Hi, this is Steve French. I'll be giving a talk today on network file system security. Be giving an overview of securing SMB3, the most popular protocol for accessing files on the internet. So to give a little introduction about who I am, I'm the author and maintainer of the Linux SIFS client. I've been working on the Samba team for many years. I'm the co-author of the SNAF SIFS technical reference and I'm a principal software engineer in Azure Storage at Microsoft focusing on Linux and accessing network storage safely and efficiently. I'll be giving you an overview of SMB3, the protocol and network file systems in general, then talk about some of the security challenges and the different features, authentication identity, encryption access control and data integrity, and then talk about some of the efforts and where we need to go from here as we improve network file system security and the kinds of things that would help the kinds of things we need help with from many of you in improving security in this important workload. So first of all, a lot of people ask why network file systems matter. It's been a lot of focus, for example, on NVMe, Fabrics, RDMA, and people question why network file systems. Well, the answers are fairly obvious.  They're a superset of what objects can do and all applications we're used to save files. The presentation I'm giving today is saved as a file. I typically back these up into Azure, into the cloud, sometimes to a local server. Now, historically, one of the problems had been performance, but with a well-configured NAS, especially with support for RDMA and faster transports and faster encryption, you can now get 80 to 90% of the performance you might get with a block device with network file systems. But what you get is a lot better security. You get the ability to identify the owner of a file more easily, more metadata. It's easier to understand security in a file protocol. It's easier to understand backup, encryption, archive, compression, quotas, quality of service. All these are much easier when you know the owner of a file, when you know the access patterns of a file. When you access a block device, there's very little the block device knows about who's accessing that and why. In a network file, it's much more complex, but you have incredible variety of features. One of the challenges with network file systems is keeping the performance good, keeping the security good, and doing it in a way that allows us to take advantage of these useful features. Network file system knows who's making the operation and knows the applications, access patterns. And it knows a lot more about the type of access the applications requesting. So it's a very complex problem, but it's a much bigger superset than block or blobs and objects and what it can do. So it's important to understand why network file systems matter. We're never getting away from this idea of storing files on disks, whether it's local or remote, storing files on specialized block devices is going through a file system. It's the same thing through a network. We want to be storing files over a network file system onto network storage where possible because it lets us take advantage of these features and lets us take advantage of this enhanced metadata that helps us secure workloads better and make them higher performing, but they have huge disadvantages. Network file systems are much more complex than block devices. I used to give a presentation at the annual Linux conference in Ottawa on how to write a file system in 45 minutes. Well, you can do it, but file systems are incredibly hard to optimize and they can be slower than block devices and we have a lot more security features and challenges. So this isn't easy. The NFS and SMB clients in Linux are about 50,000 lines of code and they're quite a challenge, but they're incredibly well optimized for certain workloads and we can continue to improve that. One of the things we're gonna try to do here is talk about how to improve the security features though and where we need to go. Now, why do we talk about NFS and SMB? Well, over this 36 year period, they're the two survivors. So in 1984, Barry Feigenbaum, IBM, recent PhD graduate invented the SMB protocol and son back in same year invented the NFS protocol. Many other protocols have come and gone. These are the two that seem to live on. They are by far the most widely deployed and it's hopefully just coincidental that that coincides with George Orwell's famous 1984. Now, the current dialects of these NFS 4.2 and SMB 3.1.1 are almost unrecognizable compared with the original dialects in 1984 and they've evolved quite a bit. So looking at these two network file systems, it's interesting, there's a reason they survived. They've gotten a lot of attention. They've been deployed incredibly widely so major devices have them and they're well understood. But SMB has some unique advantages. One of them, for example, is it's insanely well documented for various reasons and it's incredibly helpful to have these thousands of pages of very detailed documentation and then many hundreds of thousands of lines of test cases. But in general, how do they differ? One way to think about it is the SMB protocol is much broader in scope. You can see some of the examples here, branch cache, witness protocol, file replication, the global namespace, DFS, claims-based act was, this is a much broader protocol than NFS. But there are some exceptions. NFS has support for PNFS where the metadata and the file data can be separate. PNFS allows you to query the layout of a file and then access the file's contents, it's data from different servers. That's something that SMB doesn't have. The backend typically provides that. In addition, NFS4.2 added support for labeled NFS to better support SE Linux to allow the client to enforce SE Linux better. Now there's also one other major disadvantage, I don't know how you wanna phrase it, probably disadvantaged NFS. NFS is layered on top of another protocol, SunRPC, where SMB talks directly to TCP or directly to RDMA or in the future directly to QWIC. This means NFS is a little bit harder to optimize for network operations, although there is an NFS over RDMA. But both these protocols have borrowed features from each other for many years. For example, NFS ACLs are based on SMB ACLs. And you can see that they've learned from each other. And we need to dive in on some of the security features as well to go explore this. Both of them support Kerberos, but in a different way, for example. So let's give a quick overview of SMB. SMB 3.1.1 is the current dialect that was introduced in late 2015. It's by far the most broadly deployed network cluster file, it's the default on Windows Max and various embedded devices. It's built into the media player and various operating systems, including Linux. It's got clients and servers on every major operating system. Samba is common on Linux, for example. Now there's a kernel server on Linux. It's part of a family of protocols that offers the broadest set of functions of any network or cluster file system protocol. And you can go into the documents like MS-SMB 2 and MS-FSA and see some of the examples of this. And vendors have done vendor-specific extensions, for example, Apple, to offer specific client-specific features, server-specific features. It's also the best documented. Just the core document alone for the file protocol, SMB 2, is over 470 pages long. And the test cases, Samba's test suite, SMB torture, as they call it, is over 200,000 lines of code. The Microsoft open-source test cases are also huge. And there are multiple annual test events, some of them coordinated by SNEA, that go into a lot of depth testing the, so this zoo of clients and servers against one another. Now on Linux, although Samba SMBD is the most popular, there's also now an open-source K SMBD. There's also various users-based libraries, the SMB 2 among others. Ronnie Solberg's live SMB 2 is a great example, since it's embedded in various applications. And there's servers from many, many vendors, NetApp, EMC, and many others. And they range from very small devices to the largest server in the world, right? The largest file server in the world is Azure Files. There's a great presentation on this at the storage developer conference a few weeks ago. So what about the key security features of SMB? For authentication, Kerberos, you can use other things, but Kerberos, and Kerberos is encapsulated in SPNego, so it's opaque to the SMB protocol, but it allows the SMB protocol to integrate well into directory services like Active Directory and AAD. And after you authenticate, there's a preauth integrity step that verifies that no man in the middle has changed the authentication. And then from there on, you have the option, it's by default in things like Azure, to encrypt and all the traffic after that preauth integrity is encrypted. And typically that's GCM 128, although GCM 256 is now possible and there are other choices as well. It can be configured on a per share basis, so you can decide that some shares need tighter security or on a per server basis. The client can also require that encryption be configured on a share. So the client can force encryption or the server can force encryption and it can be required either on a per share or per server basis. It's very flexible, much better than it'll give VPN, for example. Now for access control, there are various mechanisms as possible, but SMB3 ACLs, rich ACLs are most common. And in Windows example, they have this optional DAC claims-based ACLs that can give you much more enhanced access control features. In addition, there's something called an SACL that allows you to configure auditing. Now, there's a fairly serious problem when you're dealing with a network of systems and that's understanding which users are which because clients coming in from client one and client two, users coming in from client one and client two could have the same UID on their systems but be very different people. SM French, maybe UID 1000 on one client and UID 2000 on another client. It's extremely important to be able to map identity. Who is a particular user? And different protocols choose different mechanisms for this, some use OIDs, some use SIDs. NFS has user at domain, which is now possible to use when you configure ACLs, for example. So you can configure a realm name to scope the user's name. But in the SMB world, they use a globally unique identifier called a SID. And there's an example here. And the SID can be mapped various ways to the more primitive UIDs that POSIX operating systems and Linux use. And that can be done via services like WinBind or SSSD. They can even be hashed. But the most common way, some of the large enterprises do this is RFC 2307, which is an LDAP feature that allows you to associate a Linux UID or POSIX UID with a user in a directory service. A globally unique user. So what's the goal here? The goal is to be able to access files. My presentation, for example, whether I'm storing