Good morning. Good afternoon. Good evening and welcome to a very special episode of get up sky to the galaxy I am joined by two of my fellow Red Hatter's Christian Hernandez and New to the show Michael Foster Christian. How's your day going? How's your pretty? Yeah, it's been it's been crazy. It's been what we call a sprint to cube con right because all of a sudden Wow, cube cons next week. Whoa. Okay. Um, I better get to my demos. So I'm flying out in Saturday. There you go. Yeah, one times one times. I enjoy the enjoy the there was a note that Stu sent to you yesterday That you knew the answer in the slide. Oh, oh, okay. I actually thank you for that. Thank you for following up live. So Also real quick and I'd like to introduce Michael Foster here in a second I'll let him intrude himself. Um, I actually got a new keyboard. There was a saga of me getting my new keyboard It took him eight months folks. It took me eight months to get a keyboard. Yes supply chain issues But anyway, so if you hear loud clicking, that's my new Cherry MX blues. So um, I want I want my neighbors to hear when I type so anyway that aside I like to uh, this is a really long intro. I like to introduce Michael Foster from from the from the AC ACS team Michael if you want to give a little a brief introduction He's from the ACS team former minor league baseball player all kinds of crazy stuff Yeah, going way back going way back. So anyways, uh, Michael give a little short intro about yourself. Thanks for the intro Hey, everyone. I'm Mike Foster on the ACS team formerly stack rocks. We came over April I think was the official date that we moved over. So it's been a fun six months so far and Thanks for for getting me on the show Been around Kubernetes for four years now and you have a diverse background used to play baseball and I went to school in Northeastern Boston. So yeah, thanks for having me. Yeah, I know it's just yeah, it's great. I was um You know going through this it's actually been up been a while. I invited him on the on the show, but Since we had so many we did a show plan and we had so many shows that let's like, okay Well, you can come in October. This was back, you know closer to the acquisition and I Was trying to get around trying to get a You know stat the guys from staff rocks on but very happy to be here You know, a lot of the times we when I talk about get ops and when I talk about The get ops practice. I always talk about it being the core of a lot of other practices you know, for example You know, the latest buzzword is like DevSecOps, right in like Application supply chain delivery and how get ops Really has to sit at the core of that, right? Like it get ups isn't the complete story But it's part of that story and I was I've been wanting to bring in You know the stack rocks over and kind of just you know explain kind of a little bit about You know that that whole vision of having you know security be part of the process not just Not just like an afterthought and then you know continuously monitoring your process Even after you've you know deployed your your application and that that being part of the whole you know speaking a supply chain, right? We're talking about the application supply chain. So so yeah, I'm gonna I'm gonna I'm gonna shut up for a little bit That that Mike over here take over a little bit talk about talk about ACS, right? Talk about stack rocks about ACS talk about that whole ecosystem Yeah, you nailed it. Especially the DevSecOps word that buzzword that you keep hearing It's really it's about breaking that down because it's so high-level. Nobody really knows how to actually apply that and so Just want to show you some practical examples. Hopefully you can apply it to your use cases and When I share my screen, I'm going to Take you through just a couple slides.  Okay, right. Everything's clear. Looks good to me. Awesome Chris, no, you're on mute by the way. You're muted. It's all good. Okay, awesome yeah, so the vision of Stack Rocks and ACS now is to enable organizations securely build deploy and run cloud native applications everywhere and Earlier in 2017 Stack Rocks was a more container focused security Service and you'll hear cloud platforms and container focused platforms that are out there But we really pivoted to kubernetes and it's because kubernetes has a specific challenge That it presents to developers and operation teams that is slightly different from let's say a serverless process. There are a whole array of configurations with kubernetes that are Challenges and if you want to deploy at the speed at which the developers can introduce functionality into your applications You need a security process that can keep up with that So it's about securing the supply chain securing the infrastructure and making sure that your workloads That that that process fits in with the developers and the containerization techniques that you have so that you can securely scale and I'm not going to go too much into these slides But it's just about delivering continuous security and fitting into the process that you have right because if you've adopted kubernetes in any sense Taking a security solution like ACS you might be hey like how are you gonna implement this? So we'll show you and really it's about just full life cycle security of the things that you have to take care of which cloud platforms Kind of leave up to you and in a shared responsibility model. You'll see on the different providers that are out there Yeah, one of the things and To kind of just frame this a little bit. I always I like I like Eric Jacobs I don't know if it was Eric Jacobs or if it was you who talked about Kind of comparing, you know, what when you say application supply chain that It's it's really nice to have an analogy, right? And that's like the analogy of like, you know, you're talking about the assembly line How there's no like dev assembly line, right? Like the you know, like if you think about like Henry Ford and like building a car like building a car the assembly line They don't There's no like dev version of that somewhere Maybe R&D is the dev version who knows but like You know, like there is no dev QA like all that happens in that in that same supply chain, right? So in that in that same it's all that same process like it shouldn't have to be an afterthought It shouldn't have to be something you do on the side, right? It needs to be all inclusive So yeah, and I almost see the security solutions, especially Kubernetes native ones like ACS as the quality control for that supply chain So your developers have already already have an application where they have something containerized so they have their v1 0.0 whatever you want to call it and Now it's just about let's reign in some things and let's enforce it upstream so that all your parts are You know up to size and have the right capabilities and everything is okay. So that your final product is Stable and secure and won't wear down. Let's say that's if we're gonna go with that analogy, but Just to talk a little bit about ACS as I transition is the one that we talked about Kubernetes native It's the architecture if you're used to something like like a fluent D Yeah, or log in controller, right? You're gonna have one central UI and that's the UI that I'll show you in a bit and It has basically all the data analysis the scanning components and it's just pulling information from your various clusters So you can have multi hybrid setup on different Kubernetes clusters and you can pull out all that information into a single UI One of the benefits of this is you can easily onboard clusters and push policies that you already have into your UI into new clusters and new applications as well and then just in terms of the layers for red hat You'll see that advanced security and management are sort of that top layer that you'll see because like a lot of Platforms really kind of only only give you the Kubernetes specific part of that, right? And so how do you grow and scale your cluster and then how do you secure your own applications? that's something that a lot of You're gonna normally need to go to an extra service unless you have bought into the specific cloud provider But that's enough slides. I think we can Jump into the demo We like the like hacking hacking at it until it works. Yeah We'll get there. Yeah, I Let me just move over and share a new screen with you. There we go Everything's good Now it is ultrawide monitor rock and dude.  Yeah, okay. Well, you can if you can zoom in That I can do. Yeah Thank you. There we go. They work. Yep. Yep. That was that like to make 300 percent. What did you yeah? I think that's a new record, right? All right, yeah, so to start off We have a have an OpenShift cluster set up. This is fairly recent. I think I said this up a week ago and Nice good reference and Installed some demo applications and installed a couple operators ACS can be installed as an operator in your cluster And I think I have four here. So we have quay. We have OpenShift pipelines We have get ups and we have ACS in the cluster It pretty much is as simple as coming in enabling OpenShift cluster or advanced cluster security for Kubernetes speaking picking the specific namespace that you want. I Called it stack rocks because gotta keep the name alive somehow. That's right. You got a You got to keep that flag going. Yeah. Yeah And once you get in here, you'll see that part of the differentiation of the architecture that I showed you Is there's a central component, which is the UI and all the tools for Analyzing all the information and then there's the secured cluster component So the central cluster component is the one that you're going to want to install first It's deployed initialize. It'll give you the UI that you can go into and then you can Bring on clusters as you go and you can do this in an automated way by basically generating the certificates And then as clusters come online They'll automatically get populated and they'll reach out to the UI to say hey I'm here or you could do it manually just so that you don't have that automation aspect of something reaching out to your UI But you have that capability so with I'll just go right into it have a couple applications installed on here I think I was actually given some pretty insecure ones and I haven't seen them yet So interested to see what pops up now. This is just the main dashboard Which I should probably zoom in on again to 200% so everybody could see And we only have one cluster if you had multiple clusters, obviously, this would show up here You'll see system violations compliance standards. It's your clusters at a glance dashboard and Just to see that we don't have any critical. Yeah, I'm actually very surprised Yeah, so if we wanted to what do we want to jump into first let's jump into violations because It tends to by the way Sorry to interrupt, but so by the way, I told Michael if you go back to violations That first violation is probably like the thing that sold me on ACS the stack rocks is like hey Someone access the cube admin secret Oh, like it like it knows that the ACS knows that and right? Like this is This is something I wish I had like an open shit version 3 Right, right like what was supposed to show you how I have how the How Kubernetes the whole ecosystem has evolved like now we can do things like this. It's like oh man Things as common as someone accessing something getting an alert now seems like oh, that's really cool You would think that would seem like intuitive that you would have in the platform, but sure Maybe not, but well, I mean Kubernetes was so young back then, right? It's like now. We're at that point Anyways, like I was kind of Joking with with Mike here about like you basically sold me like I will you sold me on stack