He found himself out of a job a few months ago, simply for daring to ask the pertinent questions regarding the conflict in Gaza. A stalwart in the alternative information sphere, he possesses an intricate understanding of Middle Eastern and African politics. His prominence rose to international acclaim when he dismantled an anti-Islamic scholar at Oxford, his alma mater during a profoundly impactful debate that reverberated worldwide. His tenure with Al Jazeera and subsequent representation of the Palestinian cause, including appearances on platforms like ours at the Open-Minded Thinker Show, further solidified his reputation. However, the recent release of a video by this esteemed scholar has caused a seismic stir on the internet, prompting major media outlets to scramble to suppress it from mainstream circulation. This video serves as one of the most compelling rebuttals to the falsehoods perpetuated and justified by Israeli authorities in Gaza, ostensibly to support their escalating efforts to render the enclave uninhabitable. What captivated us in this presentation was the exposure of the fallacy that Gaza was peaceful before the Palestinian resistance mounted its defensive actions. Indeed, the evidence presented by Hassan in this meticulously crafted video left us astonished, leading us to regret not giving it the widespread recognition it deserves earlier. As such, this video serves as a belated acknowledgement of our oversight. Our aim is to clandestinely disseminate the video, ensuring it reaches every corner and crevice of those who harbor doubts about the justifiability of Palestinian resistance against occupation. This video is nothing short of monumental, brimming with irrefutable evidence to dismantle the fabrications and manipulations employed by Zionists to garner global sympathy while perpetrating what can only be described as genocidal military actions. Our commitment to delivering impartial news and geopolitical insights remains unwavering. We implore you to engage with our content by liking and sharing this video, thereby staying abreast of developments in Palestine. Subscribe for timely updates on related events. The Israeli officials have told so many lies since October the 7th with so little pushback from the media that it's hard to keep up. So here from Zeteo is the first in a new segment we're calling debunked. The top seven lies about Gaza debunked. There was already a ceasefire on October the 6th and Hamas broke it. You see it said everywhere by Benjamin Netanyahu, by Hillary Clinton, they all say it and yet it's completely false. Just two weeks before October the 7th, Israeli airstrikes hit Gaza for the third day in a row. And on October the 4th, Gaza Strip protesters received bullet wounds to Ankle's Medics Report. Does that sound like a ceasefire to you? Even over in the occupied West Bank before Hamas' attack on October the 7th, Israeli forces had already killed a record 234 Palestinians. If there was a ceasefire in place before October the 7th, nobody told the Israeli military. Line number two, the priority is freeing the hostages. There's no higher priority Joe Biden has said. And yet last month Israel's finance minister said bringing home the hostages is not the top priority. Hamas must be defeated. We resonate deeply with the sentiments expressed in this submission when the events of October 7th unfolded. We at the Open Minded Thinker Show discerned that it was a bitter reaction to the ongoing killings within. The blockaded Gaza Strip, as avid followers of Middle East news, particularly concerning the Holy Land, we were taken aback by claims suggesting peace prevailed in the Strip before Palestinian soldiers retaliated. However, upon closer examination, it became evident that there was no ceasefire in place. The conflict persisted, albeit with reduced intensity following the Palestinian counteroffensive. Israel, aware of the sympathetic portrayal it often receives in the global media, particularly in the Western world, sought to manipulate the narrative. They employed spin tactics, even distorting events on the ground. While we unequivocally condemn all acts of violence hindering peace in Palestine, we also denounced the IDF's deliberate targeting of its own people to escalate tensions in the aftermath of Palestinian military actions within occupied Palestine. Authentic reports, including those acknowledged by Israel itself, confirm such occurrences. Yet mainstream media largely refrains from criticizing the occupation for its deceitful justifications, further perpetuating the disregard for human rights in Gaza. Unpoignant observation is that the media's inherent bias and reluctance to address the plight of Gaza's inhabitants have emboldened the occupation, fostering a determination to perpetrate atrocities while thwarting any attempts at achieving a ceasefire and lasting peace in the conflict. The media's failure to challenge the narratives propagated by figures like Benjamin Netanyahu grants him the audacity to persist on the path of war, instead of pursuing peaceful resolutions to end the decade-long plight endured by the region. Whittingly or unwittingly, the Israeli military has actually killed more Israeli hostages than its soldiers have rescued. In fact, as one Israeli journalist recently tweeted, citing new reporting from an Israeli news website, 10 hostages were killed by Israeli airstrikes in Gaza, some even as the Israeli military had intel they were residing in the buildings that were targeted. The IDF reportedly killed their own citizens and then lied and said they died in quote, Hamas captivity. But sure, it's all about the hostages. Line number three, 40 beheaded babies. How can we forget the most emotive and most offensive lie of this entire conflict? A lie that went viral and was repeated by the President of the United States, who falsely said he saw pictures of beheaded babies even though there weren't any. Nor were their babies burned in ovens, as Israeli newspaper Haaretz proved in their investigation. They were all lies. In fact, according to data released by Israel's Social Security Agency, tragically there was one baby killed on October the 7th, 10-month-old Mila Cohen may her memory be a blessing. But in the interests of facts, she was not beheaded. Now one baby killed is one baby too many, a tragedy, a crime. But 40 beheaded babies is just a cynical, reckless, repulsive lie that was then used to justify the killing of hundreds of Palestinian babies. Line number four, there was a Hamas base underneath the al-Shifa hospital. Remember this video from the Israeli military claiming Hamas's main headquarters were under the hospital? Wow, an underground lair straight out of a Bond movie. To this day, we have yet to see any evidence of such a headquarters under al-Shifa. Sure, as the AP has reported, the Israelis found a pair of metal cots in a room fashioned from rusty white tile. They appeared to be out of use. Meanwhile, the Washington Post said the underground rooms found by Israel showed no immediate evidence of military use by Hamas, and Israel has provided no hard evidence that Hamas was using the hospital as a command and control center. The Israeli military lied so that they could attack more hospitals under the same false pretext. Line number five, you can't trust the Hamas health ministry. Remember what Israeli spokesman Mark Regev said to me on Peacock back in November? The Gaza health ministry says Israel has killed more than 11,000 people in Gaza, including the Hamas controlled. Let me finish my question. No, but you can't say that. No, but you said you have to say the Hamas controlled. You can say that. I don't have to say what you asked me to say. Why mention Hamas controlled every time? Because you can't trust the health ministry's numbers, right? Except the Israeli military does. The Israeli ministry has secretly found the Gaza health ministry's casualty figures to be reliable and even uses those numbers for its own intelligence briefings. Oh, and the world's most famous medical journal The Lancet found no evidence of inflated mortality reporting from the Gaza ministry of health. Line number six, there is no hunger in Gaza. That is an exact quote from an Israeli defense official. And it's a lie, obviously. Asked the parents of poor Mahmoud Fatou, the two-month-old baby who starved to death recently in Gaza. According to the World Food Programme, four out of five of the hungriest people in the world right now are in Gaza. And line number seven, the Gazans getting killed today elected Hamas. They voted for them.  It's just not true that Gazans elected Hamas. It's a lie. Half of the population of Gaza are kids under the age of 18. Most of them weren't even born when the last elections in Gaza took place nearly two decades ago. And even in those 2006 legislative elections, Hamas didn't win a majority of the votes cast in Gaza. The issue of Israel's detainee rescue has become increasingly complex since the onset of the crisis. We echo Hassan's assessment that the Israeli operation appears to be operating outside the scope of hostage rescue intentions within the war context. Furthermore, the rapid declaration of war by Netanyahu left us astonished, suggesting a preconceived battle plan even before the Palestinian offensive. It seems evident that while the occupying government maintained stringent control over the strips economic, social and political aspects, it had already formulated plans to wage war on the Palestinian stronghold. Reports have surfaced indicating instances where Israel covertly funded the Palestinian resistance, aiming to sow discord and prevent unity with other parts of Palestine, thereby perpetuating a division that hampers the realization of a Palestinian state. Such allegations gain credence, particularly considering Netanyahu's reluctance to entertain peace initiatives that might jeopardize Israel's complete access to purported natural gas resources in Gaza. Speculation suggests that the crisis is intricately tied to the control of these natural gas reservoirs abundant in Palestinian shores and for the occupation to assert full dominance over the area, a war allegedly had to be initiated. While these assertions remain speculative, it is prudent to acknowledge the complexity of the crisis. Without a comprehensive resolution, the risk of a recurrence of events akin to October 7th remains distressingly high. Hostages taking a clear war crime by Hamas and those hostages of course need to be released. Are we any closer to the release of any more hostages? We surely hope so. You know, Hamas, as you reported, has kidnapped some 240 people. Unfortunately, today we found the body near the Sheba hospital of one of the hostages, a woman from Kibbutz Berry. Her name is Yehudid Bais.  