I'll go ahead and get started now. This is a multi-factor authentication for the cloud. My name is Dustin Kirkland. I'm the CTO at Gazang. I used to be self-conscious about this first slide, but it turns out many people haven't heard of Gazang yet, so I'll go ahead and leave with it. We're a small startup based in Austin, Texas. Venture funded. We're focused specifically on encryption and key management of what originally was for the cloud, but it turns out there's quite a bit of opportunity now around big data. The more data that there is out there, the more often we see private information that needs to be secured and keys managed for it. We have packaged solutions protecting Hadoop, Cassandra, MongoDB, OpenStack, a number of other different big data and cloud platforms. But for the most part, we can run on any Linux distribution. We are active in various open source communities. We're a new member of the Linux Foundation. And what we're ultimately doing, we're helping our customers secure their most sensitive data at RAS. So first of all, authentication. Before we talk about multi-factor authentication, let's talk about authentication. It's most basic. It's really the act of confirming the identity of purported by a person, or in software terms, often a program, by using something that it has, knows, is, or does. From a has perspective, we're all familiar with showing our ID or our passport at the airport or at the DMV. That's something that you have. You have this credential that supposedly there's only one of, that it's hard to fake. It was issued by a trusted authority. From a software perspective, that might be a token or a certificate, a private certificate. Something that someone or something knows is the traditional passphrase or pen or the pattern used to swipe on your phone. There's two other forms of authentication that's often used. Something that someone is or does. I'm not gonna talk about those here, really. That's not very cloudy. It's very difficult for a program to simulate or have a fingerprint or DNA or a retina. Really, that just comes down to being a private certificate or a private passphrase. The same goes for does, a challenge response or spoken pattern. Moreover, and this is maybe a personal, more of a personal opinion, but I really don't think that fingerprints or DNA or retinal scans are very good forms of authentication. This is just a small tangent to the side, but for me, it's very important that the piece of information you're using to confirm your identity is something that can be changed and rotated. Should your fingerprints become compromised, it's very difficult, if not impossible to change your fingerprints or your retina. Moreover, your fingerprints are all over the place. My fingerprints are on this glass right now. I don't do that with my passphrase. I tend to think of a fingerprint or a retina. That's more of a username, not a password, right? Perhaps willing to share, much as I'm willing to share my fingerprints on this glass, my username, but that's not enough to uniquely identify a person. So this says that, and aside from the current discussion, think real hard before you introduce biometrics into an authentication system. So that's basic authentication. What about multi-factor authentication? How and why is it different? You may also hear this called two-factor authentication. I prefer to call it multi-factor authentication because it can be any combination of the has and knows and is and does. It can be any number of things. It can be multiple has that are required. It can be some combination of has and knows. I also often shorten it to multi-factor off because there is, as we'll get to in the end, a bit of a difference between multi-factor authentication and multi-factor authorization. And that's two very different acts. So the goal with multi-factor off is to significantly reduce the risk of authenticating a false identity, a false entity, someone or something purporting to be the identity that it's trying to authenticate into. And it does this by increasing, vastly increasing, if you use these inappropriate combinations, increasing the landscape of resources that have to be compromised in order to perform that authentication by a false entity, while still making it possible for the true entity to be able to authenticate. The images here have the fingerprint and the retinal scanner. As mentioned previously, maybe not the best idea, but when using combination with other things, it can really increase the amount of effort your attacker might need to spend in trying to falsify that authentication. If you've seen Mission Impossible, Tom Cruise's character, Ethan Hunt, goes through more than a little bit of effort to break into the CIA and log in with the five-character password. Which is always amusing to watch in retrospect. So when is multi-factor off in the cloud, as is the topic of this discussion, when is it essential? There's a lot of places where I'd argue that it's important or essential in our organization and in many of the organizations that are our customers or partners. It tends to be in mission-critical and production systems, especially when the data that is being guarded is private or in a regulated environment. Quite often that's in government, healthcare, financial, or even academic. There are laws that protect the records of minors, especially in student records. And then I would say essential in internet-facing systems. We think about, I've been in Linux security for over a decade and some of that time has been spent in CIS admin roles and we spent all the vast amounts of effort that we put into keeping machines from being internet-facing, keeping those systems from being on the edge and being able to open up ports on internet. And now for 10 cents an hour and within the next 30 seconds you can have dozens of them with public IP addresses and ports open all over. So think real hard about multi-factor off in internet-facing environments. Multi-factor authentication is already supported by a number of popular services. Just to mention a couple, this is hardly a comprehensive list and I'll get into a bit more specific. And some of these can be argued how cloud are they, but that's just the ubiquity and the breadth of the term cloud now. Certainly Amazon, AWS, there's a multi-factor authentication feature. You can enable this and then hook up Google Authenticator or Jim Malto or RSA key to your AWS account or accounts in many cases. Those are required for production systems. That can guard the access to the web console, launching of systems, other privileged operations. The Google Authenticator is also very popular, easy to use with Google services. It's not very difficult to set up. It does impact your user experience. I'll warn you. Having to have your phone up and running and hooked up to Google Authenticator every time you do something that requires authentication with Google, it's unbelievable how many times per day that might come up. It's also really inconvenient when you reinstall Cyanogen on your phone and you dropped your Google Authenticator token. It's a bit of a manual process to reset that appropriately. And for a good reason, obviously. There's always a sliding scale with security. There's a hyper secure but very difficult to use and then there's extremely usable but lacking all security. You need to find the place on the dial that makes the most sense for a given environment. Dropbox has what they call, I tried to use the terms that each of these, if you were to search for any of these, the terms that these companies use for their multi-factor authentication. But Dropbox has a two-factor verification feature where access to certain files or objects in Dropbox can be verified. Same with PayPal, you can actually order a physical security key. It's another one of these, I'm not sure who makes it, maybe Jamalto makes the physical security key that gets used that is required to use your PayPal or eBay account. And then Facebook recently implemented login approvals for certain, you can set up your account to require you to approve a login using SMS, which is perhaps better than nothing but SMS has its own security issues and considerations. Probably the most popular, the most well-known is the time-based one-time passwords, OTPs as they're often called. Rolling tokens is maybe another word for it. It's actually extremely simple to implement in its most basic form. This is three lines of shell code that will very quickly and conveniently implement a, it's a character missing on, got pushed to the next line there. I'm gonna scale this to 10.24. This is a real simple example how to do a time-based one-time password. Take a shared secret, you gotta get this shared secret on the two different places. You choose it sometimes, it's given to you other times. You take a time stamp. This is a real basic Unix Epoch time stamp number of seconds since January 1st, 1970. We're gonna take the first nine digits of that, leave off the last one, which will give us basically a 10-second one-time passphrase. So that changes every 10 seconds, this is decimal. And then you concatenate that shared secret with that time stamp, perhaps run it through an HMAC and then I grab the first six characters from it. That's extremely similar to what these dedicated devices are doing. All of them require a shared secret. They require some amount of time-based synchronization. Now, for far more resilient and robust algorithms, have a look at these internet RFCs. The original one was 42.26 and HMAC-based one. A much more modern one is 62.38, which is what their Google authenticator is based on. They're a bit more robust. They handle time drift, as you can imagine, requiring two servers to be in, or two systems to be in perfect sync. It gets difficult over time. So they have a way of basically resynchronizing itself and determining how far out of sync they are. And a couple of, not that I'm endorsing any of these products, I just stole their images off the internet, but the classic RSA secure ID, Jamalco, Authy has a real interesting app and a very small bit of shell code that you can put in your SSH config command and require an Authy code every time you SSH into a system. And then, of course, the Google authenticator. So when can you use multi-factor authentication? Fundamentally, in a Linux system, anywhere in the PAM stack, take a look at cpam.d and you'll see a number of different places that we've already hooked in Linux and within the authentication system that require or define as sufficient different pieces of information. Linux is set up very well for multi-factor off and has been for decades. And some people have used it for decades. But simple cases at login, desktop, or console, or SSH, it can be any one or all of those three. At something like a password change event that also goes through the PAM stack. And then administrative tasks, such as sudo or call on or at jobs. Within the last year or so, Ubuntu implemented multi-factor authentication through the Google Authenticator. You can very easily set up either a desktop or a server to