Welcome to State Fair Food. We're doing Wisconsin cream puffs. I made the cream puffs yesterday, thank goodness. The humidity was lower and they worked really well. Yesterday they were crispy. Today they're a little soft but they will be wonderful. We will fill them with whipped cream for you. We're also doing Turkey to Go sandwiches which is Minnesota State Fair. Since 1958 they've served Turkey to Go on a bun because Minnesota is the largest producer of turkeys in the United States. And on top of the turkey on the bun, sheboygan hard rolls. We have cranberry relish and brie cheese. I called the Minnesota State Fair and they said they no longer serve the cranberries and cheese but we're going to have it. North Dakota popcorn salad. And that popcorn salad since 1910. And 1910 their popcorn salad was banana, leaf lettuce summertime, mayonnaise and popcorn. We're going to expand that. And I thought how odd. Popcorn salad, North Dakota. Pick and save has it in their deli now.  Now we have here today, Elaine Krause, county administrator. Tell us something about Sheboygan County and you. Oh, excellent. I have been the county administrator since February. February. I've been working for the county for over 11 years and growing up I was in 4-H and went to the fair every year and know all of the food stands very well. So I am honored to be here today for Fair Food Day. And of course to my eye, she looks like she's 22 years old. That's older than that, thank you, Marilyn. Of course. And our wonderful volunteers Anne Kraft and her sister Janet Ray and Jar doing the tables. Wonderful Peg Watson. Thank you, Peg, you're always here. And thank you, thank you, everybody, thank you. It could not be done alone. And my friend, Kathy Tarpe, who lived in Sheboygan a long time ago, lives close to Madison now. She and I were in the catering together. She was always my sous chef for many years. The mansions and the beautiful houses, we went in the back door, we cooked, we left out from the back door. And you have a story that I had forgotten. I'll stand close to you so they can hear it on the microphone. Oh, I can project. Can you hear me in the back? Can you hear me in the back? She's a mother of 10. Marilyn had always said to any of us, some of you have heard this story before, and my children have heard it several times. Some of you have, Marilyn always said, I will take responsibility for anything that happens. If we break a wine glass, if we drop something, I will take responsibility for it. And I will own up to it. So one night, at the end of the meal, a man came to the door of the kitchen, stern looking, big fellow, said, who's responsible for this meal? So of course, Marilyn stepped forward and said, I am. And he said, can I marry you? Then of course, the time we did table side, flaming coffee, I think I may have told you. And the gentleman who was hosting it said, Marilyn, this coffee tastes a little salty. And sure enough, I had used salt instead of sugar. Oh yes, yep, right. The can of jar filled with a granulated substance. And it was not marked. And I did not taste it. Okay. The brot nachos, I'm going to... Oh, they're done, good. I'm going to quickly demonstrate the brot nachos. We'll put them right here. On this little tray, I'm putting the rye crackers. And then some bulk bratwurst that I've cooked. And of course, making the nachos on a big tray is usually the way it's done. But you know, if we did that here, we would not be able to get those all apart.  Okay, and cheese. And of course, however much cheese you like. And of course, the onions that I don't have. And then the squeezed sauerkraut. I had not thought of sauerkraut on top, but I was at a committee meeting and I was telling Craig Stewart, who's going to be the sous chef in October, who's the veteran's representative. I said, I'm going to... I told him about the brot nachos. And then he said, there should be sauerkraut on top. I said, absolutely. I just dreamed this up. And then, and some mustard, horseradish, and mayo. So you put it together however you want. I'll put it in this little oven. Kathy, can you turn that on and then kind of watch it? And I understand on YouTube, there's all sorts of brot nachos. Well, I had just dreamed it up. Sure, right. I would think the rye crackers would also work. Okay, so come on up and get your order. Which is the brot nachos. I was talking with my husband this week, and as I say, I talk to him quite regularly. Now that he is retired, he wants to sit and talk a lot. Anyway, when he was a young man, before I had married him, when we lived in Dallas, and he lived in an apartment across the street from me, he went to the doctor because he had such athlete's foot. And the podiatrist told him, Lee, not only do you have athlete's foot, you have scurvy and malnutrition. Because, and then I said to Lee, oh my goodness. He said, well, we guys went to work. We came home and ate bologna sandwiches and drank beer. And that was it. I said, oh my goodness. And he said, if I hadn't married you, Marilyn, I know I would not be still alive, because I would have been doing all those foolish things for many more years. Okay, cream puffs. On your cream puff recipe, I think it says, Elaine, what does it say on the cream puff rest? Oh, here, tell me what it says. A half cup butter, which is eight cups, eight tablespoons. I tried a new recipe. Use six tablespoons instead of eight. And as I say, I made cream puffs yesterday and the dry humidity helped a lot. Cream puffs are ideally made in winter time. Summer is difficult. And of course, we're going to put eggs in this. And you know the egg trick, but of course, Scott already told Elaine. Is it okay? I do need them back, so we'll find them, because I need to do that at every class. Next is one cup water. One cup water, thank you. And heat that to boiling. Yep, heat to boiling. Thank you, thank you, thank you. A pinch of sugar, pinch of salt, which I did not bring. We'll let that, we'll see. We'll let that, we'll see. Oh, thank you, thank you. Start a fire here in the, you're gonna have to have the fire to keep the one of your next guests. She has that already. Oh yes. I had Vernon Koch, yes. Oh, did you? And then two firemen came. She doesn't want salt. It doesn't make any difference. It adds flavor, it doesn't make any difference in the rising. So while that is coming to a boil in five minutes, in 30 minutes, who knows? We'll go to the North Dakota popcorn salad. All right, Elaine, if you will, Justin, put into this pan all of these things. All together? Yep. Okay, what's the first one? What's the first thing on the list for the popcorn salad? Celery, all right. And then next, water chestnuts, all right. Carrots. And I grated them myself. A person can buy those little grated ones, but they're kind of tough and dry. And what's next after the carrots? Cheese. Cheese. Cheese, oh, we don't have any. Yeah, one of those containers in the refrigerator that has cheese in it. Okay, did we go cheese? Yep, cheese, cheese, right. And green onion, all right. Do you want the whole jar? Yep, the whole jar, you bet. Carefully measured. You use what you have in your house. Well, you know, when you make a green salad, you put into it whatever you happen to have in the refrigerator. Black too? Yep. And then I mixed together the vinegar and mayonnaise and a little black pepper. I think this will taste better than simply leaf lettuce, banana, mayonnaise, and popcorn. Now, the trick is the popcorn is added at the last minute so it doesn't get soggy. Let's see, does it have cheese? Sure enough. And I do grate the cheese too. We can use the pre-grated, but you are cooks, you know that tends to be a little dry. And it has to be in order to stay separated. Wisconsin Colby and Wisconsin Cheddar. It is the Wisconsin State Fair. Isn't this Minnesota? This is North Dakota, but I'm still using it. No, we're fine, Kathy. Open, that's boiling. That is our North Dakota State Fair, except for the popcorn, we will add at the end. I wonder if Pick and Save adds the popcorn with each serving or if it has... I don't know, I don't know. Okay, the water and the butter are boiling. I will add a cup of, okay. Okay, Elaine, stir like mad. Okay. No, it'll all be done in the kitchen. Yeah, we'll do that later. I'm gonna just hold it up for a moment. You can see that it's starting to come together. And one recipe did say to use a rubber, no, no, a wooden flat spatula. And it does work better than the rubber one. Who knows why, but for this, it does work the best. Can you turn that down? Yep. I think it's burning. Okay, now we'll turn this off. Keep stirring, it's all right. Now, I'm going to put into that. Let me see, we don't have another cut. If we put this on this table, it's going to melt the tablecloth. What do we have? I know, my metal tray. Okay, there, Elaine, put it on there. And we'll pull that plug. Okay, now, one egg, just leave it. And stir like mad again, one egg at a time. And we can do it the easy way. Let me, thank you, thank you. The other way. I'm gonna get that plugged in just as soon as I'm done stirring. Oh yeah, oh, you have three more eggs to go. Okay, let's see. Okay, no, I need three more. Okay, I was just getting a lot of the eggs. Oh, okay, here, I'll let you take this. That is a noisy mixer, my goodness. Another one, go for it, one at a time. It has to be completely integrated. It doesn't have to be, it works best if that egg is completely integrated before the next egg goes in. Keep mixing? Yep. Okay, turn it off for a second. Okay, class, did I put in three eggs or four? Four, did I? Okay, thank you, thank you. And then that can be unplugged and put in the back behind us. I remembered the tip. I forgot the piping bag at home. So, we will, yep, we'll use a plastic bag. I need some scissors for my tool chest. Oh my, yep, that's fine. And of course, with this nice fold on the bottom, it's good for when you're going to put food in it. It's not so good when you're going to use it for a piping bag. You know it's gonna pop through, you know it is. Although, you can do these just with a spoon. But let's just see how long it takes for this baby to pop through. I'm gonna leave a little here. And that tray. So, we can just do this. And of course the cream pops and take the knife and cut that off for me. Yep, thank you. And you can make big cream pops, you can make medium or large. I'm making them really big. That's all right. This is demo. The ones we're eating are already completed. Any questions? They're perfect. They're perfect. These will go into the oven, according to the directions. And that does work pretty well. And they should be golden brown, better on the darker side than the light side. Okay.  