Hi everybody, this is a talk on our experience integrating Active Directory with OpenStack. I'm glad you're all able to get past the rain and the smoking escalator to get here. This is a quick overview of what we're going to talk about today. First to give you some context, I'll tell you what we're doing with OpenStack at GoDaddy. Then I'll jump right into Keystone integration with Active Directory, then how we, the things we did to integrate Nova with it. I'll talk about our DNS integration a little bit because it has some implications to how we integrate it with Active Directory. Then Mike will take over to talk about deployment with Puppet, domain controller proxying, and PBIS integration. Those last two will make more sense as the talk goes on. Okay, so first off, we started with OpenStack at GoDaddy early, mid last year, and we launched a pilot in February. We released this internal pilot to all our technical and corporate employees. To date, we have about 200 users who have created a VM, and we have right around 300 active VMs. Those are all Linux VMs. We're going to be rolling out Windows VMs pretty soon. We also have a production customer facing pilot in the works. This is what our OpenStack looks like. We're running the latest release version of Havana, which is 2013.2.3. We use Anvil to build and patch OpenStack from source, and we used the OpenStack puppet module on Stackforge for configuration management. We use Neutron for networking the ML2 driver with the OVS agent on the compute nodes. Our operating system on the host and in the guest is CentOS. We use KVM as the hypervisor, and in true minimal viable product fashion, we didn't release any object or block storage with this dev pilot. That's just to kind of limit the scope of the dev pilot. All right, so we can jump right into AD integration. Just to give you a little more background, GoDaddy has a large preexisting Active Directory infrastructure, like I think a lot of companies do. With any piece of infrastructure that's grown over a number of years, there were some pain points with it, but it was, for the most part, it just worked. It's the source of truth for authenticating users. It's also the source of truth for computer objects. So basically all servers have to register into AD. And then that last note there is just to kind of explicitly state that both are, it's a typical uses pattern at GoDaddy is to have both real users and service account users in AD. I put an asterisk next to read only. That means we could only use it to authenticate users. We couldn't write projects to it or anything. I put the asterisk there because when we were working with the AD admins, they actually were willing to work with us. And we had a solution going where we were going to have sort of a separate OU that we had right access to in order to create projects and roles. But as we discovered later, we didn't really need to do that. So this first bullet point here is how we discovered we didn't need to do that. In Havana, the identity and assignment back ends were broken out into two separate pieces. So we started off with Grizzly and then just sort of Havana was released and we made the decision to jump to it. And then we found that the identity and assignment back ends could be separated. So we could authenticate users and find out what groups are in using AD, but we could write all our projects, roles, and associations between those things to the database. For the DevPilot, we had a one-to-one mapping between users and projects. This kind of just limited our scope and made it really easy to automate that. So basically find the users out of AD, create projects for them. We could do that all scripted and sort of like a batch style process. The next step for the DevPilot is to create group-based projects. So actual product teams can have shared resources and they all have access to the UI and API and can just generally see what each other is doing. That will also entail tying into a lot of other systems like budget codes and more group-based permissions inside of AD. The last note is as we sort of piloted with one or two groups inside the company, we found that a typical need is to have service account users associated with your project so that you can script them using Puppet or whatever to make the calls out to the API to spin up VMs. So we've done that on sort of a one or two off basis. I think when we get to fully roll out the group-based project approach, we'll have that sort of more self-service. Okay, so largely integrating Keystone, the Keystone identity back end with Active Directory went pretty smoothly. There's really just a couple bugs that slowed us down. I list them explicitly here just because if you ran into the same problems over the last six months, you can have a reference point. The first one was really the only showstopper, excuse me. And that was basically because we needed to search from the root DN of our Active Directory tree, that doesn't work very well with how Keystone was written. But the fix for that is upstreamed and I think actually the back port of it to Havana is like in process now. So hopefully that should no longer be an issue, which is cool. The second one is an interesting one. So basically the way we had to configure Keystone was with SAM account name as both the user ID and user name. Common name is Craig space Jellic, SAM account name is C Jellic. And when you do a user get, regardless of how you have the user ID attribute configured, you'll get the CN back. So where I expected to see C Jellic, I saw Craig space Jellic. There's a patch for that one. There's a fix submitted. It's not fully flushed out. So I think we need to revisit it to actually get it accepted. And then the last note, horizon performance issues. Horizon we found just kind of really fell apart with the project management piece if you had a lot of users. So our user base was all the users in a particular OU and Active Directory and that was a lot of them. And the way that Horizon would work when you went to assign users to a project, it would get all of the users as a list. And then it would do a single get for every single one of them before it even loaded the assign a user to a project screen. So that just didn't scale with our number of users. And frankly we circumvented it by not using that portion of the UI. So all of our user assignment was scripted and automated anyway. And if we needed to do anything one off, we would just do it through the CLI. Sure, I mean it was, I guess at that point we were looking at a couple thousand users. So here's a link to our configuration. I'm not gonna jump to that link, but it's there for your reference. And I put in some of the interesting points right here. The first four lines are how you separate the identity and assignment back ends. The LDAP connection information is not terribly interesting. Local host is not a sanitization. That's actually how we had it configured. And Mike will talk more about that later. QueryScope equal sub is important because that's how you can kind of search infinitely deep in your tree. The user filter is interesting because we needed that because we're searching from sort of the root of our tree. We would also kind of catch computer objects. So we needed to explicitly add a filter to remove the computer objects. And like I said earlier, we had both username attribute and user ID attribute configured to be SAM account name. There's nothing terribly interesting in the group section of that, other than just the ID attribute in that case actually is the CN. Cuz that's sort of the part that people see and it makes sense. Well, that's the part that makes sense as an ID and then the name is what people see. Okay, so moving on to Nova integration with Active Directory. As I said earlier, all servers at GoDaddy have to register into AD because other systems feed off that information. Mike will talk a little more about that later on. But because of that, we have some additional constraints we have to impose on server names. Specifically, they need to be, when I say globally unique, they need to be unique across the entire Active Directory tree. Because the server name is used as the CN and it needs to be unique and the SAM account name. They need to match a regex, so there's no sort of special character enforcement. So it just sort of need to match a very well-defined regex. And they need to adhere to the name length restriction we have in our Active Directory installation. To do all those things, we patched it locally. I've linked to that patch here, just if you want it for your reference, it's kind of very specific, some parts of it are specific to, I don't think it applies to Nova as a whole. So that's why we never tried to upstream it. The last note, I put it on there just because it was really hard for us to find this configuration setting. OSAPI, compute unique server name, scope equals global. I think the other option is project or tenant. That makes the name unique within your open stack installation, the server name unique. That's important because of replication lag between the different domain controllers. So if someone spun up one VM with