rocks Just with that one line of the violation, but anyways, sorry, I didn't mean to derail you Mike But I just thought it was a really cool thing to see Yeah, that's It there's like cube exec Really commands that show that either Somebody's in production or somebody's in your developer like trying to access secrets or trying to get into a container Those are things you want to alert on which is why the severity is high and obviously it's not enforced right now so by default ACS doesn't enforce anything because you have to go and install an admission controller to do that and there are There is security aspects of doing that as well, right there It's actually part of the MITRE attack framework of exploiting admission controllers specifically mutating ones, right? So it's your choice whether you want to do that and then how you're going to enforce it You need to make sure that you are aware of that as well. So just by default it's hey come in Take a look around understand where your high-risk deployments are and go from there Yeah, a lot of security is just first of all just information right like just what's going on in my cluster. Yeah Yeah, that's exactly it and the challenge and really the The pitch is that you don't want security chasing things that it doesn't need to worry about right? You want to be able to identify the things that actually matter to you and that you can take action on So you're not just pushing things on to other teams that has no impact, right? It doesn't protect anything but Real quick before I want to show vulnerability management because it's one of my favorite sections ACS has a bunch of default policies set in that take your information and apply Kubernetes best practice to them now for example that cube exec one or the Where'd it go? I forget but let's say there's a specific categories or a specific policy It doesn't have to be high so you can create and edit things if you that's how you disagree with the severity of something Or it's a dev cluster and you don't care that much all these policies can be changed and configured accordingly So it's a we can have comments so if a violation pops up and it's something that's continuously there you can leave comments for the next person to come in And you can export all these policies as well. That's pretty cool.  I accessed this that's actually You wouldn't think Like that's actually really smart like because I wouldn't never thought to what put like that in like if I was like Designing this but like as an afterthought I'm like, oh, yeah, like that would be cool to put like just some information for someone else That's taking a look at the violation Yeah, and a lot of a lot of this tool is about baselining when we get to the network graph You'll see it as well It's there are you have to accept an inherent amount of risk and that's why risk is such a cliche thing to say in Security right and just risk in general to define so It's here's the information. Here's the Best practice the things that you need to worry about and then it's up to your security team as to how you want to enforce it We're not going to some security tools tend to be very opinionated about what you're supposed to enforce and That can lead to like false positives or breaking builds that you're not that you don't necessarily want to so we tend to err on the Kubernetes approach to hey come into the cluster. Everything's pretty much wide open and then you can go from there and and Really secure right because if we had network policies enforced by default in Kubernetes, I'm pretty sure it would not have got adopted Well and also kind of like one of the One of the things about security and especially like vulnerabilities especially for the information is like well Not not everything like requires action right like it's it's a little difficult to explain where it's like Hey, I scanned the red hat official image and all these Severities came out like well like did you actually read the CVE's like some of them? Yeah, like it may be just information Do something to invoke it right? Yeah, exactly Or like maybe it's mitigated or like maybe it's you know, yeah, this could be a lot of a higher level anything Yeah, and a Lot of I don't want to Let's just say that certain tools and certain providers and things like that. It's just here's the CVE you need to be aware of it but then if you're using rel or something like that it should be Okay, we really don't need to let you know about every single CVE that's out there It's these are specific to you. These are the things that really matter or I mean even even if you have Vulnerabilities in your images. It doesn't necessarily mean that they're exploitable or really active at any aspect in your container being used so there's There's things that you can do to basically say hey, these are the fixable Aspects like these are some things that you can't fix but do you really need them in the container? Are there other options? So, yeah, it's just about triaging accordingly, right? So we got a question in chat here guys Is the ACS operator supported for disconnected clusters? I believe so. Yes. I can yeah You kind of have to ferry all the no container images and everything in to your environment But after that yes, and there you should be supportable Disconnected yeah, and you'll set up a mere repository or something like that to pull the vulnerabilities in every month or so But yes, yeah That's good question and stack rocks is pretty much always supported that from the beginning. I don't yeah, so Yeah, I guess at that point it'll be just more manual right like right now. Yeah, you know stack rocks will it will be or ACS I better use the product name Is reaching out and you know pulling though that information I would imagine and disconnected you would have to You know sync that yourself. You got to ferry the the the info data and As well as the images Sneaker netted in and your little floppy. Yeah, so I will say one of the riskiest images that we have here are the the workshop some of the demo applications that we've set up and It's always funny because riskiest is very uh, it it just depends, right? Yeah. Well, it's what's funny. It's like it's Relative to your cluster, right? Like if you have like if everything's perfect and you have one medium, right? That one is technically the riskiest, right? There's a there's actually a question in the chat and I think you're gonna get this a little later But I'll ask this now. I'll feel free to punt it down. It says who who resolves the CD E's. Mmm That's a great question. So you've identified a CVE if There is maybe it just needs an upgrade so maybe you push to your devs and you say hey build this pipeline right now or Maybe you you understand that you need to change versions or something like that if there's a quick fix Normally when CVE's are released, they tend to come with a fix associated with them by the application developers if something's major Most likely that will so if a new CVE comes out and it's something that's high level You you'll get an alert that hey, this is something that that can be fixed and is relatively new It just needs an update. That's one example another one would be there could be a vulnerability that Doesn't necessarily it might be rated as low or you need a specific exploit like you need Let's say you need to have access to port 80 or something like that. Well, Python 378 with port 80 open Yeah, your screw. Yeah But realistically if you have the Configuration file and your deployment setup properly and your network policy setup so that that port can't be accessed It's not really an issue, right? So there's more to just hey I have a vulnerability to push it so that we can make the change at the build stage You don't you might not need to and that you might want to get to that eventually But that's the high priority for the team, right? So there's more conversation. There's more Context that needs to be added. Yeah. Yeah, because this here like this one here like I'm looking this looks like this image here By the way, it's my image. I know I'll admit it. This is one of my test images, but Michael's like, well, do you have you know some some test images? Oh, I got all I have some images that all light up Like a Christmas tree, but it looks like some of these It looks like I just need to rebuild the container right like I just do a yum update in the container Looks like specific to this one, right? Like this one's Apache. Yeah, so Have been updated with the new collections So you need to do an update basically and then if you want the full CV description to understand a little bit more You can go there as well. And and really that's If you're gonna go to the overview if I were to go back To the main screen If we sort if we view all and we sort by fixable These are the the ones that we want to focus on especially the recently detected ones So the biggest thing about ACS is the the longer it runs the more you get a baseline for what your services should be network images that are running users and You'll start to see okay. There's a change. There's a new CVE from the newest update It's a fixable one. This is probably something that's recently come out that just needs an update or a patch to do Let's prioritize that right So someone asked in in the chat The stack rocks has own dashboard UI like OpenShift or satellite. Yes, this you're you're actually looking at it It's just it looks a lot notice top left Yeah, yeah, we use a common kind of framework called pattern fly here at Red Hat So like our applications kind of look consistent as a result But the logo in the top left is the dead giveaway. Yeah, so the answer jazz. Yes, I Believe you can put your own logo up there if you're feeling yeah Totally can yeah Yeah, there's there's there was this competition Yeah, we did we did a console customization competition last yeah console because yeah, we did that was it last year on my year like it's Like go back and look it up folks I'll find the link and drop it in chat, but it like some people do some really cool stuff with their Yeah, so yeah, and there's links to like the repos and everything I'll go find it sweet And then Well, since we were talking about fixable CVE's I figured I'd show you this dashboard We can look specifically we could sort by fixable. We can also snooze ones. So Let's say as your security team you've installed things and you're obviously there's a ton of containers running Really what you want to focus on are things with a high CVSS score Things that have high impact that can be exploited And also we want to look at the amount of components and deployments that are associated with it Right, is this something the the more prolific this is maybe it's a part of a base image that you constantly use in a lot of your applications That would have a big impact to fix right that's something that it's like hey everybody Teamwide we need to just go and upgrade this specific part Or we need to pull a different base image to make sure that this is that this has changed and that will have a significant impact So this extra information helps you triage Yeah, you can also like I can mitigate that with like ubi right like if you're using red hat ubi and you know You know like your your cluster is like well, you're you're vulnerable But like if all your images are based on ubi you can probably just update your base image You know at one place right and it should cascade right across your environment Definitely, I don't think I've actually done this yet, but um Yeah configuration management This this is the other aspect and this is when when we talk about risk in this dashboard We're pairing vulnerability management and the images themselves with the configuration of your application in the cluster So there are other things