horse of the speed of light, a cloud of dust, and a hearty, high-o silver, the Lone Ranger. The heroic deeds and actions of the famous masked writer of justice live on and on, despite the fact that the history of the United States does not record any of his stirring adventures. Today we thrill to another daring ride with the phantom figure of the plains. Here he comes to stride the great horse, Silver, the Lone Ranger rides again. Town of Bixby was a typical mining community of the old west, supplying the necessary equipment of the prospectors, and providing recreation for those who had struck it rich enough to patronize the many cafes lining the main street. Lempervis, a seasoned veteran of the hills, was celebrating the sale of his gold claim, and as the action of our story begins, we see him surrounded by a number of his friends. The Lone Ranger, unmasked but wearing a disguise, is also present. Boys, the drinks has earned me.  Lempervis is buying. What a celebration. Lem sold his mine. Got $200 for it. Come on, join the fun. Lem's luck has changed sure enough. Won't Tom Gordon be surprised when he hears about it? He ought to be. He told me this here sample of all what, no good. Told me my mind was worthless. First worthless mine I've seen to pay $200. Yes, stranger, it ain't even worth the effort of digging it out in the ground. What do you mean?  It ain't no good. But that eastern dude, Carter Dodgson, bought my mind, locked, stocked, and bought when he's seen this here sample. How do you know the sample is worthless? And I know. That's a good one. I took it to the assay office and had the assay clerk, Tom Gordon, test it for me. That's how. And Gordon, he said the mine weren't worth working. When Carter Dodgson offered to buy your mind, did he know about the assay? Of course not. Dodgson came snooping around with that sneering way of his and thought he was putting something over on me, buying the mine for what he paid. I just shut up and let him talk himself into buying it. Never did like that, Dodgson. Well, I know how. He's got it coming to him. About time he was given a little of his own medicines. Licked up, easterner. Carter Dodgson represents the gold mining syndicate, doesn't he? Yeah, that's right, stranger. Has he been here long? Nope. Come from the east about two months ago. He's been trying all sorts of tricks on the boys here. I'd like to see his face when he finds out that Betsy Ann is worthless. He'd sure be mad. He might come gunning for your land. No chance of that. He's an easterner, ain't he? Man, I see that sample of oil. Chuck, stranger, no reason why not. It is. Say, I ain't seen you around these parts of four, have I? I don't suppose you have. You seem powerful interested in things and you sort of talk like an easterner. You ain't a friend of Carter Dodgson, are you? I don't know, Dodgson. That's strange. Oh, what do you mean? What do you mean? This or is rich. No, it ain't, stranger. All it is is fool's gold. I thought it was gold at first, but it ain't. This is not fool's gold. I had a test to tell you. There's Tom Gordon heading this way. He can prove it. He's in the assay office. Tom, come here. Lamb wants you. I'm coming. Hey, Lamb. Gosh, he's excited about something. Tom, listen, we've been caught enough. That or of yours? What about that or? I don't know how to say it. What is it? What's the matter? I made a mistake, Lamb. A mistake? Yeah, an awful mistake. I gave you the wrong assay. The wrong assay? You mean on my mind? Yeah. You found Lamb's order be valuable after all? That's right, stranger. Lamb, I don't know what to say about it. I heard about you selling the Betsy Ann. You mean to tell me the Betsy Ann is worth something? Yeah, that's just it. It's worth a lot, Lamb. I can't believe it. It's the truth. I wouldn't have had it happen for nothing. But I... How valuable is the Betsy Ann? I reckon the or run over $25 a ton. And I sold the whole claim to Dodson for $200. I wish I'd have found out sooner. I sure do, Lamb. You wish. Why you don't? Lamb, you better watch out. So you made a mistake. Yeah, I told you that. Seems to me that's a pretty good mistake you made for the Easterner. What do you mean? I'll tell you what I mean. Dodson stands to make thousands of dollars out in my mind. Yeah, but I'm... And with two days around the assay office, you didn't find out the mistake till I'd signed over the mine. I know. But, Lamb...  You don't make much money on that job of yours, Gordon. You might be able to stand a little extra cash, Mike. Yeah. Lamb, you... I've been slaving for years to get a good claim, living from hand to mouth. And then you make a mistake. I've been robbed, that's what. You'll rob me of my right for money. Careful, Lamb. You keep out of this, stranger. I'm beginning to catch on to things around here. He's got a gun. Lamb, don't shoot. You can't do it. I ain't got a gun with me. You can't shoot me down. You'll change them samples of purpose, and you'll pay for it. You can't rob Lamb Berverson. Get away with it. Lamb, put down your gun. I won't. Gordon, you're gonna pay. No! My hand, you shot me. You're not hurt, Lamb. I simply knocked your gun out of your hand. I could have got that crook if you hadn't interfered. You shot Tom, Gordon. You'd have hung for murder. Absolutely. But he stole from me. He's no proof of that. It's your word against his. That's right. I swear it was a mistake. A darn convenient one for Dodson. Quiet! Gordon, whose report did you confuse with Lamb's? Jeff's all his, mister. He'll be powerful disappointed when he finds out his mine ain't worth nothing after all. Disappointed? That's a mild word for what he'll be, Tom. Maybe he can still take that offer Dodson made him. What offer? Dodson offered him $1,000 for his mine. But Jeff laughed at him. If Dodson don't know about the mix-up yet, maybe Jeff can take up that offer. Are you going to tell Jeff about it? You're darn right, mister. And I'm going to do that same now. I just hope I'm in time. It's some ride to his place. $200. I reckon I'll clear out myself. Oh, hold on, Gordon. I got more to say to you. Take it easy, Lamb. I'll see you when you pull off, Lamb. Problem with you is you got a low boiling point. I read it. I bet he'd done it a purpose. If only I was sure... You would never find out by shooting him. Let him go. See what happens next. When Tom Gordon left the cafe, the lone ranger followed the young man. On his way, he met Tonto and told the Indian what he'd overheard in the cafe. Together, they continued after Tom until the young man stopped at a house some distance ahead. He's stopping at the widow-sim's place, Kimosame. That's where Carter Dunson is staying. That's right.  I want to hear what Gordon tells Dunson. Oh, silver. Oh, boy. Oh, my Tonto. You must go carefully, Tonto. If he sees us, we'll learn nothing. Oh, that's right. He's going inside now. Dunson, Tonto, open the door. Yes, I see. Come on, Tonto. We have much farther to go. We get near Winder. Careful. Gordon seems to be excited. Must be telling Dunson everything that happened in the cafe. Here we are. Listen, Tonto. If that stranger in the cafe hadn't shot James Gunn away before him had a chance to shoot me. That's fine, sir. Who was he? I didn't find out. Oh, what the interfere for? I don't know that either. I guess that isn't important anyhow. What else made you think these miners suspect our scheme? Oh, nothing else. Then why did you come here? I had to warn you. Warned me that a miner was angry when he heard his mine hadn't panned out like he wanted it to. Why, uh... Get some sense, Tom. Things are working out just like I planned. But I don't see how you figure that. Lem, Purvis simply lost his head when he heard the mine he'd sold to me for $200 was worth a lot more. He called me a crook. Did the rest of the men call you a crook, too? No. Then don't worry about it. All right. As long as you stick to your story, they'll think Lem's raving mad about losing money.  And even if they do, they can't prove it. At least ways, not till we've cleaned up and got out of here. That's right. And how about Jeff's owner? You think it's all right to go on like we planned about him? Why not? You don't think he'll get suspicious about the mixtase? Our scheme is foolproof. No one can prove anything against us. You made a mistake, and I was lucky enough to cash in on it. And that's all. Yeah, maybe you're right. Jeff's owner owns one of the richest mines in the region, and Lem Pervis' mine is almost as good. Yeah. You made Lem Pervis think his mine was worthless, and he sold it to me for $200. I know that, but I can't... Then you claim you got the assays mixed and tell Jeff his claim is worthless. And Jeff takes you up on that $1,000 offer you made him. Right. He'll think he's putting one over on me by taking me up on the offer before I find out his mine is no good. It's a pretty slick scheme, Dodson. We'll pay Jeff Salter the $1,000, and then when we have the deed, we'll clear out. Then send men back here to work the mines and we collect the profits? Exactly. If they ever realize they've been swindled, we'll be so far away they'll never catch up with us. When are we clearing out? All we're waiting for is to get the Salter claim. I told him I'd call on him today to see if he'd change his mind about selling. Yeah. I'll start out for his place in about an hour. That will give that friend of his time to get to him and tell him his mine is worthless. Yeah. As soon as he signs over the papers, we'll start for the East. We can't be stopped now. No.  Mines that'll yield us a fortune. We'll be rich. You'd better ride over to Salter's with me. Well, if he sees me... He doesn't have to see you. You can stay back a ways. But I don't want you too far from me until this is all settled. Why?  