name foo and then immediately after that someone else spent up a VM with name foo because of the possibility of going to different domain controllers to check the name uniqueness, we couldn't really guarantee that we would avoid replication lag. So by turning this on, it makes the name unique within open stack that ensures that at least in our use case you can't have that immediate issue, I guess, race condition you'd run into. And then this is just a quick snippet of the patch that we added to do all these extra checks. So the validate server name function was already there. We just had to add a few extra checks to it. We made the max length configurable because it was hard coded to 255. We have that regex check there and the underscore check server name uniqueness is what would call out to Active Directory to see if the name existed. OK, and DNS integration with Nova. So our internal DNS at GoDaddy is powered by Active Directory. Those details are for the most part hidden behind a REST API that another team wrote to encapsulate the internal DNS. Windows VMs, which we'll be rolling out shortly and we've already been testing and everything, auto register into that DNS system. So we don't have to worry about adding those Windows VMs into DNS. But for Linux VMs, they don't do that automatic registration into Active Directory DNS. So to get around that, what we did was hook into the Nova notifications topic. We basically have a system that sits, little application that sits next to OpenStack, listens on that topic, has its own dedicated queue when it receives a compute instance create end event. It will get the relevant information, the fixed IP, the fully qualified domain name, and it will submit entries into that REST API. Both for Windows and Linux VMs, when they're destroyed, we also listen to that topic and we do cleanup. So we know the server name that's destroyed and we just call the REST API to delete those entries. All right, so with that, I'll hand it off to Mike to talk about some other bits of it. So good morning, my name is Mike Dorman as Craig kind of introduced me earlier. As he mentioned on one of the earlier slides, we do use a lot of the Stackforge modules in Puppet to do all the deployments and configuration of all the OpenStack services. For the most part, those work pretty well for us. There were a few modifications that we had to do earlier on, mainly around supporting the SSL options for each of the different services. We kind of had a requirement to do SSL on as much as we could in OpenStack, so that's where that came from. For the most part, all that stuff has been implemented in the meantime in those modules. We were pretty bad at first about getting that stuff submitted back, but kind of separately, the community has implemented those and those modules now. So on almost every one of them, you've got the SSL options now. The piece that we did need to take a look at and modify was around the prefetching that Puppet does as part of the resource providers internally to Puppet. What that does is it attempts to kind of load in a cache of all the different resources on the front end so that every time you're operating on another resource within Puppet, it doesn't have to go fetch that information on the fly. This works pretty good for a lot of the resource types, but for Keystone users, Keystone tenants, those types of things, not so well, especially in this environment where we've got lots and lots of users. Basically what this boiled down to on the back end is for every user that was in the directory, it translated into two Keystone CLI commands because that's the way the custom providers in the Puppet modules implement this today. They don't go directly to the API or anything like that yet. So it was very, very slow. For our directory of a couple thousand users, I mean a single Puppet run would take like 45 minutes because it would just be sitting there spinning on running Keystone after Keystone after Keystone command and it would take forever. So you can imagine how much worse this would be if you had 30,000 users in your directory. So the solution to this is to implement lazy loading in the module in that back end provider for the users and tenants.  We kind of took advantage of the fact that from our perspective AD was read only. So even though we were technically managing users in Puppet, we couldn't actually write to the director and create new users so we were able to strip out a lot of this code that was going out and prefetching a lot of the parameters for the users.  And obviously, you know, this scales much better to directories where you have thousands of users and those types of things. And actually the other day in the Puppet labs session upstairs there was a lot of talk about switching these providers over to actually hitting the Keystone API directly rather than going to the CLI tool. So there should be some improvements there as well. And then I've provided the short link there for this commit if anyone's interested in more of those details. Then the next challenge that we kind of had to think about was how do you tell Keystone what domain controller to go to to look up the information? Across GoDaddy we've got several domain controllers spread across all the different company sites across all the different data centers around the world. And AD has some tricks that it does to do kind of site awareness. So if you're a Windows box and you're on the domain and you need to talk to the domain controller there's server SRV records and some other stuff where you can kind of figure out where it is in the network and be able to hit a domain controller that's relatively local network wise to it. But LDAP out of the box and the way that Keystone gets configured with LDAP doesn't really have that notion. So you just give it an LDAP URL and that's where it goes to. So it's a little difficult to try to figure out which is the best one to go to. So we're kind of left with a couple different options. I mean just from a very basic level. The first one is you just pick a domain controller that you know is gonna be local to you. So you just pick one that's in your local data center. You configure Keystone to go directly to that one and you just kind of hope and assume that it never goes down and it's always gonna be there to take your queries. So the drawbacks in that are fairly obvious. The second way is to just let DNS do it for you. So in your LDAP URL, you just use the kind of the root domain name of the domain and that'll give you back all the A records of all the different domain controllers and you kind of just pick one pseudo randomly. A couple things to note on that. The first problem still applies to that. So just because you've got DNS around Robin or whatever mechanism that DNS will provide to you, you could still be sent to a domain controller that's actually down or not responding. So while it kind of does this load balancing, so to speak, it doesn't do anything to help you not try to connect to a domain controller that's actually down. Second problem is you get all the A records for all the domain controllers across the domain which could send you to one that's across an ocean someplace which for obvious reasons, you don't really want to do that but in this DNS scheme, there's no way to really pare down which ones you get sent to. So we kind of took a different approach to this to solve this problem. We actually run a local instance of HA proxy on the machines that run Keystone. That HA proxy is configured to load balance LDAP across all the domain controllers that are local to that data center. So we pre-configure HA proxy with only the local domain controllers so we stay local in that way so we kind of solve the number two problem. But HA proxy does the port checks and some of that intelligence to be able to detect which ones are down and it will only send Keystone to one that's actually responding to requests. So we kind of solve the first problem through that. So it's a little bit of a, it looks a little bit ugly depending on how you look at it but it actually does a really good job of solving the problem. And since we run HA proxy locally on the boxes that run Keystone, technically there's a network hop there but it stays within the kernel. So that piece of it remains fairly, you could be fairly confident that that communication path will always work. So it's not like we're adding another real network hops in place to get to AD. Okay, then just kind of quickly wanted to talk about a little bit of the things that we do inside the VMs with regard to our AD integration. Across the company, we use a tool called Power Broker, not sure what the IS means but we call it PBiz. Basically that allows you to hook into AD from the Linux side and be able to do authentication and group-based access control and two-doers based on AD groups. So what that allows us to do is basically everybody can log into all the Linux boxes using their AD credentials instead of some other password management scheme that is out there. On the root password side of things, we use a tool called CyberArk that manages and keeps track of all the root passwords on all the machines and that's tied into AD as well. So the security folks are really the only people that have access to that information. Sometimes the data center folks that need to console into machines, that kind of thing. But for the most part, nobody else knows the root passwords but obviously we need a way to track them and we use this for that. The fact that it's tied into AD and everything's kind of centralized there allows us to do root password changes across the environment very quickly. So if there's some kind of compromise or just the regular password rotation that we wanna do, it's very easy for the security group to go and just do that across all the machines. There's a bunch of other reasons why this is really good too.  