So originally this was titled crucible towards a safer and more consistent Bosch job interface. The lawyers told us we couldn't use that name though, so it's now called BPM. That's the release you can find on GitHub. I'll be presenting with James. We're both software engineers at Pivotal. I've been there for about four years. I've done stints on Runtime, on Bosch, many other teams. James worked on Diego most recently, and we're both working on security in the past year or so. Overview. We're going to talk about where this came from, why we're doing this. Jim will talk about implementation and some of the benefits, and then we'll talk about the future and hopefully wrap up with enough time for some questions. Cool. So yeah, let's first talk about where BPM came from. So I think it was late last year. Christopher Brown actually proposed a research proposal to CF leadership and asked to see if we could explore what it is to run Bosch jobs inside containers, but also to explore how we can standardize the Bosch job interface away from just Monit and Bash. And then in March, I believe, we were given a two week exploration where we spiked out a project that was known as crucible at the time. And we were basically running Bosch jobs inside Run C and also using a declarative configuration to do so. We were trying to test out the feasibility of this product and see how it went. And the fact that we're still talking about it today seems like it's going pretty okay, but we converted a large majority of the open source releases. And yeah, there were some pretty cool benefits. If you're interested, I can link you to the previous exploration that we did, but yeah. So motivation. Probably you all have some idea why we'd want to run containers instead of just having jobs running on the BM. The first is the defaults are unsafe. So every job starts as root. Every job has maximum privileges and the best practice of least privileges left as an exercise to the developer to varying degrees of success. Bash is not a great abstraction for running processes. Pidutils. You might have seen this. Some of you might have copied it into your release. Starts out kind of simple, gets a little more complex, kind of makes people sad. Loggly direction. Seems kind of simple. You have to create all your directories. That's also sort of problematic. Copy and paste that into all of your releases. Also poor isolation. So jobs can read everything. Other jobs credentials, other jobs configuration, the Bosch agent credentials and config. Jobs can overwrite anything on the stem cell. Try replacing bash, see what happens. No resource constraints. And there are no tests for these bash scripts. There was a vulnerability earlier this year, maybe last, where we had been passing user input for log lines through an exec in bash, which was less safe than we would have liked. All right, I'll turn it up to Jim to talk about implementation. Cool. Yeah. So, yeah, now that we know why we're building BPM, we can talk about how we're building BPM. One of the first things is BPM is actually using RunC internally. And I'm sure everyone's familiar, but RunC is a implementation of the open standard for containers known as OCI or open container initiative. Technically, it's a Linux implementation using C groups in the Linux kernel. And one of the great things about RunC is that it is lightweight. There is no daemon, so that was a big win for BPM. One of the things about BPM is we want it to be light and we want it to not actually take up very, very many resources because it's going to be side loaded on every single VM where it's used. Another thing that we actually found that was pretty unique that we could do with RunC was that we were actually able to get away with not using an image. So what we did is kind of weird, but it works. But what we do is our image is actually an empty directory, and then we bind out the root file system from the stem cell into said directory, obviously with permissions protected and stuff like that. But it's a really cool feature because what it gives you is it gives you the execution environment of the stem cell while you're running inside a container. This was an important design feature for BPM because with the way it works, we always wanted the stem cell to still be the source of truth for your file system. We wanted the security updates to come with the stem cell, not with a separate image that you're side loading onto said stem cell. So that was a big win and that was something that we did. Another thing that was great about RunC is that it mirrors the Bosch lifecycle pretty well. RunC run is a Bosch job start. RunC kill, you can imagine, is like a drain. And RunC delete dash f, which is a forced delete, is a big win because it cleans up all the associated resources with said container. And that was always a struggle in the past. We were sometimes leaking processes with PIDutils and other things like that. Some other cool things that come with it is the built-in security primitives. It gives you an easy way to do app armor in SE Linux. We are not doing them currently, but it's an idea. And then also another huge thing is that it's actually the backing technology of Diego through Garden RunC right now and also on various other platforms at the moment. So we do know that this is a battle-tested technology and production ready and it does work. But now you might ask yourselves, like, why don't we just expose RunC to Bosch jobs rather than doing some other tool around it? And the real reason for that is that the JSON configuration for RunC is kind of crazy. I've seen specs that take up over 1,000 lines, and they have way too many specifics that most people don't really care about when they're creating releases. So one of the big takeaways from BPM is that we really want to give a simple interface to secure containers, and that's our goal. So looking at some of the BPM configuration, this is what a Monit file looks like today. You see your bash scripts with start arguments and stop arguments in a PID file. We're still in a Monit world because Bosch is so attached to it, but maybe one day we'll be away from it. We'll never know. But in a BPM world, this is what this looks like. I can prom-ify. Right? In a BPM world, the PID file, it's just now in a standard location. And then the other thing that's unique is that you're now using the BPM executable to start and stop your process. Not much else changes. You're still allowed to use other Monit directives with it so you can do the health check and stuff like that. And then what happens is when you call BPM start, what it does is it goes and finds a BPM configuration file that lives in your jobs directory. And it's just a declarative config that you can see here. One of our goals was to keep it really simple and to not really give the developer much leeway. Like they should just specify what they need to specify to execute their process.  