Or if you use the fancy word, you make the pate choux into profiteroles. All the same thing. All the same thing. Just like the chamele is white sauce. You're impressing us with all these words that we can't pronounce or spell. And you don't have to. Really, there are no tests in your own kitchen. The tester does not arrive on your door. Good. What's next? Okay, we'll go to this turkey. Remember, a number of months ago, we had turkey sandwiches for something. And I had purchased a lot more turkey than we needed. So, I looked up a variety of state fair foods in Minnesota, the turkey to go sandwich. So we have here the diced turkey. It was probably all breast meat, but if you use all of your turkey and kind of shred it together like you do pulled pork or pulled beef, that works wonderfully well also. This is diced. Cranberry sauce. I did cranberry relish. The cranberries, the sugar, more sugar than you possibly can imagine. And the raw orange. But then I added a couple jars of the whole berry cranberry from the grocery store. There was only one bag of frozen cranberries in the whole store. But, and then when I brought this in yesterday, coming in the front door, I dropped it on the cement. And it's cool. No, no. And quite a lot of it, it was on the sidewalk. But I did save this. And so, Jane hosed it down. But if people saw that, who knows what they thought. But you know, that's what cooking really is. Lots of boo-boos, lots of errors, lots of tasting and still lots of mistakes. All right, have I covered everything? Minnesota's, the turkey to go, they started in 1958. The popcorn salad was 1910. And cream puffs in Wisconsin, let's see. They started selling the cream puffs in 1924. That's even longer ago than my birthday. Okay, let us start with, I'm going to cut this open. That'll be a lot easier to get to. Marilyn, what's your preferred provider for hard rolls? This came from Johnston. Johnston? Because of Mary Ann Pearl, P-E-R-L, who does our library, is of the Johnston family. Yes, so when we had these for the brat fry, Johnston Bakery donated all of them. Oh, awesome. That is very nice. Yes. And of course, it's still the Johnston family and all the sisters and brothers still run it. Mary Ann tells the story of when she was a little girl, six children, eight children, however much it was. And her dad put a swing set in their living room. I thought, oh, that's nice. That dad liked his children. And they all still get along marvelously well. Do I have another story about anything? I did bring from the sun, I think, the Sheboygan County Fair information, which is finished. Did you get to the fair? I did, I did. And did you say that you used to show things at the fair? I did not show animals. Well, I take that back. I had my dog. I had a border collie growing up, and I had him in obedience and agility classes. But I also brought other projects through 4-H, so arts and crafts. My mom was the leader for our cooking group and our 4-H club. So we had a lot of cooking classes in my kitchen growing up. So it's wonderful to be here and doing this with you. That's nice. That's very nice. And I brought another... Would you bring that calendar to me, Pig? I took the calendars down from the basement toilet area. And I just keep putting them up year after year. This is 2014. And this gal, Scott knows her. Now she's, you know, that was 2014. Her mother was... What was she, Scott? Miss... Alice in Dairyland. Alice in Dairyland. Isn't that nice? And now, of course, she's old enough to be Alice in Dairyland. We have the white milk cartons, the chocolate milk cartons. Did you get the chocolate milk also? They're all gone. These are big heads. Oh, okay. All right, so okay. And then some strawberry milk. I had asked Pigly Wiggly to get that for me. They forgot to order it.  What will I do on Wednesday? I called the school nutritionist, left a message. I thought, well, that's the end of that. She called me back. She said, we'll provide the milk for free. Oh, great. Isn't that nice? Isn't that wonderful? I did buy the strawberry, but she provided all of the chocolate milk and all of the white milk. And of course, if you're not a milk drinker, white or, there is water there to also. And I noticed all of the milk that she provided is 1% and 2%, so that's what they provide for the students. And of course, we grew up drinking. Well, actually we separated the cream off the top of the bottle, right? To whip and then drank the rest. Yeah, right. Okay, let's start on our sandwiches. Okay. Okay.


Thank you all for coming. My name's Ethan, and I'm going to be talking about how we're signing and verifying container images in a Kubernetes environment at Datadog. So this is a talk about Datadog's internal infrastructure. But this infrastructure ultimately supports the Datadog product, which is an observability and security platform. We run at a very high scale, and I have a few numbers on this slide to illustrate that. But the important thing to remember for this talk is we run on self-hosted Kubernetes. So you have hundreds of clusters, tens of thousands of nodes, and hundreds of thousands of pods. So the solution that we design for signing and verifying images needs to work at that scale. But about me, my name's Ethan. I'm a senior self-engineer at Datadog, where I've been working on infrastructure security for about four years now. So if you have any questions about the talk, feel free to approach me afterwards, or you can reach me out the address on this slide. So why should we care about signing and verifying images? On this slide, I have a simplified model of what an internal software supply chain looks like targeting a Kubernetes environment. So it has all the components you'd expect, version control, CI, CD, a container registry, and then the various components of Kubernetes. But as an organization matures, each of these stages often serve by multiple subservices. And as the complexity grows, this means that you have more surface area that you need to secure. And each of these stages is a target for malicious code injection. So an attacker could inject a malicious payload at any stage in this pipeline, and that might reach prod eventually, allowing that code to run, even if the attacker doesn't have direct production access. So what signing and verifying images gets us is a guarantee of provenance. So if we sign an image in CI and then verify it in one or more downstream systems, what this provides us is a guarantee from the perspective of the verifier that the image that it's handling is bit for bit the same as the image that was built and signed in continuous integration. So the overall goal is to push signing as far as possible to the left, as close to build time as possible, and push verification as far as possible to the right, as close to run time as possible to extend the scope of the integrity guarantee of that signature. In the past, there have been a variety of approaches to signing container images. But the ones that have achieved the best adoption all have an architecture pretty similar to the one I've drawn on this slide. So the common property is that the registry that's used to store application images is also used to store signature metadata. And this is made possible because registries following the OCI specification are actually able to store data that's not what you would normally think of as a container image. As long as it fits the spec, you can store essentially any kind of blob, including signature metadata. The signing itself, signing and verifying itself is achieved through public key cryptography. So the signing client uses a private key to generate a signature, and then a corresponding public key is used by the verifier to verify that signature. But the way in which you distribute public keys to the verifier is largely left to the implementer. There's really no standard read of trust to connect the signer to the verifier, and there probably never will be, because each organization is going to have its own threat model and its own preferred way of handling secrets. So I've spoken generalities here, but two systems that you might have heard of that have this high level design are six doors cosine and a Notary V2, and the system that we've built a data dog also has this high level design. So we're using the container registry as storage for signature metadata. And this stands in contrast to some of the earlier approaches that used more traditional databases. So there's a few interesting things to say about this. First, I think the success of this design is largely because container registries aren't a new runtime dependency, and this makes the system easier to adopt and more reliable, because there's few moving parts and you don't have to, for example, manage yet another database. But a data dog, one of the reasons that using the registry for storing signature metadata was a particularly good idea for us is it allowed us to build on an existing replication platform. So we run a number of isolated data centers, and by design, there are very few systems that are able to transfer data between these data centers. And notably, one of those is the registry, because we need to be able to build an image in the build data center and transfer that image to all the runtime data centers where it will eventually run. So by pushing signature metadata to the same registry, we get to reuse the same replication mechanism to distribute those signatures everywhere that the verifiers will need them. It's important to note, though, that taking advantage of this fact doesn't come for free because we're replicating signatures to all the same places that images will run. We're doubling both the replication load and also the number of stored images. So you definitely need to be mindful of any registry quotas that you may need to comply with before you start signing images. So we discussed storage, but what do the signatures actually look like? The format that we developed the data dog is loosely based on SigStore's cosine format, but before we dive into the specifics, I want to give a quick caveat on why we ended up building our own. It's almost always a best practice to use an open standard when it comes to cryptographic designs, especially if you need interoperability, such as if you're signing images that will be distributed in an open source setting. However, at the time that we implemented all of this, cosine was still pretty new and there was no reigning standard yet for