There's no hash management in the shadow file that we've got to manage. Employee onboarding and offboarding becomes much simpler because that gets done in AD anyway and then that just goes and applies to all the Linux machines as well. It makes everything a lot more user-friendly, so to speak, to the people that are actually having to log into these things. So some other stuff that we do specific to the VMs is when you create the VM either through the UI that we have for our platform, which is this screenshot, or through the API, you can provide a list of groups that should have access to log into that VM. So on the lower right here, you can see where the login groups option and that just gives you a list of all the AD groups that you're in, and then you choose the ones that you want to be able to log into the VM that you're creating. That gets put down into the metadata that's attached to the VM, so this is just kind of an example that greens maybe a little hard to read, but we also passed down this created by field, which is the username of the person that actually created it through that UI, or did the API call. That's the user that we tell Cloud in it to give the SSH key that's provided with the VM. So that ensures that the guy that actually created the VM is the one that has the SSH key on their account, so we don't have any funny Fedora or Cloud random accounts on all these VMs with some SSH key attached to them that we don't really know who that goes to. So that ensures some additional level of security there as well just to make sure that our keys are a little more locked down. And then you can see in the login groups field there, and then as well as the sudo groups, and then the analogous fields for specific users, that's how we pass in that information for what groups and users should have access to the VM. When a VM comes up, we run a puppet process to do some of this provisioning work the first time the VM is booted. Part of that process is actually taking that information, not a metadata, and then populating it into the config files as necessary. So the Etsy login groups is the file that that PBiz tool uses to have as a reference for what groups and users are allowed to log into that VM so you can see how now login groups is populated with that list of users and groups. And then we do the same thing in sudoers to specify who can actually sudo to root on the machine. In addition to that initial process of provisioning the VM with puppet, we actually do this process every 10 minutes through Cron as well. So what that allows us to do is you can, if you need to change the list of users and groups that have access to a particular VM for whatever reason, you can go back through the OpenStack API, provide new metadata which has a new list of users and groups who are accessed to the VM. And then within 10 minutes, the Cron runs, updates the config in the VM, and then the new access policy is in place there. So that makes it really nice to be able to control all the authentication and authorization stuff kind of external to the VM itself. It also is nice because now you have a way to audit this through the OpenStack API by looking at the metadata and all the VMs. And because we run this continuous process to make sure what's in the metadata matches how the VM is configured, we have some trust there to know that what the API metadata is showing us is actually how the VM is configured. So go to the next slide. Okay, so all that said, obviously that's all kind of enterprisey stuff and you wouldn't necessarily want to do anything like that in a public cloud or a customer facing things where you don't necessarily have all your customers in some kind of AD domain, but it makes it a lot easier for our kind of pilot environment for people to actually use this thing because the other developers and engineers in the company are used to being able to log in with their AD credentials and control things based on the AD groups and that kind of thing and making everybody sort of shift away from that and like, oh, you need to log in as the Fedora user using your SSH key because that's the default in cloud and it is a little bit of a paradigm change for people. So a lot of this integration we've done is more around just trying to make people comfortable with it and being able to have it be as user-friendly and frictionless as possible. But kind of the implications of this are now that we've integrated all these Linux VMs with AD, technically those Linux machines are actually joined in the domain so they actually have an object in AD when they get configured to authenticate against the domain. So this is where the name uniqueness requirement comes from that Craig had kind of talked about earlier where we can't have any duplicate names we need to make sure all the VMs are named uniquely kind of from a global perspective. And then this is where the external cleanup hooks come into play as well where we take a look at that notification queue and then any time a VM is destroyed we have to go back into AD and remove that object so we're not polluting AD with all these stale objects and you can imagine how if we didn't do that how quickly AD could just completely get out of control. I mean previously where we've just mostly had physical servers on this thing you know a physical Linux bot kind of comes up and it lives for a while and then there's a deep provisioning process to get it cleaned up. Well VMs can be created and destroyed much more quickly there's a lot more churn there so that's why we had to build sort of this automated system to do that cleanup to make sure that we're keeping things nice and tidy there as well. And that's it. Just wanted to do a plug as well for our team we're actively working on growing it there's several of us here at the summit so if this sounds interesting to anybody and you're just didn't talk to us about working there we'd be glad to talk to you. I mean I think just kind of my personal perspective on this it's been pretty cool to get open stack in our environment and kind of get more towards this cloudy way of doing things and it really is an opportunity to kind of actively help other people in the company do their jobs better on a daily basis and it's been pretty neat to be involved in this. So again, if anybody's looking I know everybody's trying to poach this week but definitely would be interested in talking with you. So any questions we'd be glad to take them just please go to the mic so that we can hear. You guys touch a little bit on some of the scripts that you guys are using with Puppet or do you guys have any of that out on the public GitHub or is any of it open source at this point from you guys? Sounds like you've done a lot of the work and it would be really nice to. Yeah, there's a couple of pull requests or I'm not sure what you call them in the Garrett review world exactly but around a couple of the tweaks that we've had to do as far as like the specific manifests of how specifically we go about configuring the Keystone module for example no that's out there today but for the most part it's just the stock modules and we fill in the parameters but we can talk afterwards if you've got other specific question I mean I'd be happy to show it to you it's none of it's out there right now.  No we didn't do any of that. There's a little more history to that than what comes out in the talk but originally we just did sort of the number one where we just hit a local domain controller and then the Windows team would need to take that guy down to do patching or whatever so that's kind of where we got to well we just need to spread across all these local ones and for the most part there's enough diversity within each data center that we should be okay and I mean we haven't investigated it but I would probably shy away from saying well if all of these guys in the local data center are down then as the last resort go to Europe. We have bigger problems if all of our domain controllers. It's not a bad idea but no we didn't look at any of that. Yeah so just to clarify we only have HA proxy configured for the ones local to the DC we're in so we just don't even go out to the other ones for our local HA proxy instances. Thank you. And actually we're gonna follow up on that same HA proxy thing. I'm from the Keystone team. One of the questions we request we see quite a lot is to support some like primary, secondary, LDAP server. We can't quite hear you can you just get a little bit. I'm from the Keystone team. One of the requests we see quite often is can I support a primary and secondary LDAP server? How would you compare if we had that versus an HA proxy which would be your preference? I mean just from like a strictly effort to get it configured I mean I think if Keystone itself could do some kind of failover I think that would be preferred.  