And then we have some other configuration here that we needed to add so that we could support other Bosch releases. But ideally, you could get away with just the first three. And so this is a simple YAML configuration.  Yeah. And it takes hundreds of lines of bash or thousands of lines of JSON and turns it into 20 lines of YAML. So that's how we implemented BPM and how you're expected to use it. Some of the benefits that we see coming out of BPM and really what we are hoping to get out of it is, one, security. So job isolation is a huge win that we get from BPM. We use namespaces pretty extensively, one of them being the mount namespace. And one of the awesome things about the way we're doing the image list containers is we actually have really fine-grained control over how we mount all of the directories into the container. So one of the big things is most of the file system is no exec, no SUID, and read-only. So it's really locked down. Another big thing is that in a previous world, Bosch jobs have access to literally everything, the whole host. But in this world, in a BPM world, they actually can only see their own resources. So we only let them see VARVCAP job name or VARVCAP data job name and so on and so on. Another big win is we actually have control over where jobs can write their data. So the only actual directories that are mounted read-write are VARVCAP data and VARVCAP store. This is just standardizing where Bosch jobs should put their data. I've seen jobs put it in packages. I've seen other things. This is just standardizing it. And one really big win we get from that is it protects the host, the stem cell, from tampering. So if a job is compromised or something like that, we have confidence that the integrity of the stem cell is still intact. And we don't have to panic that other jobs might be compromised as well. Another big isolation is PID namespacing. So each process in a BPM container is the init process. They all start at PID 1. They think they're the only thing running. And it really just provides more isolation. So if a compromised process can't see other processes or signal other processes or cause interference. So that's just another big isolation win there. And then we've also thought about resource isolation. So this is kind of a weird one. Right now, we don't actually have any default resource constraints in BPM. And the reason for this is resource constraints in Bosch are kind of confusing because VMs are arbitrarily sized. Like, what does it mean to put a memory limit on a job when you can give it massive VM or small VM or anything? But one of the cool features that I think you get out of some of these resource isolations is it gives a release author a way to really document the resource profile that their job intends to use. One example being the Metron agent. It's always meant to be side voted on all the VMs. And it's supposed to be non-intrusive. So they can set some amount of resource limitations so that they ensure that they don't actually become a burden to the VM in question. We also see this used in Cloud Controller and other things as well. Some of the other wins, with security, we get least privilege. So there's absolutely no capabilities allowed by default to the process executing. You have to actually request capabilities. And even then, we only let you request a certain subset of them. Right now, the only one we actually do allow is CapNet Buying Service, which allows you to listen on low reports. We have found that, I would say, the most Bosch processes are totally OK with this. They don't need these capabilities. That's just another huge win. In a similar vein, we always execute as a non-privilege user. In the case right now, it's VCAP. It's not a suitor, so you can't escalate your privileges. You're locked down.  Right now, we have N releases, and they're all implementing PID utils and log utils in different ways in their own flavor. And what we get with BPM is we get a singular release that we can then apply across the board to all releases. So you just do one update, and it goes across the board. So you really do get a consistent place where you can make these changes.  You update your BPM release. Anything using it gets all these updates. You can implement these changes in a shared location. So an example of this would be the security vulnerability that Erin mentioned earlier. It would be tackled in one place, and there wouldn't be the struggle of having to manage the security across multiple teams or across multiple products. Some other things we can do is we can do simple performance improvements. We found that by setting certain time zone variables, you actually do get performance improvements.  Some other things is like best practices as well. And a thing that I think is actually kind of interesting is we always talk about CIS security standards, but this might be a really good place to try and implement these because you can consistently enforce these across all Bosch jobs. Another thing that I think is huge is simplicity. So from the releases that we've converted so far, we actually have seen a large reduction in BASH. Most of them, there's almost no BASH, but in some cases, there is. And when it is BASH, there's like 10 lines, so you get a much more auditable BASH experience. It's easier to reason about, and you don't find yourself in ambiguous situations where you don't know the execution path. Another thing is the declarative configuration. You know exactly what you're running. You can see it, it's declared out there. There's no more boilerplate, so PID utils is gone. Everything is handled by BPM. And I like to think that developers can really focus on writing the code that they wanna write rather than writing code to operate their code. A huge thing too is opinionated standards. So we're enforcing users to actually follow standards that both Dimitri and the team thinks are good experiences. And a really big thing is it's a consistent experience for users, right? So, right? But it's a consistent experience for users is what's big too. So if I'm working on release A, and I go to work on release B, the execution doesn't change. I know right now I've jumped projects and the way that bash is invoked, it just changes. But this would standardize that. And I think the last thing that's