1. Paragraph 8 of the instrument of accession executed by Maharaja Hari Singh provided that nothing in the instrument would affect the continuance of the sovereignty of the Maharaja in and over the state. 2. On 25 November 1949, a proclamation was issued for the state of Jammu and Kashmir by Yuvraj Karan Singh. 3. The declaration and this proclamation that the constitution of India would not only supersede all other constitutional provisions in the state, which were inconsistent with it, but also abrogate them, achieves what would have been attained by an agreement of merger. 4. With the issuance of the proclamation, paragraph 8 of the instrument of accession sees to be of legal consequence. The proclamation reflects the full and final surrender of sovereignty by Jammu and Kashmir through its sovereign ruler to India to her people who are sovereign. 5. Neither the constitutional setup nor any other factors indicate that the state of Jammu and Kashmir retained an element of sovereignty. 6. The constitution of Jammu and Kashmir was only to further define the relationship between the Union of India and the state of Jammu and Kashmir. 7. The relationship was already defined by the instrument of accession, the proclamation by Yuvraj Karan Singh in November 1949 and more importantly by the constitution of India. 4. There is a clear absence in the constitution of Jammu and Kashmir of a reference to sovereignty. 5. In contrast, the constitution of India emphasises in its preamble that the people of India resolved to constitute themselves or to constitute India into a sovereign, socialist, secular, democratic republic. 5. That the state of Jammu became an integral part of the Union of India is evident from articles 1 and 370 of the Indian constitution. It is reiterated in section 3 of the constitution of Jammu and Kashmir which is unamendable. 6. The preamble of the constitution of Jammu and Kashmir, sections 3, 5 and 147 of the state constitution, coupled with article 1 of the constitution of India, read with the first schedule as well as article 370, indicated in no uncertain terms that a system of subordination as understood by the definition of sovereignty exists by which the state is subordinate to the Indian constitution first and only then to its own constitution. 7. All states in the country have legislative and executive power albeit to differing degrees. The constitution accommodates concerns specific to a particular state by providing for arrangements which are specific to that state. Articles 371A to 371J are examples of special arrangements for different states. This is a feature of asymmetric federalism like article 370 which became applicable to Jammu and Kashmir on the adoption of the constitution. The state of Jammu and Kashmir does not have internal sovereignty which is distinguishable from the powers and privileges enjoyed by other states in the country. 8. The limited question before the constitution bench in its decision in Premnath Khol was whether the monarch helped plenary legislative powers after the constitution of India as it applied to Jammu and Kashmir was adopted in the state. But before the constitution of Jammu and Kashmir was adopted, a decision is an authority for the proposition which it decides. The question whether the state of Jammu and Kashmir retained sovereignty upon integration with the dominion of India did not arise in that case. The next issue which we have addressed is the challenge to constitutional order 273 CO273. To answer this issue we had to decide on two issues. 1. Whether article 370 is a temporary provision and 2. The effect of the dissolution of the constituent assembly of Jammu and Kashmir on the scope of powers under clause 3 of article 370. We have held that article 370 is a temporary provision on a reading of the historical context in which it was included. Article 370 was introduced to serve two purposes. 1. The transitional purpose to provide for an interim arrangement until the constituent assembly of the state was formed and could take a decision on the legislative competence of the union on matters other than the ones stipulated in the instrument of accession and ratify the constitution. And 2. A temporary purpose and interim arrangement in view of the special circumstances because of the war conditions in the state. See, we have held that a textual reading of article 370 also indicates that it is a temporary provision. For this purpose we have referred to the placement of the provision in part 21 of the constitution which deals with temporary and transitional provisions. The marginal note to the provision which states temporary provisions in respect to the state of Jammu and Kashmir and a reading of articles 370 and 1 by which the state became an integral part of India upon the adoption of the constitution. 3. On the second question of the effect of the dissolution of the constituent assembly of Jammu and Kashmir on the scope of powers under clause 3 of article 370, we have held that the power of the president of India under article 370 clause 3 to issue a notification declaring that article 370 ceases to exist, subsists even after the dissolution of the constituent assembly of Jammu and Kashmir for the following reasons. First, the provisor to article 373, there is clause 3, encapsulates the process by which the Indian states could ratify the constitution of India. The rural of each Indian state had to issue a proclamation ratifying the constitution on the recommendation of the constituent assembly where such body existed. In states where the constituent assembly was not convened by then, the ruler of the state had to issue a proclamation accepting the constitution. When a constituent assembly was convened in those states, the constituent assembly could make a recommendation for the modification of the constitution as it applied to the state and such a recommendation would be earnestly considered by the union. The words recommendation of the constituent assembly refer to in clause 2 shall be necessary before the president issues a notification as it appears in the provisor to article 370 clause 3 and must be read in this context, thus the recommendation of the constituent assembly to begin with was not binding on the president. Second, at the time of the framing of the constitution of India, it was obviously within the contemplation that the constituent assembly of Jammu and Kashmir was formed for framing the constitution for the state. It was not intended to be a permanent body but a body with a specific remit and purpose. The power conferred by the provisor to article 370 clause 3 was hence something which would operate in a period of transition when the constituent assembly of Jammu and Kashmir was formed and was in existence bending the drafting of the state constitution. Third, when the constituent assembly of Jammu and Kashmir seized to exist, only one of the special circumstances for which the provision was introduced seized. However, the other circumstances that is the special circumstances because of the situation in the state of Jammu and Kashmir for which article 370 was introduced subsisted even after the constituent assembly seized to exist. This is recognized by the judgment of the constitution bench in Sampad Prakash. Fourth, the effect of the precedent declaring under clause 3 of article 370 that article 370 seizes to exist is that the provisions of the constitution which apply to every state in the first schedule would equally apply to the state of Jammu and Kashmir. Article 370 1d and 370 bracket 3 were introduced with the purpose of enhancing constitutional integration and not for the disintegration. So, the power under article 370 1d and article 370 clause 3 even when exercised to its fullest extent does not freeze the system of integration contemplated by article 370 but is rather intended to enhance constitutional integration between the union and the state of Jammu and Kashmir. Holding that the power under article 370 clause 3 cannot be exercised after the dissolution of the constituent assembly would lead to the freezing of the process of integration. Article 370 1d and 370 bracket 3 was introduced with the purpose of enhancing constitutional integration between the union and the state of Jammu and Kashmir. So, the power under article 370 1d and 370 clause 3 even when exercised to its fullest extent does not freeze the system of integration between the union and the state of Jammu. Article 370 1d and 370 clause 3 even when exercised to its fullest extent does not freeze the system of integration between the union and the state of Jammu. Article 370 1d and 370 clause 3 even when exercised to its fullest extent does not freeze the system of integration between the union and the state of Jammu. Article 370 1d and 370 clause 3 even when exercised to its fullest extent does not freeze the system of integration between the union and the state of Jammu.  సఈద్త మిిస్తార్చిన చౕలన ర్త్రూ. ڈΉΦΣΑΌΣΑΝΑΙΤΡΑΚΑΚΑΚΑΓΑΣΑΙΣΑΚΑΚΑΙΣΑΑΜΑΙΤΑΔΑΔΕΑΤΑΖΚΑΘΔΑΚΑΥΚΙΙΣΑΚΑΕΕΤΑΙΟΘΙΑΜΑΛΑΙΤΑΙΤΑΑΚΑΙΟΙΕΟΕΙΛ΍ΑΣΑΚΑΕΕΕΟΟΕΕΟΕΕΕΕ


What's going on guys? It's your boy DPJ here today with another Destiny video and in today's Destiny video I have top 5 locky salute drops of the week and we're gonna get straight into the video. In at number five we have a clip sent in by KGCBully running them strikes for that rep and received three legendaries. Now I have run the Ruck and Dragon strikes thousands of times and never received even two legendaries at the same time. Never mind three this is insane it really is. In at number four we have a clip sent in by MIGAS2003 shows us this great loot received from the lighthouse chest. Actually this was the first submission I got where someone obtained the Galahorn from the lighthouse chest. How crazy is that? In at number three we have a clip sent in by Coupa Meadow 300. Now you guys who have been subbed to me for a while now know I have opened way over 200 packages from that postmaster. Never did I ever get three legendaries from the same one. Absolutely insane. In at number two we have a clip sent in by BilellicBall178 shows us this insane loot drop he received from the Rotoglass hardmode although we don't seem very happy or surprised I'm pretty sure most of us would have been very happy with this loot. Oh I got vexed Huckmoon. Oh but I have both of them. Yeah but I have both of them already. I should have got Galahorn. I got Huckmoon. In at number one and the winning of my top five lucky loot drops is a clip sent in by Headzone 4. Shows us him getting two Galahorns in the space of minutes. One from the silver tier package and the other from the lighthouse chest. Absolutely insane. But guys that is it for another top five loot drops if you guys enjoyed the video. If you could leave a like I would appreciate the support. Also guys if you have anything badass to send in send it into the email I just linked in the top of the video description. Hope you guys enjoyed the video thanks for stopping by as always and peace out till next time. Peace.


