Hello, greetings. Good morning. Did anyone post the meeting notes into the chat yet? I'll do that. Thanks. Taylor. Yeah, you're welcome. Would you like to lead today? Just so people know, we'll probably went till five after before we get started. So people have time to join. Please add yourself to the meeting notes. And if you have any topic you'd like to discuss, you can put it in the. Agenda area of the meeting that's a necklace. So thanks for everyone that's joining right now. If you can just add your name to the meeting minutes and adding the agenda items you'd like to talk about, we'll get started in about a minute here. Okay. It's five after so we can probably get started. So welcome everybody to the telecom user group meeting. We meet on the first Monday of every single month. And if you want to add your name and any agenda items to the meeting minutes, you can always do that in this Google doc. So with that being said, before we jump in, is there anything that anyone would like to add to the agenda. Okay. Thanks everyone that is showing up. So just a reminder about upcoming events. The CNF working group meets every week on Mondays at 1600 UTC. Cube con Europe just passed and there's a bunch of great recordings from about telecommunications and cloud native telecommunications industry the videos are now up on YouTube. The Cube con North America is coming up in this fall and located alongside it will be open networking edge summit and Kubernetes on edge day. There's more information in the links here. So with that. Today we have a teach to talk about orchestra, which is a cloud native release orchestration lifecycle management platform for fine grain orchestration for groups of independent applications. Yeah, Natesh, would you like to take over. Thanks. Yeah, let me share my screen. Let me know if you can see the presentation. Yep, we can see it. Perfect. Hi folks. My name is Natesh. I'm a senior software engineer at Microsoft and newly formed team called Azure for operators. This is about an open source project that I've been working on for the past year, along with the team is called Azure Orchestra. Orchestra is an orchestration platform that's built for system level releases of complex mission critical applications. And also be seen as a tightly coupled helm applications because the delivery mechanism is Helm charts today when we deliver our apps to our customers. So previously I was a technology architect, the office of the CTO at the firm networks, the firm networks was acquired by Microsoft early last year. So Kubernetes enthusiast, I've been working with Kubernetes for the past three to four years now, prior to joining the the office of the CTO, I was working with service meshes and this was a studio to support our 5G platform. So using all the features from service mesh. I'm also an avid gopher. And the funny thing about me that I love to hoard swag. My entire wardrobe is just graphic tears from coupon and gopher con. So, talking about the couple of topics today I'll keep it short. And I do, I do wish to show you a demo of orchestra with a slightly less complex app as compared to network functions that we that we ship to our customers. So as an overview, orchestra is an open source project and didn't start as something that was open source it was kind of tailored to, I'm going to say a firm network site now because that's where we started our journey. Now it's Microsoft. It's tailored to our workloads and how we ship our network functions that we built which are 5G core network functions which are sold or by the ship to service providers, but over time we kind of realized there were components in here that would be of some benefit to the rest of the Kubernetes community and started abstracting out pieces that that were were not specific to the firm workloads and we, we built orchestra out of those abstractions. The primary goal of the platform is release orchestration of tightly like highly dependent applications or groups of applications. Release orchestration would be the rollouts rollbacks, and then you have the lifecycle management which would be around watching the state of the system, our network functions and other components and auto remediation on failures going back to the last successful deployment and everything would everything should be easier to touch. And like I said, it's a it's a group of health applications. So, I think of it as a bunch of health, health artifacts, health charts that are your applications and a lot of these health charts can also have some charts which could be micro services that power your, your network function. The, the operators cluster scope, it doesn't work across. It's not a multi cluster solution, though there are some. There's some work in progress to kind of build an abstraction on top of orchestra to, to make this multi home across multiple clusters, but this one just focuses on a single cluster and deploying components on on the one Kubernetes cluster. The architecture, it's the the whole solution is built using some popular CNCF projects we have our go workflows that let's us do some dependency based workflows so you have died based workflows and you have chart museum and help which are used as as your health registry and helping your vehicle of delivery and have controller to kind of automate the whole helm operations. So, have control has some nifty features where it can do remediation for you it's, it's a declarative spec you no longer have to deal with imperative commands using the help see a lighter deploy your applications. The orchestra itself is built using the cube builder project, it's written and go, and it leverages the the official client go and controller on time library so so no surprises there, it uses what cube builder provides. The, the, the input to orchestra as a custom resource called application group and it's it's a collection of applications with dependencies mentioned amongst them. So the primary use case is is for the in service upgrades of mission critical systems and especially as we're in the telco group it's it's around the five g core network function so we build a bunch of network functions that we do not manage. These, these network functions are are kind of delivered over an air gap environment and you no longer have any visibility so you need something to do zero touch deployment you need it to be reliable and completely automated so so that's the main use case when we build our applications is that you have your you have your network functions but you also have a whole bunch of supporting components that as ISVs we have to provide which may or may not be something that the customer is going to manage for us. So you have to build an entire group of application supporting components in for components that need to be shipped along with the NFS. I was listening to a session from the previous meeting and there's a line in there that caught my attention network functions are not just help applications. So they're more than that it's not like the enterprise world where you can have a single chart for a single application. So it's a little more complex. So the use case of orchestra was to provide rollout strategies you have your Kubernetes rollout the standard rollouts. But we want to enhance that especially in mission critical systems like 5G, you want to provide canary and blue green deployments so orchestra can leverage some service mesh features behind the scenes to do canary and blue green deployments. I think the the plug in ecosystem kind of allows allows users to build custom strategies for rollouts as well so you can you can build your entire pipeline on how you want to roll your application out including the kind of telemetry data that you want to look out that's not supported by the service measures or rather the progressive delivery frameworks.  So you can catch errors quickly and rather than cause a lot of disruption you can you can just roll back to your last working set of applications. So we have two plan components that we're working on planned and rather than actually started off last week. We're going to do orchestral support quality gates. We would use quality gates for promotions manual and automated kind of gives you control over how you how you release your applications across the customers network so it could be this the staging labs canary labs and continuous testing as an integrated part of orchestra so rather than having your own test infrastructure running outside of outside of your Kubernetes orchestrator rather the release orchestrator you would have this continuous testing built into these rollouts along with automated canary analysis orchestra would also do its own analysis any custom metrics that it needs to look at. So the reason why it's so complex is why network functions are so complex is because they rely on a lot of infra and past components that that are specific to the vendors network function different vendors are going to deploy their network functions on a single or across the network of a customer's cluster so survivors cluster and everyone has to bring their own supporting components so so we just because of that we we start having tight dependencies so really complex dependencies between these applications and all the supporting components so here just show an example on how we deploy our workloads but we have strong hard dependencies on some RBAC policies that need to be configured before anything else can be deployed these aren't these aren't pods that microservices that converts these are base resources that you need to set up before anything else can be started similarly you have OPA that you need for a mutation and validation so these web hooks need to be up and running before anything else can start Metal LB is another case when you're doing this on bare metal servers bare metal clusters and then we do leverage STO service mesh which means the the service mesh needs to be up before you can start any of the network functions because the whole side car injection approach and configuration of envoy and much there's there's other components to observability security that we need that we need set up before our NFS can be spun up so this kind of drove us to the part that we need to we needed to automate the whole solution on deploying things in in a particular order following dependency graph. So, so some of the features of orchestra is that it's built for Kubernetes it uses the operator pattern to deploy controllers to to to Kubernetes cluster completely declarative because of the custom resource approach you provide the state that you want to be in and the controller reconciles and gets you gets you to that state. And it's a GitOps compatible kind of it can plug into any GitOps framework any so things like Argo CD flux CD. So it's it's it's pretty much agnostic to it. All we need is that custom resource to be deployed in the cluster and orchestra takes it from there. The way the way it works is by generating database workflows. This is where we leverage our go workflows and what what orchestra can do is one our applications are the health charts themselves can have dependencies amongst themselves. So so you could you could think of the of the first layer as the info components, the first set of layers and then you have the, as you go through that the final thing is your network functions or a set of dependent network functions that are being deployed. So so it renders a DAG based workflow for these applications as an optional for us it's kind of a mandatory feature is it also does DAG based workflows for the sub charts that are contained within the application chart so we have a lot of supporting or rather comprised of a lot of microservices within an application within an NF chart. So it be deployed those sub charts so those as health sub charts and they need to be coordinated as well. I should take that back they don't need to be coordinated but when you do in service upgrades. It's good to have them ordered following a DAG where the most crucial elements go get updated first or last however you want it so that you can reduce the blast radius when things go wrong. So you you cast the issues early and then you roll back rather than having everything kind of blow up at the same time. The reason