So Thanks for being here for the last session of the safety critical software summit It's not that still a bunch of audience is here on a Friday afternoon. It's not too big like us so Yeah, before I jump in Normally I have a short shout out to my employer, which was We're not yet there. Not good enough. Okay, but I do it like this. This is better We take it in this way. Okay. So first of all is short shout out to my employer, so I'm at Bosch and I want to Say thanks because I'm working in an embedded Linux IoT project Well, we make use of a bunch of open source projects So I say once thanks to all the communities which making this possible and also thanks for Bosch for sending me here That I'm able to talk about some parts of my work what we do with all these projects is like we're bringing them in very different product areas and I also like to highlight this because not everybody is aware What Bosch is all about so something about the fridge or other parts some bought the automotive But we really go into very very different areas and all of these areas include Linux and Some of them also in safety critical context. Some of them have to run for 10 15 years and so on so long lifetime And yeah, though this also makes it attractive for us to work with Elisa and to give a few words about me, so I'm Philip I'm on this you could already see I am currently technical business development manager and It's a long title, but basically I take care that more Bosch engineers Can work on open source get in touch with open source that open source gets spread inside Bosch and try to foster Collaboration with communities inside Bosch and so on besides that. I'm the technical steering committee chair of the Elisa project So that's also why I try to place some update or outlook session and more generic part on this Not a lot. I just came from a Linux meeting But there's the Linux Foundation Europe advisory board where I'm also a member in Linux Foundation Europe founded last year during the last embedded open source summit or open source summit in Dublin. That's where I'm also a member Generally on Linux. I started my Linux journey not as early as some others Which may sit here just other on 2005 six time frame where I was setting up Linux PCs for exchange students and when I was studying in Sweden, they couldn't afford their own Laptop cat didn't have a notebook or so So we used old PCs from the university and brought them to the students so that they had something To serve and work from home at this time and we did this on a Ubuntu 610. I guess Right for automotive perspective That's a little more than 12 years. We brought Linux into the car with infotainment devices navigation device at first was a 2.628 kernel I guess Was nothing about secure boot at this time, right? So if you if you search good enough, you will find how to hack these devices these days It's different and we take a lot of care of this. I Put the apparatus on this is our district But it's not the one which is in the system at this point of time where to plain yoke to usage at this And now we come to the real topic the aliza things and I start typically was a little bit of disclaimer Saying what is Linux in safety critical systems? If you see some other slides I have seen a session before it's basically the house keeping things for aliza So to always mention it and what I want to shout out here is that if you see and look into system And whether to sass if a system is safe, this means you need to require the system sufficiently And in this system you may find a Linux part of it so the Linux itself is not the full system as you may judge by just in the system context of a wider system and You need to understand how this Linux system was part of the system is used in there And by this you will see there are certain parts which may be relevant Others are not so you need to like select which Linux components and Features are there and which are safety relevant which may not be safety relevant Which is the core of all the activities and when you look at this. I'm pretty sure we will identify Gaps because if there wouldn't be gaps for Linux and use in safety criticism system, we would have already done it What's makes it hard for Linux is that it differs quite a lot from traditional Safety critical operating system traditional safety critical operating system will be certified it was taken one subversion it comes with a very small food print It fulfills a lot of standards. It may have hard real-time capabilities The real time is making a good step forward not everybody says it's hard real-time and I agree So the Linux kernel are cheap. I just will not guarantee hard real-time in any case, but we have real-time in there But the traditional systems also face some challenges if we see a coming from automotive background We have these software defined vehicle environments if you like the word or not, but still it will happen that you have virtualization involved containers Arches next to each other multiple VMs running and if you want to put all this only with the certified arches You may have hard times and even just bringing art using an arches and hyper by then there to Scale on high performance computers It may be that your safety safety certified as which was prepared for chip environment ten years back Does not fulfill your memory demands your cash demand and all other things So you will face a lot of challenges and suddenly Linux becomes very attractive because you have a rich ecosystem You have strong community support. You will find drivers. You can discuss things open but you have to take the challenge of Well get somehow to a point of certification getting it robust and reliable enough and that's where we work in Elisa and to say this clear. We are not Safety certifying a Linux. We want to enable others To with the right tools and so we seal in the mission shortly to enable then so I come with Like the legal disclaimer. We have collaboration is a password collaboration, but we also have Things we cannot do and the things we cannot do is like well We don't make your system safe because we don't know your system Why you have your use case of mind you have your obligations You need to see where to use it and if I take it like a security part You need to if one security perspective on Linux kernel if you have C groups name spaces other things in there You need to know how to configure it just because it's in there. It doesn't mean that the feature is used properly and When we describe processes guidelines and so on that's also something that you have to take care on on your own We cannot directly because we deliver something to the open where we don't get any or sometimes not any feedback on this back We will not have an out-of-three module We are straightly try to keep up with the mainline speed because there are continuous improvements This may be a breach to the traditional way of thinking about safety about certification But there are so many things going better and just because they are more boxed in this kernel than in a 4.14 It doesn't mean that the 4.14 kernel is better than the one now Yeah, and you remain responsible for a lot of things Nevertheless, we find enough partners even if we have this limitations which support us in this mission Which bring things in and we have some premium members Which are like from aerospace recently, but also redhead was really strong and driving activities so also redhead in vehicle as a lot of automotive parts in there and Spread all over the world. We get a little bit of associate members This basically mean they don't pay for the membership, but they support us in the one or the other way Like for automotive grid Linux We have collaboration on the use cases we use some of their work and also with CIP Which has long-time support stability robustness we all cooperate to certain extent with them as well Osada is mentioned because of the history. There was a still to Linux MP project in there And at least I basically continued this with a little bit chain scope, but the idea remains right all the different members subscribe to a mission and This mission basically concentrate on the element processes tools documentation to make it amenable for Safety certification, so we make life easier than we get things forward. We do this by said of horizontal working groups The safety architecture basically looks into the Linux kernel So more deeply looks at the subsystems whole subsystems are interoperating and so on try to understand how Linux is used for use cases and This is a wide approach not very bound to use cases sometimes was a use case focus and in a similar part There's also the Linux features work group and I mentioned the part of example with C group namespaces And so on this group really tries to figure out what is there what could be Supporting features for safety was in the Linux system or what could be something which breaks with safety So if you switch this on or off or configured in the wrong way This could harm or benefit for safety, but it still remains on the product which you build And you will bring expertise as an integrator to just bring this in The tool investigation code improvement work group has a little bit different focus. It's the smallest group more or less and they set up Some tools like syscaller code checker and so on run it on the kernel It could benefit from a little bit more Contribution use case focus so we if someone thinks you're very good in tools reach out to me later So here we are really actively looking for a larger path in there And yeah, the old set open source engineering process This is more really on the process side like how can you argue? Things how which analysis tools are possible within the Linux kernel We use heavily the system theoretic process analysis There was a raffia talk from coding this morning, which also goes in this direction my portrait would he presented the work Yeah, and the last is the systems work group. That's where which is the group which I'm leading also here We try to bring all the different pieces together So we put the things into a system and into a system context which fits into the original mission which we had so to say here's something you need to understand the system context and Normally this would be something which you put in a safety element out of context If you take the automotive language, which means you have something which is not in context But it doesn't work whenever you have an out-of-context you always have an assumed context our assumed contacts Are prepared by verticals There's the newly founded aerospace work group. They don't have the use case yet They just align with partners looking for members try to see where's linux already news find commonalities Before they really drive into use case and they're really open for everything from their thing From drones or so up to going into space passenger flights and so on Automotive you see the AGL old style instrument cluster in there That's where we base on in the automotive work group We work on the little danger sign there to look for warning signs tell tales and see that they operate properly That's our main use case. That's also what the architecture work group puts up and the second one in there is the Open APS This is from the medical device work group. It's a very nice one. It's an open artificial pantry system This was developed in the open. It uses standard components, but as the control of insulin is a very critical sensitive sim and highly safety regulated in the field of medical these equipments are very expensive and Many people suffer from it that they don't kind of force such a system because of the High amount of cost for the certification. So what someone came up with was Dana Lewis. She put in a raspberry pi in the middle and Let's script run on it and this script controls basically the insulin pump and the glucose monitor things And by this she gets a much better work