Hello everyone, and thank you for joining my talk today called Don't Be Silly, it's only a light bar. Before we begin, just a brief introduction. My name is Eyal Itkin, I'm a vulnerability researcher working at Checkpoints Resource Group. In my research projects, I tend to focus on embedded devices and network protocols, and in which case I combine these both together. You can easily read more about my recent publications on my Twitter account. The motivation for this specific research started a few years ago in 2016 when I heard of a new smart IoT device, smart light bulbs. I was already quite familiar with many smart gadgets and even smart air conditioner, which allows you to activate it remotely on your way home so the temperature will be just fine when you arrive. But why would I need a smart light bulb? I only need a light when I'm physically in the room and I'm fully capable of toggling the switch on and off when I enter and leave the room. Why would I need an app for that? Well, I figured out that it won't catch, people won't bite, and that's it. And apparently I was wrong. Because according to a report from the end of 2018, more than 400,000 households in the UK were already using the smart lighting solution, so people are apparently buying this gadget. Okay, but if I connect my light bulb to the mobile phone or to the internet, there will be some security risk about it, right? But when I ask people about it, I always receive the same response. Don't be silly, it's only a light bulb. It's fine. Obviously, I'm not the first to study this test case, and there is some great firework before me. We will start with a light bulb worm by Colin Loflin and Aya Ronin, which presented their research on blackhead USA on 2016. Later on, they developed the research into IoT Go's nuclear, creating a ZigBee chain reaction. This time they were joined by Adi Shamir and Achiyo Vangarten, and you can read about it on their website. I really recommend you reading about the research because it was so cool they actually took over all of the light bulbs on campus in a war-flying demo from their drone. Since I already was familiar with Aya Ronin's work, and both Aya Ronin and Achiyo are all colleagues of mine, I talked with Aya Ronin and together we decided that with his help I am going to continue on their research and take it to the next level. So, what did they find? Well, it turns out that attackers can remotely steal a light bulb from a given ZigBee network and force it to join the drone. Once it joins the network, attackers can send the light bulb a malicious firmware update to fully take over it. And if that wasn't enough, it turns out that even a regular light bulb can steal other light bulbs and you don't need any fancy RF equipment or an antenna in order to do it. Using these three primitives together, the researchers claim that you can take over a selected set of light bulbs in a given city. From each light bulb you take over the other light bulbs in close proximity and so on and so forth in order to propagate and take over all of the light bulbs in a given city in a nuclear-like chain reaction. Sadly for us, the vendor did fix the last vulnerability and we were only left with the first two. If you put it visually, we can see the network diagram over here. On the right, we can see a smart light bulb which communicates with its bridge, the controller, over ZigBee radio. The bridge is connected to both the radio network and the commuter network with an Ethernet cable so we could control the light bulb from our mobile phone through the controller. The attack itself will start when the attacker will transmit ZigBee factory reset messages to the light bulb in order to confuse it and convince it to join their own network. Once you join the network, attackers can send the malicious over-the-air firmware update to the light bulb to fully take over the light bulb itself. And while the original research only focused on the light bulbs, we are focused on a much broader target and we want to take their research to the next step. We want to infiltrate the network. In order to infiltrate the network, we are hoping to find a vulnerability so that our light bulb will be able to remotely exploit the ZigBee vulnerability in the bridge itself in order to take over it. Once we took over the bridge, the bridge can launch attack inside a computer network and hopefully allow us to take over the computers inside the network itself. Once we understood our attack vector, it's time to get started. But first, some preliminary slides on ZigBee. ZigBee is a suite of high-level protocols for closed-box AMD networks. It's an IEEE 802-154-based specs that defines a low-range low-power radio. Now to be confused, we have IEEE 802-11 which stands for the more commonly used Wi-Fi. The maximum transmission unit, or the MTU, over ZigBee is only 127 bytes long. And I'll repeat that. The maximum packet we can transmit over the air contains only 127 bytes. And with this harsh limit, we should be able to somehow exploit vulnerabilities that we hope to find in the bridge. ZigBee has a full network stack of its own. Like any other network stack, it's out to the lower levels, which is the physical layer and the medium access controller, which acts as the internet acts in normal computer networks. On top of that, we have the network access layer, which is responsible for both routing and encryption. Above that, we have the application sublayer, which is responsible for routing our packet to the respective application in the upper layers. This application could be ZDP, which stands for ZigBee Device Profile and is responsible for managing different aspects of the ZigBee protocol. It could be ZCL, ZigBee Cluster Library, which is responsible for managing the configurations of the different devices. And it could be whatever other application that the vendor decided to implement. Now that we understood how ZigBee works, it's time to meet our target. The target for this research is going to be the Philips use smart lighting, now under Signify. Signify controls approximately one third of the market in the UK, so it's a broad target. And we're going to focus specifically on the bridge, because as we mentioned earlier, the bridge is connected to both the radio network and the computer network, and we hope to bridge the two. Specifically, we're going to focus on the second generation of hardware for the bridge, which is the rectangular version of the bridge as seen on the right. If you remove the plastic cover from the bridge, we can see the board. When looking on the board, we can see on the right the main CPU, which is a Qualcomm CPU usually found on Wi-Fi enabled devices. Over the left, we can see an Atomil CPU, which we'll refer to as the ZigBee Modem. And like any other embedded device, we have a clear pinout for serial debug, which turned out to be quite useful throughout this research. The main CPU is a MIPS architecture, which is quite unique, and the operating system is Linux. This is quite refreshing because in prior research projects, we mainly had to handle real-time operating systems, which are harder to debug. This time, since we have Linux, we hope to be able to route it and to access it directly using an SSH connection in order to extract the file of the firmware itself, and in order to hopefully install a remote GDB server in order to debug the device. And luckily enough, Colin of Lin details in his blog exactly how to route the bridge with a step-by-step guide followed by a video. Once finished, we will get a route SSH connection. When I started this research, Aaron told me that the bridge is using a single huge process that's pretty much doing everything, and this is the IP bridge. The IP bridge is a single process that acts as the brain of the device. It is responsible for parsing incoming signal messages, maintaining the different signal state machines, and pretty much doing everything it needs. And like any other embedded device, IP bridge runs with route privileges, which means that once we took over this process, we won't. We don't need any other vulnerability. Now that we saw all of this data, it's time to start looking for vulnerabilities, and IP bridge is going to be our target. We had quite a slow start to begin with because due to technical issues, I couldn't route the bridge. It turns out that I don't have the right hardware equipment, as my younger brother pointed out. And the package we ordered got delayed, like pretty much any other research project I've done thus far. Instead of sitting idle, we decided to start working on the old firmware version, which we received from the original research team. This is a firmware version, which is a few years old, and we really hope that it didn't change a lot throughout the years, but we really don't know. We simply have to cross our fingers and hope for good. When analyzing IP bridge, we soon enough saw something quite odd. The code expects strings to be found inside and coming messages instead of bits, because we can see the strings as such as ZDP or ZCL or even connection, but the maximum message size is only 127 bytes long. We don't have enough room for textual strings. We have enough room for mere single bits, and that's it. So what's going