Lately I've been reflecting upon something that I'd like to share with you publicly because some of this is going to be personal and That is I I suspect and I guess this is just a suspicion on my part Maybe it's a projection. Maybe it's a judgment on my part. I suspect most couples really don't know how to create deep Intimacy with one another Intimacy and while I didn't coin the following phrase intis intimacy means into me you see In other words that way you can actually see inside a person's soul that way you see who they are on the inside instead of the Masks that most human beings wear on the outside and yes, I do believe most human beings wear a mask myself included And I've often wonder how do couples really connect with one another One another on an emotional level Oftentimes intimacy is confused with the physical connection you have with someone and certainly when you connect with someone on a Physical level and when I'm talking about quite frankly a sexual level It can certainly feel like you you you really know who they are you might feel that way in the moment In fact, it's been interesting. I've heard I recall shortly after my divorce and I was Dating and I was physical with a woman and this particular woman I remember that when we were physical together, it felt like a sense of home It's so there was a sense of like this just felt like home while we're together And it's interesting as when I've shifted to becoming a dating coach when I mean by shifted I used to be in the insurance business now. I'm a dating relationship coach and I've spoken to women who have said that men have said the same thing to them that being physical woman with a woman feels like Being home and I'm like I thought I only knew about that and it's written Anyway, I feel like I'm babbling here for a second a physical level many men Might feel like that's genuine love because when your body is feeling tingly Your body is connecting on so many different levels. It can feel like you're really connected to another human being I mean technically when you're in intercourse, you're actually connected to another human being, but that's on the physical level. I Think what so many couples are missing in Relationship is really connecting on that emotional level that level of I see you that level of I genuinely care about you that level of your best interests your interests are just as important to me as My own interest that level of trust that level of deep commitment And I've often wonder how do we get there as human beings? How do we get to that place because the physical part is rather easy in fact these days the physical part is The easiest part because when we think of attraction We often think of it from a physical level Certainly, there's deeper levels of attraction. There's a emotional attraction. There's intellectual attraction There's even that attraction of being attracted to someone because they are creative or those people that are the protector types These are multiple different types of attraction that exists out there But that's merely attraction. How do we go below the surface as I talk about my relationship iceberg? How do we get to that level of really connecting with another human being on that? emotional level That level where you you feel comfortable to say almost anything to your partner In fact, you feel so comfortable that you could tell them your deepest darkest secret How do we make that happen is something that I contemplate frequently So I want to share something personal with you all And it's something my girlfriend said to me yesterday is she says I like your woo-wooness I like your woo-wooness and what she means by that is she likes that I've studied Relationships I've studied spirituality. I've studied personal development and self-help work I've studied it to actually become what I think is a better human being or a more evolved human being or a more Awakened human being because I I recognized that in the significant part of my life. I was rather unconscious To simply the concept of awareness Being aware of my thoughts being aware of my feelings being Connected to my own thoughts being connected to my own feelings outside of the mass that I wore for a significant part of my life and I suspect many men experience this as well as many women experience this operating from the facade of who they are instead of the core of who they are and I think one of the things I appreciate in this relationship more than anything In fact, I said this to her yesterday What I appreciate more than anything is I feel safe enough to just be who I am warts and all Warts and all that's kind of funny. What I mean to say is I Don't feel like I have to play the game of hiding Behind the strength of masculinity. So I don't present present weakness. I Share my insecurities. I share some of my fears with her and we talk about it We put it to the light. She talks about her fears and insecurities with me whether it's in our own individuality or even within our relationship and That's one way to build real connection with a partner To be vulnerable to be authentic to be transparent with a person to really step into that feeling of like I I'm with really good friend. I'm with my best friend. I Know there's a meme that says Something along the line of you know, the best relationships are friendships on fire And what I think that means is that you can be with your best friend and at the same time you have that passionate connection with them And I think one of the best ways to get there is to start by being vulnerable authentic and transparent with your partner Now I'm gonna share something That's very I'm gonna it's not to the extent that it's private between the two of us We were sharing last night wouldn't it be great if the world could do what we do So I want to share what this is So since we began our relationship every once in a while we do something called camping And what we do is we create or I correct this was my idea and I didn't learn it I didn't learn I learned this from some other people I've learned it from a group of people who shared this with me But what we do is I lay out on the blanket on the floor and I build it up So it's very cushiony and very comfy with fluffy pillows and stuff like that And we spend half a day On the floor in my living room just connecting with one another now Sometimes we use plant-based medicine to connect sometimes it's just the two of us But we really we spend half a day we we turn off the phones Turn off the phones Just sit and connect with one another and talk about things That matter to us in our lives and all the nooks and crannies of where our thoughts go Each and every day. Did you know that the average human being has somewhere between 12 and 60,000 thoughts a day? 12 to 60,000 thoughts and by the way from what I understand 80% of them are negative And 80% of those negative ones are real or now I think 95% of those negative ones are reoccurring ones So we just sit and connect with one another now There's a book that I highly recommend you all check out It's called how to make love all the time by Barbara DeAngelo since she creates these simple little ways that you can connect with your partner There's a The table of contents You know what and I'm sharing with you one of ours, but here's one the love letter technique The secret class sexual classroom technique You know your hidden power of sexual energy now. I mean some of this is well, that's the bedroom stuff How to tell if you're with the right person letting go of letting go of love I mean there's how do you use this technique to make love all the time the first aid technique all these things in this book? I highly recommend you checking out And I'm offering what she and I do It's a suggestion and you since my audience is women mostly you can create this for your partner And that's simply making a request that you spend time Just really connecting with one another you shut off the world you sit I mean the nesting is what we call this nesting with each other and just connecting with one another The plant-based medicine takes some of the edge off But it's just a way not to make it sexual. This is not a sexual thing This is about creating deep intimacy with your partner deep connection with your partner taking time out of your week If you can do it once a week or once a month, whatever it is to just sit and be together What's cool about nesting is we we move in all kinds of different positions throughout the the day It's just kind of like thinking we I think out loud You know just some of the thoughts and we just unpack them together and we have fun together And it's a great way to build real deep intimacy with your partner by being vulnerable by being authentic by doing transparent and so we even had this idea of creating like a nesting bed and maybe selling it on Amazon or something like that because We both agree We've never experienced this before in any of our previous relationships, and we suspect a lot of couples probably don't know Genuine intimacy outside of the physical realm, and I'm here to invite it into the emotional realm And I hope just this offering today might create The shift in your existing relationship or it might plan to see that you use this in a future relationship And if you're single and looking for love, I invite you to attract in that beautiful relationship like what I think I have God universe spirit I'm open and receptive to love. I invite in a love where we can be vulnerable authentic and transparent with one another I invite in that level where you have that mutual chemistry for one another and we have that ability that will be Open with each other on a communication level and we can play and dance in that realm of vulnerability Authenticity and transparency and we can blend our lives together at some point And we also share the deep values that allow us to really connect with one another Then we develop the deep roots of trust through social activities hobbies mutual interest spending time with family and friends traveling together teamwork building school skills both in our personal our professional life and lastly that deep intimacy that isn't just physical It's emotional as well and God universe spirit. I invite that into my life That's my invitation for all of you to invite in that kind of relationship Is it gonna work? Hey, nothing ventured nothing gained, right? Give it a shot See if something can shift between you and your partner by starting to block out time During the week during the month where you really connect and just be with one another And I hope that helps your relationship or your future relationship All right, if you had that if listen, I'd like to hear your thoughts on this post to comment below If you found value in this please tell your friends about midlife love mastery send them to my website jonathanasley.com have them click the group coaching coaching button so they can join our fantastic group And I'm gonna sign off this video as I always do first off give myself a big check in at jonathan barrick of self love I'm gonna reach into the camera and give you a hug of love if that's okay I'm gonna ask you to turn to someone a pet teddy bear pillow Give it or them a hug of love because hugs are a great source of love and let's face it We could all use more love in our lives. Thanks a bunch. Bye. Bye now