use the Google Authenticator where in addition to providing, first you provide your password and then you have to provide the token that you get from the Google Authenticator. And that works just as well on Ubuntu servers. It's actually pretty simple to set up for any Linux system that supports PAM. So when is a multi-factor difficult? Well, it's reasonably straightforward when the authenticating entity is a human, right? And all of these examples we've shown the rolling tokens or some piece of hardware, a smart card or something that someone has, right? And we know how to do that. We've been doing that for a while. It can actually be a bit more difficult when the entity is another program or a process or something else that's also in the cloud. So especially with the cloud, we're talking about automated processes and we're talking about virtual machines where there's machine communication and often these are virtual machines and especially in between services. So I'm sure we've all seen the snippet of PHP or Python or Ruby code in a web app that has a password that's embedded in the code somewhere and then passed in a connection screen. I mean, that's the way we do things. If not that, then it's in a file and we open that file, read it and put it in there. But fundamentally that password lives on disk somewhere and has to be loaded into memory. And that is what it takes to connect to MySQL. Perhaps that's the MySQL server has some firewalling on it that requires an IP address for whitelist hopefully it's behind a VPC and there are some additional levels of protection. But the piece of authentication itself ultimately is password. Of course, we use extensively in cloud computing, SSH and SSL or hopefully we use extensively in cloud computing, SSH and SSL. But fundamentally there's a private key that stored somewhere that is used by SSH in this case in an R-sync job that at 4 a.m. every morning copies the logs off from this system to a backup system. It's authenticated using that private key and only that private key, that's a single factory. It is strong encryption. This could be an RSA key 4K long. You could use a strong algorithm but there's still only a single bit of information that is required to perform that authentication. The lower example, that's a snippet of an Apache configuration where there's an SSL certificate, that's again a file on disk, a private file on disk that's required to host that Apache service. A single authentication is required to start, excuse me, that single file is what's used to start Apache and SSL. So I'd like to introduce a bit of a different concept here and it's a concept that we call, we know in modern terms as a trustee. I can overhear a little bit of a conversation next door and this guy evidently is an IP lawyer so he could probably do a better job explaining a trustee but a trustee is a legal term. It's a person or an entity who has a position of responsibility to act on behalf or as an authority for others. There's a lot of ways we can think about this but at its most basic in a modern democracy we elect leaders who make decisions on our behalf. We don't always agree with them. Perhaps we agree with them less than we would like to but ultimately we're entrusting them to vote on our behalf and that's the US Congress in this case. But where does the term come from? The concept of a trustee as a voter was formulated by this guy, Edmund Burke. He was a member of British Parliament in the 18th century. He was also a philosopher and he wrote extensively about British politics and about just the philosophy of acting on behalf of others but the modern term of a trustee being used in the sense of a voter comes from this quote. Essentially it's someone, typically someone, we're gonna talk about it as something, a computer program but it's someone that considers an issue and after hearing all the sides of the debate exercises their own judgment and makes the decisions about what should be done in that case. So thank you, Mr. Burke. But trustees, we also know from a different term and we know trustees from a sense of a trust fund. The modern concept of a trust fund for property is actually much older than the concept of a trust fund from the sense of voting. It actually developed in 12th century England. So once again, thank you England. Here, you're welcome. Sorry, appreciate it, much appreciate it. Yes, absolutely. In 12th century England, during the Crusades, landowners, especially wealthy landowners, they would leave their property in the care of a trustee so that when they left to fight in the Crusades, this trustee didn't own their property but it was up to them to essentially bestow their will or exercise their will passing it on to their beneficiaries, their children. There's actually kind of a funny scene at the beginning of Robin Hood, Men and Tights, the Mel Brooks movie, which I debated. Mel Brooks or Paris and Nicole, they won. But in the beginning of Robin Hood, Men and Tights, Robin Hood, Kerry always comes back from the Crusades and they're hauling off his castle and it had been entrusted in the wall. It's a comedy, so it wasn't properly executed. But the concept of a trustee in this sense is someone who acts, like voting, acts on behalf of the property that they're entrusted with. They don't own it, it's not theirs, but it's up to them to make decisions as if with the beneficiaries' interest at heart. So let's take these concepts and fundamentally apply that to software, to a software system. So within, this is the product from Kazang. We essentially have two products. One's an encryption product, the other one's a key management product. The real differentiator in our key management product is we've taken this concept of a trustee and trustee voting and formulated that in terms of software. We've brought that and we're using that both for authentication and for authorization. This enables a system administrator to delegate the approval of the release of information to one or more trustees. That release of information could take any form. We treat it as an opaque object. It's encrypted in a way that we actually are true to the trustee concept. We encrypt that data using the beneficiaries' public key so that only the beneficiaries' private key can decrypt it. Not even the trustee can see the information that's being entrusted to the Z-Trustee server and either the server, the one holding it, nor the trustee is privy to that information. What the trustee is allowed and unable to do is decide whether or not that information should be released. So in practical terms, once again, we're talking about passwords or passphrases, private certificates, private keys. One-time passphrases or tokens, perhaps generated objects. It can be files, and if it can be files, it can be tar balls. It can be collections of information. There's a couple of bits of vocabulary we use when we talk about this. One is a client. The client is the piece of software that actually puts a deposit onto, we call them deposits. We try to use banking terms wherever possible. It's the client that puts the deposit into the Z-Trustee server. When it does that, it actually, at that time, because it had access to that information at some point in time, that point in time, it defines the policies by which it can be released. And we support all the normal things you get out of a KMIF or a typical key server such as a TTL on the key, a limit to the number of times it can be retrieved. But we've also added this concept of trustees where when putting the deposit, the client can define, well, zero, and there are no trustees, but all the way up to n number of trustees. And those trustees can be humans or they can even be programs. You can identify a trustee by an email address or by a GPG public fingerprint. Question? Good question. It's, in every case I've ever seen, it's data. It's strings, it's files. It's something that we can encrypt and base 64 encode and insert into a database somewhere. I've never thought about it from a runtime sense. Interesting. What would guard whether you can do that or not? Is it some bit of secret information that allows you to do that? Sure, that's a good question. I'm intrigued. I don't think I quite see the connection yet, but I would like to talk about it more. So emails are the request to that email address. We can actually sign and encrypt the message to that email address. We always sign the message. If we have that email address in a production system where this is your system administrator, people have GPG keys that have been uploaded to the server, we actually encrypt that message and all messages when we have a public key on file to that address. And so we'll throw it out there, but only the person with that private key can encrypt it. Actually, both are supported. So the ideal use case is we have public keys for everyone. We actually have a public key server that's part of ZU trustee. We started with the Debian SPS, which is the synchronizing key server for PGP. We hit the limitations of that because we're running this in environments that may involve hundreds of thousands, millions of clients, and scaling that SPS didn't work. So we're actually working on a GPLv3 replacement for SKS called HOPIPOP, or HPP. So there is a public key server component to this that's required for all client-to-client communications. Every message between a client and a server, the programmatic sense, is signed and encrypted using GPG. That's how we do the authentication from the clients to servers and servers to clients. But in the case where that's not available, we've also got a URL not space approach where, much like, say, the Facebook approach to, we'll just click on this link in this email. We do have time-expiring, one-time-used, not URL links where there are organizations that, GPG is frankly hard to set up and hard to get working. So both are supported by default, everything signed and encrypted. Unless we can't do that, we fall back. Does that answer your question? So that trustee would, in the case where the not slink is used, they would need to know the Z-trustee server name and they would need to guess or somehow intercept a 256-bit randomly chosen nots. If it's clear text email, that would be possible to scrape. If it's encrypted email, impossible to scrape. If you're not using the email-based approach and I'll get to the different trustee interfaces in a second, then it's as impossible as brute, or it's as difficult as brute forcing a 256-bit nots. That's actually, that's certainly not the optimal way to do it. We've got APIs in, yeah, I'll show you in just a second. We've got APIs in Shell, Python, Java, and C and all of those are over SSL links, number one, to prevent man in the middle. Number two, you go through that API and it will form a, let's see, the innermost packet is a bit of JSON, JSON contextual information act on this, it's a REST-based approach. That JSON is then signed by that client's public key, sorry, private key, and then encrypted to the server's public key. So now we've got this encrypted signed blob of JSON data that is posted to