I like our solution. It's also worth noting that our that little patch we have to Nova also has to connect to Active Directory and then the code that listens on the queue and does the cleanup also has to connect to Active Directory and I think the solution we have right now scales very well for all those scenarios. I was gonna caveat that with like it depends on how reliable that failover and what the mechanism is within Keystone like if there could be some intelligence of just can I connect or not on TCP then that's essentially the same as what HA proxy is doing for us. But if there could be some more intelligence there like if I go out and query the first one and it gives me back some kind of error then try the second one as well that that could be kind of interesting to do some more intelligence there. Oh also one more note on it is just using sort of the HA proxy solution we do open ourselves back up to a little bit of replication lag issue you know so if the request the first request goes to server A and the second request goes to server B there's potential for replication lag if you're doing just the primary secondary and you're kind of always guaranteeing that the first one goes to you know server A you avoid that issue but for the purposes of Keystone specifically we aren't writing anything to AD it's just for those creating and deleting of server objects. Yeah. I had a question about the service accounts in Active Directory are the teams or groups allowed to create those themselves and manage those themselves or does that process have to go through you guys or? That is external to OpenStack I mean that is a that's the way we do service accounts I go daddy. Oh yeah so and I just learned this this week that through federated Keystone you can have service accounts in the database and still authenticate real users against Active Directory is that right? That's what I wrote my driver to do so if it's gonna be in Keystone that'll be awesome. Awesome cool. Yeah I appreciate the the hard work y'all did on Havana and I know I appreciate also having a bunch of the Keystone guys in the audience here so I'd love to be able to hear from maybe some of the Keystone folks what will change in Icehouse and going forward in a federated model that will make a lot or that will maybe hopefully simplify some of the work that has to get done for AD integration and so that you know you don't have to have a PhD in AD to be able to do some of this AD federation for customers who are looking to do that kind of thing is there anybody you can comment on that? Maybe yeah. Our job just got a lot easier up here. You can stop. Yeah federation's got a really good start in Icehouse I think we need to close the loop on a few things to make it so it'll solve this particular problem. One of the killer features that Henry was working on I think even back as far back as Havana was the ability to support multiple LDAP servers and that's a subset of a more general problem of the ability to support multiple sources of identity and understand we're solving it not just for the enterprise case not just the case where you can well basically we come from the world of trust no one and so I don't want to be in the case where use the classic example Coke and Pepsi are in the same data center and Coke steals Pepsi's users and is able to create users under their domain and stuff like that so we need a way to make sure that the user IDs remain globally unique across this when they're coming out of remote sources when you can't write that UUID back like we do in the SQL thing and that resolving how to do that is one of the major things that we have to do today so that while you'll see that there's code to that effect in there it's experimental it's experimental in that you have to guarantee that user IDs are unique across the whole thing so in theory you could probably get away with like setting up an open LDAP or something for that other domain over there I wouldn't know that it's been all that well tested that's kinda there now there's other things you can do what I'd like to do is get rid of the service users all together and just when you register an endpoint that endpoint is able to do work on its behalf and stuff like that which will work for a lot of things but obviously it won't work for stuff like heat where you actually need a real user that can do real things along that nature with Federation what we're seeing is a push towards it trying to take all the nastiness of dealing with LDAP directly outside the hands of Keystone so the Keystone just kind of inherits an AD setup but somebody's still gonna have to go through and do that I don't know if I can reduce the number of PhDs in AD that you need to get real work done blame Peter Puglio Peter's one of the, it works for Microsoft and he's the driving force behind Hyper-V being back in there so we have a very good natured ribbon going on but Active Directory is suitably complex because of the breadth of problems it has to solve. I'll just pick up on the stuff that I said just to see you know in terms of the stuff that we will definitely get put into Juno mainly because it was almost ready for Icehouse which is how I'm hinted at it that if you have multiple domains you'll be able to choose this domain's got a SQL backend this domain's got an LDAP over there this domain's got an AD over there and so you can split your configuration up that way if you have customers who want to use their own corporate LDAP for instance you can point their corporate LDAP just for their domain of users for instance that's kind of one of the key things we're gonna get in for Juno is say there's experimental version in Icehouse don't use it it's experimental means broken unfortunately in this case but we will fix that for Juno the concept is there in Icehouse but we'll fix it probably for Juno and so that'll probably it may well be even in for Juno one if we can get it in so it'll be pretty early in the cycle Cool, I just want to say thanks for all your hard work for the most part Keystone's been pretty slick Some great stuff this release I really apologize for the whole DN approach No worries, I mean yes Yeah, it's been a learning process the goal was to try to make the user look up as fast as possible and to use the DNs as that try to do LDAP things LDAP-wise and obviously it doesn't quite map to how people then look at the objects Yep, question Howdy, thanks for the talk I was just curious what else you evaluated besides the power broker services if you looked at SSSD and whatever else you evaluated for authenticating within the VM So specifically within the VM we didn't look at anything else we just use what the rest of the company has been using for a while I know in the past there was some work around the LDAP back end to PAM that was kind of before my time and I'm not sure I'm not familiar with the problems and whatever, what the motivation was to move to something else there But even PBiz is definitely not without its challenges for sure but for OpenStack specifically we just kind of forklifted in what everybody else was using already And I think the summary of this talk referenced alternatives to it time constraints we kind of did not put that into the presentation so apologies on that not as advertised Great talk Did you guys have to make any schema changes to the AD to get any of this to work? No, nope, AD was what it was Had we have to do if we were going to write projects and roles and stuff to AD I think we would have ended up because when we prototyped that they didn't map and it was as much an artifact of how our ADs were set up but with read only we didn't have to do any schema changes One person who really deserves credit for that I would like to call out who's unfortunately not here but works for CERN, Jose Castro-Leon CERN has the interesting ability they have a huge Active Directory deployment but they have the ability to write to it and they really wanted this and so they're the guys who drove early on Active Directory support so that's one of the reasons why Active Directory does work so well I just want to give CERN and specifically Jose much gratitude for me because I know nothing about Active Directory I don't want to Yeah, we don't either Whatever we know, we learn from this experience and CERN's wiki or blog article on integrating Keystone with AD was like our starting point basically where we referenced everything from I think we're close to the end of time let me look real quick here Okay, thanks everyone Okay, thanks