signing images. The sign and verify operations of cosine at the time were only available in a CLI and we knew that we would need to override a lot of the low-level functionality of those operations for compatibility with our internal systems. So I know that there's a lot of ongoing work in the SigStore community to build these low-level libraries that expose these components in a modular way. So if we were to start again today, it's pretty likely that cosine would have worked for us out of the box. So I'm going to describe the signature format from the inside out. So at the very core is the signature payload and this is what we're trying to protect. The format that we ended up using is the OCI descriptor which contains the digest of the signed image, the media type and the content size. Additionally, there's a key value map available called annotations and we use that to store and also sign the timestamp as well as the number of claims about the identity, the internal service identity of the signer. So that payload is signed using the add25519 algorithm in hash of corp vault and that signature is wrapped up in a signing envelope using the dead simple signing envelope spec. So this is a spec that was developed for the Tough and InToto projects, also CNCF projects and what the specification gets us is a data structure that combines the payload with a number of signatures as well as a standard spec and ready to go libraries for building these envelopes and verifying them. So to store these envelopes in a signature that we can push to your registry, we combine them into an OCI image manifest where each layer represents one envelope for one key and we annotate each layer with the key ID which is just a fingerprint of the public key for easy lookup during verification. So that's essentially the data structure that takes the place of a container image so we need to push that to the registry. And the location that we push that signature artifact to is a transformation of the location of the artifact that's being signed. So we add a prefix to the repository path and we convert the SHA-256 digest into a tag. And this is a little bit different than the approach that cosine takes in that we add this repository prefix. And what this gets us is a dedicated registry quota on these signature images independent from the quotas imposed upon the signed images. This gives us just a little bit of isolation in terms of the volume of images pushed versus signatures pushed. So to produce these signatures, we've chosen to encapsulate signing in a service. So at a high level we're pushing handling of keys and signature metadata behind an RPC service that is more hardened than CI is. So jobs in CI that are building and signing images use a thin client to send an authenticated RPC to the signing service over TLS. And then the service responds to that by building the payload, using a hash report vault to actually sign it. And then wrapping it up in the metadata format that I just described and pushing that back to the registry. The thin client that CI jobs are actually using is a CLI that we call DD sign. Looks pretty similar to cosine if you've used that. But we've designed it to be simple, have a extremely stable API and additionally easy to integrate into many CI pipelines. So there's not many options here to configure. Essentially to use it, you just call it DD sign sign and then the reference of the image that you'd like to sign, including a digest. So you're signing exactly one image. And we also have helpers for specific types of image builds to make integration especially easy. So for Docker built images, we have an option that pulls the digest directly from the local Docker daemon in CI. So you don't need to write complicated shell scripts to do that. And we also have a custom Bazel rule that we use to sign Bazel built images. And this approach of having a signing service and then a thin client in CI has worked really well for us. And I'm gonna touch on a couple of the reasons why we particularly like it. So first, compared to if CI jobs were signing directly with HashiCorp Vault, we have much better control of key usage and we get richer audit logs. So on the side, I have an example of what it might look like if we are signing directly in CI with HashiCorp Vault without the signing service. And the all audit logs, although they're solid, in terms of the payload, they only contain an HMAC of the signed data, which is opaque and hard to interpret. We can't, for example, filter them after these logs are collected based on the signed artifact reference or something like that. So in contrast, when the key usage and metadata handling is pushed behind a service, we can now apply a least privileges principles to the CI jobs that are requesting the signing. This means that they don't need direct signing access in Vault and they don't need to have direct access to push signature metadata to the registry. They only need to express their intention to sign the artifact to the signing service and then the hardened signing API takes care of the rest. As an example of the kind of audit logs that we can get out of this, we have identifiers available for the CI jobs that are requesting the signing and also parsed out fields of the signed artifact for easy filtering. Another benefit of signing in a service is that it encapsulates most of the complexity of signing behind a single deployment that we can dynamically update. Updating clients in CI is an incredibly tedious and time consuming process, especially when you consider that there are many branches, some of which might be behind the trunk and you can't update those directly, et cetera. So we really don't wanna have to update clients in CI frequently. As an example of a big change that we're able to make without touching clients in CI at all, we introduced a deduplication feature in image signing. So we were looking for a way to reduce the load that we're putting on the registry caused by signing images and pushing those metadata to the registry. And we found that only about 3% of the image signing requests that we were receiving were for brand new images. And we think this is because our reproducible builds were rebuilding the same image at different points in time. So by changing the logic of handling an image signature request to first verify, or attempt to verify signatures for the current key set and only if that verification fails, produce another signature. By introducing this logic, we are able to divert most of the registry load to the read path, which is much less expensive. So this was a huge performance and reliability benefit to image signing. Additionally, in this design, key management is also completely transparent to clients. So you can do things like rotate keys without updating CI. And to some extent, Vault provides this abstracted key management, but we found that we needed to implement several features on top of the features available in Vault. For example, if we need to sign with multiple keys in one signing request. So that's about all I have time to say about image signing. So now onto verification. So if you have to consider, or if you only have one, if you have to choose one point in your software supply chain to verify signatures, there's a bit of a trade-off that you need to consider. And that is the earlier you sign, pardon me, the earlier you verify an image, the faster you're able to get developers feedback. So you can, for example, stop and deploy before it even starts if there's a benign image signature verification issue, rather than stopping at mid-deploy and requiring a rollback. In contrast, the closer to runtime you verify a signature, the better security properties you get because the integrity of that image is guaranteed over more systems and the trusted compute base after verification is much smaller. So ideally you would verify in multiple spots to get the best of both worlds, both fast developer feedback as well as better security. The typical recommendation that you'll see in open source for image verification is to do so in the Kubernetes control plane using admission controllers. But at Datadog, we made the choice to verify at the no level within the container runtime with supplemental pre-deployed checks for that fast developer feedback. So to explain why we opted against using Kubernetes admission webbooks for image verification, we need to understand how they work. So admission webbooks basically allow you to write custom pieces of code and run that code to determine whether creating, updating, or deleting Kubernetes API resources is allowable. And there are several kinds of admission webbooks, but the typical choice for this kind of problem is the validating admission webbook type. The important thing to realize here is that the latency of the code that you're running in a webbook is added to the baseline latency of handling an API server response. And this is because the API server blocks on a webbook through a turn its response before returning its own response. And the large clusters that were running at Datadog were really careful about avoiding introducing back pressure on the API servers. So the latency goal that we have for admission webbooks is about 10 milliseconds at the P99. Unfortunately though, image signature verification is an online or somewhat online process since it has to talk to the registry. And this is quite hard to fit into that latency budget. In practice, the latencies we see for image verification are actually closer to 200 milliseconds at the median. So this on its own is enough for us to rule out admission webbooks as a solution here, but another disadvantage of the approach is that using the registry for signature metadata introduces a new cluster level dependency. So whereas previously the registry was only a dependency at the node level for pulling images, it's now on the hot path of the control plane. So this has some pretty serious reliability, reliability or changes to the properties for reliability. So one workaround that you could consider here is using a different kind of admission webbook, the image policy webbook. And this is one that has built in caching and retry features. So for example, it would patch around intermittent verification failures. But we're not very comfortable relying so heavily on essential cache like this to meet our baseline performance goals because if that cache were to be cleared for any reason, the API server could be put into a state of metastable failure where it's unable to keep up with the request following necessary to rebuild that cache and