That and policies that violate They have basically best practice here. So curl in an image right being able to Pull if you don't need curl in the image don't have it there um Using add in in your in your in your images secrets mounted as environment variables. That's one we see pretty often Old images so this is Pretty common, right? I think christian your your image probably failed that one Yeah, yeah Yeah, all these are probably mine. Yeah Yeah, so you can see the policies that are being failed and this is this is cluster wide so Maybe you make an exception for specific ones But in general, this is a a policy that you want to have and of course you can change the the format You can make it 120 days. You can make it 60 you can make it two if you wanted to And just there are also little things, you know, like required labels and owners, right? So you can enforce best practice and this can be done Earlier in the pipeline too if that's something that you're interested in But it all culminates with uh, basically a risk assessment That's highlighting the riskiest deployments and it's giving you a priority score of what you need to focus on So we have some very severe violations environment variables containing secrets and some fixable severity Some fixable vulnerabilities that you need to uh to get to You're uh pulling the curtain here on my image Yeah More like pulling the rug out from under it. Yeah, exactly And as we go down to there's uh, so there's a little bit about the service configuration So no capabilities were dropped. So assuming that there's no security context on this deployment, which means it has full capabilities not great Volumes are mounted with read write ports exposed components that are useful for attackers so This image contains bash crawler bm and yum and has no components dropped That's a severe. That's something that you want to fix pretty much as soon as you can number of components in the image Yeah, so this is obviously a A larger image.  There's just all kinds of stuff wrong with this The list never ends But if if there was a security context, it would be here. There isn't Although you do have the resources set up There you go. That's the one one.  You got you got a five. It's just yeah Yeah, it does some point moved over one Now the nice thing is on the event timeline you have no policy violations of actual running processes so even though You have a specific process they're running you haven't Violate anything, but if we were to view the graph we can see when specific processes were run in the event time And what's useful about this is you can set up alerts. So I could set up alert on something that is a quote-unquote risky deployment to say if Uh bin slash slash sh gets run alert me send me a notifier So what you could do is let's say you know that you can't um harden your image in time or Your dev team says hey, we're gonna get to this but it's gonna take a day Okay, well, I'll set up a notification on this image for the next day So that if anything happens in the day I get alerted right away and I can go and destroy that pod Yeah, that's pretty cool. So that way you'll have So like all right. Well, you know in case something happens While they're fixing it I can be notified right I can send it to pager duty or a webhook or whatever, right? Yep, and if you because we use the admission web controller for enforcement, let's say There was a process that you didn't want to run and you wanted to Stop that process.  That's an option Yeah, we would just say Yeah, just pull the pull the ethernet cable off the wall Well, what I find surprising is that I actually pulled an image. So like I was Um, I pulled an image from docker hub that I know that was pretty old and yet my image was still the highest Somebody has better stand Well, they probably have a built pipeline right like right exactly You probably just were like, hey, what's vulnerable put it all in. Yeah, does engine x even appear Does engine x even appear on this list? I don't know. I don't think so Yes, I mean there I don't know but there you go I do I do want to show the network graph and a little bit of the pipeline I set up before we get uh Caught up on time. Um So yeah, this is the network graph It would look a lot cooler if I had a load to run against this cluster But since it's pretty new we don't have a lot of connection information But typically you have this active and allowed view So you can do both So connections that are allowed and active ones that are currently being in use The blue sort of signifies that a network policy has been set up red means it hasn't So these are Ones that you definitely want to go to and say, hey, there's an anomalous flow And we need to make sure that network policies are set up for these right now.  So this is definitely a cluster that needs some work And one of the best things about this honestly is the baseline So this is baseline traffic. Uh, let me go back here Yeah, so for the scanner scanner database Um, there's two baseline flows. It's basically scanner. This is expected Right angress, um in the namespace stack rocks. What's not expected to The ui is all of the network flows in the cluster So this is something that's picking up. It's like, hey Um, you know, these are open connections. These are something that we're not expecting Now we can add this to baseline Or we can, um, basically generate a network policy to To account for that So you can simulate a network policy And account for the network changes and it will recommend an option now There hasn't been really any traffic in this cluster. So the network policy isn't really going to be Accurate So it thinks that there's a lot of connections and that's what you want Yeah But the other thing too is if you set up your baseline and you say, hey, these are the three connections that are part of the baseline anything that Breaks that you can alert on So this is really useful, especially for You don't want to alert on everything, right? But let's say you have databases or you know sectioned off nodes that are for specific workloads You know, those will show up in your network graph And then you can click on that and say anything to and from these specific pods these specific deployment resources I want to be notified if it violates the network baseline That's pretty cool. So it not only um, will it notify also see now i'm sounding starting to sound like a customer will it notify also if um If there were if I have a network policy set up, right and it'll block traffic Can I get alerted on the attempts as well? not just Um, it depends on where it's coming from Oh, that would make sense right if it's a monitor like certain. Yeah, okay. Yeah, if it's in the cluster um, you would get Like let's say an application was using some network tool to get at stack rocks, right? That would come up as a violation of runtime in that application in the cluster So that would be logged, right? If it was an external entity trying to get at the api That would just depend on where it got blocked All right, so we got an interesting question in chat here speak, you know um Navin ask we saw one internal Dependencies repo From image tried to pull updates from public git repo Security captured that anyone experienced this I feel like that is a very common use case yeah, like There's a lot of developers that are going to be like hey You need this file that's going to come from git or hey, you need this dependency Go pull it from git because they want a specific version of that dependency um Yeah, I just if you just if you take look at your go mod file, right like it would right It's like pulling from random git repo sometimes. Yeah, like that that's just kind of how go works, right? Like it pulls from github that blada blada pulling as dependencies Yeah, and you're going to have a bunch of different teams that don't have the same application don't code the same way So maybe you have one application that has to run in a knit a knit container or three knit containers And has to pull information or secrets or variables or whatever, right? What you can do is when that runtime process At initialization is known Well, you can flag it as a baseline to say this is a normal runtime process This is for this team. This is expected And then alert on anything that isn't Those, right? So It's it's kind of one of those. It's uh that you need the flexibility You can't just say any time that we're going and reaching out of the cluster for for packages or dependencies We want to stop that, right? and Yeah, no your apps will break. Yeah, and and what um Some dashboards I should say when they have network tools that don't actually use kubernetes specific um functionality They might be in a dashboard and just say hey, well, there's this weird network reach out. Okay You know, let's just block that IP address or that that's specific, right? So There's no real conversation between Where the firewalls are what's getting blocked what isn't and it's it's like a box around the cluster not letting things in So there's there's just a different layer and that's not saying that you can't use that tool and acs Right, you can have the external firewall and then you can have the network policies and the functionality in the cluster, right? It's also just how you communicate that information between teams right Collaboration is key is a theme. That's right. That's right For sure now I think I have that's this default one that I kind of want to show This is a old old docker demo very old and There's no network policies And I built this in github and I pulled it using argo cd no security contacts extremely probably Pretty insecure. Yeah Let's go find it actually I'll just hop over to to docker hub and give you a quick run through of what's what's happening here Actually github is probably the place to go so I was thinking like how do I sort of build this process where We can enforce the policies of acs in the build process for developers Or maybe not enforce but educate Well, we're still letting them deploy and then we can come back and say hey watch out These are things that you need to fix before the next release and you can consistently notify them over Let's say the next six weeks And if they don't fix them then you say hey, okay. Well, I gave you time to Fix these and yeah, you're not communicating with us. So I was like, okay Well, let me pull an image and see what I can work up and github actions Even though github actions is not extremely intuitive Yeah So can um Can you zoom in a little bit? Oh, yeah, please. Good call. I should just set everything to 250. Yeah There we go. There it is So in this in this setup there it's basically just a uh, let me show this if I can zoom in on this one It's this little docker labs getting started using mk docs and Basically initialize it drop the file in it's good to go and what I did was Took that and created a build yaml. That's a pretty big build yaml, but Logging into docker hub building the image But then i'm doing a deployment yaml yaml check an image scan and an image check after and so the benefit of this is Let's say your developers already have their workflow set up and they already have their build process or their ci process for their build and they're pushing Well, you can take rock ctl and go and install it at the end of these processes and then pull the security information Close to them and display it to them without actually enforcing anything and so then you can have that conversation about These are some serious vulnerabilities that if you do not fix you will not be able to push to production Right. These are the high ones. These are the ones that we care about And you can set all this and build into the pipeline And you can test it without really interfering with that team, right? And