You're riding with me. We're leaving in an hour. And you're staying right here until we do. Salter, do you hear what they said? Me here. We must get back to our horses quickly. There's no time to lose. You got the plan? I have an idea, Talter, that might work. We just told Jeff Salter about the scheme. We'd save his mine, but that wouldn't help Lemp's purpose. But we must always find somewhere to jail those crooks. Never mind. Here, Silver, wipe on her. We'll go out and call on Jeff Salter. And then he must have a huge talk to Carter Dodson. Here's my mask, Talter. Good. Come on, then, Talter. Yeah. Hey. It's a long ride of Jeff Salter's mine. Come on, Silver. The curtain falls on the first act of our thrilling Lone Ranger drama. Before the next exciting scenes, please permit us to pause for just a few moments. Here's our story. Carter Dodson of an eastern mining syndicate and Tom Gordon, the assay clerk in the town of Bixby, plotted to cheat Lemp, Corvus, and Jeff Salter out of their claims by substituting false reports on the value of their mines. Lemp, believing his claim worthless, sold to Dodson. But the Lone Ranger in town to overheard the plot to get Salter's mine in a similar manner and decided to do something about it.  Oh, Silver. Oh, steady. Oh, wait a minute. Poor Ller. Is it Dodson? I want to talk to you, Mr. Salter. A mask man. A mask means nothing. It means just one thing to me, Mr. Outlaw. You and that red skinner after my ghoul, ain't you? No, we're not, Jeff. Then why'd you come here masked? You were an offer to buy your mine, didn't you, Jeff? Yeah, and what about it? Are you planning to accept the offer? What difference would it make to you whether I sell my mine or not? Just this, Salter. You heard that your essay was mixed up and your mine really worthless, didn't you? Yeah, but how? What you heard is not true. Oh, what do you mean? I mean that it's a scheme to get your mine for a fraction of its actual worth. You mean it's a put-up job with Reed Dodson and Tom Gordon? Exactly. Why, those dirty... Wait a minute, Mr. How do I know you're telling the truth? Where do you come in? You'll have to take my word for it, Jeff. Then all you're doing is warning me? Not quite. I might have known that Mask Man is... Wait. I told you I wanted to warn you against the thieves, but I also want your help. My help? What can I do? I have a plan to catch those crooks so they'll not be able to swindle other people. I want you to help me. During this thing I ever see, Mask can not an outlaw, helping people and wanting nothing for it. I like your style, Mr. Tell me what you want me to do and we'll see about doing it. All right then, Jeff. Listen carefully. Here's the plan I haven't... The Lone Ranger and Tonto left the Old Prospector shortly before Dodson arrived. The Easterner did not suspect that his plans were known. Move, move, move there. Move, move, move there. Hello, Salter.  Have papers with me and everything, all set to sign. I'm sure you thought this thing over carefully. I have. That's good. You can't go far wrong on taking $1,000 for this mine of yours, Salter. Of course it is worth a bit more, but... It's worth a darn sight more than $1,000 for me, Dodson. Huh?  But I thought... Never mind what you thought. I ain't selling. And just to show you how much I'm backing on this here mine, I'll tell you something. What's that? Tom Gordon made a mistaken assay in the mine and now he says it ain't worth a cent. You mean... In spite of that, I'm still holding on to it. But if it's worthless... You won't get it, worthless or not. But I don't see why. I ain't selling. Now get. Very well, Salter. But you may change your mind before a very long. Get up there.  Get up there.  So I won't get it. We'll see about that. Can't afford to let Salter's mind slip through my fingers. And there's Tom coming to meet me.  Steady boy. Well, Dodson, everything all set? All set, nothing. What do you mean? That old fool Salter won't sell his mine. Won't sell? No. What went wrong, Dodson? Salter doesn't seem to believe the story. He still thinks his mine is worth something. He told me he wouldn't sell for any price. What are we going to do now? I don't know. There must be some way to get hold of that mine. What's that? I don't know. It sounded like something moving. It was right over there. Hey, look. It's a man. He's hurt, but we said get him out of there. You come out of them bushes and keep your hands high. Me come. A red skin. And you understand English? Me savvy, me here. You talk about gold mine. A smart Indian. Maybe me help you. What do you mean? How could you help? You want mine? Yes, that's right. What were you thinking of? Maybe fellow take trip. Maybe could. A nice long trip. I was thinking about that myself. Here. You mean that. I mean we can't argue that old coot out of his mine. But there's one way of getting hold of it that's sure. You wouldn't. That mine's worth any risk, Gordon. If Jeff Salter was to disappear. You'd let this engine murder him? That's exactly what I do. Me fix Salter. You maybe pay me. I thought you might be hired. But Dodson, murder. What the Indian does won't involve us. Salter out of the way we can get his mine. How? You will see that folks think he signed his mine over to us and left town. But if they don't believe it, if we're caught we'll hang. Murder is nothing to fool with. We won't get caught. I don't like it Dodson. I don't care whether you like it or not. Do as I say. Now listen carefully. Here. I have it all figured out. The Indian will go back to the mine now and take care of Jeff Salter. You understand Indian? Hmm me, sonny. I'll pay you when you've got the job done. Tom, we'll ride back to town. Here. We'll take the bill of sale with us. You sign Jeff Salter's name. Forget. Of course. Then you act as if you've been hunting for me all day. Tell me about the mixing up of the two assays. And ask me if I bought Jeff's mine. What for? When you ask me about the mine, I'll show you the paper's proof that I bought it. Here. Then I'll go into a rage about being swindled out of a thousand dollars by Salter. And then? We'll go to the sheriff. Take him out to call on Jeff Salter. When they don't find any trace of him, they'll think he skipped town with my thousand dollars cash. I see. Then you leave town and I'll have someone else make an assay him on mine and find it might pay me to keep the paper's Jeff Salter sign. What about the engine? Redskin, you're not to leave any trace of Jeff's things. Take them all away. Hmm me, do. You'll get what's coming to you after we get that mine. When Dodson returned to town, it was taken for granted he had bought Salter's mine without realizing its worthlessness. Dodson, relying upon this impression, stormed into the sheriff's office. Cheated me, Sheriff. Maybe so, maybe not. He did. He knew that mine was worthless when he sold it to me. Can you prove that, Dodson? I'll prove it all right. I'll prove it if you'll come out there with me. Well, I. All of you come. I'm going to have the law on Jeff Salter. He can't swindle me like this. Are you coming or not? All right, Dodson. They can all have you. That's their bill of sale looks binding, though. It won't be if we can prove a swindle, if he confesses. We'll see. We'll see. Come on, boys. We'll go call on Jeff. Anything to please this gentleman. It wouldn't do for an Eastern dude to be swindled. It's different when the shoes are in the other four. It ain't it, Dodson? Come on, let's go. Get on your horse, man. I'm coming, too. We'll be right enjoyable seeing Dodson face Jeff Salter. I'll prove I'm right. Come on, Tom Gordon has to come, too. He's the one who can prove that Jeff Salter knew about that mine. Yeah, I'm coming, Dodson. Get up there. Come on. Get up, come on. Get up, come on. Get in that shack where the mine entrance went. I left. Get in around there now. Maybe he's inside the shack or down in the mine. Oh, there. Oh, oh, oh. There he is. There he is. There he is. There he is. There he is. There he is. There he is. There he is. There he is. There he is. Jeff. Jeff Salter. We better look around the inside. Yeah, you look in the shack, and I'll take a look in the tunnel. Maybe he's run out with the money. Don't go speculating. We'll find out for sure where he is. Sheriff. Yeah? Sheriff, Jeff's things was mostly cleaned out in the cabin. The tools are gone. So is his extra clothes. Yeah, yeah, yeah, yeah. Is he in the mine? Jeff's not in the mine, Sheriff. I called down the tunnel and didn't get no answer. That proves he swindled me. That proves it. He don't prove anything of the sort. Since Jeff ain't around here to talk for himself, Dodson, I'm afraid you're going to have to keep this mine. Keep it? That there paper looks legal enough, and I don't see there's a thing I can do about it. But if Tom Gordon tells you that... You can add sign, paper means more in Gordon's word. This is your claim now. I recommend you start back with telling, boys. What's that? Sounded like stone sliding in the tunnel. I'm going to see. Yeah, sure, that's all. Come on, Dodson. We'll see what's going on in there. Yes, yes, sure. Come on, Gordon. It's an engine. What's he doing here? Drag him out! What were you doing to Jeff's soul as Mark? Me not tell. Maybe he was stealing ore. Maybe Jeff didn't run off after all. Maybe this red skin killed him. Yeah, right. Make him talk. Where's Jeff? What about it, engine? You better talk. Because we ain't none too friendly with red skins in these parts. Dodson Teller, tell me, come here. Take care of Salter. What a lie! If anything's happened to Jeff Salter, he did it. Yeah, the engine planned it. He's the one.   Yes, no. No. If Tom Gordon was talking to the red skin, maybe he planned to kill Salter. What? It was Dodson's idea. He wanted Salter's mind. It was him who schemed it all. He schemed to get Lempervus' mind, and then schemed to kill Salter to get his. He's lying! He's lying! He's lying! He made me sign Jeff's name to that billy sale, and he hired the engine to kill Jeff.  So you swindled Lempervus out of his mind. I killed Jeff to get his. That's right, Jeff. He did it all. Time up, boys. I've got a rope right there. You've got to prove Jeff dead. We can jail you for forging his name to the billy sale. We don't need to find Jeff. Have you evidence enough to convict them without murder charges? Who are you? I'm not one of them. I asked you if you could jail them without proving murder. Jail them and hang them. All three of them blame schemers. You can't hold the Indian show. Who says I can't? He's done nothing wrong. He's the one suggested that... Jeff! Jeff ain't dead. Here I am, boys. I was hidden in that tunnel, too. But the masked man says he's right. What are you doing here? You're supposed to be dead. Well, I ain't. You see, Sheriff, this masked man and his friend got me to help them show that Dodson Tom Gordon was grown. Why do you... In the six. And I reckon he'd done it. He sure did. They won't need no minds where they're going. You and Lemper show lucky the masked man and that Indian showed up. See? Where did they get to? Hey, hold on, you two. Here is a copyrighted feature of the Lone Ranger Incorporated.


