 Or why in the morning it's just me I think it's wonderful that Neza Patap We remember that we are human All of us first Regardless of what we believe Or how we believe it And I like that Papa Jones Kuna ma Okay Chani sinpeh promo But let me come back to you Is that something you would be comfortable with Or is that something that Is not really At a market you'd like to tap into Um Based on my upbringing The spiritual upbringing I'll say And I'll use the scripture Because at the end of it Ato kwa sekula mu kwa kospel God akutuma baibolia Sekula na baibolia You know It is all kwa tia kwa kospel Khalifa, khalifa, khalifa Effect Uhu Una lala Uwa Boli mi eni kwa saha ukwa Amma tongese Just ask me kwa Hey Amma na mi eni Aneza saha wad Okay Kati Okay, I'll Repeat that one Like God did not say Now this Bible is for sekula Na inia kwa kospel We only have one word And the word of God is light And where there is light Darkness cannot comprehend it So therefore there is no way Now this is my perspective How I understand the scripture And how I understand the things of God So There is no way light and darkness can come And compile It's not possible It's either one will be deemed Or the other one will receive light You understand? So For me as a gospel artist There is no way I can come in Partnership with a Sekula artist and release song Remember gospel I think a lot of Music ministers Uwameza kutkulia Maybe gospel as a light thing But when you understand that Gospel is the word of God It's the true word of God It's the true definition of the word of God So whether you're in sekula You must have always that moment of As in like The word of God It should rejuvenate you And if it rejuvenates you Automatically whatever will come out of you Is a word So this is what I think But me when you meditate upon the word of God What will come out of you is that word So there is no way Like you will mix the two Me I don't like I cannot So Jana Holi Dave He has morning devotion From around 6 to 7 AM Every day And he said the reason why he does it Is because Early in the morning at Kawizum So by the time he's going out To social media platforms Or to other people He has something to give Because he's inspired himself How often do you have devotion?  I cannot tell you that I do at this specific time and anytime you find me, I'm praying.  Onajiwa, so me always have that fellowship with the Holy Spirit every time because every time you have that fellowship, okisha build that in the knees like a father and daughter or a father and daughter is a perfect one because daddy's girl, you know, that bond you can never break it. So when you have that kind of a bond with God, trust in me, your antenna, your spirit will always be allowed to know what to do, where to invest, what song to release, what to do at every time of your life. So mine is a lifestyle as in that fellowship. I don't have specific time that I have fellowship. Anytime I pray, anytime I worship, anytime I have that fellowship with the Holy Spirit. What's your most vulnerable moment as a person? What's your most vulnerable moment as a person? What's your most vulnerable time? When I'm speaking in terms, yeah.  And I take time I pray. So the best time is that time when I'm speaking in terms, just I'm there me myself and I is alone time with God. I have come to understand that there are a lot of people who suffer from anxiety.  It's a thief, it's like an unwanted guest that started telling us what to do in our own homes. Ati wash hands, ati distance, in fact it's social distancing and all these things. Have you, no, because you don't look at us, what is the dawa, dawa yu anxiety ni gani, because you're so confident, you're so sure, you're very still, if that's actually the best word I can use, you're very still. So how do we get from anxiety to stillness? When you have the Holy Spirit, every doubt, every anxiety in your life just, it just goes down.  But you see, how do you bring it down? Personally I speak in times, I'll tell you, there's no... So you learn how to work? That's hwa. Imagine I find peace in God, that's how I've trained myself. The same way you can go to school, they train you, there's a system yo, you must know what it is, that is now me, it's a system where I just choose to relax, you know, because that's what I've been saying, be anxious for nothing, but in prayer and supplication, make your request known unto God. So why worry? You know God and I say mangam, they all find omega, the beginning and the end, where value kawati? Kati kati, kandot. So why worry? You know, like an example when an insect is walking, I can just give us a best example, and then there's a stone there, and you are standing, they wanna be in the end.  See you pandetu, you maya lafi yende, that's how God sees. It's not that we're that small, but God anatuna, even in terms of we are just in between, what he needs us to do is just ask him, God, what should I do? What is the way out? Anatuna, and in Christ, there's always a way out of any situation. I just told him, suji landlod suji nini, there's always a way out in Christ Jesus, and God can never even allow you to experience something that you are not prepared for. So when it comes to tough up, she not chest out, face it.  Those are the things in terms of confession. When you confess such things, you'll never experience shame in your life.  So these are my daily confession, daily contemplation, daily, you know, they just keep me going. So whatever the situation that comes, I just laugh. I'm like, never badwa jaona, you know? And that's always my confidence, no matter what, no matter what. Even if it comes to my family, my kids, sometimes you see some symptoms of what, what, what, I'm always confident that it can never happen for my children. Never, why? Because I am a child of God. I am a Christian. I am a joint here with Christ Jesus. My children, my family, they cannot be disadvantaged. So that's where I find my peace. And that's where I never have that. I hope I'm not taking notes. Should we just wait and for you to just continue writing mumkosa? But you can also catch the interview again at White Fire 4 channel on YouTube. Now, before we get to, because I have one more question on the video, but I do have another question preceding it. And in my life, the way I'm living it and experiencing it, nima kujakuna mungu, ua hachizangina tamiangu. So neza muitisha ikitu, sayi. Nani liye, nise me wo ii, nita kasaia, ginda kufauspunpe, aiaiaiaiai, alafu nisa hau, perhaps, amani give up, amani jambe tu nisaawa, liwe liwa, liwalo.  And I've seen quite a number of people, I want to put it in quotes, give up. Una skiam, toa gospel mi bia mi kwit, jo istoryam li tei pesa. And I guess that's the whole point of being an artist. If you're going to, because studio sifri, you know, kupushungoma sifri. Yeah, trying to be out there, trying to make a name for yourself. Performing pre-Kovid was not free. So, how would you like to address the giving up part? First of all, I'll say, a Christian should never give up.  Because if God has really called you to be a minister of the gospel, remember now, he has not just called you as an individual, he has called you as a minister. So he's no longer about me, he's about his will. So when you give up, it's like giving up the will of God at work in your life.   We should not be the case. As a music minister, especially a gospel music minister, what you're doing, you're bringing forth, they will pass on as a preach, them they're preaching with the will of God. Like preaching, preaching. But for us as music ministers, we are preaching using music, is ministration your music whereby he can preach this word in, you know, hallelujah, what what what. But I can do it in music whereby it will affect lives. So when you know that this is administration, don't give up, no matter how tough it is, it is administration and it's calling on your God Amiukwita and what you need to focus on is delivering it to your level best. You know, like they say, I can give example to those yaparaboli alasu al patiwa talents kwa Bible. You know, kuno liali hide, kuno liali endakende leza, unona. So the question is, who are you? Who are you in those three?  