really important to actually focus on is the operator experience. I think BPM really gives us a nice tool to improve that. And what I mean by that is, because all jobs will hopefully be one day using BPM, what you could see is log files will be standardized and ephemeral and persistent data will be standardized. So when you're an operator, troubleshooting an issue on a stem cell, you have a much clearer idea of what things are doing and what they should be doing if they're using BPM. Another cool thing that we actually found in the Crucible research project is that we're able to put the BPM executable on the path. And so then we can actually add some helper functionality to the BPM executable to help operators. For example, BPM logs is a current one that where it would just tail the logs for your process. BPM trace is an opinionated S trace, which is a really cool tool that has helped me find some bugs in the past. And BPM shell just launches you in a bash shell if you need to poke around in your container. Cool. I'm gonna talk a little bit about the future and then we'll stop for questions. So one possibility is maybe improving cross OS consistency. Currently we've got Monit and the Monit JSON that comes with Bosch Windows. We see a future where maybe these are using the same config file under the hood. Or at least people are using the same sort of primitives. This may also involve us moving or looking at WinC on the Windows. The corresponding Windows Run C executable. Possibly being able to translate from Bosch jobs to other container schedulers. So Diego Kubernetes and Bosch BPM begin to look very similar. It's not inconceivable that you could have a mechanical translation between those. Further security enhancements. BPM provides a shim that might allow us to run every job as a different user on the VM. Username spaces may allow us to do that without having the job know about it. So the job would appear to be running as VCAP within the container. It improves isolation, leverages user isolation on the host might be some issues with shared volumes, it's unclear. Network namespacing is also a possibility but that seems to be somewhat fraught. We don't really know what's gonna go on there. But definitely a possibility we might consider. Flexibility, so we're introducing a layer between Monit and Bosch jobs and the Bosch developers. This might pave the way for replacing Monit. Again, it's a five year effort, so not sure when that's gonna conclude. I'm sure it's a bit. I think it's fine. We'll provide also an abstraction between the job and the stem cell. This allows fine grain control of the job's execution environment but also it allows us the possibility of maybe evolving the stem cell and what's laid out on the stem cell OS differently from what the jobs see. So this could happen either more rapidly evolving stem cell or more rapidly evolving job execution environment. But at this point, those don't have to be bound together because they're not seeing exactly the same thing. So lastly, try it out. We're not at 1.0 yet. Our intention at 1.0 is to have a stable config file format. Right now we're making a lot of changes so it's not very stable in that respect but the containerization has been. Try converting a release. We'd like to hear about you, your experiences. We'd like to hear about issues and edge cases. We'd like to help you adopt BPM. There's a Slack channel at the end of this. But one caveat is that BPM is more constrained than the Bosch execution environment and we hope to keep it that way. Sorry answer to this doesn't work might be you should do it a different way. But we think that's a good move for security. With that, questions? Thank you very much. Speaking of this doesn't work this way anymore and how can I adopt it? So I'm maintaining a CPI which is basically an executable being placed by one release being called from a long running job placed by another release. How does or could that work out? We've had some conversations internally this is the execution pattern between the Bosch director and the CPIs and we think probably the correct way in the future is for that to be a network boundary. One of the things that's really interesting is if you think about that as a network boundary then it's possible to imagine that the person who owns controls and provides credentials to the CPI job could be a totally different person from the one that owns the Bosch director and those two processes and those two silos of information wouldn't need to be shared. So the director operator would never have the credentials to the IOS. Which you could potentially do already now with CPI configs and credit but true. Interesting. Well, yeah. Yeah, I think you already mentioned that you might, you could potentially extend the isolation to a network domain also. So I'm wondering what you have thought about in that direction. You could have something like security groups that you know from Cloud Foundry extended to this concept or only allowing linked other job instances, job of network visibility. We haven't done a lot of thinking about it and actually network namespacing was one of the things that we explicitly did not want to do to begin with because there's a huge amount of complexity there. But I think, I mean we are having conversations with the people doing the container to container networking and it might be possible to leverage some of that. Right now it's very unclear but it's, what's nice is that this is a place where we could implement it. Right, it's a layer that gives that possibility. Whereas before it's not even on the table. Sorry. So what if you have a boss job that maybe needs some of that Rudy type privilege or maybe needs to do some stuff like say for example, Dmitry gets busy stripping out all the extra stuff out of the stem cell and maybe your software requires some of that extra stuff to be installed back in. Are you envisioning that the permissions afforded to the container would be configurable so that while you're secure by default you could be insecure by choice? Yeah, I think that's definitely going to be a possibility. So there are two escape hatches. Right now the BPM containers are pretty locked down. I see us adding more capabilities in the future because I think the benefit of having every job be declarative as opposed to running a bunch of bash is more advantageous than forcing every job to be very locked down in terms of privileges. Right now there is one escape hatch and that is that the Bosch pre-start runs outside the container. BPM also provides a pre-start to do some setup. So I'm not sure we're kind of