Our final speaker for the morning is John Sawyers, who my first knew a long time ago as the very well-informed deputy chief of mission of Britain in Washington. And a few years after that, I was surprised to learn that he'd become head of MI6. John today has a very important business consultancy, and he's going to tell us all about everything we need to know. Thank you, Jim, and thank you very much for inviting me back to the World Policy Conference. It's very hard to build on the wide variety of thoughts we've had from the first four panelists, but I want to put it into a global strategic context, because there's absolutely no doubt that as we move towards, or rather back to, a world of great power rivalry, where the institutions that we built up in the period after the Second World War are basically in decline and are being replaced by competition between great powers, almost a 19th century world, with the United States and China being by far the biggest two, and Russia, Europe, India being and Japan being players as well. In this great power rivalry, technology is playing a central role. And then we just focus initially on the rivalry between the United States and China. The United States has some historical advantages here. It has the biggest corporates, like the ones we all know, Apple, Amazon, Facebook, Netflix, Google, and so on. But China is catching up quite fast, not just in China, but beyond China's borders as well. But the United States has a lead in corporate development. Secondly, the United States dominates the operating systems through Microsoft, through the Android system, through Apple. The United States is definitely well ahead and has global reach for the operating systems of the IT that we all use. And thirdly, the United States has an iron grip at the moment on the semiconductor industry and the intellectual property that is associated with producing semiconductors. So that's where the United States is ahead. Where China is ahead is, first of all, on the Internet of Things. China, it's estimated, will be producing about 95% of the elements that go into the Internet of Things, all those computer devices in our homes and in our businesses that will hold that together. China is also ahead in telecom's network infrastructure. And I will come back to that, the arguments over Huawei and ZTE. And there's a question as to whether China is ahead of the United States on machine learning, what others call artificial intelligence. But there's no doubt that China is making a huge state-led research investment in machine learning, perhaps drawing on what President Putin famously said a few years ago, that the nation that dominates machine learning will control the world. So that's the sort of the competition at the moment. Let me just focus briefly on the telecom's network infrastructure, because the argument about Huawei and ZTE in intelligence circles, I became Chief of MI6 in 2009, and we had a big split in the Five Eyes, United States, Canada, Britain, Australia and New Zealand. Between those countries that accepted, we have the former Prime Minister of Australia here, he was familiar with these arguments. There are those countries that refuse to allow Chinese telecoms equipment into their national systems. And there are those like the UK and Canada that accepted some degree of presence of Huawei equipment under very strict controls. And these arguments have been running for 10 years or so. But what's happened recently is Huawei and ZTE have become part of the argument between China and the United States for dominance in technology generally. I don't think the intelligence argument is a new one. What is new is that with the advent of 5G telecom systems, if you rely solely upon Chinese manufacturers, then you are going to be in serious jeopardy of having your systems subject to control by China. Now, that's true if you have your entire system, and India, for example, will rely entirely on Chinese equipment for its 4G and 5G systems. But that doesn't mean you have to go to the other end of the spectrum and have zero equipment from China in your systems. And this is where the argument lies. But the United States is not only pursuing an intelligence argument here, it's pursuing an industrial policy argument. The United States, through a series of steps over the last 20 years, has found itself without a national champion in telecoms network infrastructure. And I think President Trump is trying to re-establish the United States as a player in the telecoms world. And it's, I think, a bargaining chip also in this wider U.S.-China trade relationship. So that's on the telecom side. On defense, there have been some very interesting developments recently. As this rivalry between the United States and China hots up, both capitals have to think about what if the worst happens. We have to plan ahead to the possibility of an armed conflict between the United States and China. Now, the Chinese are developing very sophisticated systems, but are heavily dependent upon the U.S. in certain areas, for example, semiconductor provision. But the United States isn't safe either, because so many components of U.S. defense systems are made in China. And what we're seeing is a move both in Beijing and in Washington to decouple their defense industries so that they are not dependent upon the other country, just in case the worst comes to the worst. And the two countries end up in conflict. Now, I think what is happening in the defense field is happening more widely as well, but it's sharpest and most prominent in the defense field. We have moved past peak globalization. The scale of globalization that we saw developing the 90s and 2000s has peaked and is probably now in decline, as both the United States and China seek to decouple their economies from one another, primarily for defense, but also for industrial purposes. In the security world, we're seeing China develop an extraordinarily sophisticated surveillance system of its own population. One advantage the Chinese have is they're not particularly concerned about human rights and they have no concept of data privacy. In the world, there are three concepts of data. In Europe, it's controlled by the individual. In America, it's controlled by the corporate. In China, it's controlled by the state. In China, the state has got almost unlimited use of your data to control and to know where you are.  But of course they don't use it to control people on the pavements. What they do is use it to monitor potential dissidents and China now has a surveillance system that Joseph Stalin would have died for. It is more effective, it is more thorough and it's less violent and more accepted by the population. So in the world of surveillance and control, China is no doubt far ahead of all other countries in this realm. And then lastly, just a couple of words on cyber. Cyber, of course, is the means by which countries and corporates and criminals can hack into other people's systems either to cause damage or to steal intellectual property or to hold you to ransom. We all know the cyber world, we all know how cyber defences have improved, but cyber attack capabilities have also improved. In this area, I think the major powers are very conscious of their own vulnerabilities. In the West we're conscious that our entire systems are based on IT networks that shape our daily lives and if our IT systems were brought down, our banking system, our public healthcare systems and so on, then the scale of damage to our stability would be great. It's even more the case in autocratic countries like China and Russia where they feel themselves very vulnerable to exploitation, to the stirring up of unrest in their countries and we're seeing a progressive move by autocratic countries to take control of their internet space so that they cannot be subject to disruptive cyber attacks. We saw earlier this year Russia experimenting with cutting their internet off from the rest of the world. This was seen as an emergency step that they might need to take in a crisis. I think it would be surprising if Russia develops the capability to cut itself off from the rest of the world and then doesn't use it as the norm, as the status quo and where Russia is leading in this field, China is also taking a very close interest and of course there are other countries, Iran being an obvious example which is taking a close interest in having control over its own domestic internet and separate from the global internet in the same way that they want to de-dollarize their economies, they want to reduce their dependence on the US-led infrastructure system. So I think in all those areas whether it's just straight industrial competition, whether it's the dominance of the machine learning space, whether it's for defence competition and of course this is spreading into, in defence it's spreading into the mergers and acquisitions world where every entity whether it's the European Union or Japan as well as the United States is giving themselves greater powers to scrutinize control of technology takeovers, whether it's in the cyber world, the role of technology is central to the great power rivalry which is going to be the design model of the world of the coming decade or two. Thank you.


