فشرف بل اشتغالي بالعلم ولا تبغي به ما عشت يا بدا بدا وياله من شراف عظيم الحمد لله رب العالمين له الحمد الحسن والثناء الجميل وأشد أن لا إله إلا الله وحده لا شريك له يقول الحق وهو يهد السبيل وأشد أن سيدنا ونبينا محمد صلى الله عليه وعلى آله وأصحابه والتابعين لهم بإحسان إلى يوم الدين أما بعد نحن في المساعدة الكتاب دفع إيهام للضراب عن آيات الكتاب وخطأ من الشيخ العلمة محمد الأمين ابن محمد المختار ابن عبد القادر الجكني الشنقيطي رحمه الله نحن في المساعدة الكتاب التي يمكن أن تأخذ منها قرآن وقرآن وفي حقيقة كما نعلم القرآن لا يوجد قرآن في قرآن ونجد قرآن في القرآن وفي حقيقة كما نعلم القرآن من هذه الحقات التي الشيخ أخبرها أخبرها منها سمم بك منعميون فهم لا يرجعون هذه الآية يدل ظاهرها على أن المنافقين لا يسمعون ولا يتكلمون ولا يرصرون وقد جاء في آيات أخر وقد جاء في آيات أخر ما يدل على خلاف ذلك كقوله تعلم ولو شاء الله لذهب بسمعهم وأبصارهم وكقوله وإي يقولوا تسمع لقولهم أي لفصاحتهم وحلاوة ألسنتهم وقوله فإذا ذهب الخوف سلقوكم بألسنت حداد إلى غير ذلك من الآيات ووجه الجمع ظاهر وهو أنهم بك من عن النطقي بالحق أنهم بك من أنهم بك من عن النطقي بالحق وإن تكلموا بغيره صم عن سماع الحق وإن سمعوا غيره عمي عن رؤية الحق وإن رأوا غيره وقد بيانت على هذا الجمع بقوله وجعلنا لهم سمع وأبصار وأفئدة الآية لأن ما لا يغني شيئا فهو كالمعدوم والعرب ربما أطلقت الصمم على السماع الذي لا أثر له ومنه قوله قع نبب الأم صاحب صم إذا سمع خيرا ذكرت به وإن ذكرت بسوء عندهم أذن وقول الشاعري أصم على الأمر الذي لا أريده وأسمع خلق الله حين أريده وقول الآخر فأصممت عمرا وأعميته على الجود والفخر يوم الفخار وكذلك الكلام الذي لا فائدة فيه فوق العدم قاله بيرا تبن أبي وهبن المخزومه وإن كلام المرء في غيره وإن كلام المرء في غيره كنه وإن كلام المرء في غيره كنه لكانا نبل لكانا نبل تهوي ليس فيها نصالها لكانا لكانا بل تهوي ليس فيها نصالها ما هو your say now the seventh point which is قوله تعالى in the statement of Allah صمم بك من عميون فهم لا يرجعون صمم they are deaf عميون they are blind فهم لا يرجعون and they do not come back هذه الآية this verse يدل ظاهرها from the apparent it shows أن الملافقين are the hypocrites لا يسمعون that they do not hear ولا يتكلمون and they do not speak ولا يبصرون and they do not see so this verse has shown us that the ملافقين they do not hear and they do not speak and they do not see وقد جاء في آيات أخر in other verses that have come it has indicated ما يدل على خلاف ذلك opposite to that meaning meaning that they do hear they do see and they do speak an example for that is قوله تعالى in the statement of Allah ولو شاء الله if Allah willed لا ذهب بسمعهم الله تعالى will take their hearing from them وقبصارهم and they are seeing وقوله and if another example for it is the speech of Allah وإن يقول when they speak تسمع لقولهم and you hear the speech اي لفصحتهم وحلاوة ألسناتهم in eloquency and the sweetness in their speech when they speak وقوله in the statement of Allah فإذا ذهب الخوف سلقوكم بألسنات الحدان which is that they speak سلقوكم and they utter words and they speak إلا غير ذلك من الآيات other than those verses that all indicate that they speak they hear and that they see so how do we reconcile these evidences if somebody comes up to you and says to you the Quran contradicts itself here you have Allah saying they are deaf, dumb and blind but here we have them here we have first is that showing us that they do here and that they do speak so how would you reconcile between the two the way to reconcile between it is it's easy, it's nothing hard they are unable to speak they are unable to speak the truth وإن تكلموا بغيره even though they can speak other than the truth so the thing that Allah is saying to them سبحانه وتعالى they are what? عن النطق بالحق in speaking the truth وإن تكلموا بغيره even though they can speak other than it صمون they are deaf from what? عن سماع الحق here in the truth وإن سمعوا غيره even if they can hear other things عميون they are blind عن رؤية الحق see in the truth وإن رأوا غيره even though they can see other than the truth so when Allah is saying that they are they are unable to speak their mute and they are also blind and they are also deaf all of them is referring to when it comes to the truth but other than that they are not deaf and they are not and they are also not blind from it they have it so all of those three is what's meant by it عن النطق بالحق they are mute from speaking the truth وإن تكلموا بغيره even though they can speak other than it صمون عن سماع الحق they are deaf from here in the truth وإن سمعوا غيره عميون and they are blind from seeing the truth وإن رأوا غيره even though they can see other than it وقد بينات تعالى هذا الجمع بقولي all of those three Allah has already told us in one verse that is what's referring to is the truth which is قوله تعالى in the statement of Allah وجعلنا لهم سمعا we have made for them what hearing وابصارا and we've also made for them what eyes وفيدة and heart وجعلنا لهم سمعا وابصارا وفيدة we have made for them all of those three but those three haven't benefited them لأنما لا يغني شيئا فوق المعدومي لأنما لا يغني شيئا فوق المعدومي even though Allah gave it to them He said I gave those three to them they are still not able to benefit from it because the eyes has to take you to the truth and if it doesn't take you to the truth it doesn't benefit you because the presence is like its absence again the same as with the hearing your hearing should be something that takes you to the truth or you should be able to hear the truth if you're not hearing the truth having your hearing is of no benefit so it's كلا معدومي like you don't have it and also speaking the truth if you're not able to speak the truth then the utterance and the speech that you have is not of benefits نعم والعربو the Arabs ربما أطلقت الصمامة على السماع الذي لا أثر له the Arabs sometimes they refer to and they use the word صمام which is to be deaf على السماعي when it comes to hearing الذي لا أثر له when it has no effect on a person if you're advising a person and you're telling them something and they're not taking it on board they refer to that person as what a person who is deaf even in English don't they say it's falling on deaf ears is that oxymoron deaf ears then the answer of the ear is to hear is to hear right so you're saying it's falling on to deaf ears in other words he's hearing but he's deaf how is that possible صحيح and this is like the statement of the Arabs and he brings an example of the Arabs saying this he says so whenever they are deaf when I am mentioning in a good light they are deaf they don't even hear that وإن ذكرت to be and if I am mentioned in evil عندهم أذينوا they have ears now they understand it they know it so this bait is بحر البسيط as you can see from the form it's قعنة ببنه in his book لباب الأداب you can find it is written by ابنه من قدن also الصحح لمام الجوهر رحم الله brings it he wrote a book he wrote a book which he called it من نسبة إلى أمه من الشعراء people people people people people people people people people people people who have been named after their mothers from the poets عبد السلام حارون who is one of the محققين scholars who specialize in تحقيقاته في كتب he also brings this in it وقولوا الشاعري and also the statement of the poet أصموا عن الأمر الذي لا أريده they are deaf they are they are deaf عن الأمر الذي لا أريده in the matters which I do not want وأسمعوا خلق الله and they are the most hearing of people حين أريده in the things which I want بيضاو يستشهد and also كشاف وقولوا الآخري another statement of another person so the one which is أصموا عن الأمر الذي لا أريده وأسمعوا خلق الله حين أريده is بحر الطويل فأصممت عمرا وأعميته عن الجود والفخر يوم الفخاري this is also a close meaning to the previous one and also is mentioned by ابن قطيبا is كتاب المعال الكبير غريب الحديث خرطابي brings it خصائص ابن الجني محكم لبن سيدي فأصممت عمرا وأعميته فأصممت عمرا وأعميته أمين صادفته أصم وآمى صادفته أصم وآمى عن الجود والفخر عن الفخاري as I said قطيبا brings it غريب الحديث خطابي brings it خصائص ابن الجني محكم ابن سيدي he brings it and as I said it's close to the meaning of the previous a line of poetry وكذلك الكلام الذي لا فائدة فيه the statement that doesn't have no benefit if a statement does not have any benefit the Arabs also refer to it like that لا فائدة فيه فوق العدمي it's like it's like something that doesn't exist قاله بيرا تبن أبي وحبن المخزومي he says the statement of a person that doesn't really have its weight كنبل تهوي ليس فيها نصالها it's like a nipple that doesn't have no nصال at all it's like a nipple that doesn't hold a nصال this is بيت من الطويل لغبيلة ابن أبي وحبن المخزومي زبي ري يو رحمه الله he brings it in his نسب قريش ابن إيشان brings it روض الأنف you'll find it there شربيني also brings it في الإعالة على فهم بعضي كلامي بعضي معاني ربنا الحكيم الخبير ابن حيان uses it many times in his بحر المحيط and ألوسين روح المعاني so that's the evidence that's the response for the first evidence for the first sorry the seventh apparent contradiction that I put forward إن شاء الله تعالى next sit we're going to do the 8th and then the 9th and then the 10th I will carry on بإذن الله الكريم anything which I've said that was wrong فإنه مني ومن الشيطان والله ورسوله بريان منه سبحانك اللهم بحمدك أشهد أن لا إله إلا الله أستغفرك وأتوب إلي


Thank you for coming everybody. It's nice to see you all here and virtually as well.  My name's Evan Gilman. I work at VMware. I'm one of the maintainers on Spiffy Project. I'm here with my colleague Andrew. Yep, Andrew Harding. Been in Spiffy Inspire projects for about three and a half years. Yeah, I've been four years, five years. Longer than that, yeah. Yeah, four and a half, five. I don't know if it's something I thought. Anyways, yeah, so we have a new thing here for y'all and we're gonna try our best. I've spoken to the room moderator already. We're gonna try our best to keep this as casual session as possible. So we want it to be personal for both in-person and virtual attendees. If you have any questions along the way, anything like that, please feel free to raise your hand. We'll stop, we'll talk, that kind of stuff. We're also, we've all started doing a little bit of a different presentation for you today, both in terms of material. So you'll see some stuff here you probably have never seen with regards to Spiffy. And we also purposely did not practice this because we wanted to feel natural and personal. So we hope that you enjoy it as much as we do and apologies in advance if that doesn't work out, but we're gonna see what happens. You wanna do the agenda? Yeah, so that's our agenda for today. We're gonna talk about the vision of Spiffy, kind of give the high-level overview. So the experience level of the audience, the attendees is probably gonna be varied. So we're gonna give an overview of the Spiffy vision and what it's around for, like what it's trying to solve, where it fits in and like other technology stacks and it's a part of the puzzle, where does it fit in inside that puzzle and what other pieces are generally involved. We're gonna give an overview of the different points of the Spiffy specification, including like a deep dive into the Spiffy ID and interest domains and federation. And then we're gonna kind of recap on the whole picture, the whole Spiffy surface and what it brings to the table. And we listed Q&A at the end, but like Evan said, we wanna keep this like very casual, very relaxed. If you have a question, just like yell or raise your hand, our moderator's gonna do the same thing for the virtual attendees. Like we want to talk about the things you wanna talk about. So we have some materials prepared, but we're okay with wherever the discussion moves, to be honest.  