this is important in the service provider world is because they're not going to do continuous deployment as it's done in the enterprise world. It's not take updates as they come in and roll out applications. Instead what we have realized and after talking to our partners is that they would do it on a schedule which means more than one application in for component could be ready with upgrades. Whenever they schedule the releases, which means it's not it's not just one application going in there's a whole bunch of help charts being upgraded along with say the service mesh and observability components security components. So so just one the application DAG helps with that where the DAG is always followed you you honor the dependence degree and deploy the intro components first and then your applications come in. And the sub charts again we break it down so that you can catch any failures at the microservice level. So, so I made a mention to the Github frameworks it plugs into any CSAB framework, you can also connect it into a QQ portal as well. So the plugin ecosystem is we you bring your own executor container image. So the way it works today is each of the DAG nodes are responsible for generating a custom resource that's picked up by health controller. The custom resource is called Helm release. And it's it's it's very similar to what you would do on a Helm CLI command you provide the values you provide any any flags that help needs and help controller would reconcile and make sure it does all the help actions that you need. So, so today it just just deploys the Helm release object and wait for the status before the workflow node succeeds, but you can bring your own workflow container where you could do a lot, a lot of other things that you could go in and look at monitors and monitor the state for a bit before deeming the node of success and moving on to the next node in the DAG. So it provides a safe and reliable zero touch system foreign service upgrades. And this is this is a simple example that I'll be demoing. We do our upgrades following the forward workflow, but the reversal is not a blanket rollback. Everything won't be rolled back to the to the previous versions altogether since stated reverses the workflow workflow again honoring the dependencies and starts starts either if this is a delete then starts deleting everything in the reverse order or if it's a rollback it does the same thing. So our ecosystem is becoming larger every day we're, we just introduced. We just spoke with the captain team and we're making, we started the integration there and that's captain is another CNCF project that can do validation and quality gates. So captain would be an integral part of our kesta over the next few months as we go on it and then kept in itself could leverage progressive delivery frameworks. While our kesta outside or kesta can do this without captain as well so we're going to put up some examples of using our go rollouts which is which leverages is to do some progressive delivery and automated analysis to promote your applications. So, so this is a roadmap, like I said, captain's the first item in our roadmap and then we have our go rollouts as an example as well that'll be added. So you can you can get to the GitHub repo following these links and we do have official docs as well, especially for admins and contributors who are interested in contributing there's a whole bunch of resources on the website that you can use to get yourself set up and start contributing if you wish to. So let me quickly jump to a demo do we have enough time. Yeah, we do. Okay, perfect. So, right so so what we have here is. I'm going to just quickly show you our application group. So, so this is our custom resource that orchestra picks up, and you can see that it just has a list of applications. So, so this is your application group with two applications you have ambassador and book info is is kind of based on the STO example where the book info app has a whole bunch of microservices product page reviews ratings and details so these are treated as sub charts in the application chart. And in this example book info is dependent on ambassador, which means ambassador is spun up and roll out before book info can be started so we have to make sure that everything comes up and only then book info gets kicked off. So, but then the book info application we have dependencies among the sub charts as well. So, in here you have details and ratings with no dependencies which means they can spin up first and then you have reviews, which depends on those two sub charts and then product based upon depends on reviews. So, kind of everything is driven through him so you have the standard helm options. You can specify what target namespace to go go to what override overlay values you want to use. In this case we have the replica accounts that we override on the default charts and sub charts. So, let me create this. So, so what we have here is our architecture in that the application group and it generates a workflow out of this. These tags are intermediate most and not the executive containers so you have ambassadors pinning out now on the right you can see it's starting the ambassador pods in within that and the Bay Orchestra did the generally the object for these other containers is it passed in a Helm release object to our executor as a basic before and quoted string and when you decode that it's just a Helm release object that help controller picks up and this executive container down here if you look at the logs is just waiting for the Helm release to go into a successful state. So again, you have, you have ambassador the primary application that's seated and now it's gone into a sub chart tag. So details reviews ratings and product pages are sub charts within the book and for application. Since, since sub charts are dependencies the dependencies go first before the application charges them. The application chart may or may not have any resources being deployed but if it does it has deployments config maps all of those will be created after the sub charts is deployed.  Orchestra kind of staggered everything out. So, so we have a successful workflow over here I can go in and make a modification and this would be similar to releases changing over time and being ready and the CD picking it up. So let's go down here and change the replica set. So product page. So both of them should see changes. And what's going to happen is this workflow is going to kick off again. It's completely at which, which means that the ones they have hand releases that haven't changed will not be affected at all. It's just the executive container will see the hand releases in a succeeded state and just do nothing and move on to the next part. So, so now we have the sub charts spinning up quickly I just wanted to show you don't have to watch the entire thing but if I just look at the hell release version the process name spaces. So you'll see that reviews and product pages to do applications to do sub charts that we touched the values that we touched were moved on to revision to finally the thing I wanted to show is the rollback. So, so let me show the remediation that if I go in and let's say, set it at a version that doesn't exist. So let's say rollback to the loss of the full spec. So this should, this should fail because it couldn't find the chart. And if you go back to it, it will spin it up again just to make sure everything's looking right. And if you go back to the spec, you should see that it's rolled back to a version six. So, so that's that's another one. So let's just roll out so that then we can show the reverse workflow, which should be quick. Let this turn green and then succeeded. Now I can go in and delete the application group. What we should see is when we look at the workflows, you have a reverse workflow that's picked off. So the forward workflow if it was in the middle of reconciling would be suspended. The reversal would be started. So if you go back and look at the pause, they'll be terminating in the same order as they were the opposite order of how they were deployed. We have a book in for product page interviews. Going in the reverse order and be deleted. So yeah, that's that's what I have for the demo building some more demo has to show features like progressive delivery and quality gets that should be out. In, in a short while, but we are at our MVP stage things are a lot more stable than they used to be so feel free to play around with the with the book info app and if you want to try it with your own application as well. And we'd love to get some feedback. And also, if you wish to contribute. There's a lot of open, open issues, small and large that would really appreciate anyone's contribution. All right. Any questions. Hi, thank you, Natasha. It's a really, really great presentation. I have a lot of questions. I'll start, I'll start maybe with one. You know, you started the presentation talking about the challenges of CNFs and and telco workloads. I wonder how how you see orchestra directly connecting to them and then I'll have another question. So, so you mean the orchestration of those CNFs. Well, you talked about the some challenges of CNFs having to do with integration with the platform with the host. Yeah, so let me go back to this picture. So this, this is based on my experience with the firm. The way are so you could you could think of our the data plane component like the UPF UPF is something in terms of the platform is speaking is would need DPDK on your platform as well. But when you when you get into the Kubernetes world is a whole bunch of CNI frameworks you have other operators like Intel building features to help with some hardware acceleration DPDK again. I'm not the expert on that but I have seen like these dependencies that are done through Kubernetes operators. So this kind of becomes a prerequisite before our NFS can be deployed, you can't just go in and deploy UPF and expect to work. So in that way things need to be set up. So so orchestra honors that dependency, the DAG so one when you're rolling things out it could follow that order where all the prerequisites are started. So in this case we show from the application from the platform side you have the service match that needs to be up you have OPA to do our mutations that we need in terms of we don't leverage it for a lot of security features. And like I said, any of those from what I remember they were like new new Mac or mappers and there's some whole dynamic set of controllers that Intel builds around this. So so that's what I mean by orchestra handling dependencies is not stick to what you're deploying but as long as you have it packaged as a helm chart, it'll follow the DAG. Does that does that answer your question. Oh, somewhat. Yeah, I guess I guess my follow up is related to that. So, I mean the DAG is a future of our go workflows. This is not maybe specific to orchestra and, of course, one of the things you can do with our go you don't have to call helm. You could your your tasks can be anything you want them to be including configuration tasks. Things like things that you absolutely cannot do with home things like installing things on the host installing CNI plugins for example and configuring them. Argo also were very useful or possibly useful for solving issues with configuration right so it's not just deploying lots of Kubernetes resources right because in the end what we have here as you showed with you showed that we have all these Kubernetes resources deployments pods etc that that are being deployed for us in order. So two issues there one. I think we would all like our applications to be more cloud native in the sense that they shouldn't depend on order that is things should come up and if they do have dependencies they should be autonomous in the sense that they component should be able to make sure that if the dependencies don't exist and it won't do any any work right. Ideally you'd want to be able to deploy everything declaratively without a workflow and and have everything up but but we we of course in reality isn't always that one of the aspects has to do with configuration tasks things like net configuration for various components. Things that could happen in order