Hello, welcome to using Open Policy Agent to meet evolving policy requirements. In this talk, I'm going to cover how my team has been using Open Policy Agent or OPA for around the last year in order to meet evolving requirements that we've faced as we've moved into new regulated environments. My name is Jeremy Rickard. I'm a software engineer at VMware. And my team has really been focused on doing things in the Kubernetes space for the last few years. I'm also the Kubernetes 120 release lead, and I've worked on a number of open source projects like Virtual Cubelet and Service Catalog for Kubernetes. If you'd like to reach out to me after this talk, feel free to ping me on Twitter or the Kubernetes Slack where you can find me as J-E-R-I-C-K-A-R. I'm also happy to respond to emails. So what does my team at VMware do? We're called the VMware Developer Platform, and we've got this long collection of words that describe what our team does. But if I boil it down to a really simple explanation, our team provides managed Kubernetes to VMware SaaS services along with supporting infrastructure like maybe Vault or creation of resources in AWS that might support what those teams are doing. This project has been around since mid-2018, kind of generally available for VMware SaaS teams. The genesis of this thing was really focused on deploying clusters for multi-tenant use. So we would deploy kind of shared clusters, and these clusters would have multiple tenants on them. These were deployed into Amazon, so running in public clouds, and available to the SaaS teams to deploy their workloads. Since we are running multi-tenant clusters, we kind of use namespaces as the level of isolation where we're enforcing the multi-tenancy, and we used RBAC pretty extensively in order to make that happen. So to really facilitate that, we also have a data plane that we run in something we call our management clusters. So when a user is going to use VDP, they use a CLI that we've written to maybe create namespaces, or label namespaces, do things like that, then once they have the namespace created, they're able to do pretty much whatever they want inside of that namespace, and it belongs to them. They can define network policies, things like that. But we very quickly came to see that that's not really sufficient for all the use cases. There were teams that needed to do more than just exist within one, maybe two namespaces. They needed the ability to create more namespaces, do other things on the cluster. And doing that doesn't really fit into that multi-tenant cluster kind of model, so we also have evolved to support non-shared clusters. We call these tenant cluster pretendants. And in those cases, they get much more access to the cluster. They can do things like create namespaces. They get nearly cluster admin access instead of having to rely on our data plane to do a lot of that stuff. But at the same time, we have resources that we deploy that are really required for the cluster to operate successfully. So we come to this challenging point of tenants really having what amounts to cluster admin that can do a lot of things that might impact the operation of our system. But we also have resources that we want to protect. And RBAC wasn't really sufficient to handle all of those things. Maybe we need to validate that somebody can do something based off of their org membership in an external system. So thinking about how we might solve that problem, we realized pretty quickly that Webhooks, the mutating dynamic admission control that's available in Kubernetes, would really solve this problem or give us a point where we could write some extensions to make that happen. If you're not familiar, when you do something like a CQube CTL apply, the tool in the CLI makes a call to the Kubernetes API. It does some basic authentication checks to make sure you're authorized and authenticated to do what you're trying to do. And then it moves into the dynamic admission control. In that, you can define mutating Webhooks, which might make changes to the request coming in, maybe inserting a sidecar pod or changing labels, doing things like that. Finally, it moves on through the chain until it gets to the validating Webhooks. And there, it makes decisions about whether the request should be allowed or not. Maybe it's checking parts of the request against other things in the system to make sure that that should be allowed, or maybe it's checking something against an external system. So we ended up writing a Webhook to do some of this. And it was focused on protecting the resources that VDP manages in the clusters, but allowing them to do most everything else. So when a request comes into a VDP managed namespace, where we have deployed things, we can analyze who's making the request and either allow it or not allow it. This really became a great just general extension point for us to add new functionality that we couldn't directly express with role-based access control. But as our scope started to grow, we onboarded more tenants. We also started to pick up some additional places where we needed to run. We needed to follow our tenants to where they needed to be. And the first place they needed to be beyond our normal commercial AWS regions was GovCloud and Amazon GovCloud. And our tenants wanted to start pursuing FedRAMP certifications, starting with FedRAMP Moderate, moving into FedRAMP High. So we recently just completed an effort to help the VMware Cloud and AWS team secure a FedRAMP High certification. And doing that meant that we needed to evaluate a lot of what we were doing and look at the requirements for that certification process, find the gaps in what we had deployed already and start to evolve to fix those things. Shortly after, we started to support a PCI certification effort for VMC again. Each one of these new environments brought new requirements. When you consider FedRAMP High, there's over 400 different controls that you have to meet in order to get that certification. PCI has a completely different set of requirements. A lot of them are similar, but there's also differences between them. You need to really review each one of these things against what you've deployed and how you're operating to make sure that you're fitting into those requirements. Does Kubernetes directly meet all of those things? Probably not. And in our case, we didn't try to justify each one of those things with Kubernetes. One of the nice things about getting these certifications is that they've realized that not every requirement that's written can be directly applied to every business case or every computer system.  And compensating control can be applied to almost all PCI requirements. And it really says that if this requirement can't be directly applied for technical reasons or business reasons that are documented, you can go ahead and identify additional problems that help mitigate the risk that those controls are meant to address. And for us, that was a great way for us to take the Kubernetes clusters and the other stuff that we've deployed for our tenants and figure out how we can augment those things, maybe with policies or maybe some additional things we deploy, that can help to really reduce those risks. And as we looked at each one of these things and considering that we have lots of different clusters, we're deploying in the commercial regions US West 2, US East 1, various APAC or Europe regions. When we look at those and compare them to the GovCloud deployments, they're pretty different. And the requirements for them are pretty different. We do have a base set of security things that we have to follow for VMware security, obviously. Any VMware service that's going to be deployed has to go through a set of security validation to make sure that it's going to meet our internal requirements. But when we move into these other environments, there's more and more restrictive things put in place. So we obviously don't want to force all of these requirements onto the tenants that don't need them because that would make their jobs harder. We want to be an enabling feature for them, help them be successful. That doesn't seem like it fit really well with our webhook model because we would be adding different features that we would have to probably feature flag and different clusters, key track of all those different things. It's additional code we'd have to write and test every time we wanted to make one of these new features available. And then it would have to go through our whole rollout process and just be a little bit more complicated than we think would be great. And we also, thinking about this problem, want to make sure our users don't hate us. Additionally, some things we really wanted with this change, these new things we wanted to apply, was that we didn't really want to require new code for each one of these things. We didn't want to have to make changes to our existing webhook code. It's written in Go. We build it into a Docker container. We deploy it. It rolls through our pipelines. Goes through a full upgrade process. If we wanted to make individual changes to that thing every time we had to identify one of these new policies that we needed to enforce, that would get a little bit complicated. So we wanted to require something that didn't really require new code. We also wanted to make it easy for the team to learn. So we wanted to not require them to learn a brand new programming language from the ground up. Obviously there's probably gonna be some domain-specific language involved. Something that looks like code. But we didn't want to force, everybody in the team that's not a Go developer to learn Go in order to build new policies like this. And finally, while we don't want to go through the process of doing a full upgrade every time and rolling these things out and going through the whole process, we do want to make these things testable so we can make sure that when we're defining these new policies, however they're gonna be applied that we can test them before we roll them out. So we're not breaking things down the road. So we looked at all of these requirements, the fact that we wanna have this kind of applied on a cluster by cluster basis. We wanted to make sure that we could satisfy these wants. We did a search across the CNCF landscape and we really identified something that we thought would help us quite a bit. It turns out that was OPA. Open Policy Agent. Open Policy Agent is pretty extensible. It provides its own language for defining what policies look like and we'll look at that in just a second. And it turns out it integrates pretty well with Kubernetes. There's