Good morning. Sound off, Jonathan. It's great to see so many folks. Great to see so many folks here standing remotely in the back. So we're here from the government and we're here to help. My name's Jonathan Mayer. I'm Chief Technologist for the Federal Communications Commission's Enforcement Bureau. I'm joined by wonderful colleagues throughout the federal government. We have Lori Craner, who's Chief Technologist of the Federal Trade Commission. Eric Mill, who's a senior engineer at 18F in the General Services Administration. And Alan Friedman, who's Director of Cybersecurity Initiatives at the National Telecommunications and Information Administration. Alright, let me try a little louder. And with apologies to the folks who are near speakers. And Alan Friedman down at the far end, who's Director of Cybersecurity Initiatives at NTIA within the Department of Commerce. So it's a great cross-section of different technology policy roles within the federal government. We have working on cybersecurity in the main component of the executive branch. We have delivering services throughout the government. We have an independent agency working on security and privacy issues, real thought leader within the government. And then we've got the FCC. So I'm going to ask each of our participants to say a few words about their agency and what the agency has been working on in technology policy and the role in the agency. And then for the most part this is going to be an extended Q&A session. It's up to you to lead the conversation. There are microphones at the left and the right of the room. Please line up and have your questions ready. And my game plan is to just alternate and we'll do our best to answer. Okay, so Lori, could you start? Hi, good morning. So the Federal Trade Commission focuses on consumer protection. And in the security and privacy space, we're very much interested in protecting consumers from having their private information breached and leaked. We're interested in protecting them from unfair and deceptive practices. Scams, fraud also spam, robocalls, these are all things that we are very interested in investigating and in finding ways to protect consumers. We also do outreach to consumers about how they can protect themselves and avoid falling for some of these scams. We are very interested in talking to researchers and if you come to our session at 1pm we will get into more detail about that. But we would like to work with the researcher and hacker community to identify vulnerabilities that we need to be aware of, to identify tools that we can use, that consumers can use. And so we encourage you to come talk to us. We've also set up an email address research at FTC.gov where you can send us the things that you've discovered that you would like us to know about. We also have a number of events that are coming up this fall that we are going to be interested in having researchers attend. They're going to be open to the public as well as webcast. So we have a workshop coming up on drones. We have one coming up on smart TVs. We have one coming up on disclosures. So privacy notices are one form of disclosure, but other kinds of disclosures as well.  And then in January we will have our privacy con event. You can read about all of these things at FTC.gov slash tech. Thank you. I'm Eric Mill and I'm with a group, a relatively new group in the federal government called 18F. It's like one 8F. And we're about two years old and we're housed in the most excitingly named agency in the federal government, the General Services Administration. So we're about a couple of hundred people, mostly not in DC, and we are trying to do technology right in the federal government. So we actually have dozens of engineers, product people, UX people, design folks, security people. And we are trying to make sure the government can do well for itself on technology and to make sure the government can do things the way that we all want to do things. We can embrace the cloud, use open source, do agile development. We can bake in privacy and security from the beginning of the development process. So we try to lead through implementation and delivery. We do some of the things that are maybe most relevant to this crowd. So we're currently working on getting a bug bounty program started on a number of our public facing systems. Shout out to DOD who just did the first government bug bounty program fairly recently hacked the Pentagon. Definitely learned a lot from them. We're also trying to hire, the government does in fact employ information security professionals. We're trying to do it a little bit differently and hire people that are senior technical implementers that don't require security clearance and put them at work on a variety of government-wide systems that make the country work better. And in particular part of my work there is focused a lot on encryption and in particular, AT&F has been a really animating force on web encryption, on HTTPS in particular. There actually is a federal policy mandate right now in the executive branch to move everything to HTTPS only with strict transport. That's something that our organization has animated and put a lot of energy into. Something I personally work my tail off on and that's gotten me the chance to meet a lot of the good folks here and hopefully we're making the government a better place. I'm Alan Friedman. I'm with the US Department of Commerce in the National Telecommunications and Information Administration. We're part of the administration. We are the president's advisor on telecom and internet policy. You may have heard of my boss, Assistant Secretary Larry Strickling who's trying to keep the internet free and open with the ICANN IANA transition. And thank you. And in fact that's a large part of what our organization does is represent the equities of a free and open internet both inside government discussions as we sort through policy as a giant complex government and also across the private sector. In fact we take this notion of multi stakeholder engagement quite seriously. Too often there are policy issues where if we wait around for legislation it's going to take too long and it may not be great because there's going to be lots of complexities and legislation is a pretty big hammer. Regulation also takes a while and when Jonathan isn't writing it himself it's not always optimal. So what's the tool we have left and our tool is we try to get the right people in the room and say guys let's solve this among ourselves with the right engineers in the room from all the different relevant stakeholders so that we can demonstrate that this is a solution that can be solved by coordination collaboration rather than waiting around for long drawn out legal processes or regulation. We have two ongoing initiatives that might be of interest to you guys right now one is on everyone's favorite topic vulnerability disclosure. We know that this is not a new issue but on the other hand the cliche that everyone is now a software vendor really is true and there are a lot of organizations that have never had to work with researchers before so we're bringing together security researchers, vendors middlemen, everyone possible and saying hey how can we equip companies and organizations around the country and even around the world to know what to do when someone knocks on their door and says hey there's a big problem in your system and we can help you solve it how do we get people along that path. The second initiative which we've just announced is around everyone's buzzword favorite IoT security. It's sort of recognize that one everything is going to be connected sooner or later and two security is a giant flaw. No one's really building it in right now. How do we start that process? How can the government promote a better marketplace for that? So we're starting with a small debate and say hey patching seems like an important issue but there isn't really a universal definition for what it means to be patchable. So let's get some tech engineers, people who make products, consumer representatives, security researchers in a room and say what are the different dimensions of patchability. Here are all of the technical details. Here's the user experience here's the connectivity issues. Let's build a taxonomy and then try to collapse that down to a small set of definitions. There is no one size fits all. And from those definitions have a couple of words that we can tell consumers don't buy a smart widget without this on the box. Voluntarily. This isn't the government saying don't do this. This would be consumer reports or a budge or someone else saying hey look for these words but these words are backed by a couple of paragraphs of technical specifications. And by the way if you lie about what's in your box we have some colleagues in government who know how to take care of that. So if you're interested in talking about IoT security or patchability disclosure we're very happy to have you engage. And we hope you do because when we meet it we say it's multi-stakeholder. Whoever shows up gets a voice to weigh in and make sure that everyone else can hear what you have to say. Thanks. So let me touch on the FCC briefly and then again open it up for questions from the microphones. So the FCC is the federal regulatory agency for communications, infrastructure and services and that includes communication, security and privacy. So in the US legal system the FTC is sort of the closest we have to a catch all data regulator but there's a lot of sector specific regulation. So for instance our colleagues at the Department of Health and Human Services deal with medical security and privacy. FCC does communication, security and privacy. And it's an independent agency in two senses. The first is we're not within one of the cabinet departments and the second is the commissioners are nominated by the president and confirmed by the senate. But they don't report to the president. So if the president wants to provide input on an FCC proceeding he writes a comment to the agency just like any of you can. So the independence is very real. The FCC's core function is independently proposing enacting and enforcing rules. So it's a little bit of a blend of the three branches of government. We say first here is what we think the law should be on this issue and then put it out for comment and any of you can write in and say why were right or wrong. Then the FCC finalizes those rules and then ultimately it becomes a job for where I set primarily the enforcement bureau to make sure those rules are followed. So the FCC's authority in communications covers a range of technologies. Radio and all sorts of RF emissions. Television by their broadcast or cable or satellite or fiber or whatever is next. Telephone of course and the agency's recent focus has been especially on broadband internet. So you may have seen the term net neutrality somewhere or other. I'm just going to guess this crowd's heard that one before. So the FCC proposed strong rules to protect the open internet and just a month and a half ago the DC circuit concluded that those rules were consistent with federal law and net neutrality is the law of the land. So much of the net neutrality proceeding focused on the kind of economics of innovation online but at the time the commission said we know we're going to come back and look at security and privacy. Do more rules on security and privacy left that open for another day. And so earlier this year the commission proposed rules for ISP and security and privacy saying ISP should be transparent about their practices should have reasonable security protections in place for your data and that you should usually have choice and opt in choice if your ISP wants to repurpose your data for advertising or anything else. We've also been vigorously enforcing security and privacy protections that are already on the books. So for instance earlier this year we settled with Verizon for tampering with their customers internet traffic to insert their unique identifiers that made them trackable online. There was over a million dollar fine but more importantly Verizon agreed to make the practice opt in for any of these headers going out to third party businesses. We've also done data breach cases against AT&T in Cox and just earlier this week you may have seen we reached a settlement with TP link a router vendor over selling some routers that could be modified to create radio interference but an important part of that settlement was TP link committing to working with the open source community and chipset manufacturers towards bringing Linux support, custom firmware support onto their routers. So even when we're kind of operating in one of our kind of classic areas we're trying to make sure to promote innovation and make sure that sort of the freedom to tinker is protected. The freedom to lawfully tinker my boss likes to point out. Let me close by touching on some of the exciting work in progress we have. So just recently the commission set up the sort of licensing infrastructure for upper microwave spectrum. Now upper microwave spectrum I knew nothing about before coming to the agency. Turns out the technology is now there to make this very useful spectrum and it's widely believed