Base Goku shirt. Let me hit you with the Napa Strat real fast. Uh! Got him. Oh, that's one big Napa I caught. Throw this man to the side. How's it going everybody? Dottodoi here with another round of Dragon Ball Fighter's Rank Matches and this time we are once again playing a Base Goku team. Now we are still here on the PC version because, you know, I was already here and we're so close to Super Saiyan Blue. I'm sorry, wait, living legend actually. And we gotta get this Base Goku practice in, boys. I'm trying to 2M. Alright, so it was a mistake and I've made mistakes before. That one was a pretty special one though. That might actually be my 1M mistake in life though. Big moments all around. Ah, we're not getting the side switch. But, there's no rule book about when you should spend Bar. Let me go ahead and, let me go ahead and waste that cash. Ah, I could have done so much. That's fine. We'll take what we can get here. Oh, what are you doing? Let me get a little bit more then. If you must take some hits. Alright, well, I might have over- Oh, dude, the 2H almost landed. It was right there. Okay, okay, I see you, I see you, I respect you. Reflect, get him off me. I missed.   How many times I gotta teach him this lesson? Okay, well, he taught me a lesson right there. Never get overconfident. We're dead. No, wait, you might not go all the way. Eh, that was questionable, bro. I don't know about the scaling. Oh, it wasn't even that questionable. This is, this has to be a go, right? This just has to be. Yeah, it is. Every time I do that, I'm just, I'm just flipping this, man. God, I got him, though. God of you, the audible mix-up. He thought I was gonna throw out a flip. Nah, bro, I'm catching you jumping. If you jump, I gotta teach. Okay, keep him down. I maybe could have gone for something a little more optimal. Oh, I didn't even see the overhead coming. I was too focused on Goku, cross-up, down, H. All right, that was one way to get things done. Level three, it connects. Here comes Super Saiyan. How many Goku's we gonna show off in this right match? Face Goku, GT Goku, Super Saiyan 4 Goku, Goku, blue. Fighters, two. Nice dragon rush. I definitely did reflect. Can he kill with zero bars though? Not unless he sparks, right? Yeah, no, no kills. Wow, he combo'd off of that. And the scaling's not looking too bad either. Again, he doesn't have a lot of bars, but oh, he'll just settle for this. Not again. No down heavy. And he can definitely kill. One bar is for this. I got me. He got me. Now, here's the question. A good player wouldn't do this, but am I a good player? I wish I was a good player, bro, honestly. Being bad is suffering. Get him out. Get him out. Let's get the mix. Somebody call the mix up police because I'm coming in. What do we do? What do we do? What do we do? That was top 10. Saddest sites. I can't believe the down heavy missed by like a little inch. Okay. He didn't super dash, but a little early on the trip. Wow. Going for the heart. I guess I don't have sparking. This is it. This ain't a bad idea. Get the hard knockdown going early. Do what you got to do. Got him, dude. What you throwing out normal for? That was kind of risky. Okay. How many points we get from a Super Saiyan God? Now, these matches are a little tougher than like if I was going up against the Oh, that's not a lot of points. We're getting to we're getting we're raking up the set. Do you leaving? I know he's not leaving. We're getting we're we're raking up this session boys. Believe that. Ah, we got to switch out for the knockdown though. Oh, the beam wasn't fast enough. Wait. Yo, that was sick. I clashed with him. So the beam didn't affect me that first frame. The second frame it did affect me. That hit me for one frame. That dude that I did not expect the Super Dash after two punches. All right. Well, you're getting a little we're all getting a little bit wild here. The up tech Super Dash and it worked. The genius. I'm down second to him who I look like.  I must admit. Powerful gets me all the way to the corner. Just GT Goku things. Oh, the up tech Super Dash is a classic here in this household. He doesn't add on any assist we live. You can he has a Yamcha. How does this character get better every day? That's the only part I don't understand. How does he get better every day? Wow. That was just that was me. That was me. I might have thrown out a little too many lights carried myself to the corner. We just finished here. He's trying to drag him at your time. Oh, come on. I don't know why I'm doing this. Oh, dammit. That come on. I jumped I jumped away from the assist, but he still hit me. Damn. I was hoping the frames would give me a little more like back up back him up for the boy. Maybe I should have gone for the switch. Damn. So he gets to punish before I do. He punished me before. Oh, wait. That's okay. Never mind. I was going to say that is that going to miss? Come on. Okay. The time now. I wasn't so sure we were going to hit that. No, the Super Dash city. Okay. It's okay. We can make a comeback as long as we adapt to the Super Dash. Let's back up here. Oh, I tried to click some buttons. All right. We still have sparking. So it's not the end of the world. It's just getting there. It's just really getting there. Now he's going to mix. Does he predict? Why is this? This is hitting like super hard. Yeah. One bar one kill. That's a good trade in my opinion. We still have a lot of sparking time left. We got all the time in the world. All the time in the world. Let's force him to use that Super Dash. Got him, dude. Still got a ton of sparking time left. One bar one kill and we still we we almost have another bar cooking already. Good stuff. Good stuff. Now does he Super Dash again? Every time we miss it, every time he uptexts it's Super Dash. Can we kill? Wait. If we if we hurry it up. Slice it up. Yum. On the road. I told you we're trying to rank up today. It doesn't matter if base Goku's here or not. We still got a job to do. This is going to take a while though. After this, we might have to find a new guy. Damn it. All right. Let's see what we can get. He's going to throw out some assist. Get him to the corner. Dude, the lag. Oh my God, we got crossed up. That was a that was a two-toe shuffle. That is what we call in the industry a two-tone shelf guard cancel. I probably should have expected that. I tried guard. Oh, that's fine. Not too bad. Ah, it was the third one that set him off. Nice. I'll take it. I got to learn the optimal corner stuff. I can't believe I tied that so poorly. Level three for the hard knockdown. No. What are we doing throwing Key Blast in 2019? Let's go. Commitment. It scares me, but it doesn't scare Yamcha. Too far. Oh, he blocked that. Oh, don't even ever. Wow. That was close. I tried down heavy in it again. That was kind of cheap. The reason I didn't super there is because I was trying to do a half circle into Goku, but it just didn't end up working. So I kind of just dropped the entire super. Wow. That was nice. That was the fakest vanish I ever did do. I could up. Okay. Nice. Nicely done. All right. Come on. Show me what you got. Oh, again, dude. Got me going again. Okay. Got him, dude. Got him again. All right. So let's go find a new new player because I need these points. All right. Mission successful boys. We found another Super Saiyan Blue. Now we just have to actually win the matches, which is the hardest part. Wow, Broly. Well, at least we got we got out of the corner. I guess it's like that is a small consolation prize.  We're out. Just let me know. He didn't get the dude. We're getting Broly pretty hard.  That really caught me off guard. Optimal stuff. Yeah, right, dude. Yeah, right. Well, that was interesting. Do we get Broly back out though? Watch the mix. I didn't get to do the mix. Okay. Hold on. Guard cancel. He's going to switch. Boom. Let's go. Can I see one Vigito blue back on the playing field, please? And he does have an air level three. So miss me with that offense. It is kind of crazy that I'm like, dude, the people that do air level threes after that are the worst people because they just scar you for life. You can never do offense. Get out of there. Oh, beautiful. Beautiful, baby. I love to see that. I'm sorry, but you who said you get to play face Goku shirt. Let me let me hit you with the Napa strap real fast. God. Oh, that's one big Napa. I caught throw this man to the side top tier mile to beat here coming through. I always try to back dash against Goku Blacks. It's every time I almost get it. Nice vanish. Dragon rush just when I was about to like like guard cancel my plan had changed at that point. I was focused on leaving. I was trying to leave Goku in the face Goku in the past move on to noon. I try to reflect Goku Black shenanigans, but it didn't go to six of online. You know that six and be hitting. I didn't want to vanish. Wow. Oh, baby mix ups. Gotcha, dude. The oldest trick in the book. Now welcome to go