a project called Gatekeeper that I highly recommend you take a look at. We ended up not using Gatekeeper for a few reasons that I'll get into as we go through the talk, mostly because when we started this journey, it was pretty early days for Gatekeeper and we ended up going with the cube management approach which runs cube management and OPA together like in a sidecar manner. It ends up looking something a little bit like this. Just like we wrote our own webhook, validating admission controller, this plugs in pretty much the same way. So when you deploy OPA and cube management together, you can register them as validating and mutating webhooks. They plug into the API server just like any other webhook would. So when a user is making a request with kubectl, CSED pipelines, maybe are using the API directly, maybe using kubectl themselves, or when controllers inside of the cluster are making changes to objects and resources via the API server, everything goes through that normal admission process. An admission request hits OPA. OPA looks at that request, determines if any of the policies you've applied should result in a deny or a block, and then it sends that response back and the API server handles that appropriately. So let's look at a really simple example of what a policy might look like. Here we wanna deny any request that comes in that's labeled with a certain value. So you can see that this is really a declarative language. We're saying a series of facts or in this case, really just one fact. And then if that fact is true, then we're setting a variable value of this getting returned. So we start this off with a deny block. So the keyword deny, and in that is a message that's gonna be returned. And then the first line in this is really the statement that we're checking and the policy we're enforcing. So in this case, if the metadata has a label called pants with a value of sweatpants, then the message we're gonna send back is you can't sit with us. If you notice in that line, input.request.object, that's really coming from the Kubernetes admission request. If you look at the JSON that makes up a Kubernetes admission request, it's got those pieces of it. So it's really great in this policy you're able to say, I wanna work at the metadata of this object that's coming in, or maybe I wanna look at the spec of this object that's coming in. Maybe I wanna look at the verb, is this a create or an update? Maybe I wanna apply policies differently that way. It's really flexible and gives you a lot of power without having to go write new code. It's still code, obviously, you're still writing some declarative statements, and you still have to end up putting those in the cluster somehow, but it's a much simpler path forward. To test this, OPA provides a lot of tooling, and you can actually take this stuff and put it into OPA Playground. I have a link to that at the end of the presentation. Just to test these things without having to run anything locally on your machine, you can build out a sample test document and build out your sample policy and run the validation in this Playground, and it's pretty cool. So with all of that in mind, let's talk about a few use cases that we have solved with Open Policy Agent and Rego. And for each one of these, I'm gonna go through three examples. I'm gonna loosely tie this back to some control or some rule that we found in FedRAMP or PCI that we needed to apply to our system. And the first of those is the use of external information systems. Inside of this requirement, there's a whole bunch of different rules and a lot of different individual control points. But the one I'm gonna focus in on is information systems that are outside of the authorization boundary really qualify as those external information systems. So we deploy our, in GovCloud, we deploy Kubernetes into those FedRAMP environments. And we deploy a lot of other things in there. We try to minimize our reliance on external resources, things that are outside of that authentication boundary. And one of those things is the Docker registry. So in production, in our commercial environments, we're using a hosted service from JFrog that's not available to us to use directly as part of our FedRAMP offering. So we needed to run our own registry in boundary. So inside of that GovCloud environment, we have our own Docker registry that we're running and we push all of our images to that. So then when we wanna deploy stuff into the cluster, we need to reference those images. We also wanna make sure that the cluster isn't running things that it's directly pulling from the internet. There is some connectivity. There was originally, we've locked it down since then, but originally you were able to pull things from Docker Hub or pull things from our JFrog hosted solution. So the first thing we looked at with OPA was how do we restrict the use of those other registries? We wanna really lock it down to just the one. So we wanna make sure that requests that are coming in only come from that registry that we want them to come from. So one of the first policies we built was a pretty simple one that would look at the image that's being used by containers. So this policy really is cool and it lets us restrict any request that's coming in to only those that come from certain repositories. So in this case, we start off again with that deny block. And the first thing we look at is, does this kind, the kind of this request, so just like you deal with kinds and Kubernetes, we're checking that here. So an admission request will come with whatever type of object you're dealing with. So we really only wanna apply this to pods. And we can do this at different levels. We could look at the deployments replica sets. This was the simplest for us to just look at when a pod is created is the container using something using the registry that we expect it to use. It's a pretty simplistic check. So we iterate through all of the images. So obviously you can have multiple images in a pod spec. And we wanna make sure that each one of those things is valid. So we start off with the second line of the block, some I. So just for every image that exists in this array of input that request that object that spec that containers, let's grab that thing and validate it. So then for each one of those images, we basically just say, does this image start with what our gov repo is? I replace it here with VMware is awesome just for notional purposes, but you can see the, we're making a little bit more complex policy here by calling into that function. When this evaluates true, when the first line is it's a pod and when this is not a gov cloud image, we're gonna return the message pods container is not allowed to use the image from a non-approved repo in Gov. So what's that look like in practice? So using this deprecated functionality of creating a pod with QCTL run, we're still running fairly old clusters. So I can still do this. I'm gonna try to run an MQ test client from my personal Docker hub account. So I run that with QCTL run. That actually behind the scenes right now in that version of Kubernetes creates a deployment and that deployment that will then spin up pods. I don't get an error here though because my policy was really applied to just the pod. So to kind of work around that or to see how like what feedback you get, let's take a look at the events. We can run QCTL get events and filter that down to open policy agent in the string. And you can see that we can't actually create pod. And if I did a QCTL get pods here, you would see that there were no pods created for this deployment. And it's specifically showing that error message that I created before. So this was great. And we were able to lock all of the registries down, make sure that we weren't deploying anything from the non-controlled things that were inside of the boundary. But now we have some fairly unhappy users. And our goal all along, I mentioned this at the beginning, was to make sure that the users didn't hate us. We wanted to make sure that things were as easy as possible for them. And not every one of our tenants is super versed in Kubernetes. They're using Kubernetes. They realized the benefits of deploying their stuff under the platform. They're along for the ride for GovCloud. But us adding this constraint makes it a little bit more difficult for them. They either have to go maintain a separate set of values files if they're using Helm or some other tool that does a kind of template in an overlaying. Maybe their Helm chart doesn't even allow them to really template that because they've not done a super great job of templating that stuff out. So there were changes that had to be made there. So we thought, what can we do to help with that situation? And I mentioned this earlier, but you can actually run OPA as a mutating webhook in addition to a validating webhook. So what's the big difference there? Well, when it runs as a validating webhook, we have those blocks and they started with deny. And what happens there is when all of the rules match for a deny, the validating webhook functionality will say this request is not allowed. Here's the error message. But just like every other mutating webhook, OPA can also update your resource. And it does that by generating JSON patches. The syntax gets a little bit more complicated and I'm not gonna show you the entire thing here, but I'm gonna show the relevant parts. So here we've defined two variables, VDP repo. So it's gonna be whatever our upstream public managed JFrog thing is. And then also whatever our GovCloud, the host name for our GovCloud repo is. And then instead of using the deny block, we're gonna define a patch block, which is gonna return whatever JSON patch needs to be applied. So in this case, we have a couple of extra things here. I probably should have removed from the example, but we first wanna make sure is mutation allowed. So we wanna to validate that the type of resource that we're gonna mutate is something we wanna mutate. We have some rules built around what namespace it's in or what labels it might have on it, specifically labels a brown disallowed mutation. So we have a label that we've put in place for some of our components where we don't wanna mutate like this because it could lead to unexpected consequences, but we essentially check to see if that exists or not and then move on. And then just like the deny rule, we're gonna iterate over all the containers and then we're going to check to see if that container matches the upstream public repo and replace it with the downstream value. If any of that generated a new value, then we're actually