the ZTrustee server. The ZTrustee server decrypts that data, only the server with the private key can decrypt that data. It checks the signature and using that signature check, it determines which client sent this information and then cracks open the JSON and performs whatever action is specified by that. It then concocts a response. That response is then signed by that server's private key and then encrypted to the client's public key. And then that goes back over to that client in SSL. There is that double encryption there and this is, it can be a CPU intensive of work, but that can certainly be mitigated. Does that help? Both, both are doing it. The client and the server are both using fundamentally GPG. That's all right, no, it's a good question. So clients later request that deposit. The client must be able to meet all of the defined policy, the server enforces that and the trustees are probably the most, certainly the most flexible and extensible policy of all of them. The basic policies are the ones required by something like the KMAP, the Key Management Interoperability Protocol. But the trustee can be anything that you could possibly imagine requiring. So in a programmatic or, I'm sorry, in a pictorial form it looks like this, that it's the clients here, one or more clients that are putting and getting this data to one or more Z-Trustee servers. That Z-Trustee server decides if it can, that client can meet all the policies defined for that particular deposit. And if that particular deposit requires trustees to vote, the requests are sent out or made available for these trustees to then vote on up or down and if that can be met, then that deposit's released back to the client. So in the GPG case, this is an example of the decrypted GPG message. It still has the signature here at the bottom. But in, okay, in this case, so this message is a cryptographically signed message. It says, hey, this is your Z-Trustee server. A managed client has authenticated itself, so that much you have to trust that the server has done a good job of authenticating the client and has requested the following deposit and it has this handle in this description. That's just metadata that the client set whenever it created the deposit. It provided the following explanation of this request and this is a free form field that the client when making the request can define and this is called a justification and this justification could just be basic information. It could also include some sort of a challenge response or some other additional bit of information. In this case, inside of this encrypted signed email are two Naut's links and these are, when I said Naut's links, that's quickly what it looks like and you've got all the usual limitations of a get-based URL, but all the advantages of a get-based URL. And one of these is an authorize, a thumbs up, another one is a deny, thumbs down and each of these links can only be used one time. Question? Yes, absolutely. And this is a snapshot of the previous version. I took this from the previous version. We now identify the client. We also include the host name, my key address, internal and external of the client and put that in this message. So hopefully that's a little bit better if you've got other ideas. Yeah, we certainly can identify this client by its public fingerprint as well. I'll take a mental note to add that to the metadata that comes back about the message. But yeah, I'd love to hear your ideas. So that's email. And this is easy and simple for a demo, especially to a demo to some of the executives that I'll demo this to from Pan Tan. But any of us that have written to a REST-based API certainly knows that there's better ways of doing this. I'll get to the REST-based API next. But once again, for demoing to execs, this is certainly the way everyone wants to see things. Write an app for it, create an app for it. So we've created an Android app and we've got an iOS app in progress right now. But it's a mobile interface. It's a push-based notification interface where your mobile app, you then register to one or more Z trustee servers. We always think about this as one or more clients registering for one or more servers. In this case, all the communication happens over SSL. It's authenticated. The packets are still encrypted, also using GPG and these bouncy castle in Java and Android to handle this. Whereas we use GPG2, libgcrypt and on the programmatic on the server side.  Only grab the one screen. That's the vote up, vote down type interface. And this is a basic deposit and this would be the place to add more information about which clients making this request. In this case, Casey could vote up or down or abstain. The middle ones is kind of hiding abstain from this vote. But I think the one that most of us here would be, at least to this crowd, I think would be interested in is the programmatic sense. I mean, I really want to program trustees that behave and make those decisions. I want to have cron jobs or demons that are authorizing or denying requests based on perhaps the time of day. It's about a five line Python script to have a trustee that checks in every 60 seconds. And besides, if it's between 1 a.m. and 2 a.m. on the first Sunday of the month, approve this request. Or if it's not between 1 a.m. and 2 a.m. on the first Sunday of the month, deny this request across the board. In this case, this is a couple of lines of shell code. The Z-Trustee command itself is just a bit of Python. It's architected like Git, where the first argument's always an action and then it's got a bunch of contextual options after that. But the Z-Trustee pending command would show a JSON data structure of all the pending requests. And in this case, so to your point or to your question, we have identified the client that's made the request. So that data is available. We just didn't expose it in the email interface yet. But we know the client fingerprint that's made the request. We know that the email address or the text associated with that client. We know when the request was created, the deposit that it's been identified, the expiration of this request, and then some justification. In this case, just for an example, we've put where justification for one of our servers might require the title of a Beatles song, for instance. And it's always kind of changing. But if I see a request that doesn't have some bit of information that reminds me of the Beatles, it's not a valid request. And that's from more of a human-to-human than a machine. But it's a form of a challenge response or a shared secret. This request has a UUID. This is the role of trustee. There's a couple of different roles, and everything we identify by these 256-bit single-use UUIDs. We base 62 and code them to make them a little more URL-safe. And then there's an authorized and a denied command. The authorized command would take that UUID and package it up into the way that encrypted sign, JSON data blob, is supposed to look for the server to respond to it. And it can mark that request as authorized or it can mark that request as denied. I had every intention of creating the same blob in Python, C, and Java. And I didn't get around to it today. But fundamentally, import Z-Trustee and then Z-Trustee.pending, blah. I mean, it's gonna look exactly like you'd expect in Python, C, or Java. Yeah, so when a client makes a request, the default, if unspecified, the timeout is 12 hours. But you can specify any timeout you want. You can say, make this request. I need a response in 60 seconds or else I'm gonna assume it's wrong. It's specified if the timeout's too long or too short. Too short. Yeah, perhaps. I mean, we scale pretty linearly with CPU and disk IO. It's not a very memory-intensive operation unless your deposits are huge. We have put multi-gigabyte deposits, but I mean, Dropbox is a better solution for that than RS3 than this. No, it's actually multi-preddit. So on the Apache side, on the server side, we're using Apache and Postgres by default. We actually use SQL Alchemy so that SQL backend can be replaced. We test it with SQL Lite, MySQL, and Postgres. We've gotten the best scalability out of Postgres. It's an Apache web server. We've looked at IngenX, but so far, Apache's done pretty well. Out of the box, it's about 100 connections, simultaneous connections it can handle. Using, there's three tweaks to make to scale that up. You increase the number of threads in Apache. It's a Python WSGI module. You increase the number of threads in Apache. You increase the number of connections in Postgres. And you need to increase, there's a syskittle that needs to be updated. I forgot which it is, but we've documented it in the server man page. It's a, and with that, we've taken it up to, I think 10,000 simultaneous connections in the largest instance we could find in Amazon. We're working on our clustered, sharded, high-availability type solution where you could put these in multiple systems. We've got a design that works on paper and we're in the process of implementing that. That'll be, that's targeted at this summer, June, July. Excuse me, please. Yeah, great question. I get to that toward the very end. So I'll short-circuit straight to that and circle back. It's offered as a SAS model, multi-tenant SAS. It's offered as a private, dedicated SAS. And it's offered as an on-prem. And so far, the adoption has been mostly on the on-prem solution, which is the, it's not unexpected, but I mean, that's where people are deploying this and doing it internally. Absolutely, totally. Yeah, absolutely. Security is a funny field. It's real hard to get, and it's one of the real challenges, especially in a startup world. It's really difficult to have advocates who publicly will come up on stage and say, we use this theory, but it's just inviting trouble. Yeah, no, personally, I mean, I'm the CTO and architect of this software. I would much rather, not much rather, but I certainly like it when someone takes this and deploys it behind their own firewall, maintaining other people's appraises. It's something we do, but it's touching. Yeah, so the first thing to understand that's extremely important for this is that every single deposit that's put onto the Z-Trusty server is encrypted using the public key of the client that put it there, okay? So even though the root administrator of the Z-Trusty server can't read the data, that's in the content column of the deposit table, the database. They could tamper with it, they could destroy it, they could, our root user could authorize releases. There's bad things it could do, but the data itself to compromise that data would involve compromising both the client and the server, obtaining the private key on the client and the server. Of course, you can put a passphrase on the GPGP on the Z-Trusty client, but that really hurts your, that really makes it difficult to do any sort of machine to machine communication. Now you also require a passphrase as well. There is one exception to what I said about everything's encrypted. There is at customer request, there is an optional feature, any deposit can