and it's useful to sometimes break them into building blocks that you can indeed put in a cyclical graph. But what one of the problems with helm and I think helm is very problematic to be honest is that in the end you know it's a it's a text templating tool right it creates a Kubernetes manifest for you and YAML and and those become the the Kubernetes resources but but but but we have much more that we need than just that I think I mentioned that kind of configuration tasks but there are all kinds of other things assembling for example clusters of components maybe putting a load balancer of some sort for a particular protocol among them there's this problem space I devoted a lot of time for it I'll share in the chat some people know this sorry for tooting my own horn, my own horn here but I'm working on an orchestrated which is based on Tosca rather than the Kubernetes manifest and lets you create apologies with all kinds of relationships relationships themselves are typed in Tosca so what I see here is basically there's one kind of relationship which is a dependency. And that dependency defines order of execution but I think there are a lot of other kinds of relationships that we we want to create some of them are networking connections but some of them are. You can call them logical relationships that have to do for example with, as I said, look, say look, you want to describe a load balancer so you know I love this visual graph presentation but this is a deployment graph. Specifically, this is an order of deployment. But once you get to day two operations and changes it's not so much about deployment it's modifications, especially in configuration that are more than this so not to say that this isn't an important contribution but I think it addresses one corner of the problem. Hey tell, do you have some specific questions that we can look at. Like, if you're saying there's a specific area how do you handle this and you don't see like you don't see that it's going to be handling, and then we can hear back some targeted questions about this. Well, so one. Yeah, I know I didn't end up really making a question here but yeah. The question would be more specifically about how does orchestra handle tasks that are not helm. So I mean it's integrated with Argo, but how well is it integrated with Argo that is if I wanted to find Give an example of a task that it wouldn't handle by default their helm so then we can examine that. I thought I gave one that so a net configuration so let's say some of these components are running a net con agent, and they need to be configured as part of this. This entire product right so it's not just every individual sub chart, but those components those pods those services might need to be configured with net conf right according to a general plan. How would that integrate. Yes, it's a good question but it's kind of outside the scope of orchestra, you're right we only address the whole deployment strategy so doing orchestration, agnostic of what kind of deployments here, you're trying to leverage it for so it doesn't know whether you're a galco system deploying by G applications or not, or just that's why I said it started it started pretty. It was, it was as built for the affirmed workloads at that point there were a lot of tie backs to configuration day to deployments but over time. We saw that this could be applied to any kind of application so so one it's it's a generic tool. It's not. It's in no way tied to 5G. But it was it was built with these mission critical systems that take multiple releases at a time rather than continuous delivery that enterprises do. It was built with in service upgrades in mind and this is this is just around the deployment aspect of it. You're right about the day to configuration. A lot of people have their own proprietary stuff we have our own proprietary stuff on how we do. I'm not going to dive in. I don't even know too much about it because I'm not the main person working with that but there are cases where we leverage helm and helm operations to do those configuration. That said, the the selling point of orchestra in my mind is the in service upgrades and the the the kind of progressive delivery that it brings. So it's it's defense in layers. And by that, what I mean is you could start at the lowest layer and again we are tied to help today. So I'm going to speak from that aspect. You can have helm tests, which are part of your health charts that the developers built. You can bring in progressive delivery framework like our go rollouts or flagger in which case you have if you're using canary deployments you have automated canary analysis. So it would it would leverage service measures to do redirect traffic in steps and do the validation as it as it redirects traffic to the to the canary pods before doing a promotion or rollback. So that's that's another layer and then the third layer is the introduction of captain, which one lets you do quality gates where I think the the other feature that we we love about captain is that it can it can do continuous testing for you. And in the 5G world, you could imagine that as as the deployments happening for every application going in captain can do a call back to say an X for server or whatever your testing framework is for your call flows. It could go kick that off do some validation and only then promote the node in the tag. So the applications around so it will change the node in the back to agreeing before it goes to the next. Next node in in the workflow dag. So that's that's three layers. The fourth one would be bring your bring your own container executor. So now you could build your own. You could have your own script, whatever runtime you want to use that could query. If you're using Azure, go in and look at Azure monitor or any other kind of metrics or behaviors that you want to test for across your system or application group just to make sure nothing else is affected so you can build your own own validation as well. So I think it's it's to answer your question it's not it's not tailored to 5G specifically or rather the configuration aspect of 5G, which itself on its own is like a really complex task and orchestra is not trying to address that at all. Yeah, no it answers my question fully I think I So I guess that it really depends on you know for these tasks to turn green right it means that you have to write a helm chart that not only succeeds in deploying but actually has some tests to make sure to make sure that this component is up right this sub chart is up so it. It's up to you to make sure that your helm chart does the verification that it needs for the task to turn green before it just moves on. Yeah, additionally, not just checking its own state and whether it's up, it can also so a lot of a lot of those NFS are interdependent so it can go and query the state of or make make some sample calls or whatever it needs to do between those those NFS to make sure things are looking good. All the calls are succeeding so it could do smaller tests there like integration tests in there and then you have the system level test with the call flows happening using captain. So it can it can look look at the entire topology and do some verification across the in fact across other applications running on the cluster. Okay, thank you. Welcome. Any other questions. Right. So let me just share the link with all of you. It would be great to see people come in and give some feedback. And we love we love for contributors to come in and pick up some tasks as well. Space is right here. Please add the link and and if if there's a online version of slides or if you can upload those somewhere. Should I put it on the Google Drive. Yeah, put it on the yeah that Google Doc you can add them the links to the line at him for you. I'll do that. Yeah, that's only good. Thanks for letting me speak. Appreciate it. Yeah, absolutely. Thanks for coming and presenting to us today. That's all we had on the agenda for today. So in the teachers you can add the links to the doctors so people can find them after the meeting that'd be great. Is there anything anyone else would like to discuss or chat about any more questions for the teacher about orchestra. I have a general question now regarding the agenda and the the KubeCon videos that are up. There are a lot of KubeCon videos I wonder if anybody in this group can point us to some good ones having to do with topics related to telco. Yeah, so I think Taylor put a couple in so one that I recommend was the keynote from book from budget telecom talking about how they're using CNCF technologies to build out their. 5G infrastructure. Taylor also gave a talk about the scene of working group. Did anybody else see any talks at KubeCon that they liked or would recommend to other people. Tal were you able to attend KubeCon. I've watched exactly the two videos recommended so and nothing more. Okay, I know there was also some at the Kubernetes on edge day two, but I will add a link to that afterwards because I wasn't able to watch them. There's a lot of things going on in the day zero events, but I'll add a link to those videos after the call to. Yeah, it's a bit overwhelming. Yeah. Cool. Is there anything else anyone wants to discuss. Can I see in a teacher's drop the link to the slides in the chat too. So with that thanks everyone for coming if you're joining the scene of working group meeting we're going to be starting in about eight minutes on the other zoom call. So thanks everyone for joining. Cheers. Cheers.


Good evening and welcome to our continuing coverage of town meeting 2019 here at channel 17 We're happy to have you and we're going to be talking about the Winniske City budget and Ballot items and we are a couple of them are bond items So I've got them in there and we have Jesse Baker who is the city manager and Nicole mace who is the mayor So thank you both for being with us tonight. Thank you long land. I really appreciate it So we want to start we have a presentation for the budget and ballot items and I think it's always Good to read and understand what the strategic vision is of Winniske because you are really a very much of values driven community So why don't we start with that that is correct? So a few years ago the council decided to work with the community to be very very clear about where it was we were Hoping to get to as a city and so the statement is is up. I don't know if it's on the screen at the moment, but we're committed to being a affordable livable diverse community where the role of government is to foster and guide investments in economic vitality municipal infrastructure Housing and ensuring that are we have safe healthy and connected people. So those four areas have really been Areas that we've devoted a lot of time attention to and which our budget is intended to carry forward from what has been years of planning to into action and Can I just ask you just quickly? I don't want to use up your time because I know you've got a lot to say but just say How how does the budget process work and how do you get? Feedback from the community about how to inform the budget and these values So as Nicole said the strategic vision really guides our work. It's the community's value It's what we align our city work plans to So in the fall in October that we staff sit with the council and set some goals for our budget We then as staff go back and develop a budget. We do that in conjunction with our commissions as well So we have a pretty extensive commission structure where we have community voices at the table guiding how these values are reflected in our operations We then bring a proposed budget to the council at the beginning of December We go through a series of six or seven public meetings where we really dive into the weeds of our each department operations What's in the budget? What's proposed for new initiatives new projects? And then ultimately at the end of January the council decides what to put forward to the voters Got it. So what are the high high levels? What's the high level on the budget this year? I see it's budget Does a number of it's a critical budget for the city really we've had years of planning as I mentioned before and this budget both maintains current level of services