gonna make the JSON patch here. So I've removed some of the bits about actually making the JSON patch and I'll link the documentation at the end of the talk, but what will happen here is that when we make a request, so maybe we're gonna helm deploy some deployment and it's gonna reference our upstream JFrog repository, this code will actually get invoked. It'll look at that request that's coming in and say, oh, hey, you're using the upstream version. We can't use that in GovCloud. Let me go ahead and mutate that for you. So when this actually hits the API server, or sorry, the STD, it's gonna actually get the Gov repo instead of the upstream repo. So it'll try to pull that down and it'll work just like we would expect it to work, but we've made it a little bit transparent to the end users. So that's the first use case that we had that we solved with OPA. As we got further and further into the process, one thing that kind of bit us was this next requirement. It didn't PCI, but it's also in GovCloud, but I like the wording here a little bit more. And this is PCI requirement six, develop and maintain secure systems and applications. So there's a lot of things to unpack in that terminology, but specifically 6.1 underneath of this requirement is that you need to establish a process to basically scan for vulnerabilities. And when you identify these vulnerabilities, you have to remediate things that are medium or higher. So you get different severity levels and these are based off of CVSS scores. And when you get these things, you have, depending on the sort of, like whatever certification you've achieved, you have N number of days to fix them. So like in GovCloud, we have 30 days to fix things. It's not a long time, but it's also not a short time. But as we deploy a ton of stuff, we found as we went through this initial process, we found a lot of containers that we were deploying that actually had a number of vulnerabilities. So as I mentioned, these things are based off of CVSS scores. So in the PCI case, anything that's medium or higher, which is a CVSS score of four or more, you actually have to remediate or you will fail your PCI audit.  And you can do this, you can check this yourself. There's a number of tools you can use. We happen to use Twistlock, but you can use an open source tool from AquaSec called Trivi that'll do pretty similar things. Just a really quick example of what that might look like. I scanned one of the images that we have deployed in our commercial environment. And you can see that it found a number of vulnerabilities. Two of them are critical. Three were high, four were medium, and three were low. So we definitely have to fix those criticals, those highs, and for PCI, we need to fix those mediums. What kind of things do you find inside of that? So these can be OS level vulnerabilities. You could say like the version, you're running an Ubuntu-based container and it's got a G-Lib C vulnerability inside of it. That'll come up in these scanners and that will get flagged by one of the auditors. So it may not really be a problem, but it's best for us at least to, the least amount of effort is to fix the problem. It can also be application level things. So in this case, this is a Java application and the problem here is actually the version of log4j that it's using. So how do we fix this process? How do we, the VDP team handle fixing these things? How would anybody else really handle these things? Well, you generally need to build some new container to do this. Updating libraries, maybe applying OS updates inside of the container if you're using something like Photon, if you're a VMware person or Ubuntu or WN as the base images. So we built a little process around that for ourselves and that involves taking whatever the base image that we have, so maybe it's some upstream component that's based off of Alpine or some upstream component that's based off of Ubuntu. We write a new Docker file. We take the old one as the from line. So if you're building a Docker file out, first line is from whatever. Then we run whatever the OS appropriate updates are just to make sure that we apply those things. And then we add in, it's something we've built. We add in, we make sure that we've rebuilt that with whatever the updated libraries are. And voila, that results in a new tack, hopefully without any vulnerabilities. Then we need to deploy that to the cluster. So we go and maybe we run a Helm update or a Kapp deploy, whatever functionality we're using. But then we have to repeat this process whenever the vulnerabilities happen. So for us, we scan this pretty regularly. And we automated that by building this, these images pretty much every day. So twice daily, actually, we run through that process. We build all of the images that we've identified in our inventory file, which is of course the animal file. And we update those things to generate new tags. Then we update the inventory file. And then we somehow need to deploy that to the Kubernetes cluster. And we wanna do this in a not really manual way. So we were able to pretty easily automate the front half of that process where we would rebuild these containers. We've already written the Docker files for them. We have the skeleton of the inventory. How do we then take that and deploy it? So one of the cool things is that OPA, especially when you're using the CUBE management sidecar, is that you get access to other resources in Kubernetes. And it acts just kind of like any other Kubernetes client would where it establishes a watch and sees things from the API server. So we put that into a config map in the cluster. It lists out the name of the image and then what version we wanna run. And then the OPA sidecar, CUBE management, sees that those things have changed and makes them available as a data field to OPA. You can access it like this. So next we can write a pretty simple policy that looks at that inventory and compares that to what's deployed and then mutates the tag. So we again start with a patch block. We iterate through all the images in this case the init containers. We do this for the init containers and the regular containers. Obviously we wanna update both. Call this update image version function which returns us back a modified version of that reference. And then we make a patch off of that and return it as just part of the mutation process. Just like we did with the repos, we're now updating the tag to match what we have in our CI CD system. So now our inventory file gets deployed to Kubernetes. We play that as a config map. That gets reloaded by OPA and then we run a small job that just labels touches the labels on all our deployments which then forces them to go through the emission process again. That forces the mutating web hook in this case OPA to update all the tags and then start up again with all of those new hopefully vulnerability free images. So the last policy that we really wanted to enforce was running as non-root. And running as non-root, we're doing mostly with pod security policies. Pod security policy works pretty well and it's pretty easy for our tenants to understand except when they don't pay attention to the notifications we send and don't make changes to their Riemel. So all of a sudden, my pods won't start. What's going on? Well, did you specify the context, the security context in Riemel? Oh, you mean I have to update my chart again? So again, we bring mutation to bear here. And in this case, we take again checking to see if mutation is allowed. We look to see if the spec already has a security context defined and if it doesn't, then we make another patch where we actually add in the run as user in FS group to make this thing run as non-root. The great thing here is though, when the users are making these calls and they're deploying their stuff, they can actually specify whatever security context they want and we won't mutate it. This is just a nice add-on for them when they don't have that done. So recapping, what did we learn, the VDP team learn? OPA is really flexible. Validation can get you pretty far. You can write a lot of deny rules to lock your clusters down and do a lot of things. But mutation can get you even further. You can do a lot of things when you combine these two things together. Rego is pretty easy to learn. The declarative nature of it just makes it pretty easy for people to pick up and we have found that it's pretty easy for all the team members to really learn it and start writing new policies or fix problems we found in the policies. And then with those in mind, we were able to balance our security needs pretty closely with our desire to make the user experience as nice as possible in this security world that we're living in. But let's go back for a second and talk about the mutation aspect of this. I have mixed feelings about mutating webhooks and if you read the documentation, the Kubernetes documentation, there's actually some call-outs to say, hey, you should probably be aware of these things and maybe it's not the greatest case. And one of them is that users don't necessarily know what's happening. They may be confused by like, what this thing that I've created doesn't look like what's in the cluster now, what happened? We actually had that problem with the security context mutation. As we were going through this process, people weren't specifying security policies on their deployments and then actually tried to run as root and gave us an exception request where we created security service accounts for them, things like that, but they didn't declare the security context because they were just depending on our automation, our easy mode access for that. So think about the things you wanna do with mutation and maybe use it judiciously and think about what impacts it may have downstream. So here's some great links if you wanna kind of follow up on these. If you wanna read more about the FedRAMP high requirements or the PCI standards, I've linked them both here. Play.openpolicyagent.org is great to go experiment and mess around with policy. There's a great tutorial link here as well and like how to validate ingress in the cluster. And then finally, one of the reasons we didn't use gatekeeper was that it doesn't do mutation yet, but there's an open issue here and maybe by the time cube comes around, this will be done. I would totally advise you to follow this and give gatekeeper a try if you're gonna look at OPA, especially if you wanna do, just validate and sort of things at the moment. So at that point, I'll turn it over to questions if you have any questions I would love to answer them now. Thank you so much.