it in the cloud or whether I'm storing it in a local small device, we have to be able to do that securely and efficiently in a very, very hostile world. When I'm backing up this presentation or when I'm, you know, if I was working on a resume or if I'm working on patch sets, it's very useful to be able to save those files in the most natural way possible, but be able to save them into the cloud and to be able to save them to local servers securely, efficiently, quickly. And we have a lot of common use cases. We have things like containers spinning up needing to store the container images. We have things like backing up systems. You know, the Macs, as you probably know have a time machine feature. If you're in Starbucks sitting with your Mac, the Mac can be backing up over SMB into Azure, into the cloud. So we need to make sure that users don't move away from a secure file protocol to some less secure mechanism or less reliable mechanism, less functional mechanism, just because of some missing feature in SMB3. So it's important, I think, that for these commodity protocols like SMB and NFS, that we have enough key features so users don't make bad decisions and move to either less secure or less functional protocols in order to save their important data. It's not just about saving presentations or video files. It's about being able to do workloads in this new world where data is spread out broadly across the enterprise, sometimes into the cloud and do that efficiently and securely in a very, very hostile world. Let's dive into some of the details. So, you know, authentication is very different from authorization. Who are you? Can you do that? So there are various ways to authenticate. In SMB, you typically authenticate with Kerberos, but you can with NTLM V2 as well, but that's been around for more than 20 years. What we need to think about is other mechanisms. Maybe we need to reserve through the IETF additional SPNego OIDs to identify other mechanisms. We today have the option of PKU-DU, MACS have a peer-to-peer Kerberos variant, but we may have to go to things like OAuth in the future and be able to opaquely just plug in additional security mechanisms for file protocols to use. So in Kerberos authentication, it's a fairly simple flow. The client gets a ticket granting ticket from the KDC, usually Active Directory or Samba Active Directory or some equivalent. And then this ticket granting ticket allows us to get a service ticket for the server we're trying to contact. And then the client sends a service ticket to the server they can validate that both ends can validate that the users who they expect. This is extremely common mechanism, well-tested. And it's good for a lot of environments, but what we need to know is as we go forward, and some of you may have expertise here, do we need to offer additional options, maybe OAuth, to allow other authentication models to allow saving files securely in the internet? Now, these mechanisms are largely opaque to SMB3 because SMB3 leverages the SPNego standard to embed security tokens inside the file protocol during session establishment. But that does require that we have a way in both Linux as well as have the servers and clients agree on how to identify the OID that identifies this whatever security protocols we may use in the future. So you take a look at RFC 2478, for example. Now, one of the problems we have in Linux, which is fairly obvious, is that there's no easy way to add libraries that would make authentication opaque. There's no SESP-Nego directory where we can put a config file in to add a new mechanism. And what that means is that we embed too much knowledge of the security protocols into the client and server libraries for the file protocol. Now, what if we have a security disaster? Let's say at the next year's security summit, they find some security problem that causes us to have to evolve the security protocols, the authentication protocols. How do we plug those in? Well, we need some way in Linux of exposing these libraries in a way that things like Samba and kernel clients can access those libraries without having to embed, as you see with Samba today, Samba has Heimdall-Kerberos client and server. It has OpenLDAP embedded within it. It can call out to other libraries as well, but it's somewhat limited in that. And we need to make it easier for applications to call out to new security libraries. So how do you protect them from tampering? SMB 311 has a really nice mechanism for validating that no man in the middle has modified the authentication flow. And then when that tree connect comes, the mount, the initial session requests and the negotiate protocol are validated to make sure they haven't been modified. And from the tree connect on, it's typically encrypted and at least signed. So you know that the security, the authentication hasn't been tampered with. It's a very powerful feature and very useful. So they exchange mandatory negotiate context early on that allow additional security features to negotiate. And this allows support for many different types of encryption algorithms and it allows some really nice security features. Now in older protocols, for example, SMB1, SIFs, there was no man in the middle attack mitigations and Ned Pyle and others at Microsoft have given many talks on why never, never, never use SIFs. We don't want to have another one or cry. We don't want to have another major security incident. Don't use SMB1, don't use SIFs. What you're using and what SIFs.co negotiates by default is SMB311. And this is much more secure. So what about identity? What about figuring out who you are? In the dark ages, we use something called NIST, the network information service in the 90s, for example. And this was replaced in the 1998 by a much more secure alternative that used LDAP to store the POSIX UID, RFC 2307. So Luke Howard did a nice job on that in defining this. And one of the obvious questions will be, are there any alternatives we should be considering? Right now, RFC 2307 is really the only alternative for storing identity in a directory service that is broadly adopted. It's not just supported in Active Directory, it's supported in most LDAP servers. Now, there were two variants of RFC 2307. They added the original RFC 2307 didn't have a way of figuring out what groups a user was in. It could tell you what users were in a group, but not the reverse. And so it was extended with something called RFC 2307 BIS. There was also a proposal from Matt Bannister in 2015 for a directory-based information service. It appears to be abandoned. Now, in many cases, users just give up and they just hash the UIDs. WinBind and SSSD have options to do that as well where if you have an unmapped user, you can just hash the global identity to try to come up with a local UID in a consistent fashion. But it's very important for us to understand is there's some way going forward other than RFC 2307 that we should be defining who a user is. You know, there's an important problem here and this is pretty serious. Although WinBind and SSSD security services have a way of with private APIs, D-Bus and SSSD case and a private RPC and the case of WinBind, of mapping names to UIDs and UIDs to SIDS and these are specific to that application. There's no Linux API that allows you to sort of do the mapping among the four ways you might represent a user and this is fairly important. So if you have multiple protocols, NFS and SMB, HTTP and others, HDFS perhaps accessing the same storage, and some of those protocols are gonna represent the owner of that file as an OID and some like SMB with a SID. NFS could be a UID or a user at domain. So this is extremely important that there's a mapping not just between name and UID, which get PWNAM and get PWU UID due today, but you need a standard library interface to map between the four ways you have identities, OID, SIDS, UID and name. And you're gonna have to have this, otherwise you're gonna have people calling private APIs all the time, WinBind's great, it's a wonderful service, but do we wanna way to plug in other ways other than WinBind of mapping identity? Samba includes WinBind as I mentioned, it's a great service, but having an API in Linux extending PAM and NSS to allow you to map the global identity for a user, user at realm name to a globally unique identifier like a SID, and then map it perhaps in a somewhat imperfect way, but map it to a local UID. A local UID could be 32 bits, so it's not necessarily gonna be globally unique. And this mapping is done differently, we may not use RFC 23.07 forever, but this really shouldn't be the file protocol doing this, this should be something that identity libraries, security libraries do, something that plugs into PAM and NSS, but today NFS and SMB have to have their ID mapping callouts because there is no common API that lets you do this effectively, at least in Linux. Now, what's the alternative? Well, you end up mapping local users to guest or you have a default mapping of all local users to some default Kerberos user, and that's really not sufficient for most use cases. What we wanna get to is not having the SMB client and the NFS client calling into their own ID map callouts, we would like them to be able to go into generic PAM and NSS functions to map the four different ways you can represent a user, his name, UID, globally unique SID or an OID back and forth. So, access control. So in access control, here's an example from Windows, what you might see in the Windows securities, when you do right mouse button on a file, notice that you have users, groups and permissions. This is the simple version, you can obviously bring up more advanced panel that shows the individual permissions. Now, this is much richer than what you see in Linux, the mode bits are quite primitive and POSIX hackles are also very primitive, but it's not just Linux that has GUIs for this, here's one of the SIFs utils that allows you to modify rich hackles as well over SMB, right? You can see the SID and you can see the permissions here. Now, there are lots of tools in Linux, they're command line tools, SMB hackles, get SIFs hackle, but I think it's important to contrast this with what users are used to on Linux where you only have 12 flags, now you have 777 permissions and then you have the set UID, set GID bits. These are very primitive compared with ACLs. And in Linux, if you wanna have ACLs, the only broadly supported one is POSIX ACLs and they are more useful, but they don't have deny ACES and they have far fewer features even than the standard SMB ACL, much less claims-based ACLs. Now, there's been a move to push rich ACLs into the kernel since 2007 and they are implemented by various operating systems, not just NTFS and SMB and NFS and they're on various operating systems. ZFS, for example, has support for rich ACLs and Macs have support for rich ACLs. It's important to realize though that they're much more functional than the POSIX ACLs you see by default in Linux, but in addition to that, Apache introduced a