or better much better live quality So she she was telling about improved sleeping quality because she's not waking up by an alarm at night and so on and Here the nice thing is is really that everything is in the open We could do analysis we had outreach to community and this is a bit different to automotive Which is more a clocked and closed space Still as we were talking about the system before if we see a typical architecture. It's not that every Element fits into all the parts. So mainly these two use cases Which you have seen are in this more reddish middle part about the Linux and we need to see how we get it further and Here also then the architecture work the features were combining the kernel the code improvement also in their Tools engineering process will more or more on the surroundings of it It's for the whole system environment fits into every scale and the use case just basically tailor her whole system We do this work also in collaboration with other communities, which is quite cool So we reached out to Xen and sapphire community because both have a safety critical pass They have same challenges. They have different challenges But at least it's a good room for collaboration because the room of open source and safety is a little limited Especially for the automotive part. We see that the architectures are repeating and Sophie eclipse SDV Have also architectures which have of contain involvement virtualization wolf and are taught in there So we want to reach out to them as well and we reach out already and we have also related communities like the Octo project Which participate in the work? We have a special interest group for it was an SPDX for safety so The call is working on it. She's here Kate also and we also reached out to in our already because also here a lot of the I make a secret just fits in and it always remained the idea of yeah, I Like this if you have an apple I have an apple if we change apple then we still both have one apple But if you change an next idea and with me and I have an idea changing with you Then we both have two ideas, right? So that's basically the overall concept of this collaboration to just get a knowledge spread get a wider open All these things and we bring this into artifacts These artifacts are split into various elements is based on the mission. We have elements processes tools software parts the working groups Work with different extent on the set of different areas So not everybody works on processes because it's more generic thing and not every working group need to go in there But we also have a bunch of activities and The meter Eliza, I will shortly mention the rate of status which we have About the reproducible system. I give you a short insight also workload tracing which has been recently upstreamed and the latest activities arts of Linux Other things are the STP and all those code checker Cultury and if you want to know about this just check the Eliza YouTube channel For example, then you will find all recordings and get more insight on this All this is also documented So it's on github gdocs and in this presentation there are clickable links So you just if you download them you can click on them and should be guided to the different I first Few words about the automotive part just that you hooked up from the use case. We've selected this warning signs of an instrument cluster which could be the air bake sign or Oil pressure and so on because it was a nice and simple use case, but complex enough to put it under analysis It has for example less real-time constraints and it's easily reproducible. You can make a simulation out of it so this is where we started and Therefore we had an extension which is Still a work in progress. So there's the meter Eliza layer. It's not integrated into a GL. We maintain it locally in our github We share regular with a GL folks but it's more there and this is like seen as a demo set up Where we can improve where we can trace workloads and so on this Was always a challenge for us to prove this and get this forward to different working groups So or for just also for people joining newly So for this work, we really come to a flow where You can either start from a plain document taking a step-by-step guide forward Or if they I go with a document rather than building things a full yacht on my own I can either enable it as state or not. I can even take a pre-made image of the QEMO and just boot a QEMO and But this you can see and play around with the potential system This is made in a very dependable way, which means Each step of this queue depends on the previous one. So the docker file depends on the github documentation It's creating the image the git lab pulled the image which in the end means Wherever there's some break in this queue. There would be an issue. We would see it and can trace it back to its origin and We see for example the git lab See I more like being a user through the steps, which are in the github are basically the steps Which are documented and pulls so we hope by this we get more stable on the things But this was all QEMO and I said something about the reference system This is something where it comes to real hardware So we want to bring the work onto reference hardware and for those who have been there on Wednesday there was Talk by Thomas colleague of mine and me. We were talking about our setup with Xen Zafire and Linux We currently bring it on the Xilinx XU. We tried with renaissance before And the idea is really that you can use a git hub Documentation later on get all the artifacts build artifacts download the things and reproduce something on your own the XU hardware is Quite expensive. So therefore we still look for an alternative in there We have basically selected this hardware as the reference because of a good community support within the Xen community and We will work on this first of all forward until someone comes with a better board because the idea is really to figure out Something where I have at least two hardware. I have two different kind of Linux and they're like it's mentioned The pita Linux and a purchase, but we also have Agl considered so we at least have a yok to an a devion version in there later on since we're conservation and we start with Zafire, but we're also looking for an alternative artist so that you get a skeleton at the end where you can put whatever feature you develop Into context let it be safety or not such as you just have something to learn about right So if you missed this on Wednesday the slides already online and they can you can access the recordings So take the chance. It was quite good presentation, which Thomas did there The other thing which I'm very proud of is that we have from the medical devices where the sdp I was done it reached to a certain level So it's more like a systematic approach drawing some boxes and then at some point of time the group figured out Oh, we don't get deep enough into this topic We need to understand what's really happened in the subsystems of the Linux kernel how things are how does it work? look like and they're Sure and Alice did a great job of upstreaming later on this documentation. I think was also she finally she did this She wasn't meant he was in the Lisa project and dated upstreaming of This guidelines into the user and admin guide That's something which really tried to do more that you as potential user awful in a system in safety criticality can Make use of these kind of things the upstream part is more than the generic case with stretch and G while The work of the record of course goes on the low level of the real workload use case the continuation of this for the Linux features work group also here in cooperation between Ilana. She's leading the work group and Sure and some other members of color work group To bring more RT documentation upstream because we see that the RT patches get mainline It's close to all being done, but How do you really use it hard what to do what to avoid what not to do? What could cause problems? This is really documentation which is needed and they therefore have all the presentation this morning Maybe a bunch of you have attended if not all their slides again later on and your recordings and here They look into various kind of updates, and this is really achievement which will go on and end up then in the kernel documentation But we also have upcoming this is quite an eye thing is the usage of Yachto all Linux in aerospace So Boeing was presenting some work during the open source summon of America in May and as we had so great feedback on this and Large audience there was a request to also have an extension of this presentation So we plan in the middle of July a webinar So dates Maybe around the 18th of July, but there is no direct invitation or QR code, which I could share here I know so maybe watch out the Lisa social or the mailing list So it will be all announced there. So we'll make some promotion when it's there somewhere in the next weeks right and Yeah, like a pre-check you can just search on YouTube to find the recording of it there old recordings Or all life. It's a very nice one to see also how Linux gets some responsibility in aerospace Although it's mainly not on a full safety level. It's more on the lower level of these standards rights Another thing which comes which is not mentioned here. I guess this goes more towards September. We will also have Neighbor community webinar so to say so we will have some parts of the extent project also in this explaining their past our safety How they deal with misra how? their work differs from what we are doing how the virtualization environment differs from the plain Linux. So this is something which will come up in September again here watch out To see it coming. Yeah One latest news, I guess that's a really new slide which are Nobody most likely has seen because I've just prepared a last beginning of the week So there I know there was the deadline to submit everything on Monday, right? This slide came in a little bit later We had a workshop in Berlin Last week was a bunch of new participants new companies in there And this was a really great chance to discuss where should the project go? Which problems do we have where do we see challenges and One point which was mentioned that we want to concentrate on the core of the core How I call it so we know everybody has a Linux kernel, but everybody configures it in a different way Still there are similarities in almost every system and we want to go on and see what are these core components of A kernel which all have in common because there is most likely a strong safety criticality in there then From our mission you can see that there's elements processes and tools But we also want to phrase a little bit clear what this means. We don't have a good name for this yet So if you're coming in automotive space, you know, maybe about a safety manual which gives you an instruction on how to use your System and we cannot write a safety manual So it's a question if it's an unsafety manual or a safety how to or whatever by at least what should go in there It's like what are certain Issues in there. What are certain capabilities? What do we have to consider so that you get? Most likely it starts with a little bit of input and then it grows over the time that you get a guide document Which helps you in understanding the usage of Linux and I'm pretty sure a bunch of this will also be in the user and admin guide then so these are both related and What we also figured out that we will work better on our big picture document the big picture document should help all Those which are in the community to judge if the work fits So if we're doing in the right direction, but also for those joining newly to the project To find a part of what is really safety critical part and what is the ELISA project just doing To get operating. So for example, we need to do certain processes in order to have good Reviews