get back to its normal operation. So the alternate design that we chose was to verify image signatures in container D. So as a refresher for the architecture here, container D sits one level below the Kubelet and receives commands from the Kubelet like create container or start container over the container runtime interface or CRI. So container D is the process ultimately responsible for resolving an image digest, pulling that image from the registry and unpacking it to disk. To actually run the image, container D differs to a lower level runtime like run C over a shim layer. So the obvious place to integrate image verification to this flow is right after resolving the digest and right before pulling the image. This is pretty much as close as we can get to runtime as possible. So we've minimized the trusted compute base after signature verification. At Datalog, we truly believe that the container runtime is the most appropriate place to do image verification. So we're pretty excited to see momentum pick up around this discussion in open source. For example, cryo and cauda container runtimes, I think as of recently both have support for verifying six-door signatures on pull. But at Datalog, we use container D. So we've taken the initiative to contribute these features upstream. The basic approach is to add an image verification plugin system to container D. So users of container D can supply custom bits of code that container D would call to determine whether pulling an image is okay. So if the plugin returns a response saying the image is okay or the signature is verified, for example, container D would continue the image pull as usual. Whereas if the plugin returns a response saying that the image is not okay, container D would bubble up an image pull error to the kubelet. So because the kubelet sees an image verification error as a type of image pull error, this means that we benefit from all the features in Kubernetes for pulling images reliably. So for example, at the node level, we have the kubelet's image pull retry loop, which in our case would retry to patch around intermittent verification failures. And we also have the pod feature of image pull policies, which allows us to cache image verifications at the node level. So if a container has to restart, for example, you wouldn't need to do a second image verification. Additionally, the latency concerns that we had in the context of admission web hooks are not applicable here because image pulls are expected to be slow. Images are quite large sometimes. And all of these systems are built that in mind. An important thing to note though is that the only reason we're able to pursue this architecture of Datadog is because we're self hosting Kubernetes. So we have access to all these low level components on the node. So if you wanted to implement an architecture like this using a managed Kubernetes cluster, cloud providers would need to expose this kind of image verification configuration at a higher level, but we're pretty hopeful that industry will move in this direction eventually. So we've been running a temporary fork of container D with an implementation of this idea implemented. And we're working with the maintainers of container D to get these features into the two.overlease. So if you're interested in following along, I have the link to the tracking issue here. There are some PRs there, but just note that the implementation details are not yet finalized. So this slide shows the developer's perspective on the image verification system. So if you try to run a pod that has all signed images, everything works as usual. Whereas if there's any unsigned image in a pod, the pod is put into an image pull error state. And developers can get full details on the issue using pod events. And because this is a new and potentially confusing error for developers to see, we've made sure to make the error messages as friendly as possible and also included an inline wiki link for support and escalation. So the last thing that we need to talk about for image verification is how we're distributing the config for verification to the node. So in order to verify an image signature, the container D plugin needs several pieces of information. First, it needs a trusted public key set. And this is dynamic if you consider key rotations. Second, it needs a verification mode. So we need the ability to put the system into either audit mode where it's only checking but not blocking anything. Blocking mode where it would reject images that aren't signed or a disabled mode to disable the entire system. And additionally, we'd like to configure this at a relatively granular level. So we can be in different modes in different parts of our infrastructure. And finally, we need to distribute an image digest revocation list. So because our signatures don't have expirations, we need to be able to revoke them in some way. And typically we would prefer to revoke image signatures using a public key revocation, but this is a bulk operation since public keys are used over multiple signatures. So if we only have a handful of images that we want to revoke signatures for, we would prefer a revocation list for this use case. And our requirements for distributing this configuration are mostly guided by reliability. So we don't wanna introduce any new node level dependencies. We need the ability to roll out this configuration in a slow and staged manner. And also we'd like to have multiple fallback mechanisms for configuring this, or distributing this configuration. For resilience. To distribute the public keys in verification mode, we've taken a layered approach. So we bake a set of defaults into the node image. And this is kept relatively fresh using our automation for building and rolling out new node images. But in order to get faster updates than that, and we also have a dynamic update system that runs on each node. And what this does is it periodically pulls a config map that sits in each cluster and mirrors that to disk. And we're able to slowly roll out this config map just like we would roll out any application to multiple clusters for slow incremental updates to this configuration. Finally, we have an override config layer on disk that takes precedence over the dynamic update mechanism. This allows us to do pretty much zero dependency overrides if we need to. And in general, this layered approach allows us to roll out config at essentially any layer of the stack. So we can continue to operate the system under a wide variety of incidental constraints. The approach for distributing image revocation lists is actually a bit simpler. We simply bake it into the machine image on build and forgo any dynamic update mechanism. Just like how we bake defaults in for the verification mode and public keys, this has kept relatively fresh using our node lifecycle automation. The interesting thing to note here is that dynamic updates for this revocation list wouldn't actually be useful, even if we implemented it. And the reason for that is because container D is caching image pulls or pulled images on disk. So if you wanted to purge our infrastructure of a single image, we need to not only make sure that we don't pull it again on new nodes, but we also need to remove it from all existing caches. So in practice, our approach here is to prioritize draining nodes. So moving workloads off of them and deleting them that have run the invoked image at any time in the past. So we're nearing the end of the talk. So I wanna close out by discussing some of the challenges that we've encountered rolling out this system and recommendations that we have for others heading down this path. I'll say the most significant challenge we faced in rolling out image verification is that you can't easily configure the verification mode by Kubernetes namespace. So at the cluster level, namespaces are handy boundaries to separate different tenants in the same cluster. But because nodes can run containers for multiple namespaces on the same node, we don't really have this boundary available to us. What this means is that you might need to sign all the images in a given cluster before you can turn on blocking your verification mode. And this could be quite a challenge, especially in a large multi-tenant cluster, simply because there's more images that you'd have to sign. What we found here is that having dedicated clusters for more sensitive types of workloads not only has the obvious security benefit of extra isolation, but also this allows you to more easily sign all of those images in the cluster because there are fewer of them. And then you can go from audit mode to blocking mode in that cluster sooner. Second, in an organization with a lot of diverse CI configuration, it's a lot of work to globally add a new signing step to all of those builds, even if the integration on each one is relatively simple. And what we found here is that monorepos and consistent build tooling like Bazel make it quite easy to make sweeping changes like this. And my recommendation in general for rolling out image signing is one, to leave ample time for it, but two, simultaneously roll out audit mode signature verification. This not only allows you to develop operational experience for the verification system sooner, but also it will provide an additional source of telemetry for what images are signed where. Finally, node level image verification is relatively uncharted territory. So it's been a challenge to develop new techniques here. That said, we truly believe that the reliability benefits are well worth the effort and we're really excited to guide these features into container D2.0 so they're more readily available to everyone. So to close out, three takeaways. First, evaluate whether encapsulating signing images in a hardened service is worth the security and scalability benefits. This is very likely not the right decision for everyone, especially if you're only building images in a few places. But in Datadog's CI environment, there's no question that this was the right choice. Second, think critically about using admission controllers for complex verification processes like image verification. At scale, you may come to the same conclusion that we did at Datadog and prefer the properties of image verification in the container runtime. Lastly, these verification features are not yet merged into container D. So if you're a user of container D and you think you might use a feature like this, I welcome you to join the conversation at the link on this slide and give us your input. That's all I have. Thank you for your time.