Hi, this is Jack Lefton and this is Critical Materials Corner. Today, I'd like to talk about critical metals, but I want to, as the philosopher say, deconstruct this idea for you, because we talk about critical metals as if it's one thing. It is not. First of all, let me tell you briefly how the list came about. The U.S. Department of Commerce or Interior has the United States Geological Survey as part of it. The Defense Department has the Defense Logistics Agency. These two departments are separate and never the twain shall get together, but they did in this case in 2018. The two departments, Interior and Defense, decided to publish a request in the Federal Register, the recording instrument for the government, requesting that experts and even other people submit a list of what they thought were critical metals and materials. In the fall, they published this list. So let me just tell you one quick thing. I was in a meeting in the fall of 2018 in Washington with those gentlemen, the United States Geological Service and Defense Logistics Agency. And the head of the Defense Logistics Agency said to me on the way out of the meeting, I noticed you haven't submitted a list of critical metals. I said, that's because I don't think you'll agree with my list and I don't want to argue with you. He said, oh, I don't think so. He said, well, you should submit. Well, I never did. Because when the list came out, I didn't agree with it. So let me say that the current issue of critical metals in the United States is actually dictated by Defense Department policy. The metals and materials that the Defense Department is most worried about, which are rare earth materials for permanent magnets, battery materials for lithium ion storage batteries, and some exotic applications of more common metals than that. For example, tungsten in armor, scandium in armor, things like that. So here's the thing that nobody seems to understand. What, how much of these any of these things that the government need? Well, again, in 2013, Mark Humphries, a then of the, I believe Defense Department, published a article and he said, we need about 1000 tons of your birth permanent magnets. Okay, now comes 2018 and 19. And I made an inquiry of the defense department. Can you guys tell me how much you use in the way of birth permanent magnets and alloys? So I can do some work on this. And they said, no, no, it's classified. I said, gee, it wasn't classified six years ago. It's classified now, which means to me that they don't know that's the truth. When you hear something as classified, it means it's classified out of their knowledge base. They don't know. So I'm going to guess for you. I'm going to guess that US Defense Department today uses about 3000 tons a year of rare earth permanent magnets. Now, quite frankly, that amount of rare earths, the rare earths necessary to make 3000 tons of rare earth permanent magnets are 1000 tons of neodymium, praziodymium, and perhaps 90 tons of dysphrosium terbium. So could that be produced at mountain pass mine of MP materials? Well, the light where it's good. Could that be produced by energy fuels in Utah from Monozyte? Yes. Could that be produced by Texas mineral resources or USA where it's whichever company will be the dominant one there? Yes. Okay. Now, why then are we talking about 10,000 tons of rare of magnets made from rare earths and numbers like that? Well, the reason is because that's the civilian economy. But the Defense Department doesn't care about the civilian economy. That's not their responsibility. So that would actually I guess come out of the Commerce Department or Interior Department, but they have no particular knowledge in this area. So what we're having here, the policy of the US federal government is to prioritize the production of critical metals and materials either in the United States or in friendly countries that are allied with the United States.  It's really the Defense Department driving it. Here's the problem. And everyone in mining knows this. That isn't enough material for it to make a profitable company. It's just too small. The world production of rare earth permanent magnets is you'll be about 170,000 tons. Our Defense Department needs 3,000 tons. There are many, many, many Chinese companies that produce that. But not a single American company so far can do it. Not a single Canadian company so far can do it. Or anybody in Europe does have some companies in this field, but nowhere near that capacity. So the Defense Department has therefore made proposals to put $30 million into Texas and 40 million or 400 million, some big number, into California and to produce rare earths. But they came up with a target of 5,000 tons a year. That's what they thought they'd like to have. They don't need 5,000 tons a year. And so they don't care about what is beyond what they need. Now, if you think this is a bit of a mess, it really is. So let's wrap this up. We don't know what the demand is for rare earth-enabled products in the United States. We don't even know what the military demand is. But the military has said they want 5,000 tons. Do they need that? We don't know. Will there be a ton left over for the civilian economy? We don't know and the military doesn't care. This is going to be a big issue from now on and we'll be talking about it every week on the Critical Metals Corner. Thanks.


Noncystic fibrosis bronchiectasis, NCFB, is a common and debilitating condition that can be difficult for patients to manage due to the complexity of their treatment regimen. Poor adherence to these treatments can lead to poorer outcomes such as decreased quality of life, faster progression of lung function decline, and increased risk of recurrent pulmonary exacerbations. There are multiple factors that contribute to non-adherence in NCFB, including difficulty understanding instructions, lack of motivation, and financial constraints. Interventions to improve adherence should focus on addressing these barriers and providing supportive care to help patients better manage their condition. This article was authored by Christina S. Thornton, One Journey Semiogy, and Rachel K. Lim.


Welcome to PDAC 2019. It's the first day. The show is just getting underway and we're here today with Dr. Dave Driesinger of Search Minerals. Yes. How are you doing? Very well, thank you. Nice to see you again. Haven't seen you for about six months. Yes, it's been at least that long. Your reputation is as an expert in metallurgy and mainly in the rare earths, right? Yeah, generally, but also rare earths in this particular case. That's correct. Which is suitable since Search Minerals is searching for rare earths. Where are your projects located? We're in Labrador in the province of Newfoundland, right on the coast. We've got a 70 kilometer by 8 kilometer belt called the Port Hope Simpson District, which is mineralized through the whole extent of the district. And we've got currently two resources and about 20 more prospects to track down in that space. And which of the rare earths are you looking for? Well, we're looking, they all come together typically, but the ones that we're finding that are most economically interesting are the Neodymium and the Presidium. Numbers 59 and 60. We're 59 and 60. I can't say that word, so I just call them 59 and 60. Or NDPR, or PRND, however you might want to say it, and then also dysprosium and also terbium. And why are those important to our modern economy? They're basically magnet making materials, so they go into the high intensity magnets used for all the electrification of our society. We see huge increases in demand for these materials as electrification takes place. If I remember correctly, the average combustion engine vehicle uses a half kilogram of those rare earths, but the average electric vehicle needs over a kilogram. That's correct, and of the higher value ones. And if I remember correctly, the world prediction for electric vehicles this year is four million units? I don't have that exact number in mind, but yeah, it's increasing exponentially as we go.  Now most of us are contemplating it. Right, so you need to feed that supply for the magnets. Absolutely. What's happened lately in the company? Well, a couple of things. We've been drilling in Newfoundland, Aberdeur. We've just identified there. Just drilled the Deep Fox resource, which is our second deposit. Right. We've gone down to 200 meters. We found them, like we did for Foxtrot, our original resource. We found that our mineralization extends down to 200 meters. Okay. It's the same at depth as it was on surface. It's higher grades than Foxtrot, so it's a more attractive resource from that point of view. What's it hosted in? It's basically a volcanic deposit. Okay. So it's basically a layer of mineralization that over time has been, would have been deposited horizontally. It's been tilted up more or less vertically. Right. So we see on the surface a channel of mineralization that extends down to this depth of at least 200 meters, showing the same grades and widths as we see on the surface. When do you think the drill results will be out? The results came out Friday. Yeah, so we do have the results out, and they are showing sort of a 10 to 20 percent increase on grades. And very importantly, a much larger width of mineralization. So when you're mining something that's like a monolith, you want it to be as large and width as possible. Right. We're seeing at least a 350 meter length to it and about a 30 meter width to it. Now historically, there is a preliminary economic assessment or PEA on the property. No doubt you'll have to update that now. We will. We're actually having meetings during the show here to actually engage with our partners on the PEA development to make sure that we put out a new resource statement and update our preliminary economic assessment on that resource. A lot of exciting things happening up at Deep Fox for you. Absolutely. We'll keep an eye on it. Dr. Dreisinger, thank you for coming in to speak with us. It's always good to see you. Thank you, Peter. Thanks very much.


