Hello, I'm Andy. I have a lot of slides, so I will attempt to do this in as clear, but as speedy away as I possibly can. So, what's going on? I'm Andy. I'm a technical milliner. You can tell I'm a build fanatic and an advocate of continuous everything. I'm a founder of Control Plane, continuous infrastructure and security practices with a focus on containers and Kubernetes. We are, of course, hiring cloud native hackers and engineers. If I can get to the end, I will give you more details. And I've done a little bit of everything from development, database administration, operations, pen testing, architecting. I want to talk about network security in Kubernetes. So, what is this? It is a way to ensure private and trusted communications across potentially untrusted networks with malicious actors like the internet. Why do we need it? Because we can't trust anything. The internet was built with trust between everything. But, unlike the origins of the internet, we're not a bunch of academics running trusted workloads anymore. We think about runtimes and we write software to run as if it were a day boating on the lake when in reality there are pirates everywhere. We should be designing our systems for the most hostile conditions they could possibly face. Resilience is key. So, we'll look at how Kubernetes does it. It uses a lot of standard components, but sometimes in a slightly different way to the manner they're used on the internet. For example, on the public internet, self-scientificates are bad. We'll look at why they might be good. We'll look at how encryption works, how we establish trust and finally how we determine identity from the protocols that keep Kubernetes secure. And our workload safe. And if there is one takeaway from this, it is encrypt everything everywhere. We are at the bleeding edge of a revolution that is already permeating traditional enterprise systems. These systems have high compliance and high audit requirements. Breaking away from traditional network security patterns is really difficult. There are many layers to a security onion. So, cloud native applications give us an opportunity and a problem. It's difficult to encrypt everything, but it's also difficult to encrypt workloads that are constantly churning, restarting and being rescheduled to unexpected or unpredictable places in our infrastructure. The SPIFI project is looking to solve some of these issues. The subject is broad and deep, so we will cover some key technologies and hopefully leave you enough pointers to go and do some further investigation on the parts that interest you more thoroughly. So, network security 101, Kubernetes API components, TLS in general, mutual authentication in particular, CNI and network policies for applications and finally looking at bootstrapping identity for dynamic workloads with SPIFI. So, what do we want from network communications? We want privacy and we want trust. Private means confidential, trusted means we have integrity and authentication on the communication and non-repudiation sometimes makes an appearance here. That means the inability to disprove it was the person actually communicating. We won't worry about that one for now. So, human communications, trusted and local. This is like whispering between two people. We know who is talking to us and nobody else can hear us. This is like a private air gap network. We believe there's nobody else there and so we take no extra steps to verify the identity of the other party. This is okay in a very small number of situations, but in general it is not. If somebody else sneaks into the room or is hanging from the eaves, our security is broken. We need it to be private as well as trusted. So, how does this work on the internet? Communicating on a public network is like shouting across a crowded street. We see the speaker or IP. We hear their voice synchronised with the movement of their lips and hear the words. Is that enough to trust somebody? Well, in human terms right now, yes. Although in the future deep fakes mean impractically that may not be a possibility, but this only works when both parties are local. What happens when we need to communicate remotely? You may remember Postman Pat from your youth. We use the postal service or these days this is the internet. So, with the postal service we want to trust the stamp on the letter as a guarantee of sanctity. Nobody is supposed to open this right? Wrong. The UK in particular has a long history of postal interception and communications in transit in general, preventing them from reaching their destination or spying on their contents. So, we need to get our privacy. What can we do when our communications path is untrusted? We use encryption and on the internet that encryption is what we know as ATTP secure, SSL, TLS, and back we go in time to 1991 when there were no certificates. Neither was their geosities, but for those of you old enough to remember it, here's a trip down memory lane. We tried for a few years. We released SSL version 2. It was difficult. It was slow algorithmically and computationally and it was broken. So, out came SSL version 3. More turmoil. And finally, TLS. Backwards incompatible. Everything is deprecated. We're now on TLS 1.3 and there are many, many attacks against these protocols and specific implementations of them. So, as always, keep your systems patched. Is it really that simple, Will Smith? Sadly not. A single mistake anywhere in configuration, implementation or usage can compromise the integrity of our encryption. Leading to the oft-sighted atherism, don't roll your own. There's no greater challenge for a cryptography nerd than an unhackable cipher, C Blu-ray. Cryptography is just a mathematical puzzle with some strict assumptions. And with that warning, on to Kubernetes, securing the API server. There are a lot of encryption options on the API server. We use TLS everywhere, but how does this work? We ask for a set of data to be signed and a certificate guaranteeing that data is produced. This is the CSR request and we can then use the trust we have in the certificate chain from the signer to the LEAF certificate to validate an X509 certificate at runtime. So, we have the root certificate. The root certificate authority is generally kept offline and safely secured. The root sign is an intermediate or a more general signing certificate which finally signs the LEAF or end entity certificate which is what we get on a website or a workload or on the API server. And what's that? That is a load of X509 certificates in a chain of trust that is the basis for TLS. Okay. So, what are these concepts? And how can we establish new encryption keys across a network that we do not trust? Because it's not already encrypted. We use public key cryptography. So, what is this? Simply it's a way to send messages that only the intended recipient can read. We use the public key to unlock the mailbox. The public key can be shared given to everybody because it's meant to start the conversation and not end it. Then the message is encrypted with that key and put into the box. And finally, the private key is used to unlock the box and decrypt the message. The public key cannot decrypt a message that it itself has encrypted. Only the private key can do so. So, how does this all work? Some quick glossary descriptions. Symmetric encryption is both keys being the same. You use one key to open and close the same door. This wouldn't be any good on the internet because the server would have to share its private keys with every client who wanted to talk to it. So, asymmetric encryption. The keys are different. This is more like it. This is how PKI works. We base this on elliptic curves, which is essentially curves that don't cross and loop around the plane. And we use certain properties of the elliptic curve to make a far more difficult problem space to brute force. Finally, these are elliptic curves. Finally, Diffie Hellman is a way of generating a shared secret between two people in such a way that the secret cannot be seen by observing the communication. This is how SSH works. This has been integrated into the bootstrap phase of TLS now. So, you're not sharing information during the key exchange. You're creating a key together separately. And, have we actually seen these guys? There we go. These are the two gentlemen here as a cryptography that have kept us safe since 1976, fighting US export grade classifications on cryptography and doing a great service for all of us in the meantime. Moving on. There's more info on how this bootstrapping in TLS actually works from DNS Simple, explained with cats what more could you possibly ask for.  