Coos corner time starring nobody. I didn't mean to do that. Oh, no, I did not. I mean, it doesn't it doesn't. It's not like, wow, I'm gonna lose the game now, but dang. Did I not mean to do that? I don't know why I censored that one. There was no need to. The option selects though. Did you guys see that? I was working on it. You know, I'm constantly on the YouTube game, Brian. We are going to lose this. My my my confidence has been shattered. Please let me out. Why is it lagging now? Please don't drag and rush. Please have some confidence. Oh, he tried to mix me up in this sweater weather. Dude, come on. Where's your competitive integrity? The mix ups. I mean, I guess maybe that was easier to block than if it was not lagging. Oh, get that double down heavy slicer. Please. I'm just a man playing Yamcha, dude. I don't even have a plan. I'm not even the man with them. Get that out of here. Trying to drag it from me and I never even lost. My cool is the thing, dude. I stay cool, calm and collected at all times. I would not be surprised if we don't get the read. We do. Okay. I wouldn't have been surprised if we didn't get it. I'm just going to run up and heavy. So this is, this is top tier. Would you mind if I talked to Goku Black just for a little bit? Let me see his nine. That made sense. That made sense. Make sense. Make sense. Can he combo this? Okay. Well, he couldn't, but he has the buttons three bars. We're dead. Actually, hold on. Every time I try to throw a key blast, it's never the right move. I'm better off. Just hold and don't do it. Dragon rush. That is always so risky to go for. I can respect that though.  Hold it down. We need the points. Don't crack yet. Okay. I don't know what he was going for there. A little bit of neutral, a little bit of neutral. That's okay. You know, I got the pressure dude. You know, I got that pressure. You know, I got that quarter circle forward light. The triple overhead. You never would have thought about it until I until you just see it. Oh, you never would have thought about it. He just clicked buttons. That's truly the best threat in the game, baby. Just hit him with the triple overhead. Make him rethink that defense. I don't want to see you playing lazy defense.  And you know, Super Saiyan Goku just came through with the massive power on that one. Yamcha didn't do much except for, you know, the assist was pretty crucial, but come on. Give some props to Super Saiyan Goku. All right. Keep hunting those points, baby. This could be the difference. Ah. Wow. His buttons hit me through that. At least don't throw me back in the corner. Please. I beg. Ah, I tried to near button. I did. I did. I did. We can all admit that. Now I'm getting tossed for free. Oh, but welcome back to the blender. Oh, I tried it down heavy. I should always just go for the super after that. I don't know why I try to get so fancy with it. Oh, baby. Welcome back to the Goku blender. What can I get for you today? Ah, nothing. You're, you're full. Uh, a little rude to the establishment to walk in here and actually want nothing to eat, but don't ever try that. Not the cleanest. We're all up here, big bro. Let me get that action. And the Yoki afterwards. Oh, get him out of here. Throw him into the nearest mountain. Doesn't want anything from this establishment. Man, who says we wanted a server? All right, he's going to try the 5H. Oh, no, he didn't. I tried it, dude. I tried something so fake.  The age-old Broly throw. OK, but we're kind of tied. Ah, dude, I'm so afraid of the command grab. The beams are still better. He tried to zone me out, and to be fair, it almost worked. Got him. Beams are still better, though. It was just fast enough. All right, what are you going to try today? We're just fighting in the air. These are the Dragon Ball battles I live for. The beam, that was smart, and now Goku has to die for that. Oh, that's, that's, that's a little sad, because now we have to actually rely on Yamcha full-time. It's never a great day when you have to rely on Yamcha full-time. Wow, the medium didn't even beat him. And the lights came out a little slower, too. Oh, no. Oh, I'm not feeling too confident about this one anymore. No. I can't believe that's that fat. I mean, I should have known. I did know on some level, but I wanted it so bad. He's eating me alive. I haven't touched him yet, have I? It's partly a confidence thing. I don't feel like I'll be able to touch him, so I'm not able to get in there. Three, four, five, five. Oh, we lost so many points. No, he held it. He held it. He held eight. Dude, I gotta give it up. That was smart. I hate this man. I got tripped up by the beam assist. Tripped up again. Just stop looking for the command. React to the command grab. If you're that afraid of the command grab, learn to react to it. We lost bait. We got Broly. We got absolutely Broly. We got big Broly. I cannot believe we're cracking like this. Cracking like this is deadly to the cause. Deadly, absolutely deadly to the cause that we're cracking like this. All right, just... Can we reconvene? Waste the vanish, not waste, because he needs it for the optimal. Absolutely deadly. Come on, that didn't get him either. I should have optimized this. Too tall, too tall. You are one tall character, Broly, and that was your undoing there. That beam is crazy, dude. His Super Dash somehow beat that out. I thought we kinda like did it at the same time. I thought we were at least in clash destination. Are we out? Oh, come on! It beat me out again! All right, all right, all right. Well, if any character could make this, it would be Super Saiyan Goku. It is still doubtful, though. Oh, my God. Oh, the go... My Key Blast still came out. The game didn't even know what happened. Super Dash picked me up again, and it's over. The rank up dream is practically dead on the ground. Jump cut to when I win. Jump cut to when I win. Let's go, baby! And that's where the jump cut cuts back in. And it was all planned. We're still not ranked up, though. That was the same match I jumped cut away from. It took eight minutes. That was hot! Cut back in! Editor, cut back in! There's the blatant favoritism going on. Editor, cut back in again. We're back. We're back. Two wins up. Do we record this fight? Is this the final one? No, we're not even close, dude. Cut back out! Come on, the doubt heavy didn't reach in time. We're going to get final flashed. No, he doesn't.  I just got it, but I'll take that. All right, this should be the final one. So, cut back in. It's time to bring it all back. Welcome back, everybody. We cut in a few times there, but we're back for real now. We kind of got him figured out over the course of these last couple games. All right, we messed up immediately.  That was new. He's really trying to escape here. He was not this fidgety during the normal matches. Oh, no wonder why he's fidgeting because he needs that double Sunday. No, our lights didn't come out faster. All right, now where are the ones getting fidgety? An early spark might be worth here just to get rid of the Broly if we feel our momentum slipping too hard, but it does feel like this is worth, honestly. Nice, it killed. I was having a mini panic attack. I thought we didn't do enough damage, but we did get the knockout. That's good. Get Broly out so we can deal with the others. Get him to the corner. Get him to the corner. And I know we just let him out. We probably should have gone with Yamcha, but he reflects after these. Watch. You'll see. He reflects. He reflects. He's scared, but in a different way. We're getting down heavy. Trying to stall out as much time as possible. I should have blocked low. I always go for the reflect in case they try to 5L. Oh, well, base Goku's not the most important character right now. Get him out of here. Oh, okay. Come on, boys. We're one away. We're one away. Does he try to go for the cheese? No. Don't get too fidgety now. Okay, you got me. You got me. You got me. You got me right in the chest. Dude, Yamcha is not good in those situations. They're rare. Can we hit the... Can we hit the big Goku souffle? Now with added on Goku? Double the Goku? I tried to hit him with the comment. Kick him in the face. No, he didn't do it. He didn't mash. Oh, that was... That was unfortunate. But is that the rank up match? Here we go. Oh, my God. Oh, my God. I'm so, like, broken mentally that I don't want to be here. I really do not want to be here. Oh, I'll make it all sorts of mistakes. I've never seen this many ranked points. Don't you want me to be happy, Dragon Ball? Aren't video games supposed to be fun? Come on.  