concept of claims-based ACLs that allow you to do things like control permission based on other things, the location of the user, whether he's running on a managed client. And this is supported by Kerberos and much richer in function, but it allows a much more detailed access control model. And here's an example you can see from Windows where they're basing it on one of the access control entries based on the location of the user. And also notice in this example from Windows, you see you can do logical ands and ors. You can imagine a case, for example, where somebody in group managers would have permission to something except if they're in group janitors, right? You could imagine different cases like this where ands and ors are used together to do richer access control decisions. Now we don't have this in Linux, but it's an example of something that might help as we go forward. It is supported over SMB though. And once again, this is not necessarily meaning that we have to implement it in all the Linux servers, but it would be useful to be able to have a more visible way of exposing this because in many cases apps wanna check their permissions on files. You see this a lot in Linux and Macs where on open or just before open, they're querying what permissions they have for the file and sometimes changing those permissions on files they own. And of course servers always check their permissions on open of a file directory because they have to do that to understand if you're gonna be allowing access to that for the reads and writes that come in. And there can be real conflicts between the permissions that mode bits expose, POSIX ACLs and rich ACLs. And it's been a real interesting problem over the years. Many, many years of development I've been working on, I see this a lot on how to map permissions or emulate them between these three models. And examples are like how would you map 0707 or how would you map cases where you are going to deny permission to a group that the user is a member of? Not an easy thing, right? That if a group is a member of some, that example I gave where somebody's a member of group janitors and janitors has zero permission, well, the denying of that user access would prevent him from accessing the file even though from the mode bits, you could have 0707, that's very hard to represent in an ACL. So there are cases where mode bits are really tough to map into ACLs. And of course, there's millions of cases where ACLs can't be represented as mode bits. And then another related question with POSIX ACLs, since they don't have deny ACES, should they just be emulated when somebody queries a POSIX ACL on an FS or queries a POSIX ACL on SMB? Should you just show the best approximation, not show the deny ACES? Should we allow users to change them remotely, set POSIX ACLs? Another interesting question is, what is Chone changing the owner due to affect the ACL? In the SMB case, there's a access control entry for the owner's SID, but when you change the owner, you now have an access control entry that's kind of old and doesn't represent the current owner. So, do we change when we do a Chone, do we change the ACL as well? Not just change the owner, but also change access control entries. And there's an interesting access control problem that's quite common in the Linux world. It's most common to enforce the permission on who can delete a file by looking at the directory entries, the parent directories, mode bits. But in a rich ACL world, you're most often looking at whether the object has a delete permission. Well, there isn't an equivalent of that in mode bits, right? So, the object's delete permission doesn't exist. The permission checked is the parent directory. But this can be a real problem. If you have a temp directory and people are creating files, you only want the owner of the file, the guy who created the file to be able to delete it. You don't want an attempt directory to allow George to delete Bill's files. And that's easy in a rich ACL world, but it's hard when you're just using mode bits. So this semantic conflict between what remove means in Linux when you have ACLs and Linux when you don't have ACLs is an interesting problem. This comes up a lot with NFS and SMB when you're trying to expose files to a Linux client over a network file system protocol. So what about SE Linux? So these implement mandatory access control support in Linux and individual objects have security labels stored as Xatters. And RFC 7504 describes potential protocol requirements to support this over NFS. So it's a useful read. So looking at Tom Haines's document there that gives the requirements for what is needed for SE Linux is quite interesting. And NFS 4.2 does support optional extensions for security labels, but this is client-enforced in NFS. And one of the questions is should something similar be done in the SMB3 protocol, which already supports Xatters and alternate data streams but basically defines something like sec label like you see in NFS. So what about encryption? In SMB, there's four algorithms supported. You can see AES128, CCM, GCM. Now AES256 GCM has been added. Typically AES128 GCM is negotiated. It's fast, offload to the hardware. In my testing, large IO is about five times faster processing on the client. The overall gain is a little bit less, but five times faster on the client, the processing of those frames when you use AES128 GCM over CCM, decent and typical VM. And now we have support for the what are they called military grade encryption, the AES256 GCM that's much stronger. It's, you know, these are quite interesting, but they provide very good performance and very strong security and many servers like Azure by default negotiate encryption. So every frame is gonna be encrypted from the tree connect on. And, you know, why do we use GCM128? Because it's got hardware support. It's very fast. So from the 5.3 kernel on, you can see it in the SMB client on Linux and Samba added support a year or two ago for a little over a year ago for GCM128 as well. So here's some examples of recent work in progress on the stronger GCM256 support that'll be enabled via a global module load palm on the Linux client. So what about RDMA security? You know, SMB direct is very, very fast and quite common in the SMB world. RDMA encryption though, shipped in Windows at least in the first half of 2020 and includes support for 256 bit AES that we talked about earlier. RDA signing is also feature complete and will be supporting AESG Mac will be faster. And there's a nice presentation on this from the storage developer conference a few weeks ago by when and would be worth looking at if you're intrigued about SMB direct security. But the message on this is it's extremely fast and can leverage many of the same security features running SMB over RDMA. And like I said, it's quite common in the Windows world but it also SMB direct is becoming more common in Linux as well. Looking forward to porting those to getting those kind of features in the Linux client as well for the faster encryption for RDMA. Now, what about quick? So encryption is very important to discuss but there's a kind of related problem that in many networks, whether the traffic's encrypted or not, if it goes to port 445, it's gonna be blocked. Working on this presentation, for example, I wasn't able to save it to Azure because my local ISP Spectrum blocks port 445 here. When I was on a trip recently, different hotel chains each of the three nights and two of the three did not block 445, one of them did. My son's ISP doesn't block 445, the one I use here does. Now it's an interesting problem. So how do we get around the port 445 problem one way and you can see a great presentation on this in the last few storage developer conferences is to use quick. Much of the network traffic for HTTP already uses quick. It has faster connection setup, it has these nice performance features listed here, good congestion control, no headline blocking. Here's an example from the Windows presentation on how quick fits into the network stack. And as you can see, the SMB client and SMB server, unlike many other protocols, talks directly to the transport. So whether you're talking to TCP or RDMA, SMBD that is, whether you're talking quick, the SMB client directly communicates with the stack. So it's kind of cool and relatively easy to implement in SMB, like I said, there's a good presentation on this from a few weeks ago at the storage developer conference and in a similar one a year ago, that show has a nice demo of that. And Wireshark can even decode this now, right? So obviously there's been quite a bit of progress in implementation of SMB 311 over quick, especially in Windows. So what about for the Linux client? Well, we got an obstacle here, there's no kernel driver for quick. So one of the things that we need to figure out is, is what to do. Well, quick itself is about 30,000 lines of code in user space, at least the MSQuick module. And there's similar sizes for some of the other user space quick modules. MSQuick has some nice features. And so I was looking at that, but there's two others as well. And it depends on TLS, but TLS 1.3 was merged in February of 2019 into the kernel. So there's already support for TLS in the kernel. You can take a look at this GitHub project. It doesn't use kernel coding style, but it might be mergeable with some changes. But what was interesting for me at the storage developer conference a few weeks ago was the annual storage developer conference, three other use cases came up. Three other networking cluster file systems are also interested in quick. So we really need to figure out a way to drive this secure encrypted transport driver, which has these nice performance advantages, but currently is only available in user space. We need to find a way to get that into kernel. And I'm sure there'll be politics involved. I'm sure there'll be lots of pushback, but we have to figure out a way to do this because obviously we need some of the security features. There's some nice security features as well as the performance features of quick. If not for SMB, for these other three use cases that we were talking about two weeks ago. So when SMB 3.1.1 is layered on top of quick, there's really no difference in SMB multi-channel and signing encryption. It uses server certificates. You don't have to double encrypt. There's a good talk by Sudhir Dantaluri if you want to look at it from this year's storage developer conference. What about data integrity? EXT4 supports something called Verity, FS Verity to allow enhanced integrity checking. And this is invisible over SMB, but SMB does allow setting file attribute integrity stream to enable enhanced integrity checking on some file systems and also file attribute no scrub data is kind of the reverse that disables data integrity checks by the background scanners. We could probably make these available in Stadex. Dave Howells added Stadex a few years ago. So these extended stat parameters could expose these and allow us to set