Don't tell the other room. So, let's move this back to Kubernetes Land. The API server presents a certificate when cube control makes a request to the API. It's usually self-signed. This sits in user.cube config on your local machine and typically contains the public portion of the root certificate for the API server's certificate, which is specified when using place of the system default certificates. Cube control uses the public key of the API server to start the Diffie-Hellman exchange. They generate their shared secrets, then shared a secret key and begin to talk, this is now secure. Exactly the same certificate path validation as before. So, this is what a public key is made from. SSL or TLS certificates are the public part of a server's X509 key pair. It contains a public key and an identity, a host name or an organisation or an individual, and is either signed by a certificate authority or self-signed. What does a certificate look like? Well, here is a certificate spec from the X509 version 3. We recognise this as the encoded version of a certificate and we can decode it very easily to see its contents. How do we know that we can trust it? We're back to certificate path validation. And there's a question here of self-signed certificates. On the public internet, self-signed certificates are bad. They are generally the sign of a man in the middle attack. We don't trust them and it looks like somebody has potentially intersepted and reproxied our connection to a server, then presented the communications back to us. The difference here is, with Kubernetes, we sign with a certificate authority that is generated within the cluster. The private keys for that certificate authority do not leave the cluster and as such there is one place to control your key material. If the routes on the API servers where those certificate authority private keys are stored is compromised, you have bigger problems than the encryption in transit of the cluster. So arguably this is a new pattern and it's better than having centrally organisation controlled certificate which you have to manage not only offline in some sort of cold storage but also bringing into the cluster regeneration and management of keys at rotation time. So the new cloud native way is generate your certificates, keep everything, all key material inside the cluster. It's nice, it works. We do this in Kubernetes land with two certificates. One for the server so we prove the identity and another one for the clients. We've mentioned this a couple of times already. It's just the TLS negotiation twice. There is a second certificate exchange between the client and the server after the initial handshake. This establishes a two-way trust mechanism that guarantees the identity of both parties. So on the internet you would ask for the certificate of the server and you would get back the Google.com host name. With mutual TLS you also provide a second certificate with your identity encoded into it. So both parties can identify each other and that authentication can then be used as the basis of authorization. This is a good thing. So where are we? We have private communications, confidential, encrypted. We have trusted communications. We have integrity given to us by the encryption. The Cypher guarantees we get the correct output with the correct inputs. And finally trust. We have authentication from client certificates. So back to the Kubernetes API server. Do we trust the network? Frankly no. And why should we? If a malicious actor gets inside the perimeter they have access to everything behind it. Phrases such as perimeter and DMZ should raise flags in cloud native architectures. Beyond Core from Google is designed as a response to these newly emergent threats. This is a project that basically says trust nothing validates everything and run your servers as close to public as you possibly can. Because that's the best way to bring pain forward. And be sure that your configurations are secure. This is called zero trust and it means that our systems continue to make some guarantees of safety even when some components are compromised. Obviously the nature of that safety is entirely dependent on the system and the type of data it stores but contrast this to traditional perimeter-based approaches. One compromise and the whole system might be hosed. Say what's Equifax. So if you want to run your own zero trust server all you need to do is put an identity-aware proxy in front of it or in the same pod as it. There are multiple examples of this online and it's fine for simple applications. It works nicely. But for complex microservices with deep transitive dependencies and crazy call graphs you'll probably have to run some sort of one-time token service to prevent replays, pass request context around and another number of non-trivial application layer concerns. Fortunately they're all described in this book by Spiffy author Evan Gilman. If you want to dig deeper into the future of network security this is a great place to start. We will examine some of these concepts in detail shortly but first back to the API server. Zero trust really mean in this context. It means that we mutually authenticate the tier less connection with client certificates between the cubelet and the API server between clients that are connecting to it. It means we know the identity of the server and of the client and that we have our own private and trusted criteria fulfilled. Zero trust is a lot more than this but we're adhering to one of its principles to restrict the blast radius of potential compromise in our network. Some container or server has an unauthorised user and their intentions are malicious. Let's have a look at the API server components and their communication. This is an awesome diagram from Lucas Calstrom, the Cube ADM maintainer. It's in more or less every talk I ever deliver and it shows us the network communication, parts and protocols for the various components of the system. So let's think about this. What could go wrong? Well, a container has an unauthorised user. How likely is that? Well, what about if somebody routes a privileged container? Admit it, everybody is running some and with a few caveats that is game over.   