and moves forward for large capital projects Two of which have been approved by the voters over the past year our main street revitalization project and the Myers Memorial Pool Reconstruction and two that are just critical infrastructure needs for the community water and street improvements to Hickok Street and New downtown parking infrastructure that we're going to go through during the presentation. All right And if I can just emphasize a little bit I think it's really important to acknowledge that the community has spent years going through a number of planning efforts many of Which have been covered here at CCTV from our main street project to our parking study our transportation master plan our community economic Development strategic plan and those plans have really rolled up into this call for action Our voters approved to bond votes last year And this is the budget that enables those projects to move forward as well as Hickok Street and our new parking garage So I think it's really important to reflect back that the community has spent years building towards these four votes And really laying a strong foundation to make sure that if if we receive approval from the voters were able to execute Relatively quickly. Yes. I want to just remind folks that if you have any questions We are at 8 6 2 3 9 6 6. We'd love to hear from you This is a good time for Winniski residents to weigh in with any questions They have on the budget or upcoming valid items for the March 5th boat So the Main Street revitalization project. How is that reflected in the budget? so this project This year in FY 20 is $155,000 engineering expense The total cost of this project is expected to be around $23 million and we've identified some federal sources in terms of low-interest loans and grants But this year we need to move forward. We're in the phase of Final design phase for the full project and so that will incur about $155,000 in expense Just as a reminder this bond vote was presented in May of last year was approved with 63 percent Approval and at that time we were projecting about a four to six percent tax rating impact for that project The annual debt cost for the engineering that we're going to incur in FY 20 If we rely solely on the property tax to fund that would be about a three cent increase to the tax rate Luckily, we don't have to rely solely on property tax revenues and we'll talk about that a little bit later But certainly the next council is really going to need to wrestle with The pace timing and scope of that project moving forward so that we can you know Manage that $23 million cost over the course of several years and what's the highlights of that Main Street revitalization? What's going to be different? Sure, so Right now the water and wastewater lines under the street are about 100 years old We're experiencing some pretty significant water breaks along those lines. So it's a full reconstruction Subgrade up so new water lines wastewater lines We're going to run the utilities along Main Street and then improve the streetscape So bump out the sidewalk allow for new street trees green space along the road And put in some bike improvements as well. So it's it's not where this circle is It's Main Street up towards the interstate exchange exactly It's the mile of road between the railroad bridge right north of the rotary to exit 16 All right, so trees and pools So the pool Has been closed for a few years now this past august voters approved Gave us bond authorization for up to 3.8 million dollars to support the reconstruction of this valued community asset On the estimated cost for this fiscal year is 300 thousand dollars We have we're excited to announce today. We received a grant from the state of vermont for close to 150 thousand dollars So we are really as a council been very committed to identifying Sources of revenue to offset the impact on the property tax We have a pool fundraising committee that has a goal of raising some funds to support the construction of the Slide and a shade structure. So we're really excited about the prospects for moving forward This spring with construction And this again this investment in the fy20 budget allows us to do that Excellent and then hickok street water improvements. That is a bond request for this ballot It is so one of the things we heard Through the previous planning efforts was our neighbors really wanted us to focus on the neighborhoods as well As improving the infrastructure in our core downtown and along our gateways So the hickok street area has needed some work for a long time needs some infrastructure improvements So this is primarily a water replacement project We're going to replace the water lines underneath the road and then repave the road It's it's focusing on one of our most important neighborhoods And doing so with no impact to the tax rate no increased impact to the tax rate We can fund this project slowly solely through our water rates our wastewater rates and our existing debt service Capacity within our general fund. So I get the I'm getting the impression that the infrastructure Underneath when is ski needs to be replaced As it does across the state. Yes, exactly. So you're you're planning to do it in sections as opposed to one big undertaking Okay, and um, you're going to talk. Are you going to talk about the impact on the water rates of this? We will and Few slides and the abnaki garage talk about that So, um, this is a new parking infrastructure that we're proposing for Abadaki way. Um, so the lot right now between ccv and river run in our core downtown It's currently used as a parking lot this new parking infrastructure will allow us to alleviate some of the parking pressures in our current garage therefore Creating some new space some new accessibility for our residents and visitors to Park close to the downtown the restaurant community, etc It also allows us to fully develop the tiff district So a couple of years ago. We had permitted a hotel At the bottom of the rotary in winewski that ran into some legal challenges Some concern about where that was situated and how the traffic flow would work So with this project, we will move that hotel development to lots what we call lot 7d The corner of winewski fallsway in abnaki way The hotel developer is on board with this will then subdivide the lot We will build our parking infrastructure on one side between ccv and the hotel And then the hotel will go on that prominent corner at the corner of abnaki way in winewski fallsway And we're really excited about we're excited to successfully wrap up the tiff district in five years We're on track to do that and that downtown master plan always envisioned a hotel in our downtown So I think this is really bringing the community's vision for our vibrant downtown community to fruition And this is the last lot that the city owns in that In the tiff district and it's currently being used for parking So we really believe that this project maximizes the potential of that space and meets a critical need for From our residents and business partners So so those are that's a general obligation bond It is so they're both general obligation bonds, but that bond will be paid solely through the parking fees Within our parking fund. So there again will be no impact to the taxpayers as a result of this construction Okay, so so when we talk about our level services budget So this budget obviously maintains current levels of services as we said earlier We had some assumptions built into that That lead to increases including a 2.8 cost of living adjustment increases in health insurance We also projected a modest increase in the grand list because The pace and scale of development can be difficult to predict. So we always air on the side of caution in terms of estimating new revenue Generated by development, but we're we're anticipating about 40 000 dollars in new property tax revenue for the general fund Which will offset the need to Raise property taxes and here's the the so now. So what does it mean to me slide? So this budget will result in a six cent tax rate increase for musky residents When you look at a 225 thousand dollar home, that's roughly 137 dollars a year an increase When we talked about The main street project and the pool project With our community at the time that the bond votes were being presented We had estimated somewhere between I think eight or 11 and 17 cent tax rate impact for those projects So, uh, how did we get to six cents with funding both of those projects and Maintaining our without cutting operations That is because we've identified some new revenues to offset the tax rate impact So council was really clear with the community that in order to move forward with Some of these major infrastructure projects that we were going to be pursuing every possible avenue to offset the Impact on the property tax So one option that we are presenting to the voters that they will need to approve on town meeting day Is the local option sales tax and a local option rooms meals and alcohol tax And that's something that brollington has Yes, yes Williston has yes Most other surrounding communities Have those okay. So we are essentially an outlier at the moment because we do not collect a local option sales tax We've worked with the business community And they seem on board with this as a way to ensure that You know when uski is a destination for many Vermonters and and non-vermonters and if we're going to be investing in Our water sewer and road infrastructure that This is a good way to ensure that those visitors contribute to those costs as well So on that slide, could you bring that slide up again kevin that There's a lot of information on that slide and it's a little hard to read So what's the most important part on this slide jesse that people should be looking at So I think the most important thing to think about when we're considering the local options tax Is it really is a way to diversify our revenue streams to bring revenue into the city? That's not solely property tax revenue not solely our residents But as nicole said as we become a destination How do our visitors contribute to that infrastructure that they're walking over driving over parking in etc I think it's really important to note that when uski right now is in a donut hole We are surrounded by other communities that already Benefit from this diversified revenue stream. So how do we Capitalize on that and bring those revenues into the city The council has been very clear that these new revenues. We're projecting about 277,000 in the first year collected go solely to capital So we're not Tapping that revenue resource to pay for operations. It's solely going to our increased cost for main street and the pool So the sales tax is projected to raise 144,000 and the rooms and meals Is the meals and alcohol is projected to raise about 133,000 correct And I think it's important to note that the sales tax does not apply to essential items like food clothing medical items Shoes etc. That was also really important. Well, you can't buy those things in winiski. Can you Buy a few things. Well, you know what I mean? I mean winiski is primarily A rooms and meals and We have some clothing stores that are pretty fantastic Yes, yes, we do Corrected the block building. Yeah, and it's actually projected that the sales tax will bring in more revenue than the rooms and meals and alcohol tax That's that what the state data shows us Because we don't have a hotel yet. We don't have a hotel yet.  