guidelines and so on internally But this is nothing which you would need to care of as an integrator or a provider of the system because you will bring your own processes and There are other things which you may want to use like our analysis techniques But also this you may bring instead of an SDPA and FME a FTA whatever is your preferred method And we want to clearly differentiate this and say these are the core parts of it. This is really from the kernel part This is how we differ from Sapphire from sand for example, this is what we have in common with the other communities This will be in a big picture document because a lot of the people were asking for having it and in order to Prepare this also. We see that it's very good to interact with the other we Decided because we had as TV involvement in there and a little bit of Sophie involvement in the workshop as well So it looks as TV and Sophie we will take a meeting together with a GL and also line more on the work of systems Workgroup that elements from the systems workgroup get into the project and that the other project bring in value in there So that we're not all reinventing the wheel or it was the outcomes from the Berlin workshop as key takeaways We have some more activities going on What's in there? For example, is the s-bomb generation for Linux? We have enabled already the s-bomb Generations so in our CI setup, which I mentioned earlier for the automotive use case where Sudeep was doing a very great job. So Thanks a lot Sudeep or We will continue with it because it's not Linux in the system And we know that system bill often or suffer bill of material and the system bill of material is very important We want to get this in there and see how does it work with that fire? How does it work with send? How do we get the things together really properly automatically generated? Then we have this reproduction of sense effort Linux But it's not in a state that it's really robust and that you can have it in a github PR We have a github PR for the renaissance one, but we most likely don't get it into a CI at the end we want to get a first on the exo further and then have see a comparison of both guides how things go on Therefore the documentation is something which will come up in the next months directly Was once as this achieved also the s-bomb part will move on. So basically the orders swapped here It should be moving on from a pita Linux from just a Linux to really have all the chance to exchange your Linux into the preferred version of Linux So that you can say I'll say I'm a Davian guy or I'm an yok2 guy Or I would like to go in between with some part of one or the other But at least the system should work with all of them and also this opens new domains because the Agl and apparatus are more in the automotive space while Cip is in the civil infrastructure and as a leader is also cooperating with these With this project in LF we want to see that we also get their Linux in there Here always the topic you cannot mention often off at the upstream part the upstream work because we want to get as many things upstream as Possible and to increase the documentation. So we see that this is really demand there. There's a lot of improvement possible Here and I guess the last Point was all that we need to improve our internal development process We have a lot of things written down, but they are not really structured their cross tracing is missing and especially for onboarding new people We got quite a bunch of new people joining the working groups. They ask questions. We see repeating questions So we know okay, let's see here How do we align that we have really a streamlined process and that people have an idea way into the community Right by this these were the main activities. I can say we have a bunch to subscribe So we have the mailing list We have weekly meetings or by our fortnightly meetings. They are all open So as soon as you subscribe you get the invitation even the technical steering committee meeting is completely open But you can also bring a concerns discussion points ask where to go best where to put your use case we also have the chance now to ask and Yeah, we I love to hear your questions because I Reach already the end a little bit earlier slightly ahead on time But this gives us more room to ask some questions Or get early into the weekend Okay, thank you. I have the microphone here. If you have any questions I'll pass the microphone to you. If there's no question. I have questions. I just want to ask who is from automotive in The room who brings an automotive background? That's of you. What about medical a Little less industrial We want to have more inputs from the industrial work group actually and we try to find to Found one because we see especially due to the RT patches getting in they're getting new use cases right where There's the first time and we can say oh, we don't need the artist anymore We could bring it in Linux and combine certain functionalities. So if you have a statement on this Let's say, okay. I have some use cases which I'm able to share or I have an interest I have a certain concern on this we treat things completely different though That's why we will never use a safety critical Linux or have no demand on this. It would be all interesting input because Yeah, so far we look in the IC650 or 8 and to ISO 26262 mainly as safety standards by no industrial also uses Understanders you may most likely share the same requirements and maybe not aware Maybe some things are different, but this is interesting typically requirements traceability design Implementation traceable use all the elephant all are the same and If you do a lot of things this helps at least so we also want to reach out to more Industrial actually the systems work group was intended to be industrial work group, but we put it on a wider footprint because there was not the quarrel and not the Yet the all we should say oh, yeah, let's have drivers from the industry industrial and support Who's already using Linux already? from the industrial space Yeah, it's much less so Maybe it's a good chance to give a little extra chance Anyway comes up with a question One in front Cool talk. Thank you. And you said you're generating s bombs. Yes. It's that using like Yachto's features Yeah, it's using the as pedigts inherits Or inherited as pedigts and as pedigts pretty and the report is on the git lab so you can all download the It on a daily base That's something which I haven't mentioned We delete the images every day, but you can just go to like the artifacts was in the git lab pain There's something to just download we keep it fresh So you get a fresh release every day So as soon as a new feature and you functionally gets in it thing You will experience and we also rebuilt Basically from scratch once a week if I'm correct that we also do the s-state. We don't do Every night. Yeah, we built every night But then we use the s-state and we cleaner the s-state the shared state every week because we said well Maybe something happens. So we want to also make sure it works still and The benefit of this we could already see and this may be nice to see We our CI did not broke actually but we did was detecting errors twice and One I think the one we've put back to a GL as an error and the second one was also Interesting because what everything was building the system was booting just the danger sign didn't show up because the certificate expired for the can stack This is something to keep in mind and this is something which you can experience This is the I am where it also makes sense to we come to a booting state doing test cases and we do this every night Then and it's not at all a safety critical Work which we have done or can be judged as safety critical at short show best practices on how to do it There's one also in the back and one and there Okay. Thank you for your talk You only asked about industrial. What about home and building automation? It's an interesting topic, right? I guess for home and building automation. They're also the hobby projects in there, right? Actually fire safety. Yeah, it's our industry fire safety. Yeah. Yes Yeah, but I guess I don't do you make use of Linux already? Yes. We use your go. Oh, cool And you're do you have certain you but do you have use really safe the integrity center? Or do you have actually also safety standard which tell you what? Conditions your system has to work on I know this for twice for example, they say don't work basically both we have like our own European standard the EN 54 but for on an international escape. We also do safety integrity level So for example for fire safety, usually you have sills we so we need to comply Yeah, and you comply with this work completely worse Linux or you have additional elements in the mind currently we have like also other elements which are compliant and Linux yachter Linux is just basically our Cloud connectivity right by ourselves, but it would be nice to have like everything on Linux Yeah, I think it's it and this also shows like there's a way of You have a heterogeneous system with other things involved and linux is part of it So it shows basically what we draw with the architecture and maybe also how you can get more responsibility to the system Like say if you enhance feature reduce complexity by getting certain things out There so it's a very good use case if you want to discuss more Feel free. I guess I was another one a little bit more back. I Don't know where was yeah, I can Comment on the previous one for homes and passage systems I've done work with the leading company for in Sweden for four years and Made them start the jocto and they've done a great job but for industry I work with I Won't mention it, but How they didn't want any security at all they didn't even want encryption on the devices Because it wasn't connected to the internet. How do you make them realize that? I guess here. It's once at least one statement is we need to split between security and the safety part right because the security is the Like intrusion part The safety part goes more on where it could cause harm to people Still I guess So within our use case, it's more like the people are concerned that Linux is not safe enough yet to go and take over certain Responsibility especially for complex use cases, but I think you bring a very good point because this is something where you also need to Consider how your environment change and just to say well I don't care about all these kind of things because it's not in my primary use case You never know when someone connect the USB printer to the router and it gets suddenly and post to the internet because you just have an open Connection in the router because there's some firmware mismatch and so when you get Suddenly your spam may it comes out of the printer. I get there are some prominent examples if you shut the web So this is something to consider as well And I guess it's just making it public making things visible and point to these kind of things and say there are Examples which show exactly this and that's where we came from right ten years back when we did our first device in infotainment and from Bosch site there was not that high view on Security and we were not connected at all. It was just the device But someone put the device out found the pins hacked the whole thing and was sharing this report on github to show Okay here. I can get into the root shell. I Said very good. You had it a lot of effort actually cannot do this because all the relevant functionalities hooked with an Artus and as soon as you change and flush a new Linux, it doesn't work anymore, but that's another story And I have a meeting on Tuesday with the automotive Part company it's not Yeah, it's automotive and they already signaled that we don't need Safety or Cutting corners everyone So It really heavily depends also on the use case, right? So it depends which device you do and if you if you see our infotainment devices which have a review camera in there But normally you could say well the review camera is something safety critical because you need to see that the camera still operates If a person is standing in the back of the car a kid a child or whatever you could cause harm to the person Damaged a person Not only damage your car. That's just I guess is the least problem by what then come in this like argumentation This is not safety relevant for some people building it because they just make the stating I know a few have ever seen this some of you. Please always look in the mirror and Don't trust the camera. This is basically there to say I Have less responsibility for safety still even if it's mentioned like this It reduces the safety level but the quality which you have to do still there So for example, we build and mechanisms to still identify that the camera is working there to do what it should not with a 100 point zero zero zero percentage But to a sufficient amount and adding this as a safety belt like additional safety net for us to give just this information and so there could be even Some argumentation from other manufacturers say yeah the safety relevant others say it's not safe to run heavily depends on the use case It's really heavy equipment, especially the first way so it's It should be Critical if something goes wrong. Yeah Okay, we are the last minutes. We would have chance for one more question otherwise Which is close a session Thanks a lot to all of you staying until the end