be defined as recoverable. So there's sort of an escrow mode for Z-Trusty where instead of asymmetrically encrypting it using the client's public private key pair, instead a shared secret is used, a shared symmetric key is used so that an administrator of the server could recover data. That's not the default, it requires an override on every single client that wants to put that data. It's not, you know, it's, we've tried to, anywhere we could have taken a secure approach, we've taken a secure approach and offered the less secure approach as an option. Okay, sure. Yeah, let me see what do we have left. We have about 15 minutes and I have a couple of slides and then we'll open it up completely. So the voting policies, here's a quick example what this looks like. Generated password, this password never landed on disk, it went straight from memory from PWGIN directly into Z-Trusty. It's a Z-Trusty put command with a dash C says the contents are dash, standard input and I've defined three trustees. One is on call at example.com. Another one is sales at gizang.com. This is who you'll contact if you want to know more about Z-Trusty. And the third is actually identified by a fingerprint. We identify clients, trustees, processes, anyone can be identified, that has a fingerprint on file can be identified by their full fingerprint. We only use, we always use this canonical form which is the bit length or the key length, the algorithm and then the full 40 bit key is actually some attack service now for key collisions in GPG especially if you just use the short key. We always use the full fingerprint, the key length and the algorithm. A subsequent get of that deposit, this one's identified by the TUIB, instantly puts this shell command into a waiting poll until and it will check back at the server on a slow back off for up to 12 hours by default. You can always override that timeout but it'll put this into a poll and the server will not release that deposit until those two votes are acquired. So there were three trustees, two of the three have to approve the release of this deposit. If any one denies the release before two have voted in favor of it, one denial is considered authoritative. It has to happen before the sufficient number is reached. And so in this case this will sit until those two are retrieved and I guess I forgot to copy and paste the actual retrieval but assuming that the two email addresses are the client authorizes the release, that deposit will come because it came, went in on standard in, it's gonna come back out on standard out. You can actually use files or directories as well with C-Trustee. So instead of standard in, you can give it a file path which on a successful retrieval will unzip that into dev-shm shared memory. You don't wanna write it to this or you can specify a dash F and tell us where to put the file. In another case, we've actually got a, this is sort of a consumer of Z-Trustee. We've written a C program called Z-Off which uses the C library for Z-Trustee. So, you know, pound includes Z-Trustee.h. And what this at Z-Off does is it actually adds the whole PAM authentication that I mentioned before in reference to Randall X KCD. So you don't make me a sandwich. Well, give me your authorization code. And that's how Z-Off works. So you can actually add one or more trustees into Z-Off and then you can add off sufficient or off that should have been required, excuse me, off required PAM Z-Trustee into anything in PAM. In this case, this is Pseudo. And so Pseudo apt-get install, you know, some program and then with depending on where you put it in the PAM stack, you're put it after common off, then it would await Z-Trustee authentication. And that would be for anything that went through the Pseudo stack. Imagine the same thing for a screensaver for login or console or SSH. It might be, but it could be programmatic, you know? That might not be a human that you're waiting on. It might just be a program making sure that you're inside of a maintenance window. You could block access to SSHN except for inside of a maintenance window and do that, you know, programmatically with a separate system. So is this something completely different? The title of the talk was multi-factor authentication. The more I started working on this particular expression of the idea, I've been talking about this idea for over a year now, but it's actually more like multi-factor authorization. And I did a little searching and I really didn't find anything called multi-factor authorization. So that's why I'm trying to use multi-factor off and shorten it and leave it as a mystery which one we mean. But the key is that, you know, any information object can be dynamically requested and retrieved from Z-Trustee. There are ways to protect data that has to stay local in the system. That's encryption. You know, we've got a whole other product speed based on encryption. I co-author and I maintain eCrypt.fs, a cryptographic file system for Linux. There's DMCrypt. There are ways of protecting the data locally that has to be written to the local storage. But when you actually want to protect the data and you want to protect it by, instead of storing it local, storing it remotely in a trusted service, a trusted server and retrieve it dynamically, use it and then discard it. You know, only store it in M-locked secure memory or something like that. This is a way of doing that. So, you know, getting to your question about is it available as SaaS or on-prem? It's actually available as both. There is a SaaS service, but for anything other than a couple of deposits, we recommend either dedicated in the cloud or, you know, ideally on-prem. The server itself installs easily on Ubuntu 12.04 and newer REL, CentOS 6, Slash 11. It's, we package everything as devs in RPM, so it's an appget install or a yum install away. The servers have, you know, sort of a limited footprint in terms of what's required there. But the clients are available on pretty much anything, the Python, the C, the Java, it's all extremely portable and anything that has a modern Python stack or a modern JVM can run this. And I even say hesitantly that Mac, Windows, and Android especially, we've tested very thoroughly, but we've even done puts and gets on Macs and Windows using the Java client. So the client we look for, you know, sort of ubiquitous support. The server is kind of on a customer by customer basis. We did it on Ubuntu first and then we got a customer of RAS for REL and we got a customer of RAS for Slash and that, you know, that kind of grew like that. It's across both Amazon and Rackspace. We've got Failover. It's public cloud, yeah, it's public cloud. So that's me, you can find me any of these places and I think we have right at 10 minutes left for questions. Yeah, absolutely. I've already sent them to the presenter. I'll put it on my blog and leave it out a bit later. Matt? So the software is commercial software. So there's an alt-right reserved at the top. It's in Python. It's perfectly visible. We haven't obfuscated it. It's copyrighted and that's our, it's not, I mean, that's a commercial discussion. I know for this crowd, I would love to say that our clients are open source and the server's proprietary or it's all open source and we may get there one day for a small startup and this is where we're at. But it's not obfuscated in any way, shape or form. We send patches and I'd be more than happy to accept them but yeah, it's the Z-Trusty part of this is commercial. There's quite a bit else in the presentation that is freely available. Some of the offy stuff is kind of cool. Offy doesn't work at the ham layer. It works only as an SSH config option but that's another simple way of doing it. Most of the other services are commercial as well, Google Authenticator and AWS so. Great question. We do, we work with SafeNet and Tollis. There's a couple of ways we actually can set and this is kind of the default answer inside of the company whenever someone asks, can you do this? Make a trustee out of it. What we've actually done is set, use the HSM Java API and created a trustee out of an HSM. So you request a deposit which is cashed and in this example, this customer is running in Amazon or something. Amazon now has cloud HSM but before that happened, this is essentially a software version of an HSM. Something store data there and you fetch data from and someone said, well, can you integrate? I want the HSM to decide whether or not I get this data. Oh, okay. Oh, well, so the only thing that we've so far integrated with the HSM are the root of trust fundamentally because at the heart of the Z-Trustee server is a GPG private key, an SSL certificate. The same things we're telling you put into Z-Trustee, well, it's got its own. Put it into another Z-Trustee and cross them together or put it into an HSM. So we've got another use case where customers storing encrypted data in a public cloud. They run a Z-Trustee server in that public cloud but store the private keys for the Z-Trustee server in an HSM in Europe. And so they sort of have this root of trust that ultimately requires at some point if they power down some piece of the puzzle, it ultimately requires a connection back to their VPC or their VPN to their data center in Finland or something. What that gives them the ability to do is pull up log but not every single request and there may be thousands of them per minute has to go through that VPN to an HSM which is we can kind of sort of cache that typical hierarchical cache. No, go for it. Yeah, so we designed this originally for our encrypted file system. So I've maintained, we do quite a bit in the open source, I've maintained eCrypt FS for about five years. It's a stack file system in the Linux kernel it's used by Ubuntu and Chrome OS and there is other, yeah, it's really interesting and it actually forms the heart of, well we actually support DMCrypt and eCrypt FS but those two form the heart of our encrypted file system solution. The thing that's never been available in pure open source has been the key management aspect. And so Gazang was originally funded and founded based on the concept of there's more encryption that needs to be done in first relational databases and now no SQL and cloud file systems. The missing piece for actually getting all that to work is encrypting is easy. Where do you put the keys and be able to reboot your system? And so what we have are a set of net scripts and upstart jobs that at boot time will go out and fetch the keys necessary to mount your file system and you can put a trustee on it so that at two in the morning when your web server reboots this your system administrator might get a message on their ZTrustee mobile app that says you wanna approve this request and it might be up to him or her to make a couple of phone calls and make sure that this is expected and if so approved and no one has to log in anywhere. Oh and by the way, that's this admin didn't actually have the private certificate or the private password. All they did was authorize the release of that to a system that maybe your separation of