We're here to talk. The vision. I'll do it.  But you can see like this is especially for a large enterprise, this is like not a foreign thing, right? Like people tend to have infrastructure that's dotted across different places. It's a reality for some folks, not for everyone, but it's a reality for some. And if it's not a reality for you yet, it will likely be in the near future. The main challenge when you have this kind of stuff, at least from a security perspective, in my opinion is when you need to talk across these boundaries, like how exactly does that occur, right? And not just like the physical communication, like okay, how do I address this thing? How do I find it? How do I discover it? How do I authenticate it? Not just that, but also like applying security policy in a consistent way across all of these things, right? It can be very difficult because each one of these things on this slide has its own idea about what policy looks like, what language is used, it's own idea about identity, how things are addressed, it's own idea about authentication, how you do off against these platforms, all of these things. And so, I have lived personally in this world in pre-Spiffy days, right? And I wrote a lot of software that did like translation of identity, brokering access between these things, a lot of abstraction to try to solve this problem of talking across different pieces of infrastructure, running in different providers, and maybe with different runtimes or different software platforms and things like this. Everyone has got their own idea of how to solve this problem. And so, Spiffy is an attempt to say, hey, let's do a scheme that is platform agnostic, let's do a scheme that is not anchored to a particular technology or a particular provider. And if we can do this, just provide a stable notion of identity and a way to prove identity across these boundaries, right? All of a sudden, everything above it starts to stabilize too. So that security policy we're talking about starts to stabilize because you have this stable identifier that you can reference and you can have this policy go across multiple platforms without having to change or munch it to be specific to one place or another. You also find other things like tracing, observability, debugging, all of these kinds of things stabilize. As soon as you have a call stack that traverses these platforms, how do you identify each one of those service hops and threads? So once you have this kind of notion of stable platform agnostic identifier, what you find is a lot of other things start to get easier as you jump across these different verticals. So we'll talk about the Spiffy specifications that we'll get down in the details. Ultimately, like Evan mentioned, what it provides you is kind of like this uniform identity substrate and you're gonna get a cryptographically verifiable document and that's what Spiffy brings you. It brings you the document, but it's up to you at that point once you have that cryptographically verifiable document to present that in some way to another party to assert your identity and allow them to authenticate you and hopefully you authenticate them in return. So Spiffy is just like one small piece of this puzzle. We bring the authentication layer, we bring the identity layer to the puzzle and there's things that you have to do on top that you have to actually use that identity. So sometimes you'll have workloads that are Spiffy aware, those can talk directly to the Spiffy Workload API and obtain their materials and then they themselves will engage in mutual TLS, for example, to establish that authenticated secure channel to another workload.  And so we'll bring the authentication with Spiffy, you need to actually use those documents and do the secure connections in between workloads. You can layer authorization on top of that, whether that's with OPA or with something else. You can bring on protocols like GRPC and the write on top of that TLS channel and do secure workload communications that way. But yeah, it's up to you and there's a lot of flexibility in what you end up doing with the identity you receive from a Spiffy implementation. I would just quickly add to the kind of really important part on this that is we get a question about often is authorization in particular? The Spiffy project calls authorization kind of out of scope for what we're doing. What we're doing is we're providing this kind of stable uniform identity that then you can build authorization on top of. So it is a whole nother problem space that is very, very deep in its own right. It is not something that we attempt to solve in any way really. And so you bring that to the table with either OPA or even something simple like built-in allow lists in your app or what have you, right? But as Andrew was mentioning, what we can do is we can bring you these identities or we can bring you them in a very secure way and we can show you, make some recommendations on how you can use them and ways to think about them. But at the end it is up to you to make use of these primitives and build something, right? We've got a question from the platform. What does Spiffy aim to identify? I'm sorry, can you repeat that? What does Spiffy aim to identify? What does Spiffy mean to identify? Aim to identify. That's a very good question. We have a bit of a slide on this, but not exactly. So I'll just say quickly now. Spiffy aims to identify what we call a workload, right? So Spiffy is like cryptographic identity for workloads. What is a workload? And it's a bit of an overloaded term and an overloaded question as well. I think different people and different shops have different requirements for that. The most common thing that we see is we see Spiffy identify on the service, right? So if you could think that I have a Kubernetes cluster and there's a deployment and there's five pods servicing this deployment, the typical pattern that we'll see is like a Spiffy ID will be assigned to that deployment and the pods within that deployment will all receive the same Spiffy ID. This makes authorization easier. It makes a number of other things easier. It's also kind of the mental model that most people follow. There are folks who don't wanna do that. There are folks who say, I want every individual pod to receive a unique identity. They do this for auditing and observability purposes, forensics, things like that. But it does make things a little bit more complicated. So I hope that answers the question, what will we aim to identify as we aim to identify workloads? However, you view that and we have some later slides talking about ways that you may, like naming conventions and ways that you may arrange this based on what you're trying to address. Okay, my turn? What is this? Okay, so yeah, this is the overview, the spec overview. So we're just gonna, I think, kind of run through a few of the really important ones here just to kind of orient everyone, how they fit together, and then we're gonna choose a few in deep dive. So the first spec here is the Spiffy ID spec. It's like the most basic one. This is just the spec that kind of dictates the ID itself, the rules around it, how it's formed. It gives the name. It's like a username for workloads almost, right? It's one way that I describe it. You do the next one? And then there's the Svid. The Svid stands for Spiffy Verifiable Identity Document. And this is the way that you prove identity to someone else, right? It's usually like a signed document of some sort with a Spiffy ID in it, right? Maybe there's a public key in there too that the workload holds on to. We try our best to not like reinvent anything here for a number of reasons. Number one, inventing new documents like this is difficult. Number two, it requires like that new investment from the users. So we try to choose documents that are already widely adopted and well understood, work as much as we can with off the shelf software and things like that. So the two supported Svid types we have right now is X509 and Jot. And I don't know how many people are familiar with these two things. But X509 is generally useful for TLS, powering TLS. Jot is generally useful for securing the message layer, layer seven. And you use them in different places which is why we support both. You may even use them together in fact. We go on the next one. And we have the workload API. So we have this ID, this username. Then we have this document that has the name in it and there's a signature over it. Well that's cool. All my workloads are supposed to get one of the things, how do they get it? So that's what the workload API is all about. It's an API that is like a node local API. And this API is actually unauthenticated and this is like a super critical aspect of it because what that does is it allows a workload to pop up without having any prior injected secret or token or anything else. This workload can kind of pop up and say here I am and the spiffy magic will kind of figure out, okay I know who you are.  