Too bad it's too early for like wine or champagne or something. Is it?    Blah, blah, blah. Very informal. But yes, we've wanted to do this and we enjoy giving out meaningless awards. It's our first end of year video ever. Yes. There'll never be another one like it. Nope. But the way this is going to be, we're going to go over a few categories, 2019 categories. So like best film that came out this year, 2019, best actor, best actress and then we also have our best short film as well. Those are not 2019 associated. No, those are, we had to cover, yeah, because obviously we haven't seen all of them. But then we will go through our top 10 favorites. And all of these will essentially, well I think the 2019 will be, for the 2019, the ones that we think, like if we were doing the Oscars, who are the, because see when we talk about our favorite films, there are the films that we say, okay, this is the one that should win the Oscar, but that doesn't necessarily mean that that's like our favorite film. Yes. And so we'll do that with the 2019 ones and then for our top 10 videos at the end, those will be our personal favorites. Personal favorites. Not, not the best cinema, exactly. Like one of my favorite films ever is not really right. I would never put that on the top 100 or 200 or 500 greatest films of all time. Never. Also, this would be a little long video. I'll try to edit it so it goes a little faster.  Yes.  So the 2019 ones, and then I think they also have their favorites of the, their top five or whatever of the stuff that we've watched. In case you were wondering, we've watched what, 60 films this year? Something about that. Yeah. But so there'll be, well after we say ours, we'll tell you what the Stupid Babies thought. Right. And then you can let us know yours down below. Much first. Yes. So the first category is shorts. Not to be confused with pants. We've seen five. We saw Juice, two, Ahamnelia, Creti and then Curry, all those. And so what is your pick? And you can just do a brief synopsis of why you liked it at the end. It really only came down to two. For me, that were my two favorites, but ultimately it was Satyajit Rai. Two. Yeah. Because it's the best short film I've ever seen. So there you have it. Yeah. That mine came down to those as well. But I actually picked Juice. Really? You liked Juice more than you liked two? I did. I did. Because it surprised me a lot. Even though, like as I said, Satyajit Rai, I have no quarrels with you about picking that. Yeah. I could have easily picked it. And I have no quarrels with you about Juice. I mean I have my personal preference. But I can't argue, Juice was great. But this one is just, I think the acting was phenomenal in it. I think the message was phenomenal in it. And I think it was just great.  Interesting though. Yeah. Best Fino Actor of 2019. There's three basically in this that it shows. At least that's all they put in this. Right. And these are from the films that we saw that were released in 2019. Not every, over there all. Correct. That we saw, ladies and gentlemen. So yours was? Alia. Mine too. That one wasn't very hard even though the other ones, The Stupid Babies by 52% also picked Alia Bhatt. Uh-huh. Makes sense. Her performance at Gully Forman was just outstanding. Phenomenal. Yeah. But Priyanka was in second place at 18. First guy's pink. Right. That would probably be my second one. And then Topsy as well. Yeah. And she was phenomenal as well. She was fantastic. Earlier this year in Babla. Yeah. It was Babla, right? Yeah. It wasn't. Yeah, this year was Babla. I mean we saw her in pink as well. This actor of 2019, what did you pick? This is a contentious one. I think I know who you picked. And it was by the scores of The Stupid Babies as well. Was it contentious? Yes. I picked Shea Kapoor. Shea Kapoor. I figured you would. I think his performance in Kabir Singh was just so brilliant and so different from the other films that we've seen him do. And I thought he had to go to different places and also take a chance on a film that a lot of people think is controversial. I think his performance in it was the one that stood outside itself. I'm guessing you picked Renveer Singh. I did. I understand. Yep. I'm not really going to debate that. He did a phenomenal job. I loved him as well. So it's really up to you what your personal preference was in this one.  Oh my goodness. Wow. It was like that close. Renveer Singh. Woo. He's 28.6. Wow. Shea was 28.3. Wow. So that shows you how close it was. It just makes it was a good year for actors. And again, I really enjoy it. I have no problems with somebody saying they choose Shea Head, but for me I definitively no questions. But that's kind of how the awards are going as well with the ones in India as well. It's those two. Right. Those two. Which makes sense. They both had phenomenal performance and very different performances. Very different performances for them. Yes. The best film of 2019 that came out in 2019. Well, and our poll did it as three options, didn't it? Like you could pick three, two, and one. Your third favorite, your second favorite, your first favorite. Yeah, yeah, yeah. You can go ahead. Okay. I didn't do that, but I can think about it. Yeah, I did. My third favorite was Badla. Gotcha. Second favorite was Uri. Favorite was Gully Boy. Yeah. Yeah, I didn't come up with the top three. And so I'm just trying to get that in my head real quick. My top three would be, God, that's difficult because Article 15 was phenomenal. That was the other one that was tough for me. The third slot for me, it was a toss up between Badla and Article 15. And war, of course. Well, need we say more? Okay, I think it would be Kabir Singh, Uri, and then Gully Boy. Oh really? Yeah. Yeah. I think I would pick Shahid's performance, but I just didn't, I really enjoyed Gully Boy as a fan as a whole. And I can't get past my own, you know, the meaning of that. But it was also just in and of itself, it was a really great one. But this, the Stupid Babies also picked Gully Boy at 30%, and the next second was 19% at Uri. Was number two? Yeah. And then Article 15 was three. Yeah. That was my other, it was either Article 15 or Badla for me for the number three slot. Those are great. And then we'll do the main calls. Just a reminder, these are our personal favorites. Personal favorites. That's different than what you would say, okay, you need to put this in a time capsule for the rest of the world to see or the greatest films that have come out of India kind of thing. This is very subjective. Yeah, basically we could watch the most. Right. It's essentially how I came down to it because this was incredibly difficult. Because there could have been 30 films that we've seen, and we've seen almost 60. Yeah. We were just saying, I had it narrowed down to 20, and it was painful to chop off names. Yeah. Because there were so many. So many that I loved. Yeah. And could, I would make no argument with you if you put it in your top tag. And this is going to be very revealing as well that you're going to see, which for those of you who've been around, you know the differences between Corbin and I. Yeah. You will see the stark contrast. I don't even, I don't know what he's picked. Oh no, he doesn't know what I've picked. But the stark contrast of the kinds of films that we want to watch on a regular basis. Yeah. Because this is what this is. This is the movies that we would want to go back to over and over again. So we are going to do this, he'll say his top 10, 96, then I would say my 10, 26. And you could say just the short, the brief synopsis of why I enjoyed it. Yeah, why I enjoyed it. And then we will go 5, 5, 4, and then we will get to 1. Got it.  Awesome. So some of these might surprise you, some of them will not. But my number 10. War. 9. Nice. Doom 3. My number 10 is Ram Leela. I could have been in mind because I enjoyed that film so much. Yep. I just, it's got the visual beauty of Sanjay Leela Manjali shots. Yeah. And it's got the chemistry and fun of Ranveer and Deepika.  I know. That's okay. Don't care. It's just, it's a fun watch. Fun. I just love watching the visual treasure of the lighting and the set design. Yeah, no. And chemistry of those two. No issues with you on that one. I thoroughly enjoyed that film. Number 9 is definitely not even in your top 10. Let me see. Go ahead. Devdas. You are correct. Yep. Go ahead. Number 8. Swades. Okay. Number 7. Do you want to say anything about it? Yeah, well it's a little brief thing about it. Swades was surprisingly impactful for me and the Indian experience that we've had. As well as I felt, you know, we've seen SRK give a lot of really good performances. My name is Khan. It immediately comes to mind. Absolutely. But there was something about the emotional availability he had and the, just the gentleness of his portrayal and just that story of India and the connection and the music. And it being a smaller Bollywood film, the musical numbers were smaller. So that's why I like that so much. Number 7. Piku. That's a phenomenal film. I love that film. Come on. I mean, and it's for me up to date, it's my favorite work to watch Deepika carrying herself alongside two of the greatest actresses we've ever lived and holding her on completely. That's not in my top 10, but it could have been and it was a finalist. The only reason it wasn't is because we said it was on purpose exhausting at times to watch that film. I don't know if it would be the second time maybe. Yeah, for me, I could just turn it on and watch it over and over again. At least the first time viewing is so exhausting on purpose, which is a brilliant part of that film. I don't think I could watch it as much as I could watch some of the films. And it's such a different take we've seen from Big B. Yeah. I remember a couple we was like, wow, what a different thing for Big B. Oh yeah, I thoroughly enjoyed that film. And then my number 6 is Barfi. Interesting. Justice or Ranbir. Justice. In case you didn't know, for those of you who saw that review at first when I didn't like Ranbir, I have since watched Barfi three times. That on the second viewing was completely in agreement that I had made my own headspin on his performance and unjustly disliked his performance and have since now enjoyed him as much as I enjoyed, well almost as much as I enjoyed Priyanka. Priyanka for me is at a whole other level than I've ever seen a lot of other actors in that film. But I thoroughly enjoy and can go back to that movie over and over and over again. So you're saying I was right. You were right. So I would do my 10 through 6. Number 10. Could be your thing. I love that film. How could you not put your best friend in the top 10? Yeah, exactly. Come on. And it's a role