Hey, what's going on guys? My name is John Hammond and welcome back to the Python programming tutorial and this one around We're taking a look at proxies. We're finally be able to set those up really really simply and really really easily so it's taken as a keyword argument in our URL open function and That's all so let's go find ourself a proxy. Let's go to Google Let's just look up proxies It don't matter and hey free proxy list.  It's got an IP address. It's got a port here So we want both of these information And we'll hop on over to idle import your lib You and let's actually create a variable for proxy and that's actually going to be a dictionary So this takes this schema that's going for which is always in this case HTTP And that's all it needs to be that's just gonna be our key and then we need actually The proxy itself so it's IP address and then specify its port with a colon and the port afterwards. So Where'd it go? Where the heck'd you go? You update that quickly?  No, there you are Let's just take you Okay, so now I've got that variable set up and if we actually run before we use the proxy. Let's actually check out Something so we can see our IP address before and just so you guys believe me. Let's go to httbin.org And forward slash proxy. Sorry for slash IP. We'll get us our IP. We just read this Okay, so that's my current IP address now. We want to know what it is after we supply a proxy You guys know that we can supply proxies as an argument in our URL open function So let's throw that in there We're gonna use it as a specific keyword argument because there are other things we could throw in this in this function So let's specify it with our proxies and then we'll use that proxy variable that we just created Now when we run this Takes a little bit because we're going through all of that networking to go through their their proxy and boom there It is really really simple now We're coming from their IP address rather than ours all we had to do is specify that we're using HTTP The proxy that we're gonna use its IP address and the port that we're going through super simple right super super easy We can build this into our own URL URL opener object with the if we create our own class if we subclass the thing and we use up the Super function to call the constructor with this proxy because there's no variable for it in The objects in the in the class kind of blueprint But we can do that with the super function if you guys need help setting that up and you're curious about it You can just say the word I'm not gonna go through and demonstrate it because I think this is simple enough and pretty easy to learn And follow through so cool. Hope you guys enjoyed it Hope you guys liked it and trust me we're using that proxy right now with everything we open up when specify We're gonna use that process that proxy. Thanks for watching everybody. See you in the next tutorial


Democratic U.S. Representative Rick Nolan says he will not seek re-election this fall in Minnesota's 8th congressional district. Nolan plans to retire to spend more time with family, creating an open race for a Northeast Minnesota house district that has become swing territory in the past decade. Nolan says he's stepping aside to give other candidates plenty of time to build campaigns. He already faced at least one primary challenger. The 74-year-old Nolan barely defeated Republican challenges in his two re-election bids in 2014 and 2016. The sprawling district was among the most expensive congressional races in the country. If you enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland PBS.


Ladies and gentlemen, the story you're about to hear is true. Only the names have been changed to protect the innocent. Fatima cigarettes. Best of all long cigarettes brings you dragnet.  You're assigned to robbery detail. Two armed bandits have robbed a large jewelry store in your city. One of the suspects escapes. One is apprehended. He's identified as a friend of yours. Your job? Send him to prison. If you want a long cigarette, smoke the best of all long cigarettes. Smoke Fatima. Fatima is the long cigarette which contains the finest Turkish and domestic tobaccos, superbly blended to make Fatima extra mild. And that's why Fatima has a much different, much better flavor and aroma than any other long cigarette. That's why Fatima is doubling and redoubling its smokers. So if you want a long cigarette, smoke the best of all long cigarettes. Smoke Fatima. Dragnet, the documented drama of an actual crime. For the next 30 minutes in cooperation with the Los Angeles Police Department, you will travel step by step on the side of the law through an actual case from official police files. From beginning to end, from crime to punishment, Dragnet is the story of your police force in action. It was Tuesday, February 8th. It was cold in Los Angeles. We were working the night watch out of robbery detail. My partner's Ben Romero. The boss is Thad Brown, Chief of the Techies. My name's Friday. I was on the way over from the city hall and it was 8.35 p.m. when I got to the second floor of the Georgia Street receiving hospital treatment room. Joe, hi. Hi, Doc. Ben, how's it going? Okay. It hurt for a while. Doc gave me an injection. Six of a grain of morphine, novocaine injection. The bullet's still on your shoulder? Doc's about ready to take it out. As soon as I get the wound clean, here's the soap and water nurse. Alcohol sponge leak. How's it look, Doc? There's the X-ray, shallow penetrating wound in the deltoid area. The blood is larger than the soft tissue right here. No bone involvement. Okay, the bullet will spin. That's good. Feel okay? Sure. Nice. Let me file that application, please. All right. Let's see now. Where'd you leave that at, Joe? Interrogation room. Reynolds and top center with him. Let me have the probe nurse. Yeah. Got anything, Romero? No. That's it. You hear that? Hear what? Located at the slug with the probe. Nice. Plus that. Thanks. Here we go. Oh, it's steady.  No, she's doing the work. Here it is, boys. On the market forever. Yeah, give it to me, will you? I will. Nice sterile saline solution. Here, get the wound. No sign of Tyler's partner, huh, Joe? Got me? No, not yet. Sterile dressing, please. How long did you know this, Tyler? Before he went wrong on me. I met him in the Army, helped him line up a job when he got on. Sure is funny. Making a friend of yours pulled an arm robber. I was just surprised, you know. You want me to drive you home when the dock's finished? Let's go back to the office and talk to Tyler first. Okay. Is that all right, Doc? No. You're staying right here, Romero, till tomorrow morning. If you haven't got a temperature by then, I might release you. Oh, it's only a flash wound, Doc. I feel all right. I'm not taking any chances with gunshot wounds. If infection set in and you were laid up, I'd have the pension committee to answer to. You're staying here. Sounds like an order. Please, you can pick them up. PNF will be my morning. Okay. You gonna need anything, Ben? Yeah. A phone to tell my wife I won't be home for dinner. His name was Max Tyler, white, male American, age 32. Dark hair, brown eyes, medium build, married, father of twin boys. He was a friend of mine. We served together in the Army overseas, and when the war finished, I came back to my job on the force, and Max went back to his old job. It didn't fit him anymore. He stopped working and started drinking. His wife didn't help much. Max started with small trouble, but it grew fast. On the afternoon of February the 8th, Tuesday, Ben and I surprised two men holding up a main street jewelry shop. Shots were exchanged, and Ben received a flash wound in the shoulder. One of the holdup men escaped. The other one was apprehended. His name was Max Tyler. Hi, Larry. Hi, Joe. Glad you got here. Tyler says you won't talk to anybody but you. Okay, boy. Thanks for standing by. I'll be outside. You need anything? Joe, you're in deep this time.  I didn't. This guy was with me. I didn't fire once. You were in on the job? Yeah. Then don't expect presents. I don't expect anything, Joe. Glad you came back. I don't want to talk to those other cops. I work in the same department they do, same job. It's easier to talk to you. What's your story? I was crazy to try it. No alibis, Joe, but I didn't know what I was doing. Believe me, I just didn't realize... I won't buy it, Max.  