Or there's another container in the same pod as us. Remember, the pod is a shared network namespace. They share the same network adapter. We can then sniff their traffic under certain conditions. Game over. Defence in depth is a friend here. This is similar to how traditional breaches occur and attack a gains of foothold within a system and starts to look for other chinks in the armour to pivot and to continue to escalate their privilege. We can fix this. For more on sealing up those gaps in Kubernetes, this talk goes into a lot more low level implementation detail. Thank you for the cat. This relentless focus on automation allows engineers to automate and refine the business's concerns. Veracity, security and performance in some order. So, now that we're sure that the control plane is able to communicate in hostile waters what about the applications running on it. Our data is the golden treasure trove that attackers are keen to retrieve. So, if we leak our database keys over the wire, we may as well have not bothered encrypting our control plane traffic. So, what's next? Static endpoints are easier to encrypt as they tend to stay in one place. Or, more importantly, one IP domain. This can then be used for X5 and 9 as an identity. But that's all very well if your infrastructure has a static IP as the front door. But what about dynamic resources? Containers break the coupling between IP and identity that has traditionally been used for firewalling and network security. Containers churn, they get rescheduled, they are dynamic. So, we need a component with a holistic view of the whole cluster to run our firewalls for us. Our cloud-native firewalling is network policy. Kubernetes is a complex mix of abstractions and network types and providers. And so, enforcement of network policy should be deferred to the orchestrator, which has a holistic view of the whole system. This is what a network policy looks like. They are applied to pods by label. Of course, labels are loosely typed. If you want to put that in inverted commas, in Kubernetes, there is no verification of labels. As a security feature, they are the loosest possible way to enforce anything. But unfortunately, we deal with what we have. With an empty pod selector, it just denies everything in the cluster. So, it's a default fail closed. It should really look like this. I just test this API. I think for something so important, it is not very clear. Here's another example that only permits egress for port 53 traffic on both protocols for some reason. Of course, maintenance of policies as applications change is very important. And this is just for layers 3 and 4. That is because DNS is inherently nondeterministic. We could be load balance. We could be OIP. We could just be round robin going on. So, this was ignored for Kubernetes purposes. Istio does away with this problem because Istio lives at layer 7. So, you can perform egress filtering with an egress gateway at layer 7 with Istio, which is something we will touch on briefly later. So, here is an impermissible network policy, of course. And we have a pattern for testing these. How are you going to know if something so loosely typed and verified actually breaks? You SSH on to the node. You enter the same network namespace and you aggressively parallelize NMAP to white and blacklist the desired endpoints that your application can reach. This is a meta-pattern for testing network policy. Start with a default deny and build out your code based on the Kubernetes deployment names. Produce a simple tab compliant output. And there are other ways to firewall things in Kubernetes, notably new vector operators at a different level to network policy. Whatever you do, do something unless you are a creative agency with no state in your application at all. So, we also have encrypted container network interface plugins. These do some good if you're using one, but they only fulfill part of our requirements. This is blanket symmetric encryption on all traffic. We have no identity and thus no authentication, and we are using a single key. A public API is an attack surface, so we need to do something else to fix this problem. Enter Spiffy. Spiffy is a set of open source standards for securely identifying software systems in dynamic and heterogeneous production environments. Spire is the reference implementation, which is a tool chain for establishing trust between software systems across a wide variety of hosting platforms. And concretely, Spire exposes the Spiffy workload API, which can attest running software and issue Spiffy IDs and ESFIDs. An ESFID is a Spiffy verifiable ID document and is the foundation of the identity that we then use to bootstrap our network encryption. This in turn allows two workloads to establish trust between each other, for example, by establishing a mutual TLS connection, and we do this by attesting to individual workloads. This is an example of a Spire attester for Kubernetes, and attestation policy is describing the properties that a workload must exhibit to conform to the policy and to gain the identity and have the certificate generated for them. And it's typically a mixture of process attributes, so the contents of PIDs, PROC, sorry, and infrastructure attributes, so attesting to a VM on a cloud provider, you're using the metadata API to pull back instance ID and type, for example. So, Spiffy is a standard for how an application can retrieve an identity programmatically and importantly, generate short-lived credentials on the back of that identity. And just as importantly, the API allows a workload to retrieve a trust bundle, which is the public keys that can be used to verify these self-signed keys. So, we're self-signing with a private CA, and we need to share the public key of that CA so that workloads can validate the TLS certificates that we have minted and handed out to our cluster, to our applications in the cluster. So, this means applications, libraries, and tools can retrieve credentials that automatically identify them without needing any secrets co-deployed. A Spiffy ID looks like this, there is a trust domain, which in Kubernetes is your cluster name, and you have a workload identifier, and it's encoded into an X509, just like we saw earlier using the certificates extensions to encode further information. Here is a certificate spec, the X509 extensions here are what are used by Spiffy. We know that we can trust this, we're back to certificate path validation, it's exactly the same technology used in a slightly different manner, and we can see how further selectors can be used to identify all sorts of workloads. The workload unknown attest to plugins here, bootstrap the identity process, and can do so across multiple different deployment types, while Istio implements a rudimentary first cut version of Spiffy, I'm sorry, Spire implements a whole lot more. This technology is actively being pursued outside of the Istio project. It is important to note that Spire, and well, Spiffy in particular, is not the network encryption itself. It provides the identity on which we can hang all our network encryption and generate certificates, but it does not have anything in the specification that describes what the usage of the verifiable identity document is for. Very simply it looks like that, it reinsert the Spiffy ID into the SAN. This is the Istio implementation. Envoy has the public keys of the certificate authority injected into it, because Istio is using its pilot component to write those API changes to Envoy's API, it's all API-driven configuration, and as such, Envoy is able to verify the authenticity of those certificates, and security tightening will continue in this project. Istio is still nowhere near where, ultimately, it's promised to suggest that it will be. So, yes, a couple more minor things. The secure naming is then used, secure naming is extracting that SAN, and using it as the basis for routing decisions. So, we then put on top of that, our back at layer seven. So, HTTP verbiage, parts, and we can also, and there's something else that hangs off that that escapes me right now. And there's plenty more. So, recapping. We have end-to-end encryption. Private, mutually trusted communications between the API server in Kubernetes and its callers. We have encryption in Kubernetes equally now for the values in the SCD store, which we didn't used to have. You must turn on SCD encryption on