working to figure out where those boundaries, what the right boundaries are there. Ideally the capabilities we can grant would be limited. Like I would prefer if we didn't grant we would didn't make it possible to add every Linux capability. But again, like the value of having everybody become declarative and providing that shim layer might outweigh having it be permanently locked down. I think one of the things that's most important in terms of isolation is walling jobs off from one another so that there's not this possibility of crosstalk, cross pollution, or so one job being compromised and not allowing every other job's credentials to be taken off that VM. So that's one of the things that we're really focused on. It looks super awesome and I'm excited to use it. Are there any Bosch jobs or Bosch releases that you've looked at and explicitly gone, this is out of scope, this isn't gonna work with this kind of approach? There's one that we thought about converting and didn't in that's garden because it's doing the same thing as BPM. Mootless garden might open the possibility for that but it's not clear, that doesn't seem to have landed completely yet. There may be some cases and that might be one of those things where we go ahead and add like a very big dangerous sounding config flag that lets somebody basically do a sort of useless container around the job but just gives us the opportunity to make those jobs declarative as opposed to Bash based. Does that mean the nested container thing is a problem? Like the Bosch light sort of experience that we take for granted? No, the nested containers should be fine. It's more just that we make certain decisions like hiding the C Group file system right now and things that would make garden incredibly hard to implement so we would need to get rid of some of that and put some holes. So if I run Docker Bosch inside a concourse container which itself is containerized with BPM running on Bosch light, we should all be good. Yeah, you'll be fine. All right, good, just... You might have a headache. We currently actually have a CI build that does a concourse build, a Docker Bosch and then a Bosch deployment inside of it, so yes. From the Bosch UX point of view when you do like Bosch instances, FNF and PS. So right now, Monet is responsible for giving the process status. Like what are jobs that are running? In this case, like BPM provides, I mean, how is the integration between the process status? From that perspective, the process just like, looks like a process that Monet is watching. It just happens to be that the PID that Monet is seeing is a PID which is namespaced underneath that. So from the outside, everything looks the same. Monet status should be the same. So essentially, RunC is managing the PID on the host and then Monet is still watching that PID file. So realistically, what we get rid of is the user's need to manage that PID file, but the interaction between Monet and the process should stay the same from the viewpoint of Bosch itself. The Monet itself is not running the process, right? So how does it can like check whether the process is running or not? So it uses the PID file for that information. Basically, if the PID is running, it reports healthy. That's how Monet currently works. Can I throw up that example, Monet? Yeah. I'll let you age through how quickly. Nice animation. So the PID file directive on the second line is what ties the RunC state to the Monet state. So if that PID file actually exists on the host, if the PID running inside that PID file exists on the host, Monet will report healthy. And that's essentially how it's done previously in the CTL world, CTL scripts world with Bosch is the scripts will maintain that Monet file and depending on the content of that Monet file, Monet will report healthy or not. Well, so for anyone that's done more with Monet than just copy and paste, we can add more health stuff here. That would fit straight into all the BPM. Yeah, so from Monet's running on the host and from its perspective, the job that BPM is starting there is just like any other process. It's only from the perspective of the job itself that the world is containerized. So you can still do network health checks and all that. It still works. We have another one, awesome. I mean, if you could bring closer to me, that would be good. I'll come to you if that's all right. So you mentioned eventually it might be a long-term goal to run Bosch processes no longer on VMs created by Bosch but also on other schedulers. But at the same time you mentioned in the beginning that you don't actually want to create images but you have zero images and mount file systems on it. How does that fit together? I guess if you want to run it on a different scheduler, you would need to create an image at some point in time. Probably during Bosch compilation phase or something similar. Probably. Yeah, it doesn't open question. I think in that world it's possible that there might be some sort of like an OCI layer that looks just like the stem cell or the stem cell is an OCI layer that something, something, wave my hands. I'm sure to meet you real figured out. The homomorphism of the configs is just to point out that, so first of all, the world is kind of moving to a declarative setup about how to run jobs and the world is moving to a world where everything is running containers. And once Bosch jobs kind of catch up with the rest of the ecosystem and are set up that way and that they're declarative and that they sort of are a specification for running something in a contained manner, it becomes possible with obviously some caveats and some work to do this kind of translation or this sort of migration, whereas right now going from 250 lines of bash to a pod spec is kind of a non-starter. Yeah, I truly view it as a transitionary period. I think there's jobs that should not be run in Bosch, for example, like Cloud Controller. It's just a simple web server. And for those things, I think you might do, you might have to build an image at some point, but that would be a good problem. I think the point of keeping the stem cell as the image is to preserve the interface that Bosch is providing and that is the stem cell, that is Bosch's contract with you. And also to deal with the rolling updates, right? You would want to solve that problem of like constant security updates differently if you move to an image-based system. Right, I guess the opportunity would be to even further reduce the actual image that you would need to maintain. You could use like Alpine instead of Ubuntu and then releases need to bring their stuff, so you could even further reduce the attack surface. Yeah, yeah. Yeah, we have a bit of a challenge in the Bosch universe where obviously this contract is unknown. Over time, we've tried to rip things out and then you'd find out, oh, you were using that, were you? Oh, perhaps you shouldn't have been. Classics being GCC. I don't know a Bosch release that brings its own GCC, I don't. So yeah, that's the contract, it's a bit icky to move on from. Gentlemen, thank you very much, everyone. Thank you. Awesome. See you.