Over to you, Andronika. Yes, hi. So welcome to our webinar. My name is Andronika Pavlida. I work at the Afinaris Center and Open Air, of course. Here with my colleague today Evgenia, we'll present you the activities of Open Air Advance on Citizen Science. So, from the room to Evgenia, please to introduce yourself. Hello, I'm Evgenia Kipriotis. I work for Elino-Germanici Ego G. Nathens. We belong in a big private school, but we're actually an R&D department dealing with projects. Sorry for that. Dealing with projects about education. So, Andronika, would you like? Irina, should we start? Yes, please. So, what you will see today, let's go. Let's start with an overview. So, the outline of this presentation of this webinar is about Open Air Citizen Science activities. So, what we are doing throughout this project, all the activities are focused in schools. So, you will see a very, very brief introduction of the integration of those activities with current Open Air services. Not many details. And then you have a look of the first activity, which is the seismic schools network. So, when there is a seismic activity, there are data collected from schools. They are in a repository, and there are many applications that we can produce out of that. And then, we'll show you one of the events, the Hackwake, that were organized. The second activity is the Open Schools Journal for Open Science. This is a brand new, fresh and modern journal for students and that with the help of their teachers, they submit articles. Evgenia will present this very, very in detail, very good. And then you see again how Zenodo is connected with all that, Zenodo by Open Air. And the third activity is about bringing Nobel Prize Physics in the classroom. So, you will see again how something which sounds very difficult and very distant maybe for students, it can really get into classrooms. And then we have a good surprise for you, which is a very good practice example of an article. So, I'm not going to say much more about this. And of course, if you have any questions, we're happy to answer. So, we start with the citizen science activities. Evgenia, please continue. Yeah, sure. Thank you, Androniki. So, before I continue, since we are not that many, can I ask if there's anyone from the educational sector? If you want, you can answer in the chat or I don't know. It would be good to know your background so that we can explain how we approach citizen science in Open Air. So, I don't see any response. So, I guess you are not from, you are not teachers or belonging to the this sector. Okay. So, before starting, what I would like to clarify at this part is that in Open Air, we have attempted something very unique. We wanted to test how citizen science works in education. And I have to admit that it has been a quite successful test. We have from the very beginning decided to divide our efforts into three major sectors. So one was the school seismograph network where we were dealing with seismic data. The second one was the Open Schools Journal for Open Science, which is a scientific journal from students to students, as Androniki has already said. And the third part was the access to research data where we tried to bring Nobel Prize physics to classroom. So we picked these sectors and we have developed educational content and educational activities that can be used in class in a way that citizens, that students become the citizen scientists, they become the researchers themselves. They research and analyze and even publish their work once it is done. Androniki, would you like to tell us how this has been integrated in Open Air? Yes, so what you see here is a very simple graph which shows the process. So if you take, for example, the journal that Evgenia mentioned, and you will see later with more details. When a student submits an article, this is reviewed and also if it's accepted, it gets, it is assigned with a DOI. So that happens through the editor of the journal, which is also a member of the Open Air Provide, so a content provider here in Greece. So the students don't have to do something very complex or their teachers. It's automated somehow. All the metadata, the information, the records, everything that is needed, the licenses, everything is, of course, packed in that article. So then you have the index on Open Air. So when you go to Open Air Explorer service and you search for articles of the journal, you will find them available. So all this process respects the fair principles. You can find, you can access, and you can find also that information in Explorer through Provide and also in other communities. And of course, you can reuse all these outcomes. It's a great example for students that don't have all this knowledge that we have as adults. And it's a first step they can make to this research path, let's say the research strip. And Evgenia now is going to show you more and, you know, and there are all these activities in schools with more details. So please Evgenia. So thank you, Androniki. So as I said, we have divided our work into three main sectors. And now we will now we will break them down to see what we have done in each case. So the very first is the activities in schools, the seismic data. The journey to this of the seismic data. Actually here we're talking about a school seismograph network. Truth is that this initiative has been initiated from Greece. We are an institution running in Greece and in case you do not know it, Greece is the most prone country to earthquakes in Europe and the sixth worldwide. There was a great interest there and we have cooperated with countries who are similar problems like Cyprus, Bulgaria, Italy, Turkey. And we have created this network where we actually put place seismographs in several schools. Here you can see a map of the 68 seismographs that are currently placed into schools. Most of them you can see that they are located in the countries that I've talked to you about. But also there is one in Azores, as you can see in the far left and in far right in Israel. We have picked this location because there is an extra interest, especially in Azores, where we can also have an insight of the volcanic activity. In combination with our seismograph in Sadorini, which also has volcanic activity. So each triangle or red triangle that you see there represents a seismograph in a school. If we move forward, we can see that once we click on a station, we can see more information. We can see which one is the school and the coordinates of each school. Also its seismograph has a special code that it can be recognized. How is that happening? So the thing is that it can either start from the school so that there is one school that they have a special interest about hosting a seismograph in their school. So they ask for them to be funded to have a seismograph or there can be an interest from our side. For example, in places where there is a special research interest. Because above everything, we gather this data and it is recorded for the National Observatory of Athens. So they have a whole picture of what is happening in the area. So once if we know that there is an area that is not captured enough, maybe we want to focus our efforts there. So what is happening is that we're finding a school, then we're finding a teacher who is interested into cooperating with us. Because let's be honest, there are some responsibilities when your school hosts such a delicate instrument. Then the seismograph is placed there and it is connected to a computer that has a Wi-Fi 24-7. This instrument records everything. It gives data all the time and through the network of all the other seismographs we have, this data are distributed to everyone. Not only to those that have a seismograph, but to anyone. It can be either used by schools or from any citizen that is interested to know what is happening right now in a certain area. So the main objective is the data collection. Here you can see a school list, all the schools that have an instrument. When I say instruments, I actually talk about seismographs. You can see the coordinates, which is important, especially if you want to place them on a map or for an educational activity. This is some extra data. You can see exactly where they are, the city. You can see the technology used. We do not use always the same seismometers, the same seismographs. And of course, you have all the time a response whether it is online or not. Then you can have an even more specific status of each seismograph, which is very, very important if you want to have a very accurate research. Because for example, we have a picture here, a screenshot where one of the seismographs is delaying. It has a minor delay as you can see, because you can see in the last column the size, let's say, of the delay. But the last one, which is orange, it has an even greater delay. So these are all data that can give some extra to your research and it can help you be even more accurate. Apart from the data that we have shown so far, at any time on demand, you can have access. Any citizen can have access to this raw data. And I have to admit that I don't know how easily they can be used by normal citizens as the type of the data produced by seismographs are SAC SAC files. There are many who can use them, but be prepared that you may not be very, it may not be very familiar for you to work that easy. But in any case, this is the