My name is William Brown. I'm a senior software engineer for Sousa Labs, and I'm based in Queensland, Australia I'm a member of the three at nine directory server team Which you are probably more aware of as the LDAP server which sits underneath free up yay and Just because of my time zone and other things if you have questions I'd love to hear them, but I am in UTC plus 10 which means that I'm often not online So please send me an email if you have any questions at any time Whether it's about LDAP or the content of this talk to my email at wbrown at Sousa dot de so My talk today is about my life and how I kind of got really involved in authentication what I've been doing the last few years and so when I First became interested in authentication identity management I was actually a system administrator at the University of Adelaide as pictured here my home city and And I was in charge of managing their Red Hat directory server instances Since then a number of things that happened after working there for a number of years I think I worked at the uni for about seven years. I applied to work at Red Hat in 2015 and I was successful in that and I became a software engineer at Red Hat working on Red Hat directory server or throughout 90s and since since that time in 2018 I left Red Hat Did a few other things and then I was asked by Sousa to join them and continue my work on throughout my directory server And the thing about LDAP is that it's really kind of the linger franca of of identity and authentication You know, it's used all around the world from as mentioned universities as pictured here to telecommunications for authenticating phone handsets and cell towers to even finance where there are finance providers who authenticate Accounts and transactions through LDAP and And it's really one of those very foundational things that you kind of just know is everywhere and you know It's even a foundational part of free IPA But since I have been part of the Red Hat 389 team and now as part of the Sousa team You know, there's a lot of things that we have certainly improved in 389 DS But a lot of it feels a lot like polish, you know We have a lot of really good new CLI tools Thanks to many people in the team to get that done. We have the nice shiny new cockpit administration tools But it is core it still really just users groups passwords and So, you know, we kind of want to look at what's going on in the authentication space for for a period of time and Within open-source identity management, there's really four major identity players I'm sure there are others that exist But if you go to a a large organization and they have an open-source identity system It is very likely to be one of these four open order 389 DS or Red Hat directory server for IPA or sign before and You know, there's Not been a lot of change in these things over the last few years, you know a lot of polish a lot of improvements But realistically the latest standard, you know The most important innovation that has really come through has been in 2011 TOTP And that has now since been at free IPA a couple of years later and open LDAP I think picked up support for that last year maybe the year before But when we look at other areas of identity management and we look at proprietary and non open-source technologies We're looking at a lot of Really big differences, you know, we have things like a warth and open ID for web single sign on 2005 We have the rise of Identity as a service infrastructures like G suite octa or zero and especially in 2014 with Azure active directories Synchronization connector that was a really large step forward to helping major businesses move their identity infrastructure from on-premise into Identity as a service and then we even see further advancements beyond just the technical advancements of all of these Identity services. We also see new advances in terms of cryptographic authentication with things like Windows Hello web orphan and Apple's touch ID And a lot of these things are really actually clean slate, especially things like Azure AD Which cast off a lot of its active directory and LDAP cover us legacy And they're all gaining a lot of popularity due to their ease of use integration and how they're advancing things And so we have to ask why aren't our open source technologies keeping up? Well, a lot of them are LDAP and Kerberos focused And the thing is that the itf working group for LDAP has been defunct for a large number of years And two attempts to revive that within at least the last five or six years that i'm aware of have both failed It's also sometimes it can be a very unwelcoming place You know from mailing list comments such as quote you will be shited mocked and denigrated end quote To even things like people in the communities being brought into tears by other maintainers Just due to hostility and difficulties in working with them It's really not a place which has been attractive to people to want to work in It within these projects And of course LDAP and Kerberos are really hard to use conceptually A lot of developers already find it very hard to use LDAP And sometimes they will begrudgingly add it onto their website because that's what corporate requirements want them to do But no one really these days willingly wants to implement Kerberos You'll never for example see a web service or an implementation that has native gss api support And of course this makes devs reluctant to add these integrations and it makes it much harder for a business to justify continuing to deploy them And this has kind of led to the a little bit of stagnation Whereas on the flip side Our h2p focused and more proprietary areas have really advanced and and gone a long way into Attracting people into these identity spaces where we are currently kind of losing ground within within the more traditional areas And so for me This was a really difficult situation Because I really genuinely care about authentication, you know, you can't Become an LDAP admin at a university and then apply for a job at red hat without being, you know, somewhat passionate for this Especially given that I'm in Australia and we are not really well known for having many engineers within red hat. But anyway This was just a really Hard situation for me because I really wanted to be improving this state and I just felt like it was continually slipping past us I wanted to get to a point where I could stop saying no When people ask me questions about features and what we could support I really wanted to be able to start saying yes Why can't we have an open source identity management system that could be as good as azure ad But you can run it yourself like free rpa or samba floor Some of the supports these web first apis but also our existing infrastructure integrations that have been left behind by identities of service platforms And can we break away from this LDAP and cobra centered mindset, which is confining our thinking So in september of 2018, I decided to start a new project So I started to develop the cunny dm project which is an identity management platform developed completely in rust and it is Mine and other people's vision of what we hope is the open source identity management of the future And of course we've tried to learn a lot of lessons from the past successes and failures of both the open and proprietary technologies that I've already mentioned There's still a lot of development that needs to occur. It is still very much an alpha project It is barely two or so years Yeah, barely two and a half years old so, you know, there's still a long way to go to compete with a lot of the more major and mature projects But there's a lot of things that you would already expect from a traditional identity management system that we have today We have Unix system integration through things like pam in an s switch, which was heavily inspired by triple sd But it has a slightly different model to help improve some other performance and reliability issues that triple sd is often encounters It has full working radius support So things like if you want to have vpn or wi-fi all still work natively And you don't need to do anything else exceptional out of box It also has an all that read on the gateway Which allows viewing a subset of attributes and a subset of authentication standards in order to allow legacy applications to help transition through to some of the more newer protocols But it also has many features that are only found in some of these newer identities as service providers we have HGP first and a REST based api rather than any other protocol We have support for a lot of security features including things like password bad listing and ZX CVBN as a password quality checker We have a working recycle bin so that we can recover when people make mistakes And realistically it also just has a lot of things to make admin lives easier very simple configuration And a lot of very subtle design details in the protocols and how it's configured to really try to make it a lot Easier for an administrator to use