Challenges are bread for life. They are a stepping stone to the next level in life. So they should never be an excuse or any thoughts of you now giving up or backing out irrespective of what you stick to it and ensure that this responsibility and your God Amiukwita, I'll ensure that it comes to pass and I'll ensure that I multiply it. I'll ensure that I increase it to the level in your God Anataka. So I don't encourage any Christians to back out or to give up. Usi angali apiwa like you have said, maybe it's not bringing in money, it's more than money. It's more than money. I can say right now me, my focus is not that at all. Music is investment. You're investing so much and why are you doing that? Because God has called you to do it and apart from it, I can even say, personally, is out of the love I have for God. Your passion and income for the things of God, it makes me now, if my music, I can put money in my music, it reach so many people that I'm able to reach them in my physical contact. Why not do it? And don't look at, just say okay, something is up, I'm going to make it. No, no, no, no. I can even tell you, I didn't even calculate how much I've spent on this just victory song in terms of marketing, in terms of I've spent so much and I'm not looking at the impute. What I'm looking at is the impact and the results. So I think that is kitueni, at like music ministers on Afua Angali, they should not like look at the end product, like Pesa, because we are by when I say, but there is profit in every labor. So you continue labouring. There is profit. Profit might not come in as up as in form of money, of other blessings, remarkable blessings in your life, opportunities. Like me here being today, these are opportunities. Why God ordained like now this interview to happen because I believe there is someone there who is listening to me that after this their lives will be eternally changed for good. And if that is the purpose why I'm here, I'm good to go. Okay, briefly, the last thing because we are running out of time. Thank you so much. Help me understand the storyline behind the video. As I said earlier, victory came as a result of what was happening in the world. And when the whole spirit said of course, now victory is now saluting, you know it's victory. You know there's no, when I say there's no victory without a shout. Value is in me, to me fly like in a car. Is in me for a while. Yeah, I'm so extra. Whooo! Sim nani jua to. So there's always that you need to express it. So like we are saluting now to God to the victory that He has given us that you are saying victory victory everywhere irrespective of where you are, there is victory. That's what I was saying in your family, in your business, in the churches especially and in the nations all around the world. So the storyline there is just, let me say is victory as the song says victory. Because in pandemic it's not here to stay. But victory is here to stay. So that's why I sang the song and I believe it will continue. Blessings so many people and let them keep on sending the feedbacks via my social media. If they have videos they can send. Keep keep social media again. Social media. You can follow me yes on Facebook real Tatiana on Instagram real Tatiana Twitter real Tatiana. So if you have amazing feedbacks keep them keep them coming in the videos you know of you dancing of you celebrating to that song just tag me tag me and I'll see the video. Yes and I'll truly appreciate for the comments and the feedbacks. Mshaskia Vittumbici victory. I don't know anything else that rhymes with that unfortunately nimechoma but nisawa. I put my phone on Facebook at what5o channel onto the hashtag is why in the money hashtag social test social Friday. Thank you so very much Tatiana for coming. Now let us show you what she was talking about. Victory.


We're training for Xenoth Foto in Mosaic, hobby four marks number eight, it is 900 points. Good luck. Six times, and top team's gonna get it here. Six times. One, two, three, four, five, and six. Going to the Lions, Lions. Thanks again, everybody.


So I must say I'm slightly out of my comfort zone, I'm kind of used to introducing people to this subject of plants and wild places and the things you can eat by wandering through those places and just pointing things out. The thing is I mentioned this over breakfast and somebody just said to me what you need to remember in this place is that you're just dealing with it with an awful lot of goodwill and I really think that's true. So I'm just going to introduce my story to you to just give some background on how I came to be foraging for a living and gathering wild plants as a job, which is I have to say it's my dream job and I'm very satisfied to be doing that. It all started when I was about six years old. My grandfather took me out one morning. It was quite a cold winter morning and he knew something about the wild mushrooms that grew in the land surrounding his house. So I remember stepping outside the door. I can't remember if I saw it first or if he pointed it out, but we're looking across the field and there's this strange object that's a different color to the grass sort of about 150 yards away and either way we started looking and walking towards it. He knew what it was and I didn't and we got closer and closer and gradually this shape became clear.  We're going to get that on the way back and we'll eat it. And then we went right into the woods and, you know, you might think it staged managed it to make sort of the maximum impression on a small child, but he wasn't that kind of person. I know he didn't do it. But the next two mushrooms that we found, one was a deep purple mushroom with a really sweet kind of mealy smell. So it looked amazing. It smelled amazing. And a couple of minutes later, we found that was called a wood bluet, by the way. A couple of minutes later, we found something called an ivory clitocybe. It's sort of an aqua blue on the top and it smells very, very strongly of aniseed. And when we took it back to the house later, I found out it tastes strongly of aniseed, too. So that was my kind of initiation into foraging. And the thought that really got implanted in my mind during that experience was something which has pretty much stayed with me ever since. And it sort of guided the interest that I've had and the sort of quest to discover wild foods. And it is, there is treasure in the woods and fields. I think that thought just stuck that day. And a few days later, we just moved to Suffolk, which is where I was doing that in the south of Indon, doing that outing with my grandfather. And the next few days, I started a new school and we're supposed to catch the bus home from school, but I didn't do that. I skipped the bus and wandered across the fields home and found some one of these parasol mushrooms and some horse mushrooms and just turned up at the door carrying this great edible bounty. Everybody's fretting, where have you been, where have you been? I said, never mind about that, look at this. And my mum was slightly nervous, but had enough confidence that we cooked the stuff and ate it. And it's that sense that there is stuff out there to be discovered. I must say, I learnt some other plants. I learnt about the wild watercress near there. I learnt about the elderberries that my grandfather made into wine and the blackberries that my grandmother made into jam and there were nuts in the woods. But I was a bit of a mushroom guy mostly for the foraging I did for the next few years. But this constant thought irritated me for years that there were more of these kinds of treasures to be found. And I think the really poignant thing is how my grandfather had arrested my attention while he hadn't really taken me out. And these things had arrested my attention. We're talking about treasure. The fact that we're not all using that stuff and we don't know about that stuff suggests it's kind of hidden in some sense. And yet it's not. There was that mushroom on the field, it was perfectly visible, all of these mushrooms were very visible in the woods. And most of the stuff that I gather now is blatantly visible. A lot of it, people just walk on top of it. So what is it that's hiding it? I think it's that attention grabbing thing that sort of sums up what happened to me. My attention was focused on that. So the things are hidden just because we don't attend to them. We can see them, we can probably even smell them. So that's one thing. But then again, the other thing that hides them is just the value that's put on them. Because we think it's just weeds, it's just plants, and so on and so on. And the value that's put on the ingredients that we do eat, it's interesting sometimes to ask why do we value that? Oysters used to be peasant food years ago. Then it became scarce. Suddenly now oysters are seen as a gastronomic delicacy and so on. And the process that we've gone through in discovering some of these plants and taking them to restaurants, that has been the sort of most poignant thing. Because there's been wild foodies and foragers for years, sometimes though that's had a bit of a kind of quaint image attached to it, a bit wacky, a bit eccentric. But the point about what's happening now is these ingredients are being placed in the top restaurants in the world. Ali, my wife and I, we started inviting friends around to have supper with us. And I think it was like that first experience again that I'd had as a child, this sense of discovery. Only this time it wasn't just the plants, but it was like people eating together. And we'd bring wild sorrel in. We looked for weeks for wild sorrel. I had this book by Carl Ucho. And it was just like 15 plants in that book. And we were just going through them and going, let's find all of these. We had our wildflower book and lots of countryside. But it took us ages to find a wild sorrel. So when we finally did, we've cracked this and we said, come round and we just cooked this simple recipe from the Carl Ucho book. I think it was wild sorrel soup. I think we had eight or nine guests. And just the sense of awe and wonder that everybody had.  