on? And things got complicated. It turns out we forgot about the ZigBee modem. The ZigBee modem uses Atmel's BitCloud SDK in order to parse incoming ZigBee messages before they arrive to the main CPU. Effectively, it acts as a co-processor, but handles the ZigBee lower network layers instead of the main CPU. It converts the parse messages to textual form and sends them over to the main CPU to be handled. And, of course, we don't have the firmware for it, so it's a black box. It reduces the attack surface on the main CPU because complex parsing is offloaded to the modem, and if the main CPU doesn't handle a specific task, it can't be vulnerable when doing so. And we don't fully control the messages which are sent to the main CPU because they are constructed on the modem itself. And if that wasn't enough, it puts a huge question mark on everything we find because maybe the modem checks it. Maybe there's no check at all. So, we'll have to add this to the list of ongoing issues and really hope for the best. Our first vulnerability attempt focused on ZigBee cluster library, which is ZCL. ZCL is responsible for managing configurations and it really is similar to SNMP in traditional IT networks. It offers a read attribute, write attribute interface, and it supports multiple data types. The first data type is Boolean. Then we have an unsigned integer of 8 bits and unsigned integer of 32 bits and even a dynamic array. And a variable size data type in an embedded device is a true recipe for vulnerabilities. It looks promising. When we dived in to look how ZCL arrays are being parsed in the code, we saw the following code snippet. Here we can see that at first, a one byte length field is read from the message and then a fixed buffer is allocated over the heap with 33 bytes. Don't be confused by the delay slot in MIPS. The assignment into register A0 is done chronologically before the invocation of the malloc function and that's why it's called a delay slot. Effectively, we allocate a fixed size buffer over the heap and that's it. Later on, we read the entire blob from our attacker's packet into the fixed size buffer. And what does it mean? Well, a controlled one byte name copy into a fixed size heap buffer invets the definition of a heap-based buffer overflow. Sadly for us, it isn't a vulnerability until we have a working proof of concept to trigger it. We don't have the latest firmware and things might get changed. The modem might block large ZCL arrays we don't know and we can't test it because we don't have the radio equipment to transmit the attack and check it. Luckily enough, the package arrived quite in time and we can now root the bridge and extract the latest firmware and check if something got changed. And of course, it did. It turns out that now ZCL arrays are no longer supported and instead there was an additional support for ZCL strings. But if we look on the support of strings we can see that the following code was changed. Now we allocate a dynamic buffer on the heap using the one byte line field plus an additional one byte for the added null terminator. This means we don't have any vulnerability this time, which is bad. Of course, we still have some good news because as you can see the firmware was shipped with debug symbols. For some unknown reason the new firmware version supports and was shipped with all of the names of all of the functions in the firmware which was really quite useful for us for reverse engineering the new firmware. So what do we have? The latest firmware version got support for ZCL arrays because now they use strings instead and strings don't have vulnerability in them. It's a good time to search for other vulnerabilities and we did try. We really, really did try and we covered most of the firmware and still we found pretty much nothing. And then we remember the ZCL strings were handled correctly and sent to another thread. But what does this thread do with the incoming ZCL strings? So we traced it down to this code snippet. In this code snippet we can see the same memory allocation over the heap using the same fixed size we saw earlier. So that's quite suspicious. We can even see that later on the buffer is being copied to the newly allocated heap buffer using the length field stored in the struct itself without any side checks. The only condition for reaching this code snippet is to have the fixed size of code of 16 stored in our struct. And when we go back to how we initialize the ZCL string struct we can see that it indeed uses the same opcode 16. So it turns out that someone forgot to finish the migration from arrays to strings. Strings should have been marked with f for strings and then be duplicated using a call to strdup. Instead for some reason internally they are still marked with 16 for arrays and are handled using the same vulnerable code snippet we saw in the earlier firmware version which is quite good from our perspective. So the original vulnerability still exists it is just buried deeper, that's all. Time to start transmitting ZigBee messages and hope to trigger the vulnerability. In order to play around with ZigBee like the previous research we decided to use the ATmega256RFR2Expo board. It enables us to send and receive ZigBee frames over the radio. It should be computationally equivalent to a light bulb which is quite important because we are going to do all of our exploit from this board and if we will succeed then the same exploit could have been performed from a light bulb we took over using the previous research findings. In addition it turned out to be even more important because there are really strict timing constraints in ZigBee and the timing constraints dictate that we actually use C code from the board itself. We can't use Python from our laptop for example. This means that the entire ZigBee code the entire ZigBee stack that we need to implement should be in C and the entire exploit should also be implemented in C. So it's not going to be easy but we'll have to leave with this. And the vulnerable flow is only accessible during the process called commissioning. And what is commissioning? Well, commissioning is a process of pairing and associating a new light bulb. We have two types of commissioning. We have classic commissioning and we have touching commissioning. The Philips U app on Android which we use initiates a classic commissioning process and so we focus on this one. Technically in theory the ZigBee specs explain the entire process. In practice there's a lot of room for vendors to do as they wish and trust me they did. When analyzing the protocol we got quite stuck because there's no documented flow or at least no documented flow we could find. There's enough documentation for the structure of each specific message but we don't know what message is supposed to be sent and when as a response for what so we don't have any clear flow of commissioning. In addition, we can't sniff a full conversation from our light bulb and the bridge because too many messages are sent and they're sent too fast and we simply miss some of them. If that wasn't enough we needed cryptographic key. There is a transport key which is shared between all of the ZigBee light devices but we don't have the key inside so how do we get we need to decrypt the messages from an early phase in the commissioning we will need the key. Luckily for us we are not the first to tackle this issue and in this blog post you can find all of the information for all of the keys used in touch and in commissioning and in classic commissioning with the values of the keys themselves. So we took the keys we inserted them to Wileshark and Wileshark can now automatically decrypt the messages with sniff. The analysis and the implementation part took a lot of effort. A lot of work days. But eventually it worked. We managed to fake our own light bulb you can see a brand new checkpoint research light bulb with the model CPR123 so now our board is doing all of the classic commissioning phase faking our own light bulb so we could continue on. In order to help other researchers with this task we decided to open source the full pickup of the classic commissioning as we sent it from our board. So instead of other researchers having to manually analyze the commissioning phase we can now look on the pickup the decrypted pickup with all of the messages we have sent. The lessons we learned fast for are without user interaction the bridge won't accept new light bulbs which is a good security precaution but it doesn't help us. We will need somehow to bypass this limitation. In addition we have approximately one minute to commission as many light bulbs as we want there is no check about it. The user will only see the light bulbs in the app after they finish the specific phase we labeled ZCL phase which is pretty much the last phase in the commissioning. If we fake other light bulbs and we stop before the ZCL phase the user won't be aware of that which is pretty good for our attack. And the really good news is we managed to trigger the vulnerability during the ZCL phase so we have a success. We really have a vulnerability. There is no state machine check in place we can simply send whatever ZCL strings we want whenever we want without any request to get them so we