Well, we have commodities in our downtown So we we've achieved that for the downtown I think from a large-scale supermarket perspective The market is very hard to make work in winiski because shaws is you know an eighth of a mile from our border. Yeah, got it. Okay So in terms of the water projects we um We do we have identified new revenue through increases to the water and sewer rates. Um, so we're Presenting a two and a half percent. We've approved actually this council two and a half percent increase to the water rate And a three percent increase to the sewer rate Taken together that'll have a collective impact of around 32 dollars a year and an increase If we go to the next slide, you'll see again, it's a little hard to read But you can see our rate history um for water and wastewater rates Have not increased those rates since 2012 and even with these increases We're about in the middle of the pack in terms of our neighboring communities This council if you can see the chart you'll see some years We had an 18 percent 19 percent increase and then years of no increase So I think the attitude now is the the better approach to ensure we're you know having Putting money aside for these capital these infrastructure needs that that we now have a plan to address that we would see regular moderate increases On an annual basis rather than nothing for years and then a spike Got it. Okay, and you're not part of this the Champlain water district or are you we are yes, and so how do these water rates Tie into the Champlain water district So the communities that are part of the Champlain water district buy wholesale water from the district and then we operate the distribution system So we buy the water that we manage the pipes under the streets We manage obviously the wastewater treatment plant where the water ultimately goes And the rates we charge cover both our wholesale purchase cost as well as our operation and capital cost to run the distribution system Are you seeing any increases from them for the cost of what they provide? They've made a small increase this year But again along the lines of nicole as nicole was just saying In order to stay up to date and sustainable with the cost of operations So a household's looking at a combined Property tax and water rate tax of about 170 thousand dollars give or take if their house is worth about 250 170 dollars. Yeah Yeah, okay, great. So you've got this slide here past tax rate increases or lower than inflation Yeah, so um, this is just to um, you know, I think most wanouski Voters will see a six percent increase and say well, that's higher than we've seen And so we just wanted to remind folks that this was intentional So for the past five years Council and the city manager's office worked really hard To hold the the line on increases and spending and really try to keep them at or below Inflation and as I said earlier the water and wastewater rates have not increased since 2012 because we knew we were coming into these Critical infrastructure needs and that we would need to be asking our taxpayers to support these investments. So All of that is intended to again We're excited about the fact that we we were able to present this budget with a six cent increase And move forward with main street and the pool And maintain high Levels of service to our to our residents. I think you know when you when we thought about a potential 11 to 18 percent increase To fund just main street and the pool to be able to come back to our voters and say Um, the final budget in this slide has more detail in terms of the split, but um, when you break out the sixth sense 2.4 Percent of that is for operations and then the the remainder is for main street and the pool. So kudos to to jesse and her team for really being thoughtful and creative about ways to diversify the revenue to to make sure we can actually move forward on the projects but Not place the entire burden for doing so on the property tax So for folks who might have just joined us jesse, would you just recap for us? Sure So this the budget items the four different ballot items We will be asking the voters to vote on on town meeting day really Bring to fruition what we've already heard from them. They want main street to be revitalized They want the pool to be reconstructed They want us to invest in our neighborhood infrastructure And they want us to successfully wrap up our tiff district This this budget while a six percent increase a six cent property tax increase As you said a hundred and seventy dollar impact for the average property tax paying family over the year Really lets us get to that place where we can implement We've been talking and planning and talking about community values and and visioning for our community for many years This lets us put shovels in the ground and get these things to fruition for our residents and our neighbors All right, olive, would you like to come and remind everybody when to come and vote? Can I just say one thing this last slide talks about the four? Questions that will be on the ballot box The first is the prove the amount to be raised by property taxes The second is to approve the bond vote for hickok street The third is the bond vote for the abnaki garage and the fourth is a one percent local option Tax on sale sales and rooms meals and alcohol We need four yes votes in order to move forward with this community vision For example, if the local option sales tax fails and then we really need to rethink the entire budget Because so much of what is included in the budget relies on that additional revenue moving forward So really appreciate the opportunity. It's a complicated budget The pieces fit together like a puzzle and so we're hopeful that we do see Four yes votes when folks come to vote and when do they do that olive? Tuesday March 2019 from 7 a.m to 7 p.m At the senior center at the senior center, that's right And um, we can't say vote early and often but we do want you to come and vote And not to forget that election day town meeting day is march 5th So thanks so much for watching and thank you so much for presenting the winiski budget and bellions Jesse Baker and Nicole mace. Jesse Baker is the city manager. Nicole mace is the mayor of winiski and olive is Our co-host here. So thank you so much. Thank you. Thank you. I'm glad


Everybody forced here ripping 21 22 impeccable basketball hobby three box case number 52 pick your team style We've got Alan a Kings Christopher M. Spurs Damian K Hawks pelicans nicks Danny C warriors D Lou nuggets Edgar B bulls wizards Farron Z with the T wolves Harper B Mavericks Grizzlies thunder magic Jason L heat Joel M with the Hornets That's Joel and the Hornets Jonathan C bucks Ken I nets Kenneth G with the Celtics and Sixers Matthew X blazers Michael C Clippers Pacers and Jazz Mike B Raptors Paul K. Cavs Robert P. Lakers Shigganore you Pistons Jing W with the Suns and you Chen with the Rockets. Thanks everybody for joining a good look How do you feel about Jalen Brunson Mike he was definitely big for Dallas in the playoffs That'll insert there Do that one at the end. All right first up going to the box. Yeah, I'm a Santana Kumpo to 99 magic RJ Hampton a 35 and Sixers Ben Simmons to 49 First hit goes the Nets.  I think he has a few teams in this. So let's go ahead and check Vince Carter Elegance retired jersey auto card nine Elegance retired card nine is Raptors Raptors on the Vince Carter That'd be a big one there patch auto of insanity Stainless stars parallel for the Suns Devin Booker to 75 got the super max extension from the Suns today Phoenix all right cabs Collins sexton out of 99 Nuggets Nicola Jokic to 49 Nicks RJ Barrett to 75 redemption Warriors elegance rookie jersey auto moses moody Doves There you go moody elegance rpa Nice hit warriors Champion already got blazers impeccable selections auto laru laru martin to 25 interesting Team player combo here 76ers tony kookoch auto to 99 76ers tony kookoch Grizzlies rookie autos zaire williams to 99 Nice hit grizz. I think zaire has got a good upside there And rockets rookie impressions auto jaylen green 33 of 99 boom Houston awesome rookie auto there the lovely impressions design on these as well Great color 33 of 99 on that Let's keep it going one more here Timberwolves stainless stars purple kevin garnett to 49 T wolves kg I think so Uh james book knight rookie for the hornets to 75 Might just be out of order I don't know I guess we'll see Should have all the hits though either way blazer season but calling the 49 Now the rockets hit here Jay shuntate extravagance auto to 25, but you just got a extension from the rockets Solid hit there second year Jay shunt elegance rpa pistons. I say a liver son 99 So chris ox jaylen johnson rookie impressions auto to 25 redemption For It's grand hill impeccable victory signatures I would assume pistons on the impeccable victory for grand hill Let's see Yep, he's only pistons in this actually he's got two sets at his pistons grand hill Nice hit there. We're not thinking impeccable victory would be him with the magic Got lakers anthony davis He's called impeccable stats auto to 42 nice ad Love the look of the uh, it's like the impeccable Design I guess you could say 10 of 42 anthony davis lakers auto 42 points May 9th 2021 Get that one mad for your lakers And metal insert here it is blazers d. Me and lillard troy ounce of fine silver numbered five of 20 there you go portlands Troy ounce of five silver d. Me and lillard I wonder if they'll make any noise in for agency All right, let's go ahead and recap that case Pretty good case overall Some big redemptions in here We had a pistons redemption grand hill on the uh Impactful victory signatures jaylon johnson hawks jay shawntate rockets. Isaiah livers pistons rpa grizzly xyre williams 76ers tony cuckoach trailblazers larou martin warriors redemption moses moody rpa Rockets out for in shingoon wizards corrie kispert pacers jaylon rose nets joe harris With a trance of silver for the blazers d.  Thanks you again everybody. We are on to soccer for a bit


Everybody Matt here for late in sports cards ripping two boxes of 2022-23 tops. You have a club competitions Merlin chrome soccer These are for Sam M. Good luck Sam up cheese Muhammad kudos refractor Not a soccer guy will mispronounce some names like even the soccer guys. I'll mispronounce some names Pablo Torre and Omar at Zili vintage Merlin coming my new Gavi under 21 Phil Foden refractor with your boniface put a face. That's a rookie speckle 150 Gonna say the name backwards might pass out if I try that All right, here we go Carney Chukumeka Chukumeka Merlin's Masters Harry Kane Young men son refractor Pablo Barrios rookie refractor Bellingham, so do you know Zoff Agile Salkamy? Benjamin Sesco It's a neon green shimmer to 350 And Juan Griezman Luca Romero under 21 This is not the guy right there's a guy whose name sounds like goulash. It's not him The junior and this is a red shimmer Christian Pulisic to 299 All right, that red like Gets me like it throws me off. It's like excited. I'm like, oh man. It's gonna low-number Alex Lowry rookie under 21. I can't read that word Steve without reading it like hearing it in my head And Andy Sambury voice Cody Gackpo you're watch Erling Holland and mojo auto Cody Gackpo. This is to 99 75 of 99 What about Brooklyn 99? Did you watch that? Show like show. Yeah, hella DiBala as Andy Sambury Detective Cabaret Lowry I almost said in Brooklyn The safe word is hoisky Jory boss green refractor rookie to 99 Bandowski refractor Still room of like plenty of room if y'all want something ripped And so Fernandez miss Loneland to ruin I actually I think they had a Like every I was like the last one to know about him You're a boss. Well, he Yeah, he did a particular Who's whose title I will not name yeah Baki Yoko and Matt this towel That's a red shimmer to 99 Zabi Alex Lowry and The John Kulisevsky neon green Muhammad Ali Cho Simon a rookie refractor I don't know why shied away from that name there's Antoine Griezmann and Frankie De Young vintage Merlin Francisco Konsai Chow Ponsi Chow Erling Holland Chama Musiala refractor 121 Fabio Moretti All right, here we go. We're gonna give this one shot Andres shoulder rope rookie Mincesco Kulisevsky and Kai Havertz Mojo Otto to 99 You go Sam And so Fernandez Merlin's master's rookie How about a low-numbered parallel here and now messy Devin Mubama rookie refractor Ruhachi Green Mojo to 99 Tomasso Pobega Hadry and under 21 Paul Wanner All right, there you go, Sam. That'll do it for your break appreciate it. We'll get these right out to you