you'd want to play. Yeah, and that's how I often, my favorite, not always, but my favorite films are stuff that I can see. It makes sense. You know, you'd have to relate to it. I'm the same way. You have to relate to it. You have to be able to see yourself in the film. Absolutely. Not saying I would abuse my wife ever, obviously. Right. No. You have to have her behind you. Yeah. He was a terrible person, but I thoroughly enjoyed that film. As did I. And those films deserve to be made, and I think they're incredible. The performances are great. I just enjoyed them. When I made my top 20, it was in my top 20, and it was a hard one to cut. 9. Golly Boy. Wow. Yeah. 9. Yeah. I knew it would be in the top 10. It was, it's just every single time I came coming back to it is just, I was like, I thought it was such a good film. Every single part of it. The songs are great. The directing is great. The acting is great. And like it, it could have been higher. There's a lot of films that could have been higher, and there's films that were left out that I could have made a debate that it could have been over Golly Boy. It's just, it's one of those things. It's just, the thing that I left it in, I was like, I could watch that whenever. Yeah. It's one of those films that I could, I would put it on before I'd watch Eight Mile again, honestly. People have compared those two films, but I could watch this film before I could watch Eight Mile. I agree. So many more times. Eight, English, English, just such an enjoyable film. Just good call. Like, I watched it with my wife. I think it was actually one of the first one she'd watch with me. Yeah. And the entire time, as we said in the review, I was just smiling. Yeah. It's just felt good the whole time. It's just so, I could put that on anytime for anybody. Like, I could sit down with anybody in my family, any friend, and they would enjoy that film. I've recommended it to people who've said to me, hey, I have some American friends that I want to show some Indian films to. What do you recommend? That's like, at the top of my list of Indian films that an American audience would digest and enjoy. Yeah. It's just, it's so enjoyable. And it's different also because like I said, I can't honestly see myself in any role in that film, which is why it's strange. Well, I thoroughly enjoyed it. Seven. Swim's on your top 10. Super Deluxe. That film, you don't think it's in my top 10, huh? I don't. You're right. I think that was a thoroughly brilliant, unique film. Totally agree. That is just, I was laughing throughout it. I was also surprised throughout it.  Everybody in there was basically a sleazebag. I enjoy that when you're telling stories that one, I can't predict. Yeah, it's so funny because I agree with all of those aspects of it in terms of it deserved the accolades, it deserved being in the conversation for an Oscar submission. I could care less if I ever see it again. No. I could watch that. I could care less. I could watch it anytime. Six. This one could have been much higher as well. Padma Bhatt. That's because of the, it probably has a lot to do with Ranbir's performance and Sanjay Liebansali. Well, the film itself is a great, wonderful film. It's so good. And let's not, I mean, talk about an understated performance by Shahid Kapoor. Yes. So. We didn't even mention them. I'm so sorry, my best friend. It's one of those that I, I could watch that anytime for multiple reasons, primarily for watching Ranbir. Ranbir, you know, Sanjay Liebansali, his artistry that he puts on the screen, Deepika's performance. Yeah. The music. The music behind it. It's some of my favorite songs that we've had in that thing. It's just, it's a thoroughly enjoyable film. Yep. All right. So we're going to go five, five, four, four, five, three. Yeah, okay. My number five, the lunchbox. Go on. Come on. First of all, the simplicity of the directing, moments of just static shots, Irfan. And the story, just everything about it. It's one of those movies I will happily go back to and just turn on and just, I'm currently doing that right now with the two popes because the acting of Hopkins and Price is so exquisite that I can just turn them on and just, I just do this watching them and that's how I feel watching those two in that film. So that's my five.  Ah, yeah. I should have done that. I should have done that. Apologies. Tara, like Stars on Earth, Leb, is ten for them. Bag Mukha Bag is nine. The lunchbox is eight. Barfi is seven and Dangle is six. Dangle, dangle. Yes. So yeah, that's theirs. Five. What is my five? Lagann. Like, this is one of those films that I think I really enjoyed it when I watched it, but the more I think about it, the more I just love that film, like, and how good it was. Yeah, especially for, I mean, it's not incredibly old, like a such as it rise, but, like, it's an old film, like 2000, I think, when it came out, right? But it's so good and so relatable and so, like, especially for an over three hour film, you just, you just enjoy it and the songs in it are great. The performances are great and you relate to it. Yep. It's just, you just love being there. It's one of those performances. It's a great sports movie. Yep. One of my favorite sports movies just in general, I think. I agree. It's so, yeah, that's, that, that was, that was mine. All right. Their five is Bastrami Mastanadi. Ah, Bastrami Mastanadi. Go ahead. Number four. Cool. Number four. English, English. Yeah. Yeah. You knew that was going to be my top ten. Yeah. I knew it. Yeah. Do you want to say anything more about it? Ah, just, I loved everything about it. Yeah. I just, it's just, it's such an accessible, beautiful story. Sridevi is so great in it. I love the little big B moment. I love, I thought everybody was so beautifully cast. I think it probably elevates it a little bit more for me than for you as I know you weren't thrilled with, like, the teacher and some of the students. Yeah. Whereas for me, I just, I, I loved everything about it. So it's, it is for me. One of those, I can just go back, I can watch that movie 20 times. Yeah. And that's one of those films that would not be on my top ten, like, best films? I totally agree. If you were giving us a top ten, like, put them in a time capsule, this is the best films. Technically, Academy Award level, great, you know, kinds of things. I wouldn't put English, English in the number in the top ten. Absolutely not. No. But in terms of favorites. But my favorites. Correct. I agree. Four. Sholey. Hey. I knew Sholey was going to score really high for you. Yeah. It did. It's just, it's one of those things as well. And I think my wife actually enjoyed it even more than I did. Because she's a big fan of Old Westerns. Like, that's what she grew up on. Her and her father watched. Yeah. Good, bad, ugly. Any old school Western, that was her, her thing. But it's just, the more it sits with me, the more I'm just like, that was such a good performance.  So it's, you can't really ding it for that. It's just, and I'll tell you what, it's funny, what always comes back into my memory immediately is how great the stunt work was for a film of that era. And some great, great moments. And the thing that always goes back to me for this list is that these films that I could watch, like if it's on, I'm going to watch it. If I could pop it in at any moment, I'm going to want to watch it. Exactly. And so that's how this list went for me. So number four is gully boy. Hey. Four. Four is gully. Interesting. Yeah. All right. So go ahead, you three. My number three, this might surprise you. Okay. But it won't. PK. No, that doesn't surprise me. For me. Yeah. No, it doesn't surprise me at all. The, the earlyness in which we saw that. The affinity I feel toward Amir Khan and how many of his roles again I could see. and Irfan are the two actors that I can see myself doing the roles they do. And the connection point, the emotional connection point of the honesty with which he's questioning faith and the honesty with which he's addressing pluralism and the intelligence with which it was being portrayed. It's one of my not just favorite Indian films, PK is one of my favorite films ever. It hits me in the feels. I love watching him as that character. I love the love story in it. I just love that film. Yeah. My three is The Lunchbox. Hey. Yeah. Yeah. That was just such a brilliant film and also just such an enjoyable film. Yeah. It's easily digestible for any audience, but different in terms of critically wise. I think anybody would like this. I would say that's the difference with English English from The Lunchbox is that The Lunchbox makes sense on the film festival circuit and in awards conversations. Whereas English English, it doesn't make it any less of a film. I love them equally, but English English is not an awards film festival circuit kind of a film. No. Lunchbox is at that level. Yeah. Absolutely. And that's it's just it was so so great. And so different on it. Well Irfan's performance was obviously just in the president was so different. That's that's what he's like. I can't believe that's no was it. Yeah. He's just so brilliant. The direction was so good. It's just it's so good. Their three is. Hey. Yeah. Just because of our review. Come on. Admit it. And I do. I do wonder if people didn't understand this list. If it's because it's this is supposed to be there. It's not right. I'm predicting. No. They're there. Yeah. Favorite. Your favorite. It's not what you think we would think. Not your favorite. Our review either. Right. It's supposed to be under reviews. That's why it's so high. But yeah, the I love them. I thoroughly enjoyed that was actually in contention for my top 10 as well because it's such a unique film and it was it was so so well done. But yeah, the theirs is under. I could I enjoyed it but could never have included it in the top 20. We know. It's not number two. Number two. Yeah. Nice. Thanks. This will give away because those of you who've seen and paid attention. There's only two films left. I haven't mentioned that would be here. So by me mentioning this one, you know what my number one's probably gonna be. My number two is header. That's surprising. That is it too. Go ahead. Talk about what's there to say a lot. Header is just as it's one of my it's one of my favorite films of all time. Like I go down the list of my the films that I think are the most important and best things ever created. Or you know, I start off at the top of Schindler's list and Graveheart and Gladiator and this goes right up there. And this is like my favorite interpretation of Shakespeare's Hamlet was Gibson's version because it was such an accessible version. It takes the four and a half hour play and makes it really accessible to people. And I watch Mel Gibson do something where he's never going to be Daniel Day-Lewis ever. But I watched the guy. I remember when he did the film and I thought really Mel Gibson's gonna do Hamlet. And it was a ballsy thing to do. And I thought he did an excellent job.  