Let's see, what else about the workload API? So I guess the main reason that we have a thing like this, right, people ask why don't you just put them on desk or why have this API and all this jazz? And I think there's two primary reasons for that. The first is around structure and rotation and control. So we provide over this workload API as we provide you your Svid. We may provide private key associated with those Svids like the case of X509, right? And we also provide the CA asserts that are keys and key material that is needed to validate other Svids. And that key, there may be multiple keys if you're talking about multiple domains and things like this. And so if you wanna put them on desk it gets complicated because now you're into the world of ad hoc naming and what, you know, how do you name the files? How do you group these things together? Is that a directory? Is that this? What happens when you wanna rotate them? These things rotate all, including root CA's all rotate. And if you've ever worked at the E-Pole or anything like that, you'll know. Pain there. So that's one big thing. And because of this, the workload API is also push. So we can like rotate a root and push that update out to all the workloads and like we can accomplish that pretty quickly. So that's a big part of it. Another part of it is portability. So the whole spiffy thing is supposed to be platform agnostic, right? If we tie this, the retrieval of these S-FIDS to a platform-specific API, like a Kubernetes API or something like that, then all of a sudden who loses this portability that we're trying to build in the first place, right? So the portability is another major aspect of this. Do you wanna do the rest? I've been talking a lot. Okay. Your water's over here if you need it. Yeah, probably. Okay. So the next specification that we have in the spiffy set is specification around the trust domain and the bundle now. The trust domain is a security boundary. So if you look at, if we, we'll get into the details of the spiffy ID, but spiffy ID is essentially composed of two parts. It has a trust domain and it has some sort of entity underneath that trust domain. And the idea is that a trust domain itself is this cryptographic boundary with a set of unique signing authorities within it for issuing the identities from that trust domain. And so we have a specification around like, you know, what does a trust domain name look like? Like what, you know, what sort, what is the bundle that contains all the root material and the public keys for that trust domain for the signing authorities within that trust domain? Like what does that look like and how is that shaped? I will also quickly add there that I, you know, I was talking about structure over the workload API and multiple keys and things like that. You know, you may be talking to multiple trust domains, right? And they all have their own set of keys and that's kind of what, this bundle thing that we have, we have a few slides on that later on. Yeah, and then the last kind of specification we'll talk about today, this is, sometimes we call it the Federation API. The, it's actually, you know, just Federation specification within spiffy. And that defines what we call the bundle endpoint. And this is an endpoint that a party can talk to to obtain the spiffy bundle for a given trust domain. And this is to empower federation, right? So you can get, you know, multiple trust domains, obtaining the spiffy bundles for each other and then they're able to authenticate the identities that are minted in, you know, in the other trust domain. So we, this is a pretty basic specification. We'll get into the details of that later. But it's, yeah, it's not anything super complicated. It's basically just an HTTPS endpoint. HTTPS endpoint, it's gotta be authenticated, must be authenticated, that you can talk to to get this bundle material. So this specification is all about like, you know, what are the different profiles for connecting to these endpoints and how do you deal with the responses and things like that. So I'll take this one, since I already kind of talked about it already. This is your spiffy ID, right? So it's a URI, it's pretty much like a username except for your workload or your service. And it is scoped by a trust domain. And like we talked about before, the trust domain is going to be the, have the set of authorities that are gonna be signing identities, you know, for that trust domain. This URI is, you know, the URI spec, I don't know if you've ever dug into it, it's ginormous, it's huge, it's a mess. It's very difficult. It's bigger than it should be. Yeah, way bigger than it should be. And there are some interesting things that fall out of the inherent complexity of that specification. And what, so we've tried to take this URI spec and carve out a nice safe space for a spiffy ID within that specification. We did similar things for X509 and JOT. You know, we want to reuse these standards because they're prolific and they're out there and they're well understood.  And so one of those things is a limited character set. We don't allow the full range of expression on the characters that are allowed inside URIs. But, you know, a spiffy ID is really kind of this thing that you get, you get to decide for yourself with any organization what makes sense and like what this ID should look like, okay? So after you get that spiffy scheme on there and you define your trust, I mean, after that, it's anyone's business, what you do, right? So, but we do have some guidance as we've seen people craft spiffy IDs over the years and maybe take some routes. You know, we've formed some opinions and maybe some guidance around how you might want to shape your spiffy IDs in order to avoid a certain class of problems. All kinds of creative uses we've seen. I'll do this one, I guess. So we've got a couple of these. We get a lot of questions around this, like how do I name things? It's like turns out that's really hard. So I would say, I thought it would be useful to kind of provide a couple like pro tip best practice type things here. So like one of them, the first one, I guess, is be mindful of naming. People, the nice thing about spiffy ID is that it is kind of like a nice middle ground of machine and human readable. And we want to keep that aspect as much as possible. You know, in the spec itself, we have a section that is like, yeah, like the path of this thing can be whatever you want, whatever makes sense for your org. And we gave some examples of how you might do it. One of those examples there just has like a GUID. It's just like the trust domain and then a GUID after that.  But, you know, you lose that nice property of like it's readable, like I can look at it and like have meaning to it, you know. So all those cases I was talking about before around observability and things like that kind of go away if you go in that direction. So you want to kind of keep it readable.  What I see people do quite often is that they say like, well, I have these policies that I'm trying to enforce and they're like super expressive. And there's like 15 different pieces of information that I need in order to like evaluate this policy. All right, and so then they go off and say, okay, well, what should my naming scheme be then? I need 15 different things in my naming so that when they call me, I am able to differentiate and do the authorization I want to do. This is like real slippery slope and I think that you will always have this idea, right? You'll always have this idea that, you know, you're making decisions based on the shape of the spiffy ID, right, not just like some opaque string. But I would strongly recommend like strike a balance with that data, you know, don't try to overload it with a bunch of stuff that you may not need, may need, may not need. Instead, what you want to do is you want to choose like the most basic things that are going to be like super, super static, like things that are not really going to change much or like innate properties of this workload or thing you're trying to address, right? That's what I would recommend to include and you kind of draw the line there and things that are more dynamic you'll want to put elsewhere, right? So the second pro tip is it's fairly aligned to that first pro tip, right? Like, you know, the spec is very open-ended and unspecific on how you shape your IDs on purpose because, you know, different organizations have different needs, right? Your different deployments, it needs to be really up to you on how you shape your identities.  The more specific metadata you put in that spiffy ID and more that can change, the more complicated your authorization logic becomes. You know, where you have, unless you're really good at like centralizing authorization, then you have a bunch of processes like receiving these spiffy IDs and trying to like pluck out different parts and apply policy to these different parts, it gets very complicated. You end up getting really coupled to that authorization logic and if you don't centralize it, then now you've got a bunch of people doing this, this same sort of logic piecemeal and if you ever need to like change the metadata or change how this thing is structured, there's a ripple effect that takes place and there was a talk a few days ago at Production Identity Day, you know, an organization who had gone down one route with their spiffy ID, with their naming and they'd gone a little too complex and when they decided to like reign that back in, it was a large amount of effort to try and like shift and migrate back to a simpler scheme, which ended up being better for them in the long run but it takes effort. So if you get the more specificity you like shoving these IDs, for example, you could go hog wild and start throwing like network locator information inside the spiffy ID of where this workload is, not what this workload is and if you ever go and change where that workload lives, then suddenly like the ID is changing and you gotta like update your authorization policy, et cetera. So you really wanna focus, I think, at least for me, on what the workload is, not where the workload is or other, maybe sort of tangential attributes about that workload. Yeah, and I would even add that, in terms of like pattern and convention, one of the things that we've seen is that Istio being like very early spiffy adopter chose naming convention that worked for them, right? And that naming convention was the slash s a slash service account value, or slash n s slash name space value slash s a slash service account value. And most people, a lot of people I would say have become familiar with spiffy through Istio and the impression that has been left is like this is the canonical way to format a spiffy ID, right? And that's really, I think, an important point to understand is like this is not canonical way. And it doesn't mean that you cannot like borrow those patterns, you know, for one reason or another, like you absolutely can, but you should also understand that those patterns are not going to work for everyone, right? You pluck a workload out of Kubernetes and drop it somewhere else. What meaning does this convention have anymore, right? Name space and service account. So it should be understood that the convention that you choose will not apply universally. It may be good for you, but it may not be good for a next person. That means when you want to talk to a next person with spiffy, you're going to get an ID that is shaped totally different than the one that you're used to, right? And that is a problem we've seen for interop, right? Like people get this idea that like, yeah, this is the convention, right? And like, I'm building all this policy on top of it. And so when a spiffy ID comes in, you know, I parse this sucker and I like pluck these different things out and I feed it through my policy and I make