All right, so you're recording now Dustin we are live. Yes, so let me do a quick intro to you Liz Yeah, and we'll go from there. Let me just get this set up here There you are I see you guys. Hey everybody, I'm Dustin here Dustin Schaefer here Can you got me Liz can you hear me? Yep, okay, cool for whatever reason I am Cool, I'm back On my phone is a little different. I was here in two people talk myself talk twice So y'all I want to cook you a little introduction. So this is our action zoom We do every Monday at 1 p.m. Eastern Standard Time and the idea of this zoom is is to Give people little steps that they can take through the day and the week to Move their business in the right direction and in the goal is they meet everybody with that what we know is that is that It's about consistent daily routine and habits that help us grow this business And sometimes what's interesting about things in life. You always know that they always come out of the blue when people go Sometimes I either believe in miracles or you think everything's a miracle. It's kind of like one way to look at it And I have this unique perspective that I just you know, I'm never surprised by who I might meet in 10 minutes Because you just got to be open to it all so the idea would be is if we can build daily routines and habits And this zoom is a place for us to do that if you're watching that live or replay Let us know your thoughts and feedback with that consistent pattern of Desire to have more so super super important and I have somebody on here. It's been super consistent for I mean five plus years Is it six years now? It's Liz Not yet. Not yet. Is it five? It's been five though, right? Oh, yeah five years Okay, I try to do the math in my head. I'm like, okay Um, and so she's been super consistent and very well She's gonna give you some of the amazing tools that she's been using to help Spread the word and create consistency For her to have success and and she hit me on these last week I was like, oh my this is so good that we got to share it to everybody So if you guys want to get it what's up Miguel if you guys want to get the little secrets to help Help the consistency of your business. Liz is gonna share I'm gonna hop in today too because I want to share a few perspectives based on what she said I've had a few days to think about it and before we kick off today's zoom Do me a huge favor put it in the chat. What's one big win that you've had over the last week for me I've had three brand new customer conversations in person and I've had a new promoter business conversation in person and that's a big step for me because I Have gotten kind of away from in person and that's where I'm the best is when I talk to people in face-to-face So I just wanted to you know throw it out there and say that that's my big win for today Is that's what I got for the week? Sorry, that's what I got to do But if you can put the chat put a win put a win that you have and then lastly Liz before you kick it off Can you just touch a little bit about the hubba call today with Michael Rutherford? He talked about something and you said it was such a good call Can you give maybe one one feedback of that call for you that connected with you and then we'll kick into the zoom Yeah, for sure. Thanks Dustin for those of you who don't know me I'm Liz and I am from London, Ontario, Canada So we are really further south and a lot of the US states just to let you know So we're having a really mild winter for Canada here Yeah, that call today with Michael. He was in he's in the Bahamas He was given an invite to go to the Bahamas and spend I don't I'm not sure how long on somebody's boat and he was talking about The billionaires that he's met while he was there and talking about the you know the boat and being on a yacht and Everybody a couple of people in the chat had said but what if being on that boat? What if having a yacht isn't my dream and if that's not something that speaks to me and so of course Mitch got on which is always a good person to listen to Mitch always has some amazing insight and shared is like basically What we need to do is find out what our yacht is per se It's not necessarily a yacht people were saying well Mine is living on a farm and having my own farm and having somebody that can clean the stalls for me so everybody's yacht is different and Just to remember that so that that was one of my biggest takeaways to because Yeah, I like to be I like to be around water not necessarily on the water Per se so yeah, it is it that was one of my biggest takeaways there There was a lot of takeaways So if you have an opportunity to watch the replay for that by all means if you did if you weren't on that call I would highly recommend that this is one that you really should go back and watch and Yeah, so I'm gonna start off today with one of the DMOs that I've been doing daily method of operations I'm sure everybody knows what a DMO is that I've been doing for well over a year now and What it is is going to the birthdays on my Facebook account each day and What I've found by doing that initially what I started doing is when I would get that message Every morning on Facebook that would tell me it was you know, so many somebody's birthday I would just go in and then send them. I would wish them happy birthday on their profile Then I changed that up and I would send them personal messages on Messenger I now often send voice messages to them But what I was finding is that as because I've had this DMO and I've been doing this for so long is I was finding some awkward moments because I would go to I would like for today Let's just use today for an example It didn't happen to me today because I've changed my I've changed my format and what I do But I would go and see somebody's birthday and if I went to send them a message or a voice message I would go on there and I'd see oh geez the last time I had a chat with this person on Messenger was their birthday last year So I was starting to feel awkward by sending another birthday message to them and here I haven't even had a conversation with them in 12 months So what I do now is if you're all familiar with the birthdays on Facebook If you're not let me know and I can guide you through that super quick, but it what I do now is I Will wait until the day after their birthday that gives now their the hype of all their birthday is gone and now somebody is still Reaching out to them about their birthday but what I will also do now is I will go through to see who has birthdays coming up and Sometimes I will give myself. I'll actually put my phone on a timer and give myself if I have 20 minutes I'll give myself 20 minutes to work on this and I'll go through the people that have birthdays coming up within the next 30 days and start a conversation with them now so When I do go to send them a message when it is their birthday 30 days from now It doesn't seem so awkward with them and again when another thing about Creating having those messages when you the more interaction you have with people through Messenger I think they're more prone to see your any posts that you're going to be making So hopefully you're consistent with your Facebook posts all the time too now this is this can Obviously, you don't have this birthday method or dmo that you can use if your preferred platform is Instagram That's not going to work I'm kind of just talking about Facebook here And I think I have found it myself anyway in the last 12 months that Facebook has really started to pick back up again So it's I think it's a platform that you don't want to let go of So that is one the other thing is creating interactive posts The now you've got all these messages with these people. They're more inclined to see your posts and What I'm finding is that if I just pop up a question on a post where you just you know, put the blue background or pink Background without a picture. I see Alicia is not in her head. So she knows what I'm talking about. Thanks so what happens I'm finding with those interactive posts that I'm getting a lot more engagement now and It's I think it's good to make it a post where people can one offer their opinion people like to be able to offer their opinions and also Where people can recognize or give themselves a shout out for their own accomplishments. So one post that I made was who has successfully quit smoking and for how long That generated 146 comments on my post now Some of those comments were mine where I was giving them like a, you know, celebrating them and congratulating them on their their achievement But I find that people really really do like to be recognized for their accomplishments and also to give themselves a shout out. So that's an opportunity When I go through and I look at some of my Facebook posts. Those are the ones that get the most interaction And Jennifer Mann had a really good one as well. She put up a post because this is where Dustin was talking about the iPhone versus the Android. He's been pushing her to get her get an iPhone So she's been hesitant and she put a post up there and asked people for their opinions on whether she should get an iPhone or whether she should get an Android. And wow, she had I think I thought she had 126 comments on that and she had some really good conversations going on With regards to that whole question all on its own. So that's another one. So the other thing I do too is I go back and I look at other people's Other people's posts like other people within the Pruebic community like I'll look at Oh Dustin, did we lose you Dustin for a bit. Yeah, I'm back. I lost sounds. I had to leave and come back. I'm back. Okay, that's fine. So another thing that I do too. If you're stuck and you don't know what kind of what you want to put a post up there, but you're not sure which one to do I go like I'll look go and look at Katie Rollins's page and you know or go look at Mandy Mitchell or Anybody right for that and Dustin, I was telling him when I go on to my Facebook and I open up my Facebook app. And I go to the menu. He's in my top three. It's birthdays and then it's Pruebic and then it's Dustin Shaper. So I use Dustin's post a lot of time for inspiration on where to go. I won't copy exactly everything that he does, but I use that as an idea for sure. So It's completely okay to do that. The other thing is about those. We're going to talk about the guest call tonight. If anybody Do you guys all I think I'm seeing some familiar faces on here. So I think everybody might already have some Scripts, maybe that you can use yourself. If you don't, I can put them in the chat for you. I've got four lined up. I've got one For where you would send to your friends or family or customers who are already drinking cut ketones and are already on smart ship. Another one for people who you have never ever talking to ketones about. I don't know if there's anybody new on here. And people that have purchased trial packs from you, but have not yet created their own account.  