visualization that you can have at any moment. If you click on a seismometer, this is something that you can see. One problem with having seismographs in schools is that schools are very, very loud places. So sometimes you run the risk to get confused with what is a noise, what could have been a strong kick instead of an actual earthquake. But here you can see the noise, you can see these snow, let's say, around, but you can also recognize far on the left some seismic activity. So these you can have at any time. So what happens now. So thank you. Yeah, thank you very much. It was very clear. So you saw what happens when you have all these data you collect and what you can produce. So what we tried something new in open air was to collaborate with Helix and have the same data in Helix. So first of all, what is Helix? So Helix is an infrastructure, is a national infrastructure here in Greece that has three main action points. One is to host, it's a repository to host data publications. And the third one, which is very useful for our case is to log in, create an account and have your own lab, let's say private lab. So what you can do in that lab is you can test out in an interactive and explanatory way with Jupyter notebooks, something that you want to see how it behaves or if you trigger something else what happens. What if you write some code, a script. So in our case what we did, we created an account and we use the data sets that Evgenia explained and we created again the graphs. So step by step process. So the first step is you need the data from schools. So, so far nothing changes, you still use the same hardware from schools, you use the same data from schools from the same locations. The second step is that you need to store them in a repository, the same files, you have them, you ask, it's on demand availability so you ask the providers to give you some of this data. The third one, which is different in this case, compared to what you saw before, is that now you need to create an account, email for approval to the admin of Helix and explain here is this is my name I want to use the Helix lab for this purpose. So if you need to upload a Python script that is created for the seismic activity data sets, so we have a new Python script just for that.  And yet you get really nice graphs and out of the seismic activity so the new actors here are not just schools, it's also Helix, it's Jupyter software, also Zenodo because you can of course use your output and upload what you found and open it. So this is how it goes against the best. I created my account, I had sent an email, so I got my approval. So I see here the menu lab. If you don't get approved by the administrator, you don't see my files and my courses, you only have two of these options so you need to get approval. So there you can upload a file. So here there is a screenshot of the Python script dedicated for that purpose that you can use. Of course we can share it. It's not something secret. Once you share it, once you upload it, you see here servers. So what happens. Now I have to click on servers. You will see this window which says available servers. And what you have to click, you have to click seismographic data. So I want to use the server that was set up, installed, created for that purpose. Okay.  And of course, don't forget you have to upload the data you want to use. Evgenia will show you where you can find them. And what happens next. So I clicked, I want to start my Jupyter server. Then you see automate a window that says sign in with a Linux service.gr. So you don't have to do anything, you just click here, it will auto sign you in. And what you see here, you have an overview of the Python script that was created that we use. You don't have to know coding at that stage. You don't have to rewrite anything here. So this is ready for you. It has many input steps. At the end of this process, when you click run and you run the Python script, what you're going to see is you see visualizations of the data and you see, for example, the time at the distance. So what happens here is if you check here, it says HL-S-A-R-T. So this is the name of the station. And if you remember the list of the schools that Evgenia showed you, this is a gymnasium in Arta in Greece. And here you have another school which has this code SIGU. So which one is this one? It's another gymnasium in Homenita. So these two, they have a distance of 107 kilometers, the two cities. And as you can see here in the graph, when an earthquake happened, the first one in Homenita, the first sensor, managed to get the signal and also monitor and also visualize it here. And then after a few seconds, the second one started to have the same information. So you see a time gap. What we wanted to create in our activities was also to show students how they can use these new tools, modern tools, but also let's challenge them what they can create. So what they can create? So Evgenia, what happened? Are you muted, Evgenia? We can't hear you. Sorry. So based on all these things that Androniki just presented, we have created an event, Hackwick 2019, where we have asked from teachers to create a NAP, an early warning system. Androniki, would you like to watch the video or should we skip it? Oh, we could have a look. Yes, of course. I think you have to swap, search screen with video. Yeah, sorry, it's my mistake. Let's see. Let's see if there's voice sound. We don't need dubs. Okay. Do you have the voice, the sound? No, we don't. You know what Androniki, I think that next to the faces and the blue arrow, there's an icon, and if you click on it, it's swap screen with video. And I think you also have to select play sound from your computer, not from Zoom. So I don't know, maybe it's better if we just post a link to this video on YouTube. Sorry. So what we wanted to show here, Evgenia found this great video. It's about the importance of the early warning system, let me copy paste in this. So apologies, you cannot see it. So yeah, the idea is historically how all cultures have tried to explain what is happening during an earthquake and they tried. Humanity has tried so much to find ways to get protected from earthquakes. We have reached a point that we know that earthquakes cannot be for there. There's no earthquake forecast, but what we can do is that we can gain a certain a very little, very little time before a big earthquake so that we can save something a few lives cities something. So this, this image is very self explanatory, because as you can see the epicenter on the far left is where the earthquake is really taking place. And then you see how the seismic activity is traveling in the form of waves, you can see the first wave which is red one then you can see the second one which is yellow. And as waves, they travel to other parts of Earth. The problem actually is when these waves reach big cities, there is where the danger is. And this is what this is the shape that we will take advantage of in order to create an early warning system. So what we have asked from teachers through this hack wake was that we have provided them with seismic data from five major earthquakes, which have taken place in Greece over the last couple of years. And we have uploaded them on helix on editable forms and on forms that could be used also from traditional computers that you can easily find in a computer lab in a school. So for the beginning, teachers had access to all these data. And what we have asked from them is to cooperate with their students in order to develop an app using Python program language, which could warn earlier for an earthquake coming. Actually, if you break that down, what they had to do is that they had to check the activity on a seismometer, then check it with another one exactly as Andronikis told you earlier for example with two very close cities. And then they would know that if two of them have given a signal, something was happening. And if they could certify that with the third one that meant that the alarm should be set. And again, it will not be more than two seconds but in some cases it can be enough. So think that at this case, we can see citizen science at its best, because students with teachers, they're cooperating, because they produce data from instruments that they host in their schools, they are very active in their daily life, children can see it as they pass by from the classroom. Then they take this data and they analyze them. They use another program language and they create an app and through this app, they return to their community, something that can be beneficial for everyone, not let alone that we talk about human lives here. So that was the initial idea that the first part of Hackwick took place in October, as I said, it was actually training for teachers so that they can go back to class and cooperate with their students and work as mentors for them. The second one, it's meant to happen in 2020, Corona crisis happened and at the moment it has been postponed, but in the second part, we will talk about products this time, about actual apps that can be used. In the next slide you can see some pictures of how we have worked and