a decision, right? And then of course, the next, as soon as somebody comes and that thing runs through the parser correctly, things blow up, right? So I think I saw you there, Cole. I'll get you right in a second. So that's like, understand that this is a thing that is not going to apply to everyone. And so when you build authorization on top of spiffy, you want to strive for not like trying to pluck this thing apart and make all this sense of it, right? Instead, you should really try to strive for like a straight string compare if possible. It is like the safest way to do this. And it is also the way that will ensure that like in the future, you don't run into bad interop problems. Like everywhere expects this convention, but now I need to federate with a business partner. They have a totally different convention. Okay, now it's really simple for me to just say, in addition to my regular policy, also accept this explicit spiffy ID, right? So you can kind of stay out of trouble if you follow some of these rules. I saw a question here. So the question was that, do we have any examples of conventions that we've seen work really well in the past? I would say that that like, I would say no-ish. Well, I think that addressing a node was kind of more of a spire-ism. You know, I think by far and away the most popular convention is the one that Istio set forth years back. I am hesitant to say that that is like the best one. It's just the most popular one. You know, and Istio has had a fair share of problems of communicating with workloads that are not on Kubernetes because of exactly this thing. And they have fallen in this very opinionated naming scheme. So we're working through that stuff to try and improve the story. There have been some lessons learned which is exactly the nature of this slide. Hmm, well I'd say that one. It's not to say that the convention is bad. It's just to say that if you choose a convention and then go down the path thinking like, this is my convention, right? That's when you start to get into trouble. It should be that you just understand that there can be spiffy ideas that do not conform to your convention and that your stack should be equipped to handle when that time comes. Five slides left and two and a half minutes. Seriously? Yeah. So I think this next one will skip. We really, we talked about trust domains, I think, at length. This slide really quick was just kind of showing you kind of what the spiffy bundle looks like. It doesn't have all the information in there. The spiffy bundle specification, like this is just a standard JWK asset, okay? Where we have a few custom keys, such as defined. And that is that this bundle contains the public keys for one or more routes within that trust domain, one or more authorities. And if your spiffy implementation only supports X519SFIDs, then you might only see X519 related authorities within the bundle if it supports X519JOT. You might see both of those types of routes in there. And you're gonna see more than one, right? Because one of the powerful things about spiffy is this idea of frequent rotation, even of your certificate authorities, right? Even of your root authority material. So as you rotate new authorities in, you're gonna keep adding to this bundle and as old ones are no longer in use, you can start trickling those out. And it just stays up to date and stays rotated. Minute and a half, go. Okay. So those are, we saw trust domain and a trust domain kind of usually has like this one-to-one relationship with PKI. If you're talking about a trust domain, it probably has its own PKI. That bundle that you saw is kind of how we capture those keys. And so if you have the bundle for a trust domain, then you can validate identities from that trust domain, right? So then the question is, how do you get those bundles? How do you get those keys for validation? That's what we call federation or bundle endpoint. So here's like quick diagram of kind of the way that it works. And it's really, really basic. We just swap these bundles across so we'll have a next slide on exactly how that happens. But once these two swap their bundles, then they can exchange us feds and be validated, right? This is actually how it works. It's super basic. We have different profiles right now. There's only two. They're both based on ACPS. One does regular web PKI validation. The other one does the FIATH. And here's like some configuration snippets, how you might zero minutes, one minute, five minutes. Okay. We've got five minutes back there. Oh, sorry. So it's actually not very complicated. And if you're familiar with OIDC, JDBKS, you may have noticed that these bundles are JDBKS formatted. So it's the same spec that OIDC uses. It's literally just a JSON document. So each one of these trust domains exposes this ACPS endpoint that serves up this JSON document. And so long as you know how to find it and authenticate it, you can pull this sucker out and you can validate identities from that other trust domain. And the bundle slide, can you back up actually? If we have some time back up to the bundle slide. Yeah. So you see, here's a spiffy refresh hint set onto the bundle. This is supposed to give the caller an idea of when they should check back. Because we mentioned that these things rotate and Spire in particular has support for root rotation all the way down to leaf. So they do change over time. They may change aggressively. They may change on the order of hours or days. And so this is supposed to be that hint as to how often you're gonna go back there and check this bundle and see if the key material has changed. You can slide back for it now. Yeah. Yeah, so that's basically it, right? And you'll have software in each one that kind of is configured to go hit these things and bring them down and distribute them. Now, the way that these bundles are distributed through your infrastructure is not defined by spiffy. So you build some software that goes out and does this automation, it goes and grabs this bundle and it pushes it down to your workload and your workloads pick it up and use it. The thing that we do define is that workload API. So the API that the workloads hit to get these bundles and their S-Fids and all the other stuff. But how the plumbing between that workload API and the stuff up here is unless that's the spiffy implementation really. So if you've ever heard of spire, spire is a spiffy implementation, it does all that plumbing from bundle and signing all the way down to your workload and providing that API and connecting all of these dots, right? Finally, the way that you do spiffy off is important, we didn't talk about that, I don't think. So when you run into one of these S-Fids, right, and you want to validate it, like the very first thing that you do is you look at the spiffy ID, there's something right here. So these are workloads, if you will. So we have a foo trust domain and a bar trust domain, right? So when somebody calls you, let's say TLS, and they present you a client cert, the very first thing that you do is you look at the spiffy ID and you say, okay, what trust domain is this from? And then you say, okay, do I know this trust domain, do I recognize it? And the way that you do that is say, well, do I have a bundle for this thing, right? And if you do have a bundle, then you know how to authenticate and if you don't, then you're not federated and this thing is not going to authenticate. And so this is one thing that we have been kind of like pushing forward slowly because that type of validation is not something that is found in a lot of places. We have spiffy libraries, which will do this kind of validation for you on TLS and Jot and other things. But Envoy was recently grown support to do this kind of validation as well through TLS Custom Validator, I believe, New Extension. So this New Extension can actually take that spiffy ID, look at the trust domain name, pick the right bundle, validate it and authenticate the connection. So that's super cool. That happened a few months back, I think, a few months ago. Okay, yeah, next one. All right, so this is just kind of a slide giving you the big picture, right? So actually, I can see on this side, I'm going to crowd you. All right, so it's just showing on the top you've got this, you've got trust domain in green. On the bottom, you've got a separate trust domain in blue. You can see that each of those trust domains is hosting a bundle endpoint that the other trust domain is using to pull the bundle from each other and that'll establish our federation. You've got workloads inside each trust domain. They're connecting to the workload API and over that workload API, they're obtaining their S-vids and their bundles, not only the bundle for their own trust domain, but because these two are federated, it can receive the bundle for the other trust domain. And then those workloads within the trust domain can authenticate with each other over MTLS, right? And because the federation workloads across trust domains can also authenticate each other over MTLS. And so, you know, and those S-vids contain the specific IDs of the workloads, so that we have a strong, you know, uniform notion of identity that we can, again, this is just a piece of the puzzle, we can like layer authorization on top of and other things. Anything else you want to say about that, Evan? In the earlier slides, we had some stuff on, like, how to think about modeling trust domains. Yeah, I don't know, we're probably like a little out of time for that, but. Yeah, I have like 30 seconds. Yeah, just leave that one on, I guess, and yeah, strong security isolation, I can be summed up that way, right? Like, anytime that you have a security domain that you want very strong isolation between the two, you usually take two trust domains. A really common example is staging a production, right? Like, you don't want someone to compromise in staging to own the PKI that's used in production. You'll also find regulatory things, region-based stuff. You know, again, it's kind of same as the naming, right? It all depends on your deployment and what your needs are. So yeah, I think that's it. You want to put up the last slide, actually? The last slide has some learn more stuff. Yeah, so we have a website, of course, and GitHub repo, and our Slack is super active. I highly recommend if you're interested to continue conversation, join us there. All maintainers hang out there. Spire developers hang out there. All sorts of folks. And so yeah, we've tried our best to not do any Spire talk. We're actually both Spire maintainers as well. It's sometimes difficult to wear both hats. We've tried our best to not include Spire on this talk, but we'd be happy to answer those questions as well if anyone has them. Thank you. Yeah.