if I go and show you I've Had so many failures of this, but I finally work got to work the Scroll down So the build is well if you use docker, it's pretty straightforward. You have all of your layers what is Really important is we install rock ctl and we reach out and make sure that We have the variables needed and then what we do is we run a deployment check So what this is going to do is it's going to reach out to the ui hub Pull the policies that are set up and it's going to run them against the deployment yaml that we have so This one basically just fails right away because there's a bunch of stuff that isn't set up And you can choose whether or not you want it to fail or not. I have this as continue on failure Because we don't want to break the pipeline. We don't want to impede developers, right? We just want the information and we want it so that they can see it Same thing with the image scan I didn't format this all nice and pretty unfortunately, but Uh, it has all the layers and if we scroll through We'll see that there are some serious cvss scores with this Yeah, and so if I wanted to Yeah, I take and really what I would probably do is I just take jq pipe it into a file And then just you can literally have it automatically sent as an email To a developer on the build right or something like that depending on what you use for your ci process, but It's just kind of a hey is everybody aware this this build just um You know, maybe it's not merged into the main branch, but this is a pr This is a feature that we're adding and there's some serious vulnerabilities with it And it just makes everybody aware of what's going on. So there's the yeah, that's it's pretty cool that you can build it into the ci process because Especially like if you're doing a feature branch like you were mentioning you can have you can have it pass Right for a feature branch, but then they have the information to where like hey by the way when you merge this it's not we're not going to allow to merge until um These are fixed right and so that's this the whole get workflows thing where it's like, okay You know your your ci told you that you know, here's the vulnerabilities you need to fix before We'll even allow you to merge this feature branch into the the main branch. So This is that which which is pretty cool, right? It's all about information. It's all about Fixing it earlier and often Yeah, and the reason that we designed it as rock ctl, although I don't know if it's going to turn into acs ctl I get kind of like rock ctl Is so that because it's a binary you can go and install it in a lot of different ci pipelines And you don't need to worry about integrations. It's pretty much Plug and go in in a bunch of different setups and because we want to be cube native and be applicable to a lot of different use cases It just made sense There also is a difference between Image scan and image check Image scan just shows you cvss Pulls information and compares it image check actually runs that against the policies that you've set up So maybe there's certain cvss And vulnerabilities you don't really care about Well, we let's work on image check policies that we only care about specific things So for example the docker file here the image has root So this this itself isn't that important because if you get into kubernetes and you have your security context this drop all It doesn't really matter It won't it won't run anyway, but but now it's like okay. Well, which layer matters because the developers in care They're always just going to leave it as roots. Okay. Well, is that a practice that we want to stop with the developers? So again, like not every policy Is important and it's up to you to kind of figure out And have the conversation with the team to say maybe we should drop root because We know we're leaving your security context wide open. You can't have both, right? Yeah And then obviously this fails, but continue on failure is And what I did after that was I went to argo cd And I can you zoom in? Oh, yeah Good call and I oh i'm got degraded. I don't know what happened You didn't pass the security check that's probably but uh Oh I made you pull back off. Oh, because 3.0 Maybe I messed up the uh config This is 1.0. Uh, so you rolled back Still got to work on the pipeline a little bit, but what uh what I kind of wanted to show is if you Let's say you you have that github pipeline and it's continue on failure And then argo cd automatically goes and pulls it into let's say your test environment If there are certain processes that you really care about or certain Policies you want to enforce well, then you just go into that CI process and you say we're not going to continue on failure anymore, right? So part of the implementation is maybe it's Here are the policies you need to worry about you have three months to come into compliance And then we're going to stop allowing this continue on failure into your test environment, right?  Yeah, you don't have to drop the hammer Immediately you're just have to say the hammer will be dropped later. Yeah Right course hammer will be inserted here Exactly And then the other thing that I did want to show too is there is integration obviously into pipelines So we have an example of a rocks ctl pipeline the pipeline run where we Where we cloned the workspace We ran Wait, is this the right one? I think it's the other one. Yeah And we ran rock ctl against it we found Three alerts found based off of it. So as as part of your pipeline You can Do a lot more honestly in this then you kind of get have actions And I'd I'd recommend this is the the next thing I want to work on is Just the build the check Checkmark, okay config good Are you ready to deploy and then that's the manual stage at which you say yes So you basically have parallel pipelines between configuration and image.  You're checking them all against your policy standards And then and then you can choose manually to deploy it or not anything else Any other questions and of course From a management standpoint. Yeah, you can look at your different clusters. All the system policies are here You can reassess them. You can import specific ones. You can create new ones policies summary severities And you you can export them all through the the api as well if you want to back up and go and redeploy somewhere else So SIG stores in the news again today for some reasons and I'm curious Is there a policy that says like this image need has to be signed? That's in the roadmap. It's coming. So the the image signatures and Is in the roadmap? Binary authorization is already thing. I think really only google has it operationalized at this point Right. Um, that i'm aware of other. I mean, you can you can obviously do an open shift with SIG store as well That's right. It's it's been it's been an option for last year and a half. I believe so Um, but yes, the integration into acs is on its way. Nice. Yeah, so that's that's like one of the um One of the things that we're asked for for a while is image signing In terms of uh, you know blocking things that aren't signed right and um, you know, that's like that's like a big thing, right like I want to I want to know like there's um You know, there's there's alerting right and like there's a kind of like kicking back sort of thing But like there's also flat out like stopping even before even touches my cluster, right? Yep So, um, I know that's that's gonna be that's gonna be big because that's I know a ton the ton of people have been asking that for a while So, uh, it's great that it's on the roadmap. Mm-hmm. It still is only at the container level so I would warn people that if that's the The next bulletproof thing that you're you're worried about just because the image that you built is the same image That's running in the cluster consistently doesn't necessarily mean Yeah, correct that you're secure you can build the images obviously and you can configure them improperly. Yeah Yes. Yeah. Yeah, like you you can sign an image. That's a bad image. So like let's let's not let's you know Again, everything's a layer, right? You're just stopping any injection in that in that ci process, right? correct, right like it only matters if You've built a securely to begin with right so like I can sign my crappy image. That's running Right, but that that doesn't necessarily mean it's good. Yeah, doesn't mean it's good It's just that it's a known crap. It's a known image. Yeah, it's a no. It's a known a known bad image. Yeah known known evil known evil, yeah It's bad, but at least I know no one has injected anything in my bad image. So um I also would Probably get in trouble. I really should show this a lot more the so that the policy violations and CIS Docker standards and and all this that it comes up. You can export all these as well. So When you have audits or Things that pop up Very very useful. If we look at some policy violations You can see the categories here of the violation of the the policies that they're violating for example, like docker cis and Docker cis 4.1 and you know exact ensure that A user for the container has been created every time So there was a couple that were running as root, right that we saw where there was no user that obviously violates the the benchmarks And so if you got audited for that standard you fail. Here's the here's how you rectify it make sure that all your docker files aren't root So we were talking about that as part of the ci process too. So that was uh, it's like, hey if we're going to pass this audit We need to enforce this on our developers. So you have, you know two months to get in line with that, right? Can you you see you can export it so is that uh, so I have two questions on that So like one is that like a csv or something or is that um, is that just like a pdf? Yeah pdf. I believe you can You can do and see um in a csv. Although maybe I'm missing something This dashboard. I I always believe you can export in a csv and a pdf Okay, cool. And then is that like an open api like can I automate kind of like I always think like is that an api I can I can hit and I just automate because all right, cool. Oh, yeah completely the um If you want to check I don't want to go to help docs right now But the documentation is online and um has all the the api documentation as well that you can pull from and so part of the the policies that you create so these system policies Is uh that you can export them clone them and edit them so you can pull them into json format Have them all and if you want to make changes of the policy, you don't even have to go into the ui you can Work on them separately and then just push them into uh through rock ctl And let the policy nice nice so you can Essentially customize the policies for your not not only just add can you edit the ones there? Or do you have to like clone and and create you the ones you can edit them all in here You can add them directly obviously recommend copying them instead of editing them just you can also Yeah, you can you can turn them off right Garbage them disable policy right so that's pretty much all you Um and then so you take the defaults edit them the the best thing about exporting is if you have one have two different UIs so you have like a ton of different clusters or maybe maybe you have database specific clusters and then you know your Uh state stateless applications and you like to separate them whatever the use cases It might be useful to basically pull the the rules and then um if anything ever happens because you've created all these Very unique policies and you need to go and We can figure it you have them all in json. You can just go and hey Take this and then all the policies will pop pop back up sort of your Your redundancy and a rock ctl does automatic will rock ctl if you call it will back up the database and back up the policies nice If you you can automate that or you can do it Directly and export all the uh the policies that you set up nice So here someone has a question. I don't know what what it means, but I'll answer it here It says well red hat has future. I think red always have a future. So yeah I think the answer is yes It's been one of those days. Hey, yeah, I was like christy look like you're over the day or Been a weird week. So it's been a weird week. It like if folks if you haven't heard I I've I've I've turned in my resignation my day My last day is the 18th.  