how teachers have been trained by Helix people, how to locate this data and how to make the better use of it, of them, of all data. So yeah, this is a very good example of how citizen science data can be used in education and have a full cycle of it, let's say. In our minds though, there was something missing because for the time I have talked about how citizen science can be sown and analyzed by students. We have sown some hundred activities that students could get engaged and get involved in this citizen science activities, but we have decided that there was something missing. What was missing out of the research research role the students had was to publish their research. Okay, and this is where our journal comes up, open schools journal for open science. Here we talk about an international scientific journal from students it is written by students under the guidance of their teachers, and it is also targeting to students the audience is students. So if you happen to read any article, don't be very strict. It's from students to students. Okay. So what we're thinking is that the students through the involvement in these initiatives they follow the full cycle of the methodology of scientific research. And this is the last part where they can publish their work as a researcher would do in their case. For the time journal our journal has 270 users 118 of them are authors they have provided content 91 is reviewers. This journal is peer reviewed. This is how we can guarantee for the quality of the content. The reviewers are professors from universities that we cooperate. As I said, this is an international journal, you can find content in many languages. And that makes things a little complicated for reviewing, but we're working very hard to raise a number of the reviewers so that we can offer peer review in all languages. In the moment there are 154 published items. I talk about items because most of the publishing content is articles, full articles following the research cycle, but also there are some posters. Many teachers find it much easier to work with their with their students in the form of posters. So in these cases, they just provide a description and an abstract, and then you can see the poster. But already five more issues are planned to be published until the end of July this July with more than 100 new articles this time so you there there is. It has become quite popular. So if you if you visit one of the of the issues that is already uploaded. This is a table of contents that you can see the in the text in red is actually the title which is hyperlink and you can get into the details of the article and the line below is then are the names of the authors. If you click on the PDF icon that you can see on the right. This is what you get. At the top, you can see the how to site a click button. Once you click it, you can take it the citation ready for your research you can put it there. The job is done for you. And if you click on the PDF. This is what you get. This is the the in blue you can see the title and then the names and the affiliation there. They're actually the school they're going to. And of course you can also download anything that you like on your computer. This if you click on the archives, you can see all the issues that have been published so far. And if you click on them, you can see the table of contents and decide what reading would be useful for you. We totally support students and teachers through every phase. We have created a very specific and detailed and thorough template that if they follow we can guarantee that the article will include all the important parts. And also we can guarantee that all items published in our journal are the same. And this template is. Sorry, and the Nikki can we go back a little is also available in all the languages that you can see on the on the on in the list on the left. If there is anyone who would be interested to to translate the template in their languages, please contact me it would be great. Because through that it's much easier for us to come closer to more teachers and more students. So I would, I would love to to hear from you about that. Another thing is that we offer also support to reviewers. We reviewing on the journal is happening in full secrecy. But what we can what we can provide to them, giving credit to their contribution for our journal is that we, we have the certificate of reviewing that all reviewers are getting once they have, they have participated in that part. So under Nikki talked about the integration of the opener services in our initiatives. And here you can see how the journal is also hosted on Zenodo. There's another on Zenodo there is a special community about the journal the open schools journal for open science community, where all the content that is found on the journal can be easily searchable also on Zenodo. Again, we follow and we fill in all the metadata to make it easy for you to get it. Once you click on one, I'm sorry it happened to be a Greek one. And maybe that's why you do not recognize the alphabet. But here you can see in them in the beginning that you can see the title of the article and later on the lower part of the screen, you can see the preview of the PDF. If we go to see the background of this work. Someone who wants to upload an article on this community, the administrator actually it's not that anyone can has to fill in some metadata, which will help readers to find exactly what they need. So amongst these is the publication date a title, the authors, the name surname and the affiliation they're working for in our cases, it will be a school, the access rights in opener we are very strict with the access rights and the licensing. You can name if you have received funding from EU project. And also, there are some optional metadata like the contributors, apart from the authors, some references journals that that the article has already been presented conferences that could this work could have already been presented if it has been included in a book report or a chapter. If it is a part of a thesis or the subjects that this article is covering all this metadata is just to make the readers lives easier. And the third part. I'm afraid there's less to talk about this one because most of the work is done in classes it's the Nobel Prize physics on Zenodo. So, in that the, it was a very, very ambitious goal and we are very happy that we made it is what we're doing is that we bring together teachers and large science research infrastructures like CERN, for example, or Virgo in Italy, and we bring them together and operate the students, the teachers and researchers. So, they exchange data there are even cases that students give back the analyzed data and they give back to the researchers and they make you and the researchers make use of this data. So, here on this and other community we upload all the educational activities that we have developed in order to bring that level of physics in classroom. What is surprising about that and why I said that it was a very ambitious goal and we're happy that we succeeded is that in Zenodo you can see how many times it has been viewed a resource and how many times it has been downloaded. Here we can see that it has been viewed 50 times and it has been downloaded by 42 people. That means that 42 teachers at least because between the educational community now we have lost track of how it has been distributed have found this content interesting in order to use it in the learning process. Imagine what a change that would make for students. And yeah, the surprise under Nikki talked about as I said when we started planning these citizen science initiatives of open air, we have found a gap. We have found a gap of how this work could be published. And that's that's why actually the journal was developed, but we are very, very happy when we found out that some of the of the students who published their work in one of our issues. They have actually made a new discovery. Their abstract is in Greek, but it has been translated for you. And you can see that they have used content from Kepler space telescope, and they managed to identify an exoplanet orbit around the star KIC 1432789, whose characteristics have been analyzed for the first time in this article so imagine what a difference it makes for children for students to have access to this data to be able to analyze them and even more to be able to publish them under the guidance of their teachers to publish them in such a young age to publish a new discovery. So I think that was from us. Yes, thank you very much. Eviania, you are very much you are fantastic. Thank you very, very much. Is there any questions? Thanks a lot. I don't see any questions yet and any questions. Every mind is that you can use Q&A, or if you want you, you can use chat. And also if you want you can raise your hand and speak. Like in a classroom, don't worry. Thank you, Esteban for sharing your project link. So I don't know if you'd like to say something or maybe if you have some suggestions for collaborations, because there might be some synergies in the citizen science work. So Guldkin is saying that he