and there's a lot more still come So one of the things that we've done for example is that the entire system is based on concurrent data structures And we even invented an entirely new transactional caching system just to be able to Use it so that we don't have to rely on other elements And because of this fully transactional design, which was inspired heavily by ZFS the file system in fact We're already close to the performance of 389 directory server without spending a lot of time optimizing So on a four core machine with a gig of ram on SSD We were able to perform 40 000 searches per second And 4 000 authentications per second already And that's the kind of numbers of operations that you would need to support say a large university's authentication requirements And this is without a lot of effort to actually do this and it's just because of the kind of designs We have where we do not have any blocking or concurrency issues due to the use of our concurrent data structures We also have things that are found in now the directory system For example We are we have a query optimizer and we plan to add a statistical analysis tooling To help hint and develop this optimizer further and in fact I've been speaking with a statistician from university Queensland about how to do this in the most effective way recently And it's even now up as a google summer of code project that is being offered through suzer We're planning to go a lot further with things like ssh management Today we already have ssh key management as you would expect to find in something like free IPA where you can upload your ssh public key and the Unix resolver will retrieve that key and distribute it onto all of the host so that you can then log into your machines But after being inspired by jeremy stotz linux conf australia 2020 talk called zero trust ssh And I highly advise you to watch that talk is absolutely unbelievable and very entertaining and very good content really watch it But after watching that talk about ssh ca's This is something that we want to add is for ephemeral host limited command limited privilege based keys being able to be issued by the cunny dm infrastructure And this is the kind of feature that you really only see in cloud identity and access management tooling these days But also devices have always been part of authentication And this is one of the philosophies that we've brought into this project And you know your devices are not something you separate from you know consider how Personal a device like your phone is and your own laptop is probably something that only you ever use that laptop is an extension of you That device is part of your authentication A lot of existing identity management is really based around this idea that the device is not it's only a username and password to prove the identity Whereas we decided that devices were part of this from day one And because of that we've put in a lot of effort in how we designed things to make sure that this was going to be viable And in fact, we even created the web or thin rust library because we there was no such library before that point in time So I had to write the whole thing myself It already supports touch id windows. Hello, you be keys and more and the support for that has Uh, actually just been wrapped up the this morning. Thanks to um The help from a contributor in the netherlands who has been doing some amazing work in in code review So that will be out in the next release But we also do things like our radius support See radius only really supports ms chat b2 now The reason for this is to do with these say phones and clients where they only will try to offer ms chat b2 So it really necessitates. We have to offer it in radius And what this means is that to negotiate that with radius. We need either ntlm passwords Or plain text and ntlm hashes are effectively md4. And so they're basically plain text anyway And of course a lot of traditional idm because it's a user to password one to one ratio The password that is often used is also the password that is used on the radius infrastructure and this weakens things in two ways The first is that it means that the password must now be stored in either ntlm or in plain text Which means that effectively the password can always be cracked and brute forced if the database was dumped Or an access control goes wrong and you can get access to those hashes But another really common issue is actually usability It's very common in an enterprise And I saw this a lot at the university of adelaide was that when a person would change their password They would forget to update on all of their devices And so they would have forgotten their laptop back in their office And then it would keep trying to join the wi-fi with their old password and cause their account to be locked out And so that would have to run around trying to find all of their devices and work out Which one was the the culprit causing their account to be locked out and where they needed to update that Whereas because we we said that devices are part of your authentication We made radius passwords separate from your user account. They're in fact generated server side And they're stored plain text, which means that you can retrieve them arbitrarily for enrolling new devices and so Because this is not related to your main account password and that password has only the ability to authenticate to radius If that radius password is compromised The damage radius is very small But it also means that in that case when you do say you need to change your main account password You're not at risk of then having your account locked out So by improving this so that devices can just store that radius password And that gives network level authentication compared to your main account, which is a separate level of authentication We've helped to improve the user experience There's also a lot of really interesting design details in in how we've approached things like unix integration So a traditional unix system when we have home directories, you know, you might see either an nfs or a SIF server exporting home directories with something like from say slash of all homes name And then it is auto-mounted onto the client at their home directory at slash home slash name So in this example, I'm mounting my home directory at slash home w-brown But a really common example of something that goes wrong in Many businesses is people want to change their names And unless you also have a task in your identity stack that is going to go and update the nfs server to make sure that the directories have the correct names The next time I go to log in after changing my name I'm unlikely to be able to log in because my home directory will be missing And in fact, this is really common in businesses that people get told. Oh, if you ever change your name It's a hugely long arduous process. You shouldn't change unless you really have to Or people who do change their names end up in a situation with their account is broken for the rest of time while they're at that company And I don't think that's okay. People should be able to change their names and people do change their names for a lot of reasons So how can we make this work? So in cunny dm, we actually enforce that your Home directory is based on your uuid of your account and our unix modules What they do is they actually generate this directory and create the relevant sim links to give a friendly name So what this means is that the auto mount tool will auto mount based on your uuid And then you will then have a sim link for that so that you can have a much nicer way of navigating to your home If you ever change your username the next time you log in all we have to do is update that sim link and we're good to go And so You know, this is the kind of thing where we're encouraging people to want to use those uuids the primary keys And we want to make it so that people can change their names and identities at any point in time within our platform And part of the reason we go to this effort is that as a project something that which is Which we have done from the very start is we actually added a statement on ethics and rights And to read from this because it may be too small for you on your screens It says cunny dm is a project that will store process and present people's personal data This means we have a responsibility to respect the data of all people who could be using our system Many who interact indirectly or do not have a choice in this platform And what I mean by do not have a choice in this platform is for example When you go and join a workplace You don't get to tell that workplace what idm they're running you have to deal with whatever it is They're running and if that happens to be Joe's Joe's idm and it doesn't let you change your name and I ask you to have three middle names Well, that's that but this you would not be getting respected at that point And that's what we mean is that there's a lot of people who do not have that voice Within a business within an organization to raise