duties are such that they don't have root on that box. They have the right and the responsibility to release the private cert to that machine that's required to mount the file system but they don't actually have access to that system. So we originally built this to solve our own problem of when you store keys that you need to have at boot time. Our first few customers grok the concept and said yeah, but I wanna store my other keys in that. Yeah, but my HSMs are really expensive. Yeah, but I can't get an HSM into the public cloud. And that's where we started expanding this concept and built something that was more general purpose. It works well and we're sort of our first own customer for this. Any of our encryption customers are also customers of Z trustee, but it's also general purpose. Yes, no, I must have been, I probably didn't make that transition smoothly. It's a different approach to the same problem. I probably didn't make that transition seamlessly enough. I didn't wanna spend this entire hour talking about Z trustee all by itself. This is multi-factor authentication in the cloud. So the TOTP based stuff works really well, especially for the services where humans are involved. So that's kind of this slide is the TOTP stuff it's easy when you can have one of these things in your pocket, but a bit more difficult when you're talking about a machine to machine. And in fact, I haven't done a full dissection of the Z trustee protocol, but in fact, inside of every single Z trustee message, in addition to being signed and encrypted, there's also a sequence number. It's not even a sequence number. It's a randomly generated code that the server and the client exchange so that if that client is duplicated somewhere else, then the somewhere else hijacks that connection and now it's considered that client. It's trying to prevent multiple Z trustee clients from authenticating and you need to know the shared secret, but yeah, or be able to calculate. Yeah, really, okay. I've used AFI and I've used Google Authenticator from time to time. I try Google Authenticator on all of my Google accounts all the time and man, that's a lot of Google Authenticator and get me your code. If you're a Google docs user, you have multiple devices, you can tune it down to only on logins, which is where I'm at now. So when a new device or new device logs into a Google service, you've got to type it in and hopefully your phone's nearby and not out of battery, enabling it from a programmatic sense and extending the concept from just authentication to authorization. Am I allowed to write? Is this process allowed to retrieve this bit of information? And does everyone or everything agree that it can be? The idea is that other sources, other trustees would be privy to information that is not readily available, outside conditions. Are we under terrorist attack? If so, stop releasing fees, releasing certificates. And maybe not terrorist attack, but am I under a DDOS right now? If so, let's halt the release of these. Have I decommissioned this system? So Gemolto has a lot of products and they're definitely in the physical product space, especially from the smart cards.  They've got a couple of the original inventors of smart chip technology. So I'm not sure which one you're talking about. But this rotating token one is essentially the same thing as the RSA secure ID. On the IM side of things, that's certainly an interesting extension to AWS where you can give users roles who are allowed to do and not do certain things that's baked deep into AWS. And if you're in AWS security conscious, that the user, it's a great thing to use. But AWS is relegated to explicitly public clouding, not if you need to do things internally. They Amazon, AWS. Yeah, so if you take a look at the AWS multi-factor off, it's interesting, it's useful. Yeah, inside of Amazon or Rackspace, OpenStack, private cloud, public cloud, physical servers, software. Virtual machines. We do, I mean, most of our, I'd say, there's a vast number of customers using this in Amazon, but there's plenty of opportunity out there elsewhere. And so we try to take a bit more agnostic approach. We tend to run an enterprise. Yeah, if it's Linux, yeah, we're happy to encrypt it. We don't do a lot in Windows. TrueCrypt and BitLocker have that market pretty well under control. But if it's Linux, we can certainly encrypt it. The vast majority, 98% of our customers are running in server environments. But there's a few desktops out there. And if it's, I mean, I co-authored the Ubuntu encrypted home directory feature. So the checkbox encrypt my home directory. That's something that is near and dear to my heart. It's not something that Kazang does. Now, there's a bit of work that goes behind that. And most of it's in the PAM stack, actually. And PAM eCrypt FS captures your password that you enter. It decrypts, symmetrically decrypts, a long random passphrase that was generated at setup time. That's used to mount, or that's loaded into the Linux kernels key ring. Actually, the PBKDF to it. So we hash it 65,000 times, loaded into the kernel key ring. If you have file name encryption enabled, we hash it one more time. And then that key is used for the file name encryption. And then we mount home.ecrypt FS slash username on top of your home directory. And the timing has to be done exactly right. And at the right place, and as the right user to set that up properly. So there's a set UID binary, mount.ecrypt FS private that takes care of that and gets the ordering and the locks and the race conditions down right. And there were a few bugs that I had to fix along over the years, but it's just right now. And it mounts that on top of your home directory. And then to you, the user, it is magic carries taking care of the encryption in the background. But it's ensuring that to application space, to GNOME and Unity or whatever your app, Eclipse or Terminal or Firefox or Chrome, whatever's writing files and directories, it's just writing files and directories and what it looks like to be a normal file system. What actually lands on this, each individual file is encrypted. And encrypted using its own randomly generated key such that two files with identical clear text encrypt to completely different cipher text. And yeah, that's all built into Ecrypt FS. It's per file encryption. There's also DMCrypt, which does block level encryption. It's a lot more performant, but it's a lot less flexible. You have to encrypt an entire block device. It has to be a file or a petition or a disk or a loop file. And there's only one key for that entire file system as opposed to Ecrypt FS, each individual file can be encrypted differently. Yeah, I mean, the single point of failure in any encrypted file system is the key that's used to do that mount. So in the Ubuntu encrypted home, there's a file called slash home dot Ecrypt FS slash dot user name slash dot Ecrypt FS wrapped dash passphrase. And that wrapped passphrase would be here in that case, your single point of failure. That passphrase, that encrypted file, symmetrically encrypted file coupled with your passphrase is that single point of failure. To mitigate that, you could put that file on a USB key and put a sim length to the USB key so that it has to be plugged into the system whenever you type it in. That's a form of multi-factor off. You have to know the passphrase and have the passphrase file and remove that. And that works well enough and keep it on a USB key and don't lose the key. That's easy to do when it's physical. And that's the whole point and what I said, trying to take us from really straightforward to really difficult. When it's a physical computer and it's a USB key that I plug in or don't plug in, that's quite doable. When it's the cloud, I can't plug in a USB key to the cloud but I still wanna move that key off of the system and store it somewhere secure. And that's the Z-Trustee. So I'd say the other half of that is the single point of failure is the key that's used to mount that file system, storing it somewhere else and retrieving it on use and then protecting that retrieval using the policies, the trustees or something like that. So I'll be around to talk about this more. Thank you very much for staying. Thanks.


We're going to have a free speech year at Berkeley, in which we are creating multiple opportunities to engage the issue of free speech. As I'm sure everyone in this room knows, the protections that our Constitution affords to free speech are extensive, indeed more extensive than in any other liberal industrialized democracy. That said, that the rights of free speech can often conflict with the values that we hold that both Sharon and Oscar have talked so movingly about, the values of inclusive community. So we're going to have lots of opportunities to talk about those tensions, to figure out as a community where our resources lie for creating strength and resilience both in ourselves as individuals, but also within groups and as a whole community. That said, we have not only an obligation to protect free speech, but an obligation to keep our community safe. So I've been working extensively with the police to plan for any disruptions that might occur. We'll be working with the whole community to create the powerful sense of commitment to this as a nonviolent community. One of the things that we're planning this year is a series of programs that I'm calling currently Point Counterpoint, in which we bring people of sharply divergent views together for a moderated discussion. I think in the university we have to model civil discourse in which people of very, very different opinions talk to each other with respect, argue with each other with respect and civility. We all share outrage, concern, grief about what happened in Charlottesville. We do not want that to happen on our campus. It's an assault on the principles that are fundamental to our democracy, fundamental to the mission of the university. As a faculty member and now in this new role as advisor on sexual violence and sexual harassment, I care very much about the community understanding our commitment to keeping everybody safe and in particular to making the process for investigation and response. If there is an incident as clear and transparent as possible, everyone knows about what's the kind of open secret, you know, the faculty member who harasses students often serially and what we have to do is change the community tolerance of that behavior or the willingness to stay silent. Most of our cuts have already occurred at the end of 1617 and as I said earlier with the goal of preserving faculty experience and student experience. What we can expect is that we will be able to, we may see time delays and how long it takes for us to move paperwork through the system. We're very focused, Paul and I are chairing an efficiency project towards research administration so we really want to focus on moving resources towards administering our contracts and grants. So I think we've managed it well. The hope is that faculty and students will not experience this in their day to day lives.