So you want that one, Alicia. Yeah. Okay. I'll copy that and I put that in the chat. Now I'm not sure Dustin said he wanted to talk to somebody about he wanted to give a quick chat to all of us. Can you do. Can you do me a favor though. First, can you Can you because people on YouTube. I don't like can see the chat. Can you slowly each script so that if somebody's watching the replay, they can write it down. Yeah, for sure. Okay, I'm just going to copy and I did not know that I didn't even think of that it makes perfect sense though. So that's the one there for the So the one for people who will go with this one that I just put in the chat for people have dropped off of smart ship and not currently drinking ketones. I just put hi George. I hope all is well with you. I know you haven't been drinking ketones for a while. And now that the holidays are over with. I'm just wondering if you've given any thought to getting started again. As you know, with consistency. They are a great tool for fighting those cravings and providing us with more energy, which is something that most of us want as life gets back to normal again. Great news. We are hosting another online guest call tonight where others will be sharing their experiences with the benefits. Would you like to join us for a refresher. You can certainly invite others that you care about to with the new year here and my recent conversations. I've learned that many people are looking for a product exactly like this. Do you want the link to join us. And then I put down if not that's okay. I just didn't want to not let you know about this. And then depending on who it is that you're talking to and how good of a relationship you have with them. I some of them I put in like remember I still love you regardless of your choice whether they're going to watch jump on agree to jump on or not just to let them know that you still care about them. You don't have to use the word love because that is a strong word, but there was a friend of mine that I've known for many, many years that has dropped off and I that's what I put in my message to her to so I got a really warm heartfelt message back from her, she's not able to get on the call, but that's okay. So, um, then did you want me to read some of the other ones off as well Dustin, because I know it's we're at 20 after one I don't know if you've got a 30 minute time limit on here. Oh, he was gone and now he's back. Okay, um, maybe I'll go with back. We lost you again. That's all right now my wife called me. Okay. Did you finish the scripts squirrel. Oh, yes, I did. Okay. And now Bobby said she wants the ones for people who have never bought before. So I'll go over that script to. Yep. Go for all of them nice and slow and then we'll then I just want to all of them. Okay. Yep. Okay. Yeah, just just a family's watching the recording they can write. Yep. So, so, um, just change that to everyone's everyone gets it here. It's not pasting what's going on here hang on to me, bear with me. Interesting. It's not pasting for me now. Well, I'll read this one. If you guys can still reach out to me too. I don't know why it's not letting me paste it. Let me paste the first one, but I will, if you want, you can still reach out to me too on messenger and I will send you those on messenger as well. But this one is for those who have not yet, you've not yet had any conversations with about ketones and you could, especially if you're new, this is good if you could use this for a lot of people that you're going to reach out to. So again, I'm using George's name again, so I say hi George and I always emphasize the word are like how are you. I know we are halfway through January, but I don't think it's too late to wish a happy new year, right. Happy New Year, I hope the first two weeks of the year have treated you well. I also wanted to take this chance to let you know about a product I have found and love the product product is called keto os nat, which are exogenous ketones. I've been sharing it with as many people as I can and also on my social media platforms. I don't like to assume that you have seen any of my posts, you know what they say about assuming. lol I really do believe that you will love these we are holding an info meeting an info meetup tonight online at 830pm Eastern to share exactly what these are all about and I'd love to have you join us. And you are more than welcome to have your families and family and friends join us to would you like the link to join us. If not, that's okay. I just didn't want to not let you know about this call. I can always fill you in myself at a later time if you are up for that. So I'm leaving them because this is if this is somebody that I've never chatted to about ketones at all before and perhaps they don't even know that I've been drinking them. They might if they don't want to get on the call. I'm also letting them know that I'm still open to talk to them one on one belly to belly or just personally with them. Let me try one more time if I can copy this. No, not let me paste anymore, which is really bizarre. So I apologize for that. Dooms being weird that way. Dooms being weird that way. Can you hear me. Yes, I can. Awesome. Give Liz a shout out. I missed it if you did, but did you talk about Jennifer's post? I did. Awesome. Very cool. Okay. So what do you all think I would love to do two things I wanted to share in this activity hour is I want in the chat or if you're watching the replay I want you to put down.  Are you an introvert or an extrovert? If you don't know the difference, I'll explain so that you can be really clear. So an introvert is somebody that does well, feels comfortable and flourishes like you'd like to have a one on one conversation with somebody or maybe one or one on two. But as soon as you get above three or four people in a room or an environment, you tend to shut down. You tend not to speak. You tend to be very quiet. That's an introvert. It doesn't mean you're shy. Shy and introvert do not they not coexist. That shy is very different than an introvert. Introvert is just somebody that is much more comfortable with less people around. That's me. Are you there still, Dustin? No. Can you guys hear me? Okay. Okay. I know when I was chatting earlier, I got a message that my internet was unstable. So I wanted to make sure that it wasn't just me. Now, I don't know if any of you. Oh, there he is. You're back. Dustin. You're not muted. What movie that was? I don't know if any of you were at ELCD. That's one of the things that we did is we had an exercise where they asked certain Jay Shetty asked a certain questions and we went to the different parts of the room. And then we went to the different parts of the room based on how we answered those questions. I thought that I would have been an extrovert, but based on the questions that he asked, I actually fit over onto the introvert side. So, and again, like Dustin said, there's nothing wrong with that. It just means that you were there. Yes, you were, Kristen. So until Dustin can get back on here, I'll just go over a couple more of those scripts that I have. I have purchased trial packs from you, but have not yet created their own cloud account. So again, I'm using George as an example, which, I'm happy Monday. Alicia, you have a question. Yeah, for sure. Pop on on you. Yeah. So just real quick. So the, the link with the birthdays there, like the, the after that and then the month that that follows, like, is that because those are people that you know and that you may not know. not have realized may not be drinking ketones with the birthdays popping up that you may not have because the birthdays that pop up, those are people that you obviously know because they're friends in common and stuff like that. Is that where you're going with that? Yeah, they're my actual friends on Facebook. You may not have already hit up with the ketone conversation and stuff like that. And so that's what it is. Okay. I'm just wanting to make sure. Regardless of whether I've talked to them about ketones or not, I still do this practice and I still speak to every single person. Or just to reconnect. Yes, I will still create a conversation with them and connect with them again because you know there are many of them that I have spoken to about ketones and they either turned into crickets and don't answer me or they were not interested at the time. And it's funny because depending if you're consistent on your posts, you can tell who's watching you.  They're not making comments depending on what the post is because like there's you know people that I have had conversations with about ketones and also sent birthday messages with my other posts, they don't say a word about I might get five or 10 comments, but all of a sudden I post this post and they're all in there. No, it's so weird. Yeah, I'm like, I'm good at social media. What's no, so it's just like I know it's weird. So but even just so that you can reconnect with people just have to start a conversation of like that maybe that you've gone to high school with or something just get them back into that. So yeah, yeah, I just want to know. All right. Thanks, Liz. And it's it's you're welcome. And it's funny you mentioned that question that you mentioned high school people that I went to high school with that was a long time ago for me. I know. And I have some I have some friends who have friends because that's one of my things is I try to get new friends all the time and new followers. And I have friends who are friends and I see their names and I'm like, man, that person looks really familiar to me and the name sounds really familiar, but I just can't pin that message to them because a lot of them face a lot of these high school friends of friends. I left Barry when I went to high school and Barry I left in the middle of grade grade 10, almost finished grade 10 and moved out West. So they all graduated together. So the memory is not as clear for me. So it's hard. But yeah, I still will send out messages to them. Yeah. Yeah, I've got my year but I've gotten my yearbook out because I'm like, I can't is that person who idea I have to look through like when the name pops up, I'm like, who is that? Like a thumb through that and everything to see if that's the same person or not. And I'm like, just want to make sure so I've actually gotten the yearbook out. And I'm like, Oh, that is that yeah, you know, that's a fantastic idea. Really good idea for sure. Miguel, you would ask any strategies for reaching the yearbook out. Yeah, getting the yearbook out. That's did I freeze? No. Okay, so maybe Alicia is frozen. Miguel, you would ask about any strategies strategies for reaching out to the watchers. If I know that they've been watching, I will just send them a I'll just send them a reach out to them and send a voicemail out to them, a voice message to them on Messenger.  I will still send out a message to them. One thing that worked for me, I sent the message out to a girl and I said, I see that you liked my story. Thanks so much for liking it and interacting if I appreciate you for doing that. Would you be interested in ketones or are you just being a super fan? And that's how I got she actually started drinking ketones. So that's one way one idea to did that answer your question? Maybe I don't want to take up too too much time. I know that Dustin wants to get on talking about birthdays too.  