to be an important component of 5G wireless technologies. So the commission set out its security expectations for the spectrum and plans to address 5G more fully soon. Those expectations include that there be a routing security and for voice calls and text messages, security from one communications device to another communications device. We think that's what the use of the spectrum should look like. And if you'd like to hear more about it one of my colleagues Admiral Simpson is going to be doing a presentation at the Internet of Things workshop here at DEF CON. He's also done quite a lot of work recently to address robo calls. The chairman sent out letters to the major telecom firms saying he expects immediate action. AT&T has taken up the charge. They're leading a new multi-industry working group to deliver actionable results including new deployments of call authentication standards, new efforts to make sure phone numbers like the IRS mainline can't be easily spoofed and efforts to build compatibility interfaces so folks can bring filtering like spam button technology into the phone system. And then I mentioned earlier the agency has been working on security and privacy rules for ISPs. We proposed those in March the comment period closed recently and so that remains work in progress. So that covers what I wanted to cover for the FCC and again this is your session. It's going to be mainly Q&A. So there's a microphone there and a microphone there and by all means line up and we'll take your questions. Thanks. Start over here. Yes I imagine this is for the FCC. I'm wondering what is your time frame for the telecoms to harden their system 7 vulnerabilities? So we work closely with the telecoms to implement better protections across their networks including SS7. The commission hasn't put out a firm timeline on that particular issue but an important part of the 5G communications work that the commission is doing is saying here's the way we think the world has to look going forward obviously we're not going to tell companies how to build their networks but we're going to set expectations and we're going to work with them to make sure they meet those expectations and for now that's an ongoing conversation but the commission does have regulatory authority and can always be firmer if that becomes necessary. Over on the right. Hi. This question is for the FCC. What are some bits of advice you can give to private citizens so that we can be impactful during the request for comment stage? Lately it's becoming an increasingly politicized event with large corporations lobbying excessively hard and we don't have the monetary resources to have our voices heard and we as technologists know that some of the things that they're doing have led to stagnation of broadband in rural areas increasingly nasty behaviors like with Cox trying to do the opt-in service for additional privacy and it's just it seems that it's getting worse in some ways. How can we have our voices heard? Thank you. So let me start with the FCC component of this then I'm going to hand it off to Alan and Eric to address getting your voices heard in the processes they work on. FCC's usual process for doing a rulemaking is we issue something called an NPRM, a notice of proposed rulemaking where we say here's what we think the law should be in this area and then there is a usually about 30, 45 day comment period then another equally long reply comment period then there's some period of internal decision making, stakeholders can continue to come in and meet with the commission, continue to write letters to the commission and then ultimately the commission proposes final rules then usually someone sues and then finally after a judicial review the matter is settled. So that's the process as we're making sure your voices are heard we'll have to be careful not to comment on any ongoing proceeding. I think it's fair to say that I've been really heartened to see how the process works being in the agency. Smart comments get noticed and if you come to the conversation with something new to say and especially if you have some real data to bring to bear it gets noticed and so sort of the best advice I can give on how to contribute to the debate is make sure that what you write is not duplicative, ideally doesn't use curse words at us or something like that and gives us some really constructive input. Those comments get singled out. Let me also add just as a purely procedural matter, make sure you're commenting on the right proceeding. Every so often folks will file comments in the wrong place and the system at FCC has recently gotten a lot better for filing comments. We have a whole new online comment filing system but make sure you file in the right docket and make sure the issue you're writing in about it is appropriate for that docket. So sometimes folks will have really smart things to say and really great data but it's just not germane to the specific issue in front of the agency. By all means call that to our attention. Feel free to kind of reach out to who you think is the appropriate contact at the agency but it's easy for it to get buried in a docket if it's not germane because someone will review the comment and say it just doesn't bear on this particular proceeding. So that's a kind of procedural note. Okay, so now over to Alan and then Eric. So as an example of a comment process that I don't know how effective it was, a few months after I joined the Department of Commerce last year I get a call from one of my colleagues in a different part of commerce called the Bureau of Industry and Security. He says, hey, we're about to release a proposed rule based on this arms control agreement known as Vasinar. So we had some discussions and we helped prepare them for the fact that they were going to get strong responses. And we did get a lot of responses and many of those were really helpful. This was a case where industry and the security community were on the same side but they brought two very different perspectives that was very helpful. It's challenging because often people were commenting based on news stories that were based on other news stories and so by the time they filed their comments it wasn't something that was directly related to the regulation because a lot of this stuff is quite technical. So as Jonathan said, make sure, have as much preparation as you can. But this is an area where we got the comments and they were overwhelmingly negative. I think there was one comment in favor out of over 200. And so the US Department of Commerce worked with our government colleagues and has gone back to Vasinar to try to renegotiate. And so that I think is an example of feedback from the security community driving policy in the direction that it should. And so as you are preparing to engage, it helps to talk to other people. If you have colleagues or friends who are engaged in the policy network they'll be able to give you a little bit of background. If you're curious at least in our case, I don't know if the FCC can do it, but in commerce we'll talk to you about what we're looking for so that you can tailor your feedback to give us the insight that we need to make good decisions. There are lots of organizations out there that are engaged in a lot of these issues, whether it's EFF or I am the Cavalry we need more advocates for security as a unique value. So please try to engage and learn as much as you can and then give us as much feedback as possible. So I'll just briefly add on, it's actually a bit of an outside perspective. So I'm not in a regulatory agency now at GSA. Before this I was at an NGO and non-profit called the Sunlight Foundation that does open government and transparency work for about five years. And I worked a lot on trying to make the regulatory process more accessible to people because I watched many different times where people leave the opportunity on the table to comment on a regulation. And I'll tell you that the people who will always comment on a regulation that affects them are affected businesses or the private sector, not very often comparably do you get real public constructive input on things. And it's not always well known that, and this is distinguishing from a lot of other countries in the world that in the US executive agencies that are issuing regulations must respond to every unique comment they get. They have to at least acknowledge it in some way. And I've read many final regulations that went down and addressed all the different groups and notable comments that they got and changed their minds on small and large things as they went. You don't always get your way, but when you participate showing up really does matter. And that was my personal experience as an advocate and like open government lobbyist working on these issues that showing up is everything. So I really do encourage you to, I mean the Federal Register, if you go to federalregister.gov, they actually added in the last few years a number of really great alerting and feeds systems for you to follow things more easily. It's actually a really great team that built federalregister.gov they were invited by OFR to do it after they did an app contest as an outside group of developers trying to reimagine what federal regulation and commenting should look like. And that is and there are other services that will help you do that. I just strongly encourage you to take that seriously. I'll just add that at the FTC we often are looking for public input usually when we announce that we're having a workshop there are opportunities to comment both before and potentially get on the agenda as well as after the workshop. And we are very much interested in people who bring us data. We want data, we want empirical results, not just the opinions which are nice too but if you are a researcher who can bring us data that's something that we are going to be very interested in seeing. Let me amplify that point before moving on to the next question. We hear a lot from lawyers in the government. We don't hear so much from technical experts and so that sort of input is incredibly valuable and it gets noticed. So you mentioned that the DOD now has a bug bounty but for sort of an opposite perspective one of the things that I do is run census.io and other scanning for security things. And five years ago when we started the DOD sent us a very strongly worded email saying you'd better stop scanning us. That means we can't participate them with them, we can't tell them about vulnerable TLS implementations. So how do you engage with the DOD beyond just submitting to their bug bounty? That's a difficult question given that none of us are from the DOD. We're probably not going to be able to give you the answer that you're looking for but in general the closer you get to communicating with subject matter experts inside different agencies the more you get answers that make sense and creative solutions to different problems. The DOD Hack the Pentagon program was started by the Department of Defense Digital Service which is a relatively new team inside DOD. It's part of the US Digital Service which is a White House initiative that has created digital service teams in a few different agencies but that's about the best I'm going to hire. Maybe anybody here is going to be able to give an answer to that. I think just large organizations are not monolithic and so as we said the closer you can get to the people who engage the better in the private sector we work with large companies inside our process on vulnerability disclosure who are trying to figure out how can we work with researchers even as their general counsel's office is writing comments about how we need to bring back DMCA controls on their products. So the trick is to find the allies in any organization that you can. I think this panel probably is a great way to start to find the right people so good luck and thank you for reaching out. Thank you also for running census.io. GSA 18F uses that data in our work all the time I personally use it in my work to understand the government surface area and to report things to other agencies as necessary and then to work with them to fix it. So I'm a student who's going into my senior year at high school and I was just wondering how did you guys get into the federal government and