He is desperate to jump. Let's try to use that. Oh, this is almost a 50-minute recording. These rank up videos are going to be the death of me. He's dead. He's not dead. Every time I drop it, I drop. We're not recovering that. I didn't block that either. That was just my bad. I wasn't sure what side I was going to be on by the end of that. I won't even try it. Okay. Yeah, let's go. Finally. Oh, baby. We are finally here. One, two, three, let's go. One, two, three, let's go. You got hit by the last jab. I was coming in for that mean mix. Oh, is that techable? No, okay. I just wasn't the usual combo route. That's fine. That's fine. That's fine. That's fine. I think we should probably get Yamcha out. So if he dies, it's like no big deal. We'll have to see how we're feeling, though. No. Jesus, look at the damage. It cancels out our healing factor. Commitment. Let's get this man. Let's get this man. And you know he's going to reflect here. Let's not even... He reflected during the cutscenes. I promise. I promise he did, dude.  I didn't have a bar, so I couldn't be a standard Yamcha player. Oh, my Yamcha. Oh, no. If we get hit one time, we're dead, actually. Get him out of here. We wreck it up. We wreck it up. You thought that was it. You thought that was it, but it's not. Let's go. We are out of here. Finally, at the 50 minutes. Yo, that was... I see why you did it now, Dragon Ball.   There was no need for this to happen. There was no need for this to happen. I've never seen that before. I have never seen that happen before. Damn. All right, well, I'm going to go ahead and wrap it up here. Hopefully you guys enjoyed it. If you did, make sure to let me know your favorite moment down below in the comments. While you're down there, if you like the videos on the channel, make sure to hit the like button and subscribe. Other than that, we got a few more videos up on your screen right now, so make sure to check those out if any of them catch your eye. I have been Dr. Doi. Thanks again for watching, and I will see you in the next video.


extreme example of agora sadhana, where they live in the graveyards, in the cremation grounds, they eat the meat of dead bodies, they drink from the skulls, they cover themselves with the cloth that has covered a dead body, they smear themselves with the ashes of dead bodies and they do that for 12 years as a sadhana, to be able to detach from the aesthetics of the senses and to be able to see, to touch with their fingertips the transient nature of life itself.


Guys first off my name is Silent Mike Mike Farr today Bless you a lot of allergies here in Sacramento. You guys are calling me drippy nose. I appreciate it All right, I understand you're paying attention to my nose and the drips coming out This is the city of trees is allergy season both Connor and I are suffering alright bear with us bear down today We won't talk about cardio. I want to appreciate the millions and millions of Supporters and feedback we get from Kaizen but we get some common questions So I thought I'd cover them here for those in our newsletter if you want to get involved It's in the description below for those on the YouTube channel appreciate you give this thing a thumbs up We're gonna talk about high-intensity interval training hit It is a common buzz word, but it's a great effective way to get a little bit of cardio a little extra burnin So main difference is here when we're talking about low-intensity cardio high-intensity cardio or kind of moderate Couple basic ways to define them low-intensity in my head means that you can kind of hold the conversation You are breathing heavy, but you can hold the conversation. You can also hold that pace for 20 30 45 minutes maybe even hour plus depending on the shape you win high-intensity cardio has to be done in intervals because you're going so Freaking hard on such exercise as you're going you can maybe only go 10 20 or 30 seconds So that's kind of the main definitions now When and how to use them there is some research coming out that maybe shows when you're doing high-intensity Interval trainings that you're more likely to one either convert Type one to type two muscle fibers type two muscle fibers are the more explosive kind of the strong ones kind of the jump fast Be quick muscles while the type one is kind of a muscle endurance type muscle. So there may be some benefits there To the other benefit would be time You can get done a really high-intensity interval training session in 10 20 minutes Maybe a half hour if you're in really good shape depending on the exercise and then I Guess maybe just to There's other benefits, but low-intensity cardio another benefit Maybe it's obviously lower impact most of the time you can do an elliptical or even just walk So your joints don't suffer as bad. I guess the negative then would be you could need a little bit more time to burn Those calories and three it is not necessarily as anabolic per se then High-intensity cardio now some of my favorite high-intensity cardio is for you guys that are on some of our Kaizen fat loss programs are on your own journey, whatever it may be or you just want to get in a little bit better shape Any kind of sprint so I particularly like some kind of a sled sprint a Hill sprint or an assault bike. I like those because there's some type of resistance So you're less likely to get injured You're less likely to pull a hamstring when you're kind of running against resistance with the sled or uphill I think the resistance if you find the right sled and weight in the hill It obviously remains the same But you can either add more rounds or you can add more load Meaning going further on the hill or finding a steeper hill or literally adding more weight on the sled to progress And it just like every other training we do with a barbell or whatever may be the goal should always be to progress If you're doing three sets of 10 seconds for the rest of your life You're not getting any better and your body will adjust to that stimulus and you won't improve both cardio vascular or The calorie burn that we're going for so what's a basic breakdown? It kind of depends on your fitness and it kind of depends on how hard you can go because the more power output you put depending on the Exercise obviously you can't do as much and if you're in better shape you can do a little bit more But good basic place to start is 20 to 30 seconds all out and what I mean all out is you're really pushing yourself to your absolute limit Let's erase that a Really good basic protocol for any high intensity interval training is one you got to choose the exercise It could be a kettlebell. It could be an elliptical assault bike sled sprint hill Sprint something of that nature even running stairs. Those are some of my favorites Let's get a nice easy warm-up in so maybe five to ten minutes Just nice easy kind of jog or walk to get general warm-up from there basic protocol We want anywhere from five to even all the way up to maybe 15 rounds 20 seconds to 30 seconds all out and when I mean all out I mean absolutely all out everything you got into that sprint or into that on time Then we're going to take about a minute to a minute and 30 fully off or moderate depending on the exercise So if you're doing sled sprints what you do is sprint all out for 20 seconds, and then you could walk maybe a lap To recover and then sprint again If you're doing a hill a good way is to sprint all the way up as hard as you can and then walk Maybe down and then rest at the bottom if you're on an assault bike sprint as hard as you can 20 30 seconds And then just cruise for another minute minute 30 We want to repeat this process five to again 15 times if you're newer Maybe do 20 seconds on 130 off three to five rounds And then every two to three weeks try to bump that up whether it means you're going harder on the sprint shorter on the recovery or upping the rounds again if you're in really good shape and you're doing a Sled sprint or a hill you can add a load you can add distance you could find a steeper hill something like that Those are the ways we progress in this and I guess the goal for everything is progressive overload So you don't want to just do the same routine over and over we need to add some kind of stimulus and with sprints That has to be longer work periods shorter rest periods or Even harder loads or higher intensities and the faster and better shape you get the harder You'll be able to push so make sure you're really pushing yourself all out the entire time Ladies and gentlemen silent mic on this one just a quick topic a quick high intensity breakdown Hopefully you guys can help you out in your general fitness getting a better shape fat loss Whatever it is becoming more explosive Appreciate you give this thing a thumbs up share with your friends selling Mike. I'm out of here