the API server if you have the chance. And in Istio's case, we are actually minting certificates and bringing them to Envoy. Control Plane have some threat modelling on Istio and Envoy from a DevSecOps meet-up in London recently that you will be able to find on the Twitter stream. Eventually there are attacks on Envoy from compromised pods. If you want to talk more about that, we've got lots of interesting stuff to find afterwards. So, the takeaway from this is doing encryption. It's great. Encrypt everything and while you're there, you may as well do it everywhere. Incredibly, I've managed to go fast enough. The obligatory hiring notification. If you would like to come and work in London on difficult problems to do with network security, application security and the provenance of artifacts and third-party code risk, then we are a very nice team, a small team of people and we offer some great benefits. Please hit me up afterwards and any title that you want you can more or less have. So, with that in conclusion, network security is very important. X509 and TLS keep us safe. Network policies are mandatory. You really must be running them in your Kubernetes clusters. Otherwise you're allowing routes all over the place.  Cloud-native applications have way more opportunities to secure them than previously. A container is a per-process granular high-fidelity hanger for us to put security policies on. We can wrap security around a single process. So, although containers are fast and loose in some, from some angles, they also offer a far greater opportunity to learn SecComp. It's here on Spotify to give you wings and encrypt everything everywhere. Thank you very much. We can do one question. Oh, so on with that. So, banks love using IP addresses as the only source of identity for firewalling. Oh, yes. And have you had any success convincing people that IP addresses are not particularly good identity, or is that mindset? Yeah, so this is wrapped up in the whole breaking this traditional enterprise mindset. It's difficult. The way this works best for us is an enlightened VP will say that we've deployed loads of Kubernetes. What do we do? How do we fix this? It's still... The audit requirements and change control are required to get changes for pairing requests or subnet allocations. It's still super, super difficult. So, much success, no, but the beginnings of changing the mentality, absolutely. There's one further problem that if people have any interest in this, Spiffy are currently looking... Well, Sightail are currently looking at federated trust domains because TLS libraries do not check the federated aspect of some of the extensions to X509 well at all, which means ideally, for a banking scenario, you would have multiple Kubernetes or Istio or whatever, just TLS trust domains that are able to verify each other without being able to cross-generate each other's certificates, like an obvious requirement. However, it's not as easy as that and the project's very much looking for help. So, if federation of trust domains works, then ultimately we can say, issuing IPs entirely like we do in the CNI can be done on a wider infrastructure level because we're layer 7 everywhere. More help is needed. Good question though, thank you. Thank you.


Morning everyone today is Monday August 31st at 8 a.m. I'm gonna do a video watch this day So for those that don't know I do a free video watch this every single Monday on YouTube And then I do an 11 a.m. Recap on Mondays and then usually every day or every other day I do the video watches for the members inside the community So a couple things to make note of before we start is it's been a slow week last week was extremely extremely slow This is typical summertime action usually markets in the summer are slow until about September But because of COVID we had a crazy crazy crazy summer So this is expected, you know, we have six months of a hot market It's only normal to have one or two weeks of a slow market The key on slow markets is to trade small To stick to your niche do not try to trade random shit just because it's moving and to kind of stay patient Wait for your setups to show up if your setups aren't there. You have no reason to trade So nothing I really love this morning. Nothing that is particularly interesting to me But I'm gonna still try to find some trades. So VV PR this one apparently there's buy-ins all day today I'm sure that was kind of a reason why I ramped up yesterday So I mean in a perfect world obviously if we got a bounce towards 1050, I don't really know if it's gonna get there If this thing kind of goes red, I will look to short a break of red for a wash lower But other than that just kind of staying patient letting it do its thing once it goes if and when it does go red I will look to short it for a quickie, but other than that just kind of kind of stay patient Give me a second Huge nothing really too exciting here.  I'm gonna even take this off the wash list. This one's really nothing good It was tanking and now it's kind of bouncing on air so don't really want to mess around with it Tesla So today is the reverse split basically just gonna short it if it goes red if it doesn't go red I won't touch it. So two new stocks are popping up on my radar right now. It's MBio. So let me kind of do some quick research on this So MBio Float is 40 million insiders own 26% What's the chart looking like? Nothing. So just kind of waiting on MBio and GNW is a new one GNW is easy to borrow and SSR GNW 500 million flow. This is Nothing Again guys, there's really nothing that I love nothing. That's too interesting today is gonna be another slow day and on slow days It's very important to kind of keep yourself Safe to keep yourself out of trouble so that you preserve mental capital for when your plays are here So nothing really I love nothing too exciting this morning. Hopefully some more stuff pop up But in the meantime, that's basically it guys. Thank you


Hello, it's Waylon Chow. This is Intellectual Property Law Part E. In this part, we will examine patents. Patents, just like other IP law, involve striking a balance between providing individual benefits and societal benefits. So with patents, that's called the patent bargain. On the one side, we have individual benefits. So the individual benefits are meant to provide an economic incentive for research and development by providing a time-limited monopoly, which is the patent. In terms of societal benefits, the patent system provides for the sharing of information and knowledge by requiring a full description of the invention to be filed with the patent office. So that information is available to the public that can be used to create further innovations. And also, after the patent expires, the invention becomes a public domain. What do patents apply to? They apply to inventions and improvements to existing inventions. There are four requirements for patentability. The subject matter must be patentable. There must be novelty, utility, and the innovation must be non-obvious. What do patents apply to? Or in other words, what is considered to be patentable subject matter? Under the Patent Act, what is patentable are inventions which are considered to be new and useful art, process, machine, manufacturer, or composition of matter. It may include improvements on existing inventions. And a recent development is that some business methods may be patentable. The key example here is the Amazon one-click ordering system. So when you go on Amazon's website and you find something that you want to purchase, Amazon has created a system where as long as you've already registered with Amazon, you have an account, you can buy that item by just clicking on one button. Instead of the usual process which