how could a prospective student also get in. Thank you. Go down the line. So one, I think there I'm going to speak for everyone to say we desperately need smart, passionate and technically aware people in government. Desperately need them. And the advice I would give is it is fairly easy right now to go from the technical world into a policy track. My background is in computer science, wasn't very good at it so I have my Ph.D. in policy and when you're meeting, so it means I'm a mediocre economist and a mediocre coder and when you're mediocre that many things end up in Washington. And I was an academic and then someone talked me in but I think the advice I would give is stay on the technical side as much as possible but engage in policy in your spare time and eventually you'll find an issue where you can find the right person and weigh in and they'll say we need you on our team. Yeah, I mean so as somebody who went primarily my background in software engineering I have a CS degree but I work a ton on policy day to day now. It's really as simple as becoming an expert in something and being willing to talk about it publicly, privately, leadership without fear and have confidence in what you say and really develop your skills as a communicator. Being a good writer is just a universal skill that will make you more effective at bringing people into your way of thinking projecting that you know what you're talking about and that's something that even if it's not going to be for even if you don't end up working on policy for some amount of years take the time to keep exercising those muscles to keep writing and to keep getting feedback on that and to keep becoming a good communicator. So I started my career working in AT&T and was doing research on privacy mostly and I actually presented research to the FTC 20 years ago. I went to their workshops and when FTC staff said can someone explain again how third party cookies work? I would take time from my day to call them back and to explain it yet again and basically became known to them as someone who is willing to explain these technical concepts in plain language. I then became a professor at Carnegie Mellon and have steered my students and their research to trying to make our research relevant to some of the policy needs and submitting our results to government agencies. Until right now I'm actually on leave from Carnegie Mellon and the chief technologist position at the FTC tends to be an academic who comes in for a year or two. The other point I want to make for our high school student friend is that if you know that you're interested in government service there are scholarship opportunities for you. So scholarship for service, basically if you are a US citizen and have technical interests you can get the government to basically pay your tuition in exchange for you than committing to do some work for the government and so it's a great opportunity. To amplify something Lori said it's about explaining things to other people. The community that we're all a part of here, this conference is tremendously huge even just this room is filled with people. This is a large amazing community and you could spend years, you could spend your entire career communicating to and within this community and go very far but there are certain kinds of things and certain kinds of impacts that require you to speak outside this community and to make your work accessible and approachable to a larger set of people because even a lot of people who aren't professional information security folks, rational privacy folks have an interest in that aren't dumb and are intellectually curious and are willing to apply and integrate that stuff into their work. So it's something to remember too that even though you may not ever have to you may never be confronted in your life with the time when you have to communicate with your community, there are certain kinds of work that you really should do that. So I'm also a loner from academia I'm on loan to the FCC from Stanford. Go Bears! We can't all go to school at a country club so I'm at a different stage in my career from Laurie of course. I hope to be faculty in the not too distant future but I'm just rotating out from grad school and so I want to note their opportunity is absolutely at that stage of your career coming out of academia. If you don't know what you want to do next you're going to take a little gap between what you're doing in academia and whatever comes next. The government has great roles there there are a bunch of great opportunities straight out of college, straight out of grad school there are programs to support that more programs are coming online all the time. They're also wonderful internship and fellowship opportunities to explore. Even with a six month or one year stint in government you can have a tremendous amount of impact. Or a summer internship which we actually have three summer interns at the FTC in technology roles this summer. I really want to emphasize Eric's point about communicating with folks in government. I think having worked on both sides and I guess I should come clean I'm also a lawyer. The way in which folks communicate in the hacker community is very different from the way folks communicate in government. And better for worse but learning how to sort of speak Washington is really really important. That's something you can learn in advance of coming to the government and it's a great skill set you can pick up if you spend some time inside the government. Yeah over on the left. Great thanks Dan Tynan for The Guardian. I have a question for all the panel members and it's kind of a general one. There's been a lot of speculation lately given the hacks for the DNC and Hillary Clinton's campaign that the actual election could be hacked. In particular by a certain nation state whose name begins with R.  How worried you are about this happening and if so what worries you most? So remember when I was talking about learning how to speak Washington is? No comment? Yeah it's not I mean I don't think it's not really any of our certainly not my area of expertise here. So I'm going to use this as a pivot which is the other aspect of engaging with policy is to know when to say that's a great question but I don't know. Let's bring in actual experts and fortunately since 2000 there's been a lot of great research on security of electronic voting machines and I don't know the obvious people here but there are a couple of great professors out there. The other lesson I would take away that's highly policy relevant is if you really are interested in this go and volunteer for your local elections board. You will be the only person there under 70. The 70 year olds are wonderful and it is a great way to learn how complex technology and the bureaucracy and the ideal high level goals of democracy all work together. So if you are interested in understanding the security of the election system get some on the ground experience while you're hacking your election device as well. I've been an election judge in Pittsburgh for the past 10 years and it's a really interesting and eye-opening experience I definitely recommend that. First off thank you all for coming here today I can't imagine it's exciting to be told you're going to be at DEF CON and it's representing the feds but thank you for coming. Appreciate that. And that being said I did two questions mainly for the FTC. Where do you see the breach insurance industry going and do you see that's going to drive private sector up in their cybersecurity game because we know legislation ain't going to do it and is that a growing stagnating industry? So that's my first question. The second question is you said a minute ago you want smart and passionate people but the government culture tends to bring out a least performance necessary attitude. Is there anything being done at the executive level to change that culture? Yeah, so on breach insurance once again I would say that I'm not an expert in breach insurance and I'm not really sure. On the issue of getting smart people to want to come to government I think that the administration has made a number of pronouncements about wanting to do this saying that you can wear t-shirts and jeans to work it's a good start but that's not enough just along those lines. I think that within our agency we're an agency that's mostly attorneys and it's set up to work the way attorneys work and as we are hiring more technical people we're saying wait we may need to do things a little bit differently for our technical folks so that this becomes the kind of place that they want to work and where they can thrive and I think the leadership is very much open to that. I want to add something on the culture change. So 18F is a new office we're about two years old in the GSA and one of our missions there and the rest of the government is to work on that cultural problem to attract people to government and also to make it a great place to work for people. I'm actually I really enjoy my job at GSA it's actually the nicest, most humane place I've ever worked in terms of remote work, in terms of having being in the cloud for email and docs and calendar for having really nice people to work around me to have computers to deploy things to etc and that is that's a really valuable thing. There's something that's really dangerous though that I know we have encountered and I have encountered is that it's very tempting to talk about culture change as people change and to talk about problems that you perceive in the government as problems with the people but it's really not the case and the government turns out to be filled with a lot of really smart, well-meaning people in some really terrible incentive structures with a lot of fear that drives executive level decisions like fear of being criticized, fear of being punished, fear of being hauled in front of whoever and that is it's that thing that you have to attack through transparency, through a little bit of courage through changing incentive structures as necessary to re-interpreting or rewiring rules around hiring, all those things and yes those things are all being worked on at the executive level and at the rank and file level in different ways it is just a big problem. The US government is the largest organization in the history of mankind and it's very decentralized but it is being worked on all over. The only thing I would add to this is somebody who's quite new to government is some advice that was given to me when I was first approached is your first boss is really helpful and I'm lucky and I think many of us are lucky to have fantastic supervisors who recognize that doing Meet the Feds and something like that is really important to the missions of the policy that we're trying to change and so if you are contemplating joining government think a lot about your supervisor and what that relationship is going to look like because a great supervisor just makes your job a lot more fun. Hey, my question is what kind of metrics or data points do you guys capture to make sure that your organization is safe or secure on the right track? Sorry, could you repeat the question or Jonathan maybe? Yeah, so what kind of metrics or data points do you guys capture to make sure that your organization is safe or let you guys are on the right track? Yeah, sure, so it varies. In terms of monitoring your own systems, people use all sorts of different scanning tools, people use all sorts of different metrics at the kind of costs that are incurred on those systems. I know that one of the things I work on is measuring encryption presence and quality around the government and around 18Fs and GSA's systems especially using all the same tools that you all probably use, things that are based in libcurl, things that are based in SSLIs, we use data from Z-Map scans of the internet, we're running in UNIX-based environments and doing that same sort of work and so we use the same tools that you all do and use that to improve our work. So I believe we're getting the signal from the goons that it's time to wrap up. Thank you all for your questions. We're going to stick around for a few minutes to allow additional questions outside if you're not inside. Please go on that exit door on that side of the room. Thanks again. Thank you.