Okay, thank you for bearing with us once more. Good afternoon, welcome to Kubernetes AI Security Claybook. We will introduce ourselves momentarily, but thank you very much to the organizers for putting on another wildly successful open source summit in a distant corner of the world for us from London, and we feel very welcome here. So thank you for having us. I am Andy from Control Plane. We're a cloud native security engineering consultancy, and I'm proud to be involved with some other illustrious organizations. I work as co-chair in CNCF Tag Security, where we look to help assure open source and CNCF projects as they rise through incubation and graduation. We'll talk about some of the work that we do there later. I'm also CISO at Open UK, which is a charity which works to advise the government in the UK to try and avoid bad regulation. I'm very lucky to work with some other people who are here today, and various other things that I've been involved with over the years, and my illustrious colleague, Jack. Hello, yes, I'm Jack. I've been at Control Plane for a while now. I've got an interest in engineering, security, done lots of threat modeling at Control Plane. I did a talk yesterday at Open SSF Day related to software and the kind of pipeline for that. Today we'll be looking more at the pipeline for data and ML. I'm a package maintainer, and I'm on the INTOTO steering committee and helping out with that, so that's me. Wonderful, and for posterity, this is what Control Plane does, and these are some of the places we're very proud to be involved with, and with that, what are we going to talk about today? We'll run through a brief introduction to the AI ecosystem, and briefly talk about levels, the types of AI, different use cases, and then move to focus on the tooling and the mechanisms of the AI and ML lifecycle, so the delivery of models and ultimately inference. Based on that, we'll try and gain an understanding of the problem space of securing such a lifecycle, which, as we'll see, is a non-trivial task with a lot of opportunities for malicious users to inject problems, issues, poison, all sorts of things. Then we'll get into the most interesting technical parts where we will form a threat model of a hypothetical satellite communications AI system. We'll use a threat modeling methodology, which is something very dear to my heart, and navigate through the MLSEC problem space and identify risks and security controls to mitigate the most common and some less common threats affecting AI and ML. So, let's start with an introduction to the various different types of AI. The current and most basic level is what experts call artificial narrow intelligence, or weak AI. It's developed and designed to carry out a finite number of tasks, such as reactively answering human questions and can operate only on a predetermined set of data. Examples are Siri, Google Assistant, Alexa, and student's best friend, ChatGPT. The intermediate level of AI is artificial general intelligence, or strong AI, which is an aspiration for the next decade and theoretically fits at this stage. Examples could be HAL 9000 data from Star Trek or Skynet in Terminator. The major differences here are this is a human-like AI, and more importantly, can adapt to new, rather than operate on predetermined sets of data. And then we get to the truly hypothetical and academic level with artificial superintelligence. This is possessing superhuman transcendental properties, and it's characterized by a continuous sense of self-improvement. Examples are Ultron from the Marvel Universe, or Giscard from Asimov's novels. So it's a fairly wide problem space. The definitions are a little bit muddy, and there's a number of branches. So in order to clarify exactly what we're discussing and provide an overview of these, we'll talk about where ML sits in this landscape. Machine learning, and this is the use case we'll focus on, this specific branch of AI, focusing on the mathematical formulae and statistical models that computer systems employ to carry out operations without being explicitly programmed, delegated intelligence. Instead, they use machine learning to take what they've learned, and from the present context, generalize, generate new programs and new understandings automatically, essentially modifying their execution, and to subdivide even further, within the ML branch, we have three different types. Here you can see the typical techniques and use cases for each. We have unsupervised, reinforced, and supervised learning, broadly unsupervised learning, it's analyzing data without predefined labels and looking for patterns, clustering and unstructured data. Dimensionality reduction is an academic way of putting it. Reinforcement learning, which is how we've seen DeepMind do a lot of things with learning to play games, where an application observes this environment, has some feedback mechanisms related to rewards and punishments for performing separate specific behaviors. Game playing and robotic control are finally supervised learning, which humans actually label that data, and there is some intersection between the two, because, for example, chatGPT is supervised reinforcement learning, where humans intervene into the feedback loops to reach you in the model. So yes, they intersect somewhat. We've got classification, regression, at this point, we don't necessarily care so much about the differentiations between them. So that is the quick background to AI. Thank you very much. So yeah, if we're gonna look at an AI platform, an AI-based system, we need to kind of look at the entire lifecycle, so sorry for that. Yeah, this will be how you get from your data, you train it, creating the applications, deploying them, kind of everything in this space. Click. There we go. So yeah, we're gonna take a look at that process. So this is a cycle that many of you will be familiar with. If you're not, this is the kind of DevOps lifecycle, something we've had to look at many times over the last decade. It's the approach that people typically take to build applications, deploy them, keep them running, improve them. It's kind of your continuous improvement process. And when people went to AI, they were thinking, well, maybe we can get something similar to this. So here we've got the data ML loop. So this is obviously a very similar structure. We're gonna be collecting the data starting off. We're gonna curate it and process it and then we're gonna develop our ML. So the next level is combining the two because we don't just want a model. We want a model to be useful. So we're gonna integrate it into various applications. You don't just stare at a model for, say, chat GPT. You interact with it through a chat. That's kind of a key part. If you can't use it, it's not of benefit to you. So you need to combine these processes in order to build your model, improve it, deploy what you're gonna be using to interact with it and continue that process. So throughout the last couple of years, there's been a focus on security to do with DevOps. So many of you have heard the term DevSecOps. So that's the process of taking this section of the graph and making sure the processes work well and secure. But there's a big chunk of this graph that isn't covered by that. So that's kind of what we're gonna get into today to kind of secure the whole process dealing with data. It's a bit different, especially with massive data sets. You can't treat it exactly the same way as software. So there we go. Back over. Okay, so to understand how we're going to perform these security enhancements, we need to understand the problem space that we're dealing with. And so as usual, with newer and cooler stuff, we have more complexity, more layers that we need to assess and secure by design, secure by default. These are words now coming into ordinances and edicts from the Biden administration. We have the good old infrastructure layer that we know so well. AI is still running on TIN or virtualized machines. There may be custom GPUs or tensor processing units, but ultimately these are all quantifiable and reasonable processes, be it sort of standard or in vector form, but it's just infrastructure. There's no explicit magic there. But then we move up to the orchestration layer, which is used to actually define and execute the operations on the data and on the model itself. But it's equally important, and this is what we'll get into, to secure the data layer and associated operations. Because data plays such an important role in ML ops, it is, of course, the lifeblood of any organization, but even more so when we pump all our IP into one place and then put an API on the front of it. So it's crucial to secure these operations and finally, at the top layer, any application leveraging the models is an entry point for an exposure of the model which we need to secure. Of course, if an attacker is able to get in front of that, they can also falsify the results from the model, but we'll try and focus on those core bits in the middle. We'll assume we have a benevolent application developer with a reasonable expectation of security and that we're running on a shared responsibility model with shared infrastructure in a cloud provider of some description. At the exploding complexity of this is reasonably overwhelming, so we won't get into this so much now, but this is a high level view of the end-to-end process from data to end user. And