takes many more clicks where you put the item into a virtual shopping cart and then you need to go through a number of different steps to check out. So this makes it much easier for Amazon customers to purchase an item from their website. So Amazon a few years ago was granted a patent in Canada before that Amazon had already received a patent in the U.S. But Amazon did have some significant difficulty in getting a patent in Canada. They were originally rejected. They had to fight it in court and eventually they won and now they do have a patent for their one-click ordering system. But still highly unclear as to what criteria a business method has to meet in order to be patentable in Canada. What is not patentable under the Patent Act are natural laws, scientific principles, abstract theorem. So anything that falls into any of those categories is not patentable. For example, Albert Einstein's formula E equals MC squared is considered to be a natural law or scientific principle and therefore is not patentable. Also in Canada computer software is not patentable because it is considered to be a scientific principle or abstract theorem. In contrast in the U.S. software is patentable. What is also not patentable is any kind of higher life form such as plants or animals. Now on a more microscopic level the genetically modified genes or cells that may make up a plant or animal, those genes or cells are capable of being patented. The second requirement for patentability is novelty. What novelty means is that the invention has not previously been disclosed or become known or otherwise made available to the public. In other words there is no public knowledge of this invention. So what that means is that if you've created an invention you should apply for the patent before disclosing or marketing or doing any sale of the invention. So since a patent is granted to the first person to file, not the first person to invent the invention, it's very important to apply for a patent as soon as possible once the essential elements of the invention are complete. So the picture here shows the U.S. patent application by Apple for something called a magic keyboard. The third requirement for patentability is utility which means that an invention must both work and have a useful function. The fourth requirement is non-obvious in that the innovation involved in the invention is not obvious to a person of average skill in the field. So an example, a seemingly simple example of this is this combination drinking straw and spoon. And a patent was granted for this in Canada which would mean that it was accepted that this was a non-obvious innovation by combining the straw and spoon together into one item. How do you obtain a patent? So a patent is obtained by filing an application with the Canadian Patent Office and you usually need to hire someone called a patent agent to help assist you with the preparation of the application. So that application has to provide a complete description of the invention which is then made available to the public. The process of obtaining the patent is not a quick one, it can take from two to five years and it is fairly costly to go through that process. What legal rights do you have by owning a patent? You have an exclusive right of making, constructing and using the invention and selling it to others to be used. So this monopoly right lasts for 20 years. There is an exception in that a patent invention can be used by others for research, experimental and commercial uses. Now unlike copyright, patents of inventions by an employee belong to the employee unless the contract stipulates otherwise. If you remember with copyright, in that same situation the copyright work would belong to the employer. To economically exploit a patent, the owner may do a number of different things. They can choose to develop and market the product themselves or they can license the patent to have someone else bring the product to market. The patent owner is then paid royalties, so that license can be exclusive or non-exclusive. Another thing that the patent owner may do is just sell the patent outright to another person. Where a patent is infringed, that patent infringement is a civil wrong which entitles the patent owner to sue the infringer in a civil lawsuit. The potential remedies would be very similar to the remedies available for a trademark. Damages, accounting of profits, injunction and delivery of the infringing products. Having a Canadian patent only gives the patent owner monopoly rights in Canada. Patents are done on a per country basis. There is no such thing as an international patent. But there are international treaties dealing with patents. For patent protection in foreign countries that are members of the Paris Convention for the Protection of Industrial Property which includes Canada, the foreign patent application is dated as of the date of the Canadian application. That foreign patent application must be within one year of the Canadian application. You get the Canadian application for a patent put in first and then you have a year to apply for a patent in the foreign country. That's also a member of the Paris Convention. Filing under the Patent Cooperation Treaty or European Patent Convention has the same effect as filing in each country under that treaty. So if you make a patent application under the European Patent Convention, that application is effective for all European countries that are a part of that convention.


Hey, what's up dudes and dudettes drew that anxiety guy calm back again with my friend Monique coven all the way from Canada with her wisdom and Kindness and smiley's oh Happy to be here again, this is our second take again technical difficulties ruin everything so today We have a good topic today. This is right up Monique's alley. We're gonna talk about thoughts and And how maybe not to be dragged around by them the fact that you do not have to follow every single thought that comes in your head So since this is kind of a wreck and I think you have more to add to it than I do Let's I'm gonna let you start tell me about what the issue is with thinking. Why is it a problem sometimes? Essentially, I mean this was Revolutionary I mean, I thought I understood about thinking. Mm-hmm. I know not Because as I started to really understand our design the way we're created the way we work psychologically I Started to see that as human beings. We feel our thinking Physically, you know somatically So when we have a thought whether it's true or not whether it's, you know Something happy something sad a traumatic thought Whatever it is. We're gonna experiencing it. We're going to experience it somatically. We're gonna feel our thinking. Sure When I started to recognize that we're living in the feeling of our thinking moment to moment and therefore a lot of our thinking Feels real because we have the physical sensation or respond our bodies responding to our thoughts We get the physical sensations of it So even if it's a thought that's not true because we feel it We make stories about it and we conclude that it's real and that is a really big problem for us in that It's like it's hidden as we have eyes We see what's going on, but we don't really see what's invisible, which is our thinking And so I think that it's the fact that I didn't get all the things off my to-to list That's make anxious or it's because I've been on the couch too long That's making me anxious and I didn't get enough stuff done or you know, or whatever it is And I would blame out there and I didn't understand that really there's this there's this whole Invisible experience that we don't see that's creating a lot of our Feelings and it becomes our experience of life Sure that makes perfect sense actually