Yeah, uh, thanks for thanks for making this day super weird for me I appreciate it So, uh, yeah, that's this is um So, um, I don't know if you wanted to show anything the last, you know, eight minutes that we have here in the last few minutes here, um I don't know if you want to show anything or like if you want to you know, talk about where people can learn more about acs or Where they can find, uh, you know more More information more, uh, something to read something to watch Yeah, I'm open shift, uh has the the trial and you can demo, uh, acs for Free I believe through the operator I'm just going to pull it up if if you have open shift the operators up there feel free to to test out advanced cluster security Um, if if you uh, have the time honestly, it's it's worth it just to install it and see what's going on in your cluster and There's there's nothing enforcing right because we when you install it, it's just information Which you know it doesn't hurt to try just yeah, so when you install the secure cluster services There are three components, which is the scanner the collector and there's the admission controller settings so Basically just listens and you can have it so that there's a enforcement mechanism as well Nice If I go over to stack rocks So for the the documentation everything's up online if you want to check it out, uh You want to get started with rock ctl you can download it as well It's it's all there backup restoring upgrading Operating building it to see eye pipelines everything you need is in the docs and from And there's there's a community site as well Stack rocks is going to be an or h acs is going to be open sourced um in The future i'm not sure exactly what the timeline is But there's a community site for announcements as well stack rocks.io, which i'm pretty happy about because the name Gets to stay around. Yeah Pretty awesome. Now it'll be the open source Uh name right the upstream for acs is stack rocks and also there is a slack channel So if you are on the cnc of slack, there is a stack rocks slack channel there that you could looks like wall leads on there By the way, i'm looking at it right out chris while lead is there so our our biggest man here I guarantee he's everywhere. Yeah. Well, yeah I'm actually I went to the stack rocks a section right now and his name popped up like hey, I know that guy So, yeah, so there's another if you're in the um here i'll i'll copy and paste the link here um in the chat so um cnc and cnc f slack so not not only is stack rocks on there actually the argo cd folks are on there So if you're um you have questions about argo cd Um all the engineers and all the community members are there as well. So um and the get-ups working group is there So it's not just that shocking. Yeah Stacking rocks is one of my favorite zen games. By the way, so a slight tangent Slight tangent like as it has nothing to do with anything, right? So I play uh assassin's creed vahala And there is a stacking rocks. I guess The side game and it's like it is like the worst thing it's like the most frustrating thing for me because my rocks keep falling I'm glad I stopped playing that game like yeah within the first couple missions. Yeah Well, like for like the the the ocd person to me like I need to finish every little icon on the screen and it's like No, I hear you right like It's like I put in the game I started playing and I was like there's a lot of Many crap that I don't like in this game and just completely set aside. Yeah, it's it's a terrible mini game But then like I'm sitting there for like, you know 40 minutes, of course because you're like Yeah, I gotta cross off this one thing and I'll be complete Yeah, and it's and I'm sitting there. It's like the actual mission took me like 10 minutes But like 40 minutes to stack the rocks, but anyways, um, we'll put you on uh, we'll take your ocd And we'll put it against fixing all these cvs. Yes, that's right. Yeah I need to go through and like knock off a lot of the see us that way If I put all these cvs on a Assassins creed map, would you then? Yeah, let's see. I would knock them out one at a time. Yes, exactly I would I definitely would that that'd be away from That's a good way for me to fix these So there we go Um, so is there any any other questions here guys? Um, if not Um, I think we're almost yeah, we're almost out of time. We're at the hour a minute left. Yeah, okay So if there's no any other questions um We can uh, we can sign off here. I um Again, this is chris short's last get off sky to the galaxy. I uh, you'll again Probably heard this a thousand times. You'll be sorely missed.  So you're not going far. I'll see you next week at the uh at cube con um and You know, I guess the the search is on for my co-captain. I guess for my from the next co-captain here at uh, um On the stream here. So yeah, you got a candidate. Maybe right there. That's right. That's right. I got I got candidate I I'll I'll maybe do like they like they're doing at jeopardy, right? I'll I'll test out a few They get a competition right you have a get-offs games little Who can build the best pipeline? Yes, exactly. Right. Yeah, exactly. So who can uh, um, maybe I'll have tryouts, right? So this this week's uh Test can't and then we'll have get up in the the squid games hood. That's right.  Nope. That's and then we'll we'll take off. So anyways, um, thank you Mike for coming on showing us seven rocks Um, it's uh, it was it was fun. You made me a fan of You know, right saw it for the first time a couple weeks ago So a lot of the times you get bogged down in your own little world and you can't really like, you know Once you start seeing other stuff that um, the community is doing and you know, stuff that red hats doing it Oh, that's really cool. That's a really cool piece of software and that's um What one of the things that I thought of so um, yeah cool So There's no more questions in the chat. So I think we're good. Yeah. No, uh, You'll be back in two weeks with some more fun Yeah, I'll be back in two weeks. I'll I guess I'll figure out the streaming thing. Hopefully by then We'll see you might get some slack messages chris On it's gonna be busy week next week If you're busy, that's right Cube con chris, uh, I'm gonna I'm gonna he'll be here. So I'll I'll pull you aside chris and say show me how to do this That might actually be the best way That might be the best way so we'll see All right, cool Michael we have a meeting tomorrow. So I'll see you then but yeah christian. I'll catch you and I'll lay on saturday Or whenever yeah, whenever we'll see it.  And yes, please find me if you're going to cube con I definitely want to uh, yeah, I'll be there too. So meet you and yeah Christian and I will be around Thanks, everybody. Take it easy.


I've always wanted to be able to make my own homemade essential oils at home, but as I don't have the proper distilling equipment to separate the oil from the flour water using steam distillation, herbal infused oils are the next best thing. Lavender infused oil is made by steeping dried lavender buds in a carrier oil such as extra virgin olive oil, rosehip oil or jojoba oil for 4-6 weeks. Whole dried flower heads or just the petals can be used, but it is important that they're completely dried before they are placed in the oil to steep. While fresh flowers can technically be used to create lavender oil, this increases the risk for bacterial growth or the oil to become rancid due to the moisture content in the fresh buds. Therefore, I prefer to use dried flowers. However, if you want to capture the lavender fragrance and create more of a scented infused oil, fresh buds are more aromatic as the fragrance fades with the drying process. While the flowers are steeping, the natural active resins within the lavender are extracted and drawn into the oil, making it a concentrated oil full of the herb's healing properties. Herb infused oils are a more gentle version of the therapeutic properties found in essential oils as they come in a more diluted form. The finished lavender oil can either be used on its own or used as an ingredient to create other products like natural salves, ointments or creams. Depending on the type of oil you choose to infuse the lavender buds with, this will likely dictate the uses for your finished lavender oil. For example, some oils are inedible while others may not be great for skin. Some great uses for lavender infused oil include in a facial moisturiser, mixed in with the oil you use for oil cleansing, as a general moisturiser for your body as well as your face, as a massage oil, as a natural perfume, as an oil to help remove makeup, as an ingredient in homemade body care products like body butter, creams, arms, salves, ointments or soaps, as a hair serum to nourish hair, as an ingredient in homemade cleaning products and more. To make this lavender infused oil at home, start by harvesting the buds. Cut the lavender flowers off the plant, then tie them into a bunch and hang them upside down to dry in a dark dry place for 4 weeks or until completely dry. They take anywhere between 2-4 weeks to dry out. The lavender flowers will feel brutal once they're ready. Using two rubber bands per dried lavender bunch, tie one band just beneath the flower heads and one at the base of the stems. Then hang the bundles upside down to dry in a dark warm spot. To retain the best colour, protect the drying lavender from sunlight and place a sheet beneath the bundles to catch any buds or blooms that might fall. Over the course of several weeks, the carrier oil extracts the natural plant properties found in the lavender, including traces of lavender essential oil. The lavender infused oil therefore carries the medicinal benefits of lavender as well as its scent. After drying, remove the rubber bands then chop the lavender flowers into smaller pieces and remove the stems. Smaller pieces help make for a better extraction. Next, fill a clean glass jar with the lavender, then pour over the olive oil or other carrier oil of your choice so that all the flower material is completely covered. Use a spoon to mix the flowers through the oil, making sure that all pieces of lavender are coated and covered with the oil and any air bubbles are gone. Secure the lid tightly, then place the jar in a dark warm spot with no direct sunlight to infuse for four to six weeks, shaking it once or twice daily to help the oil infuse with the flowers. After four to six weeks, strain the oil through some cheesecloth or a nut milk bag, then pour the oil into a clean, dark glass bottle for storage and keep it in a cool, dark place. This lavender oil will have a mild aroma to it, it will never be as strong as a true essential oil. To give the oil extra fragrance, you can add a few drops of your favourite organic lavender essential oil to enhance its aroma. And that is how you make a lavender infused oil at home. Thank you so so much for watching this video, I really hope you enjoyed it, please let me know if you try this recipe out yourself and how it goes, I'd love to know. I wish you a wonderful day or night wherever you are in the world, I send you all my love and I'll see you soon again.