It felt like a kind of secret garden that we'd all wandered into. And you just felt like you were tapping into something that everybody should know about and that people used to know about. So we kept holding these sort of wild food dinner parties. Every time we discovered something new and we had some great journeys to different places to try and find things. Only to come home and find out that we're growing in the next door neighbor's garden. That was funny. There's definitely a parable in that one, I think. But then one day, we just wandered into a restaurant in Canterbury and we fancied a bowl of soup. It was the wild garlic season, so we've been eating wild garlic nonstop for weeks. And it's just soup of the day. We said, what's the soup of the day? They said it's wild garlic. And we went, and this guy was obviously deeply offended. He said, what's the matter? It's really nice. You should try it. We said, we know it's really nice. We have tried it every day for the last two weeks. We fancied something else. He said, stay there. Disappeared in the kitchen, went and got the chef. What had happened to somebody who brought a bag of wild garlic in? And they had made this batch of soup and they weren't going to be able to make any more because they didn't know who this fellow was. And he said, look, can you get us some of these ingredients? And we said, if you like. So I turned up sluggishly a couple of days later with a bag of wild garlic. There you go. And he said, crazy, grabbed it out of my hand. I said, what else can you get? I said, well, maybe this, maybe that. So, and then I wouldn't come in for a few weeks and he said, where have you been? We've got to, you know, I mean, I normally do think about ideas to try to make money, but for somehow, it's just a little while later, I said, as the penny was beginning to drop, I said, do you have any like-minded chef friends? He said, yes, I do. So he gave me four phone numbers. One of them was Steve Harris at the Sporesman. You might have heard of. And suddenly I had five customers. A little while later, we're up into our first restaurant in London. It's all gone from there. We have probably about 50 customers in London now. This is called Black Nightshade, right? Everybody goes, ugh, Nightshade, because, well, at least a few, English-speaking, we have a plant called Deadly Nightshade. And everybody's very, very nervous about that. But I discovered this just because I was waiting through books in an ethnobotanical library at Kew Gardens. And I got this whole book on it. And it was called Undiscovered Crops or something like that. It turns out this thing's been grown for greens in Australia, Africa, and the United States. But anyway, yeah, cheers. Like this. I found this outside, if you want to take a look at this. So when it's just given me this, this is a wild pea. And you can eat these flowers. They taste like peas. They're amazing. They're very beautiful. And it's funny because the sweet pea that grows in your garden tastes of nothing. But these taste fantastic. But the thing about it is, it's a plant that has a berry. It's in the same family. If you're nervous about nightshades, can I point out you eat red nightshade all the time, although maybe not here. It's a tomato, right? And potatoes and nightshades too. So it's a very good family for food. But this little berry here tastes something like between a tomato and a melon. It's completely overlooked. And one of the thoughts I often have is, why have we just cow-towred to what has been introduced in the way of plants for us? Why, for example, do we have a tomato that is bred from a tiny little South American red berry? Why didn't we look at this and think we'll turn that into something else? And one of the key things that I've really tapped into in the last few years is just how many flavors there are in the wild. But certainly in Great Britain, and actually there's a lot of the same flavors here in Denmark, which are so rich, which are so versatile. And some of these flavors overlap into things that you would actually expect to be exotic, things that you would expect to get from another country. So anyway, in there you have an Alexander seed. I'm gonna talk through them very briefly. Alexander seeds in a little packet. That's a seed that's a bit like pepper. It's like pepper, but without the heat, but it's got some of the aromatic qualities to it. You have a hogweed seed, a little envelope in there. Yeah, that's in the little plastic domes. Hogweed seeds have this kind of cardamom, orangey flavor. A lot of people are using them on dishes that have oranges. In them. You also have mellolo, oh now, yeah. You have mellolo in there, which has the same flavor as Tonka beans if anybody's used that. It's a kind of vanilla, almondy sort of flavor. And then you have one of my favorites, which is Meadowsweet. Again, that's kind of almondy, but with a very distinct flavor all of its own, which is a great plant that comes out in the summertime. And the thing is we've just been sending these flavors out to restaurants and going, what do you think? What have you done with it?  So these guys have used it for this, these guys have used it for that, and then it comes back again and we just, this kind of loop, feedback loop of information and discoveries. And we just feel like it's one great, big wild food laboratory that's going on. Guys like Noma, the guys in London, the guys all over the UK that are using these products. And this one's Siaster. Now, I don't know how long guys have been using it in Europe. It's like with a lot of these things, we kind of thought we discovered something no one was using and then you find out this guy over here's already discovered it, but that's great. There's nothing new under the sun, but what we're trying to do anyway is just get these back into people's consciousness and their attention. This plant, as far as I'm aware, was not used in the UK up until very, very recently. It's now being sold in a supermarket. Now, I'm slightly ambivalent about that because it's a monoculture how they're producing it, but it's incredible. You're going to the Waitrose supermarket, they've got Samphire, they've got this one. And just to refer to this thing about the wildness of these plants and the land that they come from, someone told me last week that on the Solway Firth up in Scotland, the land is extending dramatically, but it's all salt marsh. So it's not cultivatable land. This is all salt marsh. It's all producing plants like this, like the Samphire, like the Sea Purse land. So there's an incredible productivity to wild land that's there that's completely un-interfered with. And down south, we've got this situation where they're stopping, trying to put sea defenses in, and they're removing the seawalls. So on the other hand now, the land that has been farmed is being accroached upon by a salt marsh. So our productivity of this plant, with really no effort other than removing seawalls, is greatly increasing, which is an amazing thing for a plant that's been overlooked for so long. Just me. I think one of the major points which I just need to say, which is so amazing with these type of forages, is that these are not plants. These are spices. These are flavors. We are here in Denmark. We are Protestants. You are Protestants. We're boring. We eat one plate of food in silence, and spices is exotic. That's from the other part of the world where people are brown and there's lots of sun. And these people are showing us that spices are right below us. There's a whole new world to be discovered, and this is truly one of the major, major wonderful things that these forages are doing. This is the thing that we need to be open. We need to see it as spices. It's not just plants. So the plant is a seed. That seed might be spicy. I've tasted seeds from miles that taste like coriander. Plants that grow on beaches that taste like coriander. Imagine that going there in early spring, it's cold, and you taste coriander on a beach. In Denmark, you're used to it from Mexican cuisine or perhaps in Asia. These people are bringing this wonderful world to us, and we just need to kind of tap into that world that we are a spicy nation.  Yeah, and then time is out. That's it. So this one here, I'd like to show you the root, but I didn't have a picture of it. This is called wood avans, or herb in it. Think about this, it's amazing because the root tastes precisely like cloves. And I've been thinking about this spice subject and the fact that back in England, spices became this big status symbol, so you had to have them because you could afford it and nobody else could. So that meant we went out looking for trade and in foreign lands, we tried to establish these trade routes which became inadvertently the British Empire. So we went out, we basically pillaged people's countries, all kinds of iniquitous behavior, fortunes were lost and made. And I just think that's incredible because one of the first spices people went for was the clove. This flavor was in our hedgerows right under our noses all the time. We didn't need to go anywhere. Shall I hand that round? There's only about 12 berries, so I'll go.