of course, with every interaction between components on the entity model, there is an opportunity for hostile interaction. So the main challenges around securing MLops have to do with the complexity, the dependencies, and the data flows. And it's a multi-dimensional problem that encompasses, amongst many others, data security, model security, access control. Of course, there is a supply chain involved in all of these things and we solve this with threat modeling. Thank you. So yeah, threat modeling is something we like. And in this case, we've got kind of a massive problem. And when you start threat modeling, you really need to work out what you're gonna be doing. So we'll take a look at the hypothetical and you should start to get the gist of what we're focusing on. So in this example, there is a company. They have several spacecrafts. Various different satellites. And these satellites are sending massive amounts of data through to base stations. As you can see on the graph, this'll be insane amounts of data, thousands of data points a second. And then this gets sent through to a central location or maybe a handful of locations on Earth so that you can process it and you can see a little diagram there, a little dashboard. So the idea is they're using this data to produce dashboards about the status of these crafts in space. You can't exactly look at them to see if they're doing right. So you need all of this data and you need a way to go through it and find out if something's wrong because if something's wrong in your satellite and then if it collapses, that's a big problem. So on this slide, we've got like a little treat. This is essentially the kind of legacy process of trying to work out if there's any issues. So you can manually write a program or a policy that has various different ifs and elses to process the data and work out. Is there an issue? Is there something out of spec? But this is a kind of reactive process. This is very manual. There are gonna be things that we miss here. And then the company in this case wants to do something that's less reactive, more predictive, try and see trends to fancy machine learning stuff. But I'm more focused on the security part of these things. So this is the stack that they've got for what they're proposing to do for the machine learning. So we've got an infrastructure layer.  We'll have an operating system, in this case Linux. And then we've got Kubernetes on top of that to orchestrate everything, distribute it. It's a common thing with machine learning that you need a lot of compute. And in order to distribute your jobs, you'll want something to do that. So we've got Kubernetes. And then on top of that, we've got the machine learning E-part because out of the box, Kubernetes doesn't really know what to do. So Kubeflow is a great kind of tool that you can use to distribute your TensorFlow jobs. And get your machine learning and training done. And then we've got the front end apps. So that's the part where you're going to be using the models that you've created. And then hopefully seeing that there's a problem and being able to address it before the satellite explodes. And then yeah, with threat modeling, you cannot look at every single individual detail of the entire universe. We have finite lives, so we need to do finite tasks. And that's why we've got a couple of assumptions and a couple of things we're gonna just completely cut out. So an assumption here is that we are dealing with pretty serious adversaries. So this could be nation states because we're dealing with a serious topic such as space and satellites. And then we've got the fact that the machine learning in this case will not be directly talking to the satellites. It won't have any control. So that's not something we'll need to think about in this exercise. It'll just be for the anomaly detection and the reporting. And then yeah, it's not gonna be talking to the satellites. We're gonna have the data traveling on the earth through these orange paths. And yeah, most of the lower level stuff will be out of scope. So this is another diagram. It shows kind of the architecture, the data, where it lives and where it'll go. So we can see at the bottom the kind of operating system. We're not gonna think about it today. We're gonna try and keep it to the higher level stuff, the stuff more relevant to machine learning. You could do, say, a separate threat model just for Kubernetes. It would apply to most things. We're gonna look at the parts that are just important to ML. The infra admin, there's gonna be some aspects in this threat model, threat modeling that will go over kind of aspects of their work. And then the important part is the person interacting with Kubeflow. So that's gonna be the people trying to do some of the access to the data. And then above that, we've got the data scientists that are gonna be trying to train the data. Train the model, sorry, from the data. You can see we've got some little platters. That's where the data lives. We're going to ingest the data from the orange line there. We need to then prep the data. We need to then train these pretty common aspects to machine learning. And then once we've got our model, we need to then deploy our application that we're gonna be using and monitor it. And here we go. So this goes a bit more into the data scientist job, what the data scientist is gonna get up to, and also where the data lives. So if we think about the process, we've got the ingestion, the cleaning, the normalizing, all that stuff, and what are the kind of dangerous bits, what are the issues that we can think of, what are the dangerous attacks that people could do? So if we take a look at this, we've got the data kind of coming in and being stored in our initial storage. At this stage, people could potentially mess with the data. They could add erroneous data, which could potentially ruin a model. They could modify some of the data to make things that potentially look bad look good. And just generally reduce the quality of our data. And if you put rubbish in, you'll probably get rubbish out. And then at the next stage, we've got kind of the cleanup process. Obviously, if our data is in a good state, cleaning it up should be a bit easier. But if that process isn't undertaken correctly, then you won't have correctly prepared data. At the kind of labeling stage, if people are able to put incorrect labels, that's also going to cause issues. And then towards the bottom, again, we've got the similar thing. There's both the storage points have the same risks. And then here we've got controls. So whenever you have kind of attacks and threats and risk, you think about how you can mitigate it or control that. So things we can do to protect against these parts is we can sign some data. We can't sign everything because just the sheer amount, like you might be able to sign every piece of software you're building, because it's relatively small, but machine learning data sets are massive. So you can sign a subset of that data and then you can audit a subset of it.  But yeah, you can't do it for every single piece of data. You want to make sure that the access to that data is least privileged. So in theory, you don't want any humans to have any access. You just want the systems to have the right access. And then systems that write should only write and systems that read should not be able to write to those data sets. And then networking, there's kind of some parallels to do with storage, especially when you've got something like Kubernetes where you maybe aren't physically mounting the data. You're probably in a data center with the centralized storage that's on the network. So similarly, privileged stuff applies to networking with data.  So on the cleanup stage, we want to make sure that the data scientists, the humans that are interacting with this data, the work that they're doing kind of gets tracked. If they're doing specific work, you could say keep track of that and then have someone sign that they did that work. You can look at the kind of permissions on the tools they're using. So in this case, it's Kubeflow. So you can make sure that Kubeflow has only access to the right things. You can make sure that your users only have access to the right parts of Kubernetes. And then you can also do kind of spot check reviews or manual reviews of the processes that these data scientists are going through to make sure things are accurate. And then deeper into the storage, on the pipeline storage, we've got some extra policies to make sure things are correct. And then we've got the training and the tuning. So this is slightly further down the life cycle. And again, if we think about problems that are possible, we've got various different tampering again. You'll see tampering a lot as a risk when you're dealing with something like data because you want to keep it to a high grade of quality.  