Thanks for coming out. I'm Ash Mastaflash and today we're going to cover inexpensive coordinated GSM anomaly detection. More specifically what that means by inexpensive. The whole goal of the project was to come up with something that was going to be far less expensive than the production of a malicious device. Coordinated meaning centrally configured.  So central configuration and software management was really important. And by anomaly detection, specifically what we mean is picking up rogue BTS's and IMSI catchers. So let's jump in. A little about me. I started with actually getting paid for technology to work around 2000 and I hopped disciplines every few years, kind of changed focus and now I'm working in R&D for a cloud workload security company. And I don't like talking about me, so that's where we want to end that. Let's talk about you. The audience I was writing this for has a background in systems and network engineering, some interest in GSM threat detection, but probably not a huge depth. I mean if you've got it then great but it's not required. I'll give you the crib notes so we can make it through. And tinfoil hats certainly not required, but it's not unwelcome. So go ahead and put it on now and let's party. So I said that I'm working R&D now. I really love my job. And as such, this has nothing to do with my day job. So if you don't like this, if you do something with this and get in trouble, I completely disavow whatever it is that you do with this. So yeah, and don't go talking to my boss about this. Just come talk to me if you don't like it. So here's what we're going to cover. First off, why you should care. The current threat and detection landscape. The original project goals, two iterations of the sensor and the service architecture because it's kind of a split architecture. Set up future plans for the project and that's where I kind of beg you for your help and full requests. Not an hat tip to prior art and Q and A. Why should you care? Because invasions of privacy are bad even when they're unnoticed. Yeah, that's true and this all is kind of vague. So specifically what are we looking at? What's the worst that could happen with a compromised cell phone conversation in your CFO's office? It could have a financial impact on your company. In the right CFO's office you could even be looking at something like insider trading or market manipulation with the right phone conversation. So these devices are so small and so easy to hide and so inexpensive, you know, can you really trust your ficus, adjust your tinfoil hat. And the second side of this is it's with an IMSI catcher you can also determine whether or not a specific person is within a domicile. So if with one of these devices someone could walk up outside of your house and they could get a listing of all IMSI numbers. Now IMSI numbers are the ones that are burned into your SIM in your phone that's attached to your account. So that identifies you as an individual. If you can take a listing of those from everybody inside of a house process of deductive reasoning you can determine who is home. So it's a little bit spooky and it's not that expensive to carry off. The terminology of baseline for the talk software to find radio. I had one of those in my pocket but I gave it away. It's using software to perform your signal analysis and using a typically a USB dongle that has a software controlled tuner. And in the case of this we're using the RTL, SDR devices, the super cheapo like $20, $40 units. ARFCN, absolute radio frequency channel number. I may just refer to that as channel number from here on out given that this isn't a GSM in-depth talk just because it's easier to kind of wrap your head around. Think of this almost like a television channel. CGI Cell Global ID is a globally unique identifier for the BTS that's comprised of a mobile country code, a mobile network code, a location area code and a cell ID. All that comes from the BTS. And like I said earlier the IMSI is what's burned into your SIM and that's what identifies you as an individual. Here's a visual aid to kind of wrap your head around GSM addressing in regards to the global cell ID. Every mobile country code has a number of subordinate mobile network codes within that. You have multiple location area codes and within that you have multiple cell IDs. So let's talk about threat and detection. So we'll go over, first a drink of water, malicious devices, how you know that these malicious devices are in play and what's currently on the market to detect them. So Hack Femto Cell is a trusted part of the provider's network. We saw some really good talks in DEF CON 21 about hacking Femto Cells for the purpose of honest IDS and also for some nefarious purposes. With a hacked Femto Cell you can gather IMSIs and you can also record phone calls and SMS traffic that are going across it. Your phone has no idea if it's good or evil. Your phone is just going to attempt to attach to it. And Evil BTS. Evil socket had a great blog post on how to build one for very, very cheap and ham hands for scale. This is the size of the SDR that's necessary to build a, you can kind of see how this could fit in your FICUS right. And that's the largest device in the system. So that coupled with a Raspberry Pi 3 you can build an Evil BTS and record phone and SMS traffic. Again, this is the same case with the Femto Cell. Your phone doesn't know if it's good or evil. It's just going to try and talk to it. That's a GSM thing. So indicators of attack. How do you know when something weird is going on? ARFC and remember think of it like a TV channel. All of a sudden if a channel goes loud over threshold this is something you determine by the short period of observation. So you can set a threshold alert when it gets over that. ARFC is an outside of forecast. You can use, here's a spoiler alert. We're using graphite and part of this. Graphite has Holt Winters algorithm built in so that you can have a confidence band over time. And so if something that's typically low but all of a sudden gets a little bit louder it may not be a threat to you but it may be something nearby. A channel all of a sudden getting louder may indicate that someone's trying to broadcast on the same channel. Unrecognized cell global ID. There are databases you can download with the GPS coordinates and all the metadata for the cell global IDs and it's useful for determining your location. If you don't have a GPS chip you can kind of make that determination based on where the tower is. Gratuitous BTS re-association. This is something that you would determine by observing the behavior of a cell radio. And if all of a sudden you have a stationary radio that starts associating to another BTS or a bunch of other BTSs typically for a standard or a stationary radio you're not going to see a lot of that behavior. If you're walking around it's supposed to happen like that with your cell phone but if it's sitting in one place you really shouldn't be hopping towers a whole heck of a lot. And if you have the GPS location of a tower by the cell global ID and the BTS is broadcasting a cell global ID of something that should be in say Orlando if that cell shows up in Vegas either someone's absolutely awful at their job of configuring BTSs or it may be something malicious. So current detection methods both Pony Express and Bastille networks have an offering of which this is a subset. Open source options. Fake BTS is a really cool project. It serves as the original inspiration for this. It's a collection of shell scripts that use wire shark and air probe and calibrate to make a determination as to whether or not you have malicious nearby cells. The Android IMSI catcher detector is software that you install on your phone itself and it interacts with your cell phone's radio to determine if there's any sort of anomalous behavior. And Femto catcher is very close in function to the Android IMSI catcher detector but it's specifically for catching Femto cells and it's really only effective for phones on Verizon wireless network. The original project goals. It's Vegas. I think it's okay to ask for what you can get for $100. So that was the goal is see if I can get the target price under $100 for the first iteration. I wanted a low footprint for the raw materials. I wanted it to be at least as small as this and functional targets. I wanted to be able to pretty much use the indicators of attack as a metric on whether or not I would be successful detecting rogue BTS's and centrally managed software and configuration. That was really important to me because I have really big hands and it is such a pain to actually get those micro SD cards into the right slot in a Raspberry Pi and I've lost so many and gotten so frustrated having to crack the case back open to get my yeah I didn't want to screw around with that. I wanted to be able to drop this thing under a desk behind a ceiling tile pretty much wherever you might find a malicious device I wanted to drop this thing so that you could get good local coverage inexpensively and not have to touch it again. In the process of this I collected a lot of hardware. I had a Raspberry Pi 2, a logarithmic antenna, a couple of odroids, a C1 plus an XU4, a galaxy of red and blue and green and orange LEDs until NUC and until Edison, a GSM modem, a handful of RTL-SDR devices. I didn't really need all this stuff but when you get locked into a serious hardware collection the tendency is to push it as far as you possibly can. So that brings us to situational information from telemetry and correlated heuristics and I definitely started with the acronym site of that before I came up with the words to match. So this is the first iteration of the sensor. I had an RTL-SDR device, I wrote a wrapper in Python to get that into structured data using Calibrate and all of that feeds into the main process. Also running GPSD to pull accurate GPS readings from a GPS dongle using log-forward to forward scan logs since we have it in structured formats pretty easy to drop to file and log-pick-set-up, shoot it off to log-stache, elastic-search, all that good stuff in the cloud and I was using a tool, a Python tool called Graphite Send to send all this stuff over an open VPN channel up to a Graphite instance for tracking time series measurements which was, it was effective enough, I talked Verizon into sending me a FIMTO cell to set up in my apartment and when you start it up, I mean they never really consistently started the same speed, sometimes you'll be waiting for 40 minutes for it to get a GPS fix but when it does go live, it's pretty plain to see. Honestly, this graph is a little bit smoothed out, it's normally spikier than this, I went back in history in Graphite and Graphite had already kind of smoothed things out for me but it's very clear, very apparent when this stuff goes live because it gets very loud and your phone attaches to it and then today you're on a part of Verizon's trusted network. So remember that slide earlier, here it is in table form. So these are our functional targets, ARFSEN over threshold as a big yes as well as ARFSEN outside of forecast but the tool that we're using called Calibrate, what it does is it produces a list of channels, nearby channels and gives you a power rating. It's typically used for picking up, for determining your clock offset because the SDR devices are notorious for being drifty and the RTL SDR devices are especially notorious depending on temperature so those are the things that you actually can't get away with running those things with the lids closed, they get way, way too hot and the price was $100, like it was right at about $100, not counting the case, I mean the case was kind of necessary for the trip out here but just the raw components you can get for about $100 and it's pretty effective. The problem is you're looking at about seven minutes worth of resolution so it takes seven minutes to scan 850 megahertz GSM using a Raspberry Pi 2 and you can actually have kind of a pretty important conversation in less than, you know, in less than seven minutes. So good first-generation I was thinking, ah, I got, this actually happened after I submitted my CFP. I was able to kind of prove what I was thinking and so this is like late April and I was thinking, ah, I could kind of roll with this just right on this and maybe be fine and cool and I started looking at the source code and I was really, really not happy with it. It was pretty horrific and that's just not me being self-conscious. There were a few problems with this. So what's wrong with mark one? Main was single threaded and when you're pulling data from two separate devices you can end up with some interesting situations if you've got to wait on your GPS to get a fix and then you do your seven minute scan of 850 megahertz GSM then it's, it's this sort of sort of additive problem. It's, ah, you can really end up with some kind of ridiculously long scan times especially if you're indoors trying to get a GPS fix. Another thing I didn't like is that there were two secure channels for delivering the information.  