So let's get started. Thank you all for coming to this talk on fine-grain authorization in the containerized world. I'm Ash Narkar. I am a software engineer at Styro. And we are the makers of the Open Policy Agent project. Just a quick show of hands. How many of you have heard about the Open Policy Agent? OK, cool. And I'm also a core contributor to the Open Policy Agent. So in this presentation, we will talk about security, especially around authorization in a world where microservices are being adopted by increasingly a number of companies. Then we will see the Open Policy Agent, talk about its communities, features, integrations. And then we will dive down into a use case around Kubernetes Admission Control. So I hope after this talk, we can make it easy to enforce fine-grain authorization in all your systems. So let's get started. So today, lots of companies are using microservices to build and deploy their applications. And for good reason, microservices allow applications to scale independently. They decompose them into smaller parts, which can be reused. And they can increase the productivity of development teams. And so you have your microservices, and you can take its dependencies and all its configuration and package them in a container, which can then be deployed onto different hosts. In the real world, though, any production app will have a number of containers and will probably be deployed across multiple hosts. So managing all these containers is going to get really complicated, really fast. So enter Kubernetes. Kubernetes is going to help you to manage and deploy these containers across multiple clusters. And it will also take care of stuff like service discovery, resource management, container scaling, container health, and so on. And so what we see today is that companies are using Kubernetes in production. So it becomes really important to make sure that all the security compliance rules, as well as any other rules related to security, are actually getting enforced inside your cluster. And so in this talk, we will focus on the security around the Kubernetes API server. Kubernetes has what you call an intent-based API. Now, so what do I mean by an intent-based API? When a Kubernetes user makes an API call, he is telling Kubernetes what the desired state of the system should be. He is telling Kubernetes what the system should look like. He does not care how Kubernetes attains that desired state. So for example, if the user has an application which requires persistent storage with encryption and the connection to the internet, he will just tell Kubernetes that he wants these things, and then Kubernetes has to figure out how to configure the network to allow the internet connection or how to turn on encryption. So this intent-based API is something different than what we are normally used to, which is an action-based API. In the sense, you don't have a slash open port endpoint, which you can just call, and then your code just opens up a port for your application. So that's why we have an intent-based API in Kubernetes, which is different than what we know about an action-based API. You focus on the what rather than how. Secondly, if a user wants to define a desired state for the cluster, he will define it in a YAML file. So for example, this is, say, the desired state for an nginx workload. Now, what the user will do is take this file and do something like a kubectl apply and send this over to Kubernetes for it to do its job. Now say, for example, I wanted to update the nginx version, or if I wanted to add some configuration parameters to this deployment, I would simply update this file and just do a kubectl apply again. And Kubernetes will just take care of the rest. So my point here is, I don't have to define an endpoint like update nginx version for me to update this version. I can just update the file and then let kubectl do its magic. And so given this intent-based API and given that you can have desired state defined in a YAML file, you can imagine some of the security policies that you may want to enforce in your cluster. For example, you do not want your pods to pull images from Docker Hub.  You don't want your containers to have unlimited CPU memory. You want them to specify certain CPU and memory requirements. You don't want to use latest tags on your images.  So the question now is, who is going to enforce these kind of policies in your cluster? And I think the answer is pretty clear here. It's RBAC, right? Role-based access control. With RBAC, you can restrict users' group service accounts to perform certain actions on certain resources. And so RBAC is going to help you enforce all these policies in your Kubernetes cluster, or can it? Do you think given the intent-based API and given that you can change a certain section of the YAML to change the desired state of your cluster, is RBAC enough to enforce these kind of security policies in your cluster? Unfortunately, the answer is no. RBAC is not enough. RBAC is not expressive enough. RBAC is too coarse-grained for use cases like these. Because RBAC cannot analyze arbitrary YAML documents and make a decision from them. So RBAC, even though very valuable, is not suited for these kinds of policies which are fine-grained and require something which is much more expressive. And so we need a solution which is not just expressive, but also does not compromise on speed and performance. And these are some of the challenges that the open policy agent was created to solve. And so what is OPA? OPA is an open-source, general-purpose policy engine. You can take OPA and you can use it at any layer of the stack in any system. When you use OPA, you are decoupling policy enforcement from decision-making so your application can offload policy decisions to OPA by executing queries. So before we go deep into this, I just wanted to talk about the community around OPA. So the project was started in 2016 at Styra, where I work. And the goal of the project has been to unify policy enforcement across the stack. One of the earliest adopters of OPA was Netflix. And they use OPA across their stack for authorization over HTTP and GRPC APIs. You have companies like Medallia which use OPA for risk management in Terraform. You have banks like State Street, ABN Amro, and companies like Intuit and Pinterest who are using OPA for use cases like admission control, authorization, data protection, risk management, and so on. OPA is a CNCF project. And it was recently promoted to the incubating level. It has more than 70 contributors on Git and a healthy Slack community of more than 1,100 people. And just to give you some context around these numbers, at the beginning of the year, we had around 400 people in OPA Slack. So it's great to see OPA grow, people using OPA. And that's why it has more than 2,400 stars on GitHub. OPA is integrated with more than 20 of the most famous open source projects out there. And we will talk about these integrations later. So let's talk about why OPA is a general purpose policy engine. So let's say you have a service. And this service can be anything. It can be your own custom service. It can be a Kubernetes API server. It can be Kafka anything at all. So when your service gets a request, it's going to ask OPA whether that request is allowed or not by executing a query. And this query can be absolutely any JSON value. OPA is going to evaluate this query based on the policies and the data it has access to and send a decision back to your service where it gets enforced. And again, this decision can be any JSON value. So what we have done here, we have decoupled the policy enforcement from the policy decision making. And as far as OPA is concerned, you give it any JSON value. And if you write policies which make sense for that data you give it, OPA will send you a decision back. And that's why we say OPA is a general purpose policy engine. Let's look at some of OPA's features. At the core of OPA is a high level declarative language called as Rego. And with Rego, you can answer questions like, can user do operation Y on resource Z? Or which fields is a user allowed to see? So with Rego, you not only get Boolean decisions like allow, deny, through, false, yes, no, but you can express decisions that are collection of values. OPA is written in Go. And you can deploy it as a sidecar, a host-level demon, or you can embed it as a library. It's designed to be as lightweight as possible. So