It's our latest high-performance GPU for you know premium mobile So this one has more performance and a whole bunch of new features also and you're talking about machine learning What are you talking about? So this one's primarily about improving efficiency, so we've got more graphics energy efficiency we've got improved execution efficiency for machine learning algorithms and also It's smaller. So we've improved the area efficiency for our silicon partners who spend a lot of silicon putting down our GPU So they care very much about the size. So basically everything's better But with all those newer smaller Nanometers actually isn't there lots of space on the silicon that they need to use and they can just use it up for GPU? No So They used to be about 10 cents per square mil was this it was the going rate for silicon and now it's actually increased from that on the Newer FinFET processes so they care very much particularly if you're putting down a premium mobile GPU You know 15 square mil or something like that That's a lot of silicon and that's a lot of dollars But when you do computer vision the stuff from apical and all that stuff Mm-hmm Is it running on the GPU or is it some other parts of the SOC that do that stuff? So different of our arm partners will do things differently One of the things we've seen is that running machine learning is something that people want to do in different places so the Cortex a 75 that was announced today is also made more efficient at running those algorithms and The Cortex the Mali g72 our GPU has also been improved for executing in those algorithms and the dynamic connection technology which enables people to connect Accelerators coherently is also something that we're you know, we're announcing and it people are using Because they will want to connect their accelerators Not necessarily ones that we've produced but their own in that way So we're just trying to make it easy for the arm partnership to do these process this these type of new algorithms In the way that suits them best for their particular consumer devices So you already did you started beat frost with the g71. So what's what's what's been the The the potential with that what what are you achieving with this? So g71 has appeared in a couple of consumer devices a very high-end Samsung Galaxy S phone and also in the Huawei Mate 9 and we've had great success with that Mali g72 were not announcing licensees for today, but you know the usual suspects and We would expect that you to see that in consumer devices either later this year or very early next year And the bit frosted a whole bunch of Reoptimization of how you do a GP on a on a mobile as you see yeah So Mali g72 as I say it's primarily all about efficiency compared to Mali g71 We've gone to a great deal of optimization trouble from Mali g71 It's still on the by frost architecture, but we've made a whole bunch of optimizations Perhaps 500 little ones and you know three three major ones One around the execution of machine learning algorithms where we've reworked the data data path in the ALU And also made some changes around the instruction cache Configuration and that's given us about 17 percent speed up on machine learning And also we're getting very healthy improvements in energy efficiency graphics Of course most of these premium mobile devices The limiting factor is the thermal budget, so it's very much what performance can you give me within this thermal factor? Different manufacturers will of course have a different number for that Including case design and you know chip packaging and things like that But they will have an absolute number and they will want to Maximize the performance they can get out of that thermal budget So it's possible to crank up the megahertz and stuff like that that helps Yes, so different of arm different of our partners will do things differently So some people will put down lots of cores And then crank down the megahertz run it very slowly and run it at very low voltage So you get the performance by having lots of cores running slowly Some of our partners will put fewer cores down but crank up The megahertz and crank up the voltage and get the performance that way And what we actually see is you get a spectrum of these across the arm partnership people doing things differently Is it true that on the GPU there's more An industry of doing parallel computing that's not maybe as developed on the CPU side So actually you know a whole bunch of cores and it just works the software Yes, I mean in graphics itself is the ideal parallel workload So the way the graphics problems are specified in API terms is things like For every pixel on the screen execute this piece of code for every vertex in the geometry Execute this piece of code and that could be you know eight million pixels. It could be a million triangles So you this huge amounts of inherent parallelism within the code We know we work within a thread pool of thousands and millions of threads Whereas typically in CPU land, you know finding finding numbers of threads to execute can be more of a problem and then of course some computational problems are Thread parallel rich and so executing those on a GPU through one of the compute frameworks the compute API's Tends to be very successful then but running code without lots and lots and lots of threads is Is not good on GPU. That's better on the CPU You're designing by far the most popular GPU in the world, right? It's shipping a billion per year now So in 2016, we are very proud. We were the world's number one shipping GPU Our partners because of course, we don't ship any chips at all But our partners shipped a billion chips containing our GPU. I mean, that's a pretty amazing number You know, I have to pinch myself when I hear that Because it's not that many years. It's been going on, right? Well, it seems like a lifetime to me. So 2005 my boss walks into my office and he says are you busy and I was very keen to impress him in those days So I said no, not too bad. Why what do you want? And he said I want you to go out and buy a graphics company And it actually took me a year and in 2006 we bought phalanx in Norway 25 engineers with a lot of very smart talent and some attitude and We grew that team and the media processing group in arm is now well over 500 people and it's taken us from 2006 to 2017 and Yeah, in 2010 we'd hardly shipped any volume at all 2011 we started shipping in volume and in 2016 we shipped about partners shipped a billion GPUs It's been quite a ride. It really has so there's some of these engineers in Norway, right? Are they just like enjoying life and doing amazing GPU work and how does it work? So off the four founders of the company, we've still got two of them working for us And they're still having a good time in designing GPUs and several of their friends from those 25 Are still with us. I probably a large proportion of the 25 still work for us And yeah, they get up in the morning and they live dream GPU design and we're very very lucky to have them working for us very smart people now as I say You can't build a world-class GPU out of 25 people and you know, we've we've had to supplement them with another 400 So but that's that's the way it goes. We now have people working on the design in San Jose in California in Cambridge in the UK in Lund in Sweden and in Trondheim in Norway and Shanghai in China and So there's self-driving cars there's you name it everybody's using GPUs for all sorts of things You need to accelerate stuff super fast Recognize things absolutely and it's offline recognition and online and everything. Yeah, this is a very important thing machine learning is something that some people are doing on device and some people are doing in the cloud and Certainly we at arm feel that an awful lot of that Machine learning the inference needs to be done on device You need it done locally because you need it done quickly. You don't want latency and You might care about that data. So there's privacy issues about transmitting it over the internet security issues so doing it locally on device At low power with quick latency is what most people are going to want And if if those arm power laptops like my Samsung Crumble Plus if they feel super nice and smooth You have a big role to play in making it nice. Oh, absolutely on the the way in which compute devices is Changing is one of the fascinating things about this job. So, you know, you used to have a very clear classification between You know a phone and a laptop and then along come tablets and then you have phablets and then you have Chromebooks And then you have two in ones and you know, this is this huge variety of devices on which people are doing their Primary compute and I just think that's really interesting people get the devices They want as opposed to the devices that other people tell them they ought to have and There's this gaming also and Android is the platform of the future for gaming So mobile high-fidelity mobile gaming is is going gangbusters. It's growing about twice as fast particularly in China It's growing twice as fast as other forms of gaming. So, you know, the casual gaming What you have on phones is rapidly being supplanted by Really high-fidelity Gaming and the reason for that is the capabilities that we now have on these mobile platforms both in CPU terms But also in GPU terms you have The capability for these these new rendering techniques, you know, multiple render targets things like that Deferred rendering in G buffers, you know, there's a lot of techniques that have come Down from bigger devices onto mobile gaming to improve the quality of the images and To have a more compelling immersive experience on those gaming So there's more and more triple-a games that are coming out on Android the amount of money in this sector is increasing all the time because You know people are writing these games in these in these segments for profit, you know This is a business and there's a lot of money being made in mobile gaming now and all these tools They have an SDKs when they develop high-end games on Xbox latest Xbox PlayStation and all that is coming over to the arm World, right? Yeah, the ecosystem play is very important here And we've spent a lot of time in with in in our Mali working with the game studios and the games engine developers So a lot of gaming is done through this intermediate gaming engine And we've spent a lot of effort ensuring that that's been suitably developed and optimized for use on our Mali some other companies are using other GPUs to do a cloud grid Services does it make sense to use the the Mali GPU to do cloud stuff? There's no reason why not. It's not a primary focus for us at this time We are primarily focused on the very high-volume markets and actually there's a relatively small number of servers in the world whereas there are massive numbers of Portable devices so that's where we're focusing at the moment, but you know We'll move on to those other segments in time What was the announcement today a big deal about being the the VR and AR Chipset now so there's really three things that we're concentrating on in terms of the Mali g72 and They're all about making them better So we've made machine learning processing run faster and more efficiently on our Mali g72 We're looking at mobile VR And the high-quality Rendering effects that we've introduced there some extensions like mobile multi-view We've done there and and also the high-fidelity gaming so you know mobile VR machine learning and High-fidelity mobile gaming these are really the three areas. We're concentrating on because Google announced that they want to have crazy High resolutions in VR, but there's no way to have the bandwidth so you need to optimize Just where you're focusing absolutely. So think of foveated rendering so Right take your thumb and forefinger hold it out at arms length That's the if you look in the middle of that hole That's the bit that you can see in any detail That's the bit you focus on and your brain actually fills the rest of the picture in by you know Strange magic brain stuff. So actually what we do in Foveated rendering is if you can detect where the person is focusing their eye on That's the bit you render in detail and you render the rest of the stuff around it in much lower detail and The brain is just it says yeah, that's fine. It it's all good It says all the the whole quality is good even though actually the bit It's not really looking at is in much lower detail and that's the thing called foveated rendering and we've we've produced some extensions for that in on our GPU and Made that much more efficient and that's that's going really well because that is an optimization that Pays huge huge dividends because the bit that you're actually rendering in full detail is so small compared to the whole of the detail of The screen so you can save an awful lot of power and performance You need to be accurate on detecting where people are looking and You don't need you don't want to see a latency you you want to you want to have a license incredibly important but the tolerance of people from moving their head or moving their eye to the picture in their VR headset changing is varies from really really fast to unbelievably fast, so Certainly you're looking at frame rates, you know up around a hundred frames per second to keep most people happy and Some people are incredibly sensitive to that latency delay and you have to have it even faster Otherwise, they feel sick frankly motion sickness The one of the things I'm most excited about The Google IO was the VPS or what do I think they call it VPS indoor positioning? Yeah, so you're totally ready for this right this basically is project Tango Yeah, is Google max indoor Google maps indoor That's what it should be right should be Google maps when you go indoor Yep, and that's gonna be accelerated absolutely. So if you think about your eye If you think about GPS, you know, it's accurate to within I don't know a few meters But actually if you move your head even half an inch, you know Even a quarter and it's just a couple of millimeters Side to side you can see a huge change in the picture that your eyes are seeing and with stereoscopic vision You can actually work out where you're standing very very accurately using cameras So it's all about sensor fusion, you know, roughly where am I? Okay, that's probably gonna come from a cell tower More accurately, where am I? Okay, that's GPS. Okay, really accurately. Where am I that's probably gonna be cameras and high high accuracy digital maps All right, and you put it all together and now you know exactly where you are You know where you're facing, you know where you're moving, you know You can do all of this and and that's the build the thing that I really enjoy about this This is just a building block. You say, oh, I've I've now got you some fundamental technology I can give you accurate position pose Direction, you know tracking etc. What are you gonna do with it as an application developer? And I think that's hugely exciting because the application developers gonna take and they're gonna do something with this that you And I had never even dreamt of but I'll bet you it's gonna be fun And this is ready now the G72 and the devices that ship in 2018 with this might be Having all these amazing things absolutely you so a lot of these computer vision applications like They call it slam simultaneous location of mapping Slam is a huge area of research that people are developing algorithms for some of which run on CPU Some of which run on GPU some of which run on specialized accelerators. It's a real sort of field of research right now You


If you could pick any job in the world, even if you didn't have any experience in it, what do you think you would be? Hmm, you know what? If I wasn't this version of Megan Thee Stallion, I probably would have been a makeup artist. Megan Thee Moin.