Frontier Fighters. Frontier Fighters. Thrilling chapters in the lives of men and women who dared and won in their fight for the West. The entire Pacific Northwest and the state of Washington in particular are eternally grateful to the vision and courage of Arthur A. Denne and those who helped the state of Washington emerge from a wilderness to earn for herself the title The Amazing Commonwealth of the Northwest. On the 13th of November, 1851, 24 pioneers, 12 adults and 12 children, were among the passenger list of the schooner exact Captain Folger commanding. All but this little group were bound for Queen Charlotte Island to hunt gold. As Arthur A. Denne appears to the mist, he sees the strange, unfriendly looking shore of their future home. Mrs. Denne, bravely fighting back the tears, says to her husband, Arthur. I know. I know what you're going to say, dear. Your homesick for our farm in Illinois. I'm not complaining. But when we left Illinois, you said we'd never have to pioneer again. You said others had broken the trail in this wilderness. Well, dear, it does look pretty bleak, but we can't turn back now. Another hour in Captain Folger will be putting us ashore. My brother David and young me, Terry, landed on Puget Sound last September. There should be at least one cabin up in this new paradise. Paradise? What kind of paradise can anyone make out of nothing but miles and miles of ocean and brush and forest? Coming into Puget Sound! Well, the schooner is entering Puget Sound, dear. Or just wait till the sun comes out. It'll brighten up everything. We'll have to wait a long time for that to happen. Just now I'm not even thinking of you. Louise and Margaret are old enough, I suppose, to bear some sort of hardship. But little Roland is just two months old. Oh, I know, dear, but it's too late to turn back even if we wanted to. Whatever divine providence has in store for us, we must take. When that little, dull, tormented party of 24 pioneers were lowered into the boat from the schooner exact, nothing swept up to them but a forest rising from the grey waste of Puget Sound, over all of which towered snow-capped mountains. The landing was affected and boats were dragged up on the shore. And once on the shore... Oh, Margaret, don't cry. Louise, please behave. Mother knows you're cold and hungry, but Father's doing the best he can. Mrs. Denny, I'll take care of the girls. You have your hands full with little Roland. Thank you, Mrs. Low. If you can find some sort of shelter for the children under the trees, go with Addie Low, children. Go ahead, darling. I'll watch out for them as best I can. Thank you. Come, girls, come with Addie Low. Now we're all hungry and wet, too, but we mustn't get away. Oh, dear God. Dear God, guide and gorder. There, there, there. Steady. Steady, dearest. Arthur, did you see your brother David anywhere? No, I can't find Hyderherobin. You don't suppose that he and Lee Terry have been surprised by Indians and... I pray God that both of them have the same... I'll call to him again. Hello! Hello, David Denny! Hello! We'd better get under these trees. Down in this log. Here, I'll throw this oil skin of mine over your head so it'll shield the babies from the rain. They've unloaded the boats now and they're pulling out. Steady, dear, steady. But this may be the last time we'll see white people till spring. Steady, dear. Here, here's my hand. Hold tight. Goodbye! Good bye, Arthur! Good bye, David! David! Oh, Lord! I don't want to have buried under this gold bit. This is our son, Rawlin. The youngest citizen of this new community. Two months old. Where's Lee Terry? Did you get the cabin up? Lee Terry's off in the woods hunting some gruff, which has been mighty scarce. We got one cabin up, plenty of timber fell for others, brush gathered for fire, springs located, good lot's staked out. Well, dear. Things look a little brighter, don't they? Well, if I could just know there was one cow around here to ensure milk for the baby, I'd be happy, even though I am wet. Well, we're all pretty soggy. I guess we'd better start some good-roaring fires going in. I'll leave the party to where the cabin is. I guess that'll be the center of the town. But surely in this new town there must be at least one cow? No cows, sis. But we've got some mighty fine, meaty clams here. Clams? But you don't get milk from clams? Oh, I'll grant you that. But you do get clam broth from clams. Now you give little Rawlin some of that and he'll get you down his bone fast enough. Author Denny will speak. Thank you, friends. The Lord has carried us through our first winter. That's you and I and our loved ones. But I think it's hard time we got a name for our new town. We've got everything under the sun here for future prosperity. Timber, water power, ocean. And it looks like we've got a harbor, too. A harbor for beaches? Yes, Mr. Bell, Mr. Board and myself took an Indian canoe with a bundle of horseshoes and a clothesline made sounds on the bay to see if it was deep enough for a harbor. And it was. We pioneers have something to crow about now. And we might as well tell the world about it. But first, first a name for our city. All right. Who's thought of a name? Well, who's thought of a name? It's too bad we didn't invite our wives to this meeting or we would have had a dozen names. I reckon we couldn't do wrong to follow in the footsteps of New York. New York has a mighty good sound to me. All right. Charles C. Terry says, New York, what's the little too soon? Time for being some modest. Why not call it New York Alky? New York Alky? Well, what's the meaning of Alky? Short for alkali? I'm downright serious about that name, Alky. It's an Indian word from the Chinoo tribe. It means buying. I'll make it unanimous. And so the city fathers and this wilderness on the shore of Puget Sound declare our town site to be cold. Still a pioneer, Mother, Mrs. Low. Even two years after we have a full-fledged growing town, I never unlock my door until I know who it is. Well, I'm not afraid of Indians anymore. Just the other day, one curious red skin sat cross-legged on the doorstep of my cabin, watching me bake my bread. You mean you didn't even watch him out of the corner of your eye? Hardly out of the corner. I needed the dough facing him. And I suppose put the loaves in the oven still facing the Indians. Oh, my. Just look at the rosy cheeks on that boy of yours. Thanks to Washington milk or clam broth. The girls are thriving, too. More cabins being erected every day. Towns growing. Soon be outgrowing all this pioneer effort. Yes. And it's named, too. I hear that some of the newer citizens don't like New York Alky. They say it hasn't any character. Oh, that's Arthur. Arthur, dear. You look as though you had some wonderful news. I have, dear. Oh, greetings, Mrs. Lowe. Oh, hello, Mr. Denny. Well, I must be going. Oh, no, stay, please. It's great news for everybody. Do you ever remember me speaking of Mr. Henry