All right, so next topic is the Linux container internals by great Ume Uwe. Uwe Uwe, yeah. Yes. It's a DevOps and Linux engineer with a passion for open source and communities. So you can talk to great about Linux, everything DevOps, everything cloud system. And when he's not into all of this is out there boxing and reading random stuff. So over to you, great. Okay. Thank you very much for having me. My name is great. And yeah, are we speaking about the container, Linux container internals? So like we're speaking about the features that make containers possible. So yeah, let me just share my screen. Trying to do that now. Yeah. So can you see my screen? Okay. So my screen is off now, right? And I don't know if you can hear me just. Yes, it is. Okay. Okay. So I was thinking about the Linux container internals. So what really makes them possible and how they really work. So yeah, okay. So meet me. My name is great. Zero X, great on Twitter. And I'm an SRE. I do SRE and DevOps at TCI. So TCI is a company based in the UK. And we basically have organizations move to cloud native and also build products for them. So I'm a Linux fanboy, pretty much. As far as I remember, I've been using Linux since about the age of nine. Yeah, we had Linux computers at home. So I talk about the Linux container and containers and yeah, I love the chicken and chips. I also like the technique, night walks. I'm generally funny and I read sometimes. So that's that. Yeah, so just to lighten the mood. This how I walk around. And so as soon as you say hi to me, I smile. So in case, see me anywhere and I'm burning my face. Don't hesitate to say hi. I'm always smiling. Yeah. So yeah, just a disclaimer just so that we can set it in straight. Containers don't run on Docker. That is like a misconception or a misrepresentation cause containers don't run on Docker. Docker is just one of those several container engines that interact with container all times. Container all times like container wrong and the rest of them, which in turn acts the canal to set up containers. So what that container engines you can find is like cryo and Portman are some examples of container engines you can find around. So the outline is pretty much containers. They will look at the building blocks, C groups, names, spaces, copy and writes. They will talk a little about container wrong times, Docker wrong, system empty and spam and then we'll do a little demo just, yeah. So what are containers? I'm sure you have heard what containers are. Containers like HEPOS, okay? So containers is like a form of operating system virtualization. So this is not like a full virtualization because containers depend on the system channel. Like in a scanner to like to set up and yeah. So containers is like a form of virtualization and isolation because containers are isolated from their host system. They have their own PIDs, that is process IDs and they have their own network and all that. So containers help you to package application go together with these dependencies so that you can run them in between environments. So containers come with a potability where you can run them on different environments. No need to start installing dependencies.  So instead of you starting to run Python, installing Python, installing libraries like let me say, for example, Panda and the rest is obviously done. It's already packaged into a container.  So one thing to take note here is that containers have run as processes on the operating system. So this is what we should take note of here because I won't be talking much on containers. I'll be talking about containers like from a higher level from an operating system level, how containers are run on the system than containers. I'll be talking from a lower level, yeah. So that's that I'll be talking about containers as processes. So yeah, so we have the control groups. So control groups is one of the, this is special mechanism provided by the Linux channel which allows us to allocate like resources like CPU, memory, devices, network to a group, a group of processes or a set of processes. So like I said, container are run as processes. So C groups allows us to like give memory to like limit memory to a container. A container is a process of course, limits memory to a container limit CPU to a container and all that. So the reason for even C groups are the first that was C groups were built as a security feature. So it was actually built as a honey pot so that for attackers. So we have some C group subsystems. We have the memory, PID, CPU sets, freeze, block IU. So all these subsystems are what you can control on what you can, the amount of what you can control to assign to a process. So I'll just talk about a few of them. So block IU set limits to read or write from and to block devices. Net CLS allows to mark, net CLS allows to mark a network packets from a DAX. Like allow to mark a network packet packets to a group and CPU uses the scheduler to provide CPU DAX access to the processor resources. And then PID sets number of, that is set a limit of number of processes in a group. So we can limit number of processes that can run in a container. So C group subsystems like PID makes that possible. So for namespaces, yeah. So when C group will say, okay, I'm going to limit what you are going to use, then namespaces will limit what you can see. So I can give an example of Kubernetes namespaces. So namespaces in Kubernetes, so let's say we have this namespace called dev, I will have this namespace called prod. So the objects, Kubernetes objects like replica sets, secrets and the rest of them can be grouped into a namespace. While in another namespace, let's say a prod is as is on what is it called objects to. So these objects can't really access, let me say a prod cannot really access a secrets in dev because there's like a form of isolation between them. So just take node C groups limits what you can use like in quantity and the namespaces limits what you can see. So we have different types of namespaces. So we have the mounts namespace, which are MNT, which controls mount points. So upon creation of containers, the current mounts namespace are copied to the new namespace, but mount points created as I was not a great between those namespaces. So we also have the PID. So it provides namespaces, it provides processes written in the independent set of process IDs. So PID namespace is what makes containers think that they have this form of isolation. So now for example, a process now, let's say we have an Nginx Docker container. I won't mention Docker. Let's say we have an Nginx container. The Nginx might be running with a PID of four or five or whatever on the container, but outside that container, that it will be running on the whole system, it will be running as a different PID. So this is what make full containers into thinking that they have their control of what they can do. So these are one of the features of namespaces that enables that. So network namespaces visualizes the network stack. So upon creation, a network namespace contains only loopback interface. So once you create a container that is at default, it's only loopback interface that you are gonna have I'm going to show an example of this in the demo. I would like give an example of how we can use network namespaces. So also we can also look at the user namespaces, provides a previous isolation and user identification segregation. So like the UID and the GUID. So like it gives you this kind of security feature. I think it was recently that it came into the Linux container. Okay, yeah, recently it came