I will go on with another script. So this is for people that are already drinking ketones. They're on smart ship. They're drinking ketones. They're drinking them consistently. Don't forget about reaching out to them and inviting those people to your guest calls as well. And the reason for that too is you want to give them the opportunity to invite others that they care about to these calls that could potentially help them to earn their product for free. And so I just say to like, Hey, George, how was everything? Can you believe that we're already halfway through January? I just wanted to send you a quick message to let you know about another guest call that we're having so that we can share the ketone conversation with our family, friends and colleagues. We are all really loving this because it's a great way that we can share with those we care about without having to explain it all ourselves. Would you like the link to join us and to also share with your circle? The call is tonight at eight 30pm Eastern. If not, that's okay. I just didn't want to not let you know about this. Make sense? Yeah, Kristen, that comment about the super fan. I think that I don't know if I'm mistaken. It was either you, Lynn, or was Kate that mentioned that on one of our calls? I got that idea from. So it works. Now, I've also had somebody who said that when you reach out to somebody that likes your stories or has just seen your story, but actually hasn't liked it or given any kind of an emotion to it, that it's almost like when you're in a department store and you're just browsing and you see that sales rep walking up to you and you want to run away from them because you don't want them to approach you. I've heard people say that that's what that is like too. So it's kind of a different opinion. And maybe that's where you want to just evaluate who it is that you're reaching out to. Is it somebody that you do know?  I think I talked that whole time and not have a sound on. Yeah, you did. We heard your movie movie. We can hear you now. Dustin. Hello. Can you hear us? No answer was a stern reply. Oh my goodness. When did I cut off? We heard the movie. You were playing a movie for the kids. Now we lost him again. Carol, you're the host now. Oh, this is too funny. Here he is. He's back. Wow. Hi, welcome back. I mean, this is unbelievable. Did you guys hear anything I said? No. All right. Well, I guess it wasn't that important to be said then. Well, we heard you had the movie going for the kids, I think. Oh, her her iPads caught on to my on to my phone. My earbuds aren't even working. Nothing's working. I couldn't even get on the zoom this morning. I don't know. I'm having a technology issue. Well, I just talked for like 10 minutes and nothing came across. This is what I'm going to summarize it really quick. And I'm going to do a video or a training on it. I apologize for everybody that's watching this. Okay. How many of your introverts? How many of your extroverts? Okay. Okay, so this is what I want you to do. Carol, which one were you? Introvert introvert. Okay, so this is what I was what I would say. I can't believe I I literally am walking in circles just like yelling people are watching. So first off, if you're an introvert, that doesn't mean you're shy. That just means that you thrive in smaller groups.  In general, this is not written in stone. In general, introverts do better on social media. Extroverts do better belly to belly. In general. Okay. Now, an introvert can do really good one on one, one on two, one on three, but as soon as you have nine people come to the house, it gets a lot different. Where Miguel is like, bring them all invite a million people, right? Doesn't care. He's gonna love it. One or two people he's gonna be like, oh, it's like, it's like, you need more energy, right? I'm the same way. So how to bring social media and how to bring social media and belly to belly together is this way.  If you're an extrovert, do not write them down. You can but not in the purpose of this demonstration.  I'd like to go to Ireland. Okay. Let's do this. For this purpose, let's just do the US or Canada, or yeah, or Mexico. Okay. Florida. Florida. We're at Florida. Anywhere. I've never been to Florida. I've only been to Orlando for one proven event. Hey, pick one place or two places in Florida just for fun. Barrel Beach. Okay. Write that down. Carol, how about you? No, this is good.  A triple long B main, the coastline of Maine for like so what I want you to do when you did when you did Liz's birthday thing, right? And you're like, I don't have a lot of birthdays this month, like or next month. If that makes sense, that tells me that you need to create more followers if you're using social media as a strategy for you to that had picked a location. Your goal is that's what you want to travel to. I want you to start targeting that location of your followers. Follow your demographic. Okay. Now who's your demographic? It's hairstylist. It's women that wear red hats. It's redheads. It's whatever it's single dudes. I don't care whatever your thing is. You're going to target that market within your demographic. And that's why I want you to not only but primarily put your energy towards your following because you want to go there anyway, right? Talk about Michael's talk earlier. It's a law of attraction. You got to find your God. You want to go there. Sweet. Well, now you have a reason that now when you go to Maine, you might have customers there. You might have promoters there. If not, at least you have the ability to go have a coffee with somebody that you know in Maine or you know in Florida, right? So it gives you ability to target where you want to go. Now, extroverts. This is what I learned about extroverts. If you, this is a business decision. This is less about your dreaming of where you want to go. You do better with people in your local neighborhood, your local area. You do better with the people around you. OK, so what I want you to do is you start targeting the people in your hometown or the town next to you. And your goal is to bring in and magnify the followers. I mean, 80 percent of what I do now, I'm not trying to go to Singapore anymore, y'all. I want to just I want to coach my son's football and my daughter's my daughter's baseball. And I want to have a medium on the road instead of get on a plane to Singapore. Now, I don't mind the Singapore trip, but the reality is I'm an extrovert. As soon as you start getting I get now I go out to town. My wife hates it.  People are talking to you. Yes, because I've been targeting them. I'm I'm now like they don't know it, but I'm in their face on a regular basis. Now, the bigger the city, the harder that is. So you might want to like really like for Lynn, she lives in an area where it's like super complicated. So she might be more targeted, like I go to this part of this this coffee shop, who goes to that coffee shop, like she might be more targeting as it's a bigger city. But what I want you to do and then as an extrovert, your job every time you meet somebody is to give them the following on social media. Because if you want to build locally, the best way to build an international business is to build local for you or your extroverts. You introverts, you just create, you're good at writing. You're good at the creating relationships online. Carol, Liz, can you guys create relationships without talking like without seeing people face to face to face pretty well?  I horrible at it. I want to be face to face with them, right? So so anyway, I just that's kind of a strategy I want you to use. And then I want you to think about I was going to give a posting strategy, but we'll maybe do that next week, a four to one posting strategy. But but anyway, that's just I hope that helps.  I think the extroverts are the ones that are struggling right now more than the introverts because we've been talking so much about online stuff. But use online as a way to build your extrovert like get in front of more people, use it as a strategy rather than as a as a I'm not comfortable doing it. For you introverts, be strategic and use your online marketing to build relationships and grow your business that way. So be both. So that's done, then Liz, I appreciate you. And as a question, just Lin Noles has a question. Yeah, what's up, Lin? Hey, good afternoon, quick question. You just triggered something in me. So if I'm an extrovert and I'm going to target my local people to build in twenty twenty three locally. And I heard you say if you're an introvert, like your first thing is you want to get them following you on social media. That's for everyone, though, correct, because I might need someone out and about that is an introvert. Yeah, so I'm just using this conceptually, like in general. But Katie Rollins is an introvert. Michael Rutherford extrovert. They both have trade businesses and they both they both will tell you like Katie's like building online. Michael's like building belly to belly. What's not one or the other? It's this, right? But what I want people to know is that if this is the style of person you are, be aware of that, right? I'm an extrovert. If I don't do things out in time, don't like linear, I do this networking groups, everything else, but use social media as a strategy to magnify what you're already good at. At the same time, let's not tell an introvert that they have to go out and do a drive by because that's they are uncomfortable, right? So what's my point is we want to be strategic with them and say, listen, let's use your how do you get? How do you build relationships online so well? Like let's magnify that. I use the strategy of like pick where you want to go, right? Pick where you want to live. If you want to go travel somewhere, if you want to go to Ireland, Liz, I would tell you to start doing Ireland, too. But from a business decision, I were faster in the States and Canada, so I would focus on them. But this is a way like this would be like this is the same thing with dating. It's the same thing if you ever wanted to move. Well, if you want to move somewhere, don't you think it'd be good if you went and got like 30, 40, 50 people to connect it to in that area before you got there? You think it'd be better? Yes, right? But I just want to I want to this year to me is bring the belly of social media world together. What's happening is it ends up we I'm going to divide because of personality types and there's one person that doesn't want to talk to people in public. They would rather all do it behind a screen. And for me, that's really challenging for me. I get stressed thinking that's how I have to do it, where I want to be in front of people. So but but let's put a strategy together for that. And there's something I'm going to talk a lot more about. So I would talk selfishly. I would focus on you, not your team initially. And then if you're a leader, then start recognizing OK, they're good at this, but don't push them into the like if they're not coming to the KLPs or coming to the local event, doesn't mean they don't care. Just mean maybe they're uncomfortable, right? And don't like let's not try to keep making them more uncomfortable, which I've done a lot because if you're not, if you're not if you're an introvert around me long enough, I kind of can stress you out, right? And now I'm I'm more aware going they're that way. Let's let's let's damper it back. Let's put them in their gift zone. Let's not push them into my gift zone. So in some of some introverts, everybody can get caught up in the moment. But ultimately, you're going to you're going to be comfortable where you're comfortable. So so anyway, I do have to go pick up my daughter. She's in that room right there, Liz. I want everybody to give Liz some love and a shout out. Appreciate you so much. And tonight we'll see you tonight on the call. Hey, you're host everyone.