Hi everyone. I'm Alex. I'm very happy to be here at Kubicon North America to talk to everyone about the Harbor Project. It's a shame that this is still a virtual conference and we couldn't come in and share this in person, but I hope everyone is doing really well. And thank you for tuning in. So today, my co-presenter and I will talk a little bit about the Harbor Project. This is a graduated project in CNCF. And if this is your first time attending a Harbor session, think of it as a registry, a place to store and manage your container images and other cloud-native artifacts. Possibly you're using Helm charts, you're using singularity files or something else. But for the purpose of this session, we're going to be focusing mostly on the latest and greatest of the Harbor Project. So focusing on the latest version 2.1 release as well as some of the things we're working on for the upcoming 2.2. We're not familiar with what an image registry does and have never been exposed to the basic set of capabilities that Harbor provides. Please check out our website and check out talks at previous Kubicoms where we've always had an introductory session that sort of starts with what is an image registry, what does it do, why do you need it? So that can be really helpful. So quick introduction. I'm Alex Xu. I'm a product manager in the cloud-native team at DMR leading the Harbor effort. So responsible for trying to understand the requirements around the container registry. For responsible driving the roadmap, collecting feedback from you guys and making sure that we're building something that people will actually use and will actually want to recommend to their friends. And today with me is my co-presenter, Daniel Jiang. Hey, Daniel. Hey guys, this is Daniel. Yeah, I will present with Alex Xu. Today I will show you a few co-demos regarding the latest feature we did earlier in working 2.1. I'm working for BMR as a staff engineer and the maintainer of Harbor Project. Glad to meet you. Thanks, Daniel. We've also listed two of our colleagues who helped us with this presentation. So shout out to Steven and Steven so as well. So we, you know, we started with the intro slide. What is Harbor? Well, Harbor is a trusted cloud-native registry that can store, sign, and scan content. So it's basically a place to host and manage your artifacts. And, you know, when we started this project back in 2014, building an on-prem registry, leveraging Docker distribution, we came across some issues, right, when we were using Docker Hub and other public registries. So over time, we've, you know, addressed those issues and also added more services and features related to lifecycle management, security features like scanning and signing images. And recently we've been focusing on image distribution through P2P and proxy cache. And now we're focusing on high availability, delivering a highly available Harbor cluster through our operator. So our mission is to be the best cloud-native registry for Kubernetes. And we started with support for Docker images. We expanded to Helm charts. And with Harbor 2.0, we can now support any OCI-compatible artifacts. So let's start by looking at the community, which is thriving, doing really well. So we have more than 13K GitHub stars. We have 200 plus committers, 50 plus contributing companies, more than 4,000 forks. We have 14 containers across five different companies, across three different continents in North America and Europe, in Asia. We've also seen a lot of diversity in our contributors as well, in terms of backgrounds and skill sets from developers to DevOps engineers to system admins and basically everyone in their team has needs around a registry to manage their artifacts. So we're extremely happy about this. And we want to thank you guys for all the work you've done. And thanks again for tuning in. And so I want to just quickly jump into this and start with some of the things that we've been working on for the 2.1 release. The first one I want to talk about is called proxy cache, which is the ability for Harbor to act as a pull through cache for another remote registry. And, you know, that's usually we call that the target or the remote registry or the upstream. This is basically situations where you have a registry that you're trying to hit, but you have either limited connectivity or no connectivity to that target. And this could be because of compliance or because of security issues or limited egress options. And so Docker Hub is a really great example of a client registry of a target registry they're trying to hit, right? Docker Hub is a registry where Docker clients from all over the world are trying to pull images from. But if you're pulling too fast, or you're pulling too frequently, then you can trigger the Docker Hub rate limiter, which can follow your connection or even get UIP banned. And so Harbor as a proxy cache is meant to address this very problem. In this case, it means that Harbor will serve as an intermediary to pull the images and cache them locally for you and then serve it to you to serve it to the Docker clients. So it's much faster and, you know, it minimizes going over the network unnecessarily and prevents you from getting IP banned. So the way to utilize this feature is basically, as you would when you're creating a Harbor project, if you're familiar with that workflow, there's an added option to enable it as a proxy project where you would have to then put in the, select the target registry endpoint. That's the endpoint that you're proxying for. And so when you want to Docker pull from that remote registry, you will Docker pull from the proxy project instead. And every time you do a poll, it'll kick off a request to Harbor, which will kick off a request to that upstream registry and do a comparison to see if the image in its cache is indeed the most up to date copy. If it is, it will just serve the cache copy and if it isn't, it will repoll, recache it and then serve it to the Docker clients. So you will have to modify your Docker pull command in your pod manifest to hit the proxy project instead. So the second project or the second feature I want to highlight is called non blocking GC and it's called non blocking because prior to 2.1 corruption collection will put the registry in read only mode. So you can still interact with your existing artifacts in Harbor, you can still, you know, use the API as you can still use the web console. You can still run, you know, certain policies. You can still pull the images, but you can't push images and you can't delete them, essentially for the entire duration of that GC execution.  So, you know, it's completely runs completely silent in the background with no impact to user operations and you have to worry about, you know, data corruption or anything like that. Data corruption is, you know, it was a potential concern for us because of the way images are laid out and stored in distribution. They're essentially, you know, this is owing to the cross referenceable nature of the distribution with image layers are stored in the most efficient way possible with no redundancy. They're essentially deduced across all the projects in a single Harbor instance. So it's really great from a storage perspective, but you know it can be tricky from from whenever you're doing something destructive like running garbage collection or you're deleting images. And the way we were finally able to achieve this was, we're essentially snapshotting all the image layers that are marked to be deleted, and then sort of continuously tracking and resolving these against any incoming image blobs as part of a push request while GC is running. So it's quite an important feature from an operational standpoint. It's very highly requested by large enterprise users that have anywhere from hundreds of gigabytes to we've seen tens of terabytes of images stored on each Harbor instance. And, and because you know GC can be quite time consuming, depending on how often you run it. If it's placed in read only mode for an extended amount of time. And on top of that there's no way to tell how long that job will run for or how much disk space you will it will be the allocated from each execution, you know that can be problematic and it can be quite stressful. Right so imagine if you're in the software delivery business sort of software supply chain business where all the images are landing in your harbor instance and you're the one responsible for distributing these to your customers. And so that's why we've added the ability to perform a dry run which will give you an estimation of the amount of disk space. And so by making it non blocking, not only is it, you know, not incurring a penalty on your user operations not only is it running in a faster and more efficient manner. But you know, the time it takes to run GC is no longer as much of a factor it's no longer as debilitating to your business. If it goes over, you know, if it goes runs for for quite some time right.   So let me stop sharing. Let me make sure that's still recording. Okay. Yeah, it is still recording. Yeah, so let me get started. Hi guys so the first time I'm going to show you is proxy cash I need to use the recorded demo due to the instability of my network. Let's move on. So in the proxy cash to implement it we reuse the code of replication. So the user experience also has some overlap for you to create a proxy cash project first you need to create a registry endpoint. The same way as you created for a target registry create a target registry for a vacation. So in this case I just created a Docker hub endpoint with my personal account. And I can create a new product. Note that in this dialogue, there is a new switch of proxy cash. I can switch it all and select this endpoint I just created. Yeah, after that, this will be the proxy cash project plus images from Docker hub. Know that this is an empty product no images. And if I issue a Docker pool command against this proxy cash project. Here I want to pull go hover slash hover core images from Docker hub via my proxy cash product. I just append this relative uri to the uri of my project of the hover instance like this. And if I start pulling, you can see the images is serving directly via this proxy cash from Docker hub. Okay now at the same time under the hood there in the background there is a go routine to write the content of this image to harvest storage. And because it's asynchronous you need to wait a couple of seconds when you refresh, and you can see that there is a repository hover core and the image. Note that once this image is stored in hover storage, it's the same as the images you pushed to hover. You can access all the information and you can do all the stuff to this image such as scanning or adding text removing text. Here I simulate outage of Docker hub by messing up my DNS so that my hover instance cannot access this Docker hub, and you can see the test connection the ping doesn't work now. If I remove this image locally and pull it again from my Docker client. A hover will do the best effort to sync with the target registry but in this case, it is not accessible so hover will serve whatever is available locally. So in this case, you can still get this image that is cached in hover. We can see there is really helpful for you to alleviate the problem caused by the red limiting in the Docker hub. It's also worth mentioning that this proxy cache project. It has all the capabilities except for pushing, has all the capabilities of a regular project in hover. For example, you can use the code policy to control how much images can be proxied. And you can also set up this tag retention policy to remove this style stale image cache. You can serve and store the new proxied images. That's the demo for the proxy cache.  