So now I'm going to start the demo and I'm going to start it early in the presentation because it takes a, um, this stuff is kind of bandwidth dependent so I'll explain a little bit more about that. Check this out. Is this thing on? Alright, so this has got a RTLSDR device, uh, GSM radio, it's a Raspberry Pi 2 and, uh, and just some stuff to support that. So, and this thing's being provisioned from zero using the, uh, orchestration stuff I was talking about. So while we're waiting on this thing, ah, what it's doing is there's a, the service that I'm using to orchestrate what I'll loosely call firmware, although maybe we'll have a discussion on the actually what firmware is later. Um, I'm going to call it firmware.  But the, um, what actually sits on the device, there's a service called Resin. And, uh, Resin has built an image to put on your Raspberry Pi that runs Docker. Uh, I think, I can't remember the version of Linux that's based on, I'm not going to promise something up here. But what it does is it dials home to the service, um, and it pulls, uh, Docker images of whatever you commit. So basically what you do, this is what your deployment pipeline looks for using, uh, Sitch and Resin.    So, um, get good at unit testing and then make that part of your commit. Um, the, the commit hook will run a Docker build on your code and if your build is successful, it'll accept the commit and moves the image into Resin's registry. And then your device will, it, it pulls like every minute to the Resin service and when you have a new container image, it just pulls down your container image and restarts. And you don't have to touch the thing to do software updates, which is really nice if you're sticking these things up in attics and all over the place. So, as far as service side software goes, um, we've talked a lot about what's actually running on the sensor and what's running on the service side, uh, most people in here, if you're a sysadmin, you're probably familiar with LogStash, Elasticsearch and Kibana. It's a great, fantastic open source tool and it's super versatile. It's a part of this, uh, as well as using Carbon and Graphite for time series, uh, database and for statistical calculation. And I'm using Tissera because, uh, as much as I love Graphite, Graphite's graphs are really not pretty. You need something to go on top of it. And, um, Graphite Beacon is probably the simplest tool I found for just measuring and looking for things outside of bounds on Graphite. It was so nice that somebody didn't over engineer something. It's simple. You can figure it, set it up and fire it off. Um, so that's what I chose. Vault is a really cool tool from Hashi Corp. And, um, and what it does, it does secret management. So, you can load certs, you can load, uh, credentials in there and you use, and we have the keys for accessing those loaded up into environment variables in the device itself. So, you can do your credential rotation against Vault and then you just bounce your whole application. You know, through the Resin user interface and everything comes back up, gets its credentials and all those credentials are written on the sensor to a, um, to a RAM disk so that if somebody does jerk the power, it's at least a little more difficult. I know, you know, with physical contact all of your security should be considered null, but at least it makes it a little bit more difficult to uncover your, uh, your crypto material. Resin is the service that I use to manage the software and Slack is where the notifications come out, you know, because at least you can do it over IP and you're not relying on SMS when GSM may or may not be, you know, a friendly area. So on the service architecture side, um, uh, the first thing the information hits is the inbound information processor. What that is in this case is, uh, log stash, uh, document retention, everything stored in structured data in Elasticsearch and the web-based portal is, uh, kind of a combination of Kibana and DeSera. Uh, the time series database is Graphite and analysis and alert generation right now are shared by, um, Graphite, I'm sorry, um, that other tool, Graphite beacon, and some stuff that's coming directly out of the sensor. The sensor is actually smart enough to do some alerting on its own and that stuff is caught by log stash and it kicks it out straight to Slack. Uh, like I said, an external alerting service is Slack and there's a user.  The open cell ID database is out there and it's super useful. The only thing I think it didn't contain that I really wanted was the carrier name because you can make that determination using the MCC and MNC parts of the cell global ID. Uh, so thank God for Twilio and their free pricing API because you can just pull all of that stuff down. API key is free and the way that this works is it's all because once you start using Docker for something, you just want to use it for everything. And um, and so I have this Docker container that I can run as a job and it goes out, it pulls down the open cell ID database, it merges that with the information of Twilio pricing API and it throws this stuff out into files based on MCC. The reason that's sliced up is because that database file is so huge, uh, that you want to have this kind of broken up and uh, knowing the company, country that you're operating in, you should be able to determine the uh, mobile country codes that you need to be downloading for. So it reduces the download size, uh, but truth in advertising is, as much as I want this live demo to work, it is a lot of information and maybe or maybe it won't be able to download everything in time. If it doesn't, I've got a, I've got a video and I'm sure this probably wouldn't be the first time a live demo fell over at Def Con. So, uh, if you insist. So let's talk about the Mark II sensor and uh, and kind of the improvements I wanted to make before I showed anybody this, this ugly baby of mine. Um, so there's a component, uh, the Sim 808 collector. Uh, that interacts with the GSM modem to actually function in some, in a way that's somewhat similar to the way the Android IMSI catcher detector works, uh, by interacting with your phone's, uh, GSM components. So, the um, so everything that you see in green is its own thread off of the main process. So that way you can, you can currently run collections against your GSM modem as well as your RTL SDR device so that you don't have to wait seven minutes and then do it, you know, it's just, decided to forego all of that. Um, everything that you see in blue is a first in, first out buffer. So all of this scan information goes into the enrichment buffer and the enricher thread picks it up. Enricher thread compares that against the enrichment database that you pull down based on the MCC file. Yes, the MCC file, uh, that comes down that's, all that stuff gets shoved up into AWS. It doesn't have to work like that. It'd be simple enough to tool around to work off of an HTTP server but AWS was just easier so that's what I did. Um, and the emitter, uh, can emit straight to scan logs which are picked up by LogStash forwarder or you could point it off to, um, to the LogStash server itself. I felt a lot more comfortable having it work with LogStash forwarder because LogStash forwarder can run its own buffer if you end up with loss of communication. It just seemed like the smarter thing to do to not have everything just pipelined up in memory on one of these small little devices. And everything goes up to LogStash over that single channel, no longer using open VPN and, uh, LogStash has some great output plugins that you can use to take that structured information that's coming in and spit it right out to Graphite. So kind of coalescing those two paths was super, super that it just make things seem simpler to me. So this is kind of a, a block diagram of what goes on inside the sensor. Uh, for a calibrate scan, everything goes, um, it goes into the enriched thread, or enriched thread picks it up from Q and, um, and it can fire alerts on its own, um, based on a threshold that you set in the environment variables in Resin. Resin is the service that manages it, pushes out environment variables for running your program. Um, so you can set a device specific threshold depending on where in the building it is cause you don't want to set the same, I mean that's, that wouldn't work. Um, and it also sends individual events or individual, uh, structures for ARFS and metadata and the original scan document containing your timestamp, all that other good stuff. It's a little more interesting when you start pulling from the SEM 808 module, which is your GSM modem. Uh, the enriched thread gets it, does a comparison against the enrichment database, which is kind of sizable, but it does do a little in-memory caching for a little while, just so you don't have to keep hitting disk for everything that, that comes through. And it can set, it can do alerts on changes in the primary cell global ID. It can do alerts on the cell global ID not being in database. And it can also do alerts on the cell global ID, uh, not being arranged based on the geolocation that's coming down through the feet. Um, what I kind of want to draw your attention to is this calculation is actually happening on the Raspberry Pi. So the idea is that you should be able to stand that stuff up and, um, and have a fairly small compute overhead compared to some other services, because a lot of the compute's happening on the device itself, uh, so doing stuff like geospatial calculation and stuff like that. You don't have to do all of that stuff because the, um, something I'd fail to mention earlier, remember I said that there's about a seven minute delay on getting results with an RTL-SDR device. When you throw one of those little GSM devices into engineering mode, it's every few seconds you get a list of all of your, um, nearby cells by preference according to the GSM. So, uh, the RTL-SDR device is more of an objective observation. I see these channels, here's the power, but you're interrogating the GSM modem actually tells you what it prefers. So the stuff that's a little more GSM heavy of why do I prefer this tower over another takes care of all of that and you can just query the GSM modem and ask it what do you prefer the most and you can tell when your primary changes and you cut the resolution from around seven minutes down to just a few seconds. Woo! Uh, so this is what you see in Slack when, uh, you know, after the thing gets, gets started and gets warmed up. Uh, these alerts are for things, you know, like not being in the feed database, other stuff like that. And you also get alerts for, um, Graphite Beacon when you have problems with anomalies being detected when things fall outside of the forecasted expectation for your time series measurements. So, here's when we return to the demo and see if these things are actually going to behave for us. So, I don't think I get a drum roll up here but it's, I hope you can, I hope the anxiety is palpable. Just truck this over there. Sorry, this is, somebody told me not to do it like this and I thought I had enough sense to listen. What? All right. Yeah, thanks. Probably me again. Where did you go? All right, so. You got a 12. Every failure goes down. Here in a minute, you're going to have me some Jack Daniels and I'll know I just need to walk off stage. Let's try mirroring for the win. All right, can you see that? Okay, so it actually was able to download all of the feed database and everything. I'm going to take a drink. Live demo, y'all. You don't want that. All right, so, this is what it looks like in resin. And with resin, you can actually, okay, truth in advertising. One of these, I plugged in in the speaker's green room, just because I was afraid that it wouldn't have enough time to download all of the things. And the one that I plugged up a few minutes ago, let's