these issues about their identity management system And we'll end up having a poor experience within the workplace if they ever do for example change their name And I don't think that's okay by having this statement on ethics and rights It means that as a project we have a responsibility that if we make a mistake We must fix it. We must make difficult engineering decisions to resolve that mistake because someone is now being treated poorly And and as a result as a project we've entered up with from the from day one a lot of Infrastructure and tooling internal of the project for data migrations Manipulations and on upgrade changes because the question is not if I make a mistake The question is when and I know that that day will come where I've made a mistake And we are going to have to do this But that is our responsibility to make difficult engineering decisions and to make things that can support the complexity and richness of human culture and social needs And so I hope that this has been like a really interesting glimpse into my life and authentication and the projects that I've worked on And kind of a quick version of the journey of how I got here And to me like I hope that if if you take one thing from this at the very least It's that idm is really exciting. You know it underpins so much of what we do in a day Every day you log into your laptop You'll log into websites that you know to buy books online. You'll log into a corporate Infrastructure every single one of us have our identities stored in an identity management platform somewhere. It affects all of us every day And so as a result idm should be able to represent all of us and it should be accessible to all of us And that's something that I'm very passionate for and and really want to improve And so that's why I started this project and it's it's really grown You know, it's now become six sub projects with seven major contributors from all around the world with more than 350 commits since sept 20 september 2019 when it was first open sourced And there's been so many other non-code contributions which have been just as valuable to to the um to the progress we've made And the sub projects for example are things like the web or then library for rust a web or then soft token concurrent data structures library the LDAP bindings for rust And now I forgot what the last one is. Oh, I compressed indexing data structure library And and that's the thing that's really cool about identity management is that it spans so many areas It spans all the way from human psychology and you know user interfaces and user experience design to computer security and system hardening and and cryptographic elements to statistics and mathematics to You know low level system concurrency and high performance computing and I think that it's such an exciting area to work in because It has so many areas for both learning across a broad range, but also the impact is so high It really does affect all of us And so I hope that you have found this interesting and and I hope that at the very least You find IDM a little bit more exciting as well. So thank you very much


Dorian, Jack and Cam just talked to us about the 3-1 shooting and how that kind of was the big effect of this game. What did you see from the way that they were able to get the looks and the amount of looks that they were able to get? A fast-paced team, they were in the conference finals last year, so they were one of the best teams in the league. But we got a center who can pass the ball. When you get the ball, a bunch of guys get to moving. They made a bunch of tough shots, but we got to do a better job of running guys off the line. You guys were able to kind of cut into that lead and go on runs at certain points of the game. What was working well at that moment, and then how were the Kings able to kind of stop that momentum? I was getting stops and getting out of the run, but when they're making shots, we got to set up and run to play, and then they did good on half court defense. We just got to do a better job. We can give up 20, 23 threes and win the game. It's going to be hard, especially when we, we ain't even getting off that many threes. It seemed like the threes came at tough times. You guys cut down to six, I think a lot. I think one of those guys, he said three, he goes back up to nine in the fourth quarter. Was it just a matter of the threes just came at the wrong times as much as you guys giving them up? Yeah, you know, it was bad because they put us in a lot of rotations, and we just got to make that second and third rotation at a high level consistently. And I feel like we would have did a better job, but, you know, there was a better team tonight. The second part of that is, you know, you guys not getting off a lot of threes. Yeah, same thing. I don't want to say settling for many, but kind of maybe getting lowered into them. Right. How big of an emphasis is that going forward the rest of the season? Maybe get them credit to them.  They wanted us to shoot.  You know, we, that's one of our advantages.  They just was the better team of, you know, getting off them threes and making them.


So, the idea of fluorescence is subtly different from the idea of phosphorescence, which is a different type of luminescence phenomenon. Phosphorescence is what happens, for example, in a consumer product, you're familiar with that if you have something that glows in the dark, maybe it'll glow in the dark t-shirt or glow in the dark sticker or something like that, something that you have to expose to the light and charge it up and then it will glow for a while if you're in a dark room. We know that's not the same as fluorescence because a fluorescent object, as soon as you turn off the light source, as soon as you turn off, for example, the ultraviolet light that's causing your socks to glow white under a black light, as soon as you turn that off, the fluorescence stops. Phosphorescence is different because you charge it up and it holds onto that energy and lets the emission take place over a longer period of time. So it turns out we can also understand what's going on in phosphorescence with a combination of the Frank-Condon effect and the idea of the electronic selection rules for electronic transitions. So if we have an electronic state with a bunch of different vibrational levels within that energy well, some other excited electronic states, and here I've drawn both an s equals zero singlet state, an excited electronic singlet state, but also an excited electronic triplet state, one with spin one. So the selection rules tell us that when we excite a molecule from this ground electronic state, it has to go to the electronic state with the same spin, not to the one with the different spin. So if we consider what happens when we take a molecule on the ground state and excite it, that vibrational, that vertical transition, Frank-Condon transition, the vertical transition will result in a vibrational excited state in this upper electronic manifold. So perhaps to the state right here, it will not land in the triplet state because that violates the selection rules. So if we excite the molecule, we know from talking about fluorescence that the next thing that's going to happen is vibrational relaxation because that step is very fast. We'll give you some time scales, vibrational relaxation. That happens on the time scale of an individual bond vibration. The frequency of a bond vibration is such that the period of that motion is in the tens of femtoseconds. So roughly every few tens of femtoseconds, this molecule will fall down to a lower vibrational state. So that happens on a time scale of something like 10 to the minus 14th seconds, roughly speaking. So very, very quickly. If this were to continue all the way down to the bottom of the well and the molecule falls from the ground vibrational state of the excited electronic state down to some vibrationally excited state down below, that would be the process we've talked about already as fluorescence. I'll put that in parentheses down here because that's not the main thing we're talking about right now. That process, the fluorescence process, that happens on time scales of nanoseconds or so. So vibrational relaxation much faster, many orders of magnitude faster than fluorescence. Several bond vibrational lifetimes later, the molecule sitting in the ground vibrational state, it then sits around for maybe 10,000 vibrations of the molecule until it decides to electronically relax and then do more vibrational relaxation. That would be the fluorescence process. However, if there's a nearby single state, a spin forbidden state that it couldn't be excited into, it just may happen that some of these vibrational excited states in the triplet electronic state may happen to line up pretty well with the vibrational excited states in the singlet well that we've excited the molecule into. And if that's the case, so for this molecule, let's say this energy level and this energy level line up in energy pretty well, then instead