into the Linux container. I think at 3.8, yeah. So we also have the IPC. IPC, I don't even know if anybody cares about IPC in that process communication. So this was even recently added to the Linux container to isolate in that process communications. So yeah, clone is one of the system codes. Clone is actually a system code in the Linux container that enable us to use namespaces. So if you can actually like look at the code in the Linux container and like try to have an understanding of what clone does. So yeah, this is how process is called clone. If you can look for the int clone function there. So it calls it by the stack, passes some flags to it and the parent TID. So next we have the copier write, copier write. Copier write is really, really a complex topic. Like it's going to even have its own different presentation on that. So copier write is a bit complicated. Copier write is like an optimization strategy. So if you have also noticed, let's say you pull a docker container and maybe pull another docker container sometimes it's going to tell you that this layer already exists, right? So copier write makes this sort of smart enough. So copier write like does sharing, sharing of these files and all that. So we have different file systems which copier write uses. We have the AUFS, VTRFS, VFS and device mapper. So I don't think docker has to worry about this because docker would just, you don't really have to worry about this because docker would just use the most suitable file system. Docker is intelligent enough to do that. So for that stuff, we also have capabilities. So we have capabilities that enable you to say, okay, I want this capability psi time on this container. And yeah, and we also have a Selenok. So security-enhanced Selenok. So security-enhanced Selenok, most psi admins use a security-enhanced Selenok so that you can set some kind of, have more control over who can assess this container. So that's the part you have to look out for. And then we have the container runtime. Like I said, we're going to come into this. So we have the docker engine, container, open VAs, I'm duplicated there, sorry about that. Yeah, docker engine actually uses container and ronk for the container creation because what actually made docker stand out was that they improved the developer experience using containers. Before containers were just something that most likely you see with psi admins and other. But docker really made this easy with their whole family of two. So that's why it's called an engine. We also have LXC, LXC has been existing. In fact, there's no record of LXC in the NOSkender. You wouldn't even see anything about containers in the NOSkender because the containers you might see is like a very different thing from the containers. Like it's a big difference. So LXC was one of the container technologies that we had there and we also have open VAs to, which was also one of the container technologies that existed. So yeah, so we're going to go over ahead with demo. So for this demo, we'll be looking at creating a network name space. Then we can also test, copy or write with a union FS. So if you can, if you can... If, yeah, I'm trying to share my screen now. So I don't know. Yeah, I'm trying to share my terminal. I can't find my terminal. I don't know why it was opening again. Okay. Yeah, it's open now. Okay, so can I use my terminal? Just need a bit of confirmation. Yes. Hello? Yes. Okay, okay, sure. Okay, so we'll just go ahead on it now. And yeah, just trying to kind of adjust it so. So yeah, we'll try to look at the name spaces that exist on my PC. So let's do LSNS. So LSNS would like come up with the name spaces that exist in my system. So we have the timed name space. We have the C group name space. We have the PID name space, UTS, IPC and the rest of them. So yeah, for browsers like Chrome and Brave, they'll most likely have a lot of PID name spaces. And yeah, they'll also have the network name space like for network and the rest of them. So let's try to list those two these alias. So I don't have the types to do every time. So I will say sudo ls slash proc. So we're going to check a process. So if I do this, yes, ops. So we're going to actually check which name space my first process belongs to. So the init command, like the init process. So let's see which name space it belongs. So that was just pretty simple, sudo sls, yeah. So we can see that this process belongs to a C group, IPC, different type of name spaces. So this can actually be checked for all processes. So then we'll move on to say, okay. So we are doing the network name space. So say SIP add net and SIP net and S add name space one. Then say IP net and S add name space two. So we have two name spaces now. So say IP net and S list. So let's just list the name space. So we'll have name space two and name space one. So now let's create a pair of feature internet devices. So say IP link, always forget to add sudo, don't mind me. VTH one type, VTH pair name VTH two. So we just added, we just added a virtual internet device. So if I do IP, IF config, yeah. So yeah, you can see we are the visual internet is created. So now let's link each device, each device is created to a name space. So link set, internet, name space one. So link VTH one to name space one. Oh, so the link is VTH two to name space two. So are we pretty correct here? So let's bring up, let's try to bring up the devices and assign IP addresses to them. So let's announce exact name space one IP link. Set dev VTH one to do again. Sorry. So IP net and S exact name space one IP address. Name space one IP, so I'm adding like an IP to it. 192.168, 1.1.1 slash 24, then dev VTH one sudo again. I think it's high time I run this with internet space two. Now let's verify the connectivity between the two namespace as it's enabled by the virtual internet space on it. So from the name space one, since we have linked them, so if it's name space one, we should be able to ping the name, the second one. And from the second name space, we should be able to ping the first name space. So this is sudo, sudo, okay. IP net and S exact name space one ping. So let's do about five pings, <IP_ADDRESS>. So yeah, it's working and it's like trying to access the second name space and pinging that. So we should be able to do that from the second one to ping this, so it works. So yeah, I'll just go ahead and delete this name spaces. Delete name space one, so IP address list. Yeah, I no longer have to say. So this is something that most of this container run ties to under the hood. They try to create network name spaces and the rest of them so that you can get this interoperability between your containers, providing network access to your containers. So yeah, and then also over the second demo, this wouldn't take time. So it's just to show how these container run times also do copy or writes. So make the arrow, so let's say make the arrow, KCD one. So let's talk if I inside KCD one. Hello one, I'll touch hello two. So we'll make another di arrow, KCD two. Oh, make di arrow, KCD two. Make di arrow, KCD two. And then we'll touch already as is. It's like KCD two, you can say hello three and hello four. So then we'll try to make a union between these two directories. So let's say make KCD union. So say union FS, they are KCD one, and KCD two into union, KCD union. So for LS, KCD union, you can see that these three files has been unions together into a namespace. So under the mood, this is what container run times kind of try to implement. I'll actually say you can also look into, okay, sorry. I can also say you