can pretty much do anything we want with the long ZCL strings as long as we do it quickly during the commissioning. Once the light bulb was fully added to the network it can no longer trigger the vulnerability the vulnerability will only be accessible during the commissioning phase. Time to start the exploit. Just a basic recap on our vulnerability before we continue. We have a linear based buffer overflow over the heap. Our buffer size is limited to 70 controllable bytes and this is because we only started with 127 bytes which is the MTE on ZigBee and the ZCL is quite high on the ZigBee stack so we lost a lot of bytes due to headers. We will have to settle down with the 70 bytes we have. We don't have any byte constraints on our payload which is good. We can send null bytes non-printable bytes pretty much everything we want and the destination buffer is allocated over the heap using a fixed size buffer of 43 bytes. Time to focus the heap. The breed uses uclibc which is an old embedded libc implementation used in embedded devices. The chosen heap implementation inside uclibc is the malloc standard which is the lmalloc behind the scene. Effectively it is much like glibc but with way less sanity checks. This is because uclibc stands for microlibc it is meant to be used by devices without a lot of CPU power so it has to be slim. And being slim means less code and less sanity checks. All of our 3 buffers will fall into the range of what is called fast bins. There's a bin for each buffer size in multiple of 8 bytes starting from 16 being the minimal size. So we have a buffer for a bin for all of the buffers up to 16 bytes a bin for 16 to 24 a bin for 24 to 32 and so on and so forth. Inside each bin we will have a singly linked list of all of the 3 buffers. When examining the code for free in uclibc we serve a following check. If size is less than or equal to some configurable amount called maxFast we will use the fast bins and store our buffer inside them. In order to find the respective fast bin for our buffer we will use the fast bin index macro we can see over here. In short, the macro divides the size by 8 and subtracts 2 because 16 should be the minimal size. But there's no check in place that the size indeed is bigger or equal to 16 so if we will be able to corrupt a buffer over the heap and modify the size we could change the size to be 8 even 0 giving us the indices of minus 1 and minus 2 respectively. In order to understand what will happen if we will use negative indices we can see the malloc stays stuck over here and the variables before the fast bins array. So if we will use index minus 1 we will store our buffer on top of the maxFast before the fast bin array. Storing a pointer over the configurable size for fast bins will be too risky. It will simply ruin the heap. But what will happen if we will use index minus 2? Well, index minus 2 will store the pointer to our buffer before the malloc state variable and before the malloc state is stuck in memory it turns out to be an unused variable simply nothing. So if we free a buffer with size of 0 it will be stored somewhere in memory before the malloc state and no one will reach it. The next buffer will be joined to it creating a ghost link list we can refer to as the dev null fast bin. Since malloc is not aware of this bin it won't extract buffers from it and all of the buffers with free will be joined to this bin but won't be returned to the heap itself effectively enabling us to gradually shape the heap in the desired structure. The plan for our heap overflow is quite simple. We can see our buffer in blue and a buffer adjacent to it in memory in purple. The plan is to modify only the size and the pointer of the adjacent buffer. If we change the size to 1 which means a size of 0 bytes and 1 for the previous buffer is in use then the buffer will go to the dev null link list because size 0 will reflect it to index minus 2 and the pointer will be changed to be our arbitrary address. Effectively we want to get this structure. We want to corrupt the singly link list inside the fast bin so that an arbitrary buffer will be stored or at least malloc will think that an arbitrary buffer will be stored in our arbitrary address. The goal is we want to confuse malloc so it will allocate a buffer at an arbitrary address and then we let us write our data into this buffer. Effectively giving us a write what were exploit primitive. The heap shaping strategy is as follows If we overflow the free fast bin buffer then we won. This is exactly what we aim at. We corrupted the singly link list inside the fast bin and we will get our allocation. If we overflow the use buffer then when it will be freed it will go to the dev null fast bin and we won't see it any longer. If we overflow the use buffer that leaves forever oh well nothing would happen and no one will notice it. But if we overflow the free large buffer then we're in trouble. We'll probably crash soon so we really don't want to do that. If done correctly we will get the desired malloc wire printed. Malloc wire will grant us the ability to write over the got. The got is the global offset table. It's a global table of function pointers used to execute library functions such as free, malloc, sleep memcopy and pretty much every other library call. And luckily for us the got is a fixed address. The modified function pointer will jump to our shell code or at least in theory because it sounds easy in paper but it's way harder in real life. Time to construct the shell code. Location, location, location we need to store a binary shell code in a fixed global address. The problem is we only get textual messages from the ZigBee modem so we don't get any controlled binary data into the main CPU. We found only one good candidate for such a possible buffer and this is the ZigBee phone book. This is an array of ZigBee addresses seen by or advertised to the bridge. It can hold up to 65 records of 16 bytes each, giving us an upper bound of approximately one kilobyte for the entire shell code. It's not a lot of bytes but it should be enough for us. The enable record inside the ZigBee phone book is constructed as follows. The first 8 bytes are for the extended network address, which we fully control. After that we have additional 2 bytes for the short network address, again fully controlled. And our stock of lack ended, which is quite reasonable because now we have 6 bytes for miscellaneous fields and we don't really control them. So we have 10 consecutive bytes we control but we don't control the entire memory. Oh and about that, it turns out the bridge is unstable when it gets more than 20 records so this is going to be quite a small shell code. The initial plan was simple. It looks infeasible to restore the execution flow because we pretty much were in the heap. Instead, our shell code will try to patch the binary on the file system and install a backdoor. After the process will crash a daemon will reboot the binary with our backdoor and then we will trigger it from another light bulb. The problem is both the patch and the file path don't fit in 10 consecutive bytes each so we can't decode them properly in the ZigBee phone book. The solution for this problem is purely academic. An ideal shell code by reduction will be use the 10 consecutive bytes per record to build a decoder and the decoder will decode the rest of the records to be nicely ordered in memory. In MIPS 16 a jump to the next record will only cost us 2 bytes giving us 8 spare bytes in each record to construct our decoder. But there are problems with this plan. We need to clear the instruction cache before jumping to the unpacked shell code because this is a MIPS CPU and we crashed when trying and if we use sleep to clear the cache as people usually do the watchdog will kill the process because it doesn't respond. And we don't have enough records to silence the watchdog sleep and use a decoder so the ideal shell code is good on paper but it's not practical. Instead we want for a more bold design. We will restore the execution flow. We really don't have any choice. This means we will call MProtect to modify the permissions of the code in memory from executable to be executable and writable and we will install the backdoor in RAM during the execution. A few days and one hand crafted shell code later on we have a shell code that fully restores the execution. It restores the got, it restores the heap and it restores pretty much everything we need. In addition the shell code will only cost us 16 records which is well in budget less than 20. And here we can see the shell code in IDAR. From the first record we will jump to the second and then we will jump to the third and so on and so forth until we install the backdoor and restore the execution flow. When we connect all of the dots together the backdoor shell code will give us an arbitrary write primitive. Our exploit will fake an additional legitimate light bulb but we leverage this arbitrary write primitive we install and we will use it to write Scout's loader to memory. Upon execution Scout will load a full payload which in this case we chosen to use a thermal blue. Here we can see that Scout dropped the file on temp exploit with root privileges and this temp exploit file