all the policies and data it needs for evaluation is stored in memory. You can think of OPA as a host-level cache for your policy decisions. It does not have any runtime dependencies, so it does not need to talk to any external servers to make a policy decision. You can, however, extend OPA so that it talks to an external service, but that is completely optional. It also gives you some management APIs with which you can download policies and data from your remote HTTP servers. It can upload its status to remote servers, and it can also upload decision logs to the remote HTTP servers which you can use for debugging your policies and for offline auditing. Along with the core policy engine, OPA has a rich set of tooling which you can use to write unit test policies which you can use to author policies using integrations with Git and VS code. And it also has a tracing functionality which you can use to see the steps involved in the evaluation. So these are some of OPA's features, a high-level declarative language, multiple deployment models, management APIs, and a rich tooling set. Now, like I said before, OPA is integrated with more than 20 of the most famous open source projects out there, and these are the sum of them. One of the hottest use cases for OPA is admission control in Kubernetes. OPA is also integrated with service mesh projects like Istio, Envoy to provide API authorization. With OPA and Linux PAM, you can have fine-grained authorization over SSH and Pseudo. It's also integrated with Kafka and Chef to protect the data which is stored in these systems. In the Kafka example, you can use OPA. There are some topics which have high fan out, and you want to prevent corrupt data from being written on those topics because it will be read by many consumers. So with OPA, you can authorize which users are allowed to write on such high fan out topics. One of the newer use cases for OPA is around data filtering. And in this use case, instead of OPA returning to you a decision, like an allow or deny, OPA returns to you a set of conditions which can then be translated into elastic search or SQL queries and then implemented on the database itself. So these are some of OPA's integrations. And the cool thing here is you can start using OPA right now to enforce custom policies with any of these integrations out of the box without having to write a single line of code. So how does OPA actually work? So we've seen this figure before. Your service gets a request. Your service asks OPA for a decision. OPA uses the policies and data it has access to to send a decision back to your service for enforcement. Now let's say you have a salary service which provides information about salaries of employees in a company. And the policy you want to enforce in English says that employees can read their own salary and the salary of anyone they manage. So let's see how we can take this policy in English and implement it in OPA. So like I said, your service needs to provide some kind of input to OPA to make a decision. In this case, your service may provide the method, the path, and the authenticated user making the request. So one thing I need to make clear here is that OPA does authorization and not authentication. So OPA is not trying to solve the problem. Who is Bob? OPA is trying to solve the problem. What can Bob do? So now let's take this policy and let's implement this in Rego. So to do that, to make it easy to write policies in Rego, to experiment with Rego, we recently released a Rego Playground. And the Rego Playground is this awesome online tool which you can use to write Rego policies. So it's available at play.openpolicyagent.org. And if you go to the Playground, it looks something like this. So you can see the syntax highlighting for Rego code which makes it easy to debug and write Rego. And the way you read this policy is allow is through if input.method is get and input.path is salary employee ID and input.user is employee ID. And the cool thing about this policy is that the employee ID variable on line seven and eight will be bound to a value from the input. And so the way you can give an input to this policy is simply by clicking the input button. And so what I'm saying here, my method is get, my path is salary Bob and my user is Bob. So the question I'm asking here is can Bob see his own salary? So let's find out the answer which you can get by clicking on the output button. Allow is through which means Bob can see his own salary. And so what happened here is that the employee ID variable got bound to Bob and all these expressions were through and as a result, the policy returned a result which is through which means Bob can see his own salary. One of the other things you can do with the playground is you can evaluate particular sections of the policy. So for example, you can just select this allow rule and just evaluate that which is through in this case. Now let's say Alice was curious about Bob's salary and she wanted to see Bob's salary. So the question here is can Alice see Bob's salary? And so if we evaluate this policy again, you're gonna get a false, which means Alice cannot see Bob's salary, which is what we want. The second part of our policy said that a manager should be able to see the salary of their employees. So now let's say Alice gets a promotion and she becomes Bob's manager. So we need to tell OPA this new information. So you can imagine this information being stored in your LDAP server somewhere and OPA can fetch that information and use it to make a decision. For the purposes of this demo, let's hard code this information in the policy itself. So we can have a manager's object and we can say Bob's manager is Alice and Fred and let's say Alice's manager is Fred. And so now we need to extend our policy to make use of this new information. So the user can now also be a manager of the person he's trying to view the salary of. So if I have typed correctly, the question we ask again is Alice, who is Bob's manager, can she see his salary? And if you evaluate the allow rule now, hopefully the answer should be true, which means Alice can now see Bob's salary, which is what we wanted in our original example. So you can see here that you've taken a policy in English and converted it into a simple policy by writing some rego. And so now that you have written your first policy, you can share this policy with your friends, your family and the entire world by simply clicking on this share button, which will give you this beautiful link which you can copy and share it with anyone you want to. But before you share this link, let's check out what's inside the link. So there you go. You can see the policy which you wrote, which is always good, but there's more. If you click on the input, you will also get the input that you had provided to your policy, which means if you evaluate it again, you're gonna get the result which was true like before. So I hope you guys experiment with rego policies by using the playground and share your policies with the whole world. Let's look at some of OPA's use cases. So like I said before, it's a general purpose policy engine. You can use it at different layers of the stack with all of these systems. And that's what we're trying to enforce in this figure. So now let's look at a specific use case around Kubernetes Admission Control. So what is an Admission Controller? An Admission Controller is a piece of code that intercepts requests to the Kubernetes API server before that object is persisted into HCD. So you can leverage Admission Control to increase the security profile of your Kubernetes cluster. And you can enforce policies like images can only be pulled from internal registries, like the ones we saw before. You want your containers to have CPU and memory requests and limits. So you can have these fine-grained policies which can be enforced using Admission Control. And the way this works is whenever like an event happens, say you did a creation of a pod, a post request gets sent to OPA with an input which is the entire pod manifest which is this deeply nested structure that you see here. And so OPA is supposed to evaluate that query by taking into account this deeply nested structure as well as any policies and data it may have access to, form a decision and send it back for enforcement. So the theme is again common here. You are trying to decouple the policy enforcement from the policy decision making. So let's see Admission Control, how OPA can be deployed as an Admission Controller and used as an Admission Controller. The policy we are trying to enforce in English says that two ingresses in different namespaces must not have the same host name. Now you guys may know that an ingress object is something that controls external access to your services in the cluster. And so we want to take this policy and we want to implement it with OPA as an Admission Controller. To set up this demo, we are going to take a demo application and deploy it in the prod namespace. This demo application is going to create an ingress resource which says something like any request coming from huli.com should be forwarded to the demo app in the prod namespace. Then we will deploy Alice's version of the demo app in her dev namespace. And even this demo app in the dev namespace is creating an ingress object which says something like route all incoming traffic to the test app in the dev namespace. So you can kind of imagine the unintended consequences of deploying Alice's app in your cluster. Because you can now have a scenario wherein live production traffic gets sent to a test or development app and worse, if some malicious user is in control of this app, he or she now has access to the entire life sensitive data which they can use in any way that they want to. So this is clearly