And then, yeah, if you have this kind of pipeline that is doing these automated, it's not builds, but kind of training sessions, you want to make sure that those are provisioned correctly. And if we go to the controls, we can save for the scientists that are interacting with the platform that they are authenticated and not just authenticated, would say passwords, but you want to have MFA. So physical keys are pretty good. Pass keys is kind of a new concept to replace passwords, which is something to look into. At this point, you might be like actually writing down various different weights and things to apply to your model as configuration in a code base. So if you are kind of committing code, the same things apply as with a developer. You should look to sign commits. You should have the two keys principle, which is that essentially you have peer review. So no one person can merge a change to the weighting. And then, yep, we've got the same kind of policy stuff around this, the storage and the access to that. And then I'll pass it back over to you. Thank you very much. Yeah, as Jack says, with such a high volume of data, then you can just map it to the CIHR ad. The confidentiality of the data is often very important when there's a weight of intellectual prophecy that's potentially in these models. The integrity, as soon as something is poisoned, maybe it's as simple. It's not as simple as an office space-esque putting fractional pennies in someone else's account, but it's far more insidious and surreptitious. You often can't extract training data from the front of the model, so you can't quantify why it's made a decision, which means that that poisoning becomes almost impossible to reason about. And then the availability, you can probably tell if the model's offline, but those two initial pieces are repeated problems across this problem space. When we get to deployment, we have been through the process of taking that core data, training, tuning. We've got something that we believe is operational for whatever level of test integration we perform, probably a manual step. It is difficult to get typical deterministic testing out of non-deterministic models. So it is more about sampling. There's a sound right. You can see how difficult this is by the advancement of chat GPT between three and a half and four. It looks like sometimes it regresses in quality of output. Same thing with Google's bar, there's the two big ones right now. So testing just means, well, okay, let's just ship what we've got right now. Hopefully it's improved in quality. And we get to this question of serialization. So we have a model that exists in a training set or in a training environment, and we essentially turned it into something that can be deployed into a different environment. And this trained model is converted into files which represent the model and then are loaded into an environment or an application that allows them to be queried and used and the inferences questioned and gained. This is a point of compromise for the entire system. I mean, as with any pipeline, it is cumulative and builds upon previous stages. So at this point, this is kind of like a packaging step for an open source application. You compile something, but that is distinct from packaging it and pushing it to NPM or Maven Central or whatever it looks like. So a lot of these things are analogous to the way we build software. We're just building a much bigger thing without the universal possibility of actually compiling it because of the prohibitive costs of compute. So we cared deeply about mitigating these threats in particular. What else do we have? So if we start from the serialization point, again, this tampering or poisoning, tampering might be surreptitiously altering the data. Poisoning might be just, as Jack says, putting some junk in. Maybe that reduces the quality of output. Maybe it, again, from a sampling perspective, reduces the percentage of times you get the correct output. They're essentially the same thing for the purpose of this, although certainly different. We actually want to test the model somehow or other if we have, for example, a rogue model that is able to answer the test suite because it's been pre-trained on the actual test data, but then in sort of wider usage, it returns malicious data from our kind of satellite perspective that could be pretending that all the telemetry is good when it's actually been taken under control of a tractor beam or some equivalent spacey related thing. We're looking down at the actual image registry, again, for tampering and poisoning. The serving of the model then, hold on, let me just work through this properly, got another storage question with tampering. We're getting to serving, so this is where the application that the user is querying to interact with the model is responding. So as I mentioned at the beginning of the model, we can, if I was an attacker, and I was able to get into the request path, so be that intercepting an HTTP request, sitting behind a terminating TLS middleware box, just intercepting traffic and rewriting it, invalidates the whole thing, but that's standard, that's no different from anything else. It's the question of trust that is put into these models to actuate or make decisions for people that makes that a little bit more, again, nondeterministic and difficult to detect from the front end. And that model abuse via unsecure ATTPM point assumes that at some point we're behind the firewall that's performing our termination. We're assuming that the transport layer security is fine in front of that. And finally, that's serving to front end point where the model is misleading via data input. Again, that's from back in the model as the cumulative pipeline builds. So the point being for these is that we get back to things that we recognize from supply chain security. A lot of what we've spoken about, we can look at as a kind of ML ops with Salta as in the supply chain security attestation levels. The supply chain security pieces we do are related to signing. Cryptographic signing is the person in charge of that key at that time, sufficiently liked the thing in question to give it a stamp of meta approval of some description. The quantity of data that we're talking about here makes it very difficult to do this for each and every piece, as Jack's pointed out, but we can perform this as interstitial signings. We can sign evidence about training and log data and we can sign the hash of the model files, for example. So we know that as the data is passed along the chain from producer to consumer and in that continuing chain, then the provenance of the thing being passed along is sufficiently validatable that no one can intercept it and get in the middle there.  So digital signing and evaluation of attestation in Kubernetes terms, this is admission control. We care about is this thing signed and do we trust the person that signed it and is the signature reasonably fresh? Is it within an expiry window that we trust? Because, of course, if we look at another classic supply chain framework, the update framework, which in total in the update framework, similar in the way they deal with these things, a freshness and recency attack of a replay of a piece of software that is, at the point it was released, it was signed, it validates everything, but if it's two years old and someone gets in the middle and replays that, it might pass all of these checks if we're not also checking for the freshness and recency. Often we see keys that don't expire for non-trivial numbers of years. Through into testing, again, the digital signing of every component that we pass through just gives us that one extra layer of confidence that the thing that we've received is the thing that someone else meant to give us. Admission control, of course, test results, attestation, this is something that is often not necessarily bypassed but not given due care and attention, that the first real supply chain consideration framework, let's say, for Cloud Native was in the form of Graphius, which came out of Google, based on their binary authorization bits and bobs, and it took them about two years to argue that they needed a way to sign abstract test evidence, because many times, especially in highly regulated industries and environments, somebody is probably doing a visual check or taking screenshots of things, and there has to be a mechanism to recognize that in our fully automated pipelines because, unfortunately, not everything is automated and built with an API. We get to, yeah, of course, requests throttling age to be traffic sanitization while denial of service for a model, it's not really that serious.  