will use a thermal blue to attack computers inside a computer network which is a good time for our demo. Here we can see the light bulb and the user using it. We can see that it works the app works fine and the user can modify the color of the light bulb as he wishes. When the attack starts he will try to hijack the light bulb and steal it from the network and once he joins the attacker's network the attacker will change the light bulb to a hideous color to annoy the user so that the user will see that something is wrong with his light bulb. So we took over the light bulb and now it's ours. When the user sees that something is wrong you can see that he no longer controls the light bulb, he can change the light bulb's color and it seems to be unreachable when it sees it over the app. The only way to reinstall the light bulb is to delete it and tell the bridge to search for new light bulbs and this is where our attack will officially start. We will fake a legitimate light bulb so the user will be happy, this is our light bulb and we will fake it as the user actually configures the light bulb as he wishes so the user won't see that something is wrong with our fake light bulb. Behind the scene the full attack will take place. Here we can see that the bridge is connected to the laptop so it's connected to the computer network and now behind the scene we will use our vulnerability, shape the heap and take over the bridge and from the bridge we will use eternal blue to attack the computer inside the network and pop a cock. So our attack worked. Time for the coordinated disclosure. The vulnerability was reported to signify on the 5th of November 2017. The vendor confirmed the vulnerability on the same day which is quite impressive. It's even more impressive because not only did the vendor send its acknowledgement on the same day when it received our report it actually acknowledged the existence of the vulnerability which it found in the code according to our report so the vendor did pretty much everything in a single day which is very impressive. Later on we should attach via an automatic update on January and you can find full details and advisory in our blog post and the official CVE issued for this specific vulnerability is CVE 2020-6007 and if you have Philips you're lighting in your office or in your home don't worry all of the products should have received the update by now. Conclusion Even with an MTO of 127 bytes ZigBee vulnerabilities are indeed exploitable as we've shown in our demo. Security mitigations only work when they are on by default. The IP bridge binary was compiled to use static fixed addresses so we were able to target the got which was on a fixed address even without an information leak vulnerability. The binary was not compiled with any secondaries the got was writable so we could do pretty much everything we wanted to do once we had an initial vulnerability. Still there was a SLR in place for the heap for the stack and for the loaded libraries and that's thanks to Linux. So if it's on by default you will get it but if you need to manually do something in your Mac file you won't get it in most common cases and small devices are becoming popular by the minute and yet we can't even trust our own light bulbs so maybe we should do something about it. We can't finish this research and this presentation without saying special thanks to everyone that helped make this research possible. So we have Eyal Ronyan for the research idea and the active guidance Colin Oflin for the detail write-ups on routing the bridge and the entire hardware analysis of it for Peter for publishing the ZigBit transport keys for the light bulbs which we used and couldn't continue without and for Yaron Itkin for the crucial hardware support along the way. Thanks little brother. And last but not least for the entire CPR research team for their support alongside this very long research. Until the next time thank you for joining this talk.


I want to dispel two myths I see perpetuated on social media every day about being successful in business. One, you don't have to be ruthless or cutthroat. Being likable and respected are two invaluable assets. Being kind, compassionate, and having humility will make people want to do business with you. Two, you don't have to grind 24-7. Your need to work hard, work smart, and be consistent. But you are allowed to enjoy the process, have days off, go on vacation, and simply unplug when needed. If you can do these two things, that'd be great.


Hello and welcome to Dev Nation Live.   We think we sorted that out and we'll be at a broadcast live for the next 30 minutes giving you lots of great content. We're gonna be here the first and third Thursday of every month. We're gonna keep doing this. We have tons of things lined up as you've seen from the webpage. And today we have a very special guest star, Rafael Benavides, who's gonna give us a really awesome deep dive into Kubernetes. A couple of things to say about Rafael though. He's a director of developer experience here at Red Hat. He's one of our lead senior developer advocates who travels the globe, often doing Kubernetes workshops and getting hands-on with Java developers showing them how to use Kubernetes for the very first time. And today he's gonna give us the nice introduction for how Kubernetes works. And for those of you who have questions, please use the chat window and I'll be verbally giving those over to Rafael or trying to chat back with you and answer them live in real time. But the chat window is your way for communicating back with us. And also keep in mind, this broadcast will go live to YouTube immediately after we hit the close and finish button. So it'll be available to you instantaneously. So that's nice also. So again, if you have questions, hit us in the chat and Rafael, please take it away. Hello everyone, it's a great pleasure to be here presenting to you this introduction of Kubernetes focused on Java developers. So let me start sharing my screen so we can do a journey together through the Kubernetes specifically for Java developers. Well, one of the first things that we need to understand because most people ask, well, Java isn't supposed to be already a multi-platform language. And we need to understand why we want to run Java applications inside containers. And of course, containers have a lot of advantage. It's lightweight. And because it's lightweight, it simplified DevOps practices. It's empowered microservice architectures. And that's why we want to show you how to perform those things using containers and using Kubernetes. Of course, one way to run a Linux container is for example, when you go to your terminal and type Docker run dash D to create a detached process and the name of image. That will create a single and isolated Linux process running in a single machine. But let's go crazy here. Let's think that you have not six, but you have 100 machines on your data center or that data center or on your cloud and you decide to run a thousand containers. And in that case, what are the difficulties? What are your challenges? You probably will face challenges to scale those containers to avoid port conflicts. What we will do to update them, to know where they are running and to answer all those challenges, we have the Kubernetes project. The idea of the Kubernetes project is to be an orchestrator for containers. And it's not focused to manage machines, but focused on managing applications. It's a very popular project. We can go to the GitHub project of Kubernetes and we will see that's very popular with more than 25,000 stars, a lot of commits and contributors. We can see here at the post that the project, since the last week and it keeps moving forward and have a lot of participation. And among this participation, we can mention that Red Hat is the second top contributor after Google itself. It's a project started by Google based on its expertise using containers. Well, Kubernetes has the following architecture. Everything runs in its, every container run on its individual nodes, okay? And inside the Kubernetes cluster, you have a software-defined network that allows, for example, that wildfly application running here can communicate, for example, with the Postgres running in another node. And of course, there is also a service layer that I will talk more about that. And the Kubernetes cluster can run on physical machines, virtual machines, private or public clouds. We all know that containers are ephemeral. For example, suppose that we have data stored on a Postgres database. What will happen if that container dies? So Kubernetes also supports a persistent storage. And to manage this cluster here and all these containers, we can have one or more masters to take care of that, okay? And to allow access to those containers, we also have a routing layer. To understand Kubernetes concepts, we need to understand at least those four concepts. We need to understand what are pods, what are deployments, what are services, and what are labels. Today, we are going to focus on pods, deployments, and services. Given our time, we will not cover labels, but that's a more simple concept. And I believe that we will not have any impact covering labels at this moment. Well, let's