should look into Boca. I don't know if I can type that, okay. Please look into Boca. So yeah, so Boca is actually an implementation of Docker in Bash. So you can try to read the source code and you would see most of how this container run times implements these low-level features of the, okay, these low-level features, these low-level features of the Linux kernel like to create a container. So that's that for my talk. And if you have any question, you can just leave them in the chat. Yeah, I think, yeah, he has done, Sadiq has done that. So if you have any questions on like these, you can try to like reach out to me or you can just write them on the chat and yeah. So it was nice speaking with you and I hope you have a great day. Thanks. Awesome, that was a great presentation. We don't have any questions yet in the chat. Well, thank you so much for that great. Oh, I think Anita is having some network issues. Internet, internet, well, I used to suffer. So here is a great Twitter handle at 0x, great. The guy is great that his Twitter handle is in lit code, self. So you can reach out to me on Twitter and share whatever questions you have and you'll be grateful to answer. But if you still have any, you can drop them in chat and he will be available on the YouTube channel to answer any of them in real time. Okay, someone just asked, how C Group and Namespaces are used by containers? Okay, so C Groups and Namespaces are used. Like I said, I don't know if it came in late, but C Groups is what limits the resources that containers can use, right? So it limits how many, it limits like there are some systems for C Groups, you have the PID, the Nets, the rest of them. So what C Group does is like, try to limit system resources that these containers can use, right? So like I said, C Groups limits what you can use and Namespaces limits what you can see. So Namespaces is what makes containers not to be able to see each other because if they are, let's say this container is able to see the process of another container, that's really bad because we can have things like racing conditions and it's also a security issue. So Namespaces is what brings in that isolation, right? Like how you can run multiple containers on your system, you can run Nginx, you can run busybox, you can run a lot of containers without having conflicts. But if Namespaces doesn't exist, things like process IDs will start clashing and even though that's a bit of a security issues, that is really bad. So Namespaces is a feature of the Ninos Canada, like try to convince containers, it's what full containers that, oh, I am in my own system. Containers are not really aware of what is outside them. Containers are only aware of their own selves. So Namespaces is the kind of feature that enables that. So I don't really know. Okay, demo. Okay, see group. Okay, yeah, I think I did this demo. I don't know if this demo is able to share the demo I did. Yeah, it shared it. What we will do later is the recording of the whole thing will be available subsequently and we'll also break each of the sessions so that you can have access to individual ones. So your guests, you can check our YouTube channel by Monday or Tuesday next week and you will have his specific video so you can rewatch the parts where he did the demo. Okay, okay. That's fine. Your sesh, you can also contact me on Twitter if you have any questions. So kind of available to answer your questions. Awesome. Thank you very much, great. We have our next session. All right, bye. Bye.


Hey coach welcome back to the channel if you haven't yet make sure you subscribe stay up-to-date with all the latest content And if you want my help personal help visit the description below You can either book a free 15 to 20 minute call with me where we can jump on zoom or You can send me any questions you might have to my whatsapp or My email address okay, so today's video is a little bit different to what I normally put out Right, I normally put out strategies techniques to help you grow scale get new clients charge more But today I want it to become a little bit more personal right? I want to talk about why consistency wins in this industry so I'm gonna take you back five years ago when I first started my business and I remember sitting down on my desk and You know making notes about how I wanted the business to look like What I wanted it to do a who I wanted to train how much I wanted to charge and essentially the philosophy behind Behind the business right now when I sat down to do this I thought to myself right I've got I've got a plan I've got a strategy. I Know exactly what I wanted to look like But now I need to make a commitment Right, I need to make a commitment To making sure that this works So I had to decide I had to make a big decision and I said right if I'm gonna make this work And if I want to do this full-time Okay, I have to treat it as a full-time thing Okay, if I treat it as a part-time thing or as a side thing It's not gonna work right and I'm a type of person that if I start something I Want to make sure I go all in on it because I want it to work okay, so The message of this video today is If whatever you're doing in your business It's working Okay, stay consistent to it right don't go don't constantly change Go, you know, don't constantly change what you're doing or see what someone else is doing and Follow what they're doing right stick to your strategy stick to your vision stick to your focus and and Commit to it right stay consistent to what you're doing. Look, I speak with coaches every single day and Some of them say to me oh Leo, you know, I've only been able to add one one new client in the last 30 days So what I say to him I say to him right great fantastic What have you done or what have you been doing in order to get to that one one you adding that one new client? They like oh, well, I've been speaking to a lot more parents. Okay fantastic, right? How what what do we need to do in order to get now to? To new clients a month Well, Leo, we need to I think I need to just keep speaking to parents. Okay, great So you need to speak to more parents so more people who need to know who you are and You need to make sure that you Provide value to those parents okay, so When you're doing something and it's working You have to stay consistent to it, right? And if you're if you're doing something that that's working and suddenly you drastically change and you Deviating you do something else and you realize you know what this is a working and then you go back to plan a Okay, plan a might then not start what might not work because you've lost your focus Right, you've got to say right if I want to add x amount of clients per month and Last month I only added one. What do I need to double down on in order to get to those 10? Okay, maybe you need to do more videos on social media Maybe you need to send out more DMs. Maybe you need to join more Facebook groups Maybe you need to attend more events where there's parents and you can speak to parents tell them about your business and Maybe you need to put on more taster sessions at local clubs or offer your services to coaches who have teams But there's a lot of things that you can do In order to grow and scale but you need to stay consistent with it Okay, and consistency for me always wins in the long term. It might not win in the short term Okay, because sometimes we're very consistent and then we figure out right. This isn't working This isn't working, but if you push through that I Can tell you from experience and from working with coaches that it will work, right? So