a disaster situation which you need to avoid at all costs. So let's see how we can do that. So to make this demo a bit interactive so that you guys can go and try this later, we are going to use a tool called CataCoda wherein you can go through this demo step-by-step yourself after the talk. So we are gonna start the demo. And so what we are gonna do is we are going to, we are going to create a prod namespace and deploy the demo app in that namespace. Okay, I think I need to refresh it. I'm kind of refreshing the environment. In the meantime, this gets created. Any questions so far that I can answer? So OPPA has this feature called bundles and it can periodically download policies and data. You just point it to your external HTTP servers and it will periodically download policies and data as a tarball and then load it and use that for policy evaluation. So that's one way to get from external sources. Any other question in the meantime? Right. So the enforcement happens at your service. So for example, you've written an API server, right? And you get a request saying, okay, show me the pets endpoint, show me all the pets in your clinic, right? So you can ask OPPA, should I allow this or not? OPPA just tells you, okay, stop this, block this. Then you can just return like a four or three or something like that to deny that. So you do the enforcement, but you don't need to work on the decision making itself. So if you had like a really complicated input given to you in the admission control use case, instead of you figuring out all these steps, you just delegate it to OPPA. So let's see if this scenario has been created. Okay. So we are going to create, deploy the demo app in a broad namespace. So we created the namespace, we deployed the app. We just have to wait for all the containers to be created, which could take a few minutes or it could happen sooner, depending it's a live demo. Okay, so in the meantime, let's take one more, any more questions here on anything around OPPA. Yeah, go ahead. So all the policies and data are all stored in memory for evaluation, but you can save your policies in GitHub. For example, you can version control those policies, you can unit test those policies, and then you can feed those policies to some kind of a pipeline to OPPA itself. But then by evaluation, OPPA stores everything in memory. So it depends how you do it. For example, in Kubernetes, you can define policies as config maps and OPPA will pick and then you can just volume mount them inside the OPPA container or use bundles if you want to get them from external sources. So multiple options for you to try out. Okay, so while this thing comes up, which we have to wait for, unfortunately, can I answer any more questions? Okay, just let's just wait for this to come up. So something I really encourage you guys to do is try to use the Rego Playground. It's an online tool which you can try your Rego policies with and you can experiment with Rego using that. So that we found that to be really useful to try out Rego and to just start learning the Rego language. So I would definitely recommend that. And okay, this is taking time. It should be up in like few minutes in few seconds now, hopefully. So what we are doing just to recap is we have created a broad namespace and we are trying to deploy a demo app in this namespace. So we just have one more and that's it. Okay, we're done here. So we've deployed this app, all the pods are up and so now let's go to our app, oh man. All right, so this demo is definitely live. So, okay. So we've now hit our demo app which is basically showing Bob here and his employee details. So the next step is to deploy Alice's version of the demo app in her own dev namespace. So we created the namespace, we deploy Alice's version of the demo app and now we wait for all the pods to come up which they are. And so now if you refresh the page, let's see what happens. So this is not Bob, which means something really bad has happened here and which needs to be stopped at any point from happening in the future. So we kind of have an idea why this happened because Alice's app created an ingress resource which kind of has redirected traffic to this demo app. And so the question now is how are we gonna stop this disaster from happening ever again in the future? And so what we have, we have OPA to the rescue. We are going to deploy OPA as an admission controller and we are going to load a policy inside of OPA which is going to prevent two ingresses in different namespaces from having the same hostname. And so the policy got loaded successfully inside of OPA and so now if I redeploy Alice's app the admission control should kick in and it should prevent ingress resource from being created. There you go. So OPA prevented that ingress resource from being created. And so now if you refresh everything is back to normal. OPA has saved the world. So you guys can go home easy today and sleep peacefully knowing that OPA is deployed as an admission controller somewhere out there in this universe. And so that's how you can take OPA as an admission controller to enforce fine-grain policies like these and prevent the ingresses from being created in different namespaces having the same hostname. So this was our containerized world and how OPA can enforce fine-grain authorization in that world by being a general purpose policy engine which decouples policy enforcement from decision-making. If you want to know more about OPA, check out the website. Join us on Slack for any questions or use cases that you may have and check out the project on GitHub. And if you like the project, please start the project. Again, thank you so much for attending. I really appreciate it. And if you have any questions, I'm here. Thank you.


well thank you Bob obviously this is not the way the Yankees wanted to start the weekend with the Red Sox winning and then with the Blue Jays winning as well Yankees want to get that magic number done with but they lose a very tough game by the score of four to three and we can say that the Yankees came out flat but you have to give a lot of credit to the Rays who are pretty good run prevention team yeah you can see why their first base ball club they have a good bullpen they have decent starters and they come up with some big hits and they got a young player that might be a superstar in this league for a long time and then you know the Yankees they employed their bullpen in a way that you could say is curious they certainly didn't use their top level relievers and you can't be saving anybody at this point for the postseason because the postseason there's no guarantee it's going to happen and up until Albert Abreu everything worked out but they brought an Abreu to face the guy you said Wanda Franco and it did not work out it did not work out and Franco's been a godsend for these Rays since he's been with the club he's been hitting very well comes through with the big hit tonight that gives the Rays essentially the win the Yankees did try and come back a little bit but the Rays got the win tonight in the first game of the series and if you want a second guess just a little bit other than Abreu Hermon hasn't pitched for a long long time two months pretty much and they brought him out for the second inning trying to squeeze more outs out of them well it kind of opened the door for the Rays with when he walked a couple of guys and then you had to bring an Abreu and then all of a sudden Franco gets the head all of a sudden it looks like it's just out of the reach for the night but then the Yankees offense came alive in the Bible ninth inning they hadn't had a runner in scoring position since the first inning and then they just fell a little bit short yeah they showed that fight that they've shown for the last couple of months in the ninth inning but there were so many strange things about that ninth inning and I know that the Tampa Bay Rays and the Yankees are all about analytics and they play the four outfielder game but after Stanton got that double things unfolded there like you can't believe that they happen they let him take third base and they let Gallo get that bun and that kind of started the rally and they almost lost the game because yeah you know Stanton going to third I didn't think that was such a big deal but that set up the base hit the bun single for Gallo and I just thought that was a big play because that's the one that really opened up the door for the Yankees to maximize what they could in the ninth inning there they could only get two and they fell one short. Well the Yankees got a big hit then from Urshela and they got a big hit from the veteran Brett Gardner to close within one so the tying run pinch runner Tyler Wade is at second base and the Yankees have some injuries and one of the injuries is DJ Lamey who they didn't use him earlier to pinch it for Odore. Odore against the righty Kittridge I guess is lefty righty but this guy wasn't played that much and a lot of this season is on the line in that game. Yeah it was and it tells me that Lamey who might be hurt more than we could because he didn't start the game he didn't use him in a big spot he had several places in the ballgame where he could have used him and he didn't so it came down to Odore trying to hit Kittridge who's an all-star reliever and it didn't happen he made some good pitches I thought Odore had some good swings early in the count but that last one was the pitch that was away it was the first pitch that was away from and he couldn't reach it. Well the Yankees fall painfully just one run short but there are two more games to go. Yankees win these next two don't have to worry about what anybody else is doing and tomorrow they'll send Jordan Montgomery out to the mound to at least get one of those two wins Bob.