in files so we want particularly strong data integrity on. Now, one of the cool things about SMB is that we have many cases where the client wants to do client-enforced security and in many cases, NFS does this as well. In some cases, you want the reverse. You want the ACL to allow, you want the client to be able to emulate the mode bits from the ACL, but not enforce them on the client because you have these multi-user identities with Kerberos tickets that'll allow the server to accurately enforce security. But in other models, you want the server mount wide open and you want the client enforcing security. NFS sometimes has this case. So when you do that, this IDs from SID and mode from SID mount options allow you to store opaquely in the ACL, the mode bits, as well as the POSIX identity, the POSIX UID in a way that'll allow the client to enforce it. Where in many other cases, you'll be mounting with something like SIF's ACL where the mode bits are emulated and you might mount with no perm mount option. And you're using multi-user, so you're allowing different Kerberos identity for each local UID. So here's an example chart that shows the different ways you configure it. But today, the vast majority of people configure a default UID and a default mode on the client to avoid these configuration choices. But you have three models in the client today, sort of a client-enforced model, a default model, and a server-enforced multi-user model that clients often choose from depending on their workload requirements. So what are the two do's? We have to broaden the supported security scenarios, have better SE Linux integration with SMB311. We have to have stronger peer-to-peer all support, maybe add support for PKU2U where the max local KDCs. We need to continue this work on stronger encryption to finish off the AESG CM256. And then this quick support, solving the port 445 problem. And then there's a similar kind of thing that's been recently made available for improving packet signing performance by using AESG MAC. Now, what do we need from the security team? Is Kerberos good enough? Do we need to add support for SPNego? Had additional protocols like OAuth for authentication that are opaquely available over SPNego for SMB? Do we need to extend PAM and NSS to allow mapping global SIDS and OIDs in a different way than RFC 2307? And what about rich ACLs? Is there a way to get rich ACLs or at least standardize the API between the six or seven file systems that can support it today, not just NFS and SIFT.co for SMB3? Can we expose file attributes for Stadex to mark files for enhanced integrity checking? And how do we get a fast, efficient quick driver in the kernel to allow for encryption and alternate a different way? And quick has, like I said, some interesting performance advantages, but it also looks like the way forward for many protocols to do secure, encrypted traffic, but we need to get away, need to find a way to get that into Linux kernel. So these are some interesting actions that we can talk about that we can bring up more broadly. Many of these are far outside the file system scope, but we'd love the help on this. If you have questions on this, feel free to follow up on the Linux SIFT mailing list on the Asamba technical mailing list or email me directly at smfrenshedgmail.com. And I thank you again for your time.


Hello Zach, welcome to Helsinki. Hi Linda. Yay, so I think we need to start with the story of how we met originally And it's not a typical we didn't meet at a tech conference. We actually met building something out in the woods out of the woods Yeah, you want to tell the story? Yeah so I I lived most my life in New York City and and After I sold Vimeo, I decided I want to get out the city for a while and bought some property in upstate, New York And I invited people to come learn how to build buildings with me and you responded to an invitation I put out on the internet anyone want to learn how to build a sauna and and You you traveled And helped me build one. Yeah, so as a fin I felt obligated to come and explain to the Americans how you actually build a sauna But I did learn a lot the thing I really like about you Zach is you contain multitudes You've lived many lives and had many careers beyond college humor and Vimeo and now DIY What do you think is sort of the glue that like? Puts all of these things together. What is the the passion behind all of these different projects and lives you've led? You know, I think what Well, I'll say one of the reasons why I'm working on DIY now is because I I Didn't succeed in traditional schools. I I never you never would have found me at the top of the class I wasn't an exceptional learner, but I was deeply passionate about lots of things and a lot of those things like SimCity Which I played lots of Weren't really understood or appreciated by by adults in my life so when I think I just was never really groomed for a conventional career and Was often living in my own world and when I became an adult. I think I just kept repeating this pattern of finding things that that made me feel passion and Being fearless about about stopping Doing things when they stop making me passionate and and in moving on to the next thing You can definitely relate to that one of my personal childhood passions was Mr. Al Gore and I made websites for him and now I as an adult like I got to meet him And I think that's that's the thing. We don't know yet. What kind of skills are gonna be valuable for our careers or our Lives as we go grow older. You also do quite a bit of investing and woodwork as we discussed before You lead companies you build products How do you think you get those skills to to practice these new things or? Especially if you're not born with the ability to say investing companies. How do you get the skills? Well, I think that that relates directly to I think the the topic of of this chat Which is preparing kids for jobs that don't exist yet. I think You know my aunt my succinct answer to that is that we need to use Education as an opportunity not to impart any particular skill in Children to depend on for the rest of the lives what we need to do is I feel is help children become fearless about learning because We are living we are leaving the era in which you can depend on a single skill to last your entire lifetime My dad's generation they they had an average of five jobs Between the age of 18 in retirement My generation in America we will have 12 jobs between the age of 18 in retirement And we should expect a similar increase for the coming generation So I think it's it's bizarre that we spend so much time Trying to get children To arrive at this age of 18 where they become an adult we push them out of home in school And we asked them to choose a single skill that They should depend on for the rest of their lives when really what's going on in the minds of children is the they They're not monogamous to a single skill There's actually many things in life that interest them and often what teachers and parents are doing is discouraging variety and Insisting that they focus because you need to be focused The argument is in order to be competitive Why do you think focus is such a like a highly valued skill in our our society? Well for that reason is because specialization there were yeah, there were so few previously in previous generations there were so few skills that you could actually make a livelihood from and you know What's happening is that the number of skills that you can you can make a living from is fractalizing and the Skills that emerge are actually becoming outmoded really quickly. So when I was in In elementary school a child I was making websites and that was unusual at the time And no one then knew what? Website, you know what web development was that wasn't that's still not something that's commonly taught in schools after decades, right? When I graduated college I Did call myself a web developer, but even web developer sounds a little bit antique today. Yeah, right? We're not talking about web development. We're talking about at very least mobile development most often so So yes skills are emerging, but they're also becoming obsolete very quickly And that's why I've sort of adopted a personal strategy It's very deliberate not to over-invest in a single skill to make myself flexible and to really invest in in Keeping myself in the position of being a beginner Because I think that that sets me up for a lifetime of flexibility. What's the next skill are the next profession? We're gonna see you do That's a great question. Well, it's I Think the next thing I want to do and this this this ties back to what I actually do full-time right now like right now I'm working on creating online learning services for children I would like to Take what I learned from These online services and build physical schools Yeah, because that's actually I think people are surprised that I that I have this opinion You know, we always say at my company That we're trying to build the world's second greatest learning experience because we we do believe that learning in person is The best way to learn to learn with peers. It's an incredible social experience To learn something together in a real space in collaboration, but it's not always possible for everyone everywhere to have that privilege of having a A School with peers that share the passion that you have so that's why online is so powerful because you can live anywhere And you can go online and be anyone with any anybody Principal Zach Klein. I like If you were to design a school from scratch, what would inspire you like what books or philosophical movements or Stuff like that. I'll let you think for a moment because for me for instance I feel like I'm so inspired by the 50s and the 60s right now Not about like the current Silicon Valley trends more about say like Reggio Emilia Which is this tiny town in Italy that came up with the idea that the child has a hundred languages to express themselves Whether it's sculpting or painting or coding or whatnot So where where would you where do you get like motivation or inspiration for the direction? You're taking whether it's DIY or or a physical school Yeah, I mean I get most of my inspiration from games actually. Yeah, so I I think that Games are actually, you know, we don't give them enough credit. I mean, that's that's not a new idea but they're Incredible communities have been created around games and and me and in my colleagues We were always looking at gaming communities to see how How Reputation systems work Let's do a deep dive into this because I think in Finland a lot of the discussion around gaming is around leaderboards allow around like collecting points about Gamification, I think you have a more unique perspective into this. Well, what I love about gaming in and honestly just any sort of creativity online is that Traditional like traditional Classifications don't apply. So in the gaming world, for example, it's always extraordinary to find just to learn just how young some of the