it really does And so we we're kind of conditioned to a certain extent to to honor our thoughts and our feelings And you hear this so much, you know, especially in sort of the self-help mental health space Especially i'll just say it these days when everybody that can breathe can become an expert and put up a channel and start talking about this stuff We hear that stuff all the time check in with yourself honor yourself on and and i'm with you know We have to love ourselves and and all those things But it's almost counterintuitive like you do not have to honor every single thought you have like it's not required In fact, you know, we were talking about it in our first take on this If you look at some of the great philosophies and a lot of the stuff that you hear online is based in in Taoism Buddhism and those sort of things and all the memes and the Lakes with the calm lakes and all that stuff Is based on those those things that say your thoughts are not you or It's really your thoughts and your reaction to the world that matters. It's not the actual world So and I think it's so hard for people to grasp that sometimes that it's not the fact that you your wrist hurts It's the fact that you Feel that and then think I must have a life-threatening blood clot Exactly and it's really like I call it. It's like this huge illusion That we are under because we don't see we just we're physical people We see what's in front of us. We don't see, you know, what's what's underneath? Yeah, that for me has been revolutionary because I never knew I was feeling my moment That was that was mind-blowing when I started to write into that I thought I was feeling the world and when you're feeling the world Oh my god, I feel like a helpless victim because we all know we can't control, you know, what's gonna come next What's gonna happen? correct It's nice to know there's there's one place to look and that's that's within us in our mind What's happening inside us? Yeah, and I think that's why people who get themselves into agoraphobic situations Or they start to severely limit their lifestyle to only be in their safe or comfortable places or situations They there's that lack of understanding that says but you don't understand the problem You're bringing the problem with you everywhere So the problem exists on your sofa in your bedroom and your living room at your favorite farm or wherever you think is Safe those thoughts are still with you So Yeah, it almost has meant the place the situation doesn't matter. It never matters. Yeah I heard something somewhere podcast or something they were talking about I don't know millionaires who win lotteries and It shows that like five years later. They're in the same place And why is that? Well, that's because the thinking is still going on that hasn't changed. I'm going to introduce to you I'm not going to take the credit for it. I'm going to give the credit to where it deserves Which I saw this I learned this from dr. Amy johnson, but it's something that's been really helpful when I work with my clients And we have this chatty. Can you see it? Yeah, I can see it. Yeah This is this is our chatty narrative self That's the part that is talking and that is saying, you know, be careful. You better do this. You better do that Hurry up, you know, all this kind of stuff And it's going on on stop and a lot of that is conditioned. It's I call it.  Yeah, you would have friends if they do that And yeah, you know, this is going on all the time and a lot of times we're like, yeah, yeah, yeah, we're agreeing with Yeah, and what I've done is I know it's there blah blah blah blah But I started to see that I don't have to take my thoughts so seriously I don't and that's been really helpful knowing that there's that and then there's me Yeah And I think it's so far into people when I say things like you are not required to respond to every thought you have And so many people find that to be like a crazy thing to say. What do you mean? I don't have to But it's my thought I thought it like I feel it. How do I not reason why how can I how what are you telling me? But in a way just like you said if I was doing that to you, you'd probably hang up the call You wouldn't want to listen to that And and why is it so easy for us to look at other people who are just Expressing what's in their own heads and say He doesn't know what he's talking about.  She's fake.  It's just there and we think it's us because it's talking in our voice And I started to just sense that oh, no, that's not me I would never want to talk to myself that way and just kind of seeing that So I think and it's good It's sometimes just you're right being aware of it And I find that people when they finally grasp the concept of oh, wait a minute is my thoughts that are fueling this It's not so and then they get for at least my audience winds up in that cycle Where there might be a sensation and then the thoughts lead to more sensations Which leads to more thoughts of her and it feeds right so that that's kind of horrible And when they start to understand that like oh, I can I can have a thought Like you don't try and stop them. You can't ever stop them and there's a ton of research this thought suppression does not work Um, in fact, somebody who just was a kim quinland I remember he was posting a lot about that on instagram the other day, but anyway, um, you're gonna have the thoughts It's okay to have the thought the problem is what happens after that thought comes initially So that thought that says I didn't get anything done today. I'm screwed like for instance or the thought that says What was that was that a skipped heartbeat? Am I dying either way to the same thought right? So you have it what comes next? What's the difference? You know, what's the difference between letting that thought run away with you and not so what did you change? Well, you know, that's really interesting because as soon as I started to get on to this as I was recovering Related to to anxiety thoughts Yes, the flashbacks and symptoms. Yeah as I started to realize. Okay. We'll use anxiety as an example I would start to see myself, you know, this guy Oh, you know, that's gonna happen or this or that don't do that and I was on to it I was on to it And what I did was instead of really engaging with it I knew that if I would engage with it and go with it. I knew exactly what would happen Right the more anxious And I also knew that if I would start to want to do something with it because like you said, we don't change our thoughts I agree. I don't go there But if a lot of people do a lot of people think they have to do something. Oh, I'm having an anxious thought Okay. Well, I'm happy now or I'm gonna make a positive or right That's not helpful either. No keeps it keeps it going.  