Sure, I hung some paper, but I know who it is, Joe. You know that. I was drinking. I needed a door for Dorothy and a kid. You got to believe me. I need a break. You said that before, too. I went to bat four. You got off with six months and three years probation. Now you turn up with another caper. I know, Joe. I know. I'm sorry. You're sorry once Max and it works, but one free ride's enough for anybody. That's it. Did I say I wanted that kind of a break? I'm Joe. I serve every day I own. And then what can you tell me you couldn't have told the other cops? I want to ask you a favor. Yeah? I know you're going to hook me on this. So while I'm doing my time, Dorothy and the kids are staying with relatives out in Eaglewood. If you're... just keep an eye on them, you know, Joe. I don't mean, though, Dorothy can work, but... kind of watch out for them, huh? Give them a break, Joe. It's not their fault. They do, Joe. Yeah. Sure, I'll take care of it. Now you do something for me. Anything you want, guy. Let's have the straight story. Who was the guy with you on that hold up this afternoon? Cresta George Cresta, you know him. Out of Folsom? Short guy? Black hair? Yeah. Yeah. He's got a room above the Red Owl Bar down on East 3rd near Broadway. That's where he hangs out. Where can we find Cresta now? Well, maybe there. I don't know. I'll give you a list of the places he goes. Saw his friends I've met. He sure roped me in. Said there was going to be enough stuff. You were carrying an S&W 38? Sure, sure. When they got outside the jewelry shop, Cresta jammed the gun in my hand. I had to put it away, get it out of sight. Believe me, Joe, he roped me into this. It sounds like an alibi, no. This is your second time around, Max. It sounds like one. Okay, I got nothing coming. Don't forget about Dorothy and the kids. I promised you. Now you want to give me a full statement on the hold up now? Anything you say, Joe. I'll call for a stenographer. Joe? Yeah. I'm sorry. I am. I believe you. You got the feeling too late, that's all. Max Tyler was arraigned in Municipal Court two days later. Bail was set at $10,000. Three days after that came his preliminary hearing in Municipal Court. At his arraignment in Superior Court, five weeks after he'd been apprehended, Tyler entered a plea of not guilty. A date was set for his trial in Superior Court. Meantime, the hunt for George Cresta, Max's accomplice, went on. There wasn't a sign of him. Our informants had no lead on him, and the all-points bulletin containing all the information we had on Cresta brought in nothing. On Monday, March 22, the trial of Max Tyler was held in Superior Court. Ben and I were subpoenaed to appear. The victim of the hold up, the jewelry store manager, was the first to testify. He was questioned by both the prosecutor and the counsel for the defense. He left the stand at 11.25 a.m. Give it please, your honor. Counsel for the defense. Before the next witness testifies, is there a permission to approach the bench? A permission granted. Countable prosecution may also proceed. Wonder what that's all about, Jim? Something's up. Hello. Judge is shaking his head. Public defender's going back to the counsel's table there. What's with the defense? Your honor, as my client's desire to change his plea to guilty. Defendant rise in Superior Court. Max Tyler, is that your true name? Yes, your honor. On the 12th day of March of this year, in Superior Court, Department 83, City and County of Los Angeles, State of California, you have all been arraigned on the charge of robbery in the first degree. At that time, you have pled not guilty to the charge in question. Is it now your desire to change that plea? Yes, sir, it is. You have reached this decision of your own free will? Yes, I have. You have been no force employed, no promise of gratuity or reward to reduce you to reach this decision? No, sir. Counsel for the prosecution. Yes, your honor. Max Tyler. On the 12th day of March of this year, in Superior Court, City and County of Los Angeles, State of California, you are arraigned on the charge of robbery in the first degree. At that time, you entered a plea and set forth in this information. How do you now plead, guilty or not guilty? Guilty. Is it stipulated that at the time of the commission of the robbery, the defendant presumed that the deadly weapon, to win a revolver? So stipulated. At this time, your honor, the defendant waives time for sentencing and asks that he be sentenced immediately. That's the moment. Max Tyler, it's the judgment of this court. On the 8th day of February of this year, you did enter the premises at 23108 East Main Street in the city. And there, at the time, the felonious taking of personal property to the court, you entered the premises at 23108 East Main Street in the city. And there at the time, the felonious taking of personal property in the possession of another from his person in immediate presence and against his will. Further, said the tempers made while you were armed with a dagress and deadly weapon. Max Tyler, this court finds you guilty of robbery in the first degree. Count 2 is dismissed. That's it, Joe. The decision of this court that you be returned to the county jail is to share up and translate the state penitentiary where you serve the sentence as prescribed by law. And Jill, Miss Tyler over there, she's taking it pretty hard. Come on, we better go see her. Hello, Dorothy. I love him, Joe. What am I going to do without him? Children. I'll give it to you straight, Dorothy. You didn't do much to keep Max out of this. You drank right along with him. You don't deserve those kids. Please, I know it. Don't make it any harder. I'll do anything I can for the kids, Dorothy. That's all. What am I going to do without him? I can't be all alone without Max. It's not right. It's not right. Neither's armed robbery. Goodbye, Dorothy. Before the end of March, Max Tyler was delivered to San Quentin State Penitentiary where he started serving his term. His wife Dorothy Tyler got a job as a telephone operator. She and her children continued living with her relatives down in Inglewood. I helped them out whenever I could. Six months went by. I got a job from prison. I answered most of them. While Ben and I worked on other jobs, the search for George Cresta went on. We failed to uncover a single lead. Ten months passed. Tuesday, January 16, 1949, 4 p.m. I checked in for work as usual. All right, Joe. Cold out, huh? Yeah. Did you pick up the mail? It's lettering your box from San Quentin. Tyler, huh? How's he doing anyway? Good. Clean record. It's important up there. It says Tyler ought to be eligible for parole in about a year if he keeps his nose clean. You're going to bet for Tyler again. I don't know. See what happens. How can you see anything in that guy? He's giving you nothing but trouble. A lot of people are giving him the same. Maybe that explains it. Not for me it doesn't. I wouldn't trust him with dirty laundry. I get it. Robbery Friday. Yeah, Dorothy, what's the matter? George Creston 34, Jesse Street. A cheap rooming house down on the south end of the city. Landlord's name was Peterson. We showed him Creston's mug shot, and he told us he was in room 11. We went up a dark, narrow stairway to the second floor. Here we are, number 11. All right, stand clear. I'll try the door. It's open. He's passed out. Come on, slip the cuffs on him. That was easy. All right, I got his gun. He's been drinking all right. He'll have a big hangover. George Creston was booked at county jail in suspicion of robbery. Two months and three weeks later in superior court, he was tried and convicted of assault with a deadly weapon and first-degree robbery and sentenced to the state penitentiary. The day after Creston was sentenced, I was called to the office of chief of detectives, Thad Brown. Friday this Max Tyler is coming up for parole in a couple of months. He's a friend of yours, isn't he? That's right, in a way. You've been writing letters to the warden. You've talked to the parole board about him. Understand you're helping on his kids. They're just youngsters. You're working hard to get Tyler's parole. Do you think he's worth it? Well, I was off both him and his wife, and then she gave us that tip about Creston. Tyler's got such a good record of a cue. I figured they'd earned another chance. You're sticking your chin out, Joe, helping a con to get a parole. I think you'll realize that. Well, I believe he's a good risk now, chief. He's pretty weak in some things. He needs direction. That's all. His wife's getting better. She might help more than she did. I hope both of them are worth it. You really think some men deserve another chance, don't you? Yes, sir, I do. I wouldn't want you working for me if you didn't. Two more weeks went by. Tuesday, April 19th. Ben came down with a bad cold and had to lay off work. At the same time, a new gang started a hold-up campaign among the liquor stores out in the Wilshire district. A new rash of armed robberies broke out in the central area. It was an attempted bank robbery. It was a bad week. Ben got back to work on Saturday. Rough time, huh, Joe? Busy, yeah. Did you beat that cold all right? Sure, I feel much better. Doctor gave me some new medicine. Works good. That's fine. Maybe I'll knock off early the night if nothing's doing. Good idea. I shouldn't be too much tonight. Oh, thanks, Larry. Sure. Come on, Joe. What is it? Max Tyler. He broke out of prison this morning. You are listening to Dragnet. Authentic stories of your police force in action. And now, here's an authentic report from Fatima Cigarettes. In 1950, enjoy Fatima yourself. You'll find Fatima extra mild. Because Fatima is the long cigarette which contains the finest Turkish and domestic tobacco superbly blended to make Fatima extra mild. You'll find Fatima tastes much better. Fatima's superb blend gives you a much different, much better flavor and aroma than any other long cigarette. You'll find Fatima tops in cigarette quality. Fatima has always stood for the best in cigarette quality. For a new year of great smoking enjoyment, buy Fatima in the appealing golden yellow package. You'll agree, Fatima is the best of all long cigarettes. In the course of his career, the police officer has afforded two diverse views of the criminal. At first, the rookie cop is taught to distress the criminal at every turn without exception. He's schooled in the thousand and one ways in which the criminal operates. His psychology is motive operation. Then, when he's thoroughly acquainted with the methods of the criminal and how best to detect them, the police officer starts to learn the most difficult lesson of all. How to distinguish between the confirmed criminal and the lawbreaker, in whom there is hope of rehabilitation. After nine and a half years of police work, my first experiment in this field was with Max Tyler. I'd given him two chances to prove himself that he'd lost on both of them. So did I. Two months before his parole hearing, which might have given him his freedom, Max Tyler had suddenly decided to escape. How he figured it, I didn't know, but