of vibrational relaxing from this singlet vibrational excited state further down, it may undergo what's called intersystem crossing. So let's label these. One was excitation, two was vibrational relaxation. Instead of vibrational relaxing all the way down to the ground vibrational state, it may hop over onto the singlet manifold. So that step is called intersystem crossing. And that's a key step in this phosphorescence process. That can be fast or can be slow. It depends largely on the overlap between these energy levels. If there's a good overlap between them or not, it can happen very quickly. It can happen on the peak a second time scale or it can happen quite slowly if there's not as good an overlap. So entirely depends on the molecules we're talking about how likely that intersystem crossing is. But it's generally more rare than fluorescence. And it's also crucial to notice that that is a non-radiative process, meaning it does not involve electromagnetic radiation, it doesn't involve light. You might have already been saying, how can I get from the singlet state to the triplet state? That's supposed to be forbidden. And it is forbidden to make that spin zero to spin one transition if we're making the transition involved with using light. We can't make the molecule absorb light or emit light in order to change from the singlet state to the triplet state. But the molecule can decide through other means, through collisions, for example, to exchange energy with another molecule through a collision. That is a non-radiative process that doesn't involve light so it doesn't need to obey those same selection rules. So that process that doesn't involve electromagnetic radiation can occur getting you from the singlet onto the triplet state. And then once you're in this blue triplet electronic surface, the molecule can then vibrationally relax in the triplet surface, landing itself at this ground vibrational state in the electronically excited triplet state. That's if I call those steps after the intersystem crossing more vibrational relaxation. So vibrational relaxation happens in step four. We very rapidly after a few bond vibrations ended up in the ground vibrational state up here. And now what does the molecule do? It looks like it's stuck. There's no way to decrease its energy other than going down to this singlet electronic state but it can't get there by emitting light because that would violate the selection rules. What it does is it hangs out there up in the ground vibrational state of this triplet electronic state because it can't do anything else except for the fact that those selection rules, just like they were for the harmonic oscillator and rigid rotor, they're not perfect. The forbidden transitions are not 100% forbidden. The selection rules aren't obeyed all the time. So the molecule isn't very likely to emit light and fall down from the triplet state to the singlet state. It can happen rarely. It does happen very infrequently. So in fact that is what happens eventually is the molecule will make a vertical transition from this vibrational ground state of the triplet to an electronically excited state of the singlet below it. That step is the step that we call phosphorescence. That because it's very slow, typically doesn't happen any faster than milliseconds depending on the molecule and may be more strictly forbidden in some molecules than others. So it might happen as slow as many tens or hundreds or thousands of seconds as you know from using glow in the dark stickers or stars that you put on your bedroom wall as a child or whatever, you charge those up with light and then they glow for perhaps the next 15 minutes until the light fades. So that phosphorescence process is the slow release of light. It's slow because it's a spin forbidden process. Other than that it's very much like fluorescence. Excite the molecule with a high energy photon. Some vibrational relaxation occurs. Then emission occurs that we call phosphorescence. It's phosphorescence only in the circumstance where we've had this non-radiative intersystem crossing that gets the molecule stuck to where its only option is this spin forbidden transition which will happen very slowly. And then of course after that it will very rapidly vibrationally relax down to the true vibrational ground state. So step six, that vibrational relaxation step again occurs very rapidly. So the difference between fluorescence and phosphorescence is phosphorescence involves this spin forbidden emission but in both cases the emitted photon is much or at least somewhat lower in energy, lower in frequency, longer in wavelength than the incident photon that caused the excitation process.


From Palo Alto, California, it's theCUBE covering VMware Women Transforming Technology 2019. Brought to you by VMware. Hi, Lisa Martin on the ground with theCUBE at the fourth annual Women Transforming Technology event. VMware, WT squared one of my favorite events and I'm joined by two PhDs, both from, I'm going to say this one time, the Stanford VMware Women's Leadership Innovation Lab. We've got Shannon Gill-Martin, Senior Research Scholar. Hi, Shannon. Hi. Great to have you here. Great to have you. We've got Caroline Simard, Managing Director of the Lab. Ladies, thank you so much for joining. Thank you, it's a pleasure to be here. So this event we were talking about before we started that you walk into the keynote, opening keynote, which of itself was electric, but the energy that comes into the room with, VMware was telling me a little while ago, about 1,500 live attendees, not even including those that are watching the live stream, the energy comes into the room and then of course this morning with Joy, I'm going to try to say her name, Bola Mweeney, Bola Mweeney, the poet of Co, the MIT researcher who started really sharing with us the significant biases in AI that the energy, if it could even be down that more, I can't even imagine it. So I can imagine the panel that you guys were on this morning was quite charged. The panel title was I found interesting, inclusive animators designing for change. So Caroline, talk to us about designing for change. You look at through a design lens, what does that mean? Yeah, so I think what kind of framed the morning and then Shannon was the moderator, so I want, she picked the topic of design, but I think what Joy really showed is the power that is possible to realize when women and women of color and people from different dimensions of identity are included in creating technology and how much better technology will be for society, if all voices are included. And I would also say that some of her comments also make it clear that it is fundamentally irresponsible not to have diversity at the table in designing the technology of tomorrow. The consequences on different kinds of people and different populations are significant. And so this is why Shannon really picked this idea of as engineers and designers and creators of this technology, how do you keep in mind the responsibility that you have? So yeah, talk to us more about the design and why that is so critical. And the way we positioned it for our panelists, it was titled inclusive innovators designing for change. And we were going to explore how meaningful change towards greater diversity and equity is realized in engineering cultures and in the very technology that's being created. More specifically though, how do individuals and communities of people design for change in their technical environments even when this environment may not be initially very receptive to new ways of interacting, to new ways of thinking, to new ways of achieving. And so the whole panel was premised on this idea of people are designers of change in their environments. How does that happen? How do people interface with barriers to those design processes? And what is advice for the younger generation as they look ahead to their pathways as designers for change? Yeah, cause change in any context of life is hard. Yup. Right, it's an uphill battle. But designing for that change, I'm curious what some of the commentary was from the panelists about when you're encountering, whether it's a company or a leadership group within a company that, to your point, and it isn't receptive, what were some of the comments or stories of how that was changed over time to be contraceptive and understand the massive potential that that change can have. I mean, we look at numbers like companies with women on the leadership committees are far more profitable. So what were some of those from I don't get it to, oh my gosh, why are we doing this sooner? And we had this amazing range of perspectives represented on the panel. So we had VMware's chief technology officer, Ray O'Farrell. And he was really talking about, from a leader perspective, a key idea here when there are barriers and blocks and inertia is to open things up and really start listening. And this is a skill and a talent and a group practice that is so little done, so infrequently done, so poorly done