you've got to stay focus. You've got to stay You've got to keep that vision and you've got to say to yourself, right if I want to do this full-time If I want this to be my only thing I'm doing every single week every single day I need to treat it that way Okay, I need to wake up in the morning. I need to have a plan behind my day I need to make sure that I'm doing this this and this to generate leads and get new clients It's not gonna be easy, right? Sometimes you're gonna speak to parents. They're are this is too expensive. Oh, we're already busy Oh, you know, we'll think about it, you know, I've been in this industry for so long I've heard every excuse a parent has Possible but really and truly there's there's two main Objections that a parent has right number one, it's money Okay They don't have the money at the moment in order to commit which is fine Everyone's at a different financial But instead of telling you about the money, they're going to use another excuse And the second one is time. Okay, some parents just don't have the time to commit to your sessions Right because they're doing something else. So really and truly if you get an objection It's gonna fall under those two things One it's gonna fall under time Right my we don't have much child is too busy at the moment with training Or it's going to come down to money Right and sometimes the objection is money, but they use time as an excuse but really and truly Those are the two main ones when it comes to parents and kids Okay, and they all fall back to to this air to these two objections, right? So you have to think to yourself, right if I want to make this work if I want to make this grow These are the two objections. I'm going to face right and if I let it Affect me that a parent has said right this is too expensive Or we don't have time at the moment and you feel down you feel like you know what this isn't going to work Okay, most coaches quit. Okay. Most coaches quit because they want instant success But in this industry, you don't get instant success, right? You only get success and you only Get success for what you put in okay, now I have this methodology and I have this This thing That when I started five years ago my training business and it's the same concept that I use when I work with coaches as well is that if I don't appreciate one player Okay, and if I don't take into account that one player that I'm working with who has seeked my help Once to show up to my session Once to train with me then I don't deserve 10 players or I don't deserve a hundred right So if I can't appreciate that one player that I have or the two players that I have or the three that I have Then I don't deserve a hundred three hundred players Okay, and this is a concept that you must have in business right a lot of coaches like oh, I've only got one player I'm going to scrap it. This this isn't working But really and truly if you give hundred percent to that player not only are you learning You can set up some type of referral where they're going to refer Another like-minded player to your program and that's where it starts to grow and and the business starts to boil Okay, but That's the concept I've lived by I It's the same with coaches right if I don't deserve If I don't appreciate one coach who has reached out to me with help wanting my help Then I don't appreciate what having the opportunity to work with 10 20 30 or even 40 coaches Okay, I have to go through everyone in order to get to that right person and that's just part of business Right and it's part of the industry. We are in we're a service-based Business So you've got a service people to the point where you find the right one Okay, and not everyone is going to be the right fit But if you're consistent And you're consistently looking for that right fit then you will find them. Okay, so hopefully you you know You enjoyed this video. You've liked this message a bit different. There's no real strategy A business strategy behind the video. It's more just a bit of a motivational video and just one to take into account that Having done this for a very long time The person that is most consistent is the person that wins Okay, if you aren't consistent and you're always looking for for greener greener grass somewhere else That's how you're going to live life Every day right looking for alternatives looking for something else and essentially You know, you're not going to be able to grow and scale to the next level Okay, so thank you for watching if you haven't yet make sure you subscribe to stay up to date with all the latest content


Welcome to my talk. App security does not need to be fun. Ignore an OSP to have a terrible time It's one of those talks where I thought of the name first and then wrote the talk all around it. I Think this way most good talks work. So I live in Chicago Better developer advocates. It's about 2016 I co-hosted a security repo podcast. Look it up. We just got Jason Haddick's episode drop today legendary hacker former CIO of Ubisoft Really pleasure to talk to him anyway find me out there on the internet MC Dwayne and have you chat about anything outside of tech? I love rock and roll Rock and roll before and some improv karaoke or awesome a jam. So hit me up about any of that stuff very briefly I work not that briefly. I work for company called get guardian. We are A code security platform focused around answering those two questions where I'm hard coded secrets throughout my Codebase and has my code leaked we help companies figure that out really quick I'm gonna talk about them We'll mention them later because we do sponsor some of the stuff but want to start out with Asking you know, what what does good security look like for our work? I think it actually has an answer because you can have a lot of answers to this but I think personally it looks like this We're sleeping at night. We don't have to get up for an alarm at 3 a.m. No one's calling us to come back into the office because something broke or because something had hacked And it also looks like this Nowhere near Wi-Fi you can confidently leave Cell reception that's how good your security is that's how good security looks It looks like this because you're at the concert and you don't have to leave before The They finish before the encore And ultimately it looks like this we're hanging out with their families doing what we want to do play a monopoly Or whatever you want to do with your past time But that's the general idea good security Comes at a human cost And when we pay that cost technically and correctly Then we get our human time back to ourselves and we don't need to suffer through it So what is bad security look like? Well, I think it looks a little bit like this It's isolating I don't know if you've ever read anything and then start staring out the window because wow I don't know who to talk to about this I've been there Absence of reason produces monsters or the sleeper reason produces monsters or famous sketching in the world Because we hear about these things like chat gpt or these new cvs and new vulnerabilities and wow does that affect me And now you're imagining all the scenarios where it's going to be log 4j again And honestly security is really boring sometimes If I have to read another 90 page PDF about anything I'm probably just going to fall asleep So Tolstoy said it very well and in a corona All happy families look alike but all unhappy families aren't happy in their own way And I think that is true of companies as well Because okay the biggest family of all everybody running log for shell out there or log for