So if you are a Nintendo fan and you're used to hearing, Nintendo is for kids, Switch is for kids, Mario's for kids, everything Nintendo does is for children. I've been hearing this narrative almost my entire life. I am 36 years old. I am heading on to my 40s here eventually. I don't like to think about it, but it's true. And every time I enter a game store, since I could remember probably dating back to at least my teenage years, but really the first time I remember actually noticing it was when I was 20, whether I was in GameStop or another local little place where we had the gaming generations was when we had around here or even the Walmarts of the world and the best buys is that every time I would go in to buy a Nintendo system be it at launch or whenever, or if I go in to buy a Nintendo games, Zelda, Mario, Pikmin, it didn't really matter what it was. I would get funny looks. Even today, I was in to buy a game. Well, I'll put it a pre-order anyways in GameStop the other day. And they asked me if I was pre-ordering for my children. Now look, I do have children and they very well could be playing Switch, but I can tell you right now, whether you guys think this makes me a bad parent or not, it shouldn't really matter, but my children don't really care that much about Switch. They just don't. They care more about the Mario movie coming out than Switch. They'd rather play on tablets, on phones, and play games like Minecraft and Roblox. They have way more interest in that kind of stuff because that's what all their friends are playing than Switch. That's just the reality that I live in as a parent. It was my reality when I used to do after-school care with elementary school kids that they weren't really interested in Switch and Nintendo that much either. They were more talking about Roblox or Minecraft, even sometimes Call of Duty coming up. It wasn't very much that we heard about Switch and there's a narrative that exists because of Nintendo's admittedly family-friendly image. Obviously Mario is a very family-friendly mascot. Obviously Mario movie. A lot of games they release are rated E, sometimes PG. So this creates this narrative from many people that Nintendo is a family-friendly and family-first and kid-specific company. And while some of this is true, that Nintendo is definitely, I would say, a pretty family-friendly company.  The thing is other companies are buying into this too. The UK government, when talking about trying to block the Xbox acquisition of Activision and Blizzard, noted Nintendo is not considered an example of a company that's successful without Call of Duty because they are a children's system. They are a family system. Their games are intended for little kids. Call of Duty's not made for little kids. Here go of course Nintendo can survive without Call of Duty because they aren't competing in the same market as Xbox and PlayStation and PC for that matter. This is government bodies saying this. Sony has said this over the years as well that they value Nintendo as a company but don't view it as competition because Nintendo creates games for kids. This is a narrative that's existed both internally and externally for a long time. And this narrative couldn't be more wrong with Switch. It just couldn't. We can go into prior systems and maybe prove it. The Wii era as an example, that Blue Ocean strategy, very easy to prove it then. The DS even, very easy to prove it then. But the Switch is different and Nintendo reminded us again today. You see, they had their financial briefing and they released the public documents from that briefing today. And in there was an updated graph that we hadn't seen in nearly four years. Last time they showed us this graph was back in 2018 and it noted in that graph that a majority of people playing Switch were adults, okay? Over the age of 18, a lot of them in their early 20s to 30s, 20s to 30s seem to be the primary range of people playing it. And then obviously a good chunk of players playing in the 30s, 40s and 50s and then obviously you had some children but it really wasn't that big of a market. And Nintendo published that out so long ago that people feel like things have changed. That was back then, that was early adopters. Those were the hardcore faithful Nintendo fans early adopting the platform. It skewed the numbers. That is not what the Switch appeals to today in 2022 except Nintendo released the graph again and now it says the same thing. With 106 million reported active users, this is according to Nintendo, 106 million active people have played a Switch in the last year.  It's almost 90% of those people are over the age of 18. The biggest group being around 22 and 23 by a significant margin. Not really surprising. College age or just graduating college maybe have a bunch of free time but then obviously that chunk between 20 and 30 is massive. Again, it's the biggest audience for Switch. Ages 20 to 30, that's not kids, that's adults. And then ages 30 to 40, the second biggest market. Again, that's not kids, that's adults. The ages of 35 to 45 have more people playing Switch than the entirety of ages zero to 17. This chart just destroys the narrative that Nintendo Switch in particular is for kids. Just because Nintendo makes E for Everyone in PG or T rated games doesn't mean that children are the ones primarily playing them. And I've talked about this before because the age rating of a game has nothing to do with the audience of said game. To give you an example, I do play on Xbox. I do play on PlayStation occasionally and I do play on PC. And every time I hop in something like say, let's consider it a bit more mature like Fortnite or Call of Duty.  And notably you see in Switch's market for children, it peaks at age 10 and then dips in the teen years. I wonder why that is. I wonder why that is. Could it be that age ratings have nothing to do with who is actually playing the games?  Maybe they don't care that Animal Crossing New Horizons is rated E for Everyone. Maybe adults stop caring in general about ratings, graphics, FPS and care about fun. Now look, this obviously isn't a representation of all adult gamers. That's just a fact. It's not a representation of all adult gamers. There are plenty that want really high frame rates and the best of this graphics and they spend their free money building epic gaming PCs and that's all cool. I'm actually really into that. I'm really enthusiastic about that market. It is something I really enjoy. I'm a tech enthusiast but I just had this hard time dealing as a Nintendo fan with the constant negativity around Switch. I mean, even as I've projected that I feel like new hardware will release next year, I don't think we need it. But I have a different video coming later explaining why we don't actually need a new Switch next year, even though I want one. And I feel like I have a very strong argument to make for not needing it just because of who the audience of Switch is. Folks, the Nintendo Switch is a platform that appeals to adults even after Steam Deck came out, even after PlayStation 5 and Xbox Series X launched. The bigger adult audience is Nintendo. It turns out that you can make E for everyone games that's still primarily just appeal to adults because adults are the ones that stop caring what other people think about what they're playing. I remember being a kid. I remember playing my Game Boy and Game Boy Color and Nintendo and yes, PlayStation and Sega Genesis back in the day. And you know what was funny? Anytime I mentioned Nintendo as a kid, I get made fun of by other kids. Why? Oh, Nintendo, that's like a five-year-old thing. You're eight. You didn't even play something more grown up like I don't know. How about some Mortal Kombat? I mean, Mortal Kombat was on those platforms. No, no, no, I played it on PlayStation.  So I experienced this as a kid where kids get talked down on for playing Nintendo. So of course, what are they gonna lean towards? Tablets, phones, more grown up platforms that adults might own like PlayStation or Xbox or at least considered grown up. I find this interesting that I even need to defend this point but if you're ever been a Nintendo fan in real life or just on the internet, especially as an adult, you've seen this narrative. This is not something I'm making up. I'm not pulling this narrative out of my buttocks. We all know that we constantly see Nintendo's for kids. Why are you playing Nintendo? LOL, Nate, you're playing Sonic Frontiers on Switch? What's wrong with you? It's 60 FPS and better looking on other platforms. Blah, blah, blah, blah, blah, blah, blah. You're right, but I already own Switch. And as an adult who already owns Switch that wants to play it freely in my bedroom and the bathroom and on TV, it's just more convenient for me to play it on Switch. That's not a knock on the other platforms. It's that as an adult, I enjoy the freedom Switch gives me. Now you can say, well, then just get a Steam Deck. I agree, although Sonic Frontiers doesn't work very well on a Steam Deck but I can agree there. The thing is, I don't own one right now and as an adult, I tend to just use what I already have. Sonic Frontiers isn't a reason for me to buy a Steam Deck. It's just not because I could just play it on Switch. I wouldn't feel like I need a Steam Deck unless there were games on Steam Deck that I wanted to play that I couldn't play on Switch. And unfortunately for Steam Deck, a lot of the games I want to play happen to be on Switch already. Sports Story, December, it's on Switch. I don't need a Steam Deck. Yeah, you can emulate everything on Steam Deck. That's fine, but why would I do that when I already have the platform? I'll just play it on Switch. I understand, higher frame rates, better FPS. I get that's the reasoning but I also go, yeah, but for $500 extra out of my wallet, the only more games I could buy with that on Switch? I think I'll just stick with Switch. So look, I am sitting here today thanking Nintendo for giving us this update at age chart. I wondered when they would do it. They hadn't done it in forever. 106 million active users, 36 million active paid Nintendo accounts, Nintendo Switch online accounts and guess what a majority of us are adults. I mean, adults are the ones organizing, getting family plans and sharing it with eight people. Why?  Why not make the family plan as cheap as possible to share with eight people?  Mario Kart 8 Deluxe DLC.  And it sort of just defeats this entire narrative because as cool looking and as mature and as amazing as the visuals can be in other games, Nintendo's the place that has more adults playing video games. And that's just awesome. I am Nathaniel Rufflejans from Nintendo Prime. I hope you enjoy this video and I'll catch you in the next one.