L. Yesler? Well, yes, I think so. Isn't he a capitalist from the East? Well, I don't know whether he's a capitalist or not, but he's wanting to put up a sawmill, a steam sawmill. The first in the Northwest, mind you. Right here in New York Alky. Wonderful news. Well, I should say so. Well, we'll all have to readjust our boundaries so as to give water frontage to him, but it'll be worth it. That doesn't make this town boom. I don't know what will. Oh, my, my. Before we know it, we won't be pioneers anymore. City folk. Any more news about changing the name of the town? Oh, yes. You know, there's an Indian chief called C. Alp who's been very friendly and a big help to the White Select. It's coming January. There's going to be a vote in the legislature and I reckon they'll want to honor him in some way or another. Looks like our town's going to be the county seat. Oh, and just to think if I'd had my way about it two years ago, John Lowe would have been a gold miner in Queen Charlotte Island. But Mrs. Denny's brave smile helped me through that first winter. Oh, but Arthur and I have a little secret about that smile. It wasn't so brave that morning of November 13th, 1851. Was it, dear? Well, we're all getting on all right. Well, we must be. Or even the legislature is going to worry about us. We're all just wondering on whose land claim the town was really located. But we won't be concerned about that until January 6th, 1853. On this day of January 6th, in the year of our lord, 1853, before the legislature of the Oregon Territory here assembled, a law is passed enacting the following. That the county seat of King County be, and the same is hereby located at Seattle, so named in honor of Chief Seattle, on the land claim of David S. Maynard. With the name Seattle, New York County is no longer officially recognized as the name of said city in King County and Puget House. In the city of Seattle there rises a simple white shaft. On one side of its base we read Birthplace of Seattle. On the other, New York Algae. At this place on the 13th of November, 1851, there landed from the schooner exact the little colony which developed into the city of Seattle. These courageous men and women were indeed frontier fighters, conquerors of a wilderness, guides whose footsteps indeed illuminated the darkness for those who followed in the years to come.


The world today is a religious place, with 84% of people identifying as practitioners of a faith tradition. Religion shapes societies and individuals in fundamental ways, both when they are at peace and at war. In recent years, violent extremism couched in religious frames and a global rise in religious discrimination have dominated the headlines. Addressing these issues is crucial to building peace. Less told, but just as important for those seeking to build peace, are the stories of how religious actors and ideas can have a profound impact in supporting efforts to build peaceful coexistence and justice worldwide. Sri Lanka suffered from over 30 years of violent conflict rooted in ethnic, religious and class difference. Religious communities have come to view each other with mistrust. But in the midst of all these challenges, the center for peace building and reconciliation with USIP support has built a coalition of male and female religious leaders dedicated to peace and reconciliation. Their work has fueled not only personal but also social transformations that inspire clergy and their followers to act even more courageously and committedly to peace. In Iraq, the political transition that began in 2003 surfaced many tensions within and between faith communities. Many of those seeking to build peace understood the need to talk about religious identity, but they felt uncertain about how to do so in ways that wouldn't create a violent backlash. USIP worked in partnership with a group of Iraqi facilitators and civil society peace builders throughout the country to develop their capacity and strengthen their confidence in engaging with the religious sector. These facilitators taught peace courses in religious schools, developed the capacity of religious educators to promote tolerance, and directly mediated between religious communities in conflict in Nineveh province. In Nigeria, Pastor James Wuyeh and Imam Muhammad Ashafa served as soldiers in religiously inspired militia groups in their youth. Challenged by their own religious leadership and community members, they soon began to question their commitment to violence. They reconciled with one another and dedicated themselves to non-violence. James and Ashafa founded the Interfaith Mediation Center through which they build Christian-Muslim collaboration for peace. With USIP support, James and Ashafa mediated a local peace accord in Yelwa Shandem where peace has reigned for over a decade. Given religion's influence on societies and conflict dynamics around the world, it's critical that practitioners and policymakers understand and partner with the religious sector to build peace. For over 25 years, USIP has worked with religious communities to draw from their rich traditions, ideas and values that support peace and that can offer nonviolent paths forward in the midst of conflict. We offer skills to religious actors, both men and women, young and old, from many different faith traditions around the world to strengthen their ability to mediate conflicts, to reduce violence and to promote coexistence. USIP has a vision, a world in which the best of religion helps sustain peace rather than drive prejudice and violence. To get there, understanding the important influence of religion in shaping communities and governments and working within diverse religious communities is crucial. This work, like the work of peacebuilding generally, is not easy, but it's possible because peace is possible.


I think an oak is a wonderful memorial tree because usually when we're thinking about memorial trees we're looking for a species that'll be around for a long time and it's also very symbolic as most trees are because we grow from a small acorn which is a very recognizable symbol of the seed and oaks grow to such a large majestic size and so you know kind of the mighty oak and so I think it's a wonderful symbol and also we have to remember we don't plant trees necessarily for today but we plant them for future generations and this is a species that could be around for future generations and serve that memorial purpose that we hope it will be to remember something that has occurred in our past. We could probably expect you know multiple decades maybe a century there's a lot of space out here this tree's going to have a lot of space to grow both below ground above ground it'll probably end up having a very full beautiful canopy this species is known especially when it has lots of light have kind of almost a lollipop shape to it and so we could expect it to get 60 maybe even 70 feet tall with probably a crown spread of about 50 plus feet.