see how far along it is. This one's called Misty Mountain. Isn't that beautiful? Okay, so, yep, still downloading. Depending on bandwidth, I mean, it can take a little while. The initial download, so you've got a couple of minutes at the beginning. When you pop in the SD card, it reformats it to work right for resin's operating system and then it dials home to the service and it starts pulling your Docker image down. This is actually a lot smaller. Originally, I tried doing this with GNU Radio and oh my God, that thing is a monster. So you start dealing with image sizes over two gigs and Raspberry Pi has struggled with it. It is my hope that someday that I can get GNU Radio trimmed down enough because I think that and especially the GNU Radio GSM project, Peter Kreisik put that together. So if you're looking for something fun to play around with, I highly recommend that. I was hoping to get that originally worked into this, but I think arm's going to have to get a little bit more powerful with the stuff that you can buy off the shelf before we'll actually be able to get GNU Radio working at least the way that I need for this project. But check out GRGSM if you have a minute. It's awesome stuff. Now let's go back to the working sensor. All right. So in the start up process, you see download pulls everything down from the feed, gets your secrets from the vault. Yeah, this one started up just fine. Oh man, that's great. It's not that I thought that it would really not work, but superstition, you know, the same reason you don't do a do a change window on a Friday afternoon. So to Sarah, let's see what that looks like. Let's see if we have anything for DEF CON yet. And we do have a little bit. So these are time series measurements and it, honestly, it looks a little ugly. This is probably due to my configuration of graphite. Let's find a resolution that looks decent. There we go. That's a little bit better. And you can see the channels that are being tracked by ARSEN. And this is kind of the Rx level. This is the cell radio itself. Here's, yeah, this is the Holtwinners anomaly stuff. This doesn't get really interesting until you actually have a measurement period by which you can start to look at, because Holtwinners is super cool. You could probably do this with standard deviation, but I was, oh, Holtwinners, it's a bigger word, right? And it's free. It's already baked in. There's another buzzword if anybody's playing bingo. So Holtwinners never see this in the real world. But if you have, like, if Monday afternoons are really hot, then it'll accommodate for that. You just have to let it see a Monday afternoon or else you get that. So we're even tracking the affinity, which looks like it may have made a change. That's interesting, isn't it? So the cell made an affinity change shortly after coming online, but it's higher than that. 238. Yeah, that's cool. Anyway, we're all kind of discovering this. Honestly, I was pretty afraid of turning this thing on a DEF CON and blowing up the service by throwing so much information into it, but it's surprisingly well. So let's see. And here is my Kibana server. Oh, no results yet.  All right. There's that. Let's trim that down a little bit two hours. And there you can see we started getting stuff coming through and scans of all type. And this is all structured data. So if you wanted to build something on top of it just to interrogate Elasticsearch and pull these results out, go nuts, all this stuff is going to be released open source after the talk.  So let's return to the demo and see if I can figure out this mirroring thing again. All right. So summary of Mark 1 and Mark 2 So like we discussed earlier, ARFs and over threshold and outside of forecast worked great with the first one. It was just really slow to return results. Seven minutes you've already told them your stock trading tips and somebody else has them too. With the Mark 2 we hit all of our objectives. ARFs and over threshold and outside of forecast of course because we were still using Calibrate. Unrecognized Cell Global ID we're able to pick that up. Gratuitous BTS Reassociation we're able to pick that up as well. And the price was 150 bucks. So considering that this if you buy this at list price not the product they've got a great deal in the vendor booth you should all go and buy one these are so expensive and they've got a great deal running in the vendor booth they didn't pay me to say that. But with one of these I think you're looking at maybe around 650 dollars with this Raspberry Pi you can build an evil BTS for about 150 bucks you can build a sensor to detect when these things around. So the original goal of having something that was easy to deploy you know something I mean you just pop the SD card in make sure everything's plugged up you ship it out plug it up wherever and leave it alone and let it collect its stuff to have it less expensive than the evil devices and so there's that going forward this is what I kind of like to do with it automatic device detection something I shielded you guys from was all the environment variables you have to configure some of them you want to have to configure you know like what is the you know the key to retrieve all of my information from vault right you don't want your search just hanging out there so you can infer because you'll start getting graphite alarms um but it's really something you just have to infer I'd like to get more specific with that GNU radio like I said earlier I would love for GNU radio to be the core of this if I could figure out a way to make it run quickly and and honestly to run it all on a Raspberry Pi because running that sample rate is only grgsm but you can start playing around with adsb broadcasts from aircraft looking up fpv fpv drones all sorts of fun stuff and maybe even running connectors for ubertooth1 and yardstick one because those are you know those are some kind of fun things to play around with and if you can just if you never have to touch the thing except installing hardware why not right so here's a little cloning with a compromise femto cell that served as the original inspiration that kind of got me thinking in this direction because you can get a femto cell for 250 bucks or you can social engineer one out of Verizon for pretty I've been with you guys for so long if that argument has never worked before it worked for me I've been your customer for so many years and I have crap reception in my little to be able to do some positively evil things and last year Ducca Huna and Satan Claus put on a great intro to SDR on the wireless village was a one-on-one track that that I really enjoyed and kind of set me down the road of trying to figure this problem out fake BTS is served as the original functional inspiration for this kind of the interaction between Ryershark and Air Probe and unfortunately it's a little too intense to run on arms together thing and how to build your own rogue GSM BTS for fun and profit Simone Margueritelli thank you if evil socket is here I want to buy you a beer if you're not I owe you one it was a really well written blog post on how to simply set up an evil BTS using one of these and a Raspberry Pi 3 and a battery pack and a ease of access for parts so thank you evil socket that was a huge help for this talk and gave me a really good solid target to shoot for thanks GNU radio as much as I wish it could have made it in here it actually worked pretty well on the Intel NUC but those things are kind of pricey you were not going to beat anybody on price using Intel NUC but GNU radio runs pretty well on that for this purpose I mean on the on the GSM stuff and Calibrate Calibrate's the core of this and without Calibrate it really probably wouldn't work very well so hat tip and thanks to all the prior art and thanks to all these fools John Minerig made a not small investment in test hardware he was one of my first beta testers so John if you're out there thanks bunch maybe not Gillis Jones super helpful great advice Christian Wright and Dave Duhlin and there were a lot of silent contributors they didn't necessarily want to be associated with a DEF CON talk but I don't know why I have no problem with it but I got a really useful information on GSM networks from some really helpful people in the background anyway we can do Q&A now or we can take it off stage yep I'm going to release it as soon as I get to a reasonably secure network check on your DEF CON CD there's a white paper with the links in it alternatively my handle is Ash Mastaflash check me out on Twitter and and I'll post there and I may see if I can get squeeze an email through full disclosure as well Ash Mastaflash two A's alright thanks a whole bunch everybody


What's the bear buddy Jason here from Jaspis casebricks.com 2015 16 panini prism basketball five box blaster break It's around on teams each number four just sold out and the class is loaded Chase all these players are possible stars in this year Nikolaj Jolkic Devon Booker poor zingas d'Angelo Russell cat and of course not to mention all the hue vets silvers That's all for some big money so Here you go dice roll it and we got out of the two and a three for five times Because my name's from Bradley down to Bradley you get double the names per spot double the spots one two and three four Christopher down to Ryan Redman five times here one two three four five Wars down to the Sacramento Kings Cruiser of the war is Bradley with the piss and Steve with the bulls Ryan with the nuggets or grizzly sorry Jason's with the nuggets Christopher the jazz jet with the Suns Eric with the T wolves David with the heat Bradley with the pelicans Jason with the Hornets Ryan with the Nets Jason with the Mavericks Bradley with the Knicks David with the Blazers Matthew the bucks Chris with the Rockets Steve with the magic jet with the Calibri's Chris with the 76ers Matthew with the Thunder Christopher with the Wizards Eric Sunsala with the spurs Bradley with the Hawks Chris with the Lakers Jason the Raptors Ryan Redman with the Celtics Brother the Pacers and calves and Ryan with the Sacramento Kings All right, does anybody want to trade? Yeah, is that you Jeff? Did you end up getting the Suns? Nice T rules for Toronto for T wolves Jason saying No No, I don't remember there was anything crazy out of these actually Don't remember If the one-on-one stuff that'd be awesome. All right guys trade when it closed All right, here's five boxes guys I Think this might be a wide receiver coming down I don't know Rex. I don't know if I would say ever I'd have to look at all other draft classes, but I mean If we had to say ever I'd have to also have to put together like 0304 with like LeBron Bosch Wade Carmelo These guys are all future Hall of Famers 96 draft was pretty crazy too But right now in the NBA a lot of these players are all stars and pretty good though I think honestly, I'm really liking I feel like 17 18 has been pretty strong And then I don't know 1920 With a weird year of course with COVID but a lot of great players in 1920 that have just been producing so far and so good With their respective teams All right guys good luck Mario Chalmers Quincy Pondexter you got DeAndre Jordan you got Marco Balanelli silver and Jarnel Stokes Andrew Wiggins Carl Ari Chase Budinger Whoo, there's a green rookie emergent Devon Booker There you go, Lottie Deepak Merlin Noelle D'Amillo Galinari Nuggets silver Caldwell Pope John Henson silver DeMarcus Cousins all-star team and a Justin Anderson silver Terri Rosier Solinger Nick Young Carmelo Anthony silver, that's nice for the Knicks Rudy Gay Kevin LeFarward Dennis Rodman Shevon Darnett All right the last one Anthony Davis silver for the Pelicans Bradley Porzinga's rookie and check this out guys Nikolai or Nikolai Jokic for Denver green rookie prism And that's gonna go to the Nuggets and Jason And for the Knicks that's gonna go to Bradley. Alrighty guys, and there you go Officials Is How are you guys all the color the silvers Everything I think Davis from a lengthening to a little gal in our we did get one auto And here with the three big rookies Jokic Porzinga's and an emerging green Devin Booker. Appreciate it guys. I think we'll have more of this number five We'll be posted up soon. Jasper'scaseburge.com