She was dead. And the information we have is when she was taken into captivity, when she was abducted by Hamas, she was alive. We've now found her body. It was one of the results of the military operation today. Of course, getting the hostages out remains one of the focal points of our military operation. And we believe that by expediting the military pressure on Hamas, we're actually getting closer to the release of hostages. So was it a mistake in hindsight, and that's tragic news to hear about this poor woman. Was it a mistake for Prime Minister Netanyahu, your boss, to have reportedly turned down a deal at the start of this conflict that would have seen Hamas free women, the elderly kids, in exchange for a five day ceasefire? Isn't that why so many of the families of the hostages are angry with your government? Sorry, maybe that's just disinformation. There was not a real option for a deal before the ground operation. It was looked at seriously, but Hamas put nothing on the table that could be worked with. And so that's just not correct to say there was an option. We might have an option now for a deal, I can't tell you for sure. We might have an option because the military pressure on Hamas is maybe making Hamas understand that if they want a temporary ceasefire, they need to release hostages. Without that, we're not going to have a temporary ceasefire with Hamas hard. And maybe the military pressure will force them to consider how they look at the hostages. Look, we can't expect them to release hostages because they're suddenly going to become humanitarians, right, Netanyahu? They're obviously not. They are brutal, brutal vicious terrorists. And they're only releasing hostages when they're forced to do so. So let's talk about that. Let's talk about the military pressure. We are nearly six weeks into this bombing campaign and ground invasion. The Gaza Health Ministry says Israel has killed more than 11,000 people in Gaza, including the record number of children. The Hamas controlled. Let me finish my question. No, but you can't say that. No, but you said you have to say the Hamas controlled. You can say that. I don't have to say what you asked me to say. More than 4,000 kids, they say. That's true. You don't deny that. Maybe you don't deny that it's the Hamas controlled, and the Health Ministry is controlled by Hamas, which you can. But please tell the viewers the truth. That information is provided by Hamas. Okay, and that information, we'll come back to that information, but you've got dead gardens. The American government say maybe more than 11,000. You've got a record number of journalists killed according to the CPJ. A record number of UN workers killed according to the UN. And yet Hamas still exists. It's still capable of firing rockets into Israel. Still has the hostages. You haven't found their big base under the Schiffer hospital either. Your critics say that shows this war is a failure. I would argue that's all incorrect, Netanyahu. We're hitting Hamas hard and they're feeling the pain. We just discussed that a moment ago. Why? They may be now considering a seriously a hostage release. It's not because, as I said, they've become humanitarian. It's because they're under a very, very massive military pressure. But this operation is not one that we wanted, obviously. This war was forced upon Israel in the terrible attack of October 7th, and we are fighting back, and we will destroy Hamas. We'll dismantle their military machine, and we'll take apart their political control of Gaza. That's good for Israel for obvious reasons.  But it's ultimately also good, and I hope you agree with me. It'll be good for the people of Gaza who deserve better than this terrible authoritarian, extreme Hamas regime. The people of Gaza are still alive. As I say, more than 11,000 people dead, reported dead. 4,000 children. I just want to pull up on the screen. You say Hamas's numbers. You say Hamas's numbers. I should point out. Just pull up on the screen. In the last two major Gaza conflicts, 2009 and 2014, the Israeli military's death tolls matched Hamas's health ministry death tolls. And the UN human rights groups all agree that those numbers are credible. But look, your wider point is true. Can I challenge that? Will you allow me to challenge that, please? Can I just challenge that? I'll try to be as brief as you are. Those numbers are provided by Hamas. There's no independent verification. And secondly, more importantly, you have no idea how many of them are terrorists, combatants, and Hamia civilians. Hamas would have you believe that they're all civilians, that they're all children. And here we have to say something that isn't said enough. Hamas, until now, we're destroying their military machine. And with that, we're eroding their control. But up until now, they've been in control of the Gaza Strip. And as a result, they control all the images coming out of Gaza. Have you seen one picture of a single dead Hamas terrorist in the fighting in Gaza? Not one. Is that by accident or is that because Hamas can control, Hamas can control the information? Mark, if you asked me a question and you said you would be brief, I haven't, you're right. But I have seen lots of children with my own lying eyes being pulled from the rubble. Because there the pictures Hamas wants you to see. Exactly my point, Wendy. And also because they're dead. They're the pictures Hamas wants. But there are also people your government has killed. You accept that, right? You've killed children? Or do you deny that? No, I do not. I do not. I do not. First of all, you don't know how those people died, those children. Oh, wow. First of all, we don't want to see a single child killed. Okay, here's a question for you Mark. I agree with you. I agree with you. We shouldn't blindly believe anything Hamas says. But why should we believe what your government says either? Your military spokesman on Monday pointed to an Arabic document in the basement of a Gaza hospital and claimed it was a guardian list on which every terrorist writes his name. But that was false. It was just a calendar with the days of the week on it. Your colleague in the prime minister's office, Ofir Gendelman, posted behind the scenes footage from a Lebanese short film and claimed it was Palestinians in Gaza faking their own injuries. That tweet is still up a week later. That is endless disinformation from your government. Is it not? I disagree. And I think on the important issues. Look, I'll give you an example, Medi. No, no, no, no. We estimate it. So I'll answer your question. Allow me to answer your question. Okay. I'm answering your question directly if you'll allow me. We originally said in the atrocious Hamas attack on our people on October 7th, we had the number at 1,400 casualties. And now we've revised that down to 1,200 because we understood that we overestimated. We made a mistake. They're actually bodies that were so badly burned. We thought they were ours. In the end, apparently they were Hamas terrorists. Understood. When we make a mistake, we admit it. We respect your short on time. Why does that give you permission? Why does that give you permission to accept Hamas's numbers? I don't understand. I didn't ask about Hamas's numbers. I said to you that your military spots are important. No, but you were quoting to me about Hamas's numbers. That video may have been recorded several months ago, but its impact on the overall mood surrounding the crisis remains both fresh and profound. While Hassan Muddy's interview led to his cancellation at MSNBC, its relevance persists amidst the dangerous propaganda that has characterized the crisis since October 7th. It's evident that the media machinery of the occupation fears genuine, honest journalism. They're accustomed to the type of whitewashed reporting that perpetuates the illusion of safety for the occupation, even as it blatantly violates international law. None of the major media outlets bother to inquire about the situation in Gaza prior to October 7th, so fixated are they on portraying the occupation as a democracy while demonizing those who resist the usurpation of their ancestral lands. Hassan Muddy struck precisely where it matters, showcasing his astute analysis of the occupation's propaganda machinery. This is one of the thawdiest questions of our time when it comes to the left, Biden, Trump and Gaza. All right, this is a careful one to navigate, because this is not some abstract issue, is it, Michael? There are people who are really hurting. There are people here in America, Arab Americans, Palestinian Americans who say we cannot vote for Joe Biden. We've lost not 10, not 20, not 30, 40, 50, 60 members of our family in Gaza. And of course, how could anyone say to that person, you should vote like this? That's just a given. What Biden has done is unprecedented in the sense of what Israel has done is unprecedented and America has backed it. So in that sense, what he's done is unprecedented. Again, unfortunately, we live in a two-party system. And we have to understand that if it's not Biden, then it's Trump. It's not if it's not Biden, it's Cornell West or Marianne Williamson. If it's not Biden, it's Donald Trump. And I would like, you know, I've met people who claim, and I believe wrongly claim that if Donald Trump was president, things wouldn't be as bad right now. That's nonsense. You don't have to normalize or minimize Donald Trump's awfulness in order to criticize Joe Biden. I can say very happily that Joe Biden is complicit in an awful genocide. And in a perfect world, he would be politically punished because we have many more choices. But the reality is Donald Trump, as President of the United States, was horrifically pro-Israel. In fact, you could argue as Rashid Khalid as Biden is the most pro-Israeli president of our lifetimes. But guess who the most pro-Israeli president before Joe Biden was? Donald Trump, right? Donald Trump moved the embassy to Jerusalem. Donald Trump, Donald Trump has a settlement. Many people don't know this. In the Golan Heights in occupied Syria, named after him, right? Donald Trump is the only American president who has an illegal settlement named after him. That's how much the far right in Israel love him. In fact, you'd have to take my word for it. Itamar Ben Gavir, perhaps the worst member of Netanyahu's government, who this week was celebrating the flower massacre in northern Gaza, he has said on the record that if Donald Trump was in office, we would have much more freedom to do what we want to do. Those are not my words. Those are Ben Gavir's words. So when I say Donald Trump would be worse for the Palestinians than even Joe Biden, I'm not just saying that as a kind of opinion. I'm saying that's what the Israelis believe. And this is what I say to people. Nobody's telling you to vote for Joe Biden. I wouldn't tell people how to vote. What I would say is bear in mind the fact that Netanyahu and Ben Gavir are waiting for Trump president. There's no debate. His insights dealt a significant blow to the fabric of lies peddled by the occupation to justify its brutal military campaigns in Gaza. Presently, the narrative is shifting with voices like Hassan's gaining traction as the world awakens to the atrocities committed in Gaza. It's increasingly acknowledged that an occupying force cannot claim self-defense against the occupied. In truth, it is the resistance that holds the legitimate right to defend itself against the oppression and machinations of the occupation. Thank you for your attention. We urge you to share and like this news update with your loved ones. Don't forget to subscribe for the latest developments from Palestine. Until our next update.