j And get hit by the cv That's a fun name by the way cv 2021 44 228 It's very symmetrical But yeah hit everybody Maybe some story you haven't heard about Another unhappy family uber They had a super admin get fished We got in there This is a 19 year old kid from the lapsis group Got in to uber found PowerShell scripts full of passwords And pwned them and taunted them in their own slack and even taunted hacker one They didn't believe them So he went to the New York Times That's all we know about the story Circle CI anybody affected by this earlier this year? Yep, so you know the story Basically third party are as an external developer gets hacked They injects a malware malware starts stealing credentials Then expel traits those credentials Then they use those credentials to get into customer accounts Fun fact a same day that they announced this a Independent security researcher said hey my honey tokens won't work Something's going on the circle CI in like two hours of this The other than making a formal announcement on January 4th So Security is important but security teams are way outnumbered Alex Rice said back at security 2022 It's about a hundred to one in your best organizations If your organization is smaller than a hundred it's probably Less than that but the same general ratio I've seen companies where it's as big as a hundred Ten developers to every one security person that's the company that's throwing people at the problem Because in dev sec ops because we're here to talk about dev ops and get ops and CD But dev sec ops says hey security should be everywhere We're gonna shift left which means we're gonna spread out our security through every stage That's what shift left was supposed to mean have a whole other talk about that how we kind of misinterpreted that And this is what a lot of companies interpreted that previous picture to mean Let's just give everybody a security hat and now congratulations dev ops team. You're not the security team Congratulations developer. You're now a security developer And how do security people spend their days while they spend their days catching up on CVE After CVE after NIST we're just in NIST 2.0 just got released by the way And we read PDF after PDF after PDF after PDF after PDF after PDF after PDF after PDF And we know about all of these threats And if you're new to security or even if you're a new security while it feels like you're the red queen Or you're Alice chasing the red queen where we have to run twice as fast as we currently are to get anywhere Run just as fast as you are to stay where you're at And about now if you're like, okay, you told me a bunch of horror stories Yes security is on my mind. We're making it worse I got some good news for you. There's been a group around for 20 years called OWASP That his entire mission is to help you be safe and to help you stay sane out there Because OWASP is not just a tool. It's a community the same way that we're a community here at this event So OWASP.org is an awesome website if you like websites laid out like this The original founder of OWASP said in 2021 the problem with the OWASP website is the Byzantine mess I took that as a personal challenge and I wrote this talk But the mission is very simple. No more insecure software. This is an impossible journey Because it's impossible to make completely 100% foolproof always secure software because human beings are involved But we can get closer to it. Actually their entire mission statement reads like this That's a lot of words. So I think it boils down to this We have projects, communities, events, education, training, publications and resources And all of these together make up what OWASP is So projects are mostly what I'm going to talk about So the rest of the day I'm going to break down what is OWASP, how do you navigate it But then I'm going to end with four actual, you can walk out of this room and start using them Actually if you've got your computer open you can start using them before you leave the room So first understand that the basic unit of work So the basic unit of work in Git is the commit The basic unit of work in Kubernetes is What? Yes The basic unit of work in OWASP is the project So these are all open source repos run by volunteers New submissions come in from the community every week Last count and this was a few days ago so it might actually be a bit different now But 242 total projects in any state at all 155 are in some kind of usable state So what does that mean? Well they're basically four big categories They're constantly messing with this and tuning this So lab and incubator have now been conglomerated in the last few weeks But flagships are what we used to know as the big ones, the ones they're known for Last year in October they said we should have production projects because enterprises understand the concept of production As of this last time I checked, which was yesterday, nothing is qualified for production They set the standard very, very high so even their flagships aren't quite production projects Lab projects are on their way to flagships and incubators are newer There's a whole bunch of ones that are not there yet, they need work They even get to incubator status So we've got 18 flagships If you're going to start with OWASP it's probably where to go but don't jump over there quite yet 36 lab projects And 114 incubator projects and then everything else that adds up to that 255 hasn't made it yet So looking back here, these are the big ones that kind of span every developer in the world In some way or another, Cyclone DX is on here That's the standard behind, of course, where we get our S-bombs Juicyop, which I'll talk about later Top 10 zap And then as we go through labs and go through incubators We start getting more and more specific to things like API Specific APIs or specific languages as you roll through it OWASP also classifies everything as types of projects Not just what category they're under But so 109 code projects, 80 documentation projects for other What are those other projects? One's a podcast So they realized a few years ago, this is really a lot to go through from a list view And try to figure out on your own So they said, what if we mapped everything to the software development lifecycle Well, we can't map everything, that's a lot of projects So let's map at least the flagships So no matter where you are in the software development lifecycle There's this little map around CR, common requirement enumeration That explains what tool you should be looking at It makes it really easy to get started So this is on the project page So next time you're in the research phase, or the requirements of building phase Go look at what they got there It might help you out So you might be thinking, well, what's a CRE, like a common requirement enumeration? Well, that's a project unto itself Open CRE said there's too many numbers, there's too many things to keep track of Too many CWEs, CBEs, NIST, there are too many Let's just combine it into one number, and there you go So you can go over to that project and check out exactly how all things map together OWASP is also a community You might be thinking, okay, that's cool with projects and all But there is an OWASP chapter pretty much everywhere on earth I believe Vancouver, I didn't actually look that up before I started talking today But there's one in Seattle, right down the road A lot of them went virtual over COVID, of course There's probably one in your area, and they would love to talk to you I can tell you I've been to a lot of the virtual meetups of OWASP And they're