it was my job to find him. At five o'clock that afternoon, Ben and I met in the chief of detective's office. Two officers, Holland and Grayson, from the state adult authority, escape detail were there. How did Tyler manage his escape, Grayson? Same old story. They figured they could trust him up there. He had a good job in the prison farm. Have you checked his relatives out in Inglewood yet? Yeah, we have. We've got the home staked out. We're covering all the places we figure he might go. How about Mrs. Tyler? You're getting in touch with her, Friday? Her relatives told us that she's on a weekend vacation with the two kids, staying with friends down at Laguna Beach. We got a call into them. She'll be hearing from them soon. I understand Tyler's a friend of yours, Friday. He was ready for parole. Yeah. I was trying to help him along. I thought the guy deserved a break. He didn't need you, Joe. He made his own. Well, you're feeling bad. You weren't the only one fooled, Friday. You had the prison officials buffalo too. Yeah, I know. I helped convince them. You got any leads on Tyler at all, Grayson? I mean, from the time you broke prison? Pretty strange. They traced him as far as Stockton, and then they lost the trail completely. The Stockton police in on the search? Yeah, sure. Funny. The guy has no money, no car. We know of. No change of clothes. You figure he's getting help from somebody? Could be. Excuse me a minute. Brown speaking. Yeah, just a moment. Feel, Friday. Well, thank you. Friday, yeah. Yeah. When? Where? Just a minute. We hold on, please. It's the Tyler's friends down at Laguna Beach. Mrs. Tyler there? No, she called him last night. About 7 o'clock told him she changed her plan, and she wasn't coming. She told him where she was going? She wanted to know which highway would take her to Stockton. We told the Tyler's friends in Laguna Beach to contact us immediately if they heard from either Mr. or Mrs. Tyler. We got out on APB on Dorothy Tyler, and then we drove out to interview her relatives in Inglewood. They told us that Mrs. Tyler had the two children with her. She had left their house at 6 p.m. the night before by taxi, as far as they knew she didn't own a car. We talked with some of her friends in the neighborhood. The only thing they could tell us was that she had not borrowed a car from any of them. We drove down to the telephone exchange where she was employed as an operator, and we spoke with a manager, Mr. Ralph Cartwright. I'm sorry, gentlemen. This is Mrs. Tyler's night off. Is there something I can help you with? When is Mrs. Tyler due back at work, Mr. Cartwright? She's working the 10 to 7 starting tomorrow, doing it 10 a.m. We understand that she's on a weekend vacation, huh? Yes. You see, today was payday, so she asked me if she could have her check ahead of time. Said she had to have the money for the weekend. Did you give her the check? Oh, my no. I couldn't give her the check ahead of time. But I did do her a favor just to help her over the weekend. What was that? I loaned her my car. We got a complete description of the car together with a license number and called the office. The information was broadcast to all units throughout the city and teletyped to all points in the state. Chief of Detectives Thad Brown ordered an immediate stakeout on the telephone exchange where Mrs. Tyler was employed. The stakeout at the home of Inglewood continued. Another day passed. We checked with the bank where Mrs. Tyler maintained her account. It was 10.25 a.m. when we got back to robbery detail. Gentlemen, what did you find out? Mrs. Tyler closed her account three days ago, withdrew all her savings, $46.55. And they're not going to go far on that. Any word about that car she borrowed? Teletyped came in about an hour ago. They found it just outside Santa Barbara Abandon. Anyone see the Tylers? No reports. I wonder how those poor kids are making out. They must be crazy in his wife, too. She was going to help him pull an escape watch. He had to drag the kids along. It's a way some parents figure Friday. They owe their children nothing. The children owe them everything. Call for your Friday. Take it on two. Oh, thanks, Larry. Righty. Yeah, bird. Dorothy Tyler was brought into the city hall where there was one of her children. He was delivered to the juvenile authorities for the time being. Mrs. Tyler was brought to the interrogation room. She refused to admit anything to the officers from the adult authority. She said she wanted to talk to me. I went in. She threw her arms around me and started crying. I don't know. I'm after them as much as they are, maybe more. Where is he? I can't tell you. Why'd you do it, Dorothy? Why? Oh, you know why, Joe. You know why I had to see him. I had to be with Max. It's a bum deal. You've traded days for years. They can't get him. If I don't tell him where he is, they won't find him. They'll find him. He's got to eat. So do you and the kids. He has to go to work and working with a gun as all he knows. He'll leave a trail. We'll find him. Children. What have they done to the children? Where's Jimmy? They're taking care of him. That's more than you did. Where's your other boy, Vance? With Max? Max has him. That's fine. You and Max ought to be real proud of yourselves. I had to see him. You know that. I had to see Max. Has he got a gun? Has he? Has he used it? He just thought he might need it. He hasn't hurt anyone. I swear it. You helped him escape. Is that right? You helped him. He needed help. I met him at San Rafael. We drove all night. He didn't hurt anyone, Joe. He hasn't hurt anyone. Where is he now? Where is he? All right, Dorothy. We'll find him. Joe! If I tell you... If I tell you... Will you go alone? I can show you the way. Will you go alone? Yeah. All right. I'll take you to him, Joe. I trust you. Yeah, I trusted him once, too. 5 p.m. Monday, April 25th. Dorothy Tyler, Ben and I got in the car and headed north for the coast town of Santa Maria. Acting under orders of Chief of Detectives Thad Brown, Larry Thompson from Robbery Detail followed in another car. Holland and Grayson from the State Adult Authority were with him. It was 10 minutes past eight when we drove through the town of Santa Maria. Just outside the city, Dorothy Tyler directed us to turn off onto a dirt road. We drove about two miles. How long did it take to pull up? Across the field. Shacked by those trees. It's lonely out here. I'll go with you, Joe. Maybe Max won't understand. No, you stay here. Joe, that car... The car stopped here. It's a cop, Dorothy. It had to be. They won't shoot unless Max does. You promised. You said you'd go alone. I'll go alone. Friday. Hello, Grayson. Where is he? Did she tell you? That shack over there across the field by that clump of trees. You're talking about that, right? Yeah. He won't be in any trouble. He's armed. The cons up at Quentin say he won't be taking a lie. They say he'll shoot it out. They talk a lot. Better let us take him. You're not getting paid to do this one. I'll take him alone. I made a promise. That guy in the shacks and they have it a breaking promise. I keep mine. Keep an eye on Miss Tyler, will you, Ben? Thompson's watching her. I'm coming with you. I told her I'd go alone. There's two doors, front and back. Which one are you going in? Front. I'll be around back. Careful, Joe. Yeah. I'll be right back, Grayson. I started to cross the field. Shack was about a hundred yards from the road. The field was uncullivated and I wasn't sure of my footing. I stumbled over a tree stump. Halfway across the field, the lights in the shack went out. Who's there? Who is it? It's me, Max. Joe Friday. Come on, open up. All right, Max. Why the gun, Joe? I never thought you'd take me with a gun. I never thought I'd have to kick down a door to get you. You've changed a lot, Max. How'd you find me, Dorothy, tell you? Where is she? Outside. Your boy over there, Vance. He's sleeping. He's okay. Put out your hands. Put out your hands. Oh, sorry, Joe. Yeah. You've been good to us. I won't try to explain. Neither will I, Max. Come on. You have just heard was true. Only the names were changed to protect the innocent. On June 2nd, trial was held in Superior Court, City and County of Marin, State of California. In a moment, the results of that trial. It's amazing how many long cigarette smokers are changing to Fatima. Here are the actual figures. New York Division. Fatima Sales, sent. Los Angeles Division. Fatima Sales, up 545 percent. St. Louis Division. Fatima Sales, up 548 percent. Yes. In 1949, more and more smokers discovered that Fatima is the best of all long cigarettes. They found Fatima extra mild. They found Fatima has a much different, much better flavor. They found the name Fatima means the best in cigarette quality. In 1950, enjoy Fatima yourself. Best of all long cigarettes. Max Tyler pleaded guilty to the charge of escape and was sentenced to the term as prescribed by law. He was returned to San Quentin and then transferred to Folsom Penitentiary where he is now serving his sentence. You have just heard Dragnet, a new series of authentic cases from official files. Technical Advice for Dragnet comes from the Office of Acting Chief of Police, W.A. Wharton, Los Angeles Police Department. Dragnet honors the State of California and the men of the California Highway Patrol, another of America's outstanding law enforcement agencies. One of these men, Highway Patrol Commissioner Clifford E. Peterson, outstanding administrator and educator in the field of law enforcement, dedicates his life to making yours more secure. Fatima's cigarettes, best of all long cigarettes, has brought you Dragnet from Los Angeles. Be sure to hear, Mr. and Mrs. Ronald Coleman in the halls of Ivy starting tomorrow on NBC.