We're gonna play with some new just arrived makeup and skincare from Sephora today Some of the products I have used and then some I'm trying for the first time today So there's been some new releases that I've picked up from Sephora. Why does this have a gunk on it? This has eyelash glue on it anyways. It's been a while I feel like since I've tested a bunch of new makeup from Sephora. That's a lie I just posted this up for a haul. Anyways, whatever. I just have some new makeup And I want to try it. But first skincare I actually wanted to talk about some skincare items that I used today for the first time that I wanted to try so I Tried the new Fenty skin items. So there's a cocoa bar and then the fat water So there's a stand for it and then you have the cocoa bar soap So this can be used for body and face and I think this is the perfect shower item for me because I usually work out in The mornings and I don't wash my face in the mornings except when I work out So this is perfect to keep in the shower for me to wash my face with as well as the body and I liked it I mean, I don't really use cleansing bars. I prefer gels. I'm excited about this the whole concept of it I think it's just gonna be a great shower skincare item, but what really excited me I was really excited to test was the Fenty skin fat water. So this is a hydrating milky toner essence I love kind of a milky toner So it says it hydrates softens and refines the look of pores with vitamin rich and formulated to help maintain Skin's moisture barrier and I tried it for the first time today. I like that. It's a toner You don't need to apply with a cotton pad or anything.  I still felt like I needed to go in with a moisturizer afterwards But I'm excited to continue using this I feel like it's a product that's really going to benefit my skin and my pores Obviously only use it today my explanation for one use can only take you so far when it comes to skincare But I'm really excited about this and the scent of it is so nice. It's not artificial smelling It has a faint scent of like chrysanthemum flower No, I drink chrysanthemum tea growing up. So I'm excited about the new spenty skincare So I wanted to share that let's get into the makeup now that my skin is all prepped So I have this new foundation from Beauty Blender. This is the liquid whip long wear foundation I picked out the shade Medium nude neutral it looks dark on the sticker. So hopefully it ends up working out for me I'm honestly not very experienced with Beauty Blender makeup products I've tried a powder from them in the past, but that's it maybe like a blush or something but not very much So this is what the foundation looks like it looks a little yellowish, but not bad I feel like this is gonna be actually a very very good match for me So I'm gonna start off by taking up my finger and spreading the product that has a thicker Consistency, it's not one that's going to run down your arm. I don't know too much about this product I just know that it's new. Okay, and let's use a sponge To push it in. This is just a Beauty Blender doesn't have too Glowy of a finish which I'm not bothered by because it is summer and makeup be running off my face Huh, that actually looks very pretty. I've never tried a Beauty Blender foundation before But I feel like I didn't apply too much and it looks really good. Let me get this Half of my forehead. I just love Sephora so much. It's my favorite store in the world I love always going through the aisle seeing what's new and skin care, hair care, makeup, fragrance All of it I love. So here is one pretty thin layer. I think it looks pretty good It has a nice skin like finish honestly It's not smoothing over the pores or anything I would say but it's not emphasizing them either Let's go ahead and spread this on the other side of my face I really like how it's applying with the Beauty Blender as well Which is great. I imagine they formulate their products to work well with the OG of their brand I normally keep coverage pretty light on my forehead because I don't have much to cover and also that's where I sweat the most Definitely on the cheeks is where I need the most coverage Let's get a little bit more down the nose and I think we're gonna keep the layer here I think it looks really nice. I definitely say if you have dry skin You want to hydrate your skin properly because it's not a super moisturizing feeling product But I think it has a nice finish and I feel like when I start to have my natural oils come through as I like live You know throughout the day and exist It will moisturize the skin more because I can tell you guys know I have a little bit of dryness in my skin It's not looking Super hot on the dry areas of my face, but it's not looking bad But I feel like it's something that can easily be resolved just through natural wear throughout the day I find typically with the best wearing foundations They tend to not look as good as they do until you start really wearing it So we're giving it the benefit of the doubt because I think i'm so sick of the glowy skincare infused products This is a nice change now. I can tell you it's not my favorite foundation ever in the world already Like my new hourglass foundation nothing has beat that yet So the hourglass is still better, but this I like it and it's a really great color for me Phenomenal so just continuing on with how I typically do my makeup. We're going to go to brows So I have this from Patrick. I've already used this a number of times I've demoed it already in a Sephora haul But this is the major dimensions of brow pencil and not really much interest You know, I don't hear a lot of people talking about this But everything Patrick Todd launches honestly is just incredible and this is nothing short of that So I thought I'd talk about it anyways because it is new and it is awesome It has the finest little tip and it's really great for creating those hairline strokes So I'm going to brush my hairs up and then I like to create a line along the bottom of the brow Oh you guys, you know what I'm noticing back to the foundation. There's a little bit of pilling happening I think it's pilling with the moisturizer that I used because all I have down is moisturizer. That's not a good sign I don't know. I'm gonna have to continue obviously testing out the foundation But it actually is pilling with my base, but that could be user error I'll just test it with some other things and I would definitely update you in a updates video But anyways, I brush the brows down and I'm filling in the sparse areas and creating an arch So the arch area is the sparse part of my brow So I normally have to just make it and fake it, you know Then we brush back up because you can see how instantly that just filled in the area And then I'm going to continue with my hair strokes So we point up towards the beginning of the brow and then as we get towards the tail brush outwards This brow pencil is honestly perfect. It's not too creamy at all It actually is a little bit more on the dry side, which allows for those more precise hairline strokes Anything Patrick touches turns Too gold So definitely highly recommend this gonna put on some brow gel real quick and I'll be back So this item is one of the reasons that I just did this whole video all together because I'm really excited to try this This is the Too Faced Born This Way ethereal light Illuminating smoothing a concealer So the Too Faced Born This Way complexion line has some of my favorite products the Born This Way full coverage concealer The best one my all-time favorite concealers. So I wanted to try the glowy more natural version So let's see. I picked up the shade pecan. I'm excited. Let's focus it in the inner corner And I like to bring it down. I like to do it this way because I don't really need much coverage out here Anyways, I mostly need it in this area and then I like to blend it down onto my cheek for extra coverage I like the shade. This is really good. I don't normally like too brightening of a concealer Okay, what do we think? It definitely has a glowy finish to it You can see the difference between the foundation finish Which is a little bit more matte compared to the glowiness of the concealer So I don't know how well these two actually pair together But whatever it looks lightweight. It's giving more so of a medium coverage. I would say if even that It's definitely on the lighter side though. I don't think it claims to give full coverage. Okay, let's get the other side It's not super liquidy. It's not super smoothing either I can tell you I already prefer the full coverage version, but it does look quite natural So if it wears well, it might be good for natural every day. Let's see. What do they claim it does? It's they say it's waterproof. I don't I don't know about that. This is a serum like concealer I definitely agree with that. Yeah, I would say gives a light to medium coverage. It looks natural. It has the glow It looks good. It doesn't smooth out the under eyes, but it looks very healthy on the under eyes So I'm gonna have to see with wear time think I like it. Oh, I meant to do my eyeshadow first Too late now Okay, I think I like it. We're gonna let it sit under the eyes without setting so I can see How soon it takes to go into the fine lines, but it's actually doing pretty good. We'll see too be decided I have another beauty blender product. This is cool. This is the bounce bronzer and highlighter So it's a creamy bronzer and highlight duo. I think this is a cream product. Let's see I don't know how new this is, but it's definitely a newer to me product From beauty blender. So I thought I'd try it. So how it works at the top There's like a cap and you have a let me see a cream highlight Which I think might be a I don't know. This might be a little deep It has like a goldenness to it and then you twist the cap and you have cream bronzer So this is the shade highlighter champagne bronzer topa so champagne and topas. Let's try out this bronzer Let's see how it feels. Oh very very emollient. Oh extremely emollient interesting This has definitely has some warmth to it. Hey, and you can see the texture just by kind of how the fingerprint looks there It has more of like a wet liquidy consistency as opposed to a souffle consistency So I'm going to go extra light with my brush because it actually might benefit more from a sponge given the consistency But okay, this is blending out pretty nice. I'm going to use a sponge on the other side. I think Oh, I like this. This looks good and I think it's going to bring back some hydration to the skin from the Foundation. It's a pretty color as well. It's actually a really great color for my skin tone. I like it Let me use a sponge though. I think sponge is definitely better. It does pick up a lot of color though So be careful about that. Oh, I like this bronzer. I think it's nice Yeah, so it is definitely a creamier consistency But I think it blended into the skin really nice I'm a fan of that and that definitely added some hydration back to my face I'm going to start with the cream highlight I typically don't like cream highlights and I'm only going to do it on one side of my cheek to start Because I have a shimmery blush to try next and I want to see how the blush looks on its own I use a beauty blender and I get it in there That didn't do much honestly. I don't know if it's because it's too dark on me But I gave it a