all friendly People want to help, people really do want you to make secure software So come with your questions, and they'll always be happy to point you in the right direction Again, you're not alone, you don't have to stay out the window by yourself You can go talk to folks I mentioned earlier, GetGuardian, we sponsor a couple of different chapters around the world Including Paris, and that's the last meetup we had in person in October The Paris chapter rotates where they hold their meeting every month They hold events too, just like CD-Con Or GitOps-Con, and just like, well, as you can imagine Other things, so they have a big global event coming up in DC Global AppSec comes out in October There's a bunch of regional ones as well, it's a whole network of events So if any of this sounds like, hey I want to hear more about security for applications And get involved in this 20 year old community, show up to their events They also firmly believe in education So, there's not one section of the website that says education and training But there's a bunch of education and training scattered throughout What you're probably going to be better served by is going to Google, or your favorite search engine And saying, oh-wasp education, oh-wasp training possibilities Starting there, and you'll find a bunch of ways to get there But there is one I will call out, SecureFlag SecureFlag is its own entity, they are their own company They are not run by oh-wasp, not directly anyway However, if you are an oh-wasp member, which costs $50 American a year, or $500 for your life For lifetime, you can join oh-wasp and then you get free access to this thing Well, for your entire run of your membership So what is SecureFlag? It's a giant ongoing capture-the-flag training platform You want to go participate in an endless capture-the-flag event? Here it is, as a website You can get certifications through it, you can deep dive into just about anything you can think of across the security spectrum They also make a bunch of resources out there available This admittedly overlaps with projects quite a bit, and this is where it starts getting confusing Like, well, isn't that a resource, or is that a publication, or is that a project? Just assume it's a project. They do print paper books. I've never bought one But they also make them available online for free for the most part Your mileage may vary Okay, 15 minutes in, and everybody's probably thinking, okay, you just gave me a bunch of laundry lists, and I'm just as lost as when we started I agree That's why I'm going to boil it down to these four things If you are working in tech at all, which I assume everyone in this room is, and everyone watching at home is Then the first one is for you If you want to start learning more about general security around pretty much any topic And move toward a more secure space, then the first two are for you If you're building applications and want to see how not to do it Or have an example of something you can attack and start tearing apart to understand how to build insecure software Then the first three are for you And if you want to actually attack things, if you actually want to go red team Red teaming is the art of pen testing Of actually attacking things and figuring out what the vulnerabilities lay Then all of these are for you But am I surprised you might get to the end and be like, oh, I didn't even know that was a possibility So let's talk about the top 10s first First off, who is familiar with the OWASP top 10? About half the room Good Everyone should be familiar, I believe OWASP set out a mission years ago to say, what are the most common vulnerabilities people should be paying attention to? Let's compile that into one easy to manage list And they did In 2021, they came out the newest version They updated every three to seven years I'm not making that up Go look at how often they release That's how often they have this conversation And it breaks down all of this in great detail Explains where they got these numbers What CWEs It matches More very importantly Overview and how to prevent So if you're thinking, how do I make my application more secure How can I make the security team like me more? Not that anyone's goal in life is to make the security team like you But if you want to get on their good side Bring up like, hey, I was reading the top 10 list And I want to make it more secure by adding this feature I want to make sure we harden to this thing based on what I read in the top 10 They would love to have that conversation with you, I promise you Your security team will love that conversation And they'll help you out Surprise, there's not just one top 10 list anymore There used to be But now there are 17 13 are in some kind of a usable state I say usable state Because some of these are just blank profiles that have nothing there yet One of the newer ones is one I think everyone in this room should probably be familiar with Or at least should be On your radar now is the Kubernetes 2022 There are like four people that work on this They desperately need more input and help So if you're a captain, Kubernetes captain out there Or you want to move toward that in your life This is probably a good way to get some Something for your resume Is to help have this conversation with them They have even have a zero for getting started with the thing But we're not going to climb through that today That's for you to do But yeah, mobile security Oh, control off There we go CI, CD security, same thing Insufficient flow control mechanisms Poison pipeline execution Insufficient PBAC So yeah, it gets updated from time to time If your concerns aren't on this list Again, do a pull request Go have that conversation out in the Slack There we go So that is everyone should be familiar with at least that Next up, cheat sheets You want to sound smart real fast about technology? Cheat sheets are for you Cheatsheetseries.oosp.org Pick a topic There are dozens and dozens And there's a full breakdown on the concept A bunch of great graphics you can steal And well, everything you need to know From a high level of how to approach it From a security perspective So if your CIO overwalks in and says What do we know about security with Kubernetes? You can frantically Google this And start reading off facts If you do that in person, that's going to be weird But if you do it on a video call You sound pretty smart And you're not going to be wrong The goats Greatest of all time, maybe Who here is familiar with WebGote? Cool, we got two hands, awesome OOSP said, hey, what if we built Specifically insecure applications That are easy to tell that they're broken So they started doing that WebGote, NodeGote Wrong Secrets is a particular place in my heart Because it shows you how not to do Secrets management How to do it wrong, there it is PyGote, ChainGote, LaravelGote Depending on what goat you want But these all pair of comparison To the true greatest of all time Juice Shop I could feel my machine getting warm Because it's running in the background Juice Shop is Well, a juice shop It is Extremely well documented Bug free, they're very proud That it's the bug free application That is completely insecure They're on version 14 right now This, if you watch another video Based on this video Go find this presentation From last year, it is amazing He walks through what you can do with it Because you're thinking, okay So it's an application I can go Look at the code, sure, it's open source But I'll just give it away If you go to Slash scoreboard Score dashboard Did I spell it wrong? Oh, I put a