I think every word that I say is putting me into a little box. I don't think we need that. I want to make them question these rigid structures and break them. Everything you think about Jake, think the opposite. He's very smart, but he's quiet. You know, he makes very powerful works that are both subtle and visually powerful.  He makes art directly through the web, which you wouldn't necessarily associate with kind of high art you'd see in a gallery, but he also does performances and installations at the best museums and galleries in the city, which is really cool. He sort of spans the like high art, low art divide. He almost writes off what he creates as just fun and playful and things people like because they're cool. The works themselves do speak deeper than that about the Internet and about how we present ourselves and also how we communicate in the digital world. The collectors don't care how many likes you get on Instagram. It may introduce people to him, but if the works aren't amazing, people won't respond to them. All the Internet notoriety won't matter. People are very critical that youth, the imagery of mass media capitalism, are not legitimate sources for art. But, you know, that's, of course, an argument that goes back many, many decades. In the age of the selfie, people take on a persona. I think the margins between the real Jake and what you see on the Internet are pretty narrow. So we're already getting a glimpse past just that painting. You know, we're trying to contextualize who this character is. It's not quite that he was a person who became famous on the Internet and then moved into the art world. I think he's simultaneously been conquering those worlds in a fairly separate way since the beginning of his career.  He started saying that he's born on the Internet after he graduated from Cal Arts. And I feel like that has to do with knowing how to package himself even and kind of creating this animated character that is himself. I just try to have fun with everything. If I don't enjoy doing it, I don't want to do it. That's why I don't like this. We decided to do an interview with him, and he refused to do it in any other way but text message. So I asked him how old he was, and young Jake responded, um, young. Like, why are you actually... I think he just doesn't like being put on the spot and being asked to sort of summarize everything that he's working on. I think it just seems to make him uncomfortable. He's great at putting out visuals and videos and music and websites that appeal to a lot of people. That doesn't mean he necessarily wants to sit around explaining those things. Those are really different skills. Every time you think he's refusing to reveal something, that's actually revealing something. And that's kind of part of what his performance is. But I'm sure he would think, like, me looking into it this much is, like, very silly. He never really spoke that much. Like, he wasn't a loud person as a kid. He was very observant. He was constantly drawing and constantly creating. I remember when he was five years old, he had this comic that he would do, and it was just so, so funny. I wanted to be the voice of a cartoon because I wanted to, like, inhabit another body. It's still probably a goal of mine. He was already looking at creating a character, then watching that character go through scenes of the day. The point of art is to inspire people. You don't want to make people want to do stuff different. There's definitely a young generation. They might have not known about the art world, or they might not have thought the art world was an option for them. I don't want people to walk into my gallery and feel like they're not supposed to be there. I don't know, until I hung out with Jake, I didn't think that I was supposed to really be, like, other than street art. You know what I mean? I didn't think that I was supposed to understand art. I never thought I would really be into it or even trying to make it. So I had this idea to do, like, a space where every, like, aspect of the party is a sculpture.  There's, like, all these dichotomies going on. He's making work that relates to a demographic that is living on the internet, that's socializing on the internet. And yet it's drawn from a kind of urban sensibility, but it's very literary. It encompasses a lot, so he's kind of post everything. The coded works that he does are very sophisticated and they're, like, so engaging because as somebody who grows up with, like, the internet dominating all their conversations in their life, it really does speak to that. Yeah, the only thing that limits you is the idea that you can't do something. Jake is giving real people credit to believe in themselves the way he believes in himself, you know? If you get inspired by something, show people what inspires you. In any way, you don't have to be very good at drawing or anything to show people. Some people might really like it and agree with you. Only the future will tell how far he wants to stretch himself into what areas, but Jake is off to a very good start. It's definitely going to be hard to continue to always stay relevant, but I think that's why he's constantly, like, experimenting and trying new things. Even if he won't admit that.


According to a recent survey, the number of Americans who say they're eating pretty much whatever they want is at an all-time high, which unfortunately includes too few fruits and vegetables, as well as too little variety. Half of all fruit surveys are taken up by just six foods— OJ, bananas, apple juice, apples, grapes, and watermelons. And half of vegetables are made up of iceberg lettuce, frozen potatoes, fresh potatoes, potato chips, and canned tomatoes. Normally are we not eating enough period and missing out on the healthiest fruits, berries, and the healthiest vegetables, dark green leafies. The fruit and vegetable palate for our palate is, sadly, lacking. Why does dietary diversity matter? Because different foods may affect different problems. Cabbage, cauliflower, broccoli, and Brussels sprouts are associated with lower risk of colon cancer in the middle and right side of our body, whereas risk of colon cancer further down on the left side of our body appears to be better lowered by carrots, pumpkins, and apples. So different fruits and vegetables may confer different risks for cancer of different parts of even the same organ. Variety is the spice of life and may prolong it. Independent of quantity, variety in fruit and vegetable consumption may decrease lung cancer risk, meaning of two people eating the same number of fruits and vegetables, but when eating a greater variety may be at lower risk. And it's not just cancer. In a study of thousands of men and women, a greater quantity of vegetables and a greater variety may independently be beneficial for reducing the risk of type 2 diabetes. Even after removing the effects of quantity, each different additional two items per week increase in variety of fruit and vegetable intake was associated with an 8% reduction in incidence of diabetes. Why? Well, it may be attributable to individual or combined effects of the many different bioactive compounds contained in fruits and vegetables, thus consuming a wide variety will increase the likelihood of consuming more of them. All the vegetables may offer protection against chronic diseases, but each vegetable group contains a unique combination of these phytonutrients, distinguishing them from other groups, because each vegetable contains a unique combination and a greater diversity of vegetables should be eaten to get all the health benefits. Does it matter, though, if we get alpha carotene or beta carotene? Isn't an antioxidant an antioxidant? No, it's been shown that phytochemicals bind to specific receptors and proteins in our bodies. For example, there appears to be a green tea receptor in our body, a receptor for EGCG, a key component of green tea. There are binding proteins for the phytonutrients in grapes, onions, and capers. I've talked about the broccoli receptor already. Recently, a cell surface receptor was identified for a nutrient concentrated in apple peels. And importantly, these target proteins are considered indispensable for these plant foods to do what they do, but they can only do it if we actually eat them. Just like it's better to eat a whole orange than just to take a vitamin C pill, because otherwise you'd miss out on all the other wonderful things in oranges that aren't in the pill. By also eating a different fruit like an apple, we won't miss out on all the wonderful things in apples that aren't in the orange. When it comes to the unique phytonutrient profile of each fruit and vegetable, it's like comparing apples to oranges.


During a premiere of the Big Con at the Mountain Arts Center Wednesday, the family of a former con client, Vanessa Stapleton, came in support of their daughter, who lost her life in September of 2021 due to complications from a severe allergic reaction. Well, she'd lost her disability like I was telling them in September 2016 and then she'd re-sign back up and fightin' around with it and stuff and then like when she had that allergic reaction and then with that epic pen and everything not workin' right and all the messin' not comin' out of it and she coded died, she's down 20 minutes before they revived her and then she got bed fastened and then she's in hospital and facilities for like seven months straight and then, you know, it was hard cause with her, with it's just like Medicaid, you couldn't get her in like a regular facility or something to really try to help her cause she didn't have the good enough insurance if she'd been drawin' her disability, it would've been better to where she could've got into one better and stuff to try to help her and everything. Before Vanessa's passing, in September of 2016, Vanessa was sent a letter that she would no longer be receiving social security benefits. In 2019, Vanessa encountered a severe allergic reaction which left her family searching for help. During that time, the Social Security Administration expected Vanessa to pay those funds back even while enduring complications from her disability. Oh, I went through a lot. Hit our daughter, she was gettin' them letters like that pretty often before she took sick, you know, got bed fastened and it was drivin' her crazy. It was eatin' at her, you know, mentally, physically. It was, yeah, I wondered how she was gonna pay her bills and then she had them two kids tryin' to raise and do things with him and everything and she had her hands full. We are Pikeville Medical Center and we are an amazing place to work. We help care heroes of all types work here, all who deserve great rewards. So while our heroes are working hard to take care of our patients and visitors, we are taking care of them with top-tier benefits, higher pay rates, and great sign-on bonuses. So join our team today. So what are you waiting for? Apply today! Incredible opportunities await at PMCJobs.org. Had it not been for Social Security taking away Vanessa's benefits, Stapleton says those funds could have helped Vanessa receive proper medical attention. Oh, well, that would have helped her like with her bills and stuff, that would have helped get her where she'd have better insurance to get her better therapy and everything and then plus getting her back and forth to the doctors and everything better and stuff. It just, you know, it's a struggle when, you know, you don't have that and like I said that insurance is worth a fortune. Through the struggle of not having benefits in the death of Vanessa, something Stapleton hopes others take away from the premiere is to never give up hope. I hope they realize they see, you know, the kind of struggles and everything that we went through ourselves that I know they've got it bad but maybe they don't think that they've got it to where they can't try to, you know, try to fight for what's theirs and try to get back what's theirs, what is right, you know, I'm saying to just help them hold on to what they can get and stuff to, you know, try to help themselves. For Mountaintop News, I'm Joel Courgel.