sometimes, but really key in the face of those barriers is to actually say, instead of shutting down, open up and start listening to what's happening. Another one of our panelists, Susan Fowler, who is the Time Magazine person of the year as one of the silence breakers in 2017, she was really talking about how you expect the steps. You're going to need to go through a lot of steps to make your voice heard. And ultimately for Susan, she made the decision to go public with what she had encountered and was facing and grappling with and struggling as were many of her colleagues. But she was really talking about the step-by-step process that's involved in a large organization. When you're hitting blocks, you've just got to keep on fighting that good fight and you also need to be doing your very best work at the same time. It's a high pressure situation. Absolutely, so. Absolutely, we also heard from Lisa Gelater, who's the CEO of TechWittable, an organization that's creating kind of a safe place for change agents to share their stories when they're encountering these blocks and this kind of unfair treatment. And she talked about also the need to do your best work but also the critical importance of community in being very more resilient as you're trying to drive change in your environment. And this is the kind of community that is being built today with this event. Is really paying attention, especially for her as a black woman engineer being the only one constantly at the table fighting you know for change. It's been something that she has realized she needs to be a lot of attention to so that she can be much more resilient as a leader for long-term change. Another topic that I think in terms of generating change that really came through both in the panel and during this morning's keynote in that we pay a lot of attention to at the lab is to really highlight bias, is to really diagnose what is really happening in organizations or in AI as we heard from Joy this morning. So a lot of people genuinely aspire to treat others fairly, right? But they don't realize that their workplaces are so far from being a meritocracy that there's these structural inequalities that are really embedded in all of the ways that people are working. And so when you're able to show people exactly how it shows up in their company, right? The promotion rates for women of color, for example, being lower than for other people. The exact points of data that they need to see that they're not treating people the same way and creating the same kind of pathways for impact for different kinds of people, then that has a lot of power to drive change because a lot of people then will be very motivated to say, okay, I see this is happening in my org every day. Now I can design a different approach, right? How do I redesign the way I'm working today in my units and take action? You should actually have the data. It's such a dichotomy at times that we're surrounded by data, especially in Silicon Valley. But one of the things that shocked me what Joy showed this morning is when she put on blast IBM, Microsoft, and what was at Face++, about looking at all of the built-in biases to facial recognition. But one of the things that really also I thought was interesting was that she went and showed this to these companies who responded and those numbers are actually improving. And then when she said, hey, Amazon. So the fact that even that one person is able to show, look at some of the massive problems that you're training these models to have, they need to be able to see that. So the highlight, I think the highlight, the bias, and the communicate, communicate, communicate, and listen are three critical elements. Exactly, exactly. One additional part of both Joy's presentation and Lisa's comments too, really spoke to action needing to take an intersectional approach. So Joy's data breaks it down by race and gender and all of the sudden you see completely different trends. Lisa spoke to that as well in her comments. Key to this designing for change process is really wearing the hat of someone who is looking through the world with an intersectional lens and understanding how different axes operate together uniquely for different groups. And that's when you see these biases being highlighted really in full force and full relief. So both of these points and these presentations really brought that up. Yeah, and the intersectionality that Joy talked about was even evident, and you could parallel it to why it was important to look at all these different sources of facial recognition data, how disparate some of them were. Right, I know, without that lens, you couldn't see all of that variation even across the different providers. Yeah, and she talked to about how everything is classified in a binary way, right, in terms of gender identity and where the data doesn't even see people who are non-binary. Exactly. So it's like, again. That's still a huge omission. Exactly, that we have a lot of more work to do to have data that truly captures all the dimensions we're interested in. It does, it does. Long way to go, but the fact that it's being highlighted and opportunities like not just what VMware does with the lab as well. So let's talk a little bit about the lab. It kind of got it started in 2013 when then Stanford president, Dr. John Hennessy, provided some funding. I had the opportunity to interview him last week, lovely man. Last year, VMware did a big endowment of about 15 million. What's going on? Caroline, we'll start with you. What's going on at the lab? What are you guys studying now? What are some of the breakthroughs that have been uncovered in the last 12 months? Yeah, so a big part of our lab's work, and since we began this work, has been to really bridge the gap between research and practice. And so a lot of why there's little progress being made is because you have a lot of research happening in the academy, in the ivory tower if you will, and then you have a lot of innovative practices being tested, but without necessarily the research foundation and the research frameworks to truly evaluate it. And so our work has been to really bridge those two things together and explore these boundaries so we can have more innovative research, but also more evidence-based practices come in. And since the VMware endowment, we've been able to really grow in our aspirations and the kind of data and the kind of research questions that we can really ask. One of them is this focus on a more intersectional, long-term study of really documenting the experience of women of color and really understanding the nature of their career pathways across racial dimensions and really highlighting a lot more of qualitative, deep insight to generate their stories and really centering their experience. The other one is very investing in large-scale data sets that capture gender, race, age, and other identity dimensions and look at their long-term career trajectories this is actually work that Shannon is leading. So we have an exciting data set where we have people through five years and we see what happens to them, who gets promoted, who doesn't, who gets top talent designation, who gets a salary increase, who and then we were excitingly looking at social network data, so who's meeting with who and then what kind of connections do you need to be able to advance in your career and are there some systematic inequalities there, right? And a big part of our work then is to design these interventions where we work with companies to test what we call a small wins approach. It always starts with diagnosis. Here's what's going on in your very specific workplace in your culture and then we co-design with leaders and managers. It doesn't work for us or HR or anybody to say, go do this or you should do this. It's really about really engaging managers who want to do better in coming up with the design fix, if you will, that they can come up with informed by our research, so it's a co-design process and then we roll it out and we test the outcomes pre and post. So we're doing a lot more work now to disseminate what we're learning through these interventions so that other organizations can implement this very similar approach. First, I love that it's called an intervention. Yeah. I think that's incredibly appropriate. Yeah, yes. Second, are you seeing an uptick in the last year of companies, obviously VMware and Dell being two great companies that are very focused on not just women in technology, but I loved how Joy said today, it's women and people of color are the underrepresented majority. Are you seeing an uptick of companies willing to accept the intervention and collaborate with you to really design from within for that change? Yes, absolutely. And I would say that in this industry, people are comfortable with piloting things and doing a little R&D experiment, right? So it's also a culturally appropriate way of thinking, okay, what if we tried this and see what happens? And so I see a lot of energy from organizations and based on