Hi, I'm Devin Mullins. For the past few years, I've been working on Google Search, launching tools to speed up the web using pre-fetching. For web developers, a successful strategy to improve performance should include several different techniques in combination. Cross-site pre-fetching is one such technique that has the potential to significantly speed up many of your visitors' page loads. First, let's talk about why it's worth enabling pre-fetching for your site. Improving web page speed not only benefits your user's experience, it can improve the metrics your business cares about. One study found a higher conversion rate for sites that load in two seconds or less. On the other hand, slow loading is a major contributor to user frustration. You've probably heard a lot about core web vitals. These are the metrics we think should be foremost on your mind when optimizing your user's page experience. In particular, largest contentful paint, or LCP, measures your page's loading performance by reporting the time it takes to display the largest text or image block that the user sees. To provide a good user experience, LCP should occur within 2.5 seconds of when the page first starts loading. Let's look at what contributes to the LCP of a typical page. When a user visits the page, the browser requests or fetches the HTML from the server. The server responds with the HTML, which gives the browser more hints on what to fetch next, including CSS, JavaScript, fonts, and images. Often this happens in several phases. For instance, the CSS file might reference an image file for the browser to download next. As these responses come back, the browser must also do some work to evaluate them and eventually lay out and paint components on the page. But the majority of time is spent waiting for those packets to travel from the device to the server and then back to the device. If you can prefetch all of these files, that is, fetch them before the user visits the page, then the only remaining task before displaying the page is the work the browser must do to evaluate, lay out, and paint. The result of a complete prefetch is a much faster page load. But even if you are able to prefetch some of these files, you can still see a significant improvement. Prefetching has been around for a while, but an additional consideration is warranted when prefetching pages from one site while the user is on another. Cross site prefetch is a special type of prefetch when a referrer site instructs the browser to prefetch a page on a different site. When the user clicks the link to the prefetched page, the page loads faster. But let's back up. What if the user never clicks that link? They probably wouldn't expect a linked website to learn that they were interested in this topic while they were browsing for it on the referrer site. On the other hand, once the user clicks the link, the destination site may want to know more about the visitor, for instance, to add personalized content to the page. A consequence of this requirement is that the prefetch requests can't include potentially identifying information like an IP address or cookies. How much can cross-site prefetching help? In a large-scale experiment, we looked at just the page loads where Google was able to prefetch the main HTML. We found that doing so increased the fraction of these page loads with good LCP by 14 percentage points. How much this could benefit your site depends on the fraction of your visits that are cross-site navigations. Before we dive into specific solutions to enable cross-site prefetching, let's talk about some decisions you can make. Cross-site prefetching is easy to enable for users who visit your site for the first time. For repeat visitors, some sites may take some extra development effort to personalize content. Recall that cross-site prefetching requests can't include cookies. First-time visitors have no cookies to begin with. You can enable cross-site prefetching for these users without any changes to your site. If you'd also like to enable cross-site prefetching for repeat visitors to your site and your site is personalized based on cookies, you will need to lazy-load any personalized elements after the user navigates. But what if you currently encode personalization directly in the HTML? If so, you may continue doing so when cookies are present. Lazy-loading can serve as a fallback for prefetched pages. There are some other general best practices for lazy-loading content. See this link for details. Let's look at another choice when enabling cross-site prefetching. If a referer prefetches your page but the user doesn't click on the link, that is additional traffic you must serve. To offset this, you could opt-in to additional caching. But caching content for too long could risk showing older information to your users. On the sliding scale between maximum freshness and minimal additional requests, where should you position your page? This is a choice that depends ultimately on the specific needs of your business and your users. Okay, so how do you enable cross-site prefetching? To address the need for private prefetching, new technology was necessary. I would like to introduce two solutions to this problem that you may take advantage of today. In the past couple of years, we have implemented private prefetch proxy and signed exchanges, two technologies that enable this prefetch while hiding potentially identifying visitor information until after the click. These solutions also ensure that your users see authentic content that is attributed to you. As an early adopter of these technologies, Google Search has already integrated with them so that sites may begin improving their LCP today. We introduced these technologies a few years ago and have been continuing to refine them in response to developer and user needs. We think both of these technologies are useful as they offer different trade-offs. Let's start with private prefetch proxy. When performing a cross-site prefetch using this solution, the browser encrypts the requests, sends them through an intermediate proxy server hiding the user's IP address. These requests omit credentials such as cookies. From the destination site's perspective, only the proxy requested this page. When the destination site sends encrypted responses back to the proxy, the proxy returns them to the browser because the proxy does not have the decryption key for these requests and responses. It only sees domain names. Finally, when the user clicks the link, these prefetched responses can be used to display the page. At this point, the page can establish a direct connection to the destination site for additional resources. The private prefetch proxy is currently being used by Google Search for Chrome users on Android. Efforts are underway to expand this to desktop and to other referrers. You do not need to do any additional work to enable this. You have the option to dial down how often your site is prefetched or opt out of it altogether. Pages prefetched using the private prefetch proxy are currently shown only to cookieless users for your site. Coming soon, there will be an option to support repeat visitors. Since these requests go to your server every time, they maximize the freshness of the content that you show your users. To minimize prefetched bytes, only the mainframe HTML is prefetched, not larger subresources like JavaScript or images. Also, you can adjust the fraction of prefetched requests that your site receives. See gu.gle slash p3-info for more info and updates on the options coming soon. Now let's talk about signed exchanges. With this solution, the prefetch process happens in two steps. First, the referrer site runs a cache server. This cache requests the page from the destination site and stores it temporarily. This cached page is also cryptographically signed by the original site so that the cache can't modify it. Later, when the referrer requests a cross-site prefetched, it requests a copy from its own cache. When responding to prefetched requests from the browser, the cache can reuse its stored copy without contacting the destination site, up until the page's expiration time. The signature helps ensure a chain of authenticity from the original server to the browser so that developers can be sure that visitors are seeing their content as written. When the user clicks the link, again, these prefetched responses can be used to display the page and the page can establish a direct connection to the destination site. Users of chromium-based browsers may see signed exchanges today. Google Search supports it for Android devices, but efforts are underway to expand this to desktop, and we're working with other referrers to provide support as well. To enable signed exchanges, if you use Cloudflare, click the Automatic Signed Exchanges checkbox in the dashboard. For other serving stacks, you can use one of several open-source tools. Prefetches include sub-resources indicated by a link rel preload tag or header, depending on the tool. By default, prefetching occurs for both first and repeat visitors, so you will want to lazy-load personalization. Alternatively, if lazy-loading isn't right for your site, there will soon be an option to enable signed exchanges only for first-time visitors. Since the referrer can cache prefetch requests, additional traffic to your server is reduced considerably. To increase freshness, you may lower the cache expiration time of your pages. Coming soon, there will be an API to request deletion from the cache. Both of these options may reduce the number of times that prefetching will be used. You might also increase freshness by lazy-loading updates after the page has loaded. See goo.gle slash sxg-info for more info and including updates. Okay, now let's talk about some early results. We've worked with a number of partners to enable these cross-site prefetching solutions and learn about their experiences. Here are some examples of companies that are interested in or have already started taking advantage of the technology. Early adopters have had success enabling this benefit for their users and their businesses. Cloudflare is a CDN that offers cross-site prefetching for its customers with just one click via their automatic signed exchanges feature. They have enabled over 12,000 sites to deliver a better web experience to their visitors. RebelMouse is a CMS that offers cross-site prefetching for its customers using Cloudflare's feature. One of their clients, Paper Magazine, saw a 27% increase in sessions per user for eligible users. Narcity observed a 41% improvement to LCP, an MLT blog benefited from a 21% reduction in page load time for eligible page loads. Agazeta, an early adopter, saw an immediate improvement to their LCP and in turn, their user's web experience. I hope I've inspired you to learn more about the potential for cross-site prefetching to improve your LCP and in turn, your business. I look forward to helping more people get involved in this exciting new technology. To learn more about how to integrate cross-site prefetching into your site, visit these links.