We are in France this week, embedded with the Tactical Special Police Unit, with over a hundred anti-terror missions, organized crime and hostage rescue operations every single year. We will see how the operational mode of these French tactical officers of the GIGN is very similar to the Israeli Yaman. As we film at the GIGN headquarters itself, confusion and disorder offer victory to the adversary. Those words were written in the 6th century BC by the Chinese General Sun Tzu. A strategy adopted and applied to the letter by these gendarmes of the GIGN. While we are in an abandoned complex, several buildings with multiple levels in the suburbs of Paris, while these men gear up and adjust their sights, our eye is drawn to a T-shirt. The one with the letters CTU, Counter Terrorism Unit, the Israeli Yaman, received by this French gendarm during the joint training with the Israeli police officers from the anti-terror unit. We have a training site, a large facility available to us which allows us to train in large spaces, really big areas, so it's ideal for working in platoons. It means you will run a model of this mission in a public area. Yes, exactly, so here, this type of space is like an office, so it allows us to work as a platoon with up to 15 or 20 people, to operate, to do investigative work, to move forward in this environment, to free hostages, to arrest an individual. How often do you perform this type of drill? Of this type, three or four training sessions a week. Today's exercise, a hostage situation. The order is given. We have to move forward, even in complete darkness, they cannot miss a single clue to find the hostage takers, whoever they may be. To make things even harder and more challenging today, they will have to manage without the use of any communications devices, only body gestures. These men advance quietly in absolute calm. It's a bit, let's say, that we train for, well our goal is to arrest them, our aim is to stop terrorists, who aren't always terrorists by the way, so to free hostages and bring those who may be exposed to the situation to safety, then we choose our modes of movement. Is it a successful run, what we are seeing right now? What we've just done, well it's a success, we're working on a technical level, in other words, there's no particular theme, the people aren't geared up, so we're not really working on the individual's technique, meaning how they move and how they get into the rooms. It's like an orchestrated ballet, everyone knows what to do. The movements, the looks, the positions, everything is precise. D-Day, no room for mistakes. We're right there with them, to speak to the section chief, we have to whisper. But today, the rules of the game will change, I will become their target, a madman, a terrorist or a lone wolf, I'll hide in the corner to surprise them. These gendarmes from the GIGN intervention force do not know if I'm armed or if I have explosives, no one knows, not even my own team. But being the intervention pros that they are, they'll find me in less than a minute and neutralize the threat. Here are the pictures. Don't move. If you come closer, I'll shoot. Matias, show us your hands, show me your hands. The second one too. Raise both your hands, show me your hands. Do you have anything on you? I have a gun, I have a gun. Ok, maybe you can kneel down and put it down gently. Like this Matias, it's going to be ok. Gentle gestures, come on. He's shot in the shoulder, he's hit. Matias, can you hear me? Matias? Ok, we fired a round, we're going to call for backup. Matias, can you hear me? Matias? Can you hear me? Ok, I'll take care of you. What is remarkable is that we could not hear them coming, it was very quick. During the operation I was blinded by a strong light and a red point. The tension is high, I tried to get to a weapon, but I was neutralized first. I wanted to take out a weapon, I was immediately neutralized. Another exercise, even more complex, this shield called the Ramses, used often by the assault column of the GIGN intervention force. Like an Egyptian pharaoh, it is powerful, dominating and has lateral projection. It is massive. Moving with such an object is more complex and much slower. It is very effective in places like this. To see and hear what they could not, the technical division and its special means section accompanies the team. And here we are in the Special Resources Warehouse. We could call it a technological unit. Is that what we can call it, Chief K? Yes, a specialty, a group of specialists, technicians dedicated to one particular mission, the GIGN. This is where we meet K. The operator is an essential part of this technical division. He accompanies the intervention force and responds to alerts at the same rate as they do, operating technology that will support the mission. Exactly. It also allows us to understand the needs of operators in the field, so that we can try to find the most appropriate solutions to their problems, because that's our ultimate goal. Can you show us the different tools you are using in this technological special unit? So each operator is capable of deploying a set of resources that he has as his disposal, or that he uses to launch specific missions, be it drones, robots, various and diverse sensors. The aim is to provide intelligence to help the team moving forward. How are you always keeping ahead of the terrorist or criminals? The aim is to provide intelligence to help the team move forward. You have to place yourself in their shoes, but you also have to be constantly on the lookout for what's new and stay imaginative. Keep up to date with what's new, and that way, it means you're always ready. Back to the exercise. We find K, the operator of special means, by himself with his drone. He repeats the same gestures over and over. His control over the device is absolute. Improving of the importance of each team member in the assault column, in the light and in the dark. It is more than an hour's drive from Versailles that we meet these exceptional men, in a military camp where they received long and harsh training for more than a year before being accepted into this elite force of the French National Gendarmerie. In front of them, training vehicles which act as targets serve to protect these fighters. As you can see in these images, these men are shadowing and they're met with heavy fire. They must react. And in this specific case, the first to respond to the shots is the passenger. On the front line, he is also vulnerable. They have several scenarios. First, two in a car. As soon as the first shots are fired, the driver gets out of the vehicle. What's important here is to know your teammate's position, not entering his line of fire, a well orchestrated dance. In all our training sessions, we place a great deal of importance on being in the same situation as we might encounter it out there as much as possible, whether it's a mission or whatever awaits us. That's why, particularly in today's sessions, we're working both technically on getting out of vehicles, on support, on precise shooting and team communication. And yet the theory here seems so far from the practice because the reality has its own codes and ambush is never the same. Enemy shooters are never placed in the same location, so we have to adapt. That's why it's necessary to train all types of incidents and attacks with live fire. Here there are three in a car, but one seated in the back of the vehicle can be used for fire support of the passenger to cover him while he's extracted. The firepower is impressive. The shots are mostly selective. Just listen, all of these bullets hit their targets. Here in an intervention made in a confined space, several different sessions of operations, short assault scenarios that these men have already rehearsed thousands of times. Here there is no room for error. There too we seek to neutralize, not to kill. Gemma Reti, thank you for inviting us to your security sanctuary, the holy grail of the French gendarmerie. The GIGN, one of the most prestigious elite units of the French gendarmerie, the most prestigious unit if you could perhaps define in a few words the heritage of the GIGN. Yes, I started with the GIGN in the mid 90s, just after the plane hijacking in Marinette. I'm fortunate enough to still be here, 27 years later. This unit has changed a lot. When I joined the GIGN, we were only 80 people in the unit, dedicated solely for intervention. Today, the mission spectrum expanded, meaning everything from hostage-taking to madmen, but also a great deal of judicial police work, including arresting the perpetrators of homicide, or armed robberies, killers, and drug traffickers. But it's also about protection. Today, GIGN is present in 16 countries around the world, mainly to protect ambassadors to cover all travel needs. You were recently active in Africa, is that correct? Exactly. Last month, we intervened in Sudan for the evacuation of a French national, focusing mainly on the diplomatic corps, but ultimately to take part in the other missions to shelter French and other foreign nationals. And the third mission is intelligence gathering. This means all kinds of tailing, anything that can provide intelligence for the normal police, and to move the investigation. So it also involves installing tracker devices on vehicles, cameras, and microphones, maybe in an apartment, or other, let's say, houses, in the broadest sense of the term. The GIGN's motto is committed for life, in a way to be ready to give up your own to protect others. So that's one aspect of a lifelong commitment. That's the motto of the GIGN. You have to accept to give up your own life to save the life of others. So that is the first meaning of committing for life. But it also means committing for the life of one's opponent. Our job is to bring the bad guys to justice. We're not vigilantes, so we're going to try and hold our use of weapons, even if it means taking a certain amount of risk. Our aim is really to bring them back alive. For us, the success of a mission is with the perpetrator brought to justice, alive and without injury. 1974, the founding year of the GIGN, also the founding year of the Yamam. The anti-terror unit of the Israeli police. You're very close. In fact, you were recently in Israel. Can you tell me about this connection, the bond between these very similar units? So it's true that there is a historical link. We were both created in 1974, mainly following the Munich hostage crisis. We're pretty much sister units. In other words, in our mechanisms, in our size, in the way we think. We recognize a lot of ourselves in the Yamam. They have been a great source of inspiration for us in many missions, on many developments, on the know-how that we have been able to acquire within the GIGN. And maybe they, reciprocally, have been inspired by us.  It has been more than 15 years since this technique was designed and implemented by the GIGN, since then has been exported to the best canine units, including in Israel, notably to the Yamam. We are talking about the famous dog guiding techniques using lasers. This allows the forces not to be in immediate contact with explosive substances, as seen in these images from several angles. It is very impressive. We perfectly feel the fear of such a dog running and turning around us.  If, for example, we see immediately that the subject is wearing an explosive belt, we might not send the dog. We might send bomb traps. Then it will be up to the platoon leader or its deputy, according to the sensitivity of the mission, to decide whether to send the dog to actually determine whether or not we're dealing with explosives. Is it a fully-fledged fighter? Yeah, I don't really like the term fighter. That's my partner. It's my teammate. That's it. We work with him on a daily basis, and we do everything we can to protect him. Thank you, and thanks, Luther. Merci. Uncompromising composure. This is exactly what characterizes les gendarmes of the intervention force, but they may be clear. Using their weapon should be a last resort, whatever that weapon may be, a 9-millimeter piston or a salt rifle. These officers of the GIGN are training two or three times a week with their team members, in addition, of course, to their personal training sessions to always be ready during an incident. Technique is also the objective of this exercise, perilous, some would say. But for these gendarmes, it's purely habitual. Another exercise, boarding an army helicopter, abseiling to the scene of the intervention and being airlifted into a basket. So before we start, we equip ourselves and, above all, inspect each other. Once on board, the men get into position before harnessing themselves to begin an abseiling descent. The use of helicopters is certainly not daily, but it must be perfectly mastered in the event to quickly deploy to the scene and also for possible extractions. According to the intervention force, sliding down on a smooth robe implies fighters are carrying less heavy equipment and, above all, fewer men on board than a traditional convoy by car. Once on the ground, they continue their missions on foot. The fact that today we can train daily for challenging situations will make it easier for us to respond tomorrow to threats that will be more or less challenging. Why this type of training with the pods, with the helicopter? Is this scenario you can come across? Because the helicopter, the Puma, is one of our vehicles, like the motorcycles. We train with different vectors that we have to work with every day to maintain these capabilities. So you have to be ready day and night. These videos are quite exceptional. It's rare to receive this type of access to film this type of night exercise in a helicopter, an exercise that will last until the break of dawn. Peace and serenity all the time, including for this coordinated shot, six snipers, a target and a story from 1976 of the GIGN mission in Djibouti. Beyond confidence, reliability, the objective of such a shot is the ability to neutralize several targets with a single blast heard. That's the operational reason for this shot. Was this type of shooting used in operations? Was it effective on the ground? Exactly. This shot was used in 1976 in Djibouti, when some 30 children were being held by several terrorists in a school bus. And five terrorists were neutralized by a single shot by GIGN sniper team. It is I who will get to test the coordinated fire capabilities of the GIGN intervention force snipers that day. At the end of five days, spent as close as possible to these men who make up this elite unit of the French gendarmerie. This is a very important moment in the career of these GIGN operatives. They are the elites of this French special police unit, the coordinated shot and the absolute trust between the snipers, their commanders and this journalist. See you all next week on I-24 News.