what you were talking about, it's also, I think companies are aware that it's the overlapping dimensions of identity increasingly aware are within their own walls, but then in their customer, in their consumer base, right? So how is their product affecting different kinds of people? Is there, are their customers experiencing bias from the very platforms that they build? And so I think that's also a very powerful entryway into this intersectional conversation because the product is so foundational to the business of the company. It is especially event after event that we cover on theCUBE, customer experience in any industry is critical because as consumers of whatever it is, we have so much choice. Shannon, last question for you. One of the things that always interests me is the attrition rate being so high in technology. I'm curious what you guys are finding in the lab with mentioning following women on there, maybe their first five years, are you seeing any kind of glaringly obvious challenges that are driving that attrition? Is it, it's got to be more than the motherhood panels. Right, right, right. We're looking at a range of what we call pathway outcomes really for young people just starting out in their very first, second jobs, where they are several years later, we're looking at odds of promotion, odds of leaving the company, odds of moving in making a lateral move into some other kind of line of business, maybe taking them out of let's say a technical role and moving them into a non-technical role. Each and every one of those critical moments is worthy of deeper study for us. And what we're doing really is taking this intersectional lens and understanding how do those moments vary for different groups of women. It's not enough just to say all women have some X percentage of an attrition rate. We're trying to understand how attrition really varies by subgroups of women and how that varies over time with what interactions that precede it and then follow. One of the themes that we've been really looking at in, for instance, attrition stories is the assignments. Which projects, what kinds of assignments are people getting in their first few years on the job? How are some of those make or break with what net consequence for women, men from different racial ethnic backgrounds, different ages, different countries and understanding really the role of those assignments in someone's longer-term career pathway, just how important they are and what kinds of interventions we can design to really elevate access to the best assignments for everyone, basically. Right, so. Gosh, you guys, this is so fascinating and so inspiring what you're doing at the lab. I wish we had more time, but you'll have to come back next year. Exactly. Absolutely, we will. Thank you so much. Thank you so much, Lisa. Thank you. Thank you. Thank you. Thank you so much. For The Cube, I'm Lisa Martin on the ground at WT Squared. Thanks for watching.


Egas Fiontek vs. Jessica Pagula is the final of the WTA finals of 2023 and both players have been super impressive to get to the final. Pagula entered the tournament as the number five seed and would take on Rebecca in the first group stage match and after going down early in the match she came back to win 7-5-6-2. In her second match she would take on Zachary who'd only just gotten into the finals because of Mukova withdrawing and again super impressive getting through in straights 6-3-6-2. In her final group stage match she would take on Sabalenka the world number one and again in tough conditions she would get through in straights 6-4-6-3 to top the group. In the semi-finals Pagula would take on the number three seed Goff who had just scraped through at the very end to get to this semi-final and in very harsh conditions Pagula stood strong getting through in straights 6-2-6-1 to advance to the final. Fiontek entered the tournament as the number two seed and would take on Vondrusova in her first match and after a close first set would get through in straights 7-6-6 love. In her second match she'd take on Coco Goff and after a very good first set she'd fight to win in the second 6-love 7-5. In her final match she'd take on Jabur in very difficult conditions but there's no problem for Fiontek getting through in straights 6-1-6-2 to top her group. In the semi-finals Fiontek would take on the number one Sabalenka a rematch of what we saw this time last year in the semi-final stage but the result was totally different with Fiontek demolishing Sabalenka 6-3-6-2 to advance to the final. These two were played eight times before with Fiontek leading the head to head 5-3 however Pagula has won two of their last three matches including a semi-final in Montreal where Pagula went on to win the title after beating Fiontek in a three setter. If Pagula is going to win this one she needs to be aggressive she's been so solid this week probably the most solid player of the entire tournament in such rough conditions she needs to keep being solid but also be aggressive because we know how good defense Fiontek has as well. If Fiontek is going to win this one she needs to push Pagula around and maybe come to the net a little bit as well and mix it up because the last couple of times they've played Pagula is starting to understand how to beat Fiontek so Fiontek might have to do some element of surprise and come to the net do something a little different to get the win. What a great match up the two players that haven't lost a match they haven't lost a set for the entire week it's the perfect final but I think Fiontek is going to get it she's got to get it to get to world number one as well so there's extra stakes to this one for Igor Fiontek let me know down in the comments below who is going to win the final match of the season


Okay. So we're live. We've got a introductory slide, but I'm not seeing anything on this side.  I just checked. Yeah. Yep, we're live. And I'm, all right, well, I'm not sure. It just happened to me yesterday when I was doing a drive run with William. It doesn't give me the option to start it like it should. But I'm seeing it on YouTube. Everything you're doing. You are. Okay. All right. Well, as long as you're seeing it in YouTube, then we're good. I'm not seeing the chat in YouTube though, so you will have to... I see the chat. Okay. So as long as you can see the chat in YouTube, then that is awesome. Okay. So we're just waiting for, we'll wait for a couple of minutes so people can jump on. And Kim, is my screen big enough? Yes. All right. We'll give it one more minute for a few more people to join, and then I'll get started here. This is part two of the security sales training. Part one was last week. We went over market and competitive overview. And today, we are going to focus on personas, segments, and sales place. Okay. I'm going to go ahead and get started here. As I mentioned last week, we went over kind of the overall landscape. Some of the progress in the security industry and some viewpoints on application security. We touched on competitive scope in terms of how much of the application security market GitLab covers versus some of the more point-specific solutions. And we went over the abroad value proposition. Now, what I want to do this week is drill down and look a little bit more specifically in the security space. So, we're going to start here with the personas. So, there's three basic personas that you need to have on your radar. There's a security specialist, there's the developer, which we would traditionally sell to, and there's security leadership. And they each care about a little bit different things. So, obviously, you've been selling to the developer. They may or may not have a focus on, they probably don't have a focus on security, but they may or may not have kind of an interest in security. Let's see. Larry says, am I joining the sales training call? Kim, if you could look at Slack and see if some folks are having a problem getting in, that would be helpful. And I'm going to push forward. So, the security specialist, the developer may or may not care about security. They care in so far as it's a flaw and they need to have code that works and accomplishes the business needs. But they usually don't understand some of the details about security vulnerabilities and they don't really care at all about across projects. The security specialist, on the other hand, they're going to want to look across projects and understand, are there patterns in the vulnerabilities that are being surfaced? Are we continuously creating the same kind of vulnerabilities because then they can help educate folks on how to avoid that? They are going to care about the risk involved. So, looking at not just the vulnerability, but what kind of impact that vulnerability could have to the organization. And then the security director could be a CISO, Chief Information Security Officer, could be just a director, even manager level in some instances. They're going to have kind of a longer term view and they really care about the risk