So as Alex mentioned, when we implement this feature, instead of relying on the Docker distributions code, we use this data in Harbor's database as the single source of truth to help us decide what layers should be removed and how much space will be freed is also available. So when you hit the dry run, we just mark the layers that are candidates to be removed and calculate the size. And we can provide a hint for the admin to let him know how much space will be freed if he run the GC right now. No, this is a very rough estimation because this is a non-blocking GC. So images may be pushed when the GC is running. You're going to see now. If I trigger the GC now, you can see the job is scheduled and it's running. You can notice that there is no longer the warning bar saying that Harbor is in read-only mode. And at the same time, I can do a Docker push to my Harbor instance while it's being garbage collected. Yeah, it's still running and pushing this in progress. It's an instance on AWS, so it's a bit slow. Okay, you can see this garbage collection is also finished. If we see the lock, you can see what layers are removed and there is actual size of the storage that is freed by calculating what layers are removed. This is a big improvement for the admin so that they will not need to worry about their developer not being able to push images during GC. Next step, we may improve by considering to improve the performance of GC by doing the deletion in parallel. But this is not that an issue because it's non-blocking. So if the GC runs a little bit longer, we consider it's okay. That's all my part. Thanks. Thank you, Daniel. I'll continue with the 2.2. So let me make sure it's still recording, yes. Let me share my screen. Can you see my screen? Okay, so let's continue. So thanks, Daniel, for that demo. Switching gears a bit now. I want to talk about the upcoming 2.2 release and some of the things that are being planned and being worked on. The first one is metrics and observability and this is really just a fancy way of saying we're going to be supporting Prometheus. So the goal is to monitor services deployed actions performed as part of your target deployment and expose those metrics through an HTTP endpoint for Prometheus. And so if you have Prometheus already set up in your environment, if it's already part of your stack, you can then scrape whatever data you want off that endpoint. We're going to make it highly customizable in terms of the kind of data you can retrieve. And when you think about key telemetry, telemetry can be divided into several layers. At the very bottom, you have the platform, which is your node level information and you can monitor your resource consumption. So CPU, RAM, disk, basic event logging, health status of the deployment as a whole. And then you have the container orchestration layer, which in the case of Kubernetes will provide monitoring for all the pods deployed in your cluster. You can see in the diagram we have some of the main pods that make up the harbor cluster.  So the web portal has its own engine access, its own chart museum. If you're using trivia or clear image scanners, they have their own. And then finally, we have telemetry at the application layer, which is basically the relevant registry operations and the thing that the harbor API provides is a potential candidate here. And we can potentially expose aggregated statistics over some period. So looking at the number of image pulls or a number of images pushes, image deletions. Also looking at top images, repositories, projects being requested. Possibly looking at, you know, number of push errors or delete errors or authentication errors. And, you know, any other statistics that could be useful for detecting abnormalities, right, like users, number of users logged into a particular instance, number of failed attempts, unique IPs, number of image requests served in some period, requests in flight, number of replications. So this is still being actively worked on. I think the PR to the proposal in our community repo. If you have any questions or comments or want to contribute to this work, please, please make comments on the PR or just reach out to us. So we've also got a lot of requests to deliver system level robot counts, which is a robot account, scope to the harbor instance level, so it has access to multiple projects, as opposed to the current robot implementation, which is scope to a particular project, right, if you're familiar with that, how that works, you're creating the robot count from within the project configuration page right now. And, you know, that's that's also understandable projects go permissions become an issue when an image in one project is expected to extend an image in a different project right which is not the case if you're using images within harbor as part of your Docker build, and you're executing the doctor builds in multiple stages. Each from instruction would use a different base image and built iteratively. So that's exactly we're going to be delivering in the 2.2 as the system admin persona. You'll be able to create system level robot accounts in addition to project level robot accounts which are only available to project admins. And then, you know, you can choose the projects that that robot account that particular robot account has permissions to do during the creation of their robot account. You can also choose the particular set of actions actions that they can perform. So like pushing image or pulling image deleting images and much more. And then you'll be able to change the set of projects and the set of actions at any given time without having to recreate a robot account with a new token right which is the experience right now. So if that token is hard coded somewhere into your CI, or it's being used to construct a poll secret and used to be manually recycled right now so we're trying to kind of. We're trying to remove this kind of friction so that changing the project scope or changing the permissions of that robot will not impact your CI in any way. So again, this is being actively discussed and being worked on. I've linked the PR as well to this proposal in our committee repo. If you have any questions, comments, please, you know, share your feelings on the PR. If you have already implemented your own solution, we'd be really interested in hearing that as well. And finally, if you've been tracking our progress or attended any of our community meetings over the last six to 12 months really. So you know that we've been working on an operator deployment of Harper that will, you know, run it as a Kubernetes cluster, sort of similar to our help and deployment right now but it has certain advantages when it comes to the day to operations and it's also much more intuitive for performing some of the more heavy duty operations like upgrades redeploys backups and restores. And to give a little background, this really started with OVH cloud. I want to give a shout out to OVH for kickstarting this effort and doing a really great job. OVH cloud team built the first version of the Harbor operator. And you can find this as the core operator repo under the Go Harbor project on GitHub. But it doesn't include certain dependent services like databases, Redis cache or storage because, you know, some vendors already have those services running as managed services. And they're perhaps already deployed in a much more highly distributed or highly available manner. And that makes sense right that's that's definitely one use case that we have to we have to cover. But, you know, for the other users that are perhaps not as advanced, that's looking for an all in one deployment that comes with all the components that Harbor needs to run. We have built what's called the Harbor cluster operator, and that will basically deploy Harbor with all the dependent services like database, Redis cache and storage and deploy these in HA mode. So we don't have to deep dive every term every aspect of this diagram, but the key takeaway here is that you can see that in this diagram there's a Harbor Harbor cluster CR at the very top right so there's a there's a Harbor cluster controller. That's essentially managing all the services needed for the registry and the cluster operator custom resource encapsulates the core operator custom resource that I just talked about. As well as the custom resources for all the other individual components. And so the Harbor cluster is basically watching over everything and continuously reconciling to make sure that what is running is is what is actually specified in the CR spec. And so if there are any failures or hiccups, then it can automatically redeploy those services. So now for anyone who's wondering about high availability in the sense of multiple harbors. Harbor clusters across different data centers, perhaps in different availability zones even we do have a story in the works to address that as well, but that's sort of outside the scope of the Harbor cluster operator. I know that there's the people have been asking about it so I just want to address it and say you know this is something that we are aware of and it's something that we're working towards. And so for each of these components you can customize the spec for that CRD essentially right you can specify the number of replicas you can for for something like cash for the red is cash or for the database. You can choose to use an external cash or you can declare in class and run that in a J mode. So we have a really detailed proposal detailed meeting notes on the progress for the cluster operator. Under the Go Harbor project so please feel free to check that out and share your thoughts, you know we're still wanting more feedback on design because we will only have released the very first cluster operator version 1.0. By the time this recording is shared. So that's everything we want to share related to the 2.1 as well as the upcoming 2.2. Just a quick word on collaborating with us and how to get more involved in the community. Please follow our Twitter if you want to be alerted to any of the latest announcements on releases community events collaborations or anything Harbor related. We're still holding the bi-weekly committee meetings, one for us time zone and one for a pack. This is where, you know we have some of the feature demos, like the ones that Daniel just did. And we highlight some of the latest developments in the project and anyone can come to resume meeting and ask questions or share your experiences around Harbor. You can find the detailed meeting notes in the meeting details in the read me for the Harbor project on GitHub. And finally we do have a demo deployed that anyone can just go on and and give it a try get familiar with the UI, create a project, add users, push and pull images to and from that project. So demo.coharvard.io. So that's all I have for today. Thanks Daniel for sharing a demo. And then, you know, we'll take any questions for the remaining five to 10 minutes. So thanks everyone for staying with us so far.