little something very very natural and subtle. I think it's because it is kind of a deeper shade I'm going to go ahead and just use my finger. This kind of has a bounce Consistency to it. Let's take a look before I put it on my cheeks. You can see it's that bouncy putty formula So finger is much better. Do not use a sponge like I did Finger will get the most product on there. Oh, that's nice I'd rather honestly go for a powder highlight, but that's my answer 99.9 of the time I still think it is pretty. I'm definitely purchasing this more so for the bronzer than the highlight But the highlight works and it's actually very pretty and natural. I don't know if you can see the difference But I like that product. I don't have anything bad to say about it. Awesome. The next item I have I specifically went to Sephora for I've been eyeing this for a couple of weeks now This is the new Laura Mercier blush infusion formula. It's a shimmer formula They only had a couple of shades, but I had to try it out. Their blushes are one of my all-time favorite formulas So when I saw they had this shimmer version, I really wanted to try it out. This is what the color looks like It's definitely very natural. Let's see Just love this formula so pretty now this color itself I can see is more on the natural side So if you have a medium skin tone, I don't think this is going to work well But this is pairing beautifully over top of the beauty blender highlight It looks gorgeous now Let me see it on its own to see if the gold sheen is coming from the highlight or the blush Oh, definitely the blush. So the gold kind of flipped to it is quite strong Honestly, I don't necessarily love that a lot in my cheek products But I don't mind it in this because of that golden shift It is somewhat emphasizing textures and pores, but that's the name of the game That's what a highlight does. I think this is beautiful. It applied beautifully This is not automatically my favorite Laura Mercier blush though, but I'm happy I got it And it has a much stronger golden shift than I was expecting But I honestly try more shades of this I think this is very pretty for when I want a shimmery blush And it gave a really pretty somewhat Tanned and bronzed look to the face I'm going to go ahead and add in just a little bit of the beauty blender highlight With my finger just right on top. These two bleed beautifully together Compliment each other really nicely Stunning. I really love how my cheeks look actually. I love the peach base color itself But it does give a pretty bronzy glow when I turn and then you can see that golden to it Okay, so let's check back in on the concealer. I'm actually really impressed I think because it is like that thinner Serum light consistency and honestly has not sunk into fine lines at all. It looks really really good Oh, that's a very good sign I'm gonna just super lightly powder it though because that's how I typically would do it I don't have any brand new powders to share with you So I thought since I have a new foundation and everything I'd go with some tried and true products to see how they really wear So I'm just going to go ahead and use my Pat McGrath sublime setting powder in light My favorite because at the under eyes I'm just going to do a light layer in the center of my face where I need it the most And this powder is like so weightless on the skin It doesn't add really too much of a layer But it does leave behind a nice blurred finish to the skin one of my all-time favorite setting powders Look at that. That looks really good. We're going to see how that wears So the concealer definitely because it's so thin It doesn't really smooth or change the appearance of the under eyes But it doesn't emphasize anything bad and it went really well in its own So I feel like this could be a concealer you could get away without setting But that brings me to the next item this one. I've been dying to try. I can't believe I haven't tried to get it launched a few weeks ago, but yeah I'm finally trying out the two face better than chocolate eyeshadow palette I mean there's newer eyeshadow palettes that I have But I've been dying to try this out. So I'm going to go ahead and do one eye and I'll be back Honestly, based on the swatches of this though, I'm not that excited about it swatched really inconsistent. So we'll see I'm in the very early stages of testing out this palette. So I did a look that's very true to what I would do on the daily I haven't tested the shades that swatch bad So I can only speak on my experience with the shades that I did use and all the shades that I use Were great, but I can definitely tell by the swatches that I'm going to run into difficulties once I continue playing with this But today was good and I did a pretty typical better than chocolate look for the chocolate line This palette's more nostalgia than anything, isn't it? So I'm going to go ahead and get started with nice buns I'm using a bk beauty 201 brush and this is just going to be my crease color not doing anything fancy with the eye Look today. This is just a look that I love I feel comfortable in scent of this palette isn't too strong I feel like back in the day these palettes had a much stronger scent, which honestly I preferred But I don't think all of you would prefer that like me. I love fragrance stuff I know a lot of people don't want fragrance in their makeup. I love it I'm just blending this out. You can see it's working out fine. It's giving the perfect level of pigmentation This is just a great everyday palette if you like browns and then you have the options to play with the pops I'll see how those perform. It's a good palette. I'm using bitter. Ha And I'm going to start by blending it the outer corner Defining the lower lash line a little more and you can see again I'm not having any difficulties blending it's working out really really nice And then let's hop into brownie points right here, which is the deepest shade though I do feel like it is Kind of close just a slightly more neutral undertone lots of browns in here is that honestly are unnecessary I know it's a chocolate palette, but lots of browns in this palette I'm gonna blend that along the lower lash line. You guys know I'm boring at heart I love a good deep brown eye. Can't go wrong. It always looks good. So I'm starting off with that I'm using the shade right here. I'm the dessert and it feels pretty creamy. It's a pretty Orangey chocolate shade and I'm gonna blend that Oh my gosh, I just went into the next color without telling you I'm going into milgate, which is the shimmery white and I'm using that as my inner corner color And then lastly I'm gonna go ahead and use this refer number three brush But by the way, they're having a buy one get one free sale on their website So if you do want to try some refer brushes now's a good time I'll have my affiliate link down below if you want to shop through that and support my channel And we're going into ooey gooey, which is a lighter shade and I'm just gonna get a sprinkle of it like right here That's it. That's the look I'm keeping it very very simple and chocolatey So so far with the palette with the what one two three the five shades that I use They all were really great, but they were the brown colors for me What swatched weird was like these shades here and a couple of the shimmers So we'll continue to use that but at least the chocolate shades the shades the palette are named of look really good I do have a new eyeliner to try now. It's not a new formula, but it's a new color So one size launched a navy and a dark brown eyeliner These are their point made waterproof liquid eyeliners, which I do really like I don't love the applicator on them, but I'm going to use the shade busty brown for today's look So let's see how this one is. I just feel like the felt tip is a little too long for me But I'm excited. I do really like the quality of it. Don't talk to me while I'm doing this Let's see the pigment. Okay nice It's not too watery of a formula, which I like pressing it along my lash line. I like that I love a good brown liner. It's just so much less intense, but it still gets the job done That really is nice and the wear time on this liner is pretty good as well It's not my favorite all-time liner, but it's a good liner and I like the tone of this brown It's not too red. I mean, I think I'd probably prefer a little bit more neutral Maybe a hint darker, but I still think it's a really great everyday brown shade I'm gonna try and do like the littlest inner corner wing, but I definitely can't teach you I'm just I gotta be quiet. We are looking good. I like it. I have a new mascara to try This is from makeup forever. It looks really interesting. It's the profession all mascara So there are two sides to it Step one is the lifting which actually has a smaller spoolie and then step two is volume Which has a larger spoolie. So let's go ahead and give it a try. I'm gonna start off with step one the lift Let's see if this does add some lift. I did curl my lashes prior. So I just added some natural Definition I would say to my lashes get the other eye and then I'm gonna get my lower and lower lashes Not doing too much for my lower lashes. That's just with one coat of the lifted side If you have big lashes, you naturally you might actually like this for me I'm like excited to try the volume side. So let's get into volume here Oh, yeah, this is already adding the boom boom that I want. It's funny I don't even really care about mascaras that much though. Just throw in a falsie Then you're good to go and then most importantly, let's see how we look on the lower lashes the lower lashes I'm not throwing falsies on. Oh, it looks good. Oh, this looks really good on my lower lashes I don't have much to work with and the fact that I could see them is a big deal Now for mascaras first time use it's always a harder for me to judge But it looks good. We'll continue wearing it. Okay, let's go into the very last lip product This is urban decays newest lip product. This is the lip bond very interesting These are unbreakable liquid lip colors. They sent me over three different shades So I think I'm going to go in with please since it's more brown So these are supposed to be super long wearing, right? It says intense and full color payoff that won't crack or feather So let's try it. It says to shake very well. Listen to that. There's something in there to shake it Okay, let's see This is a good fall color. I think oh, it's very orange. Oh, I don't like that color Hold on. Let me put on a brown lip liner first So I went ahead and grabbed this since this is fairly new from Sephora. This is rare beauty Lip liner and strong. Um, can I be honest with you guys about the rare beauty lip stuff? I don't really like them. They don't last on me like at all even the lip liners They are great to apply a great color range. They feel super comfortable But in the blink of an eye, I feel like it's all gone and I have nothing on my lips Anyways, I've never tried this color before it should last longer because it's a little deeper But anyways, if you've tried the rare beauty lip stuff, can you let me know what you think?  