more than anything and how can they manage the risk of the organization with application security vulnerabilities being one part of that overall equation. So, if we look at the segments themselves and those personas play into the segments, I would characterize three segments and we're going to cover these here. The first is someone that has a very sophisticated application security program. The second would be companies that have security programs, but maybe not so sophisticated in application securities. And then kind of lastly, those that are really just focused on compliance and doing the minimal that they have to meet to check the box and be done. Okay. Somebody needs to mute, please. So, let's start with the first one, the sophisticated application security program. So, these would typically be the larger enterprises. They probably have a hefty investment in application security. Now, remember from last week we talked about historically security started with protecting the perimeter and infrastructure security, but now that infrastructure is diminishing and so the focus is changing to the application. Most of the significant breaches have come through the application layer and so there's now this renewed or a new found focus on application security. Now, this segment though that have sophisticated application security programs, they've already recognized that so they've already been in that space. They probably have application security specialists that tend to come from more of a developer background, less of a network background. And they may have investments in applications like Veracode or Fortify or IBM AppScan or some of these more expensive SAST and DAST focused tools. And then they probably are also doing some sophisticated threat hunting. Usually it's the financial services industry or healthcare providers, people that are enterprises that are highly regulated and that also really use their applications to their competitive advantage. Their biggest challenges are going to be time to market because their applications are their competitive advantage. They want to be fast, they want to create new applications and improved applications as fast as they can. They're probably already way down the path on DevOps and they're balancing speed with security. So the value proposition for these more sophisticated application security based folks is really not, it's less about head to head, SAST and DAST capabilities because they've already been doing that. It's really more about having that integration across the development life cycle. And so their biggest challenge really is the cost and the speed. So if they are scanning every application, it's going to get very costly in the more traditional application security tool models, pricing models. So they're probably not able to scan everything and they're certainly not able to scan every commit and merge request. So what GitLab offers, I'm going to kind of jump here just a little bit over to the sales play. So the sales play here for this mature application security customer is we have one integrated application. This goes back to our basic premise which is, let me find it here, which is on our main about GitLab page. And this is security is baked in, it's part of the software development life cycle. You don't have to think about it as a separate step, as a separate tool that requires integration. There's other reasons in addition to security to buy up to ultimate. Some of them are listed here, the Kubernetes integration, there's lots of additional reasons in addition to security to buy up to ultimate. But from a security standpoint, this is a way that you can scan every piece of code. It also can get your dev and your application security professionals all on the same page. So they're looking at a single point of truth. They're just a truly integrated process as opposed to a separate distinct silo. So that's an important piece. We'll get to handling objectives here, objections here in a minute. But that's the approach that I would use for those folks that have a mature application security program. Now let's look at the people that have, they have security programs, they understand security is important, but they may have followed a little bit more traditional approach. So maybe they've been focused more on infrastructure security and less on application security. This is really a sweet spot for us because, and I would jump on those as your highest priority, because you want to catch them before they go down the path of $100,000 million investments in these more siloed application security tools. So they may understand that they need a tool. They may be reluctant to spend that kind of money. And if we can come in and do their static and dynamic application security testing as, you know, again, integrated as part of their software development life cycle without substantial incremental cost, then it's a, you know, it's a win-win. They, the way that you can identify them is they may have just started down the DevOps path. They may be a little bit less mature there. They probably don't have a dedicated application security department or professional. They probably have someone as a security analyst that's wearing many hats and trying to do application side of things as well that may also have come more from a network-based background. They may be a little bit more focused on compliance. You know, maybe they've stretched beyond compliance and realized that that's kind of a low bar, but they're just getting started there. The challenges that they have, their biggest challenge is that they are resource constrained. So they don't have a, you know, dedicated app set person. It's very difficult to, for them to expand and hire security people. And so anything that you can do to help just bake it in as part of their normal development process is really going to be a help to them. And in addition, the fact that you can do it without this big incremental ramp in tools and integration and cost is really going to resonate with them. And so this, the ROI page that we have is where I would recommend that you have a conversation. And here we've got a comparison between GitLab, GitHub and Atlassian. This is meant for kind of illustrative purposes and it shows here, you know, GitLab covers all of these things plus security, whereas if you're doing GitHub or you're doing Atlassian, you're going to have to invest in some SAST and DAS tools and those can be quite costly. So this bottom line here can really be painful and really make a point. Another page in the handbook that I would recommend that you use is the difference in scope of what we do versus some of these other siloed point products. And some of them may have started using SonarCube and WhiteSource and if you've come at it from the gymnasium dependency scanning approach, then that's probably who you're going to run into because SonarCube and WhiteSource, they kind of live in that dependency scanning space and BlackDuck came from that space as well. So you probably run into those guys there where you would run in to Fortify and AppScan and Veracode is around static and dynamic security testing and the point here is that we do all of those so you can replace all of those tools with ours. Now we're not yet quite as robust but we're getting there. So in terms of a security dashboard, we just launched our first dashboard and that dashboard is really intended to focus on that security persona. So back here on these personas, that security specialist is really going to care about the dashboard and the reason why is because it looks across what an individual developer may be working on. The developer is going to care about the security reports that come out and I'm going to give you just kind of a sneak peek of those as well. But this scope can really make a difference when you're talking to someone who hasn't started down the path of the big application security investments. So we come back here to the sales plays. Another point is they can grow with us. So come on board with us with Ultimate, get started on rather than starting down a siloed approach, get started with an integrated approach where all of those application security testing capabilities are built in, they're just part of what you do and grow with us. So we've got a great reputation for iterative improvements and as we continue to refine and expand that dashboard and those capabilities, you'll be right there with us. So let me just briefly mention the third type of company and that would be a much more opportunistic play. This is someone who really just cares about compliance. They're not interested in application security. They are barely interested in security, maybe only as far as meeting the compliance requirements that they have. Typically, this is a small company, maybe a startup. They just want to check the box and do what they have to do. They're very resource constrained and they typically lack security expertise because GitLab is integrated with their testing. If they, particularly for software companies that are startups, it can help you check the box. In fact, I should have put the link in here and I didn't. We have a new compliance page and I'm fleshing that out even deeper to get into more of the compliance aspects. But one of the common, lowest common denominators across all of the compliance requirements is that you need to scan your code. So if you are using GitLab to create your code and every code commit and every merge request is scanned, then that can help meet that kind of basic fundamental check box there. Now, Hayden wanted to make sure that I covered objections and I know we're running short on time here. So I'm going to kind of speed through these. What I would love is if you guys have additional objections, please add them to these notes here. I want to take these notes and add them to the handbook. But I wanted to make sure that I'm hitting everybody's objections that you're seeing the most. And I believe the two most common ones are, actually let's say three most common ones, would be that I have investments already. And at this point in today, I wouldn't say that we're ready to displace Fortify and Veracode where they already have those investments, but use GitLab to expand the footprint of what you are testing. So use GitLab to test every piece of code.  