It is it is I it is the most incredible. Like I said, there was a point where I was like, this is perfection. Don't mess with it. And they didn't all the way to the end. It's as good of an adaptation of it's the best adaptation of a Shakespearean piece I've ever seen in my life. And I can't imagine anything being better. So it's it's an extraordinarily brilliant perfect movie. Yeah. My number two. You said number two like it's poop. Yeah. Is Gangs of Wasp. It's your number two. I was I would have bet money that Gangs of Wasp was gonna be your number one actually. It could have been for most watchable. It could have been. And actually before we watch part two, it wouldn't have been on my top 10. And I totally agree with it. I mean, it wasn't meant to be two parts. So that makes sense. Exactly. Another thing of the juxtaposition. There's the word for you. I think Gangs of Wasp or I said this in the review is one of the greatest gangster films ever made. Yeah. I would love to watch it again. But it's not something I want to go back to all the time. That's why it's not in my top 10. Especially with the second part. That's solidified for me. I could not stop smiling about the second part of it. Yeah. And I think if I go back and watch the first one, that I will appreciate it a lot more. Me too. Also, like I said, I think we watch it too soon. I agree. But yeah, I couldn't say anything. Couldn't say more nice things about Gangs of Wasp. The Stupid Babies number two is Heather, which is why I think, which, you know, I agree with, but why I think some people misunderstood. Because I don't think people before, I knew people thought it was a really good film, but I don't think people put it at the level we put it at. You may be right. They may have been guessing what we thought would be our favorite. Yeah, because I, I don't think that was, a lot of people, when we said it, they said, I didn't realize how brilliant it was until y'all explained it. I remember that too. And so that's why I'm like, maybe they realize it now. Maybe that's what they're saying. But I honestly, I didn't expect Heather to be in their top 10. Like it was for us. I could be totally wrong. But from what I remember, I was like, it wasn't like an acclaimed, I mean people loved it and thought it was great. But I don't think they put it like in their top 10. Right. But I could be totally, totally wrong. I think some people misunderstood what this was supposed to be. Maybe it's good. But anyways, your number one is our drum roll. I think it comes as no, this is not a surprise.  Oh, my number one is Gully Boy. Yeah. The personal aspect behind that. I mean, I've got a fricking arm tattoo of up my time. I got the personal connection, what it means and not to take away from the fact that I do it. That movie, the trailer singularly not only brought about the birth of the channel, right? Yeah. But for me and for you, it completely opened up a door into a whole new world that we'd never thought to look at before. It was because of the trailer that we genuinely went, dang, I didn't, I had no clue. Indy was making stuff that looks this good. And then when we saw the film, we were like, dang, who are these people? Who are, who is that girl? Who is this cast? We didn't care too much about that runger, whatever his name is. Yeah, he was, he was, he was pretty good. He was fine. And the, the, uh, this, the quality of the film itself, and then when we learned about the behind the scenes and the way Zoya went about going, about making it female director and her vision and making every, not, not using the color blue, everything about it. And I can't escape the fact that it is, I will always go back to it, not just because I enjoy the film. And I agree with you. I like a way more than eight mile. I, I would go back to it over and over again just because it's such a good movie. But going back to it has such a reminiscent emotional deep thing because it embodies everything about why the channel even came to pass, which goes even deeper for me is because, because of gully boy, I, Andrani saw me and I met Andrani. So it's nothing's ever gonna surpass in any Indian film, gully boy.  I had to choose between PK and three idiots. I could have both been in them. And then I would have had to get rid of something else. I'm just surprised.   And it still is a movie I will go back to over and over and over and over and over and over and over again.   But there's no performance in three in its three days, like Priyanka's. And there's, there's something so beautiful. The directing, some of the shots that the director does in that. I can't not go back to barfi. Yeah. If there was any one film that didn't make my top 10, that's the most painful for me. So that'd be your biggest honorable mention.  If I had to add one more and say honorable mention goes to, I'm also extremely surprised to honey wasn't it? That was that was next. Honestly, that was next. But I, for the exact same reasons, I had, I had something had to give.  So there's so much stuff there and Durga Pooja. It, those though, I, and I might in revisiting it because of the time we took. Yeah. If I was making the list tonight, I might change a few things and I might put, I had a hard time, not including Kahani and three idiots. I thought for sure those were going to be in your list. Yeah, I, those, because if I, if I get rid of either Dev Doss or those are some of the older films. Yeah, I was just surprised. But yeah, I might even see again, like I go back to Piku for the acting stuff and just watching those three doing their acting. But if you were to choose between Piku and Kahani, I would, I don't know. I'd have a hard time. I would probably choose Kahani at that point. But I would want to watch the acting more often on Piku. So I would watch scenes from Piku more often, but I would watch Kahani the film more often. So hard. Both of those were very tough. Both of those could have been in my top 10 as well. The Kahani and the, Were you surprised that Gangs of Wasiper wasn't in my top 10? No. Yeah.  But my number one is a header. And it was, and this is probably very anticlimactic and I'm sorry. Sorry, I was sort of shocked. There's no film. Gangs came close to touching it in terms of just my personal favorites of just something that was just so good to me. But I think that the only difference is it'd be much easier to sit down and watch Header than to watch Gangs because of 100%. 100%. Yeah. I might even just start, honestly, with Gangs at two every single time because of how much I enjoyed that. Yeah. But they were both brilliant to me. But the Header is just, I did an entire scene from it. And so I spent months, months just watching the film. And I loved everything about the directing. I loved everything about the performances, the story. Just it introduced us to so many people. Yeah. Well, one of the people that apparently we knew from stuff in Hollywood. Right. Taboo and Irfan. Irfan and KK Menon. KK Menon, yeah. And so many, so many different performances is just that film was absolutely just brilliant to me. But again, this was, I actually, in my top 10, there's no Padmavad or Bajoramastani. Yeah, it's strange to me. Both of those. I love those films. Both of those. Bajoramastani is probably my biggest honorable mention that would have went in there. I love those films and here's why I didn't select them. Bajoramastani I didn't because I get so hurt and so sad at the way that thing ends. I don't like it. I don't want to revisit it over and over again. I loved it. I know you did. So I don't like the way that that ends all the time. And so if I had to choose with a film that I want to go back to and I enjoy being in the most and get Sanjay Leela Bansali's genius and not feel overwhelmed or sad or too emotional or too heavy, that's why I choose Ram Leela, even though I think Padmavad's a better film than Ram Leela. Padmavad and Bajoramastani are better films than Ram Leela. Hands down. Yeah. But I enjoy sitting in the the world of Ram Leela Moore. I enjoyed all those films. Yeah. I know. Lagann, isn't it? Lagann. Yeah. I love Lagann, but I don't want to, I don't want to, that one is not one I would length for that one. The four hours on that one. That's not one I would easily just throw it and watch. I could pop it on and just sit there all day and do stuff and then come to my favorite scene. But that's crazy because I've got so many songs on my playlist. Yeah. So this is not easy. But the Stupid Babies number one, and it's not really surprising to me, is three idiots. That's not surprising because that is actually the vibe I got from the beginning of the channel. Yeah.  Yeah. Because how much people love that film. Yeah. And that, if I had to, the difference between three idiots, which is hard because it introduced us to Amer Khan, I probably wouldn't have appreciated PK as much if I didn't, if I hadn't watched three idiots. There was just something about the subject matter, not that there's anything wrong with the subject matter in three idiots. I love three idiots. I love the songs in three idiots.  So that's it. Yeah. You can scold us in the comments below. Yeah. Tell us how wrong we are.  But please let us know your top 10s down below. And what else we left out? We left out a lot. We left out a lot. Like we said, this was incredibly difficult. Yeah. I could list off films right now that weren't in that I could have dungled. Yeah. Udupunjab, Raghun Dabasanti, Piku, Highway Black. Yeah. Kahani, Ramleela, the Bog Muka Bog. I'm with you on every single one of those. So many films that could have been on this list. Rossi. Yeah. Alia and Rossi. Just so many that we had to leave out. Newton was so freaking good. I had to leave that one out. So there's so many, and we know that, which is why it's so great that we've barely had any that were just terrible, which is great. And thank you because you're the usually ones that recommend it. Yes. So thank you so much. And please let us know your top 10s down below. And one final shout out for Doom 3. And hopefully we can do these every year and update the lists. Yeah. Ooh. Wow. That would be interesting.  We have to do your all-time top 10. Next year, when we watch another 10, like 100, we have to now do a new our top 10s. It'd be interesting. Or I don't know if we do that or if you just do the ones you watched that year. But you also have to include the ones you've seen. I don't know. Now I'm, I gotta go look at my list again.