And we're back with the breakfast and plus TV Africa. Ambrose Bokeh joins us this morning for Off the Press. He's a chairman in the state chapter of the Guild of Public Affairs and the list of Nigerians. Ambrose, it's a pleasure to have you join us this morning. Good morning to you. Yes, thanks. All right then, let's quickly take a look at the punch newspaper this morning. We have other papers, but we'll set up for the punch. And the punch says, INEC votes three billion narrow to fight electoral cases. That's very impressive. APC, PDP, Labour Party, Defence and Commissions litigation budget. Litigation costly, budgets may not be enough. That's what senior lawyers are saying. Probably might just be a period where legal practitioners are cashing out. Now you find on the punch, PDP vows to probe as Bainway Ward suspends, are you? And United Kingdom to sanction Nigerians, and avoid childs of Fanny Coyote. So you're looking at the punch newspaper this morning. A Fanny Ferry. Knox. Why and who's and demands O'Hanei's is clarification. What is what you want to ask now? FSOAR is Foreign Airlines Hike Exchange Rate. I remember someone having a conversation.  Nothing has ever gone down any time it goes up. Especially when you talk about the prices of, you know, airfares. So that's not the case now. Just before move away from that ex-governor donates 240 truck of food stuff and groups to feed 2000 daily. That's what you find. We just move away from the punch. Let's go quickly to the Guardian this morning with the following headlines. NLC reconsiders strike as CBN opens vaults to banks. There's some writers there which you can see on the screen. Greeley Cabau delaying refineries takeoff. UNN confers doctorate on Zenit Bank Co. We have more from the paper. CBN's new lending rate to raise construction materials cost. And Edogastentative approval for airport in Aochi. One of the few stories from the Guardian why Africans need knowledge transfer more than grants.  You have Dia, the life and times of Army general who cheated death. Immamales quickly turn her attention now to the Guardian newspaper. We just took the Guardian. Okay, we just took the Guardian. So I'll move away from the Guardian and look at the daily trust. How NIS operative extort travelers at airports. That's what you find. That's boldly written. I paid $100 to get my virgin passport. Don't understand what that means. If you want to say new passport then. Clint, that's what the passengers say. Eight officers sucked. 88 facing disciplinary measures and found the cries extortion. These are some of the riders you find underneath the board caption. Our production increases to 1.7 million bar per day. That's what the federal government is saying.  We shouldn't be talking about 3 million. Shouldn't we exceed it? Well, should we be celebrating that we're doing 1.7 now? Question and of course can't wait to share the thoughts of our guests. The Anambra Indians deny us accommodation. And a CBN raises the alarm. Kogi Baosa imo governorship polls. APC ricks in over 1.3 billion from funds.  And of course another says the general who escaped execution finally bows out. And when it's time, you definitely have to go. We talked about it this morning. We'll just leave it at that for the want of time. Finally, the nation newspaper has the following headlines. Post poll crisis. Are you under pressure to quit as PDP chair? I thought we'd hear the last of this. More from the paper. Foreign reserves dip by 1.43 billion in 10 weeks. Cowan bundling of railways. Power boost economy by experts. A writer there. Devolution will encourage a competition enhanced through federalism. 3.4 billion narrow debt. Court blocks. Oil governments accounts in four banks. APC Klesuzodema silver. Lion and DME for primaries. Interesting. Some old names popping up there. And why I dropped my ambition via Falake. All right. The nation also has a special. It says Donaldson Oladik-Bordia. That's what I was looking for. 1944 to 2023. His last moments by family, friends, aid. All right. We'll go over to our guest embassy book. Before we look at the other stories, just give us your thoughts on the life in times of the late general Oladik-Bordia. He's been described by one of the papers. I think he's a tribune as a general who escaped final execution and by the guardian as the general who cheated death. Ambrose. Well, general Oladik-Bordia. It's a name that I knew when I was growing up. I remember as a kid in primary school, where we used to do current affairs. The name of general Oladik-Bordia ran out with some certain names of the military elites of that era. From post-1993 democracy to 1999. There was some site of a military who were mixed from general Bolanagan, Diabom, Babanjeda, Bichu, Kiwi, John Chadiya, Joshua Dome, Dome Katsbali, John Martin Yenga, David Mack. So general Oladik-Bordia was also among the general events who came later. Then his attendance to the height of the military career was when he was the chief of general staff. That was now stated by some colleagues of Phantom Coup that was said to have been planned. Remember that during that era too, a lot of former Nigerians were also shown to jail for so-called coups, which was found out with Phantom Coup. Chief Oluxia-Bordia was shown to jail. Aladik-Bordia was shown to jail. And the cost of all Nigerians were shown to jail that period. General Dahl was not lucky enough to make it out alive. Chief Oluxia-Bordia went back again and made it alive. General Dahl was very furious because he was in government. The others were not in government. Well, he was in government and he was in over two months. And then he was hooked into that coup that was said to be Phantom Coup. I was convicted to die by some stroke of luck. And my Christian tenors, we say by divine intervention, the person who was supposed to kill him died before him. And then Abusalam took over and the rest, we say, they were all released and there was a lot to go home. And they had survived almost 25 years later after that dwelling ordeal. So he has lived his life. And one more thing, the Nica size, General Dahl was a handsome man. So he was young days. His teachers, the ladies, had got shown at his teachers then.  