best Gamers are. Ageism doesn't exist on the internet. Ageism doesn't exist In gaming you can be Excellent no matter how old you are and often people don't care about your age It's just not an important factor. It's how it's how you perform it and what you have to contribute to the community That is that is so important And it's it is a shame that we that we do need to masquerade who we are online in order to get that sort of respect But I think there's a lot to learn from That lack of prejudice that that you find in online communities. What else? In gaming communities Well You know, I think one thing is This is I'm it's very interesting to speak here in Finland because in Finland I mean in the United States we often hold Finland in such high regard For your the effectiveness of your schooling system So when I when I make assumptions about schools here, I hope everyone appreciates that I'm I'm coming from the perspective of the American school system You know, but one thing that is really disappointing about American schools is just how there's a boss who sits at the front and They lecture and instruct and then they give a command You know homework and all kids virtually turn in the same thing And all kids are competing against each other There's two things there that I think I find pretty fascinating All kids in the classroom are expected to be good at the same thing, but that is not really how Real life plays out In reality, we join groups In which we play a unique part. We're uniquely good at things and we are expected to collaborate and depend on other people To to work together to as a team create something bigger and better and more interesting than we could possibly do ourselves But that sort of collaboration is often discouraged in classrooms We we all are expected to know the exact same thing and to be better than the next person at it Right and our success is actually measured in how often we're better than other people at these at skills We actually have no interest in being good at and somehow school asks you questions that have already been answered a Vizillion times ago and never encourages you to come up with your own questions and your own interests was it so frustrating, right? And that was the other thing I was going to say is that often when kids turn in homework, you know You know they everything that's turned in looks the same It's it's already been done before and often kids are you know the things that they make are prescribed And the kids have no interest in each other's work That's what I think is so cool about gaming and and just online creative communities is how Much novelty there is in each other's work. We we love seeing what each other makes You don't see that often in schools I think that's the thing with you and me like we grew up in this Internet of the 90s where you could you were Anonymous first of all there was no like data trace of your identity online for the future to see and we were also allowed to Experiment and create and also delete our own existence How do you feel about the kids and the internet today where their experience is so much more curated and so much more Contained they watch YouTube videos and and so forth Could you expand on that a little bit? I think like the thing I'm seeing online is that and both online and offline is that our kids are being more Contained they are not allowed to walk in the cities but they are also not allowed to walk on the internet and and Experience things in the same way as we do and and somehow we have no ways of like preparing it from them for that future and I think One of the like beautiful things I like about DIY is that it offers kids this place where they can be creative online where they can Experience the internet we grew up with that doesn't really exist that we kind of lost as we went on Yeah, I'm gonna give a little context for the audience So one of the projects that I work on is called DIY org and and it is in a totally open-ended You know community where any child can join It's a blank space. They can add anything to it often the things that they add Or that they share with the community are things that they're learning or things that they're passionate about Kids can find other kids who share their passions. They can follow each other just like you would on on Instagram And they're often learning from each other. What are they like? What are the sad and strange things you've seen kids make on DIY or If that's too depressing a question What are sort of that the skills you see kids learning on DIY that you think are gonna be the future web development skills that the skills that we Don't appreciate yet That will someday become careers for these kids Well, I'll ask you I'll answer your first question and you can stop me if you if it is too depressing But the hardest thing about my job is that we are often having to play the role of surrogate parents Because kids are spending so much time online We they're sharing a lot online and me and my co-workers were absorbing all of this The things that happen on DIY can be as meaningful as on the playground or right? And then the hardest part is that especially in America right now. We're living through an extraordinary Cultural moment where there is a lot of division within the country and the conversations that are happening at the dinner table between parents are being repeated online by children and They don't necessarily understand The the forces of these conflicts. They're just repeating what they've absorbed from their families and these debates are being played out with children as proxies and we You know, it's it's strange. We got into this to help kids learn creativity But we've we're often having to develop our own We're having to learn on the job and learn how to deal with these conflicts that we didn't anticipate Tell us something optimistic Well, you know one of my favorite things about the community is that the So it is open-ended kids can upload anything they want But we we try to like create pathways for them to learn new skills so they we have all these different badges that you can earn by by by completing challenges and so one of the coolest thing is when we we have a new idea for a skill will it will create it and We'll put it online and then kids will do the challenges, right? And there's 600,000 kids on the community. So inevitably anything we add will get tried by someone and I was just telling someone backstage one of my favorite things We just did is we introduced the reader skill so it's not it's not about teaching you how to read but it's it's They're challenges for people who are really passionate about about reading or or fiction So, you know, one of the challenges would be write an extra chapter for a book that you love Or cook a meal from a book that you've read but the last challenge for the reader skill is to Build a library and so what was awesome about this was that on Friday we we introduced the skill we announced it to everyone in the community on Monday I came in and Several dozen kids had built libraries over the weekend. They had put dressers and wardrobes out in their front yard Painted it had marked all the shelves with the different categories of books and had just put signs that say free books We'll continue building a library with you on the QA stage afterwards this I think the final question for the day is if childhood is the original adventure if we're preparing our kids for a future Where we don't know the skills. I think we need to try to answer this question of the discussion What are the future skills our kids should learn? Well, I I'm gonna echo or repeat some of the things I said earlier in our conversation, which is I I think it's we first need to accept that the role of education is to help kids thrive for the rest of their lives and We have been leaning on too long a strategy of overemphasizing some skills that were important in a different era and given that No one I mean we would all be very wealthy and successful if we were good at predicting the future this entire conference is Is based is built upon this idea of us being? You know it's basically a fetish of the future, but it but that's what makes it so interesting We don't know what's coming and so I think we should accept that that we and we should Find tactics that are less focused on on helping kids learn specific kids skills and More Interested in helping kids become fearless learners Help them Anticipate that what they're passionate about now May not be the thing they're passionate about 20 years from now and that there will be a strange journey for them in Finding and recreating livelihoods for themselves. They're going to have multiple livelihoods over their lifetime or strange journeys and great adventures Thank you very much. Thank you


from Vienna, Austria. It's theCUBE, covering .next Europe 2016. Brought to you by Nutanix. Here's your hoes, Stu Miniman. Welcome back to SiliconANGLE Media's live coverage from Nutanix .next in Vienna, Austria. Worldwide leader in enterprise tech coverage. Thrilled to have to the program. First time guest who just came off the keynote stage, Ben Verweyen, who is the general partner of Keen Venture Partners and was former CEO of Alcatel Lucid. Ben, thank you so much for joining me. My pleasure. All right, for our audience, you on the keynote stage this morning, we're talking about disruption. You have a good view of what's happened in the marketplace. You said you worked for some very large companies, went through some challenging transitions and now we're working with some of the smaller companies there, so just give our audience just a brief summary of what brought you to what you're doing today and what you do in your day job. So disruption is not an aim and goal in and by itself. It's more an observation from the outside that people who try to do something better or try to do something new cause to other people. That's what we call disruption. So I've worked over the last 40 years almost. I was large, big corporations. I was the CEO of BT. I was the CEO of Alcatel Lucid, for example. And those companies, big, large companies, was the big installed base of products and services where many people are very happy with and other people are not so happy with. They have to change and adapt in order to keep fulfilling the tasks that they have. And that is sometimes a kind of linear process. You make the next generation of products sometimes very disruptive because you have to do something completely different. Most of the time companies can do that themselves. Sometimes they can't. And then somebody from the outside takes over. That's the disruption we're talking about. And I've been at the big size of cooperation for, as I said the last almost 40 years, now helping small and scale up companies in Europe to fulfill their potential. And that's not just by capital. We do have capital, but it is by helping them to think through how they can become more effective faster. When you talk about disruption and growth and especially startups, there's a natural tendency for people to talk about Silicon Valley. One of the discussion points on the panel this morning was how do you get those pockets of innovation? What advantages does the European economy have versus Silicon Valley? So I wonder if you might be able to summarize that piece of it as to why Silicon Valley isn't the center of the universe or the only place that growth and innovation happens. So it is certainly Silicon Valley's a remarkable place. I mean, lots of very important, great things happen there. But it's not the only place and it's not the only model. There are different models. As I said this morning, I think talent, talent is everywhere. It's about enabling talent to do something that is disruptive in a positive way because they have an idea or a concept and they can bring it to a global audience. Sometimes it helps to be in a crowd. Sometimes it helps to stand out because you are somewhere that it's not such a crowd. And we have a very diverse model nowadays in the world. We tend to see it from the Western lands. Well, I'm also on the board of a company in India. If you take the Eastern lands, the world is very, very different. Household names for a long time were basically Western names. Think again, they also come from Asia nowadays and they build very, very quickly. So the idea that we have one set of, this is how you have to do it type of rules and it's called Silicon Valley is not true. Okay, and the point you made is that that diversity of cultures doesn't Silicon Valley. I think they have, you know, not only the universities there, but it seems to be influx of global talent to participate in there.  