Praise the Lord. Praise the Lord. Everyone of us who plans to be here in another 50 years, praise the Lord. Hallelujah. Amen. I see that many of us want to leave to at least 100 before we leave this earth. I'm especially privileged to be here today to celebrate with you all the 50th anniversary of our church, the Shepherd Hill Baptist Church. As you've heard already, this was my church and I still believe it is my church. And I was Secretary of the Yoruba Service at some point. I'm glad to see that the Yoruba Service is still on, between the hours I believe of 8 or 9 o'clock, for those of us who want an early service. The fathers of this church deserve our commendation, even if posthumously, the likes of Reverend Dr. Adibite, who for many years headed the Shepherd Hill Baptist Church and was the pastor who directed our own affairs here. Here we learned the word of God at Sunday School and we learned so much else, especially from Reverend Dr. Adibite. Listening to pastor Tunde Bakari is always inspiring, always challenging. I've listened to him for very many years, very many years. Before he got on radio, before he got on television, I listened to him. And I think that one thing that you cannot deny is the level of knowledge and insight that he brings to bear in every one of his lectures. And I want to praise the Lord and thank the Almighty God for what God has deposited in him and what he continuously offers to the body of Christ and to all of us as a nation. I was excited of course to hear him rightly divide the word of God on the central role of the church in nation building. I just want to speak for a moment or two and make most of this he mentioned. But I think that some of us who have also been on the inside for a while may be able to speak to the parallels of being involved, some of the parallels or dangers of being involved. The first is that you must not always expect the support of the church even when you're involved. I recall that I was pastor Tunde Bakari at the time when I was being attacked for being a candidate who had to come out to say, are we going to just sit around and preach and pray? If we don't get involved, how are we ever going to make any kind of difference? The problem of course is that the church very quickly reminds us that we are esters. In other words, you are there for a time such as this. But it's easily forgotten that Mordecai who said to Esther, that Esther you are there for a time such as this. And if you don't deliver, if you don't manage to help your people, God will raise somebody else. But Esther said to Mordecai, he said, you now must go and pray and fast for me. And then I will go to the king and if I perish, I perish. Very frequently, the part of it we remember is that you are there for a time such as this. I'm not going to ask how many people have ever prayed or fasted, fasted in particular for me. Members of Shepardu Baptist Church, I'm not going to ask you that embarrassing question because I know that very few hands will go up. The second is the problem of salt. The second period of the second problem is the problem of salt. Pastor Fundebacare said a few moments ago that this is the test that... What we are talking about is a test of courage and faith that every nation builder must face. And he says he calls it the promptings and paradox of destiny. The promptings and paradox of destiny. Years ago, just before I was sworn in as Attorney General of Lagos State, I had been in the church, I became born again in 1994. So this was just five years after when I was nominated to be Attorney General. On a particular day, I was in a small room with about three of the advisors of the governor of the Governor of Latin America, three of his advisors and myself. And we were meant to be talking about some policy. But there was a gentleman in the room who was smoking a pipe. Smoke filled the entire room. For somebody who had been born again for some years, I had not even come across people anymore who were smoking, let alone being in the same room with somebody who was smoking. And smoke was all over the room. My hair was smelling, my body was smelling. So I said to the gentleman, why don't you stop smoking? So that I could have some peace here. Fortunately, I agreed with me, but not before saying, you pastor, that's the way you are. But just as I was about to leave the place, my whole body was smelling of smoke. And then I asked myself a question. Is this thing really worth it? What if somebody from my church, I was pastoring a church at the time, what if somebody from my church were to walk up to me and say, perceive this smell all over me? And I said pastor, do you also, every once in a while, you know. But I clearly heard God say to me that you cannot be solved if you are not going to be in this tube. You can't be solved. If you want to be solved, just as Pastor Pundir Quakriya said, you can remain in the soul shape, you can remain in the cellar. You may not, but if you want to be the salt that Christ said, the salt of the earth, then you must be ready to go in this tube. And being in this tube means that you take the heat too. And there's always a lot of heat. A lot of heat. There is no way in the world, anybody who has served in public service will tell you that unless you are willing to do those things that are, even if you are, you are going to be hit all the time. Your reputation is always going to be on the line.  The fourth thing that I want to say, the fourth period is that, scripture says in Proverbs 14.34, righteousness exalts a nation. We know that our nation needs righteousness. Without righteousness, our nation cannot be exalted. It means that righteousness exalts individuals, it also exalts a nation. But the problem is that if you stand for righteousness, then righteousness will fight back. And it's always a tough battle. Always a tough battle. There is nobody, and I was sharing with a pastor earlier today, that there is nobody in Nigeria who stands for truth who will not be attacked. But if you stand for evil, you will be surprised how easily you will get away with it. Nobody attacks you if you are prepared to pay bribes. If you are prepared to pay bribes in the right places. If you have public office and you are prepared to come, nobody attacks you. Righteousness exalts a nation. But the same on righteousness is what fights back. And that fight can be tough. Especially as in the country where you have systemic corruption. Corruption in all institutions, including the religious institutions, have often been told, you know, whenever something happens and people are worried about it particularly, have often been told, even where somebody is about to be prosecuted for a crime, prosecuted for a major offense. There are those from church, religious leaders who will call and say, you are there for a time such as this. This your brother should not be tried. Or this your sister should not be tried. That's the kind of thing you get. The fifth and last thing is that our gospel, this gospel is a Contrarian gospel. It is a Contrarian gospel. In other words, it doesn't agree with our flesh. It is the same gospel that says, pray for your enemies.  Matthew 5.43 all the way to 46. Then he says, love your enemies.  But I say to you, love your enemies.   And pray for those who spitefully use you and prosecute you. That you may be sons of your father in heaven. For he makes his son rise on the evil and on the good. And sends rain on the ground, with just and on the unjust. For if you love those who love you, what reward have you? Do not even the tax electors do the same. Now the problem is this. The scripture says we should love our neighbors. He says we shouldn't repent. In Romans 12, 19 to 20, he says, Beloved do not avenge ourselves. Don't avenge yourself. But rather keep place to run. For it is written, vengeance is mine. I will repay, says the Lord. So God in the gospel says, bless your enemies. Don't revenge. He says, even if your enemy is thirsty, you must give him drink. If he's hungry, you must give him food. Even if it's your enemy.  A Christian woman. Two of her children. Her grandfather was also attacked. But he wasn't killed. But strangely this woman said to me, she said, we have a duty to bring these people to Christ. So that's why I have to keep praying for them. I couldn't believe it. There she was. She had lost two children. Her grandfather was also incapacitated. But she said, I have a duty. We all have a duty to keep praying for them because we must bring them to Christ. The truth is that if we are going to, if our gospel will be transformative, it is going to be the same gospel that transforms other nations. Then it's a difficult gospel. It's a contrarian gospel. It's not a gospel that agrees with our flesh. What our flesh says is that, curse your enemies. Revenge.  A few days ago I read the account of the stoning to death of Stephen as contained in Acts 7, 58 to 60. I'm sure that we've read that time and time again. And as I cast him out of the city, I stoned him. The scripture says, laid their clothes at the feet of a young man named Saul. As this assault on this man was going on, they were stoning him. And there was a young man called Saul. And they stoned Stephen as he was calling on God and saying, Lord Jesus, receive my spirit. Then he knelt down and cried out to the loud voice, Lord, do not have a bench. Do not charge them with this thing. Do not charge them with this thing. And when he has said this, the scripture says, he fell asleep. The man who orchestrated and supervised the stoning was a fuller than he heard man called Saul. If Stephen had cursed him and asked that God strike all of his persecutors dead, God would have done so. If Stephen had said, Lord, strike this man dead, God would have done so. And the man who was to write two fells of the New Testament would have died. But this great story doesn't even end there. In Acts 8 verse 3 to 4 we are told that as for Saul, scripture says he made half of the church entering every house striking off men and women, committing them to prison. But what then happened? Therefore, those who were scattered, scripture says, went everywhere preaching the word. This is the wisdom of God. The difficulty for many of us as Christians and the difficulty we have with the gospel is that the gospel simply doesn't agree with our flesh. It simply doesn't. It cannot agree with our flesh. And that is why it is that whether in government or out of government, wherever we may be if we are going to transform our country, the gospel as is contained in scripture that would transform our country. It involves self-sacrifice. We are going to be maligned. We are going to be people who will speak evil of us. When Martin Luther King said non-violence, he was attacked from everywhere. Attacked by black men like himself. Attacked from everywhere. Because the gospel, the gospel of the Lord Jesus Christ can never agree with our flesh. That's why it is so transformative. I want to leave us with some words that were spoken today by a pastor, Tunde Bukkari. And this, you know, I think is for me the major takeaway. He said that they said the nation-building mandate however can only be fulfilled by the overcoming power of faith. Faith in God. And I wanted to listen to the word overcoming power of faith because you need to overcome the faith. Such faith is an active faith. Faith that interfaces with its environment, forcefully advancing against the gates of hell and deploying appropriate strategies from activism to policy propositions and from advocacy to active politics and governance. End of quote. The point of the matter is that our faith means nothing if we're not using it to achieve the purposes and ends that God has called us to achieve. Those purposes and ends are the ends of governance. At the end of the day we are the ones called to decipher the nations. We are the ones called to be the salt of the earth. We are the ones called to be the light of this nation. But it's never going to come easy. Never. It's never going to come easy. It's never going to come easy. Anybody who says that one day light just comes and transforms darkness completely and light wins the battle immediately isn't telling the truth. Light has to fight. It's a constant fight. And all of us who have been involved in it those of us who have not been there must pray and fast. I want to congratulate again all of the members of Shepardil Baptist Church old and new members alike and to thank the Almighty God for this great church and for what the Lord has been doing here for the past 50 years. And to pray that the Almighty God will do even more and that all of us will be here to see another 50 years in good health and joy in Jesus' mighty name. Amen. Praise the Lord. Thank you very much for the voice of the Vice President.