Ladies and gentlemen silent Mike, we're back Week 8 or something of the comeback last week. We talked a little programming the week before that we talked nutrition Go check that out today. I'm gonna talk about some habits some things that I've done my entire life To help build success. I guess whatever you can consider successful at To me, I guess success would be setting a goal and reaching it multiple goals being able to reach those and have a pattern Of repeatability so before we dive in be sure to give this thing a thumbs up Subscribe new videos every Monday. We might be dropping new vlogs coming comment below if you want to see some vlogs Something we used to do back in the day a little bit of day in the life a little bit of business a little bit of lifting And be sure to check out twitch we're live every Monday through Thursday hanging out all day awesome community Have a lot of fun twitch.tv slash silent Mike link in the bio or just search silent Mike on twitch So you often hear when people are talking about injuries or life or business You hear all these gurus talking and I bash a lot of gurus, but some things they have right Start to try to focus on the things we can control and Ignore a little bit if we can or push aside the things we can't control. It's time to roll with the punches Me personally this is something I struggle with Mostly out of the gym in the gym. I can deal with it You know whether it be injuries or being banged up or not having the squat rack that I want or the barbell I want All that I can handle the life stuff the business stuff does get frustrating because when I set these goals I don't like it when something else is stopping me from pushing forward And basically what I'm getting at is I had some really good mentors growing up. Obviously my mother and father number one My strength and conditioning coach Dean Durham shot the Dean and my high school basketball coach Dean Stark And all of them really talked about preparation Preparation some type of process some type of people in sports, maybe called like a superstition or or a tradition You know, you see different players do different things at the free throw line in a basketball game Maybe different players are doing a dance or or tying their shoe a certain way before a Football game before they play or or a track runner doing, you know Whether they're saying a prayer or or some kind of signal before their big race I think having a little bit of processes whether they're big small more applicable or more like Meat and potatoes or even some that are a little fluffy can help a lot in our progress So when powerlifting, you know to me the bigger ones or the meat and potatoes would be like what you eat before a squat day When you eat when you go to bed what types of foods you like to eat I used to be really eating burritos before a big session like three hours before the time you eat When you go to bed some of these things become processes programs Schedules if you will all the way down to the little things like how do you tie your shoes? I used to have an exact routine for every single basketball game I ever played on when I put my shorts on I would always go to shoot around and I had my shoes untied people ask Me now still why my shoes are untied one. I'm lazy To it's tradition when I'm squatting and stuff I don't really lace up until I'm competing or I'm going for like a PR or something crazy Just because of basketball used to go to shoot around with my shoes untied Then I would tie him up when it's time to actually warm up warm up when you're doing layup drills, etc Just an example of something all the way down to actual technique stuff So which foot you put first when you do the deadlift and you set up What's your routine with breathing and grabbing the barbell? Which hand goes first bench when you breathe when you tighten your back where you put your feet? How you put your feet and all these things similar to a basketball free throw similar to a golf swing How you set up will not only allow you to have more success and control those variables within That one movement in training session, but when repeated over time over time days weeks months years will allow you to kind of forget about all the small steps and Allow you to really focus on the big things and similar thing happens with business similar things happen with diet when you're prepared Whether you do food prep or do you order food from the same place where they have the same snacks in your house Whatever allow you to not have the small things kind of give you hiccups along the way or speed bumps Having this foundation and the decisions are almost made for you So my deadlift I've been dead lifting for 10 years my setup so he's the same So I don't have to think about which hand where my feet go what I should do with my hips All I think about is getting as tight as I can and pulling on that bar as hard as I can now in training There will be small cues. I'm trying to tell myself that I want to improve on but overall After you build these habits, it'll be easy and again nutrition lifting all the same big picture small picture Business life same thing sometimes you file an email off to Joey and finance and you can't get that back But if you handle your work your process alright every time I have to write a proposal for this job or for me like a Sponsorship or a partner or whatever. I do this process. I get it done within this amount of time So then when it is out of my hands You can just fully let it off your shoulders because again stress anxiety all these things can really add up As we don't build these processes. So just to inside how I kind of work as an athlete I'm starting to build these processes up again My routine is probably not the exact same with my squat bench deadlift because I took so much time off But it's gonna be very similar how I set up my foods a little bit Whatever as we talked about in the food nutrition vlog basically just because of my life stress I just my schedule is too packed right now for me to really be on my nutrition, but I'm doing my best But as many as I can control without Overloading myself is what I'm going to do. So the basics are the form and technique the bigger picture You know when you eat how you eat when you sleep Bigger bigger picture when you work when you train how many days a week you train and then same processes Hopefully carry over and even your personal life, you know And it sounds kind of lame that I feel like schedule in time with my mom But I'm busy and so I'm trying to make a point that every Friday Saturday I'm gonna go hang out with my mom see my dogs etc, etc And it is a way of being organized some people might be like Mike You just blabbed five minutes and all you said is be organized, but I think it's very scalable It's very easy just to put appointments in your phone and go to that if you work a nine to five Your life's kind of broke up Monday through Friday nine to five, but when you work for yourself It's a little bit more difficult and when you train And it's your goals outside of your work. You're basically working for yourself No one else cares about your deadlift PR.  We're gonna deadlift tomorrow. I'm gonna hit some twitch right now I appreciate you guys. Hopefully take something from that and I'll catch you in the next one ladies and gentlemen just a touch on the video Some questions about rpe. I've been dealing with in twitch chat if you want to coming out or my dms Basically, someone was asking obviously like when and how to use rpe because they say they're bad at judging their own lifts And it is a skill rate of perceived exertion. It basically just means a way for you to rate how well A load or lift moved in the gym. And so one Having consistent training partners can help you to just looking internally and kind of writing it down three potentially videotaping yourself Scales of right Six seven eight nine ten ten out of ten being you couldn't do any more weight You couldn't do any more reps nine being you could maybe do one more rep Maybe, you know, two and a half five percent more weight, etc, etc percentage percentage based trainings based on how How strong you are off a one rep max and that's difficult The pros and cons right the pros of an rpe is that we're not the exact same strength every single day If you're going by your one rep max at a meat, you obviously peaked for it Hopefully prime conditions and you were physically mentally revved up for that lift So what you did out of meat say you squatted 500 you probably can't squat 500 every single day yet Rpe takes that into account It's how you feel how you're moving that day not necessarily how you feel But how you're moving that day and so that's how you can adjust load the conversation We're having is how do you linearly progress in programming while using rpe? Now linear progressions are different than like typical linear periodization a typical linear periodization Means basically you're adding load every week Linear progressing can mean you're adding load But it doesn't mean that you're at maximal load if I did a five by five at rpe 10 And I've been training for a good while I probably can't add load to that and do another five by five the next week Rpe takes into account how you feel that day so that you may not need to Add load and linearly progress every week, but you may add volume Or it allows for the days that you do feel good to push it a little bit Say an rpe 9 typically, you know is a round of 500 pound squat for you for a single On a good day, maybe you can hit 505 or 510 And on a day where life stress sleep food, everything's not perfect. Maybe you hit 490 495 Again referring to the conversation we had earlier in this video in the video last week It doesn't matter so much that you're adding five pounds every single week Once you've trained for about a year It's going to be nearly impossible What matters is that we're handling, you know, some kind of strength training You know in the in the single the triple reps 90% ish when we're going in a strength cycle We're getting some kind of hypertrophy or volume work to continue to learn the skill and build different muscle fibers right in the three two three all the way up to eight Rep range That we're staying healthy and that we're progressing somehow physically and mentally Hopefully that makes some sense I do appreciate you guys all the support all the comments mean a lot Again comment below if you want the vlogs to come back some training vlogs may be coming a little bit more raw style We'll see we got some projects in the work solid mic. I appreciate you on mouth