People come from everywhere, but that doesn't mean that the DNA is not an American DNA. It's a very American DNA, which is great to a certain extent. It's monolithical in a way to a certain extent. And there are other parts of the world where you have a very different type of cultural backgrounds that also contribute. It's not, in my view, one against the other, it's end, end. I just said it's not true that you have to be in Silicon Valley to be successful. It's not true that you are global because you have people from different passports working together. Culture, DNA is a little bit more than that. Another thing I found very interesting is talking about small and big companies needing to work together. I've worked for some really big companies and it seems most people in big companies spend most of their time trying to figure out how to work with the other people in their company.  So this is one of the interesting dilemmas.  Why you've started to become big? And but in the journey, on the journey to become big, you say, oh those big companies, you know, they fight internally, one department against the other, it's true, but why do you then aspire to become big? Because you want to be successful. And if you're successful, you will have to deal with different set of complexity than when you're small. What I've noticed is that innovation, truly thinking out of the box, used to be was in the four walls of the company and that was very hard to organize. Then we realized that you had to go out and reach out to people from the outside. So we had internal type of venture capital. And I've done that, you know, when I was, I was BT, we set up a fund and when I was at El Cattel, we set up a fund, very hard to do from in the company. So what you need to have is a kind of open-mindedness where the idea may come from everywhere and you go and work together and run with it. This type of networking company has one big hurdle. And a hurdle is the human nature to be scared of sharing. And the whole idea is you need to create a sharing economy. Okay, so things like open source, are you a strong proponent of open source as part of that? It's one of the components of that. I'm not religious about it in the way that, this is the way to go forward and therefore the other one is not. What you have to have is the ability to use pick and choose. Pick and choose. And the only way you can do that in larger organizations if you get permission from the top. So in my past life, what I thought my role was as a CEO was not to be smarter than the rest of them but give them the license to be smart. And that enabling capability is also true in a smaller company. Give them the license to reach out. I love that. So Ben, you know, Keen Ventures invest in technology companies. What are the segments and sectors that you're focusing on? So we're focusing on areas where we have some expertise. Me and my partners, my partners have done it themselves. They have, one of them has created TomTom from a 20 million company to a two billion company in five years time. So my background is much more from the corporate side but if I look to where we have something to add more than money, we're looking to the developments around internet of things type of technology where the internet is not just technology but it really means something. So that's the first area. The second area is where you can use software both at home and in the office. It used to be that you went to the office to be in all what's there. I think lately you go home and you think why don't I have this in the office? So that type of environment and the third one is what we call convenient transacting where you make a substantial difference and a momentary difference for your customers because of smarter ways to go to market.  The other examples you could give me maybe to understand. Yeah, so there are companies that for example can predict what churn is going. So instead of doing marketing for everybody, you know exactly which part of your customer base has a problem. Now those type of abilities to bring true benefits, that's what we're looking for. But actually, if I may say- So there's a personalization there you're saying? Yeah, yeah. If I have a million of customers, can I single out that one person? And nowadays was a big day that you can. But what I want to say is actually if you ask me the question, where do you invest? When do you invest? We invest, we have a philosophy that says human capital first. So we're going to work with the company before we go and even talk about money. And when we work with them and help them and create them, it's very possible that we help them to go to bigger things without investing in them. But it's also possible to know and understand the entrepreneur at the end of the day. It's people business. Another thing you spoke about on the panel was really understanding what society needs, things that can make an impact. I'm curious, IOT, the Internet of Things piece. I've heard medical health care is an area that that's focused. Are there other areas that excite you of the Internet of Things because people here just centers and devices and trillions of pieces? Where are the people in the mix and how will this help society? So interesting thing is that a subject becomes available and then needs to be hyped. That's the phase you should stay out of it. Absolutely stay out of it. Because if it's the great story, it's the compelling story. It may be a compelling story for a journalist. It's certainly very seldom is something that has legs and run in the market. So Internet of Things is nothing else than make technology available to really solve an issue that matters. When it's still in the hype phase, it's nice for a TV program, probably not nice to invest. So we are still in the early days, but I think Internet of Things and supply chain makes a lot of sense. It's not sexy, but it makes a lot of sense because it delivers on a continuing basis something that is really beneficial. I think productivity is something we struggle in the economy with. And without productivity, there's not a really chance to enhance the economy as a whole. I think Internet of Things can help to do something significant around productivity. Yeah, you also spoke in the keynote about how just the buying power for the average family, it's gone down over time. You consider yourself kind of optimistic, pessimistic. What do we need to kind of help society as a whole with jobs, where they're earning power, being able to, as you said, have a house, have a car, put your kids through college. So it depends where you stand. If I go to India and I go there on a regular basis, every single time I realized, the first time I came there 30 years ago, the middle class was maybe in the tens of millions, it's now in the hundreds of millions. In a very short period of time, they have been able to lift hundreds of millions of people into a situation, concrete situation that they have choice. They can send their kids to college, they can do something. That is phenomenal. At the same time, if I fly westwards, I see the situation that if you were privileged 30 years ago, not necessarily privileged today. So am I optimistic or pessimistic? I'm realistic, I hope. And what I see is there is a middle class that was that struggles to stay the middle class and that we need to think through what does it mean. I see chances for people that had no chance in the past will have a chance in the future. And you need to find the balance because change cannot be winners and losers. Change has to create opportunity. And I think we're struggling a little bit at this point in time. Does the current global economic environment, things like Brexit, the U.S. economy, impact your investment philosophy? Absolutely, it impacts everybody. Now, it doesn't need to be just a negative, you have to look to it, but it should pause all of us because we have this knee-jerk reaction to want to go back to yesterday's world. I mean, the whole idea of Brexit was take back control. The whole U.S. election, as far as I have seen, that was about make America great again. If I look to Europe, there's a lot of, let's get the borders back in. It's like whether the policies of yesterday will deal with the problems of tomorrow, I don't think so, but we haven't found a narrative to convince people, be with me, stay with me because it will be better. So, then most of our audience is in the technology industry. Yeah. Last question I have for you is, people are looking out in their careers. What advice would you give people as they're doing their job today and looking towards tomorrow? So the big change of technology has been that it was a kind of enabler to allow other people to do their job. So you would go to technology to get maybe something faster done or better done, but not what it is today, part of the strategy. So what I would say if you work in technology, you have to take that responsibility to the next level. Technology will be a platform, a platform that it was, an ingredients of success in the future. So if you work in technology, be loud. Make sure that everybody in the organization knows what is available. Make sure that you look outward and not inward.  All right, well, Ben Verwein, thank you so much for joining me. We'll be back with lots more coverage here from the Nutanix.next conference in Europe. You're watching theCUBE.