I just wanted a background color. Okay. Now. Let's try this color again Much better. It's not a super liquidy formula, but it does feel thin But it's quite comfortable. Hmm. Okay with the lip liner, we like that a lot better And it doesn't look correctly on the lips. It's gonna have to set down So I'm gonna throw on a natural pair of falsies and see how everything settles in together I put on lashes in a box number eight on the lashes love these it's been a while since I've worn them Interesting about this lip product because it doesn't really fully dry down it also It stays creamy, but it definitely is sticking to my lips. So this is definitely long wearing But it's kind of sticky which I don't like, but I do like it. I think it's nice It look it goes with the wrinkles of your lips as you stretch them in and out Interesting it just doesn't fully dry down, but it's definitely gonna last on your lips and okay friends I mean, this is the luck using a bunch of new makeup at Sephora The only product that I'm unsure about and I still think I like it is the beauty blender balance liquid whip long wear foundation I'm just unsure because it was kind of peeling up in some areas So I'm going to try it with a different moisturizer or see if it does that on its own Everything else I used was really really solid so far. I'm really enjoying the concealer I'm going to update you on the wear of both the foundation and the concealer the new Laura Mercier blush formulas gorgeous Love this bronzer and highlight duo from beauty blender I mean, I am doubtful that I will end up loving this palette at the end of it all But the specific shades that I used from the two face better than chocolate They worked really good.  It gives me the chocolate look I mean, I bought this definitely more so for nostalgia than anything They haven't come out with a chocolate palette in forever. The look is good It's a typical kind of chocolatey look else that I tried that was new love this new brown eyeliner I think it looks so good the makeup forever mascara solid thus far and same thing with the urban decay lip product and also Very good experience with the fancy skin. So really good application today So I hope you guys enjoyed this video talking about some of the new makeup at Sephora My main question for you is what are your thoughts on the rare beauty lip products because I've been scared to say I don't like them. Let me know Anyways, I hope you guys enjoyed this video and found it helpful Make sure you like and subscribe to my channel and I'll catch you guys in the next one. Bye guys. Have a good one


OK, welcome all. For those of you who've come for music, sorry, that'll happen later. Apologize for that. I'm Henry Nash. I'm Adam Young. We're both cores on the Keystone project, the identity service in OpenStack. And a lot has changed over the last few releases about roles and how you assign them, how you consume them, how you pass your tokens around, and so forth. So I want to give you an update on that from Ataka to find some of the problems, as well as some of the solutions. We're not all the way at Ataka. I'm not sure whether it will be all the way there. But there's a lot of good stuff at Ataka that you might want to be aware of. And I would like to point out that this presentation is 100% unprepared, 100% unrehearsed, and we're making this up as we go along. I would like to also make explicit what I tell anybody when they ask me for advice online, which is that I lie. I make things up, so take what I do and verify. And that's my way of actually getting bug reports in. I should say our way. Henry is more reliable than I am, but assume that he's lying, too, and verify everything that we're saying here. OK. So the clouds are evolving. And the key of a lot of this stuff is the fact that when OpenStack First was designed, it was really trying to do AWS but in an open source way and be more flexible. And the model we had for how you encapsulate your resources and missions you put on that encapsulation and how you get authenticated for those resources reflected that. But that isn't what we want for public cloud. It isn't what we want for complex private enterprises. We need something much more scalable. And some of the things here have been added recently. Well, probably grizzly was really the start of this stuff. And then every release, we've had things that have taken us further down that path that mean it much more appropriate for an enterprise model for authentication, authorization, and access control. I'm getting this clicker here. You've got the clicker. So this is what we're going to talk about today. I'm going to give you the intro stuff. Adam's great contributions to the project has been he's been one of the people who's been niggling and thinking as they say, think about these problems that enterprises are going to have. Think about how they're going to do the security. He's been great at bringing those things from Red Hat customers into the open stack community. So when we get to the what's wrong bit, this man can whack lyrical. I'm going to let him. I thought you were going to say that I was what was wrong. So just a quick recap. I don't quite know where the audience is in the room on this. Got just three slides on just going to bring you up to the concepts of the way this works in open stack. Role-based access control, I suspect most people are familiar with that. In an open stack world, it has a slight nuance in the fact that you always assign a role for a user on a target. You can't say Henry has the role T-boy full stop. You can't say that in open stack. I can say I've got I'm role T-boy on project afternoon or something like that. But I can't just say Henry has the role T-boy. You can't say that. And resources, of course, are owned by the products. So that's how you assign roles to resources. You assign them to a project that encapsulates those resources. Or to the domain that encapsulates those projects. And that's kind of really the concept that you have. And once you've done that, you want to use that to actually go access those resources. And so in order to prove that you have permission, what you're going to do is get a token from Keystone, which means authenticating using a password is how it started. These days, federation is an up-and-coming way in terms of open stack. It's been around the community for a long time, SAML and OpenID and so forth. But that's really now fully supported in Keystone so you can use federation. But however you authenticate, you get back a token, an OpenStack formative token, not a SAML or anything else. And that's the thing you need to hand into every API request you make to whatever service you're talking to OpenStack. It's the only way you get to execute OpenStack APIs. And that token is going to include for which container, i.e. a project, typically, the container rules, did I actually authenticate to? Did I authenticate and did I say I want roles for this particular container? What roles are they? Who am I? And for some cases, how I authenticate is sometimes you need to know, what's useful to know, how you authenticate it. And optionally a catalog, that's kind of by the by as far as this discussion is concerned. Okay, no attention in the mirror behind the curtain. And once you've got that token, then obviously you're going to hand it off to an API call and hopefully magic will happen. Well, so how is it that that service, no over glance, what does it actually do? How does it actually take those roles and say, okay, yeah, I agree, you can execute that API or you can't. And this is what it does. So actually the other piece, it's really not part of Keystone per se, it's not today, is that each of those services have a policy file that basically says, for these, not quite written this way, but essentially says, for these API calls that happen to be part of my service, no, but what it has to be, these are the roles you'd have to have. Well, this is the role or roles you must have to execute that API. And that policy file is controlled by the service. It's distributed by the service onto their nodes, actually outside of Keystone's control. So it's like a, it's part of the distribution of the logic out to the service points rather than have it all inside a single service and hence not very scalable. And so that's fundamentally how the process of getting your permission out and validated by a service. We're gonna introduce polyfiles a little bit. If any of you have tried to modify the policy file, hands up who's tried to modify policy file in Keystone or in any service for that matter, you have my deepest heartfelt sympathy. And so policy files, they're not the most human readable, although in theory they're meant to be, format, but they basically give you, this is a very simple example here, of how you define some rules, in this case saying, what is the rule for compute delete in Nova? And you can have rules within there to give you some logic and so forth. And each of the service have these. Keystone ones is a, this is an example of the default one that was Keystone, where you can decide, in Keystone v2, basically admin meant you could really do anything. Adam, why don't you talk a bit about admin and policy files? There's a few examples on here for policy files. Why don't you talk us through some of those and then we'll get into the bit about what's wrong. So you want me to talk about admin without talking about what's wrong with admin? We'll introduce the policy files and it'll lead right into the problem. I don't wanna talk about what's wrong. Okay, so the admin role, if we can dig back through the mists of time to when Keystone was an internal project or rack space and not even part of, not even incubated, roles were global. And you see a lot of vestiges of this in the approach towards thing to the policy files and the enforcement, as Henry alluded to before, or said before. If you're admin and that's a global role then what does it mean to scope it in to a given project? How can I talk about this without talking about what's wrong, Henry? Okay, here's what's wrong with it. I'm gonna jump to it. Okay, the problem is, and if you wanna look it up in Launchpad, it is bug 968696. The one that says adminness is improperly scoped or if you're admin somewhere, you're admin everywhere. And this is okay when you're all one organization and admin is one person and you're supporting a small number of people but this doesn't scale. If the problem is that how do you deploy 10,000 node data center with a million virtual machines on there and in all the different pieces there you have to be able to do things more granular and so you don't want to give away the keys to the kingdom to every last person who has to be able to go in there and still solve problems for the people that are making use of the cloud deployment. The idea that it's all admin means that it all gets through one bottleneck and that bottleneck can be pretty tight. So what we've tried to do is identify, first of all, looking at the policy files, how these things work and if you look at the examples because as Keystone guys we tend to get myopic and look at the Keystone policy file but really what do we care about? It's open sec, we care about Nova as our primary consumer because if we can't get what we wanna do through Nova nobody else is gonna adopt it and then Neutron just takes it and they in spinal tap terms turned it up to 