In this new review on the intakes of berries in their brightly colored pigments called anthocyanins, they note four out of five studies suggest that increased intake is significantly associated with the reduction in the risk of coronary heart disease, the number one killer of men and women, by between 12 and 32%. That lower range is from studies of older individuals, and the greater reduction of risk was noted in younger populations. So perhaps the earlier we start eating berries, the better. And maybe the more, the better, a 47% drop in heart attack risk for those in the top 10% of berry consumption. It's almost like one to one. For every 15 mg increase a day, a 17% drop in risk. So how can you get 100 mg a day? By eating less than a half cup of blueberries a day. My daily dozen recommendation for berry intake. Why the drop in risk, though?  There have been over 20 randomized controlled trials putting berries to the test, and more than a thousand people and berries were shown to help control bad cholesterol. Blood pressure, blood sugars, body weight, diabetes, and inflammation. Now, lots of plant foods can do this. I mean, is there something special about berries? Like cholesterol. All whole plant foods have fiber, fiber lowers cholesterol, and even blueberry tea can lower cholesterol, even in kids who are genetically predisposed to high cholesterol. We used to think only about 1 in 500 people had this high cholesterol gene, but now we're realizing it may be as many as 1 in 250, and still for the 249 others who think high cholesterol just runs in their family, more likely bad diets are what's being passed down. But even if you do have the gene, what happens when you give kids blueberry tea, just powdered blueberries, in a teabag dipped in hot water for five minutes? So they're not even eating the whole food. Well, I mean, you can imagine the water turning blue as the pigments seep into the water, and indeed, the antioxidant capacity of their bloodstream increased over the six months they were in the study. Two things of note here. First of all, no change in the control group, as expected. But note it took three months for the tea to start having a significant effect. And then, of course, six months after they stopped drinking the tea, they were back to where they started. OK, but what happened to their cholesterol? No real change in the control group, but a 30% drop in LDL in the tea group. That's like what you'd get putting these kids on a statin drug, and they just had to drink some yummy tea? But of course, when they stopped the tea, their cholesterol bounced right back.


就是オーバーナイサー・ミダー・インローシー・ビーダーボートOKAnd we'll have to show a Q&A session after thatAnd we will also invite the other media organizer or work organiser after this sessionTo share their experience with me謝謝你好英文是從現在So, I'm from Tokyo, JapanAnd I already like Taipei very wellAnd we enjoyed HongkotsYes, two days agoAnd it was really goodAnd by the way, so before being in my talkCan I ask who is from TaipeiWho is from TaipeiOKWho is from TainanOr who is from台中台中台中台中OhOKAnd other part咬力Other partOther partWhere are you fromYes, youHong KongOhI think today we have a global audienceOKAnd it isAlso, I also want to askSo, who has attended Mira alreadyWardless MiraWardless Mira attendedOKNot a big numberAnd who organises alreadyAnd hereOKSo, OKNow, I can continue my talkBecause many of you don't know about MiraYesAnd I want to share my lifestyleIt's in lifestyleSo, I work as a teacher on the landAnd I travelMy hobby is going to workMany citiesIt was in Louisville City, in the PhilippinesAnd after work, I always enjoySexy with workAnd also, I always travelThat is Mata in EuropeAnd I also work in EuropeSo, I travel a lotSo, I don't have a bossBecause I am my bossAnd I never hire a salespersonBut I can pay my travel by myselfAnd I got this because of MiraYesSo, today I will shareYou, my experience with TenzingAnd Overnight MiraAnd I want to talk aboutJapanese community and the situationAnd then, I also shareWhat you doAnd more AkistansSo, how I started my careerBack to my...I was a university studentI did Japan thingBut it was not successfulAnd also, I broke up with my boyfriendSo, I had no hopeAnd I wanted to tryVery new thing for meAnd I asked UdoAnd I found a job in CambodiaSo, after my graduateI went to CambodiaAnd so, I think Cambodia was goodLike parade every nightThat was fun lifeSo, I found internshipIn a tourism magazine companyBut they didn't have websitesSo, I started learningWebsitesAnd in CambodiaI also met Japanese peopleWho do business thereLike massage shop, souvenir shopSo, they asked me to make websitesSo, I stayed there three yearsAnd so, life in Cambodia was funBut I was alone becauseI am only a website designerIn the townSo far, I knewSo, I was aloneYou know, soOther friends are business ownersBut I made websitesBut I don't have friends who can do the same thingAnd so, I was aloneAnd when I go back to JapanI found meetupAnd at that timeFirst one had parents' anniversarySo, they want big meetupAnd I found that on internetSo, I decided to attendAnd I found a dayThey call speakerAnd so, I appliedTo share my experience in CambodiaAnd I didn't knowAt that meetup, 200 people cameSo, I had to talk in front of 200 peopleAnd I had no experience to talkSo, I was cryingI was so nervous, marginBut I did, I talkAnd so, I shared the websiteI made for Japanese travel magazineKinbonyAnd at that timeIn the audience of my talkI found the WordPress theme developerWho created this website theme I usedSo, this is PythonSorry, I used your phoneSo, that was amazingSo, you knowSometimes you found free WordPress themeAnd you just use itBut you never knowYou're a creator of that themeBut you meet here in the meetupThat's greatSo, the meetup was funAnd after my talk, everyone talked to meLike, oh, your experience in Cambodia was amazingSo, I got many friendsIn the WordPress communityAnd I started joining work campsAnd helping organizingAnd so, I learned how I can make plug-inFrom meetupAnd I did lead managerAnd so, now my profile pageOn WordPress.orgHas many contributor surmatchesAnd all of thatI learned from the meetupOr work campsOr my friend I met in ManateeSo, yes, that was a really great experienceShare my favorite parts of helping meetupSo, number one, meet peopleWho has similar mindsetSo, in Cambodia, you neverBecause I couldn't speak EnglishMaybe some English speaker can make websiteBut so far, I don't knowAny Japanese people who can use WordPressOr make websiteBut you can meet similar mindsetPeople in meetupAnd another part isHow I can collaborate with volunteer teamsSo, meetups are organizedBy volunteersSpeakers are also volunteersSo, they are spontaneousLike, want to contribute back to WordPressSo, this mindset is very specialAnd when we collaborateWith that kind of peopleIt's very difficult to describeBut you feel special feelingSo, yes, and third oneGet out of comfort zoneSo, after I joined the volunteer teamI became a speakerBut, again, I'm not good for speakingAnd my English is not so wellBut I apply speaker many