start by pod. Pod, like the name says, is a collection of whales. So in the world of containers, pod is a collection of containers because there are certain applications that all containers walk together on the cluster. For example, you have an application, you have an administrative console, you have a log collector, and all those containers need to walk together. So we will have a pod with three containers. Every pod can share, they all share the same IP address, the same volume, the same environment variables, okay? So let's start here doing a live demo and playing with Kubernetes. To manage a Kubernetes cluster, we have the command kubectl. So I have already deployed here a pod running MySQL. Okay, so if I do a kubectl get pod, we can see that I have a pod MySQL running. It's ready, no restart, it was created two hours ago. And we can even explore more details about this pod running kubectl, describe pod, and the name of the pod. So that will show us that this pod here has the following IP, 172, 1703. It has one container only, most of the time each pod will have only one container, but remember, you can have more than one. This container, it's running this image of MySQL. You can have limits for CPU, you can have environment variables, you can have mount points for volumes, like in this case, I have a percent volume, where the data of this MySQL is stored outside of the container. But let's continue. Another thing that we need to understand is that it's something called deployment. The deployment have a replication controller that for example, it says, in this case of this cluster, that I asked a Kubernetes to keep foreign replicas of a Tomcat container running. But what happens if this container fails for any reason, if someone powers off the container, if the node dies for any reason, it runs out of resources, Kubernetes through the usage of a replication controller slash deployment will detect that that node is not available anymore, and it will move that container to another node. So let's see that happening here on the Qubectl. If I use Qubectl, get deployments, I can see that I have a desired number of MySQL, the number, one replica as a desired number of replicas of MySQL. But suppose that I delete the Get Pods, Qubectl, delete this pod, now that this pod is deleted, if I do a Get Pods, I will have another replica running. It's being created, it will be ready in a couple of seconds. That's because the deployment has me to have always one replica running. But let's do another thing. Let's analyze this pod that has been created. So let's describe this pod here that was just created. And we will see that this pod has now another IP address, 172, 1704, the previous one was 003. So every time that the pod dies, it can reborn or restart with a new IP address in another node. So that brings us to another concept of Kubernetes. This concept, it's called services. Service is the kind of load balancer that will locate every pod based on its label and send all requests to that pod. The service has internal cluster IP that will not change once it's created. So let's explore that. Let's do a Qtl get services. We have now a service called MySQL with this IP address, this cluster IP address that will not change. So let's explore that with describe service MySQL. We can see that it will forward every request that arrived in this cluster IP. It will be sent to that pod 172, 1704 because it uses this label app equals MySQL as a selector. So if we do get pods asking for the label app equals MySQL, we'll see that this is the only pod that will receive the request, okay? But remember that I told you how to run a Docker container. Let's see how it is easy to run a Kubernetes pod. Let's start from a Docker. If we want to, by the way, let me show you something here. We will create a microservice application, okay? That uses this MySQL. We'll deploy two applications here, one called guest book. It's written in Java implemented using world fly swarm. And another one, it's another microservice called Hello World. It's implemented using Vertex, which were presented last time on definition. And there will be a front end written in Node.js that will use both microservices. So what I will do now is create a guest book application using Kubernetes. Of course, I already have an image of that, but suppose that I would run Docker. The command would be Docker run. I could specify the name, calling it as guest book service. And the name of the image, right? The image would be rafavene slash microservices guest book. And we can specify the name of the tag. That's how we run Docker containers, right? To run Kubernetes, it's simple as that. We will replace the Docker command by kubectl. The name is already the second parameter. And here we will specify the image. See, it's still almost the same. The difference is that I can also specify labels. I can specify a label, for example, this is my application called guest book service. This environment is the production. I'm running the version 1.0. And I can specify also the number of replicas. I want to run two replicas at this moment. So when I do that, it created a deployment called guest book service. Let's get the deployments here. Get deployment. It says that I desire to have two replicas running. I can do a kubectl, get pods. I have two replicas of the guest book service running. And let me also show you something that's very interesting. On top of Kubernetes, I have OpenShift running. So I'm using here Minishift, which is part of CDK container development kit that you can get in the dev suite. I believe that someone will share the link to you and at this moment at the chat box. So we run Minishift console to open the OpenShift dashboard. I have here the project definition. And we can see the pods and the deployments that I've created now. So I have here in my SQL, I have here the guest book with two replicas based on that image that I created. But until this moment, I don't have any service. So how can I expose that deployment as a service? Again, I can use the kubectl command run expose the deployment guest book service. And I can specify the port 8080, okay? That will create a service. Let's refresh the screen. And now I have a service that sends the request, balance the request to these two pods, okay? We can also do that using the console. Now, you can see here that those two endpoints will receive the request that I do in this microservice. Of course, I can create pods and deployments and services using command line, but that would require more commands if I want to specify environment variables and volumes and et cetera. So that's why it's a good practice to define those resources inside EMO file. So for example, I have here for the next microservice using Vertex, IEMO file that specifies the number of replicas. It's specified the template of my pods, what are the containers, the image, the ports, I can specify volumes, environment variables. So it is much more simple if I do a kubectl create dash f and specify every file here. I can specify the deployment, I can specify the service, I can do the same for the frontend deployment and frontend service. A single command will create everything and I have already here running all my, I have it here running my complete application. Okay, so in a couple of seconds, we will have the application running. Something that I can do, that's a feature of OpenShift is that I can create a route and that will allow me to access the this application externally on the part 80. So given that I want to access the frontend UI, I will click here on the create route that we will ask for a hostname. I can use, for example, frontend, the IP address and use the nip.io that's a service that every IP that I use here results to that same IP. I specify the destination service, the port, I'm using the port 80. Once that I reach, that I hit create button that will create a route and I can open this route here, clicking on the link and I can, oops, there's a small viewer over here. Let's see why. Probably it's because my application is still loading. Another feature, a good feature about the OpenShift console is that I can, for example, as I can do here, QCTL get pods and I can do a logs and get a container, for example. I can also do open here and see the logs using the dashboard. So let's refresh the application. Yeah, now the application is working. What's our name? Rafael, welcome to Dev Nation Live. Okay, the message is there, it's persisted. I can even come here, delete my pods, my SQL. Okay, we will see that Kubernetes will take care to replace that in my SQL instance and we can even refresh our application and we will see that the data is still there. But now let's make things even more easy. I will create now from this scratch a new microservice. Let's start playing with OpenShift because I want that microservice to be in another project. So I can come here in the console, instead of QCTL, I will use the command OC. OC, the OpenShift client, it's essentially a superset of QCTL because we can even do a QCTLC get pods. We will have the same result. We can do OC get service, get deployments. Okay, but we can also do OC new project, micro profile. I will create a micro profile application. Once that