Suria means, you know, sun. As we were just now talking, sun is a source of all energy. We're here today because of the sun. The planet and the moon has a role to play, but the most important thing is the sun. If sun's rays do not fall upon this planet, there is no possibility of life. It's finished. So, this sun is not just about light, every moment your life is kept up because of the sun. The influence of the planet and the moon is definitely there, but the volume of influence of the sun upon life is too big. So one thing that we decided to do was to be in tune with him. If you're in tune with him, the cycles of the sun, then physical health, well-being, vitality, energy, these things you don't have to bother. They're just there with you. The sun's cycles happen in once in twelve-and-a-quarter to twelve-and-a-half years. The moon's cycle happens in twenty-eight days. A female body is aligned towards the moon. It is because of that we are born, it is because of that we are here. That is true on one level.  Without it nobody can… The very warmth in our body which is a sign of life is only because of the sun. So how to get in tune with him so that your cycles will run in twelve-year cycles, not less?  This is the basis of all spiritual sadhana which is physical in nature so that you get in sync with the cycles of the nature. Your existence here is not free from the cycles of what's happening in natural conditions. Suryakriya means act… you know doing the sun within you. Because there is a sun within you, otherwise you wouldn't be able to maintain this temperature, isn't it? If you cannot maintain your body temperature, you're dead. See, you can make this body either the key to the existence or you can make this body a roadblock in your life.  This itself is a great thing for a lot of people because nothing else has been explored. Life happens in many, many, many dimensions, all the time happening, but not in the experience of most people unfortunately. That's how life is right now. Only one dimension is being perceived. It seems quite okay. Only when you see the other, you realize what's being missed, isn't it? I mean Suryakriya is a powerful system in that direction. Particularly for one's physiological and psychological balance. Why is this balance so important? Balance is very important. Suppose you're riding a bicycle, anybody still riding a bicycle? Okay, you're riding a bicycle. If you don't have proper balance, this itself is the greatest thing in the world that you're doing. But once your balance is very good, you can look around, you can text, you can blow a kiss, you can do whatever you want, you can leave your hands, you can adventure into life because you have balance. If you did not have balance, that is the only thing you will do. Riding a bicycle itself is a great thing. Right now life has become like this for most people. Earning a living itself is a great thing. Remaining sane itself, maintaining your sanity itself is a great thing. Just being peaceful itself is a great thing. No question of adventure in life. But if you are peaceful and joyful and it is very balanced, no matter what happens, this how you will be, you would adventure into many things, isn't it? You would try many things. You would try to explore all aspects of life. Every door that is possible you would like to open and see what is there.  If I don't get into trouble, that's enough. Lot of people have arrived at this level of retirement. You should not retire when you're there, when you're alive. You retire when you're dead. You may change your activity from going to office to something else. But how can you retire when you're alive? You retire means you died, isn't it? You may leave your office and do something else. That's okay.


Good afternoon everybody and welcome to Unfiltered. Yeah. Pastor, a question was asked to me in regards to children or children being in sports. And it seems that recently that travel ball or travel sports has become a big thing within families and families at attend church. And the question was, is there a balance between our kids or kids being in sports that are on Sundays versus coming to church on Sundays or and or on Wednesdays? What's your thoughts about that? That's a good question. Obviously, we want our children to find recreation. If they have athletic ability or enjoy athletics, obviously we want them to participate and enjoy themselves. You played a lot of all yourself. You were on traveling teams. I played a lot of sports even up into the military. I played on our company baseball team or softball team. I played a lot of sports in the church. I see the value of it because it's not so much that it forms your character. It exposes it. So you have a lot of opportunity to see what you're really made up of and see what you're able to do physically as well as becoming aware of your values and sportsmanship and things of that nature. So on the one hand, I enjoy sports. I don't play it obviously anymore. My kids did and to some degree. So on the one hand, I see it as valuable because of the physical fitness and the various other things pertaining to that. On the other hand, not every child is going to become a professional soccer player or baseball player, basketball player or whatever. Not every child has the capacity to and we know that in a world that likes to give trophies to people for participating. The fact of the world is that not everybody gets a trophy for first place. You have to earn it. And so not every person who plays in a competitive sport will rise to start them. Not everyone is going to be the best ball player. Not everyone is going to be in college the best ball player and not everyone of those in college are going to end up in the professional leagues and all of that for whatever sport it may be. And so I think that we have to be very careful that we don't implant within our children in part to them a false sense of what is valuable. You see, we all get the same amount of time a week, 168 hours. All of us do. The world gets our children overwhelmingly more time than we're able to invest in them in terms of Bible studies and church attendance. It's just if you bring them on a Wednesday night, they're going to be with us for an hour and a half. You bring them on a Sunday, about the same.  The world will teach them values that you as a believer don't own. They will. You know, one of these days I'm going to have these cars, I'm going to have all these rings, I'm going to have this jewelry, I'm going to have all of these. No, that's not true. What you're doing is you're chasing after something that doesn't, it isn't going to fulfill, even if you obtained it. And that's what Solomon said in Ecclesiastes. He said, I had everything a man could imagine from money, from wine, women, buildings, you name it. He said, it's all vanity. So he said, the only thing that matters is to fear God, to know his commandments and obey him. That was a summation of all things in Ecclesiastes chapter 12. So I would say to parents, if you do not teach your children to love the Lord, the world will teach them not to. If you don't teach them the importance of the word of God, the world will teach you that the word is not important. If you don't teach them that fellowship in church with like-minded believers is important, the world will explain to them why it's not important. The world is after our kids, the games that they play on PlayStation or whatever, the movies that are made that are revisionist of even children's stories, Disney's real big on changing things.  And so how do I feel about sports? I think sports are great. I think they should be played when possible, but never to the point where I travel on a Sunday and think that by giving my kid a five-minute devotion before a game or pray with them at night, that that is going to impact his soul forever.  They need the word, they need prayer, they need it modeled, faith modeled by their parents. They need to be around a believing community and they need to have the values that the word of God teaches. They need to learn sportsmanship when they lose. They need to learn all of those things. And that comes, I think, through a proper understanding of the standing in the Lord. Times have changed because I remember growing up, you never played sports on Sundays. No. It was always on Saturdays. And so it's another thing, another distraction that's vying for our children's time. I read this statistic, Pastor, and it said, .00098 will make any major league or professional ball in all of the population, but it's 100% that they'll stand before Jesus. Amen. And that's a statistic that I have actually in our house. And so I just wanted to get your feedback on that because you see more and more people pulling their children away to play sports on Sundays and it seems like it's a common thing and is there a balance to that? They need to get to church. The children's eternity is at stake. And if a parent doesn't value their walk with the Lord, the child never will. I was just speaking to somebody and I'll close with this briefly.  And at one time his child had an interest in Jesus. But because this person was lax in their walk, the child no longer has a desire or hunger for the Lord, but is actually modeling himself after what he saw his father doing. And his father had walked away from the Lord for a while. He returned, but his son has it. And there was a guy I knew very well. One of the saddest things that I can remember his son ever telling me concerning his father is this. He said to me, I never want to be anything like my father. So think about that for a moment. So the fathers and mothers, we need to be in the Word of God. We need to pray with our kids. We need to bring them to fellowship. We need to encourage them in their walk. And we need to be strong ourselves, especially in these last days. Amen. Well, thank you, Pastor David. And thank you for sharing that with us. And we do want to invite you to our service, our Sunday morning service at 8.30 and 10.45. Great opportunity to bring our children, bring our loved ones, our families to hear God's Word, to be involved in worship. So we look forward to having you come out and join us. And thank you for joining us today. God bless you. We'll see you soon.