It looked very handsome. So he lived the process by establishing a front of him. So we wish him that he should rest today. There is so much to do. All right then. Ambrose, let's move away from that now and talk about INEC. I'd like you to show your thoughts on INEC's budget to fight electoral cases. They have put the figure of three billion there. It doesn't sit well with, you know, the political parties that contended for, you know, contested this election. Let's not use the word contend. For those who contended or contested the elections, Labour Party, PDPA among others have said, hey, this is so much. What are your thoughts? The cost of litigation in Nigeria is very expensive. This is because the litigants is basically meant to carry the entire cost of litigation. There, the defense also has a lost cost to entail. Now, when you come to INEC, different election cycles have shown that INEC is always answered as a respondent in many, almost all, cases that have to do with election matters. These are election matters, these post-election matters. And sometimes these issues drag for long. From stages of House of Assembly to the State Government to the House of Reps to the Senate against the presidency. So imagine how many cases. I remember that these cases are expected by persons and by political parties. So what we call for House of Assembly election, for example. Imagine the number of party aspects. Imagine even the number of intraparty issues. As each of these people, I joined INEC as a respondent. So what I'm trying to, the barrier of such a layer is that INEC has a preserver of litigation cases. So I tend to. Some of these identified profiles which are senior advocates of Nigeria have to be assembled, but a gamut of them have to be assembled. So the cost is not, it may be staggering when you look at it, but at the same time, when you know the cost of litigation in Nigeria, you'll find out that it may not be too much. I think INEC should be looking at voluntary in consecutive some of these cases. Because if we want to pay all the lawyers the requisite legal fee for the 20 INEC in every of these cases, then I tend to not be able to bear the financial burden. And Nigeria tax lawyers' money cannot bear that financial burden. So this is the time to start looking at constituting a team of volunteer lawyers. I mean intelligent lawyers that we have INEC to prosecute some of these litigation cases and costs. Going forward, we can start it from now. I saw the auditive allowances, solicit stipends, the lawyers solicit stipends and allowances. I may be a certificate of commendation and some other things that we compensate for their time at the cost. But so I would say that the legal fee for each person present in them given the three below will not be enough. So INEC should be a creative in trying to contact costs of litigation during election seasons. Thank you, Ambrose. There's one that tickles my fancy. This is on the front page of the Daily Trust. It talks about the Nigerian Immigration Service operatives who are extorting travelers at the airports. And the reason it's making me laugh is because I remember very clearly the months, weeks, let me say weeks and maybe months immediately after President Mahoud Buhari was sworn in. The airports were free, empty of these touting profiteering, racketeering and extortion. It wasn't there.  This is a few months that the President leaves and it seems to be almost like a post mortem on his administration. I remember even on the roads, Merci, we didn't see policemen collecting money. All those points. The day two days, three days, five days after the President came up. So what I thought on this current article now where the Daily Trust has gone under to find out that immigration operatives at the airport are extorting still, extorting passengers. I think big shame that we have still suffered this kind of ignorance in our country. When we go to our sister African countries, even in West Africa here, like Ghana, you don't see this kind of thing. Okay, sometimes like there was in Ghana, I had an issue with vaccination, women can't, and then the Ghana, the flight was attended to be said, oh next time, Allah needs to fix the police operatives.  And then I crossed the line, I entered the city of Akra, I said hey, if this was Nagos or Bujak, they would take me to a room and miss the hell out of me, collect all the things I can. That is the concept. So my joint immigration service has been a search tool of corruption. And anybody who pretends that he doesn't know, it's not a search tool. And we go to Ethiopia, see where their airports are working, see where their airlines are working, go to Portugal airport in Ghana, see where it is going, go to South Africa, go to African countries. Let's not compare ourselves with European countries. Now we have people who are basically jobless, mingling around the airports, asking people who are coming in from... from... or from... anything for us.  And nobody... Why is it continuing? Nobody is prosecuted. Nobody suffers any consequences. So it is like I will stay there to make money, maybe for your guard back at the office. So if it is... if it is something that we need a change of mindset in Nigeria, the staff of Nigerian immigration service are in Nigeria and we are part of them. So we don't expect Nigerian immigration service to be holding? Ambrose, you remember the... When a power country is not in a right state. Ambrose, you remember the immediate aftermath of President swearing in at the airports. It was like we had brand new airports. Those people were nowhere to be found. Ambrose, are you there? Okay. Earlier I talked about the immediate aftermath of President Buari's swearing in. These things, these practices had disappeared from the airports because of the perception that President was going to come and fight corruption. But we don't have time. I think we'll have to say goodbye to you now. Alright. Ambrose Bokeh is a chairman in a good state chapter of the Guild of Public Affairs Analyst and you can tell why. Because he did absolutely justice to the few headlines that he was able to analyze with us. I will take a break. When we come back, we have more discussions ahead on the program. Please stay with us.