dash in it for some reason What's wrong with me? I guess it needed the hashtag on there Anyway, there we go, score dashboard That was great, there's also you can get to it from the side menu I was trying to URL manipulate and I don't know why It's hard to type because I'm at a weird angle up here Anyway, what you're looking at Is a full blown training series On how to start attacking websites With full instructions Buried in here, that's one of the goals Is to find the tutorials And help you along the way Finding the scoreboard is actually one of the first things But you can do things like bully the chat bot Have you ever bullied a chat bot in real life? Do you know that there are people doing that constantly? Yes, if you once you figure out it's a AI Just keep asking for that discount Because it's trained to not let you go unhappy So eventually we give up, most of them will That developers don't want you to be happy as a user Anyway, you can also run this As a complete capture of the flag for your team There's full instructions on how to run this On a secure private network This is an amazingly well documented project Again, that video will put you on the right path On how to leverage it for your teams So we talked about top 10 cheat sheets Goats, now Zap Zap, the Zet Attack Proxy The most dangerous thing they make Who here has ever run Zap? Nobody I talk a lot of security conferences And normally there's more people than that But Zet Attack Proxy Well, is an attack tool It goes through and tries to brute force its way in It tries to cross site script It tries to do all sorts of nefarious things Do not run Zap against things you don't own Or have explicit permission to use against One of the things you can own An attack is Jew Shop This is fairly new to Zap Is the HUD mode So it's a hover over display mode I don't know what it stands for I'm running out of time So you can click on things And then go look at... I forgot to make a full screen And go look and say, alright, here's exactly what just happened And we can start getting into the details of The alerts on, hey What's actually wrong with this On this particular page You can start seeing... Oh, I got some warnings here Medium Yeah, content security policy header not set Across domain misconfiguration What on earth does that mean? Well, if you go back to this interface It will start showing you Oh, there's the CVE is specifically Tied to that vulnerability So now you can go start looking at Well, how did they fix it? How should I fix it? How should I approach this? If you're using up to date patched software The good chance you won't have to manually do a lot of this But HUD will very quickly show you Where all the flaws are in your applications And I have about a minute left So I'm going to wrap it up here Yeah, again, I'm sure you see CVE And all the other stuff, cool So there's that I just showed you Same conclusion, it's dangerous out there There's a whole world of people that want you to be safe Some of them belong to an organization called OWASP And they'll love to hang out with you Sleep better at night knowing that your application Isn't going to get hacked At least not with the most common vulnerabilities People still might get in But if you can shoo off 80, 90% of attackers Because, oh, that vulnerability is closed I'm just going to move on to my day You'll sleep better Start here, start with the top 10 If you're not familiar with the top 10 Just start there And move the way through And remember Jew Shop is really fun I'm Duane, I live in Chicago I've been a developer advocate since about 2016 Found me on the internet at MC Duane And I'm happy to talk about anything Outside the tech as well Any questions before we get kicked off stage? I think it's a matter of two things, honestly One, it's right after lunch on the last day Of the conference That actually factors into it Realistically Two, security One of my favorite sayings I heard in the last year Was most developers don't think about security last Because they're not thinking about security And I think that's kind of the mindset Of a lot of the world Of like, well, security is something That gets handled by other people That will get added into the mix So for those of you all here I'm really appreciative that you're here And learning about this The other thing I think factors into it Is one earth's a wasp Like, sure, my talk title is luring Obviously you're here But that's like the Unfortunately, the Side of what's falling into is like Oh, wasp is that thing over there That I heard about That was, excuse the expression That was my dad's security org I'm all about the new stuff now What can they offer me? And I think they're a victim A little bit as an organization Of what the original founder said That they became a Byzantine mess Like, all the projects in their democracy Pull into different directions Like I said, people working on the Kubernetes top 10 There's like three people As why there are not more people in this room Well, honestly, there's a lot of really great talks This thing And if you're here to further your skills In building GitOps Yeah, maybe in a different room So, yeah I don't have a good answer there, man But that's a good question Anybody else?


Everybody forced here ripping the sports card Almanac multi-sport personal box edition volume four got three boxes for Chang S Chang has number 73 that is three. Yep, 73 35 and 33 Look Chang here you go 73 up first memorabilia There's so you guys are gonna make sure you're alive as well today. You're as quick you have the best chance at answering first I'm gonna get in top two again one in YouTube one in twitch Him and his brother are on the same team and were drafted back-to-back years Him and his brother are on the same team and were drafted back-to-back years Yeah, twitch has it twitch has it It is mr. Manage again nobody in YouTube in YouTube has it I might have to give another hint here What does something I won't give it away The player this player was drafted He's part of the 21 22 class 21 22 there it is Yeah, Preston F Preston F Is my is the first one I see that has it right in in YouTube. Yeah It's Evan Mobley It's Evan Mobley. Yeah, that was a pretty open-ended one and Clevelanders are so nice This is a Nike icon swing man Evan Mobley Fanatics authenticated Yeah, Nike swing man maroon Evan Mobley very nice fanatics authenticated there. All right number 35 now Yeah, I was a little more vague. I like it like that though because then it's uh, it's not so obvious That's one of those guys number 35 Yeah, because you think of more famous and like maybe like legendary players not like someone that was just trapped was brother was after this year, right? Oh That's a pretty one tops finest cabrayan Hayes orange wave rookie auto PSA 10 Numbered so orange wave not number. Oh, it's on the front. I'm sorry 6 of 25 cabrayan Hayes PSA 10 orange wave finest rookie auto and Number 33. Oh, dude, what's going on here? 2021 pinini one-on-one basketball Timeless moments Kareem Abdul Jabbar auto four out of 35 the skyhook over bird and Parish I think That is gold ink on the Kareem legend Good stuff. Thank you. Cheng. We will get these out to you. Congrats on the hits