Right, right. Right, alright. Oh yeah, feel it down in my lungs and my loincloth is wet.  I have a wet loincloth. Gross. And you can follow us on Instagram, Twitter for more juicy content. Thank you both for following us on Twitter account. Ring the bell to be part of the vacation squad. Ring it like you mean it. Thank you both. And follow us on our own personal YouTube channel, I don't know where I'm at right now. On our own personal YouTube channels, links always in the description below for different stuff. If you're there. Today we are doing a review movie. Because you did it backwards, I'm doing it backwards. Uh, it's for a trailer we reacted to probably a year ago. But it's called Aligarra. Aligarra? Hey, is that what you're, I know it's a city name. Yeah, I'm guessing Aligarra. That's my guess. I know it's a city. But it's uh, we saw the trailer almost a year ago. I don't know if you remember watching the trailer, do you? Oh, I do. I remember watching it and I remember thinking I want to see this movie. Yeah. Yeah, we watched the trailer and we were really interested, but obviously just like everything else, even though people accuse us of ignoring their things. Yeah. A million things on the list and we finally got to it. So sorry. But it's based off a true story. True story. Which is depressing.  And I know this, I know a lot of people have seen it, but I know some people haven't. So go watch it and come back if you don't want to be spoiled, please. But I think most people know the story probably. I think it was a pretty national story. Yeah, I guess. Obviously. I don't know about you. I had no idea about this story. No idea, but it is something where maybe people haven't seen the film, but they know the story. Like Adrani, when I told her the name of the film, she said, oh, that's about the homosexual teacher. I said, yeah, have you seen it? She said no, but I know that story. Yeah. And it's a pretty universal story. I think amongst almost every culture, I believe almost every culture has had an issue with homosexuality. For a saint? Lenny. America has had plenty still wrong with it. But happy pride, obviously, to everybody. Anyways, but go watch it if you haven't seen it and then come back and then you can hear our review. We like doing spoiler reviews. So obviously, starring this is technically our second. Yeah. But I think this is our first really. I don't know about you. Yeah, I would say it is. I mean, we've seen him in a lot of supporting things. This is the first thing we've seen him in where he's the star. No, no, we saw gangs. Gangs won. He was the star. Yeah, that's true. That's true. But we actually haven't seen him in anything else. Right. We've only seen him in trailers. But obviously, we hear that lots of people think he is the greatest actor in India, you know, the various opinions on that.  So we finally wanted to get to some of his films so we can start getting introduced to the man. Yeah. Rick, your initial thoughts. My initial thoughts, you know, in the form of my paragraph. And by the way, everybody. Oh, we have one. Good. Yeah, we have one this time. And if we if we tell you to go see a movie, odds are our review is going to be positive. So that's a little indicator right off the top.  But exactly. I suspect I'm going to predict our reviews probably going to be a little bit longer than usual because of the social justice stuff in this thing and how it's such a prevalent issue for India. And it's a prevalent issue in America right now. But my paragraph is, I think this is a grounded and thoroughly believable telling of an incredibly important true story, important not only for social justice issues and victims in India, but social justice issues and victims in any part of the world where people are oppressed and criminalized simply because they're different. Yep.  We expected him to be what he is. He's a great actor. He delivered what I expected the same way when we watch anybody that we've known now you watch your phone, that's going to be great. You watch Nois, it's going to be great. You watch Raj Kumar Rao, it's going to be great. But I got to say the casting, I don't know the real man and how replicating he was. But for me, it's immaterial because I felt like Minaj Bajpayee's portrayal was so freaking good. Yeah. And he carried the film on his shoulders in the way that say, when you watch a Daniel de Lewis film, he's carrying the weight of the film on his shoulders. Yeah. And it was so obvious. He was brilliant. Brilliant. I love his performance. It was so and the fact that he carried the whole thing and was so incredibly small and hardly did anything. My wife pointed out the beginning and that's all I could see after a while is that in this, I know I've seen him in real life and I've seen him in gangs. And so obviously him in gangs is very different than he was in this. Very different. If people didn't tell me, I probably wouldn't have recognized it, that it was the same man, which is a testament to this man and how talented he is. But he reminded me a lot in this character of Tony Shalhoub. Oh yeah, great comparison. If you don't know who Tony Shalhoub is, he's a phenomenal actor. He is Tony Shalhoub. He's deeply respected actor in America. He played Monk. He's in Marvelous Mrs. Maisel currently, and that's, I think, one of his best roles he's ever done.  No, he's not Jewish, but he looks Jewish. He has big beard, big hair, the mustache, but he's very soft, spoken a lot of times in his roles, and it's very small, but always extremely brilliant and believable. Yes. He's a highly respected character actor. I would associate him as a character actor, right? I would too. But I think his performance in this was just so, so good. Some of my favorite moments were actually when he was listening to music. Yes. And the director was not nice to him in terms of he was like, I'm going to film you and you're going to do this and we're not going to cut for like a good minute. There is, and I was just going to say I'm glad you brought that up because it's a testament to the direction of Hansel Mehta from mispronouncing his name, forgive me, but Hansel Mehta I thought was very reminiscent of the directing style many times of what we loved about lunchbox. Yeah. The fly on the wall, just hold a shot. There's a couple of shots he did where he's holding for a really, really long time on Minaj. It reminded me of there's a shot when you're watching one flew over the cuckoo's nest, they're having the party in the hospital that they're not supposed to be having. And there's this long shot on Jack Nicholson just sitting there and it's starting to get late and they just hold on him for 60 seconds. Yeah. And Jack just thinks and sits there and then looks at somebody and smiles and then he kind of daydreams for a minute and the director you were right was like, okay, I may never cut, so let's see you not perform. Yeah, my bet was that the director just said I'm going to kind of just let you, let you go. And then when I feel like the scene is done, I'm going to say cut. So just be in the moment, listen to the music, feel how do you think this character would react in this moment. And it was beautiful. And it's so hard to not act in those moments and people don't realize how hard that is. It's true.  There's one of them that's called private moment where you simply get up in front of the class and for an extended amount of time, you're supposed to have a private moment that you wouldn't ordinarily want people to see you having, whether it's you're going to the bathroom or you just woke up in the morning, you're just sitting watching TV. And the primary thing you're doing is not performing, not acting, not needing to entertain, you're just being and it's stupendously difficult, incredibly hard to just do nothing and be natural. Just sit and be singing your song or just I love the moment toward the end of the film when he's, he's on the phone with Rush Kamarao and he says he's getting sleepy and he lays back down and there's nothing, the cameras are still on the wall. Yeah. And then he just sits back up because he heard something. A beautiful airing of director and actor, I thought. Yeah, and obviously it means it goes without saying I want to see more of him. And I know you guys are like, hallelujah, thank you finally. But I don't, and so in the comments, of course, we're going to go on here, but recommend what we should watch of his next. I don't know if it's, I think Black Friday was one of his first, that's on your head cash up. And then there's also that one that we just reacted to the Satya as well that a lot of people rave about as well. So let us know. I know he has a ton of work that's all I'm sure brilliant, but we want to explore this man more. I think the rest of the cast also did really obviously Raj Kamarao did really, really, really well. I thought he's really interesting how they kind of left it open to interpretation. I didn't because I didn't know actually if he was actually gay in the end or not. Yeah. And I like that they didn't answer that. And so because you, you know, he slept with that girl, but you don't know if he just did that because he wanted to or if he wanted to get a promotion or what. Yeah, I don't know if that was the actual person in the story, but I appreciated the fact that we may have been watching a young man discovering what it was he was attracted to at that point. And we didn't need an answer. I agree. Yeah. And so I thought that was that was really nice. If he, because he talked to him, he said the day before, and that's one thing I want to talk about the end of the film and how awful it was because he was clearly murdered like 100%. He was set up in the first place. Yeah. He was set up and then he was murdered. But for some reason they ruled out foul play. What? How? And so that obviously it's different countries and because the entire time you're trying to make sure you're like, okay, this is not America.  That's a different country. Why is this allowed? And then the fact that they flip flopped multiple times. And obviously gay marriage is now legal in India again.  Marriage is not. Sorry, sorry.  