All right, 215, let's get started. So hi, everyone. My name is Michael Crenshaw. I'm on the Argo CD team at Intuit as a back-end software engineer. I've been there for about a year now. And my team supports our internal Argo CD users, such as the folks who do builds and deployments for us. So what I'm going to talk about today is what I call the bootstrap attack. So Argo CD, as many of you probably already know, has the ability to bootstrap itself, to install itself. So the way this works is you start with kubectl apply, and you apply your initial manifest for Argo CD. Once it's up and running, Argo CD is just Kubernetes resources. So you can create a new application, point it to your manifests, and now you're using GitOps to deploy Argo CD or to bootstrap it. The fact that Argo CD is just Kubernetes resources means that all of its security config is stored in Kubernetes. So this attack is about a user basically taking advantage of Argo CD's power to maliciously change configuration files and escalate their privileges. So to understand this mode of attack, it's useful to understand the layers in the structure of Argo CD. So the thing that most developers are familiar with is the applications layer. So each application is a custom resource definition, which references a source of truth for your manifests, and then a destination, which is a Kubernetes cluster and one or more namespaces that those resources will be deployed to. Each application must be grouped under a project, and a project is just another custom resource definition defined and maintained by Argo Proj. And you can think of a project as a group of rules about what the sources of truth are allowed to be for a set of applications, what the allowed destinations are, and a number of other rules just to restrict and make sure that your developers are only doing with their applications what they're supposed to be allowed to do. And then the very bottom layer of the Argo CD structure is the actual resources that you deploy. And these are the things that you see when you click on an application in the Argo CD UI. So config maps, deployments, et cetera, all those things that were represented as manifests that are now deployed and monitored in your Kubernetes cluster. So it's useful to see what visually a bootstrapped Argo CD cluster looks like in Argo CD if we're going to attack it. So this is a screenshot of the application view of a bootstrapped Argo CD instance and I filtered it down to just a few types of resources. You've got config maps, stateful sets and secrets. And the reason I filtered it to those is those are some of the juiciest targets for an attacker, the things that we can modify and potentially escalate our privileges. I've listed a few of the first things that I would attack but for this talk we're going to attack the Argo CD RBAC config map. And that is the config map that stores the CSV file which describes how users are allowed to use the API, i.e. the CLI and the UI, to make changes in Argo CD. So by attacking this we can potentially escalate our privileges and do more interesting things. The RBAC config map matters because it basically governs a second source of truth for your manifest. So you've got Git, you've got Helm, that's one source of truth. But depending on how you configure your RBAC, it can become the gatekeeper for the second source of truth, the UI, the CLI, the API. And the rules are defined in CSV like this, so we have different types of resources. In this case we're restricting the dev groups access to the applications resource. And I've given this group access to Git or to sync applications that are in the dev project. So that's the dev slash star. Every application which is grouped under dev, you're allowed to access. What that ends up looking like in the UI, and it would look the same if you used the CLI or the API, is when an admin logs into Argo CD, they see all of the applications. And on the left side you see that bootstrapped Argo CD application. But when a developer logs in because they're under that dev role, they only see applications that are grouped under the dev project. The attack, if actually performed, would look like this. On the left side you're an attacker. You've set up an application, or suppose an admin is set up an application for you. And what you're supposed to be deploying is those bottom two resources, the guestbook UI service and the guestbook UI deployment. But the nasty thing there is the config map, which is the top resource, Argo CD RBAC CM. When you deploy an application, you're allowed to specify in your resource what namespace you want to deploy to. So I can set in this Argo CD RBAC CM, I want to deploy this to the Argo CD namespace where all the good stuff lives. So as an attacker, I see the left side. I've synced it. My changes to the config map have been applied. On the right side, as an admin, I'm scared to death because I see that Argo CD is out of sync. And there's a warning indicating that some other application is managing the same resource. And if I want to figure out what exactly happened, I could click the Argo CD RBAC CM resource, and I'd see this. On the left side, what's currently deployed, which gives everyone with a dev role full access to do anything, that's what all the stars mean. And what I should have deployed is on the right side, pretty restricted RBAC. I can hit sync, and then the attacker could go back and hit sync, and we could go back and forth like that. There's no way that I could completely stop them at this point, though, from just managing their own RBAC. And as a matter of fact, at this point, they could kick me out of the system and they'd take over the whole instance. I really started thinking hard about this attack in March when the Argo CD team got an email about a CDE. Some organization had rules on their projects preventing users from deploying namespaces, but one of their users added a namespace manifest to their manifest repository, and they did a refresh in the Argo CD UI and they saw the namespace, which worried them a little bit, and then they clicked the triple dots and realized they were now allowed to delete that namespace. So the bug was basically that Argo CD let this resource into its internal representation of what is being managed by this application. Nine days later, we fixed the bug. We kicked those resources out of that internal resource tree, and so if a user tried to sync this or if a user tried to use the API, UI, or CLI to modify or delete that resource, they'd be prevented from doing that today. But this attack was really interesting to me because I realized it started out as a fairly simple attack. Okay, oh no, someone can delete a namespace. That's one problem. But if a user can also use the API or the UI to modify the live manifest of something that they've just added to their repository, then they could edit the live manifest of Argo CD's own resources in the Argo CD namespace and escalate their privileges. So it took something like a seven point something CVSS vulnerability to 9.9, I believe is what we eventually settled on. So I started wondering, are there ways that people are misconfiguring Argo CD that could let this stuff happen even when a bug doesn't exist? So to avoid those type of misconfigurations, we have a few lines of defense. First, we can use Git-based restrictions. So for example, in your source control management provider, like GitHub, GitLab, you can set some restrictions, and you can also do some RBAC restrictions in Argo CD to complement those. Second type of defenses, you can use Argo CD's own project resource, which we talked about as sort of a list of rules. There are rules that can mitigate and even prevent this attack. And then finally, I'm gonna spend a couple slides talking about the app of apps pattern and the app of projects pattern, which are a little bit more advanced and require a little bit more effort to secure from particularly this type of attack. So let's start with Git-based defenses, which is basically restricting one of the two parts of an application, source of truth and destination. This is about restricting the source of truth. So I'm gonna ask you to imagine a hypothetical Argo CD setup, and we're gonna define three protections against attackers. First, our developers are only allowed to deploy from GitHub repos that require admin approval to push. So as a developer, you can't push straight to any branch on your deployment manifest repo. You have to fork it, you open a PR, and then an Argo CD admin reviews it. Rule number one, pretty easy to do in GitHub. Rule number two is developers are gonna be given their own RBAC role. And for this hypothetical, I'm gonna give them full access to any of the actions related to applications. It's pretty common to want to give developers as much like broad access to their applications. For example, restricted to the dev project as possible, because you want developers to be flexible and be able to respond to issues. So we'll start there. The third part is we're going to configure that dev project that devs are allowed to access to access any source repo and deploy to any destination.  