Hey survivors and frivers We have over 20,000 subscribers a huge achievement I Remember when we had just 100 subscribers and it was an amazing feeling to achieve that 20,000 subscribers is incredible and I am so grateful to have all of you here Thank you all for subscribing to the channel in this video. I'm going to give you four things That the narcissist doesn't want you to know Please like comment share and subscribe Click the bell icon to receive the notifications for my future videos If you would like to make a donation my PayPal link is in the video description If you're interested in one-on-one coaching you can email me at narks by the coaching at gmail.com We have a private reddit community where survivors and frivers can share their experiences and knowledge If you are interested in being a part of this community, you could sign up for our patreon page the link is in the video description Check out the narks 5 merchandise store where you can purchase your own narks for you narks 5 a t-shirt or mug We have a variety of designs and it is a great way to support the channel The link to our narks 5 merchandise store is in the video description Four things the narcissist doesn't want you to know Number one The covert narcissist doesn't want you to know that they are fully aware that what they are doing is wrong They know that what they are doing is wrong and that is why they do everything they can to hide it They keep a code of silence They lie They use manipulation tactics such as denial projection blame-shifting and gaslighting If they really believe that what they are doing is acceptable behavior Why would they ever need to hide it? Why would they need to lie or use all of these manipulation tactics?  It's what they experienced in their childhood It gives them an opportunity to abuse, dominate and control you They like it when you confront them and try to get them to understand It makes them feel powerful They already know what they are doing wrong And they have no intention of changing their behavior, but they like to make a gamer of it and put you through their maze With the false belief that maybe this time it will be different Or if you do this one thing for them, it might be different this time The truth is it's never going to change Regardless of what you say or do And the reason for this is because they prefer dysfunctional environments They like chaos and drama It's familiar to what they experienced in their childhood So it has become attractive to them It excites them and gives them a sense of belonging They haven't even begun to resolve their childhood traumas So they are attracted to whatever traumatized them in their childhood And this is something that will never change They will endlessly try to recreate the environment that they experienced as children Using you as a character in this the familiarity makes them feel comfortable and gives them a sense of belonging But it doesn't heal their traumas Because this is something that is supposed to be resolved within Rather than being acted out in an external environment So they gravitate towards anyone or anything That can help them to recreate or traumatize them in childhood Number three the narcissist secretly admires your appearance personality and characteristics This is what attracted them to you Rather than anyone else It doesn't mean that they appreciate to do as a person They see us as objects or fashion accessories Tools to assist them in obtaining the narcissist's supply But they do admire your appearance personality and characteristics They don't want you to know this Because then that would take away their power to control you it would validate you and boost your self-esteem It would wake you up to the truth of the situation The game is to make you believe that you're not good enough for them When secretly they know that they're not good enough for you This is why they will intentionally withhold their validation To make you question if you are good enough They want you to feel worthless and insignificant It's projection They withhold their validation or try to make you believe that you're not good enough for them as A way of projecting their own self-hatred onto you They will also try to compete with you or mimic your personality or characteristics Take a step back and really observe and identify their behaviors Using logic or reasoning they make personal attacks on your appearance personality or characteristics And then suddenly they are mimicking them or using them in an attempt to compete with you Very contradictory behavior Clearly they were not being truthful about about what they originally led you to believe about your appearance personality or characteristics due to their self-hatred low self-esteem and as a coping mechanism for their pathological envy They will mimic your appearance personality or characteristics. They don't appreciate you as a person But they admire everything about you Of course, they will never tell you this as they want to maintain their power to control you But if you knew the true contrast between them and you and how much of a better person you are You wouldn't even desire to be around them and they know this They always knew this That's where their desire or motive To target your self-esteem or withhold validation from you came from number four They don't want you to know what they are thinking When they are withholding their validation from you if you really knew what was going on in their minds When they are withholding their validation from you If you really understood their thought process You wouldn't waste your time chasing their validation or trying to use logical reasoning with them You wouldn't need them to validate you you wouldn't question your own value or significance You wouldn't want anything to do with them Instead you would go in the opposite direction and find someone who can give you what you want Narcissist cannot validate you because their cups are always half full As their cups have a hole at the bottom where the liquid leaks out Nothing is ever enough for them They can never be satisfied or fulfilled They make you chase their validation Or get people to validate them Which pours into their cups, but because of the hole at the bottom it leaks out It never satisfies or fulfills them a person can't really give to someone else Until they have filled their own cup And since Narcissist can never fill their own cups due to the hole at the bottom They are never capable of giving anything to you Narcissists are endlessly chasing validation from other people But no amount of validation is ever enough for them Because of the hole at the bottom What would fill the hole is their own self-validation But Narcissist do not like to self-reflect or look within It's too painful for them to reflect on their toxic shame So they will continue chasing validation from other people and Using you to chase them and withholding validation from you When they are withholding validation from you In their minds they are thinking Wow This person really needs what I could so easily give to them I can just dangle it in front of them like a carrot and they come chasing after it I feel so valuable and powerful Important and significant without me they are nothing They have nothing to do I am giving them their purpose in life And their purpose is to chase me and the validation which they will never receive Thank you for watching Please like comment share and subscribe If you would like to donate my PayPal link is in a video description Coaching inquiries you can contact me and Narcissistcoaching at gmail.com If you would like to chat with other survivors and frivers outside of the premiers We have a Reddit community you can sign up for our Patreon page The link is in a video description Check out the Narcissistcoaching merchandise store The link to our Teespring page is in a video description Again, thanks for watching. I hope this video resonates with you and I will talk to you soon