Radio's own show, Behind the Mic. Radio, with a switch of a dial, radio brings you tragedy, comedy, entertainment, information, education, a whole world at your command. There are stories behind radio, stories behind your favorite program, and favorite personalities and radio people you never hear of. Stories as amusing, dramatic, and as interesting as any make-believe stories you hear on the air. And that's what we give you, the human interest, the glamour, the tragedy, the comedy, and information that are behind the mic. And now presenting a man whose name since the beginning of broadcasting has been a byword in radio, Graham McNamee. Thank you, Joe Martin. Thank you. And good afternoon, ladies and gentlemen of the radio audience. We've had many people on this program who make their living from radio in strange ways. There was, for instance, one man who imitated animals and a young lady who impersonated a multitude of babies on script shows. But our next guest makes her living in radio in a way that tops all of them. And here she is to tell you all about it. Hildegard Halliday. Hildegard, what is your radio specialty? Well, I make a living by sneezing. You mean you're an expert in pseudo-nasal explosions. In other words, when a radio director has a character in a script who has a lot of sneezing, he casts you in the part, huh? Well, it certainly seems to work out that way. I've done all kinds of sneezes on the Rudy Valley, Tommy Riggs, Fred Allen, Aunt Jenny, Robert Benchley, and many other programs. Well, do you mind telling us how you're able to sneeze that way at a moment's notice, Hildegard? Oh, I can sneeze like all get-out if I just imagine very hard that I have a cold and chill. I see lards cold in them larchils. Besides working yourself into the part psychologically, do you get many hints from observation? Yes, I do. I recently got a great many hints from observing a lady at a cocktail party.  Oh, how do you do, Lulu? Oh, I've done well. Oh, my dear, I've done well at all. Well, it's just a hay fever, cubs and goats. I really didn't feel like coming here today, but I just thought I should. Oh, no, I'll just stand here and chat with a few people. How do you do, dear? How are you? Well, I say look well, but nobody knows how I suffer. You know, I've been thinking so much about you lately. I saw your husband lunching with such a dice-looking woman the other day. Your sister, I suppose? Oh, you don't have a sister. Well, we never do, do we? Oh, Kate! Kate, my dear, I've been wanting to... I've been wanting to... I've been wanting to... God help us. There's serving martinis around here, and I'm allergic to vermouth. Oh, we start to think of... I just been wanting to congratulate you on your husband, Big May the Congressman. I hope he doesn't get besmirched. I always say politics is so common, what is letting everybody vote. Oh, I don't. I don't know a thing about politics, but I do know what I like. What, dear? Uncle Joe? Oh, he's doing very poorly. We expect to bury him before long. It's his life. We never... Tell what I wrote. Well, we never do. But he said he'd feel better off than happy at home. He said he didn't want anything to happen to be. We never saw each other. He'd want to buy spells with cubby gold. Oh, no, they're not dangerous. I just thought of stretch off the floor. Never think I should go, Lulu. Lulu, dear, I'm going cold. I really don't feel I could stay any longer, but I've had such a jolly time. Take care of yourself, won't you? I'm going this year. Thank you very much, children, God holiday. Sometimes frightened, sometimes despairing people. Seek the advice of social expert John J. Anthony on his radio Goodwill Hour, hoping that he will point out a solution to their problems. You have heard him, advise them. But here are stories of what happens to these people after they have left Mr. Anthony's program. Stories the radio public never hears. Tonight, for the first time, behind the mic brings you the story of the result of Mr. Anthony's advice in what he calls his most astounding case, Mr. John J. Anthony. Mr. Anthony. Will you please tell us about that story? Yes, Mr. McLeany. That case gave me the most terrific shock I've ever had during my career in radio. On one week's program, I asked one man to state his problem and to my shock and amazement he began like this. I said to him, what is your business? And he said, Mr. Anthony, my business is killing. What do you mean? I'm a gunner in the Navy.  Do you realize what you're saying? Yes, I do, but it's the only way out. You see, I'm in love with a woman and she's in love with me. But she's married and her husband won't give her a divorce. He won't divorce her well out of sheer cussetness. He doesn't love her, but he doesn't want me to marry her. I've decided that there's only one thing to do and that's to put him out of the way. That's the only way she'll get her freedom.  You must have been shocked when you heard that. What did you do then, Mr. Anthony? Naturally, I pointed out to him that he certainly wasn't going to be able to marry this woman if he killed her husband. He'd be arrested and executed, and that would be the end of it. In the meantime, I wrote a note to the announcer and handed it to him. In the note I told the announcer to have this man's overcoat, which he had hung outside the studio, searched. Inside, the man's coat was found large, heavy jackhandle, a perfect instrument with which to club someone. So I knew he was serious in his intention. I asked him to wait for me after the show, and he did. When the program was over, I told him that I could very easily have him committed to Bellevue Hospital, a psychiatric examination to determine his sanity, but I was more anxious to straighten him out. I made him promise that he would do nothing that evening but would come to see me the following day at my office. He promised. Was Thomas worth anything? Oh, yes, in this case.  So he wasn't going to do anything until at least after he had seen me again. Why did you have him come to your office? Well, because I wanted to get in touch with a well-known psychiatrist, have him see the sailor and try to straighten him out, which was exactly what he did in a series of interviews. And how did all end? Did the man divorce his wife and did the sailor marry her? Oh, no, Graham. It might have happened that way in a story, but not in real life. That was different. You see, the psychiatrist confirmed what I had suspected all along. The sailor wasn't really in love with this woman. It was a case of frustration. He probably wanted to marry her at one time, but since he wasn't and since she was married, that was quite impossible. But the fact that he couldn't made him all the more determined that he would even if he had to kill her husband to do it. The finish of the story, Graham, is that the husband, when he discovered that the sailor didn't want to marry his wife, gave her a divorce. I got her a job. The sailor didn't marry her, but he didn't kill the husband either. And there you are. And thank you, John J. Anthony, for an unusual behind-the-mic story. Modities in radio. Presenting odd little true stories that help make radio sometimes amusing, sometimes exasperating, but always interesting to the people in it. This week's oddity. A few weeks ago, Len Doyle, radio actor, best known perhaps for his interpretation of the part of Harrington, Special Cop. In the radio series, Mr. District Attorney was speeding along a highway near New York on his way to his broadcast. When are you smart guys going to learn you can't go 70 miles an hour out here? Yeah, officer. I was just driving along thinking of my grandmother. I just looked at this pedometer. Baloney, Baloney, I had you clocked. You're the third guy in the last hour. You're not going to give me a ticket, are you? I'm awfully sorry. So I'm not going to give you a ticket? Well, I meant... Well, it is... Just see your license number. 70 miles an hour. Where do you think you're going? To a fire? No, as a matter of fact, I was on the way to a radio broadcast. And do you mind telling me why you have to go 70 miles an hour to a radio broadcast? Well, officer, you've heard of Mr. District Attorney, haven't you? Well, I'm Harrington of the District Attorney's office.  On your way, buddy. I didn't want to get in no trouble with the District Attorney. Yeah. Behind the Mic salutes a program you loved. We in radio believe that radio has a tradition of which it can well be proud. A tradition of good programs that linger fondly in your memory. And so each week, we intend to bring you a star or a part of some program you used to hear. A program that you loved. Tonight, behind the Mic salutes the old RKO hour. One of the really top-notch programs of 10 years ago was this same RKO theater of the air. This was a program that was particularly dear to me because for some time I was its announcer. So come back with us for a few brief moments to 1930 in the RKO hour with two of its original stars, Georgie Price and Tom Kennedy. The RKO hour. Hello. It's sending out this message so the world will know. From Maine to California and up to Montreal. Down to Dero, New Orleans, you'll hear a friendly call. The brightest stars from here to Mars will brighten up your radio. On Tuesday night when tuning in, remember I was pruning in the voice of the RKO. Good evening, ladies and gentlemen of the radio audience. That was Tom Kennedy singing the RKO song, and this is Graham McNamee speaking. We welcome you to another weekly performance of the RKO Theater of the Air, sponsored jointly by Radio Keith Orpheum and Radio Pictures, who produce for the entertainment of you and your family the best in vaudeville and talking and silent pictures. The features are selected each week from among the Army numbering 12,000 artists. Headliners, and stars who are now appearing on this great circuit of theater spreading from Boston to San Francisco and from Ottawa to New Orleans. And now we are pleased to turn over the mic to that rising young star of musical comedy in vaudeville, Jack Benny. Hello again, and thank you, Graham. It's pretty hard for a fellow who's used to working before an audience to face this thing they call a microphone at an empty studio, you know. As say, can you imagine doing this for a living? But thank goodness, I'll never have to. Not as long as I got my violin. But enough of this chit chat. And now a little of the latest gossip from Hollywood as told by Bill Raney. Big things are expected of Radio Pictures' next great-everts street girl starring Betty Compton and Jack Oakey with an unusual musical score written by Sam Stepp and Oscar Levant. Rodleroak was wearing old clothes to the studio and was refused admittance by a new gatekeeper. He had to wait until he was identified by an assistant cameraman before being allowed to enter. B.B. Daniels has lost so much weight working on her new all-dialogue picture, Dixiana, that she has to drink a pint of cream a day. Dolores Castello enjoyed a vacation on the water so much that she is reluctant to return to work. George Sidney and Charlie Murray may fight on the screen, but around the studios they are inseparable companions. Now here is a real hot item. Radio Pictures has purchased the rights to Edna Ferber Simeron and that picture will go into production soon and will be ready for release next fall. Richard Dix will be starred in the role of Yancey Cravat. That is one picture that I'm sure you'll all want to see. And now I want to introduce to you a young fellow who is headlining at the Palace Theater in New York, one of the most versatile actors in RKO Vaudeville. A man who can sing, tell jokes, do imitations. He's great doing all of them. Georgie Price. And now Georgie will sing in his own inimitable style Bye Bye Blackbird. Oh, here I go, I'm singing low.  