I do that, I can see that the project here that I just created, micro profile. And now let's go to the wall fly swarm web page. In the wall fly swarm web page, we have the generator where we can specify, we can create projects and I will create a micro profile application. I can just hit generate project and that will give me, let me place here at the desktop, it will give me a file, a zip file that I can go to the desktop and zip that project that has been created. You can see that's very simple. It's a PoemXML and a Java endpoint. If we can take a look in the PoemXML, this is really, really simple. We have just the dependency. We have a plugin of the wall fly swarm that will convert the work file in a FET jar, in a Uber jar and what I can do now to run this FET jar inside Kubernetes is to run a Maven plugin with the goal set up. With the goal set up. This goal here will modify the PoemXML to insert the fabricate Maven plugin which allows me to have, let me show you, to have the deployment inside OpenShift as part of the build. So we can see here now, we have the Maven plugin as part of the PoemXML. Now it's easy. I can do just Maven fabricate deploy. That will call both plugins. It will call the fabricate Maven plugin. It will also call the wall fly Maven plugin. We can see here that's running in OpenShift mode. So it detected that I have an OpenShift instance running. They, we have the work file created. Now it's time for the wall fly form plugin to convert that work file in a jar file. Once that the jar file is created, it will upload the resources here to a build and that source will be converted in an image. So while this process is happening, let me ask you if you have any questions so far. Any question for from the chat box? There is one question and it's related to the rebirthing, if you will, responding of MySQL in particular, being that you're demonstrating MySQL here. What is your perception on a database connection pool and what it would need to do to reconnect back up to, let's say a recycled MySQL pod? Oh, that's a good question because as you could see, I destroyed MySQL instance and my application was able to detect again because in that case, let me show you the sources. As I say, talk is cheap, show me the source. The guest book service is implemented using wall fly swarm and you can see that I specified data source with the background validation, valid connection checker, valid data on match. So if the connection is not valid, the connection pool will be dropped and it will try to connect again, okay? Oh, we can see now that it's got the binaries and it will convert the source code to an image. There another question? Not in a small bit, but I did have one question. Do you have any specific advice on what types of Java applications do fit nicely in a Docker container, Kubernetes OpenShift world? Well, I would say that every Java application is a good fit for a container world. Spring Boot, wall fly swarm or even a reactive application like Vertex. So for example, the other service that I deployed was a Vertex application. By the way, we can see here that the source code, the image has been generated. Once that it's ready, it will push the resulting image to an internal Docker, internal image string which is an internal registry. And once that the image is available, an application will be created for you with a replica and also are already with a route. So let's take a look at the logs. We can do that again using the Qubectl logs. For example, Qubectl get pods, Qubectl logs and the name of the pod. We can even do a Qubectl log-f to follow the logs. It's exactly the same response. Okay, or even using OC instead of Qubectl. It's the same result as I said, Qubectl OC and it's a superset of Qubectl. Now that the application is loading, let's open the endpoint and as for the endpoint, hello. It's still deploying. I don't have the application running yet. Yeah, here, hello from wildfly swarm. So you could see that with a few clicks, I just, I generated a project. I run Maven setup and Maven deploy and my application is already deployed inside a Kubernetes slash OpenShift cluster. So that concludes our presentation of Kubernetes for Java developers. If you have any question, you can do it now, of course, but also I suggest all of you to follow me at the Twitter handle at Rafa Benny because we are always talking, I'm always talking and giving tips about Kubernetes containers, microservices, and things related to Java development. We also have some interesting recordings related to Kubernetes and how to get started with different Java workloads. There's one out there specifically for Spring Boot on Kubernetes, a session we reported in DevOps UK not too long ago. And Rafael actually does a lot of sessions, a very strenuous, if you will, Kubernetes workshop that he's been doing. He's got several of those scheduled coming up throughout the fall. So you can look for him, follow him on Twitter, and then maybe you can get a chance to show up on those workshops. So we'll be doing more and more of this kind of content as we go forward. Does look like there's one more question here. What is the best open source project to start with? That's an interesting question. What is the best open source project to start with? And it's a trick one because we have several open source projects for the most different purpose. I even saw an open source project for home automation, for a mid or we have plan out. So it all depends on kind of project that you're looking for. Yeah, there's so many amazing open source projects. Here's another great question. What is the difference between Docker Swarm and Kubernetes? And I know that's something that you spent some time researching. Yeah, well, the idea is more or less the same. It's to orchestrate containers, but I prefer to say that Kubernetes has a lot of attraction given that it uses Google's experience on containers. And the Google experience with containers and there's come from 2004. I know that it doesn't sound like so much time from a human point of view, from a human perspective, but from the technology perspective, it's a tremendous amount of time. And even because of these Kubernetes concepts, I know that Docker started a new project called SwarmKit which copies the idea of Kubernetes because the Kubernetes concept, like I said, the pods, the concept of services and present volumes make things much more flexible and suitable for all kinds of application. We have other question. Yeah, there was another question I was trying to answer it actually via chat and it's an interesting one though we are out of time. So, but it is a fun one. What do you consider to be, as far as memory cost associated with things like wildfire swarm? An application server is considered to be very large. What are your thoughts around the memory footprint and the overall startup cost and things like that, associated with wildfire swarm? Well, given the amount of investment on application servers, on JVM runtime, it's getting smaller every time, every single release, it's getting faster and more performatic and requires less footprint. Let me see if I can have an idea here of how much memory I'm consuming. It's actually hard to measure the actual memory consumption within a Linux architecture just because of the shared memory. Architecture just because of the shared pages and things like that. Yeah. Well, I have not enabled the metrics on my cluster, but usually I've been able to run a good load with 500 megs. And I was just testing literally right before we started this live event, I was just testing Vertex within about 268 megabytes consistently, so making sure that that's working well. But you will see it go down as low as, some people would say lower than that, but I've not found that to be greatly successful up to half a gig, depending on the workload. But Vertex being the smallest, Spring Boot being the next smallest, Wildfire Swarm being the largest of that three. I've not tested Drop Wizard and I've not tested some of the other JVM-based runtimes because those are the three we focus on here at Red Hat. But we are definitely out of time today. I thank you guys all so much for your participation, your chat, do check out the previous recording, aside from that small five minute window we lost within the recording last time. And hopefully you guys got good information from Rafael O'Dell, Rafael, thank you so much, fantastic presentation, I love the fact that how fast you blew through that. We will offer deeper dives and more content like this in the future. Stay tuned to Demnation Live on our webpage because you're gonna see a lot of other really awesome stuff scheduled up and coming, including a really awesome session on Istio, which if you're very interested in this kind of architecture, modern microservices architecture, it is a game changer and it's gonna fundamentally help you rethink the way you build applications, it's gonna be totally awesome. So if you guys need anything, reach out to us on Twitter, find us via email, we're available across the internet in numerous ways. But thank you so much, thank you Rafael. Thank you, thank you everyone who watched this live and for those who watched this on a recorded session. Thank you.