timesSo, yeahAnd with designer or developerFor web designer or developerYou have less experience of speaking, right?But if you become speakerOf work or meetupThat experience is very differentFrom designing or writing codeSo, you can try new thingsAnd you can get new abilityAnd meet more peopleSo, that experience is specialAnd...After workSo, these are favorite partSo, let me share moreAbout situation of JapanSo, I saw a websiteAnd it says in Japan70% of CMS is using WordPressSo, this is very high, right?So, I thinkBig part of reason is communitySo, Japan has localized version of WordPressFor Alun-SanVery long timeAnd I heard the Japanese versionWas very first versionOf translated version of WordPressSo, yesAnd also, all translatorIs volunteerSo, they have communityFrom long time agoAfter, they started workOf Tokyo 16 years agoSo, we have long historyAnd short communityAnd also, not only in TokyoSo, every part of JapanHas small meetupsAnd get togetherWe spoke of WordPress usersSo, that is amazing, right?So, and alsoSo, even you are living inCountry sideYou can join meetupAnd meet WordPress friendsAnd maybe you can go toWorkout TokyoOr other workouts togetherSo, you can get friendsSo, small meetupsAlso help communityAnd so, yesSo, this is Google calendarOf WordPress meetupAnd I don't know whyBut 25, 5 meetupsHappened in JapanYeah, so many meetupsEvery monthYesAnd also, meetupsWe need toChance to contribute to WordPressSo, that picture is fromMeetup ofInternationalizationTranslationSo, that dayWe translate WordPress togetherIn small worldAnd we also haveLocalized book a lotSo, you don't have to go to schoolTo learn WordPressAlso, this oneSo, it is contributedSo, we are togetherHow we can translate WordPressOr sending parts to WordPressOr all kind of contributionSo, meetups and workoutsAlso, giving parts toSomething to WordPressSorry, it was wrongSo, and IWhen I comeWhen I meet for organizerLast nightI really feelSo, maybe WordPressIt's growing in Taiwan as wellSo, it is very first work outSo, I thinkWordress will be bigger in here as wellSo, let's beginAnd I want to showNext stepFirst, if you haven't attendedMeetup, let's attendMeetup's information is onMeetup.comAnd there isType of WordPress Meetup GroupSo, on the listYou can find a schedule ofNext MeetupAnd be a regular memberRegular attendee of MeetupThen, inviteYour friends to MeetupAnd talk to new facesNew faces onMeetupAnd share howHow did you like the Meetup GroupMeetup eventHow was itOn SNS or to your friendsAnd spread MeetupAnd help MeetupSo, after you becameRegular member of MeetupMaybe you can help the eventBecause all organizers areVrontiersAnd they have a lot of things to doTo help MeetupLike find a venueOr suggest a topicSpeakerAnd also, someone shouldWrite events detailOn Meetup.com every timeAnd they always shareThe event on SNSSo, alsoAt the event stateMaybeThey need a lot of peopleTo moving chairsOr taking attendeesMCMaybe you can help someAnd alsoIf your city doesn't haveMeetup GroupSo, like TokyoWe haveBig MeetupLike 50 or 100 peopleBut alsoWe have small Meetup GroupSeeing some partBecauseTokyo is broadLike if you liveNot centerYou don't want to go to centerEvery monthSo, you can create new oneAnd like TokyoWe have eightDifferent groupAnd also any formatIt will get likeJust drink meetupAlso, you canTry working likeJust get togetherUse loveUse workOr, of courseYou can try presentationSo, if you haveChain attendeeMaybe you can askEveryone to shareSoEveryone can share somethingIf they use workplaceSo, alsoSo, because youCan't do work out todayYou should join after party todayAnd talk toAll branchesWearing that t-shirtSo, talk themAnd alsoTalk to meetupThey have experienceSo, they are fromSo, yesRemember, they seeAnd find them duringAfter partySo, yesOkSo, we want to share moreStudy casesI want to inviteMore meetupIn this roomYesYesThe work capitalWork press meetupOrganizerFrom Japan to JapanSingaporeAnd also Japan and TaichungTo come on stageYeah, we have a smallTo say everyone know moreAbout the meetupSo, now we haveThe Japanese然後新加坡臺灣就是在臺北And台中就是VIAG的主辦人然後而且都是職工然後上來就是我會做一個簡單的訪問一下然後讓大家就是更了解就是Work camp跟就是Work press meetup因為看到在場很多人都是沒有去參加過小劇I want to tell us a little bit about youSo, you have so many peopleSo, I give you everyone 30 secondsTalk down your background where you fromAnd what do you doA little bit about yourselfOKHello, Work press peopleThank you everyoneI am a hungry guyI am StanleyAnd I am theOrganizer of the Taizong Work Press MeetupSo, if you come to TaiwanFor the people who don't knowTaijong is at the center of TaiwanSo, it's very easy to get thereWe have members from TaipeiOr GaozhouSo, you come to TaiwanAt TaizongAnd you want to attend the meetupGreatest countryWork Press Taizong meetupOKSo, I am at Work PressFreedancer of the Work PressSo, thank youMy name is Takahiro FukushimaI am from JapanI am from JapanAnd this is the developerJapanese ArmyI am from Okijima, JapanI came from Okijima, JapanAnd I lived in OsakaAnd I organized the word campI organized the word campAnd then, this yearI organized the word campI organized the word campAnd the word campIt is very smallIt is very smallI am working on web designI am working on web designI am making a small facilityI am making a small facilityAnd I am feeling itSo, it isIt is in JapanIt is a small islandAnd the island isIt is 100 peopleAnd then, this yearThey are on the islandThis islandIt is actuallyIt is about 4-5 hoursIt is about 10 minutesAnd then, it isIt is thereIt is a word campIt is only 100 peopleAnd then, about 68%It is a lot of peopleSo, let's not sayWork PressInternetIt is useless它Working Camp有250人來就是到日本每一個部分都過去那現在Working Camp他們還有真正的Camping就是在那裡然後它就住在那裡和他的家人You talk more than I do資深的一個Working Camporganize然後它其實在這個Working台北是幫忙教幫忙教他們聽就是老師吧對,老師三十秒一點你就壓力所以我是我要怎麼介紹的OK,我試試看我用法文所以我就是Work PressWork Press的領域我們我是管Work Press一個EnterpriseEnterprise就是這種大公司做網頁的一個公司然後我是管就是Easy Pacific的那個Business我懷疑真是差然後在Work Press的Community是Work Press.org不是管Documentation Team的Over 方向Community Team之類的東西所以如果你用過Developer到Work Press.org我這個網站來學習Developer Press這是我的組織做的不是我公司做這是我VolunteerCommunity Team的成員做的然後所以公司也是只是用Work Press來做網頁然後如果大家想知道是Work Press之類的話或者Work Press.org就是一個Volunteer或者Work Press在於商業怎麼樣用怎麼樣賣的話我終於都可以跟你們好所以我會討論自己在英文因為這就是我們社群網站的因為我們學習所以大家會看到日本人英文中國人我會在英文所以大家想想想想但我的名字是DrebDreb Tung Ho我來自韓國特別在Dabao地區所以我組織了我的家在Work PressDabao我還支持社群網站所以我們有Work Press社群網站這個今年我們有兩個英文英文還有我也和社群網站這是Work Press社群網站所以我覺得這就是今天對嗎對我會討論在3pm所以我會討論英文最好的討論希望大家會看到你們大家好我叫Dio大家到台灣英文可以嗎OK所以今年我開始工作工作在Romain Registrar我在日本工作在台灣我是英文社群網站這個Work Press這個Work Press社群網站SoThank youNice to meet you我說中文比較順不好意思好我是阿俊大家可以叫阿俊然後我跟我今天還有一位講者Aaron是在組織我們台北的Work PressMeet Up我們也有固定的舉辦場所也剛好在了解我們這個社群之後來參加我們的這個社群那我本身是開發者的這個角色我也開發了一些這個Work Press的外掛可以讓大家都是免費使用我本身也是好謝謝大家Next question is likeHow did the community or the meet up started in your cityandlike what do you thinkwhy people want to join the meet up嗯Ok then we start from thereMy god問題是好所以問題我用中文再講一遍就是說就是你們就是在你們居住的城市你們的小劇這些 meet up是怎麼開始的那你覺得為什麼大家會想去參加這些小劇好謝謝李婷那其實我覺得剛剛邁克爾提到將近70%人正在使用Work