That's a pretty big stage Hello, everyone Perfect. So yeah, welcome everyone I want to give you a quick introduction into running a static WordPress website Let me quickly introduce myself a little bit further and There are not that many bullet points here, but I thought it's fine So I'm a WordPress developer since 2010 and I'm also the developer behind simply static which is a static site generator plug-in for WordPress We will see a quick view into it in a minute I'm also a solopreneur, which means I'm running Plug-in business full-time selling maintaining building plugins and so on so yeah, let's get started with static WordPress So yeah, the start is pretty obviously So we have to make our WordPress website static. What means static? We take our dynamic WordPress website and make converted back into HTML CSS JavaScript and obviously Leo image files Pretty much like 1999 but in a good way. So I built this little plug-in called simply static You can see a screenshot on the right hand side of the screen And the generation process is pretty much straightforward So you can install it for free from the WordPress open Pory repository Activated go to simply static generate and there's a big purple button label generate static files and you can click on it And the process starts running Depending on the size of the website that might take away So I would suggest for testing purposes. You might take a little bit Is a Simpler website to get started Once the process is finished, you will get the download link where you can click on and it will download the zip file containing all the static files So next step Let's talk about hosting It's a little bit different compared to what you might be used to when it comes to traditional WordPress hosting because you don't need an actual database and you Probably don't even need to have WordPress hosted somewhere and it's that use like something like doke local WP So Where do you host my static website? Well, that depends a little bit on how familiar you are with certain concepts For example GitHub So if you are familiar with GitHub and you know the basics to upload your files to GitHub repository and connected. I would suggest using GitHub pages or Cloudflip pages. Let's see to it to at the top Because they are free. They are pretty powerful and you get a lot out of the box without Having to worry about things like caching and so on If you aren't familiar with GitHub and you're looking for the quickest way to get started I would suggest starting with Netlify Netlify provides a little drag-and-drop zip uploader where you can simply drag and drop the zip file You got from simply static and uploaded to Netlify and you immediately get your static website running on a temporary Domain that you can use you can always switch on your preferred domain later If you're a fan of traditional deployment Which means using SFTP and copying over your files. You can do that as well The both the two most popular options here are digital ocean spaces and obviously Amazon S3 So now that we have a static version of our website and we have probably already deployed it to a hosting provider Let's take a quick look at some dynamic features and how we can make them work on a static WordPress website So, yeah pretty much every website these days has some kind of form be it a contact form or a newsletter sign-up and You still want to use like a contact form on your static website. Sure. So there are Different ways you can handle that there are external tools you can use but in my talk I'd like to prove I like to stay to WordPress as close as possible So we use in contact form seven. There's a free plug-in Available for contact from seven which is called CF7 to webhook that you can use to offload the submitted data from The form the user has submitted on the front end to an external webhook a pretty popular service You might already know is Zapia Zapia is like an no-code Automation tool and you can send off the the data from the contact form to Zapia and in Zapia you can configure Get all that data converted to an email and send it to me So this way your traditional WordPress website isn't involved anymore in the steps and you can still Use and style and modify your form based on contact from seven as you already used to The next popular thing is search so the traditional WordPress search works with PHP and URL parameters And both will not work on our static website So we need some kind of replacement while they are a lot of Different tools in the positive use case and some of them are pretty powerful and some of them are simpler I chose the simplest one which is Google custom search engine Google custom search engine is like a Little external tool you can sign up for free and you get like a little API key that you can use and in combination with the plug and mention WP Google search The only thing you have to do is copy in the API key and save the settings and you get a short code and returns that you can place anywhere on the web On your website and it will render a little search box Already available with auto suggest so once the user type something in Search results will pop up if he hits enter or clicks on the little search icon provided It will open a pop-up which contains search results from Google But limited to your own domain which is important because you don't want your competitors in that in your own search results, right? So yeah, that's pretty much the second important part now we have covered the basics and you probably Have a question in your mind Why the hell should I use the static website? So why the extra effort and what are the benefits? So let's quickly cover them One thing that a lot of people already know is that static WordPress websites are pretty fast That's because there is no database interaction. There's no dynamic processing Everything is already generated and we just deliver the static fire and optimized assets to the user or to the user's browser So speed is obvious, but the impact on the performance is even higher if you compare to a bigger website Let's say you have Traditional business website, but translated into seven languages depending on the plugin or On the on the framework you have used to do that that might take some time for the user to get the translated page so to Speed that up we can pre pre-generate and pre-convert the HTML files for each language and once you use a switch the language He automatically gets the translated HTML page back and that is a lot faster than compared to a traditional Multilingual website even with a powerful caching and some kind of premium hosting Another important benefit for me even more important than speed But I know every everyone is kind of hyped about performance Is security so a static website is almost unhackable. Why? Yeah, because Hacker doesn't have any Expert vectors that you can use to inject malicious code into your website or Try to inject some additional styles or whatsoever so because your website is Static and your database and WordPress is Either offline or protected behind basic or end or a firewall A hacker will have a pretty hard time to do anything relevant to your website as long as it's static The third point and I'm sure you agree with me is maintenance So Updating the WordPress website can be a pretty daunting task, especially if it's not your main business Let's say the average business with a website How often do people take care of updates? There's several Plug-in security updates each week. There are multiple WordPress updates each year. Maybe your themes updated each month Who knows so it's cool if everything works as expected if you click update But that's not always the case. So if you have a static website, you have like a snapshot in time So you have your static website running no matter what happens It will remain unchanged on the other side. You have your WordPress website with us now practically a free staging environment for you to update to test to Do whatever you want and only if you're happy with the results and you have tested everything You will update the static website and get the updated changes to your Official websites, so to say there are a couple of other benefits. I tried to keep a charge One I like to mention is cost reduction. So I'm sure we can argue about that, but I would say premium WordPress hosting is kind of expensive Especially if you want something secure reliable Automated backups done for you. So compared to that static hosting is insanely cheap So we're talking about depending on the website site and service about one euro or dollar per month Or even per year depending on the traffic the site of the the size of the websites the amount of pages and so on Another thing it's not really a benefit, but a question I often get is the difference between headless and Static WordPress headless WordPress often use Jamstack which requires to rebuild your existing website or Build a new design based on a modern JavaScript framework like React or Vue.js Swelty or whatever While as static WordPress is a static replication of your existing websites, so you Will still use your existing tools your existing theme your existing plugins You may have to adjust one or the or another, but all in all it's your WordPress website Replicated as a static one that you can use right away without any technical requirements involved so That's all for me One thing I like to notice certainly I missed to add the download link to the presentation I collected a pretty detailed page Containing all kinds of tutorials and additional links and resources. I will share that in a minute on Twitter But if you see me running around There's a QR code on my back You can scan that and there's a link to the resource page where you can download the presentation and all the additional information So that's all for me. Thanks for your attention and have a good day


Hello everyone, my name is Ashokan, my team members of Mr. Navav and Ms. Mamini Faridha. We are going to discuss about an analysis of energy balance for Australia. Australia is the sixth biggest country in the world, they are having the population of 2.5 crore. Out of this 30 percentage people or youngsters, those who are contributing more in their GDP. The net expectancy of Australia men is 75 and women it is 80. The literacy rate of Australia is 99 percentage. The GDP comes from Australia is most of them from service sectors, then industry sectors, then agriculture. We will talk about the energy, 40 percentage of energy consumed from coal and 29 percentage comes from natural gases. But the amount of renewable energy is very very less. The sector wise transportation sectors and industry sectors consume more energy. From the sankey diagram it is clear that the coal productions having the lion share and next we have natural gases. It observed that 63 percentage of electricity comes from coal alone and there is no significant contribution from any renewable energy sources. This is primary energy consumption by source and sector diagram. The source are coal, natural gas, oil, renewable etc. The sectors are residential, industrial, transport etc. The transportation and industry sector consume more energy in Australia. From the kaya identity it is very clear that the carbon intensity is higher in Australia. What is carbon intensity? The CO2 emission for generating particular amount of energy as well as the energy intensity means it is measured as unit of energy per unit of GDP. So here the energy intensity is Australia is higher than India. Cumulative annual growth rate for various indicators given here it shows that the net energy imports each and every year it is increasing as well as the CO2 emission is higher compared to India for Australia. But the per capita energy consumption is very good compared to India in the case of Australia. Regarding the significant policies, Australia has the target to reduce 26 to 28 percentage of CO2 emission by 2030 and Australia having the target like large scale renewable energy target and small scale renewable energy scheme. The large scale renewable energy target it says that those who are using more energy for their industry operations some particular amount of energy they should use from renewable energy. The small scale renewable energy scheme it supports the people those who are using renewable energy sources by providing subsidy. Also clean energy finance corporation and Australian renewable energy agency providing fund to the agencies or industry those who are working on renewable energy sources. Regarding energy security of Australia because of rising energy price as well as tightening gas market on the east coast as well as numerous power outages slightly there are having lower side of energy security however it can be improved by using renewable energy sources in further days. The energy bottlenecks for Australia is infrastructure mainly that is they have to invest more and more money for the electricity transmission as well as storage of energy. Structured electricity infrastructure framework definitely needed for them and working on reformers of electricity market is compulsory for Australia to develop. The main bottleneck is when the CO2 emission is reduced the coal plant supposed to be stopped or reduced. So that time the employee of coal plant will may lost the job it will spoil their livelihood for India. The development of life cycle is life style is very important for India the reason is per capita per capita for India energy consumption is less compared to Australia. It shows that the life quality is supposed to be improved and the investment for the renewable energy generation supposed to be improved as as Australia is improving day by day. The electricity laws in India is 25 percentage whereas in Australia just 5 percentage it shows that we have to give more concentration to save the electricity for Australia per capita CO2 is huge in Australia. So diversification of fuels also they should take care of and India we have national energy policy it it providing or it it is intend to provide affordable energy with good energy security and improving energy security for the systems. Australia should have the structured long term policy plan like India's having as well as India's NDCs about to reduce 33 to 35 percentage of CO2 in the near by future the same kind of plans Australia should take care. Say example India is installing 175 gigawatt of room energy by 2020 that is our target as well as Australia should go ahead with the renewable energy in the faster manner. For the conclusion Australia having lot of CO2 emissions per capita CO2 emissions is very high they are having lot of uranium energy as well as sunlight. So they can make use of uranium and sunlight they can start the renewable energy source like solar and uranium so that the CO2 emission will be reduced as well as diversification of fuel is very very important for Australia as the energy security can be improved because of that. The energy bottleneck should be taken care of Australia to taken further step for the renewable energy sources thank you.