HTTP traffic sanitization kind of depends where you are. You'd also want, of course, intrusion detection as the last line of defense along with preventative and detective controls, some automatic mediation into what Kubernetes can do by default with Cloud Native application platforms and probably the most difficult thing in the entire talk, input validation and sanitization, it looks like because AI models or large language models are built to emulate humans and humans can be conned by con artists. We're in this catch 22 where we might not be able to actually prevent people from messing with prompt injection at all. So, TVD in the top right hand corner, I would scope that outside of the threat model out of capacity fears. Right, so that is the high level of how things are terrifying and there are ways to fix bits and bobs. Kubeflow is a reference implementation of an AI pipeline tool belt. It's multifaceted. It can do things other than TensorFlow. It's a significant project and so warrants the threat model itself. So we need to scope it down or even better do it at the higher level of abstraction. So this is a data flow diagram as we saw earlier for a Kubeflow TensorFlow reference architecture. We will not go into too much more detail but pipeline components here, the self-contained sets of code that perform one step in an ML workflow, such as pre-processing data, training the model, et cetera. And we must build the components implementation that describe the specifications. The component implementation includes the executable code and the container that the image is running in, interactive environments for writing and running the code, creating visualizations, narrative formats. It's widely used for data analysis, model development and research. And the call to action, if you are interested by any of this stuff, tag security is threat modeling Kubeflow as one of the next pieces of work we do in the community. We're currently doing the vSphere CSI driver. We've recently done Flux and Argo CD. One of the greatest pieces of work we have is the Spiffy Spire threat model that we've done before. So this is what we do for the CNTF in terms of giving the technical oversight committee a security and assurance based view on the projects that come through. This is a reasonably significant piece of work that we'll be doing. Obviously we've had the immense pleasure of doing some preparatory threat modeling. Kubeflow have just stood up a security team to interact with us as well. So yes, exciting times if this kind of thing floats your boats. And there is a non-exhaustive list of further threats that the system may be vulnerable to. This is what we do for a living. If you would like to talk to us about this, please do find us afterwards or on all the various things that exist. So threat model everything. We can't quantify our security controls if we don't understand what we're doing and unquantified security controls lead to systems that end up as constrictive straight jackets where people in maintenance mode are unable to make a single change to the system because some disembodied security team before them has implemented controls without a pay for trial, without quantified, qualified controls. Threat modeling is a glorious way of preventing that particular organizational anti-pattern. Common threats still apply to AIML. There's not very much here that you wouldn't expect. There are some slightly wider pieces about the massive scale that these things work on, but ultimately they're still computers and it's still supply chain security. Configuration is part of the supply chain and configuration of the model is very much part of the outputs and the efficacy of the usefulness of the thing. These threats can be complex. These are some big threat models. Threat model Kubernetes is back in the day and it feels slightly more cognitively challenging. Just jump into this. Of course, collaboration is always required and keep up with regulations if you want to stay relevant because we're not really sure what they are. And with that, there's a free book there. Thank you very much for your attention.


Hey y'all, welcome to What Chelsea Eats. Thank you so much for joining me today. In this video, I am going to share with you this recipe for a healing white bean soup. I love making soups in the wintertime. It helps to keep you warm. It's cozy. And the key to making a healing soup is to make the soup very clean. So if you want to see how I make this clean healing soup, then stay tuned. So to make this recipe, I am going to be using a soup pot. I'm going to be using my 360 cookware. You guys know I love 360. If you're interested in learning more about it, there is a link down below where I've done a review video. And there is a discount code if you decide you want it. It's WCE 25. I don't cook with oil, so I'm using no sodium vegetable broth so that I can start to saute my vegetables. Also, I will put all of the ingredients that I'm using in this recipe down in the description box below this video. I started off with baby onions. I absolutely have fallen in love with these baby onions. They add so much flavor to your dishes. And I've got garlic. I used four or six cloves of garlic. You can use more or less. You can leave it out. I'm just a garlic fan. So this is a very garlicky soup, but you don't have to make yours garlic. You can make it your own.  And the next ingredient that I'm going to add are my carrots. I had this huge carrot that I wanted to add to this recipe just to give this soup some body or some texture. And I'm not even sure that's the word. I think maybe something to make it a little more filling or dense. So I added the carrot and it was the perfect addition. Because whenever I saute my vegetables and I make soups, I don't cook my vegetables to death where they're all soft. So whenever I take a bite, there is a slight crunch through the vegetables when I eat my soup. So I let the vegetables cook for a little bit and now it's time to add my mushrooms. I have chopped some portobello mushrooms. This is about two cups of portobello mushrooms. And I absolutely love mushrooms in soup because it gives you a meaty texture, especially if you use mushrooms like the large portobello mushrooms or shiitake mushrooms. It actually adds a denseness to the soup that it wouldn't have if you didn't add them. So you stir that around and let that cook for a minute. Doesn't that look delicious? All those flavors just melding together to make this delicious pot of healing soup. Next I'm going to add the no salt diced tomatoes and start around and get it combined with the other soup ingredients. Now I'm going to add the spices.  Everything that you need to put in this recipe is down in the description box below. So once you get those spices in there, you stir them around and let the flavors meld into the vegetables.  Next I'm going to add beans. If you don't eat beans or if beans don't agree with you, you can add either another vegetable or you can add lentils to your recipe. You can put whatever you want in this recipe. You can even add more mushrooms. Whatever is going to make the soup good for you in your lifestyle. But I love the way the white beans taste in this soup recipe. So I am on a quest to eliminate added sodium in my food. So one of the things that I add to help with that is lemon juice or lime juice. It helps with the salty flavor. You can also add celery salt, which there is a video on this channel that I did I think last week regarding celery salt. But if you are somebody who has high blood pressure, you have anemia or you are addicted to salty foods, examine yourself and if you need to remove the salt from your diet, you might want to take some of the tips that I'm sharing in this video as far as how to replace the salty flavor in your food. Now there's nothing that's actually going to actually completely replace salt. But if you use salt substitutes, you can healthy salt substitutes I should say. You can eliminate that craving for salt. So I added the rest of the vegetable broth to make this into a liquidy soup I should say. You can use more or less vegetable broth. And the vegetable broth that I use is no sodium. The next thing you're going to do is cover it, bring it to a boil and let it simmer for about five minutes. And then we'll have one more ingredient to add and then we'll be finished.  You can use whatever greens you like. I have spinach on hand, but you can use kale, chard, whatever kind of greens you want to use. And all you have to do, since the soup is very hot and simmering, is stir the greens into the soup and let them wilt and it's ready. You don't have to let it cook any longer. The heat from the soup is going to cook down the greens just a little bit. Now the soup is completely done. This healing white bean soup, all you have to do now is just serve it and eat it. Please tell me if this is the kind of soup you're going to add to your rotation. If you have suggestions on the types of recipes you'd like to see, please let me know in the comment section below. If you like this video, please like it and share it with a friend. If no one told you that they love you today, Chelsea in North Carolina loves you very much and I'll talk to you soon.