Press這套軟體那對於我們也是我是開發者是Developer我也是希望用一個很多人願意使用然後他會一直持續的維持維護下去的一套系統那對我而言我發現到這樣的好處然後也也觀察到這樣子開源的生態之後然後我就來試著想要互捧你們找大家一起來那其實原本是試試看的結果互捧你們的好多人來喔那越來越來越有信心然後就告訴大家說大家可以繼續加入我們這樣子所以在我的這個我們在台北在舉辦這個MIDA的過程比較像是說無打無撞原本就只是覺得想要找多一點的好朋友就像邁克爾也是說他覺得可能feel lonely那我們也覺得feel lonely too然後就是號召大家來一起來結果就就辦成功了就很開心認識大家Speak EnglishWork PressMIDAGoodWork PressMIDAStart it in your cityIn your cityIn your cityAnd likeWhy do you think people want to join?I'll talk about the English MIDAWe just startedEnglish MIDABecauseI moved to Taiwan in JanuaryAnd joined his MIDABut it was all in ChineseSo I couldn't understand at allBut I wanted toBut I still wanted to joinAnd enjoy and make friendsAnd join the communitySo I talked to himAnd he also wanted toStart English MIDAAnd also practice EnglishSo we talkedAnd we got toWe got passion to startSo I think in JuneWe started once a monthAnd yeahIt was a small startWe feel that it's been growingAnd the attendees areReally variousFrom various backgroundLike designersSmall businessOr programmersFor normal workers with related peopleSo if you want to practice EnglishAnd talk about Work Press Join usSo the question isHow did we start the communityIn our citySo we started way backWhen I couldn't find a good communityOf Work Press usersIn our hometownLike I'm so frustratedThat I getI was like workingNight fiveWait eight hours a dayJust in my roomAnd then that's a whole weekOf my routineAnd then I'd like to find a wayTo kind of like connectAnd bring back my social lifeSo why not connectWith the people thatWith the technologyYou use in your workSo at the same timeYou get to socializeYou get to drink beers with themYou get to eat togetherAnd you get to learnMore about the platformThat you've been using in your workSo it's likeYou get a ton of thingsOut of this communitySo that timeWe didn't have a communityOf Work PressAlthough we haveBut they are inactiveSo I would like to bring backThe community to lifeSo I started oneAnd I reached out toThe global communityThe global teamAnd weI would search around the internetAnd there's a documentationCodexOr to make aWorkpress.org pageIf you're interestedTo create a meetupSo I appliedAnd I got interviewedAnd thenYo, we have a meetup groupAnd started creating meetupsAnd the good thingAbout the platformAs well isThere's an appFor the meetup.comSo people canFind your communityEasilyAnd what's the other questionAgainYeah, thank youSo I like so muchTo come to meetupActuallyTo be honestThey would knowWhat the topicsIs your meetupSo that's somethingThat interests themThey go to your meetupAlsoThe wayThat we poseMeetup announcementWe'd like toAlsoAdd a little bit of wordingLike what do they getAside from the topicsOf course you getTo meet peopleTo connect peopleYou get inspiredBy these peopleUsing WordPressAnd that you get inspirationOr if you haveLike questionsRegarding yourCertain issuesIn your projectMeetup is the best timeWe need to getAnswers quicklyOther than justPose onlineAnd wait forWherever you'd likeTo answer that questionSo I think that's it時間短So quiteSo IActuallyI'm helpingGlobal teamAnd one dayWhyI'm not helpingMy motherMy motherMy home countryIs SingaporeAnd thenI found thatSingapore has doneMeetupJust ifNo one continuesJust likeNo one continuesIf you canThe meetup will stopSo II'm doingAnd thenStartTry theLet usTry ourMetupsSo weTry toKeep it upAnd thenSoSoSoSoSo SoSoSoSoSoSoSoSoSoSo那麼多人,可能去到50%之類其實當然50%是一個大數字可是50%大多數人都是可能做自己完帳不一定是賣公司,未公司做完帳之類的如果大多數人來,都是外國人玩這一點嘛怎麼樣弄壞啊之類的怎麼樣SEO達到更好的成績如果大多數人有SEO的那個topic一大堆的人來不是SEO的,是我們說Divide最多的一堆是50人來所以就是G3就是這樣YAMPはワードミッフレジミッタップは私がまずオフィジマーに引っ越してきた後に西川新一さんっていう人が引っ越してきたのでまず二人いたら必ずミッタップができるということで始めました他是半個新的大人然後就跟一個好朋友西川新一其實他是一個很好的好朋友然後就開始のミッタップはいそうしてるうちにワードプレイスのこと勉強した人達が島の中にもいたり島の外からもミッタップをしてるうちに来てくれるようになりました對,所以就他就開始那種研究会然後就是島內到外都開始過來就是一間島そうしてるうちにワードキャンプをしようとなったのでもうちょっと広がって例えばここにいる人で言ったら香港から血液さんが手伝ってくれたり小賀さんがお肉を薬の手伝ってくれたりしました然後就是自身做了work-in之後能work-inの那時來香港的那個人他們住香港,他們是日本人來的然後他們就說話我那時等一下就去跟他們說話然後就還有日本的幾個自身前輩就過去就幫忙就幫助work-in然後過後就ミッタップ是越來越大そんな風に二人から始まったわが大きく広がっています然後我那時開始死亡者然後なんで…なんできます我那時死亡者一人的狗狗就是我那時死亡者所以唯一當面我那時死亡者OK, 你好嗎?OK我那時就見到東京那時代なんですけど始まったのはやっぱり昔はworld benchっていう日本的名前でそれが10周年10周年東京10周年そこからずっと聞き継継だSaitamaは8年5年SaitamaSaitamaはbed timeです誰?SaitamaHe live in SaitamaSaitama is next to TokyoSo it's kind of best timePeople living and people who work in TokyoLive hereThat's the SaitamaSaitama就是在東京的北部然後就是…但是住了一段時間是晚的地方然後他就是那邊住的那邊Wina當然他也是Working in Tokyo的地牢本來的時候就是Saitama和Tokyo的人是正式那邊住的那邊Saitamaは東京に働く人一般對我明白了I expect始まったSaitamaSaitamaはworld bench Saitama那時代當然目標としてもWord can Saitamaをやりたいという目標もあってMeet onMeet on引き続きやりたい所以當然Meet on開始剛剛是要延遲Word press可是現在他們就很努力的一直做Meet up因為他沒在做Word can Saitamaでどういう人が来るのかっていうのですけどやっぱり日本のShare70倍以上あるのでやっぱり自分もそうですけどWebday、WeboppaDesign、WeblogaMarketaの方とか常常毎回テーマは違うんですけどありますか所以其實來人他們Meet up都是都是滿多種Developer,Design,VlogaUse什麼都有然後每一次Meet up那個主題都有點不同聚集來說去那個Meet up都是只是想知道我們到底是怎麼樣的東西什麼用啊之類的所以就是想認識了Iron厲害的人厲害的人他們都用現在我們開始這部片子我會講到我的朋友我住台北Kamisa好台北我住台北約7年然後我結業我也是開業一位我的朋友我叫做他认为是一个内财训练室现在他认为是训练系统他还能确实找到您能导致计划船您还能找到内财训练室您也能找到内财训练室我也喜欢训练因为解削一直向其他人伸出最重要的是我们喝了很多我们喝了很多老师说了 closed after所以每次他們來到我們餐廳,我們喝啤酒,我們確保我們學會在餐廳上學習當我回到台中,我可以找到Miba說話,所以我只想找到Miba我希望Miba可以幫助別人知道Miba說話因為很多人還不知道為什麼是Miba說話所以我可以找到Miba說話我們沒有喝啤酒,所以想找到Miba說話我們在餐廳吃飯,大家可以接受再一個問題嗎可以,再多了解一下我想問一個問題,Miba說話在你的社群中,你覺得Miba說話嗎Miba說話,Miba說話Miba說話,Miba說話下一個問題,大家在聚會或社群裡面,發生過你最有印象的一件事所以,我們在餐廳工作,他們沒有給我們錢,但他們幫助我們我最有印象的一件事,我看人們很擔心說話所以,我總是希望別人知道Miba說話別擔心Lomato說話你是初音師或是新做的錄影師,我們也希望再分享你研究的事慕容,慕容慕容,慕容慕容,慕容慕容,慕容慕容,慕容慕容,慕容慕容,慕容慕容,慕容慕容,慕容慕容,慕容慕容,慕容慕容,慕容還是最開心的小比島人是162人的島在世界上有250人來這裡人數比較多,人數比較多在世界上有很多人來這裡非常高興所以中國人那天唱的就是導聖來多個人然後我CAM MEMO是多個人來比導聖多人其實你我有趣就是那天打好籍那天就是那是就是他最記得的嘛那個一般的對其實我覺得我本來是影響了一個很好的答案可是可能是現在是最最memorable的為什麼呢我要用華語因為我很多人來說話然後我華語可能整年都沒有說到這麼多所以今天是滿memorable的嗯OK我認為最memorable的日子是在後派對所以所以我我還會推薦你們來參加之後但是一件很嚴重的事我發現每次我看到大家一起來每次我看到大家一起來參加他們的時間然後來這個很多的活動然後跟你們跟新人一起來然後聽到新的語言是很棒的是很棒的感覺我不知道一個特別的活動我感受到很驚訝但是我的感覺是像我剛才說的我感到雖然我們在英文做了一切但是我們做的我們感覺我們更加聯繫我們組織我們有很多人我們感覺我們的本地是不丟臉也是覺得


It's a very important question, how do you keep running the business whilst you're transforming the business? And it's a far from easy question to answer. A related consideration also is how do you make sure that those who are running the business don't start to feel as if they're second class citizens, that the glory brigade is everyone that's involved in the transformation. Be very clear on who you're going to call out as heroes and don't just call out the folks who are on the transformation. Call out people who are running the business as well. And also think about rotations. Resilience is an incredibly important consideration in transformation. And no one has infinite resilience. Some people want to believe they do, but they don't. It also sometimes comes down to keeping an eye on leave schedules and making sure that people are taking a leave because sometimes your very best people don't. That gets to issues of sustainability. That doesn't mean you shouldn't ask a lot of people. The truth of the matter is that if you have a strong culture, if you have clear metrics and that the organization has confidence in the purpose of the transformation and in the leadership that's driving it, in the fairness with which it's been gone about, then most of the time the organization will go to extraordinary lengths.