11. So here are a fragment out of each of those files. The top and the noble one you see context is admin, admin or owner, default. Those are rules that you'll see at the top of the file that are designed to be reused and the default is what happens if you don't have anything specified. You can see most of these things say that admin or owner. So is admin means the admin role, these things feel thrown down and that the project or that the project matches. It's not even really doing a role check. And then the last two bullet points on the Nova one are examples of how these applied, either a straight is admin true or admin or owner. Neutron you can see they're doing something similar but their concept and their user of the term owner is a little bit different. It's that the tenant ID matches because they're still talking about tenants, which is probably the single most confusing thing in OpenStack and I'm gonna apply the first rule of troubleshooting, it's all Adam's fault. We had this division in the terms we use and we inherited this. This came back to the day where Rackspace and NASA had different views. So sometimes you saw tenants, sometimes you saw projects and we wanted to get to choose one so we chose project and everybody still calls them tenants, so. Admin or owner, you see it's similar, it's really close but then they have this stuff down here like roll AD, VSVC, I think that's the advertising service or something like that. But they have this idea of starting to actually put in roll R back into place. Now I'm gonna hand this over to Henry because the V3 cloud sample was Henry's, I won't call you a magnemopus but it certainly was a slow work to get Keystone's policy file under control and one of the problems that we have is because people are deploying the existing policy files, we can't just change them without breaking everybody who's expecting the existing rules. So V3 cloud sample, while we've been telling people for a long time this is the way we wanna go, we can't make a bit of a fault. Thanks. How about that, Steve? Yeah, yeah, yeah. So as Adam said, the first thing we did when we said, okay, okay, clearly admin everywhere, it's not right, so of all the services which definitely need something more, it's Keystone. If you're in a public cloud, you wanna have cloud admin, domain admin, project admin and probably a few others that may be suitable to your own particular setup, how is it you're gonna provide that kind of level of differentiation? So shipping that ships with Keystone as well as the standard policy.json file is this other file called v3cloudsample.json which is meant to be an example of this. Here's how you would stratify your administration such that you can have cloud admins which look after obviously the whole cloud. For each of the say companies, typically a domain is used to capitalize a company or division in a company that wants to look after their own users and groups and projects so that you can then delegate the responsibility to looking after those users and groups and projects to admin of that domain, but they can only do that domain. And then within that domain, they want to create project admins that can only look after that project or a set of projects. So this is a fairly complex subject and we're happy to go through this stuff offline but if you look at this for example, you can see at the bottom here when it says, you know, what project can I list? Well, you know, so if I'm the owner, that's okay of the project, but you know, we will start to say, well, the role of your admin and you're a matching domain ID and basically what this tech said is, well, yeah, you can do it if you're admin, but only if you're admin in the domain of which the project is in. So we start including the logic to say, okay, well, you can't list all the projects if you're admin. You can only list the ones that match the domain ID. So what we're doing is matching is you got a token, perhaps with a domain scope token and then we can think, is the project you're looking at in that domain? And so the checks for admin matching domain ID says, you have been required and that kind of, you know, weirdo logic there, but he says, and the domain ID is the thing, you know, matches the one that has been passed in. So if you look at the VC cloud sample, it'll give you a starting point how you might stratify your administration, starting from a Keystone perspective, because what Keystone supports are back like everything else, to stratify those kinds of roles. The one thing we've, one new thing we've done in Metaka is improved and we talk about it in the presentation. If you're the second line here, if you think about, if I'm a cloud admin, the thing I definitely don't want is someone who's like a domain admin or a project admin to somehow make themselves cloud admin. Otherwise that kind of defeats the logic of this. So in this, We'll get there, Henry. We'll get there. Good example, we had to, basically you would actually, when you took the sample, you'd paste in the domain ID of the admin, of an admin domain, and that would say, if you're an admin of that, then only you can be cloud admin and nobody else can add roles to that domain either.  So in Metaka, we addressed that as well and we'll talk about that later on. I'm going backwards, Henry. Okay. Back one. Enter Metaka. So enter Metaka. These are the things we've done in Metaka release that ease some of these problems. And as I said, not all the way there by any means, but we're taking an incremental approach to knocking down the barriers that help us have proper admin delegation and proper support for admin and preferential capabilities across OpenStack. So, Adam, do you want to talk about implied roles? That was your baby? Okay, let's see. Okay, I talked a little bit about Bugnide 686.9.6. And that was the first thing that we had to knock out is this is really tying us to a simple place. But beyond that, we want more fine-grained roles. We want to be able to say, well, we want to be able to say that somebody can be an auditor or an observer. They can only read. And that's probably the single largest request we've had for changes in the role stuff. But a lot of people, anybody from Dreamhost here? Anybody work with Dreamhost? So in addition to being an engineer here, I have been a customer with Dreamhost for a long time. And I've noticed one thing on their cloud that they did was they said, we're just going to set up the networking for you. You sign up with us, we'll create a project for you, we'll build the network for you. And then we're not going to let you touch that. Now, maybe there's some higher level of service that you can do that, but they don't let me touch it. They know better, I break things. So I think this is a pretty common pattern where you say there's something that is kind of an end user operation, but there's certain people we want to let them crawl before they trip and die. And so these people we want to remove some subset of that. But we still need to be able to give it back, give it to somebody else. So these idea of storage or networking, causing it trouble tickets, we want to be able to choose who gets this additional ability. Rebooting a VM. You might have some sort of monitoring system that has to reboot a VM, but it shouldn't be creating a new one. That doesn't mean that it should be able to create a new one. So we want to have a role that you could say this has only amount of permissions to reboot a VM. As a public cloud, this is all about delegation, not just delegation, but the ability to delegate delegation. How does it tell somebody that they have the power to do their job without giving them the power to do more than their job? And as we start talking at scale, this is going to become the major, major pain point. How can the enterprise map roles that are meaningful to them onto whatever the provider has created because they're not necessarily managed by the same people? Okay, so. And just to pick up one point to introduce that. Part of the vision is that we're seeing here is that today there are typically most clouds have few roles, partly, you know. Because we don't ship them. We don't ship them. If you play forward your mind to when cloud providers, you know, as the public cloud providers particularly, and private ones as well, if they want to attract the maximum number of customers on a given cloud, they're going to want to create, you know, you know, probably the most fine set of roles they can, such that they can give everyone the freedom they want. But it doesn't mean everyone wants the same freedom. So how is it that they can have many roles, but they might just super complicated for everyone? That's the dichotomy. As we think we'll go to many more fine grained roles in your cloud, we need ways of packaging them up sort of thing or aliasing them so you can actually give them out in reasonable chunks to particular customers or particular sub-customers without complicating it for everyone. Okay, so I think I went the wrong way before. This I think is the next one that we're supposed to be talking about. So to get to the internals of how things happen in Keystone, often I'll have an idea and I'll put it out there and some people will tell me I'm crazy. Well, everybody will tell me I'm crazy, crazy about this specific idea and every now and then I'll take something and Henry will take that to the next level and that's what happened here. So this was my first idea and this went through a few iterations just here. If we make it so that you can have role chaining where if I assign admin to you, you're automatically a member. Now I don't need to go through and create a specific assignment for all my admins to be member in order to enforce policy on somebody that they have to have the member role. If they're an admin, they're automatically a member and if I want to take something like member, this big one and break it down to two parts, say I want to take the network stuff and break it off. So I create a network member role but I don't want to break everybody already. I could say that member implies network member and then if I want to take that away in the future I can have power member and newbie member and only the power member will get everything but to start off with I need a way to move forward and that's where this whole thing started from. How can I take what I have now, make it so we can change things and yet not break everybody. So prior and implied, the prior role and the reason why it's not called existing or explicit is because this is chaining. So A can imply B, B can imply C and by getting A I get all the way through to C. So if admin implies member and member implies observer, if I assign admin I get observer. It always has to start with an explicit assignment. Keystone is gonna look for what you have explicitly assigned when you do something with a token API and then expand out all these implicit in a chained manner. They can be defined via the web API or Python only for now, we didn't get this all the way through to the CLI but this does work, this can be used now. So this right here is the first I think the most powerful tool for getting us to be able to move forward. I'm gonna figure this out by the thing. So here's an example of creating it using the Python API. If you