Torture is brutal and is horrible, and I've been a victim of, I would say, a mild form of torture. I suppose there are two types of torture that I've experienced. On the one hand, there's the torture which comes about by being in complete and total isolation from other human beings for almost a period of five years, by being chained to the wall, by having no books or papers, by living for much of the time in the dark, by sleeping on the floor for all those years. That could be seen as a form of mental torture. Physical torture, I was beaten and beaten on the soles of the feet with cable so that I couldn't walk for a long time, and I have been through a mock execution. Many people have suffered far, far worse than that. When I was experiencing torture, physical torture, I simply remember thinking, how can you, that is the person who's committing that act, how can you do that?  I puzzled about that. Why? How is it that people can do that? Then further, I realized that torture is not confined to any one particular group of people, any ethnic, religious or whatever group. It can be practiced by the most civilized of people, if you like, or the nations that have seemed to be civilized. I think of the torture which was sanctioned by America in Guantanamo, when it was said that waterboarding was not torture. All I can respond to that is, then perhaps if you say that, why not experience it for yourself first of all, and see whether it's torture or not, and I think you'll change your mind. But I quote the example of Guantanamo, simply to make the point that where this type of act is committed and has sort of a legal sanction, either the sanction of a larger body like the state, or the sanction of a group, such as a terrorist group if you like, then individuals feel as though they can behave with impunity and engage in it almost with a clear conscience, and what has to be pointed out constantly that this form of behavior is totally wrong by the state, if it's committed by the state, or it's committed by a group within the state. It is against all that is decent and right, and also it's ineffective. It does not necessarily get information in the way that people think it does sometimes. I am very much against the use of torture, obviously. What has happened now is, I mean, the whole shape of the world has been changed with this vast migration of largely innocent people who have nowhere to go, their homes have been devastated by warfare. If you've got to take it further back into history also, and you look at the dictators in these countries, these countries were formed by the colonial powers, and we didn't know what we were doing very much in those days when we put together people of different ethnic religious backgrounds and encompass them in a nation state. The only way perhaps that these nation states may be held together was by a strong central dictator. People might hope for a benevolent dictator, but you rarely find them, I mean, going back to the famous dictum of Lord Acton when he said, absolute power corrupts absolutely, and that has, of course, happened, but resolving it by removing them by force, by creating so much disturbance, has created an even worse situation. I think the situation will eventually be resolved in that region, not necessarily by external powers, but by the people of the region themselves. But also we have to look at underlying motive. Why did we act in that way? And there are those that argue, and perhaps there is validity to their argument, that it was done primarily for economic reasons, for oil and to gain control of oil. Well, what has happened? How many people have paid a price for that, and where are we in the world at the moment in a disastrous position? I think today the work of humanitarian organizations such as the Red Cross has been made so much more difficult. At one time, not too long ago, and they really were generally immune from being captured or killed or warfare, I mean, the Red Cross or the Red Crescent was a symbol that said, okay, hands off. This is genuinely an impartial body working for humanitarian purposes, hands off them. That seems to have gone. Now they're fair game. So I think the pressures on people and the difficulties under which people have to work now to fulfill the original objectives of the organization are very, very difficult indeed. And I don't know if we're ever going to be able to restore the situation whereby there was that degree of immunity that was enjoyed until quite recent times. I think there's a possibility it may have gone forever. It's a very sad day for humanity, but it doesn't mean to say that the organization is finished. The work of humanitarian organizations who will be genuinely impartial, free of government pressure is vital. And I would encourage people to support it where there are difficulties and dangerous situations. Yes, of course, to recognize that, but to give maximum support to people who bravely engage in this work, which is a work of peacemaking, peace building, and relief for people in need. Well, I don't think I'm necessarily particularly strong, I'm very vulnerable. But I think one thing really stands out in my mind more than anything else. Someone said to me once, do you ever wonder why most of your life has been spent working for reconciliation? And I thought about it, and then I came up with the answer, well, it's probably because I'm trying to be reconciled myself within, trying to do something for myself as well as trying to do something for others. And I think over the years, probably one has achieved a little bit more in terms of internal reconciliation, somehow bringing yourself together a little more completely. Which when you can do that, actually does give you a strength.


The mustard field, girls from the Sati school wander. And of course, most of you probably know, but the Sati, the right of Sati demands a woman emulate herself on her husband's funeral pyre. This is devoted to a certain Sati school in Rajasthan. The mustard field, plunging into the button blooms, they vanish, swish of departure, delight and giddiness unleashed among the sprays of yellow. Brassika by the hundred have multiplied under the hands of rain, four petaled sons the size of fingernails, brushing against cheeks, festooning the moment. Each girl's bright encounter brings her to tremble, confirm her pluck with hands on another's shoulder or scarf, thrill and nervous hesitation working in tandem, a rushing forward along with a pulling back. The leader jerky with stops, afraid of misstepping. The one behind her, slipperless on the cracked earth and the graceful one with a star of leucoderma on her neck. Through the tunneled secrets of dust mode and bitter honey they glide. Through the flowers that will give way to seeds of premonition, but not yet. Now each second is rinsed by a leafy susserous, the need to venture further than the lasso of adult voices can pitch and bring them back. Now the percussive slap of feet, only the wake of arms in breast strokes, pressing the gold multitudes aside, is visible. They have wandered further than the absences each will grow into, scarf veiling her averted face while mustard seeds spatter from skillets of hot oil years from now. What remains after the pollen dust is brushed off after the slow backbone of light is relinquished is a long wait for virtue. A thumbprint is a glimpse of something that actually happened to my brother-in-law. The moment was all window, driving over a mountain's edge as he gathered fallen peanuts from the NT passenger seat had been predicted days before by soothsayers who read his wife's thumbprint. They spoke of glass blocking the sky and floor. The call from hospital came. She listened through the crackle of long distance, fears flaring open over the thoughts of a single fir tree that had stopped his drop, a spinny of them, verticals swaying, married to sun and water, and rapids below dashed to white shards by rocks one moment, seamless the next. After the call from hospital, silence grew. Silences grew under small sounds, branches of fly beating against glass, leaves stuck in a cobweb, tapping out reports from wind. She swept them together, fueled a fire, and burned the predictions. But random words kept escaping with fly ash, amethyst, dove, bone. The hospital was without anesthetics, needles disinfected over flame. On his return, a squash from a farmer's market swelled so large, the fridge door opened and rolled out, and it rolled out. So the stretch marks deepened into cracks, a full year without rain. She could still hear Soothsayer chants, hovering over the inky dark oval of her impression on paper. Held her knowledge like a tablespoon of epsom salts, fizzing on her tongue, without a drink to wash it down. Going to end with the Afghanistan poem. Afghanistan end of 87. Another true story.  Outside, airwaves lower than sound or shudder, are rattling cups, smashing windows, within a miles wide circumference. In her dream, trees clinging to their blood apricots swell with the darkness of curfew nights. Touch one and it explodes. Her father's vigil is crumpled by insomnia. Was that wind shift or voices shrilling above the crack of footfalls, far beyond view? Dust floats on a cup of water. It is the hour of curtains jerked from grip. It is another month, the slow ache of sky, sinking through his search. Her coat slumped against a tree. He wants to tell her about its bent limbs, elbows of trunk and branches, gestures fed by water and anticipation, all leaning against granitic rocks. When the clouds part, a strike on a thin stock sways back and forth, like a clock keeping its tempo of hunger against the backdrop of a valley bright with silence, a chewed up fruit with her tooth marks. Arrows of distress scatter like nightbirds from the open mouth of falling. In our wind, a half-shout running through it. Thank you. Thank you.