violating the substance abuse policy and he's going to be suspended for six games. So there are five more games remaining in the season. That means he has to sit out for those five games and potentially week one for the Houston Texans for the 2021 season. I say potentially because there is no guarantee that he plays for the Houston Texans, whichever team he plays for, he has to sit out for week one of the 2021 season. He's going to be an unrestricted free agent following this year. So what do the Houston Texans have planned for Will Fuller and what are Will Fuller's plans? Does he want to return to the Houston Texans or does he choose an elect to play somewhere else going into 2021? We have to break it down because Will Fuller is a 26-year-old wide receiver. Speed is so good, so good. He finishes the season officially with 55 receptions or 53 receptions, my mistake, 879 yards and eight receiving touchdowns. That was on pace for 77 receptions, 1279 yards and 12 receiving touchdowns and I say on pace because it was a very realistic possibility for that for the first time in his career that he plays all 16 games of an NFL season because he's been injury riddled and injury after injury after injury every single year and now he was just finally healthy and was just having a year without Deandre Hopkins as being the number one wide receiver in Houston and then this happened. So unfortunate for Fuller and the Houston Texans are going to be out without him as well. Pretty good numbers, pretty good season, probable worthy in my eyes, unfortunately not with the suspension anymore, but he's set to become an unrestricted free agent. The Houston Texans have no choice but to resign Will Fuller. You have to, you have to and this is all going back to the mess that Bill O'Brien cost in that Houston Texans organization. I don't know what he was doing. He was playing Madden Franchise mode, but he made some trades that were questionable, got rid of Judevion Clowning, got rid of Kenny Stills and or acquired Kenny Stills and then Laramie Tenza, which Kenny Stills just recently got released and then you traded away your best wide receiver Deandre Hopkins. I don't understand you acquired David Johnson, I get it, you acquired Brandon Cooks, I get it, both are good players and they're having decent seasons, but this is all because of the mess that Bill O'Brien made, the Texans find themselves in a very tough spot. You have to resign Fuller and that includes giving him whatever amount of money that you want to give him in comparison to the other wide receivers on that team, Brandon Cooks, the top wide out right now for the remaining five games of the season, five year 81 million dollar contract. He's 27 years old. He's going to be sticking around in Houston for at least another four years. Randall Cobb, three year 27 million dollar contract, 30 years old. So he's trending towards the tail end of a wide receiver's career, but he's signed a three year 27 million dollar contract to be in Houston. So he's going to be there for a couple more years and then Kiki QT is still playing on his rookie contract through 2021. He'll be around next season, but he is 23 years old and those three wide receivers, that's pretty much it. That rounds it out because you release Kenny still. So that's pretty much not going to do it. You're going to have to retain your best wide out at that point. And that is Will Fuller that you have a future with. You have at least, I would say at this point, maybe three, four, five more good years out of Will Fuller if you were to resign him, but it's going to cost a lot of money. It's going to cost a lot of money and you have to resign him because you have no draft capital that you can use on a decent wide receiver. Maybe you get a steal in the third round, but you have no first rounder. You have no second rounder. Thanks a lot, Bill O'Brien. So now the Houston Texans find themselves in a very tough spot. So the suspension hurt way more to the Houston Texans than we may realize. But for Fuller, what does that mean for him? That means he can ask for a lot of money from the Houston Texans and he's going to get paid next season. Absolutely. He's going to get paid. It doesn't matter if he's going to be sitting out week one. Teams are willing to pay for him and teams have acquired about Will Fuller prior to the trade deadline this year in 2020. You had the Green Bay Packers who had big interest in Will Fuller. The asking price for the Houston Texans was just way too high because I figured that if they had more draft capital, if they had a first round pick or a second rounder, then they'd be willing to shop Will Fuller for a second round or maybe even a first rounder, but instead they couldn't because they can't afford to give up their top wide out. So if Will Fuller were to test the free agent market, the Green Bay Packers are a big landing spot for Fuller. Can you imagine? Devonte Adams, who's been doing it all this season with Alan Lazard-Hert, with Marquez Valdes-Scantling, MVS just not really being or developing into that reliable number two wide receiver. It's just been Devonte Adams, Adams, Adams, Adams, make sure of Aaron Jones here and there, Adams, Adams, Adams. Aaron Rodgers has just been feeding him the ball. So I feel like that Will Fuller, if you were to sign with any team, the Green Bay Packers would be one of those top candidates that would pursue Fuller hard. Aaron Rodgers throwing Devonte Adams and Will Fuller. I mean, I don't know. This is premature, but if that were to happen, go ahead and make Rodgers another candidate for MVP in 2021. That's going to be a pretty ball and offense if Will Fuller were to sign with Green Bay. Another team that needs some wide receiver help, Washington, the football team. If you watch your episode of Town to Football where we talked about trade deadlines, we mentioned Washington and the players that they could have acquired prior to the trade deadline. There was Brandon Cooks that was on the market. There was Will Fuller that was on the market. There was even John Ross or AJ Green, the Cincinnati Bengals wide receivers. If you need wide receiver help, there were wide receivers out there and the Washington football team thought about acquiring a wide receiver prior to the trade deadline, but instead decided not to make a move and Will Fuller, if you were to hit that free agent market, the Washington football team would go hard after Will Fuller. I don't even know if they're going to be called the Washington football team in 2021, but they would go after Will Fuller without question. So to pretty much sum it up, chat with us, interact with us, what do you feel like the Texans should do at this point? Do you think that they should just cough up whatever amount of money that Will Fuller and his agent are asking for? Because you're in a tough spot and the agent knows that as well. So they're going to have to pay them if you want to keep your top wide out. Or do you feel like the Texans should move on and just use, if you were to move on with Will Fuller and not give them that big contract, you're going to have to treat 2021 as yet another rebuild or year. Maybe you can get it done with Brandon Cokes at your top wide out. I don't know. I don't know. But if Will Fuller were to move on, which team do you feel like has the best chance to sign him in free agency moving into 2021?


Okay great thanks everyone can hear me good we had a good talk before so that was we're done that's it that's the whole thing let's go home I am embarrassed to say that I actually gave this talk before at this conference two years ago we had a postgres day I wasn't aware but somebody came up to me today and they said aren't you giving the same talk he gave two years ago and they're like they said it was really good I'm like I did and I get my phone out really quick to find out because I record where I give my talks so I don't do this mistake and in fact that's what happened so I submitted this talk or somebody no I must have submitted this talk and not realizing I'd already given it did anyone to see it two years ago great okay I'm sorry about that I'm sorry about that this is not the updated version unfortunately is the same version so I have I actually I actually have over 30 talks on my website and this is one of them so I usually pick something of the one of the other 30 talks to submit and unfortunately I did this mistake so we only have one person who's seen it before I feel pretty good about it it is an interesting talk and the reason it's interesting and I'm gonna try and walk over here and see if I don't get a lot of feedback but the reason it's interesting is because it tries to look at postgres from a different angle so it looks at postgres basically from the outside and tries to see what somebody from the outside can actually do to postgres like how what what type of malicious things can somebody do to postgres and to have to prevent that from happening all right and and the reason it's interesting is because it's a database so again normally you you you have certain things you should use for server configurations and so forth but this is obviously database so it has a little different set of requirements when you're looking at security and I'm basically going to be talking about them from a database perspective okay so again yeah but this is my website down here the website the slides are there I've also submitted to the press of the organization organizers so I'm sure they'll show up on the website at the same time so we're going to talk about attack vectors how can you it's actually attack a database specifically I'm talking about postgres but frankly it probably relates to any other database I'm going to talk about postgres specific myself by the way my name is Bruce Momjin been working with postgres for 16 years work for Enterprise DB they sponsor my community work and have for about seven years now so what we're going to talk about today is some of the security you can set in postgres we're going to talk about passwords and how they're kind of configured in postgres then we're going to talk about some network issues and sort of network security in relation to postgres which I think is going to be kind of interesting and then we're going to talk kind of at the back and about sort of some of the the issues with backups and things like that so again not a super complicated but we are going to kind of build kind of from the from the bottom up what we're not going to be talking about is external attack internal attack vectors these are cases where somebody's already been given access to your database and they use it somehow to escalate their privileges so this would be something like SQL injection attacks where you use sort of single quotes inside your string to kind of get another command into the stream if you've ever done that and seen that before application vulnerability permission stuff like that we're not going to cover that doesn't mean they're not important it's just not the focus of this talk here so any questions okay so let's start with a file here this happens to be the file called pghba.com this is the configuration file that comes with postgres and the first thing we notice here is that we have a authentication method over here on the right-hand side and the way postgres comes in its source distribution it actually comes with a trust flag and what the trust flag effectively says is that I allow anyone to connect to my database who's on the local machine there is a way of changing that there's a dash capital A flag that allows you to change the default permissions you get when you install from source most packages will not use trust they'll use md5 they'll use pier which I think is a new security we have so again you might want to look at your HBA file and see how your security set up and basically what you know what controls you have this some this fall is kind of interesting there's quite a bit of of cool stuff you can do here I'm not going to go into it too much but basically it's like a big filter file so you can do cool things like say I want this network to come in and I wanted to use SSL and I want I wanted to use password try no md5 trust or I want let's see I want LDAP to be used from this network I want to exclude a couple of machines in that same network so there's a lot of cool stuff you can do here in terms of security I'm not going into just kind of highlighting that trust method and showing you other ways of setting it up there is a an authentication method in PostgreSQL