Right. But it flip flopped what, two or three times to get back. And that probably caused a ton of animosity between a bunch of people and caused a bunch of people that happened to not just this man, but probably a ton of people in the country. Oh, absolutely. A million.  Like, if it's the law, you can't discriminate against the person or fire them just because you don't think that thing that they're doing is correct. It's, God, it makes me. There's an American law. I was thinking about that watching it because obviously we are totally, we just recently came to understand that there's no jury trials in India. So we don't understand all of the ins and outs of the legal system or constitutional law like we do American stuff. But I was thinking to myself, because in American law, you could have, for example, homosexuality is not criminalized. It's legal in all states. It's marriages are granted in 37 of the 50 states already. So the only way an institution or university could get away with firing someone for being homosexual would be if they had a policy within the school that was already printed within the contract of that teacher that said, we have certain standards and ethics that we hold true for us as an organization. And if you violate these standards, whether they're legal or they're not legal, you are agreeing that you are able to be terminated if you violate the term. In the same reason restaurants say, we can, we have the right to refuse service to anyone. You will get a constitutional fight. And the person's going to win because the constitution's what protects them. But that didn't never seem to come up. It was almost like we're just saying we didn't like it and you have to agree. And they're like, the constitution of our country says this is no longer criminalized. So I'm with you. I was like, we actually, why are we even having this conversation? Yeah. So it was, it was strange like that. I did, I, I thoroughly, there was the only a few things that I, it was supporting, there were some supporting actors that I didn't enjoy. But it would not, not a lot. I enjoyed Manoj in the courtroom scene. I thought he was really fun to watch. Sleeping. Yeah. Like just, he was like almost nonchalant just in the background. And also the fact that he, I thought it was really interesting.  And what that meant to him? And he never really explained it either. And, and I saw, I thought everything the writers did with this, I thought was really nice and beautiful. I agree. I think the, even the filmmakers, because it's in India, even held back some. Oh, for sure. Oh, for sure. Like, because if this was done in America, I feel like they would have been a lot more in your face about people's bigotry. I think it would have been more in your face about the bigotry. I think we would have had more graphic depictions of the sexual relationship between him and the rickshaw driver. And when they filmed them as well. Correct. Yeah. I think it would have been more graphic. I think they would have wanted to get the shock factor. How vile that is to go in and film somebody in their own home. Like, you want the audience to be like, this is horrifying. How could, how could anybody do this?  Sorry guys, if you like sensory boards, I hate them. You can't censor all. Anyways, that's not the point of this. But yeah, so I think if they made that here, it would have been more, but obviously it's in India. So I didn't really hold it against it. But I would have even preferred it to go further. I would have too. But I think, I think the directors were probably wise based on the little we know to make it. I think for many Indians, it was for what they've been exposed to shocking. Yeah. And I think had they gone farther, they might have missed the importance of the message. And it would have been more about the shock factor versus the importance of the message. Yeah. And it's really interesting to me because there's still places on earth where very small fractions, thankfully, but there's still places where it's not only criminalized, but you can be sentenced to death if you're found to be homosexual. Yeah. I mean, it wasn't, I mean, it wasn't the law, but it wasn't too long ago in America that people would do that too. I mean, it's probably still happens to people because obviously it happened in a shooting.  And when we in Texas, there's been many accounts of guys in pickup trucks finding gay men and dragging them behind the truck and beating them and leaving them on fences. So obviously it's not legal, but it happens. Right. Yeah. And that's that's the really sad, sad part, which is why all over the world there are these pride parades and stuff because just like, you know, Black History Month where they celebrate their all coming out from all the oppression and everything that happened to them, gay people have almost gone through the exact same thing. It just in a different way. And it's a universal thing. And it was a sad thing when he talked about had that he could come to America and somebody like him could be live a respectable life. And then Rajkumar's character says, don't say that. Because he was like, he was like hurt that he thinks that he couldn't be respected here in India. Right. But you know, because he was the young guy and he was all hopeful, but he was his name Manoj. Is that what you say? I think so. Manoj or Manoj? Yeah. Manoj character is like older. And I think he was just almost like, no, this is what it is right now, sadly. Yes. And so the difference in age, age gap. But I thought as a whole, the film was really, really good. And I thought powerful and obviously acting and directing and everything like that was top notch. Top notch. Agreed. Agreed. And the other thing, I didn't put it in my little paragraph that, you know, I talked about the social justice issue, which is the primary point. There was another aspect of this that is another conversation and possibly for another time. But most social justice issues tend to also run counter to this idealism where people want to impose moralistic or religious beliefs into the legal system. And the line between having a democracy versus a theocracy is really blurred. And I don't know how many people recognize that that happens, because it doesn't just happen in India. That happens here in the United States. Yeah, all the time. We have all the freaking time. I don't know how many times I've had to remind the people who are taking the moral high ground quote unquote and remind them, we don't live in a theocracy guys. We live in a democracy. And that that's another issue because you have that tension of of the you saw it in the story that all of the people at the school were pounding the table for their moral prerogative and completely forgetting the fact that the nation has a constitution protecting the rights of this map. Yep. So really important, important stuff. Yeah. So I thought, like I said, the film was brilliant. I know some people I'm hoping you're not. Well, you probably know the story. So I guess if you're still here and you haven't seen it, go see it and watch this film because I know obviously this is more of a probably art house film in India, I would I would say I'm assuming this wouldn't have a I mean, I'm I bet it had a nice opening and it made some money, but it didn't make war money. It didn't it didn't make stuff like that because it's not mainstream and it's not a message that a lot of people like to go. If we do, we enjoy these types of films, but like some people don't they want escapism. And this is not escapism.  I love those films. I do too. It's to me, it's it's the quintessential purpose of cinematic artistry is the capacity to not only create something of aesthetic beauty, but create something that has a virtue to it that's going to be communicated about the human experience for all time, where you're going to be reminded for all time, because this isn't just about right now. I mean, I did a little research. The idea of homosexual of homosexuality being criminalized was not introduced in Indian culture.  Yeah, it wasn't introduced into Indian culture if my research is correct, until the British got there. That makes sense. That makes total sense. Yeah, it's definitely art house. And it's also one of those things that we could put into the conversation of the top films we would recommend for Western audiences to appreciate Indian cinema. I think most Westerners would love this film. Absolutely. I think it would be an easy recommendation, especially for people that like Oscar films, like artsy films, if you have friends that are into the Oscars and stuff, they will 100% love this film. I think the only thing that I would want more is that I want it to be more in your face. I want people to be uncomfortable. And one other thing we didn't shout out for is that needs a shout out. I mean, there's so many technical things we could talk about in regard to any film. But one of the things that I felt was as important as everything else was, I felt that the score by Koran Khokami was very, very tasteful. The kind of score where the moments you need to notice it, you do, and the moments you don't need to notice it, you don't. Really, really nice score, really well done. The whole film is just great. Also, I thought that the person Rajkumar slept with, I don't know if it's Dil Nas Arani. I thought she did really, I thought at first I actually thought it was Kalki, like for a split second, I was like, is that Kalki role? Yeah. I thought she did really, really well as well. So I just wanted to get, and there was one more person in there that he didn't have a huge part, but Rajkumar's buddy who was in Talvar, right? Yeah. Was he in Newton as well with Rajkumar or no? I don't know. Was he? We've seen him in a couple things, but yeah, he was good too. Yeah. So yeah, like I said, I thought everything was really good. Let us know, because this director was also the director of, I believe, Shahid and Omurta, where Rajkumar plays a terrorist in one, I believe. And so I believe people highly recommended those. So let us know more about this director and also more by Manoj. Yes. We need to explore that man a lot more because as you know, and we now know, he is a very talented man. Really good actor.