have the member role created, the reader role created and we list, you can see what you have there. I guess I cut out some of the really cool stuff which is actually setting up the implication thing. Do I have that in there? Oh create implied, yeah there it is, the last line there. So that's the API that you do. This says member as the prior role implies the reader role. And then when I go and request a token for somebody who already has a member assigned in the token response. I don't know why I'm pointing at this, I don't know where the actual clicker is. You can see that both roles will be expanded out there just as they would be if they were explicitly assigned. It is the same thing in more detail this is what people are looking for. Admin implies member, member implies reader, admin can imply read admin, audit reader. You can have it as a, it's what's called a DAG, a directed acyclic graph. So you might have two different ways that you get to the same implied role. And if you assign both three so you don't have to worry about cycles and all that kind of stuff, it will resolve. It resolves to a set. So the rules are designed to say don't follow the same path a couple of times and you blow it on out. But you can come up with these kind of things that have multiple ways of ending up getting these really fine grained roles. So if you wanted to change owner to member in the policy files, then you can do role colon member. That's I think clear. You're saying if you are a member you can do this and you don't have to have admin or owner roles because admin implies member here and it'll keep the policy files smaller. Now you're starting to build tighter coupling between the custom roles and the custom policy files. So there is a little bit of overhead that we are putting on your shoulders which we're trying to make this stuff better in future releases, but we didn't even have the tool before this is the first step there. And one of the points about that is that you could do this today by just modifying your policy files and making them very, very complex. I think that's a bad idea partly because the more complex a policy file is just either harder to understand the harder it is to convince yourself that you're not creating loop holes and abilities of people like APIs you don't want to. And so by separating this to say let's make the policy files as simple as we can and then put the, if you like, the chaining of those roles basically into the database and accessible by the API then you can actually set that up, modify it, convince it and analyze it more closely and tune it to what you want without having to go change policy files which would distribute out to all the nodes. So you need to make sure all the nodes get updated with your changes. So that was one of the reasons to go this direction rather than just let you kind of build an ever more increasingly complex policy file. How many people are local to Austin here? Anybody, okay, so I was thrilled when I found out that we were having this that there's actually a shopping mall here called The Domain. And so that's the picture of what we have here for Henry's domain specific roles. I wonder where you got that from. Yeah, this is actually here in Austin. So this is the case where Henry came up with the idea of domain specific roles. I think first or in parallel to becoming with the applied roles and it was one of these when we started talking we realized that they were complementary. So we implemented implied roles and then we got to this. And so this is taking it a stage further. Think back to when I said earlier imagine when you have clouds with many fine-gain roles potentially with change as well with implied roles. A given customer comes along and you host them on your cloud. They have a domain and they get to create all their users and their products and so forth.  So this is it guy, Mr. Customer. This is my 20, 30, 40, 100 whatever roles I've created. They may mean nothing to me as a customer and to my users, my admins, you know, VM crates. I don't know what that is but I may want to map that onto a set of logical roles, alias roles that mean something to my users, maybe to my, you know, names of my entity, you know, teacher administrator or whatever it happened to be. So we want to provide a way where, you know, given that you may have a large set of fine-gain roles you can basically use that same implied mechanism by creating an alias role which is private to your domain only you get to see it, only you can assign it. And it doesn't show up in the token. And most importantly, and it doesn't actually show up in the token because actually what we're doing is at token creation time, we're gonna expand that out into the actual fine-gain roles the cloud providers has created, which means I can give the power to my domain or industry to go do that modeling themselves and it's not my job as a cloud provider to do it. I don't even understand their industry, probably. I can go do that, but I don't have to change any policy files when the tokens get created, basically the actual roles that those alias is imply are the things that get put in the token. Yeah. The specific token's pretty big. No. The main specific roles, definitely not. The implied roles can, but it's not a huge amount that goes in. If you compare this to like one entry of the service catalog, it's nothing. There's not a lot that's in there. If you did really, really fine-gain roles and you had them all expanded out, then they could get huge. And if we get there, we'll won. I can't wait to have that problem and we'll find ways to optimize there, but we're not there yet. But the other point about it is that if you use one of the things that's come into Keystone, certainly in the last release, and been hardened in Mataka, is FNA tokens. FNA. FNA. FNA. It is not FNA? It is not FNA, and you know what, it's based on a really vile, vile tasting alcohol. So FNA tokens were a new token format, came in in the last release. And they're really a, it's a slight off-topic, but relevant in terms of the fact that Keystone's been on, part of Keystone's journey has been on, well, what is the balance between having a token which basically tells me everything I need to know, for instance, perhaps, that I don't have to go to Keystone to validate it or have nothing in the token, so I've always got to go to Keystone to validate it, or have it stored, prepared in a table in Keystone so I can read it out. We've kind of been down that journey and they've all got their pros and cons. The most modern version is the FNA token. Yes. Which says, I'm gonna put as much as I can a token without blowing it up too big and then actually the set of rolls don't go in the token. So if you have a complex set of rolls, they don't actually go in the token, that when you validate the token, they'll get filled in for you, but it doesn't actually cause the token size to be blown up.  The other thing, just as we're talking about, rolls is that, Do you wanna go for it? Thank you. This thing's jumping on me, it's actually me advancing on you. I believe you. As we're on this topic is inherited roll assignments. Something that... I chose the picture. You did choose the picture, thank you. I appreciate you honoring our great roll family. That's very kind of you. Well they have inherited rolls, right?  I couldn't think of a better way to illustrate it. I got it. And we pay em a lot. I know, I know, I know, I got it, I got it. Don't say, don't say, don't say, don't say, don't say, don't say. And these have to be the instance of Anna. And they're really designed thinking about, okay, so if I'm gonna create domains, you know, maybe inside a large enterprise, you know, various divisions, or even a public cloud, if I'm, you know, there may be still some relationship between the cloud provider, the cloud admin, and the products within that domain. Maybe I've been given, maybe I need to have a role on each project to, I don't know, back it up or be able to get in there in an emergency, whatever it happens to be. And whilst there are other forms you can do in terms of trust and so forth, one of the ideas was, let's provide a facility where if you define or put a role on domain and mark it inherited, at runtime it'll get inherited to any project in that domain that exists now or created in the future. It was a kind of relatively specific case. Now of course we have, since the last couple of reasons, project hierarchies within domains in Keystone. So it's not a flat tenant as it was called model within domain, you can actually have a hierarchy of projects within each domain. And so of course you can actually use inherited role assignments, you know, assigned to any point in the tree and you know, if you like, you know, the tree below that will get those inherited role assignments. So it works exactly the same way as it did before. Using effectively the same API. And you can actually also use that now to better model your role requirements within your container real estate, your resource container real estate. And just one word of caution here, slightly because it's heritage, if you assign an inherited role at this point, it applies to all the roles below you, not that particular node. You can also assign a non-inherited role to that node if you actually wanted to be on the node itself, just a word of warning when you try this. It might not do what you expect, but it comes from that original idea of you're gonna put it on the domain, it's gonna go to the projects. And we did actually consider changing those semantics with what actually the complexity of changing it and having some one way and some the other will be more complicated than leaving as it is. So we left all of that. And as you're aware in computer science, one of the hard problems is naming, stop jumping ahead on me. That's not me. The term inherited role assignment, if you're used to NIST RBAC, is what I talked about before with implied roles. And one of the reasons why it was called implied roles is because we had already sat on the name inherited roles. I like inherited here better because it's inherited down a tree down a hierarchy. So I think this is the clear use of it, but it does mean that we had to diverge from how things are discussed in literature elsewhere because we're different, you know? And we like to think that, I was gonna say I like to think that we're better, but we know that we're not, but we are different. Five minutes. Five minutes, okay. By the way, did you take out the slides on how we enforce Is Edmund Project? Yes, the last one. Okay, it's live, okay. So if you're going through and you're trying to modify policy, as a lot of people have done here, I gave you a tool, well, we gave you a tool that I think you're gonna really like, which allows you to check what a policy would return without actually having to deploy in an anger, okay? So in this is part of Oslo policy, the library, you run it against a specific policy file. The access dash s access is like a JSON snapshot of what you would get from a token validation. The big thing we're looking for in there is the roles, but if you look, there's examples of token validations or just do a token validation and catch that from the API, you can see what it will give you. And you run it against