Where somebody waits for me, sugar, sweet and so is he.  No one here can love and understand me. And all the hard love stories they all hand me. So make my bed and light the light. I'll be home late tonight, Blackbird. It's really a bye bye Blackbird for me. What do you mean, Georgie? Well, when I close at the Palace tomorrow night, I'm going on a 55 week vaudeville tour and every week a different town. Good old Vaudeville. Yes, sir. If it wasn't for the good old two a day, I'd be worried about eating my three a day. Georgie, don't tell me the stock market got you, too. Oh, no, I should say not. They didn't get me. I was too smart for them. Well, I'm glad to hear that. Oh, yes. I bought a stock last year. It cost me $168 a share. I looked in the paper this morning. Where do you think it's selling? I don't know. Two minutes. Yeah, but I don't have to worry. I bought mine outright. You know, that's the idea. The idea is to buy them and put them away. That's right. Buy them and put them away. I'm afraid they're going to put me away with them. Yes, sir, Graham. I haven't all figured out that if I sing 387,472 songs, I'll be exactly even for Goldman Sachs alone. Well, 1930 is a pretty bad year, Georgie. I hear a lot of people complaining. Isn't that the truth? A lot of people are complaining this year. But something tells me that in a few years from now, we'll be looking back at 1930 and speaking about it as the good old days. But I'm not worried, Graham. Thank goodness they'll always be vaudeville. Yes, sir. So I'll just pack up all my terrible, here I go, I'm singing low. This is Jack Benny. Next Tuesday at this time, another Radio Keith Orpheum hour will be presented. Next week, our guests will include that pennant-winning battery of song land, Vannan Shank, Vanny Ward, who is known throughout the world as the immortal flapper, the diving venus Annette Kellerman, and that rising young orchestra leader, Rudy Valli and his Connecticut Yankees now appearing at Keith's Riverside Theater in New York. And so, until next Tuesday evening, we bid you good night as Tom Kennedy sings the Radio Keith Orpheum song. Hello, hello, the RKO is sending out this message so the world will know from Maine to California and up to Montreal down to dear old New Orleans you'll hear a friendly call the brightest stars from here to Mars will brighten up your radio if you have enjoyed the show then why not brighten tell us all the voice on the RKO Thank you, Georgie Price and Tom Kennedy for helping to recreate a few moments from a great program. Letters from listeners. Each week we invite the listeners of behind the mic to write us questions about radio and the three or four we consider to be of most general interest we have answered on the air by the radio editor of some outstanding newspaper or magazine tonight's questions will be answered by Joe Ranson radio editor of the Brooklyn Daily Eagle Mr. Ranson Mr. Ralph Spencer of Toledo, Ohio wants to know what is the oldest commercial coast-to-coast program still on the air Well, Mr. Spencer, the oldest commercial coast-to-coast program still on the air is the city service program it originally started in 1925 and was on the air intermittently until 1927 at which time it went on regularly summer and winter and is now enjoying its 13th consecutive year Miss Helen Ruth Wegman of New York writes in to ask can you tell me what was the earliest theme song used on the air Well, Miss Wegman, as far as I can find out the earliest radio theme song was used by the happiness boys back in the early 20s it began something like this How do you do everybody? How do you do? How do you do everybody? How are you? Can't you sing it? Not with this throat Miss Margaret Bart of Phoenix, Arizona asks, can you tell me if Yehudi, who Jerry Cologne mentions on Bob Hope's program was Jerry's own idea Well, according to the advertising agency which produces the Bob Hope show Yehudi was created by one of the script writers Yehudi was originally to be used only for one show but he proved so popular that they've been writing him into almost every script Mr. Henry Zuccher of St. Louis, Missouri says this Last week I heard Bill Stern interview the Navy football coach Swede Larson on behind the mic in a supposed telephone conversation How was Swede Larson made to sound as if he was on the phone? Mr. Zuccher refers to this type of sound, of course Every week behind the mic brings you true amusing and thrilling stories behind radio Well, Mr. Zuccher, this effect is achieved in this way The microphone into which Major Larson spoke was the same as any other microphone However, the voice comes from the mic into the control room and goes through a device known as a filter box which eliminates the high or low tones of the voice Thus, the voice is thinned in such a way as to make it sound as if it was on the telephone Thank you, Joe Ranson for answering those questions Thanks One of the most interesting behind the mic stories I have yet heard concerns Haven McQuarrie who is now on tour with his popular Your Marriage Club program This story might be entitled The Strange Way in which a radio broadcast affected a member of the studio audience A couple of years ago Haven McQuarrie was presenting his So You Want to be an Actor broadcast from a theater in the middle west In that program, you know McQuarrie would select several amateurs from the studio audience explain to them the situation of a scene and then have them acted out under his direction Incidentally, Haven used to give his directions through a megaphone For the studio warm-up before the broadcast he'd call a stooge out of the audience his brother, by the way and they would do a comedy act in which Haven would direct him The stooge would ball the whole thing up and in the end, Haven would throw the megaphone at his head He would duck and the megaphone would strike a copper plate hanging over the door making a terrific platter Everyone would think the megaphone had hit the stooge and that Haven was crazy Well, one night, while Haven and his brother were doing their studio warm-up before the broadcast they were in the middle of their act Now, look, you're getting everything wrong Here's the situation You're trying to sneak into your apartment You know that if you wake up your wife she's gonna sock you with a rolling pin So you want to be very quiet Now open the door quietly I said quietly Oh, you mean like this? Oh, forget it Just come inside Now you're closing the door No, no, try it again They hit the copper plate in back of Haven's brother and a woman in the audience screamed The following day, as Haven was coming out of his hotel a tall, raw-boned man looking like a prosperous farmer came up to Haven and said to him Mr. Macquarie I feel I've just got to explain something to you You heard a scream in the theater yesterday morning during your act, didn't you? Yes, I did Well, Mr. Macquarie, that was my wife She just hasn't been herself for the past five years ever since our baby was a few months old and almost died and she's been getting steadily worse She doesn't recognize any of us at all So I bought a farm way out in the country where we'd be away from everybody and I could take care of her myself She had terrible headaches but the doctor said there was nothing that could be done for her Oh, that's too bad Yes, it was But yesterday I had a brain specialist come to see her We were taking her to a hospital for observation The doctor thought something might be done to relieve the pressure on her brain As we were driving through this town last night our car broke down Luckily we were close to a garage I called the garage man over and after examining the car he said, hey It's going to take about an hour to fix this We can't wait here in the garage It's freezing cold I've got my wife with me Well, let me see, you know what we could go across the street to that theater There's no radio broadcast there but they might let you in It's warm inside Doctor, do you think it'll be all right? Yes, I think that's the best thing we can do We don't want it to freeze out here All right, we'll go over to the theater and we'll be back in an hour We can sit back here, doctor, in the last roll We'll hear three seats right here You take this one, I'll sit here That's better I said no Did you hear that? The doctor said that the excitement of seeing you almost hit that man had relieved the pressure on her brain and it won't be long before she's well and all I can say is, thank heaven the car broke down and you were in that theater And Haven McQuarrie hears from that man every once in a while and I can tell you that his wife is well and happy again About the inside of radio that you wish answered on the air write a letter to us address it to Graham McNamee from the company New York City as many questions as possible will be answered by mail and those we feel to be of most general interest will be answered on this program be sure to listen in next week when we will bring you the unusual story behind one of radio's most popular programs We the People Inside Stuff about quiz programs as told by Uncle Jim of Uncle Jim's Question B news commentator John B. Kennedy and more of the human interest Remember the comedy and the drama that are found behind the mic This is Graham McNamee speaking Good afternoon all by Mort Lewis Original music is composed and conducted by Ernie Watson, Jack Benny and Haven McQuarrie were impersonated by Ward Wilson and this is the National Broadcasting Company