password I know it sounds real easy but you shouldn't be using it the reason you don't want to use it is because the password effectively gets sent across the network with no encryption at all so it basically is just a clear text version of the password that gets sent across now this isn't a problem if you're if you're doing everything on the same machine so if you're going local host well obviously nobody can snoop that network because it's on the same machine you're using units to main sockets or even in TCP all that network is on the same computer but if you're going from computer to computer password is probably never the one that you want to use what you probably want to use if you're going to pass passwords back and forth it's something called md5 that might be kind of a funny name but in fact it's called that because it's a basically a hashing algorithm that we use to identify how to basically how to hash the passwords as they go across the network okay the first thing you might kind of wonder about that is well okay so you've md5 hash the password but how does that really help me because somebody can just look at the password going across the wire and then we send the same hash across the network right so if you ever imagine what would happen effectively they've hashed the password I don't get to find out what the password is but I do get to find out I can basically replay that password back as a new user okay fortunately that can't work with with postgres and the reason is because the the client before it sends the password back will actually run md5 twice so what happens is the client connects and says I want to connect the server comes back and says I need a password but also I've got this random salt I'm going to send you and when you send the password back I need you to use that random salt as part of that packet coming back so the client basically says okay I'm gonna take the password the user supplied to me I'm gonna concatenate or append to that the username okay so we've got the we've got the password and the username I've unfortunately spelled misspelled username I will fix that okay and I'm going to md5 that okay and then I'm going to take the salt that was passed to me by the server and I'm going to append that to my md5 and I'm going to md5 again okay and then I'm going to send that back to the cost of the server and the server actually stores its passwords as md5 hashes of the username and password and then so what this client that the server will do is say okay I send him that random salt I'm going to take the password entry that I have stored I'm going to md5 that again with the same salt that I sent to the person I'm going to compare the two strings if they match I'm good okay so how does that actually work in practice normally I want to connect here's a password and here's a random salt the person sends it back they basically get an authentication and they're fine okay however a malicious database client could make the connection it could receive the password and the salt if it tries to replay the same string that it saw on the wire before effectively the database will say no that doesn't work it it does not match the salt that I passed you and therefore you can't get it okay so yes sir I'm sorry oh how do you spell that not I've never heard that term before okay so why is it not a salt all you mean they saw all the passwords the same they use the same salt for all the passwords okay and you're right we're not using we're not using anything when we store it we store it without any randomization okay we just kind of came up with this because we realized that replay wasn't good the big problem frankly that we have with this design is the salt is only 32 bits and you might think oh that's not going to repeat very often but when you think of the birthday problem you know like how many people have a birthday it turns out I think you only have to do like 16,000 trials 16,000 trials before you get a replay or something like that so I'm not really happy with that I think we need to go to 64 bits we sort of haven't done that yet but I would like to see us go in that direction and unfortunately we didn't think of that at the time when we originally designed this this was in like the late 90s and 30 64 bit support wasn't in most of our operating systems so it would have been kind of hard we probably could have done a way of kind of making a hybrid 64 bit but we didn't we didn't think of that at the time and that's that's sort of a flaw I think in this design okay other questions so what doesn't this cover well it doesn't cover weak passwords doesn't cover reasonable passwords and it doesn't really cover brute force password attacks okay if you need this type of security and many people do we're basically going to recommend that you use an external tool that is designed specifically for this type of capability so LDAP, PAM, SSPI these would be the normal things that you would use to sort of prevent that type of vulnerability and again most people who are doing you know who are doing large organizations are you know easier than doing that kind of thing that we do which is kind of kind of cool so again there are a whole bunch of ways to do authentication the problem though is that we just kind of talked about getting somebody into the database the problem is we really should also be worrying about what gets sent across the wire okay so just because we've encrypted the password and we've authenticated cleanly doesn't mean we're in the clear it literally means we're still in the clear because we're clearly sending our data across the network with no no security at all okay so the queries are coming across the results are coming back show me this person's past you know how much does he make number comes back on the wire you know no there's nothing there okay so effectively yes like start from customers and then all the customer data comes back this is obviously not something we want anybody who's snooping on that network and see what's going on so we have to start thinking of what happens not maybe not you may be not worried about this within your organization but what happens when somebody is doing this across the internet okay kind of coming in you can do that you know is that is that really what you want so a lot of people saying oh well okay I want to use SSL and they sort of think that solves all the problems but it doesn't all solve all the problems and I'm going to get to that so what SSL typically does in a little detail of how it works is effectively it connects it basically generates a negotiated secret key between the client and the and the server and then it uses it like an encryption algorithm like AES 256 I don't know what AES stands for but it can't be American auto standards but American encryption standard oh I'm not too far off so basically it's gonna it's gonna encrypt it as it goes back and then it's gonna use the same secret key to send the result so you know you thinking oh wow okay I'm done this is great you know I'm now encrypted I've got my authentication working you know my job stuff well not really because there's this guy and I talked about snooping before but this guy is spoofing and I know it sounds like the same word but it's really it's really different okay snooper is kind of just looking at what's going across and you're sort of like looking to the blind the spoofer effectively sort of pretends he's someone else and how does that actually apply here well let's look at one example which I think is kind of creepy and we do document this and it's kind of something I don't hear a lot about but for example if the server is down your database server is down it's possible because the server typically listens on an unsecured port for somebody just start up a server and like F for passwords okay they can't do anything with them they can't actually accept any queries because they don't have any data they only access there but effectively client says I want to connect server says give me a password and give me a plain text password okay client says okay here's the password and boom you're done okay you sent that password and then the person just says well you know user user disallowed or whatever invalid password just goes away and I collect a whole bunch of passwords and then later on got a hopeful password that can use kind of scary yeah well and I have little little little little text right down here but basically what the little text says is that it uses a fake socket or binds support 543 to while the real server is down okay and because the socket by default is in the temp directory okay then if you can basically create a saw a socket as not root and it's not a root it's not a root only port it's under 124 so 0123 or root only but we don't require root so you know it's like hey here let's go you know and and again all it has to know about is enough to do the protocol like the negotiation of the thing it doesn't have to execute a query that doesn't have to do anything it can just basically like hiccups and this is a problem you know it may not happen very often but you know who would have thought that a server being down is a security problem I hadn't realized it until somebody mentioned to me I was like I know I might have thought of it myself I don't know it just wasn't good so we do document this is something that's not good okay so that's one example of a somebody spoofing other real database well yeah I'm gonna get to that in a minute so effectively yeah so basically what happens here you just record the password and you know he's basically pulling in yeah I'm sorry no because the person basically says I want to connect as user Fred and that is the fake guy has no idea Fred's a valid username or not and doesn't care okay just basically says okay give me your password he's like okay here we go yeah so it's kind of a scary example I think and maybe a reason to use it you can't use a secure port and postgres there are there's an answer to this fortunately and but you can kind of start to see where it's going as a spoofer some of the things you can do okay this is a man in the middle attacks okay this is not kind of a man in the middle because there's nobody on the other side right but this is a man in the middle attack and effectively what this does is the database says okay I want to connect and the fake server says give me a password in plain text and the plain text password is sent to the fake server and as soon as it gets it actually then passes it through to the field server logs in okay and then all the queries that are just passing through here and then coming back out and this person's acting as a middle person but obviously is now can see everything that goes across all right doesn't doesn't make me feel real good but it's certainly a reasonable concern and you might say oh I'm gonna fix this I'm gonna use SSL prefer which happens to be the fault for postgres not a great default we've discussed it for a long time but as I prefer happens to be the fault when you turn SSL on at the client so anyway the database says I would love to do SSL with you and the fake server says no I don't have SSL okay and because it's prefer it's not require it's like well okay we'll do not miss a cell and I'll have your password and I'll send it over here and I'll send your query back and the client has no idea that somebody in the middle I prefer not yes so we do have a mode called require says I require SSL it sounds so secure doesn't it okay so the client says I want to connect by SSL and the fake server says okay I can do SSL let's let's do SSL and the fake server the real client talks to the fake server gives it the password but of course the SSL is between this guy and this guy so everything is decrypted over here the fact that we've secured this channel really has not bought us any type of security okay so effectively it decrypts the password it sends it over the real server and we're back to the same cycle here okay so even the require doesn't really kind of do it for us the only thing that really locks away that that person in the middle is SSL certificates and I don't know how many of you have dealt with those certificates great they're kind of important I know they're kind of also a pain because if you've dealt with SSL certificates you've got to like put them on every machine and you've got to manage them and you have to have some kind of key signing and there's all sorts of crazy things where you sort of encrypt them and you put them in a bundle and you've got a password to decrypt it