It is, but we're gonna poke holes in this first and then figure out where the holes are so that we can make sure they're always patched. So the first attack that we can initiate against that hypothetical setup is we can change the app's source repo. So remember, we have restrictions to prevent users from just pushing to that source repo. However, I can use the CLI or even the UI to patch this orders API application and just point it to a different repo that I control completely. I can add an Argo CD, for example, to RBAC manifest to that repository, push it, and now I've taken over. It's pretty easy to mitigate. There are two different options I wanna give you. First is you can restrict the project sources. In the app project CRD, there's a source repos field and it accepts a glob pattern. So in this case, I'm assuming your organization name is example and all of your deployment repos end with hyphen deploy. So it into all of our deployment repos end with hyphen deployment. So this would be a good pattern. Keep in mind, if users can create repositories that match this pattern and they have control over the push settings for that repository, they can just bypass this. They just match the pattern and they're in with whatever sources they want. So make sure that, for example, in GitHub, in your organization, users are restricted from creating arbitrary repositories with arbitrary names and control settings. If we have this rule in place and we try that exact attack that we just showed, the user's gonna be stopped. They're gonna see an error from the CLI saying that source is not allowed or the same error from the UI. So we've defended against that attack in one way. Here's another way. You could restrict the RBAC for applications, which remember we had a star for because we want developers to have flexible access. Now we're gonna remove a few things. The main one to focus on is update because that's what we were doing. We were updating the application manifest to use a malicious source. We just wanna stop them from updating it. Instead, our Argo CD admins will create the application for them, pointed at something that we know is safe, and then it just stays there. And I went ahead and got rid of the delete and create permissions. Create because they could create an application with any source repo. Delete because if I'm not giving them update, I probably don't want them just deleting applications anyway.  This time slightly different. It's not an invalid source. Instead, you're just not allowed to update. And they would see the same error in the user interface. So either of those two defenses works. You might wanna use both of them in conjunction. For example, if you're worried you can't get a pattern that is sufficient to match and prevent malicious repos, but either one should be able to work. But there's still an attack available. We've done all this. We're protected against those attacks. This is still vulnerable to a bootstrap attack because the Argo CD CLI has a flag option that I think kinda gets overlooked. It is hyphen hyphen local. And what this does when you do Argo CD app sync hyphen hyphen local, it builds the manifest locally on your computer, shoots those manifests up to Argo CD and that's actually what gets synced to the cluster. This is awesome for developers who just wanna test something out real quick. They make a quick change locally. They do a local sync up to the cluster, look at it in the UI, looks great.  I like this tool for admin type people. I don't love this for just average developers because there's a reason we like GitOps because you can trace what happens and see the entire history. This flag is controlled by the override RBAC actions. So you remember where we had applications, comma, star, comma, et cetera. Where that star is is where the override application or the override action lives and where we can restrict it. So here's your defense. This is one of the four remaining actions that are allowed. We just delete the override action. When someone tries to do a local sync, this is what they'll get. Permission denied, you're not allowed to override. I was chatting with someone yesterday who had never heard of this particular action that's available in RBAC. So I think it gets overlooked and it's definitely worth looking at your RBAC and seeing, one, do you need that? Two, if not, can you eliminate it? So that's Git-based defenses. So restrict pushes to your manifest repositories, make sure users can't create repositories that match your glob patterns, and then restrict RBAC at the very least to prevent override, but also probably to prevent creates updates and deletes on the application if you're not sure that you can secure the sources with just a glob pattern. The problem with Git-based defenses is all of it relies on Argo CD admins time. And I don't know about y'all's organizations, but a lot of orgs only have two or three people who really have in-depth knowledge of Argo CD, if even that. So taking those folks' time just to review PRs to make sure no one's submitting anything nasty, that's gonna be a lot of time. Intuit has 16,000 applications. If the team of eight-ish people who know Argo CD the best had to review all those pull requests, we'd never do anything else. So we need something besides just reviewing PRs. And we're gonna do that with the app project CRD. So first, we'll start with an initial setup, only two rules this time. We don't need to get restrictions because that's gonna take too much time. Instead, we're gonna give people full access, again, over all of the applications in the dev project, and we're gonna give the dev project full permissions to pull from any source, pull from any destination. We'll leave it nice and open. We'll poke some holes in it and see how much we can leave open and still prevent a bootstrap attack. So the attack at this point is the simple one we saw earlier. We have no way of preventing someone from adding the Argo CD RBAC config map or some other sensitive resource to their manifests, pushing it to a repo and hitting sync and taking everything over. The way to stop this attack using an app project manifest is actually really simple. You edit the destinations field to prevent people from deploying to sensitive destinations. In this case, I've said, okay, I know I only want these resources going to the default namespace. If you have a very dynamic set of namespaces that you want to allow people to deploy to, it could get really cumbersome to have to always update this. So we do accept multiple destinations or we accept a glob pattern in that namespace field. So you could do star hyphen dev. Starting with 2.5, thanks to a poor request from Blake Patterson, we now have the ability to add an exclamation point to the beginning of the glob and that just means don't allow anything that matches this glob. I would love to see people, as soon as 2.5 comes out, start adding exclamation points Argo CD to all of their app projects because this absolutely prevents anyone from managing resources in that namespace. There's no way for them to take over your Argo CD instance and start doing bad things. So this is what it looks like with that rule in place when someone tries to attack your cluster. You can see the config map in the Argo CD UI, but that is it. If you hit sync, the sync will fail with the error that namespace isn't allowed.  