What's up everybody Jason for jazby's case race comm sorry about that guys So the first half of the video is gonna have the randomizer and your teams that you've got This second half of this video is gonna have the actual pack break and the randomizer to who gets spots in the mixer Apologies guys. I figured out what the problem was I fixed it. It shouldn't happen again if it does It's definitely Michael Myers's fault, but short story short. I looked all around and there was one loose wire that was almost coming off the Basically one of the search protector outlets, so I think that's what was causing it to kind of Go away come back, but we should be good now. I moved it away. I made sure it was good So we should be fine from now on But I'm glad I pretty much figured it out. That's pretty much what happened So that's good because it was just weird that it was just happening randomly today But again, I still blame him. All right, so let's do the break then guys again These are your teams that you got for the break Let me quickly print out the list And then we can rip really quick guys. I did not I did not It was it was weird. I Can't even reach where it was so it must have been loose from like the last days or two and finally just started messing up So if it happens again, I'm I'm definitely blaming it on Michael Myers It was just weird that it was actually just not working, you know Good luck guys. Joe burrow Some veteran base there little Michael P. Ryan Jalen hurts T. Higgins Henry rugs quite was a liar So there you go That was the quick pack filler now. Let's do the giveaway guys. So again, we've got all of your guys's names right here That bought into the pack filler from Lucas down to Brian Number top two get in guys roll it Two and a four six times. Good luck one two three four five and Sixth and final time oh Lucas and Ryan Herald what? Harold's about to pop in and just have his jaw just dropped to the ground what? Six times congratulations Lucas and Ryan you guys are in the random divisions mixer and Good luck guys


Ladies and gentlemen, please be seated quickly.We will soon start the next session.Please be seated. Thank you.請大家儘快入座,謝謝.女士們先生們,在下一場的會議期間,請您不要拍照和攝影,謝謝您的合作.Ladies and gentlemen, for the next session,please do not take pictures, no videos.Thanks for your cooperation.早上好,大家好, good morning everybody.大家好,早上好.我是詩南生,我是拍電影的拍了三十年.My name is Shanan,I've been in the film industry for 33 years,and I've been friends with Zhou Xun for more than 10 years.I've met a lot of people in the film industry.I got to know Zhou Xun through her movies.I think she is a very talented actress,but she wasn't trained in the film academy.She started from a dancer.When I saw her, I felt really surprised.She seems to be a very innocent girl.I feel like we're chatting at home right now.When she was living in Hong Kong,I asked her to go shopping for meand then I invited her to have dinner at my home.She told me that she was afraidshe never went shopping in the supermarket.And when I got to you,you talked to me about environmental protection.What motivated you to do environmental protection activities?I like to watch documentariesand now that you watch the documentaryand a truth that we cannot face.Inconvenient truth.In my childhood,I started watching a lot of filmsand I like to dreamand I feel a lot of things are not true.When I watched the documentaryafter I saw the documentaryand I feel yes,real,it's real.We only have one earthand we're living in this worldand this earth is changingand we're facing many challenges,many disasters.And we have to protect the earth.And actually we've been talking aboutenvironmental protection for many yearsand I didn't really pay attention to itafter I watched the documentary.So how did you actuallyimplement the idea?You always say that you want to bea good actressand in addition to thathow do you put yourself into this effort?Well,around me I've alwayshave really good hearted friendsand whoreally wanted to put effortin these good causesand at the timewe've been talking about ittalking about how to doenvironmental protection activitiesmy staffdiscuss with mewhat we should talk aboutin this kind of activitiesand I have a lot of friendsand a lot of seniorswho have taught meI know whoever put themselvesinto this effortare very kind heartedhave good intentionsso when youdo these activitiesyou must have encountereddifficultieshow did you overcome thedifficulties?When I first had discussionwith magazinesI want to shoot picturesfor the magazinesI want to put these topicsin my interviewsin a lot of interviewsI talked aboutenvironmental protectionso that people whoread the magazinesmy fanscan know the ideaofenvironmental protectionI know a lot of fansa lot of my fansare childrenas an artistwe face criticismand challengeswe face a lot ofvanity thingsbut this is only onepart of our lifethis is only part of thisentertainment industryin fact in every industrywe have this partbut it is not the wholeis not the whole of thisof our worka lot of my friendsmy classmatesenvy me because my familysupported me to be an actressin the traditionalin the traditional viewbeing an actressis kind of a lower level jobthan other jobsit might lead you to a wrong directiona lot of peoplequestion if your parentssupport you to be an actresssome people saw yousaw the interview when you were really youngand you said do you want to be an actressthat who is respectedby other peoplethat's why support you to doto do this kind of worki didn't knowhow to start this workhow to start this work in any wayand first in my thoughti wanted to concentrate in actingand luckily i have metmany good directorswho have supported mein a very good environmentso i have a really good environmentto focus on actinghoweverpeople changepeople grow upwe see more thingswe expand our visiononce i rememberone of my older friends told methatthere's billions of people in chinawhy is only youout of ten peoplewho is able to stand upand what can you doafter talking withthese kind of peoplei get to knowi get to think aboutsince i was a childi wanted to be a person who is respectedby other peopledeep down in my hearti want to be rebelliousi want to be something betterthan other peoplei imagine when i'm in my 40si want to be an actress who is respectedby other peopleother people surrounding meand they talk to methey give me advicesand they are actually role modelsfor meso slowly i get toenrichthe idea or enrichthe concept of being respectedi want to do respected thingsso thanks to your personal charmyou get to attracta lot of people who are respectedand you just say thata lot of your fans are childrena lot of your fans are childrenand you also told meanother thingit is calledsunny villagea sunny village is a projectcan you tell us more about this projecti think betweenpeoplethere isthere is a relationshipfrom which we can learn from each otherwe learn from our parentswe learn from our friendswant to go to the sunny villageone of my friendactor friendshen chang he introduced me tothe sunny villagethese childrenliving in the villagewho are childrenof those parents who areliving in prisonthe sunny village has been existingfor more than 20 yearsthe villagehas childrenthose children who have parentsin prisonfor many yearswho have even likelife sentence in prisonand actually the person whowas in charge of the sunny villageworked in prison beforeshe witnessed the problemsexisting outsideof outside the prisonthat's why she started the projectone of the problem is that childrenthose children are not orphansthey cannot be adopteddue to somevaluedue to some wrong valueideas in Chinaa lot of people think these childrenare not good to be adoptedor to be raised in other people'sfamilyand I feel like we should not ignorethese children, we should love these childrenand have themlive in a better environmentso that's how I got startedI felt I had a huge familythereI had a big houseI had a big gardenbut this sun villageis only 30 minutes drive awayit's a completely different worldyou know it's so closeit's just you just drivein one direction for 30 minutesand you can come across peoplewhose lives are so differentso I started thinking aboutwhat I could do for themcan you talk about this villagebecause they need supportfrom the outside, rightthat's rightthere are a few branchesof some village nowafter 20 yearsa lot of peoplego and help thembut theythese childrenkeep beingput into these kind of situationsand thenand they startedgrowing organicfruitand also they would sell the fruitand that would supplementthe incomeso they are able to maintain themselvesbut thisMadame Zhangwho runs this placewho was a former prison guardshe will have to take care of themuntil they are adultsand there are more branchesof Chinaand so they need continued supportso if youif you identifywith what she is sayingyou can take part in this coursethere is a film nowthat's being screenedthat's called One Dayand yes that's rightthere's this filmI know a friendwho's a driverhe has a delixiahe can't readhe has trouble readingbut if you give them the opportunitythey can have a good joband they can perform in their joblike this person was a very good driverfor exampleso that's something that stuck in my mindthen I read aboutautismchildren with autismdocumentariesI realized autistic childrenthey are some of themthey are focused on one thingfor examplesorting files for exampleif you find a taskthat suits their conditionsthey can do it really wellbut this filmthat's called One Dayis releasedon the 10th of Septemberthere are nine storiesand thechildren who need helpin various waysbut this is the firstand this is thefirst publiccalls, good callsfilm and all tickets arefive yuan per personand all theactors perform for freethey all the crewwork for freethe theaters don't take a cutthe movie theaters don't take a cutunlike with ordinary filmsand so onand the movie theatersare screening this filmbut there are fewbecause there are costs to the movie theaterthe ushers, the box office etcso the film is being screenedon the first dayit did quite wellyesterday we saw a big dropin box officebecause afteralland it faces competition from new filmsbut you can maybe goand hire a whole auditoriumfor exampleto contributeso we hope we willreceive support from everyoneso that it can stay in the movie theatersfor another daybecause everyone contributedas a volunteerof course we understand the situationthat the movie theatersand thedistributors are inso the film is got one day梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員梁國雄議員