a file and say, A, I wanna try this one specific rule and the example I have down there is I'm looking against identity list user, or it can run it against all the rules in the file and say pass, fail, pass, fail, pass, fail. And you can do a delta, keep a log up. This is what I had before I changed my policy file. This is what I had afterwards. I'm getting the same results. I haven't broken anything. This should help you to move forward. And also you can have different token bodies, a token validation request or off data, whatever you wanna call them. So you can say, okay, now that I'm doing this more fine grained role, do I get a true here and a false here? So this should be a tool that helps you develop new policy to make use of the other tools that we did with the implied roles and domain specific roles. And here's an example of what you would get. I didn't do the whole thing. I did a head five of, if you did against all the ones in the cloud sample that Henry talked about before. Okay. I don't know why I chose to put a picture of Major General West, except that I'm kinda proud of the first female army surgeon general. But there's some tie-in here that I'm sure I'll remember tomorrow. Tokens, okay, this gets back to that original problem. I originally had the slide at the beginning. Henry put it at the end. It's completely tricked me up, but it's good that we're landing on this one because this is that pain point. This is a case of one of those things that we can't change by default, but you can change in your deployments and make yourselves happier. Although we did find a way to figure out how to change it by default in the last one. I'll talk through that with you later. If you add these two configuration options, admin project domain name and admin project name, and by the way, that project better exists in that admin domain, you've now created this magic thing which is an admin project. And any tokens that you request that are scoped to that admin project will have an additional field on there which is you can see token.isadminproject true. This means you can write new policy rules that separate out, say, I'm doing something for adding a new hypervisor and differentiate that from I am doing project level administration. It also gives you a way to say, okay, either you have to have admin scope to this project or admin scope to the isadmin project because you wanna only get one token to do all your work everywhere because we've actually listened to you for once and said we're not gonna make you re-scoped each project. Okay, this is gonna take time to change upstream. We can't change the defaults without breaking everyone. As much as I really enjoy breaking everyone, they just don't let me do it anymore. The Keystone Cloud sample does have this change in there. This is one of the places where we could do it. We put it right next to that thing that you would have initially cut and paste. And so you'd have to cut and paste anymore. You change your config file and now Keystone will behave according to this. We tried doing it with the Keystone default policy file and you can see the tests that are failing. It'll give you a sense of the problems that we're getting there. And we'll need to identify on the existing policy files the difference between a cloud admin operation and a project level admin. So there's been a lot of talk, the UX effort here with personas and all that that's going on elsewhere. We're not doing this all. We're not the only people playing on this. There's a lot of future work to be done here. We need input. We need data. We wanna know how employers wanna manage the policy files. One of the things that we were told in the past when we tried to do policy as managed by Keystone was we have content management systems. We wanna use those. We're not gonna change that. We're not gonna buck the system there. But we still wanna say, do we wanna strive for a more collective view? What policy looks like across the board? Make sure that we are consistent as we pointed out those differences between how Neutron and Nova view ownership and all that. And make sure we have a consistent way of talking about roles, at least through the things that used to be the core. And as the tent gets bigger and bigger to be able to talk about these things in a reasonable way for the as a services like Trove and all that working on top of Nova and Neutron. And can they actually figure it out? Will cloud administrators and to some extent, the managed administrators be able to work out what a given user can do? This request came to me from the Horizon PTL about three years ago. They wanted to be able to figure out from a user's token, what should they show in the UI? Can we figure out for this user, what can they do? That's something we're still working towards. There were so many stages we had to go through to be able to start addressing that question. So with that, I don't know if we talk right through our answers or our question answers period. I'm assuming we have, and bye. Get out of it. Any questions? This looks a lot simpler than what was there before in some ways, but as a private cloud owner, operator, admin, it's really not that useful still. What do you want? Problem I have is those are all managed on the individual control planes or nodes and all of that. To see what's happening, it's very easy to, oh, on the Keystone policy, I made this one and I forgot to change it on the Nova or on the Neutron. All of a sudden, you're managing all these files and they have to be deployed out, like I said, to dozens or hundreds of nodes in order to be applied. So I ask this question every six months or so and please forgive me, but when are we gonna have something more like AWS IM roles? Where we can say, here's a user group, not a role, but this user is part of this group that can do these things in this project or this tenant instead of having to make system level changes or create a bajillion different roles so then those domain specific admins can then create ones that are inherited based on that instead of just like the domain admin says, this is what I want these users to be able to do. And then as a step two, an instance, being able to say, hey, find out more information or make these calls to other services. So obviously, yes, we're not gonna do it, it ain't gonna happen, nope, wouldn't be prudent. So we obviously do have group assignments on, but it isn't actually a question, but just to make sure I understood, yeah, you can have groups that you can assign roles, you can assign those a role to a group on a project or a domain, but I think the point you're getting to is this idea of the fact that, and Adam just alluded to it, the fact that right now the model is, Keystone is not the, well, OpenStack doesn't provide the system for distributing those policy files around and management, it's just outside of the scope of any of the OpenStack tools, you might use that or what do you need to choose? And we have debated at length where the Keystone should take on a role there and be able to provide a collective view and so forth. We actually got- They didn't have my security enhanced OpenStack. We've got one of the- It's also the same sort of thing. You mentioned, look at a token to see what that user can do. I as an admin want to look at a user, not that user's token. I say, what can they do? And see what they can do. So I don't even have their token to know what their permissions are. And so right now in Keystone, as I understand it, it's supposed to somewhat manage access but not- The steps that you have to go to get to, okay, we don't even have an agreement from the services that we're gonna collectively use the policy API in Keystone to manage the policy files. The policy API probably predates most people in this room's involvement with OpenStack and it's still not used. We're trying to get there. If we could get that far, then at least I could give you the steps to do that. Until I know what policy file is going- Well, we're having a lot of discussions. I actually came from, and I'm going to policy discussions across the street in the developer side of things where we're knocking down the pins one at a time or knocking whatever the wall's the better. There's a lot of steps to get there. And remember, we have a lot of people that are using it now. I'm not allowed to break things as much as I'd like to do it. I really do. Raise the RAZE, the existing, but we can't. So the advice I'd say is keep saying what you're saying because I do understand where you're coming from.  Because in order to do that, we need a collective cross-project agreement of how those policy files either distributed or could be accessed and so forth so that we can give those answers. So something can give you that answer, which, because if it knows the policy files and keeps in rules, then we could give you the answer. That's what we have here on this slide, right? The question's- That's exactly what we're trying to get to. And yeah, I know that there's people who want things on individual resources. Sorry. Yeah, so basically- Oh, you again, man. Yeah. I asked this question before in another session and you told me, you know, this is the- Yeah, come to the session. Yeah, so basically, so the question is, we do have this role-based API allows us to dynamically create a role. But the role, if you want to give the permission, you'll have to go to another place, which is the policy file, to give them the permission. And after that, you'll have to restart the server. Basically means you don't have the capability to dynamically assign you there. No, well, it's not true. I try to restart the server, actually. You have to restart the server. You have to restart the server, but yes, you're right. Go review my talk from last, a year ago, the summer there, and you'll see dynamic policy. That's everything I wanted. It's- I mean, okay, and I agree. We don't have the ability to change it dynamically and to have it effectively because those policy files, again, are distributed outside of the scope of Keystone and Keystone doesn't know where they are and we need a, you know, again, I say to all of you, if this is what you really want as deployers, I'm gonna, you know, keep telling not just Keystone, but some of the other projects, we can help carry your message, and we will, it just comes, we'll wait if you say it and if I say it. I'm also being a little flippant here, but if you see that note, that second one there, we got feedback from the operators that they did not want us rewriting the content management system. They wanted to, they had, whether it's Puppet or something else, Ansible, in place, they did not want us replacing that with a custom operation, or operator for this. So there's a lot of people with a lot of different views on this and we have to keep the different viewpoints in mind there. Being able to put policy into Keystone that is then used to control access to Keystone is also problematic for other reasons. So. Is someone waiting to set up for the next session? Yeah, I mean, how am I gonna stand on this? People are gonna come and chat to us directly and then we'll answer questions.  Okay, I'm gonna go to that corner and you can come and answer me questions directly. You'll get better answers anyway. Thank you.