Hi, it's Bridget. I thought today I would do a really fun video for you and give you guys some cool gift ideas these are a few of my favorite things and if you are in the United States and Celebrating the Thanksgiving holiday. That's exactly what I'm doing here and right now so we got the turkey in the oven my husband's the chef today and I'm also Watching the Macy's Thanksgiving Day Parade Livestreaming it so that's on my laptop right here, so I don't miss a thing So today I'm going to share with you just a few gift ideas That might be really fun for you or for your loved ones gifts for all ages and Super affordable stuff because I like a good deal. All right, so first things first this Comfy sweatshirt is something you may have seen around and I Would highly recommend it. I purchased one for each of my kids last year and my college kid She loves it in the dorm room, so I'm going to show you a little bit about it. It's literally called the Comfy and It has this big pocket. It's super long and And It's a one-size-fits-all kind of a thing, but it's got these nice cuffs on it So you can juge it up if you're going to be washing some dishes and it's literally like wearing a Blanket it's got a cool sherpa lining and a hood I literally have been outside in this walking to check the mail So they come in multiple colors and they actually have two styles this one the original Comfy Has the sherpa lining and they also have another one that has just a pure sweatshirt lining So a little bit lighter weight if you're on a different part of the country where This might be too hot for you or at a different time a different season You might want a lighter weight one. You can check that out I'll mention to you that I'm going to put links to all of these favorite things gift ideas in The description below Please utilize the links if it's something that you are going to do some shopping online Because it really helps to support and give back to my work my channel and my business so Comfy I also just ordered one from my mom Hope she's not watching for Christmas this year and it had a really cool print It was like a leopard print So make sure you use the link below if you want to purchase a Comfy These are really reasonably priced. They're less than $40. So super awesome idea. Okay, so Next okay, so keeping along with the Cozy theme of the year here kind of something fun This these are awesome. You guys have probably seen these they have them sometimes at the drug stores and things like that But this particular one, it's a light-up Christmas tree bulb necklace. This particular one has a circular Control dial which I prefer. There are some cheap old ones That have just a stick behind and those are not comfortable We were these last year we went to Disney World for the Christmas party So they're totally comfortable and we actually hung them around our room to kind of decorate for the holiday So I'm going to push the button here and show you See they light up They have different settings. I'm just pushing the button to change the settings here in the back Isn't that fun? It's so much fun So I purchased them also for stocking stuff for some of my kids So now there's a setting that just keeps them glowing. I hope you can kind of see that see there on right now And our house we do like a five days or 12 days before Christmas where I Put kind of cheesy stuff and fun stuff and of course chocolate and candy in my kids' Christmas stockings And so last year I put these in the stockings and the big kids even wore them to high school They thought they were totally cool So and they're super affordable. These are super affordable. I think I got I think you can get like a four pack For like 20 bucks. They're not that expensive you guys. They're not that expensive. So These I highly recommend super fun. I'm going to show you how they come even if you order them a pack of like Three or four or six or what have you they'll come individually wrapped Like this and they have batteries here I can't remember if they actually had batteries in them right away or if I had to put the batteries in I don't remember. I think these are backup batteries actually, but I can't be sure on that So read the info when you purchase.  So if you order three or four or what have you now as far as how they last We had them for a couple of days like on all the time So they lasted at least three days constantly running and you're not going to be doing that You're not going to have them for like 72 hours on all the time But when we're on our trip we did and so they lasted at least that long at least so How do you recommend these again the link is below so you can purchase them in a bundle wouldn't these be so cute for like the grandkids and Maybe the office or that kind of a thing. I mean wouldn't it just be fun kind of a fun gift. All right so now because of the work I do you know, I do spiritual work and Connect and and as and I work as a channel. I Have a couple of things to help inspire your spirit. Okay, so the first one is Let's see. Well, let's do these first These are called Thoughtfuls These are called thoughtfuls. They are a box They come in a box and there's different themes. This one says shine again, they're called thoughtfuls and When you open the box Here, let me get the other one here. That's just brand new and not out of the package This thoughtfuls is dream. This is actually going to be a stocking stuffer for my daughter Don't tell her and So you open up the box and Inside there are Into the it's wrapped in like a packet there are six of these or I'm sorry six of these There are 30 of these cards so they come like this and a little kind of stack and Then they're individual their individual little cards so you can just pull them out so each day of a month you could pull one out or If you wanted to gift them or just pass them out to people to spread some cheers Spread some spread some positivity in the new year and then what you do is this is perforated the edges here It doesn't come open like this. It comes like all sealed perforated. So you kind of pop it open and Then there's a quote in there Isn't that cool and it's related to the The theme of the card now these ones are wish cards, so that's another one you can get there's so many you guys there's all inspired life and life is beautiful and Gratitude there's so many different themes again. These are called thoughtfuls and they will be in the Link below and they're super affordable. They're under ten dollars each and sometimes if you purchase them on like a pack You can get a little bit of a discount and so what a cool gift. This will be great for anyone any age just a positive inspirational Gift for the new year. These are also great for birthdays And for somebody that has like everything and you don't know what to get them My daughter who is 18 adores these and what she does is she tears off the edge?  