I don't this is self affirmations. I have to tell myself. I'm okay. I have to talk myself down I have to calm myself down. No, you don't like you don't have to calm yourself down Like and you will calm down if you decide just to say, oh, I just had a thought that maybe I'm having a stroke And really all that's happening right now is I'm thinking so the only accurate description of what's happening right now is all I'm thinking Done story is over. You don't have to engage and try and do what you said. We're gonna change it I'm gonna make it positive. I'm gonna visualize Because you never win It does Yeah Chattertooth guy always wins. Yeah, he never he never runs out of energy to do that Right So you asked me and so that is what happened with me and as I started to understand that I know what's going to happen If I go with that and I don't want to feel that Started doing it less and less and you know, it we've been doing this forever So it's not going to change instantly, but it does start with awareness watch See that it's happening and you know see that if you're not engaged with it Yeah, and I think some of it, you know to put it back more into your arena I mean I could relate it to people who will experience what they will continually argue Are impossible to ignore thoughts because this thought is so scary That you can't your what you're telling me doesn't apply because this thought is really scary Oh, your thoughts are scary, but this one's really scary And I think you might you know, that same might apply to you know Kind of those flashbacks to these experiences that people have had in their past Like how like I can't possibly but but what what I get is oh, yeah, that makes all kinds of sense But what happens when I think this what am I supposed to do with that? And the answer is always the same right you you keep doing the same thing I saw I don't know if that makes sense. So do you treat For instance in that ptsd or trauma background The the stress or anxiety over not finishing to do list And the stressing or anxiety over thinking about something terrible that happened to you literally happened to you 15 years ago same thing no like In a in a way, do you get it? You're gonna not react to that the same way. Am I correct? Like even yeah, right? So it doesn't matter what what you're thinking what you can be thinking the very worst thing or have the worst memory It's still the same scenario Yeah, when you start to have insight of what's really going on Because I mean before I knew all this I used to tell myself. Oh, I'm safe. I'm safe. I'm safe and it's nothing Yeah, I didn't feel safe But when I started to understand that oh You know, this is completely normal. I am having a Thought right and or a memory. It's coming to life. Therefore. I'm going to feel it, but It's designed to move through me I don't have to get in there and say okay, so I got to figure out What am I going to do with this? What I have to twist it and make it It's just we'll feel it and it wants to move through and it always does I mean, we've had so many thoughts during the day that we don't even remember why because they move through Correct, but when it's a it's a Thought that's a little bit more challenging whether it's an anxious thought that we're scared of all I got to drive here That's gonna happen or you know a symptom and we want to do something with it We you know, suddenly we keep it stuck and yeah Blow through because yeah, we have to do something with it. One of the greatest things I ever heard Was the first introduction that ever had to you we we sort of somehow connected on I don't remember how that happened And you sent me a video and said watch this interview that I did with I can't remember the woman's name it was a video interview adult this person and you I was I was out for a walk up with my dog and I was listening in the headphones and you said I you spent years and years and years thinking about Well, I'd have this thought and then I would have to think well I have to get to my therapist and process it I must I have to process this like many years of like I gotta do something I gotta process this now until you discover like no, I don't like You know and this is not to say that the past or your thoughts simply don't matter they do But they don't require All your attention and all your energy All the time I just want to say and I have to be careful because Really important to me and that is that people who have had trauma significant trauma. Yes Child which repeated trauma. Yes. There is you know, I don't just go into oh, it's your thoughts and oh, no We start with being a compassionate witness What happened was really horrible.  That's what happened They would come and they would come and then I would engage with them and run to this therapist to run to that But when I started to understand really the mechanism What's going on? I just felt a lot safer. Yeah, I would agree with you 100% I I I'm with you on that. You're right. You can't just say oh, it's just your thoughts forget it move on That's not that's not okay Yeah, but I think people tend maybe to get stuck and I got maybe out of my lane a little bit here But people seem to sometimes get stuck thinking That trauma or those past events is them like that is them like I must There's some requirement to carry it cloak myself in it engage with it process it suffer it Somehow that's required So there's a happy medium between processing it and understanding and gaining perspective or peace or closure And and cloaking yourself in it. I'm gonna say Yeah, and also something you said I was thinking about it actually and that is that you know You could use the example of our thoughts, you know people saying oh, you are not your thoughts So I thought about um, you know people for example would say I have PTSD or I have anxiety and how they would Say that is because this is their experience of life. I PTSD and when someone said hi, how are you in my head? I wanted to say fine PTSD How are you? You know kind of thing because that's what it felt like, right? Okay. Yeah, but but but Here's this thing that really showed me that PTSD is not me How do I know it's not me and my identity? Because now that i'm on the other side and I don't have the symptoms So who am I now? Right, right Who am I now therefore I was never PTSD and even people who are experiencing symptoms of PTSD or anxiety That is not who you are. Yeah Thoughts behaviors beliefs that are showing up. It's your psychology But it's up here. It's not you and it can move through Experiences move through us But they're not us. It's a very important thing to know I think you're right And so finding that balance between having to deal with maybe this past trauma or deal with whatever thoughts are producing your anxiety You have to do it at some point, but you you don't have to be dragged around while it happens I think and it doesn't have to become a lifelong thing You know and it and it brings up it's a little bit on the topic that we're talking about now We could do another one about this I think but like you said well now you're on the other side So you're beyond it now It's still a part of you and part of your past that you probably honor and in some ways respect because it makes you the monique I know today to a certain extent but I think I know people with the anxiety disorder problems as they begin to recover and get out of it They find themselves in this foreign place Like um now what what am I now? What do I do now? What do I want to do? I mean I'm not dealing with this all the time Now life becomes a blank slate and that could sometimes be Disturbing to people right or intimidating Yes, sure. Yeah. Yeah. Yeah, because what you're doing is You're uncovering Who you really are. Yeah, and in a way it's fantastic because you get to decide, you know, what do I like? What am I interested in? Yeah, I want to do It's very exciting. It is very exciting and it's it's an Yeah, it's also to some people. I think stressful possibly even anxiety producing. It's it's a little bit terrifying Like what do I do now now that I don't have to recover anymore now? What do I do? Yeah, yeah, I I've heard people say Um that I work with that. It's not a lot of quite a lot quieter in here Very scary because they're used to so much noise and suddenly it's quieter And that like you said it can be kind of like uncomfortable like yeah, you know and I said Yeah, imagine that I know it's amazing, right? So I think you know to bring it back and that thing that says okay, you can learn and and I say this all the time Like just because you have you can learn how not to be dragged around by your thoughts These are skills that you can learn be taught and practice So it has