Next Tuesday, there's going to be a very, very important primary here in Wisconsin. And you have the opportunity to tell your governor loudly and clearly that his entire agenda is wrong. That we are not going to suppress the vote. We're going to increase voter turnout. We're not going to attack trade unionists. We're going to expand the trade union movement. That we're not going to take money from the Koch brothers. We're going to overturn Citizens United. That we're going to end a set of trade policies which have been disastrous for workers in Wisconsin and around this country. What we have found in this campaign is that we win elections when the voter turnout is high. We lose elections when the voter turnout is low. On Tuesday, let's have a record breaking turnout. Bring your friends and your neighbors. Thank you all very much.


mechanism that we think is important." There is reason to be optimistic. This new CBDV-based drug is similar to one that's already been approved by the FDA to treat a severe form of epilepsy that shares some of the same symptoms that Dr. Hollander is studying. This new research could help cement what has largely been anecdotal support of using cannabis to treat autism. Cannabis was once seen as something which is completely recreational, has been very heavily sort of stigmatized over the years and it's only very recently in our modern day that people have been looking into researching and using cannabis for its medicinal purposes. Today we're going to have a look at a video called Cannabis as a Natural Treatment for Autism. Not the most appetizing title be it. I think it'd be quite interesting to perhaps have a little bit of an insight into how people are using cannabis I suppose in terms of autistic people. Let's go for it. Nate started taking medication for autism when he was around five years old. As Nate was getting into high school the aggression levels just really started spiraling out of control. He randomly started running into other classrooms, punching people for nothing. It took four adult men and handcuffs to bring him down to the ground, cuff him and restrain him. At that time he was taking 18 pills. Yeah that sounds like an autism meltdown for me. I think some people when they come into like particularly high school experiences or secondary school as we say in the UK like definitely a lot more sensory provoking than it was or at least in my experiences personally. But if you haven't already watched the podcast of myself with Miyabi I highly recommend either checking that out after we watched this video because Miyabi and me were talking specifically I think of perhaps people who have relatively lower support needs and I think this individual perhaps has relatively sort of high support needs so it'd be interesting to see what their experiences of it is like. Although I do want to put a big caveat there and say that it's going to be from obviously the lens of the parents. So perhaps not particularly their experience I suppose but the parents experience. Pills every single day and it wasn't even helping. I started researching the medical marijuana states. We were able to come to California. I remembered seeing like the big neon cannabis leaf in the window and like well that's got to be where we have to go. Why don't you just tell me a little bit about your family? Marijuana. My name is Jenny Mae. I have three sons on the autism spectrum. Each child is of course so different like any other child and as far as them being on the spectrum Nathan is what is considered to be at the very severe end and rather than trying to find the right medication they just gave more and more and more of it and that was really the only solution they had. I did not. Yeah the wedding is not is not incredibly I can imagine not the best for you guys but I think what she's trying to say is that he probably has quite quite high support needs. I don't think the autism spectrum is necessarily this ASD one two and three thing. I think it's sort of a separate sort of label that is based on what kind of functioning they need. Well why does she go straight to part? I think that they've had medications as she said. I don't know what kind of medications are giving him because as far as I know I don't think there's many like I don't think you can get medications for autism you know. Like maybe things related to like the comorbidities like depression and anxiety maybe maybe something related to like mood stabilizing is that what they do? I haven't really looked into it to be honest. Does anyone have any ideas? I do know I have seen some research around particularly around like oxytocin mediators they did like a nasal spray which apparently alleviated some of like the social symptoms that they had. Yeah that is my exams on the old wacky backie. I also passed nice. I don't want him being chemically restrained in a bed you know being taken care of by strangers. Hmm sorry. I had come across this little video clip of a young boy who. Aaron says sometimes these sedatives if there's aggression. Yeah that's that's what I imagine. That's what I'm at. That's what I thought yeah. Who was just repeatedly punching himself in the head. 11 year old Alex Eccles is severely autistic. His self-destructive behavior brought on by and it caught my attention because it was something that Nate had done. His parents were talking about giving some kind of an oil.  And after a few months of treatment the Eccles say they saw a dramatic improvement. Within just a few minutes of this boy taking the oil orally he was smiling and he was calm and he wasn't hurting himself anymore and I'm like wait what what just happened there. I watched it a few more times. This is definitely an interesting kind of thing isn't it like using medication like even even if it's something something kind of you know that a lot of people sort of tout us as being quite beneficial to autistic people from from other autistic adults like it's still a very strange thing to like medicate autism. Do you know what I mean? It doesn't really sit right with me. They should certainly try more than one medication and watch how it responds. It's a lousy way to find out what works but surely better than increasing doses of the same thing. It makes you chilled. I definitely self-prescribed pot and I think I'm right about it but it's not as good when I ever do it. Yeah I mean I think anything in excess of what you need is probably like not a good idea but this I mean usually when when medical stuff like this is done there is usually like a prescribed dose you know it's not like used for recreational purposes in that sense but I mean like I think one of the arguments a lot of like activists for like cannabis use like even in a recreational setting like it doesn't lead to people increasing aggressiveness like sometimes it can lead to like anxiety and paranoia and I think it among a select group of people it can sort of initiate any sort of pre-existing schizo related disorders but yeah I mean let's get watching. Times and I was completely shocked and desperate. At that point Jenny and her family just moved from Wisconsin to Missouri. Two states were getting pot legally for really any reason is super difficult but particularly medical cannabis to treat autism. Currently only 12 states include autism as a qualifying condition. Five other states in the District of Columbia are considered autism friendly meaning doctors can recommend medical cannabis for debilitating conditions so that leaves 33 states where you can't access medical cannabis to treat autism at all. I was raised in the Nancy Reagan just say no era. Getting the kid's stone clearly work which is worth something I guess. I don't think it's kind of in that sense I don't think that's the like I mean I technically yes I suppose you're right Baxman but you know I just it's the whole thing about medicating for autism like I prefer if it was more about like medicating like anger issues or like something like that it's just like medicating autism it just it seems a very strange way of talking about it. I suppose when it comes to legislation perhaps it's a bit sort of more impactful to allow autistic people to