You get errors for each of those attempts. So nice and easy way to prevent those attacks using app projects. Now I wanna talk about some advanced use cases. I'd like to see how many people have used or are interested in using apps of apps or apps of projects. Okay, a lot of folks. So this isn't sort of the niche thing that a more advanced use case, this is something that people are actually using a lot, which I love. But it is more difficult to secure and you'll see why. For folks who aren't familiar with apps of apps, it's kind of just what it sounds like. You have an application and the source of truth contains manifests for other applications. And when you look at it in the UI, you could have this main app of apps application and I'm deploying a couple of other applications using that root app. The difficult thing about an app of apps is that project field. So if my users are allowed to deploy arbitrary application manifests, they pick their project. And those projects are the rules that keep people from taking over your Argo CD cluster. So we have to protect that field. And we'll talk about a couple different ways to protect it. In Argo CD 2.4, so the current release and prior, the only way to secure that project field is using the review pattern. So you need to do everything that we discussed earlier under Git-based defenses. You need to make sure that Argo CD admins, people who understand the importance of that project field, you need to have them reviewing all the PRs for apps of apps. And you need to make sure that the sources of truth are limited to just the places that are being reviewed by those Argo CD admins. You also need to make sure you disable the update permissions, because let me go back and show you what this would look like. If you don't disable update, users can click one of these applications. They can click the orders API, go to the live manifest and just edit it and change the project to whatever they want. So in app of apps prior to 2.4, you gotta have people reviewing, you have to disable the update permissions. Starting with Argo CD 2.5, there's a new feature called applications in any namespace that it provides a model to allow self-service applications and restrict applications to particular projects that you can define in a way that's safe.  This is a brand new feature and it needs a lot of testing. So when the RC comes out, if you're interested in this pattern, get in touch with me. We'd love you to test the RC and see if you can secure this pattern. Apps of projects, don't do self-service apps of projects.  And just to be clear, app of projects is just what it sounds like. It's an application that deploys projects. There is currently no mechanism to prevent users from, one, creating new projects that allow them to do things they shouldn't be allowed to do. Or two, potentially just editing existing projects to allow them to do things that they previously weren't allowed to do. So make sure your Argo CD admins are reviewing all those PRs and you've used all the git based restrictions. There are discussions of making projects self-service, but those haven't resulted in a really awesome proposal yet. I tried to write one, but it's still a work in progress. So I'd love to see this happen down the road. So to sum it up, I've got sort of just the basics. If you're trying to secure your Argo CD instance, this is what you need to do. A bootstrap attack is when you use Argo CD's power to destroy Argo CD's defenses by taking over sensitive resources. You've got a couple of different ways you can defend. One, using restrictions in git and making sure that someone reviews all the changes and makes sure they're safe. For two, you can use the app project manifest to restrict people to only deploy to places that you know are safe. And finally, there are a few extra mechanisms to defend apps of apps and apps of projects. So that's the bootstrap attack. I hope people have found something useful and something that they can take back to your setups and analyze and see if you're secure. So thank you for listening. Are there questions? How can I attack mine, Ed? Yeah, let's see if we can find a mic. Shouldn't we exclude the Argo CD namespace by default as a valid target? So we ship Argo CD with a default project, which is wide open. And we do that because we want folks to be able to test quickly on their local machines and see if Argo CD is good for them. I mentioned in the workshop yesterday someone wrote an article, Denilson Nastasio, about how you should restrict that default project down. The first thing you should do is try to limit it down to only what you need or even just completely restrict it and then use new projects. To restrict out the Argo CD namespace by default is something I would want to look at for 3.0. I think that that's probably a good starting point. It would make onboarding more difficult for people, but. We could include a demo namespace, right, that is. We could include a demo namespace. Yep, we could point the default project to that and know that people can bootstrap, attack your Argo CD instance by default. Okay, well thank you and a great job of making a complicated topic understandable. Thank you, I hope it was clear. Other questions. And just to expand on that, I think there are a number of things that in like a major release 3.0, we'd want to change defaults. Maybe in ways that slow folks down a little bit, but would help people take care of their setups a little bit more easily. Yes, let's see if we can get a mic over to you. Pardon me if it's kind of a weird question. If you're good. Are you guys in connection with the rest of the industry, other vendors providing technology also for securing governance? How is this research happening as an ecosystem? Sorry, can you repeat just the last bit? Yeah, what's the relationship of the ecosystem of different vendors creating their own, because I was exposed before with Starboard from Aqua and I always thought that they were kind of doing this in a canonical way, but now that I'm seeing the bigger picture in the Vops, I see different vendors creating their own thing. So for me as a newbie it's kind of difficult to understand where is the one place you can look for research and feel like this is it or it's always like this fragmented thing. That's a good question. I mean, Argo CD is unique in a lot of ways. Like we do have our own RBAC system. We came up with our own names for like the resources and the actions. As far as I know, the app project concept is kind of a unique thing in the particular set of rules that we include in an app project. So it's kind of difficult to generalize those structures. I think the closest thing would be, I know there are probably really excellent guides on how to secure Kubernetes because it has its own model of here's what resources are, here's what namespaces are, and here's our RBAC model and how to keep yourself safe. I think that someone thinking about Argo CD and its relationship to basically how Kubernetes asks people to secure things is probably a good way to think about it. As far as just in general, good ways to understand security with CI CD tech, a lot of it's very, very new stuff and very, very quickly evolving stuff. I highly recommend thinking about how you would attack your cluster. Even if you're just a dev and you just use Argo CD to bump the tag on one of your applications, think about what you would do that's malicious and talk to your admins about whether there's anything that they need to tighten up and then write a blog post and send me a link because I'd love to know about it and know how to make Argo CD move towards those more secure practices by default once we kind of understand the use cases. Hopefully that was helpful. Kind of touched a few things. Other questions? Yes, Oprah rules. Okay, so the question is have we explored integrating Oprah rules for RBAC? The last part I'm not sure I understand though. Oh for Argo users, kind of. So Alex from Acuity has an issue up and I think it's in the 2.6 milestone but it's basically a field and app project that is a JQ query and any resource that you attempt to apply that's under this project that JQ query is gonna run and if it returns a truthy result, it's allowed, if it returns a false result, it's not allowed. This was particularly gonna be useful for restricting which custom resource definitions people could deploy because in that case the name is super important. As far as integrating OPA rules by default, I think it's fine right now to kind of layer OPA on top of Argo CD stuff and I know that they're like, I think Kevarno has some Argo CD or even Argo workflow specific rules that you can apply and try to keep things safer. I would like to see how the space evolves and what OPA rules people define for themselves and find useful and then try to integrate that as a first class feature in Argo CD. That's kind of where I'd like to go. Okay, I've got 30 seconds according to this clock. Anything else? Yeah, Raymond. Was there any attack that you saw with slash temp and the repo cache? Sorry, what with the repo? The repo server like slash temp is where all the repository information gets stored and then I know you were trying to protect that mount point. Are we talking about the directory traversal problems in repo server? Yeah, so was there any sort of attack that people were doing with? So I don't know of any attacks in the wild. We have been plagued with issues with Simlinks and directory traversal in the repo server. Jake from Cobalt put up a PR. We now disable starting with 2.5. We're gonna default to no Simlinks that point anywhere outside of your repo. So I think that'll help a lot. I'm not sure if that's the issue you're talking about but that's a huge improvement in 2.5 that I'm excited about. Cool, thank you all so much.