And then use the other more siloed products to do additional periodic scans.  Use this for the gate at the end and use GitLab all throughout. It's going to save you time. It's going to save you money. It's much less costly to find and repair the vulnerabilities early in the development lifecycle. One of the other objections is that we don't have as, we're not, our security dashboard is not as robust. But you know what? It's a minimum viable product, number, case number one. We are launching more and more robust capabilities and future releases. So get on board now and grow with us. Our roadmaps are public. You can see what we've got planned in 11, 2, 3, 4. You know, you can see what, how we are growing in the past. So get on board with us and join us now. And then the third, actually a couple more objections that we may, that you may face. One would be that we don't have remediation advice right there for the developer. What we do have though is, this is, there is a demo that's in the resources. You can actually see, you know, right here, that I've got 63 new vulnerabilities. And I've got two license management issues. I can jump in here and see what those vulnerabilities are. They are prioritized for you based on potential impact. And they can be changed right here. You can drill down and see a little bit more detail. Again, those capabilities will continue to get flushed out. But that would be, that would be one area to, that you may get some objections in. And then the last one that I think is the biggest one would be languages. There is a page here back in the resources for each one of these capabilities. I would encourage you to go to the user documentation and you'll see the languages that are covered right there. It changes all the time because we're continually adding languages. And I would say if there's a particular, if you've got a really big opportunity with, you know, a customer that's using JavaScript or something that we're not covering just yet, be sure and surface that because it can influence our roadmap and priorities in terms of what we do first. So that's how I would address those objections. Again, please add any others into this document that you come across. I've also started on some FAQs. Again, I will add those to the handbook, but I really, really want you to add what other kinds of questions that you get here. Resources. I mentioned last week we've got the security deck here. If you haven't checked out the deck, be sure that you do that. It's, there's a link here, but also in the handbook right under the pitch deck. We're building out more pages for dev sec ops, for application security testing as sort of an overview, kind of like a data sheet. Joel, I'm going to piggyback on some work that he's done. He's got a great video that he's put together. And you know, I would definitely take a look at that. I mentioned the ROI page. The security lexicon. Actually, under here there's also, and this is where you would also find the security deck. This describes the terms that we use because security has two parts to it. And you may run across this with your customers. There's how we secure GitLab as an application. And that's what Kathy Wang does as our, kind of our CISO. And that involves lots of things about what we do, two factor authentication and so forth, that we do to secure our application. And then there's how we help your customers create secure applications of their own. And that's through dynamic and static testing and all of the security testing capabilities that we have. So make sure that you are aware of those distinctions because you may need to drill down a little bit more when a customer first asks you about security to understand are they asking how we secure our application or how we can help them write secure applications. So I do want to leave just a couple of minutes for questions. And yes, we have three questions. Okay, great. The first one is Phil. Is it safe to say that by not using GitLab, and DAS and DAS and testing and all your code, they might be missing the vulnerabilities? Absolutely. And what's going to happen is, if you're not using any static or dynamic testing at all, you absolutely are at risk for missing those vulnerabilities. And there's a lot of statistics out there, 70 to 80% or more of some of the biggest breaches have been through the application layer. So you really, really, really want to make sure that you're doing that testing. Now where you do it is the next issue. Do you do it at the very end where it's really costly to find a vulnerability and now you have to decide, do I want to hold up production or do I want to go ahead and move it to production and take the risk of that vulnerability being exploited until I can go back and fix it? If you do it as part of your commits and your merge request, then you are, you're nipping it at the bud, right? You're getting it right at the beginning where it's much less costly. And you can do it for every piece of code and not worry about missing one. You have another question? Yes, the next question comes from Simon. What is the licensing model from the competitors? So there's a variety of licensing models. So some are by developer. Some are by the amount of code. There's also a difference between whether it's security as a service or if it's on-premise. Obviously, if you have on-premise, you've got a whole other host of costs that go with that in terms of infrastructure. But it, so it varies depending upon the vendor. But the siloed, the more traditional siloed vendors tend to cost way more than just GitLab Ultimate and all that they are doing is that one piece. Okay, and then finally, John wants to know if you can post the links in the sales channel. Links to... What you were, yeah, your presentation, I'm assuming. Yeah, sure, happy to. Okay. Are there any other questions? We've got a couple minutes. If you have any questions from the Google Hangout, feel free to come off mute and ask them yourself. Yeah, I have another question. So we typically, at least with the accounts that I've worked, they already have a solution in place like a SonarCube vericode or Coverty. Can you briefly explain the advantages of layering GitLab on top at the merger quest level and how that plays with the existing scanning tools that they're leveraging? Yeah, it comes down to the integration aspect. So the fact that we are one application, tightly integrated, there's not something else to maintain. The sales approach that I would use there would be our scope is much broader than a SonarCube. So use us for the pieces that SonarCube doesn't. And if you really like SonarCube, keep using it. And I'd be willing to bet money that at some point they'll realize the benefit that they're getting from that is not worth the cost of the integration and the added expense. We can play with it. That was another question that I've heard come up is, what if I already use XYZ? Great, keep using it. We've got APIs. We can integrate with those things too. But I do think that the footprint that we have is so much broader. If you can get in on any of those pieces of functionality that they're not currently covering or maybe a piece of functionality that's real costly, costing them a lot to cover, then that gives us a beachhead and eventually they'll understand that with one application there's just so many, so much upside to that. It removes some of the head-to-head feature functionality type of argument. Okay, any other questions? We're just about out of time. There are currently no other questions. Okay, well thanks everybody. Appreciate your participation. And be sure and please edit that document with FAQs and objections that you get. I want to make sure that I'm keeping current. Take care.