receive said medication but the language is just getting me. Know the drugs and say yes to life. I would have never in my life considered this to be a medicine but I basically told my husband we have to try that. Like most illicit drugs the scientific and medical research of marijuana has been challenging but the tide appears to be turning. The first large scale clinical trial is underway at Montefiri Medical Center in New York City and it may be the key to unlocking access to treatment for children with autism nationwide. Dr. Eric Hollander is leading that study. I've been involved in research developing new therapies new treatments and autism spectrum disorders for about 30 years and there's a big need to develop treatments for the core symptoms of autism. This study focuses on a new compound called Cannabidivarian or CBDV it's an extract from the cannabis plant similar to CBD. It doesn't include THC the psychoactive drug that gets you high and what Jenny uses to treat need but it's the first step in studying cannabis to treat autism. This particular cannabinoid has effects on some of the underlying mechanisms that we think are central to autism the problem behaviors and disruptive behaviors and also in some of the compulsive behaviors or repetitive behaviors or perseverative behaviors so it gets at a key Yeah I don't think we need treatments for repetitive behaviors mate. Like it's a really weird video for me to watch because I don't agree with the premise but I sort of you know I think it's good to have an open mind when it comes to helping people you know. I take mood stabilizer antidepressants and anti-anxiety meds. I have low spondies but comorbid conditions I don't think they are meds for autism. Exactly just what I'm talking about Pieta. I hope I'm saying that right. Hello like C. Okay that's what I thought I didn't think that oil got you high. I have to be honest I was under the assumption that it was. I was under that assumption. If they had medical grandeur on the NHS I wouldn't say no. No you can't get it medically in the UK. You need to have first shown that medication does not work in treating you however. Yeah it's interesting. I've been understanding trying to work out what exactly these mechanisms of like challenging behavior that they're necessarily talking about because I don't necessarily think that's like you know that it's the premise of treating autism that I don't agree with you know. Are they tackling from the angle of suppressing stimming and suppressing self-harm behaviors? Yeah because if they're challenging it from the angle of tackling it from the angle of suppressing stimming I'm not too happy about that to be honest. I think the way that he's wording it is like they're trying to remove challenging behaviors in order to make the child sort of more amenable but I think there's also that an aspect of like improving the child's well-being as well which I can agree with. I just don't think that saying treating autism is like necessarily the right way of wording it you know perhaps improving the life quality of an autistic person that would probably be a better way of wording it. Kind of just helps me not my addiction problem rather alcohol. Interesting. Help me socialize and sleep bad sleep but sleep. Yeah I've heard stuff like that as well. The mechanism that we think is important. There is reason to be optimistic. This new CBDV based drug is similar to one that's already been approved by the FDA to treat a severe form of epilepsy that shares some of the same symptoms that Dr. Hollander is studying. This new research could help cement what has largely been anecdotal support of using cannabis to treat autism but while that research is ongoing parents like Jenny are moving to states that have more lax marijuana laws. For Jenny and her family that meant packing up everything and moving all the way across the country. That decision may sound extreme but for Jenny and Nate it's been worth it. Their lives have been transformed since first visiting at a dispensary. We got home and he took a hit immediately. We got this huh? Okay. And with him not even five minutes it was just like a light switch. He was happy and just kind of looking around like he had never seen the world in that way and he was smiling and looking at me and I just knew right away because nothing acted that quickly or that positively ever. Jenny has learned a lot since moving her family out to California. There she joined forces with fellow mom Rhonda to start the non-profit whole plan access for autism. Now it's a team of moms dedicating their lives to helping other families navigate the challenges that come with getting cannabis for their autistic kids. I feel like we get a lot of people that come to our booth. Someone in their lives has been touched by autism and they don't know that this is an option Oftentimes we get people that come to us after the event, they email us or they find us on social media and they want to learn and that's kind of a group. Well I really do want to highlight that I'm not necessarily like when I question the aspect of treating autism. I'm not criticizing like the doctors or the actual parent that you know they're trying to remove autism from their kids. I don't think that's not the angle that I'm trying to take. It's more like I suppose it's just the wording if I'm being honest. I'd prefer if it wasn't treating autism, probably like helping autistic people probably be better. But the actual initiative and what they're talking about is something that I definitely do agree with. I think that there should be access to stuff like that. Especially when it comes to CBD, CBD variants, non-psychoactive stuff. It seems like a very silly thing to deny people from having, if it really really helps them improve the quality of life. Danielle says, I always feel like I say things on purpose, not in a mean way. People always take it as if I'm being rude and they give me attitude. I feel like I did something wrong. Do you mean now, Danielle?   I always didn't get as hell annoying. It drives me nuts. Yeah that's the infantilization thing. Anti-epileptics are part of a treatment for BP. Are we sure he wasn't high? I don't know. They seem to have a very sort of noticeable effect from what she was talking about. We decided to take a drive out to Joshua Tree. I had him vape and take an edible right before we left the house.  He wouldn't really look, he wouldn't really smile and he ran over in front of me and sat down. He sat there and he posed for picture like everybody else would in a situation like that and I'm like that's it. That's basically his birth picture. You shouldn't have to go... I feel like what they're actually treating here is just generalized anxiety and over-stimulation. It makes sense. Perhaps someone might be a little bit less lucid if they are like constantly over-stimulated and they have like that bodily sort of aching feeling of anxiety that you get with generalized anxiety. They definitely make sense 100%. I don't think it's necessarily making him less autistic than I think that's the wrong kind of characterization to make. To go through the whole gamut of medications and side effects and long-term consequences of some of those side effects in order to get to it, just look at cannabis as another tool in your tool bill to try. Thanks for watching. For more dope science content, check out our website and subscribe to Freethink for more great videos every week. That was Freethinks Cannabis as a National Treatment for Autism. Definitely seems like a good sort of step in the right direction I think for improving the life quality of autistic people. I've heard like an almost overwhelming amount of positive regard and also some people who have sort of negative regard for the use of it in terms of like improving life quality, sort of counteracting some of the common sort of comorbidities that autistic people can experience, particularly anxiety. Again, the wording, you know, I have to go back to the wording, the wording of what they're actually doing I think could be improved, but I think the general sentiment of improving the life quality of individuals I think is a very good thing.