What a cool idea so she can be positively Inspired all right. These are like some of my very favorite things you guys I love love love love these these are a great gift and super affordable less than ten bucks for a box of these So good so good Definitely will inspire your spirit now the last item that I have to share with you today is a Tool that you can use also a positive Well positive tool that you can use this is the these are the sacred traveler Oracle cards by Denise Lynn All right, Denise Lynn is a great resource if you are interested in any kind of a card deck thing this Sacred traveler deck is one of my very very very favorites if you've never used a card deck It's not these are not to roll cards or anything like that You don't have to like take a class to figure out how to use them super easy. They're just positive Beautiful cards. I'm going to show you what they look like They're not spooky. They're not creepy. They're not oogie boogie. They're very positive They're just beautiful help you to connect with your spirit your inner voice your intuition. All right, so Here's what they look like on the front. It's not beautiful They're nice and of course they have purple. I love purple and they're thick. They have like a thicker Texture to them. So they're very they're substantial. They're not like thin paper or anything very nice cards and Then so I'm just going to pull a card for us and we'll chat about it for a second So I just shuffle them and whatever comes up or whatever sticks out is how I grab one They also come this card deck and other card decks by Denise Lynn. It's a spiritual kind of a deck It's an intuition kind of a deck Comes with a little guidebook so you can if you want additional information for that brain of yours You can look up information about the card and the possible or potential meanings for you now This doesn't mean that every single thing that this says Applies to you. Oh, no It's an opportunity to use your discernment and connect with the message is an information from that card That really fit for you at this time. See that's why it helps you with your intuition. So Hello, let's inspire a spirit today Inspiring your spirit while we're flipping through these cool gift ideas. All right, let's get one out Oh, there it see look see that one kind of stuck out There's actually a couple more in the deck if you look at it. They're sticking out So let's take a look at a couple of these This one says stay focused hold the course So take a look at the imagery and the colors. That's how you get information. Oh I love this. This is such a cool. This reminds me of Archangel Gabriel actually Messenger angel Stay focused my friends stay focused if you got some food to make you better make sure you got those Timers set and you got your recipes out But hold the course I feel like this is encouragement right now for this holiday season you guys It's not time to go crazy off and be too totally distracted by other people's drama drama drama drama Focus on what you know to be true focus on the simple stuff and just stay focused you guys live your life Man, you can do this. All right, so there's one of them now. Remember how I said when I was shuffling the deck There were a couple more that popped out. I'm going to grab these two as well and Share these with you this. Oh, this is gorgeous. Oh, this is very psychic Mystic healer healing energy flows through you is what it says mystic healer Healing energy flows through you See look at the imagery isn't it beautiful and the colors gorgeous Mystic healer love this the energy healing energy flows through you See what this tells me is that you are so supporting you just stay focused Do your stuff take care of your business take care of the stuff that's closest to you and Just know that there is healing energy that is flowing through you around you encompassing you and enfold you and Supporting you right now. It's supporting you. This says to me the universe has your back It's totally supporting you here and now So are your spiritual healing helpers your healing team including your higher self and your spirit So let's do one more one more. This one popped out, too. Oh This one's cool This one says wise leader You are a beacon for others.  This isn't about service to others. This is about being authentic and You are fullest self. Just show up as you if other people don't like it. That is not your problem I'm not saying be in people's faces. I'm saying just speak you be content You don't have anything to prove to the world be that wise leader connect with your higher self and glow Just glow Inspire and motivate yourself. Love this vibration. You are a beacon for others this warrior energy I like this kind of goddess energy and almost reminds me of one of my guides The Joan of Arc guide the saint to Joan of Arc. She's one of my faves. I love her. She's awesome There you go. Okay, so this gives you a kind of an idea I'm also going to put a link below not just to this Sacred traveler card deck that I just showed you but Denise Lynn also has another card deck That is called Gateway Oracle cards very very simple to use and something that I would recommend Especially if you're just starting out trying to use some kind of a tool like a card deck, okay? It's not just something for psychic people. It's not just something for a reader to do It's totally an opportunity for you to act with cards as a flash cards to create a connection a common language a common just a Dialogue between you and your spirit. That's what it's about. Okay. It's not complicated Super easy. All right, so you guys I just wanted to make sure that I shared with you something fun for the day something happy for the holiday and Give you some cool gift ideas now these decks I should mention for pricing. They're less than $20 and So you should be able to find them Less than $20 so that's a great gift for yourself or for a friend of yours that you know is like on a spiritual path Or is curious about their intuition? Great resource great resource. All right, my friends. I hope you have a wonderful holiday season I thank you so much for being part of this incredible journey and I have so much gratitude for you Make sure that you use the links below if you're going to purchase any of these items or By the way, if you're just going to go to Amazon and you're going to make some purchases for the maybe the Cyber Monday Make sure you use the links just to get there to do your shopping because it does help my business It helps to support the work that I do as well So thank you so much for being here and have a wonderful holiday season