nothing to do with just brute forcing them Stuffing them blocking them out wrestling them into positive things. These are actual skills I mean so I talk about meditation and focus skills and mindfulness skills I'm guessing you may Use the same sort of tools. I don't know. I don't you don't okay I don't any tools big big revelation because what I find is that as I am sharing with my clients They start to naturally fall into this kind of not a state of meditation, but just a lot more space They get introduced to peace more easily, you know, because when this quiet's down What's left? That's so interesting. I would like to think that I'm reasonably sure that my people Probably have the same experience, but what I get asked continuously Okay, I understand everything you're saying, but how do I do that? How do I not follow my thoughts? I know The how do I do that and to me, you know saying well, look you can learn focus techniques You can learn meditation techniques breathing relaxation. These are not shields or cures But they can at least help you change the way You let your brain operate to a certain extent But I do I do think that just accepting this to be true Is is maybe 40 to 50 percent of the battle. Yeah, I agree. Yeah. Yeah. Yeah, so So good. What else do we want to talk about? I wanted to show you my now I should we share this like in one of our One of our first uh taping. I want to yes The snow globe again. Yes, maybe for those who have never seen it Remember when I first saw it just it was a good illustration of how it works with with our thoughts So I like to call it a thought storm So a stop a thought storm is when we've got so much on our mind You know, like 15 things on our mind floating around and of course when that's happening We're feeling it and oftentimes we think we need to do something with it So we'll get in there and say, okay. Well, I'll grab my list and all you know, whatever it is We're trying to manage all those things that are in the thought storm, right? And What happens naturally without And getting involved is that when we don't Get involved Try to get in there, which I feel keeps it going keeps it going. It naturally wants to Move through or calm down or settle down. It always does right is an example So this is a snow globe. It's my daughter that says yay Yeah, yeah And so okay, so this is gonna be an example of a thought storm. So I'm gonna shake it up Right, let me shake it up and you see these are our thoughts a thought storm What happens when you leave it alone? Can you see that? Yeah, sure. I can see it. Yeah, so they naturally settle down And that's what happens when we don't get in there when yeah, but I know that naturally We'll just settle down That's true and the shaking Is the is the engaging Right, so when you're engaging and arguing and I gotta think about this. I have to carry this with me at the Yeah, I've heard people say things like, you know schedule time to do it. That's a technique I've heard people say, you know, I give you 10 from 6 p.m. To 6 20 p.m. Tonight This is when I will sit and and worry about my stuff. I don't know what I think about that I don't know either. Yeah, I don't know either. Did I ever tell you that story? No Oh my gosh in my Search for help there was this something on I think it was Facebook or whatever And it said that if you do this particular activity, which was a I think it was a personal inventory Yeah, you will be healed of your anxiety and your it worked. Yeah Oh, so I'm in for it.  Well, I did that Every single fear did it day one did it day two by day three.  He said stop doing it So that was a really good lesson in that what I how I see it now is that I was basically writing out all my fear putting them on Then they were Within me floating through my mind. They were coming to life. Yeah Not necessary Well, you went that active because it's so funny write down your fears whether you're writing them type into whatever When we want to learn new things we're studying for an exam We people will always say write it down write note cards Because it is literally the best way we have to build those neural pathways So you are literally studying your fear by doing that like it's the best learning we have That's crazy in a way when you think about that. I was building new pathways. Thank you very much Along those lines. It's so interesting.  Well for some people not so much Yeah, and you're a living proof of like, yeah, maybe maybe not maybe don't do that Yeah, yeah, I mean I find now that I understand that our thinking comes to life Yes, I'm going to be thinking about my greatest fears. Well, I'm going to be feeling my greatest fears. No, thanks Yeah, what why right exactly especially if they've proven to be irrational and baseless to a certain extent I get that so I think probably that practice I mean, it's supposed to let you understand that they're irrational and baseless, but I don't know. Anyway, um, all right, we've gone for like 25 minutes here. That's that's a bit of a while so anything else to add or Well, the only thing I can say is I just want to repeat that we are always living in the feeling of our thinking moment to moment And that you are you really are safe that what you're experiencing Your you know is normal and with understanding and gentleness and self-compassion Okay, you are okay Yeah, I will I guess cap it off by saying in the most simplest terms. This is my way You do not have to honor every freaking thought you have every moment of the day It is perfectly okay to think something terribly scary disturbing and then turn away from it And think something else or nothing Like those are all acceptable things and I think the sooner we accept that to be More of a natural reality for a healthy human being probably the better off it's gonna be Because when it's very good what you're saying because when you turn away from it Another thought pops in your mind. You're gonna have a completely different experience. Exactly. That's exactly right And maybe that thought is one you want to turn away from too. There's also nothing wrong with repeating that process People they keep coming. Okay. So do that 10,000 times in the next hour if you must You will learn the skill and it will become easier and easier and easier and easier. So That's I think all I can add like this is so doable. It's so doable even though it sounds crazy to a lot of people So Anyway, all right. Awesome. Well, thanks for taking the time as always more time than people even know because of our little technical snafus And uh, let's let's mention this. So maybe when we hang up we're talking about instagram for a second People should yeah, so monika's you have a great instagram account. I love your instagram account So where do people find you? I will link it anyway. Oh, okay. Uh, it's um, so it's called cptsd.cover.coach Yes, and it's a great great great feed and there's all kinds of gems in there. So We I you know my instagram account is that underscore anxiety underscore guy I had to put the underscores and go figure. So we aren't talking about doing some instagram live video too, right? So if you guys are watching I will link us both there and all of your I'll put all your links in your instagram your website your facebook also and That's the podcast. You have a great podcast. Yes. Um But if you start at monika and coaching correct, that's has pretty much everything in it. That's where you are Yeah, that's right. Very cool. But uh, yeah, so maybe we'll do a little instagram as soon as we hang up here We'll try that little experiment. So look for us there fun. Yeah, very good. All right. I guess we'll see you guys next time Thank you monique. Bye. Thank you. Bye. See you less awkward moment, but still awkward ready. Here we go