would like to... Sure. No, he's saying that he would like to make much more collaboration now. Sure. Please feel free to use our contacts in the last slide of our presentation. You can see our emails will be more than happier to work with you. For the time, we're not very familiar of your background, but citizen science is so broad. And I'm sure that we can find very, very useful manners to cooperate. And I think that many of you are working in citizen science project is a true, because in the case of open air, we have done something very, very radical. As we said in the beginning, we have tested the citizen science and education and I can assure you that the results of the outcomes of this test have been significantly successful. So we are very, very happy to continue working towards this approach. And we can certainly find ways to cooperate. I see. Is there... Hello, Paoli. I'm sorry. What is that? I don't understand the question exactly. Yeah, maybe Paoli, you're asking a difficult question because it's a public webinar for everyone involved in citizen science projects. It's not open air only. Open air is an illegal entity that's set up and Paoli chairs management and administration spending committee in this open air legal entity because we're not a project anymore. Yeah, legal entity. So he was wondering whether there are any plans to continue that in Omke? Yeah, sorry, Paoli. I'm talking mostly about the content. So apologies. But yeah, keep in mind that this approach of citizen science and education can be very, very interesting. Maybe it's a part of open science innovation strategies that are being discussed within Open Science Policies Committee. Sure. Sure. Thank you, Gonzalo. So I only see Paoli's hand raised, but I guess... So if he wants, I can allow you to talk, but I guess we're already... Yeah, there's one more. There's Esteban is asking about the slides. Yes, sir. So I'll wait for a copy of slides from you and then I'll send everyone who attended the slides. Yeah, then please go ahead, Paoli. Okay. Thank you. Very impressive work you have done and I was just wondering is there going to be... What is coming next? Because in European level, also in open areas, as Irina mentioned, the open science part of citizen science is a very important part of open science. And that's why I think we need more these kind of very interesting cases, which you have done. And in Finland, we don't have earthquakes or we have... They are so small that you don't count them. So we are not cooperating in this way, but the concept is something I think for making observations, whatever the target is, and then the... Churching the data and analyzing the data and especially the publishing part is important, as you mentioned. So maybe we can think about some other data sets which could be used in, for example, in Nordic countries where the earthquakes are not the issue. But thank you very much for your... Thank you, Paoli, very much, because you gave me the chance to clarify that firstly, I understand that there are many countries that they do not have a special interest about earthquakes, but keep in mind that you do not need to have a seismograph in order to take advantage of this data. If, for example, in the topics and the thematic approach of the Finnish curriculum, there is, let's say, a discussion about earth science, you can have access to this data and you can follow the activities that we are suggesting, and in that sense, you can take advantage of this data. So this was the first thing that I want to clarify, that you do not need to have a seismograph in order to implement these activities. This is the first thing, and that's for the journal. The journal is stem oriented and it's not just for the earthquakes and not just for the seismic data. We publish any article, any item that is supposed to be published and it can cover any stem topic that you decide. And there have been cases that we receive independent articles on the journal and they follow the procedure and then eventually they're published. But also you can see that there are cases that we have made some special issues, for example, from a school. There have been schools that they have expressed an interest, some of their teachers to publish a special issue, so it is just a special issue of this school. So think of it more openly. We do not want to be very, very strict taken that this is students work. So if you believe that there's a chance that we can, there's an opportunity in the school that they might be interested to publish their work, please feel free and I'm sure we'll find a way to publish their work. Thanks a lot. I don't see any questions. So I guess that's the last chance for you to have the questions or comments. Thanks a million. Again, and then run it here. That was wonderful. Very impressive work. And thank you everyone for attending today. I'll follow up. I'll follow up with slides and recording. Have a good rest of the day. Thank you. Thank you very much also for joining.


Hey, thanks to Brent from my Patreon page for the request, doubling into the Game Boy Color Catalog for this one titled Survival Kids or Stranded Kids in Europe. So you start up the game, you pick a boy or a girl character, and just like that you're on a ship. It capsizes, and you wash ashore onto a deserted island. And uh, now what? Yeah, that's right. This is one of those what the hell do I do kind of games, but this is one of the best possible examples of an open-ended non-linear game done right. Survival Kids keeps it very simple. I mean, it's right there in the title, you gotta survive, and maybe even find your way off the island.   You explore the island a bit more, and you find a few more new, useful things here and there, and the game does a nice job helping you along without being overbearing. You do eventually explore caves and dungeons and such, but you can't be reckless. You gotta plan ahead with plenty of food and plenty of water in your canteen, and you also have to be careful about what you eat, or you could poison yourself. Pretty simple stuff, but it's done well. Handling your thirst meter is pretty straightforward, obviously, but you can approach food a couple different ways. You can go after wild animals, everything from rabbits to foxes to bears. You can collect stuff like clams, be careful though, because they go bad after only one day. Or you can get creative and do stuff like smoke out a beehive and take all the honey. That leads me to one unexpected aspect here, the ability to combine items to create things, like putting together tree bark and a stick to create kindling and start a fire, which of course you'll need both to see at night and to cook food. Of course you do get rewarded for surviving, besides like, you know, being alive. You discover all sorts of odd stuff on the island, and spoiler alert, maybe even other people. There's eight different endings here, and not all of them are pleasant. I mean, that's pretty out there for a simple Game Boy Color game. I don't know, maybe this all sounds boring to you, but I really had a lot of fun with this game. It has the same kind of vibe as the original Harvest Moon for Game Boy. The same top-down perspective and a similar open-ended structure that allows the player to control the pace. You know how Harvest Moon eventually led to stuff like Stardew Valley? Survival Kids feels like the precursor to indie survival games like Don't Starve. You can draw the same kind of connection between the two. Survival Kids isn't perfect though, there's some odd quirks that are no doubt the result of the Game Boy's limitations, like the fact that time only passes while you're moving, and night seemingly shows up out of nowhere, so getting a feel for the day-night cycle can be tricky. Survival Kids also received a direct sequel, but sadly it was only released in Japan. The series continued on several years later, however, under the name Lost in Blue for Nintendo DS, including Lost in Blue Shipwrecked for the Nintendo Wii in 2008. I haven't played any of these games since I was just introduced to the series, like, just the other day. But if they're anything like Survival Kids, then they must be at least pretty decent. So yeah, Survival Kids is yet another example of the quaint little Game Boy color surpassing expectations and delivering a game that might surprise you. I honestly had a hard time putting this one down. This game is a bit pricey for a Game Boy color title at around $35, but I'd recommend playing this one anyway you can. If you like open-ended survival games like Don't Starve, you won't be disappointed in Survival Kids.


Listen, I am fed up. You're just asking for more information, more information, more information. What is that all about? You know me, sir. I do business all the time. I'm sorry for the inconvenience, so. But let me explain to you why we request additional information. More information, manita. So, every year, $2 trillion is laundered through legitimate institutions like this bank. What do I have to do with me? This laundered money is used to support criminal activity and terrorist activity, and also to finance weapons for mass destruction. But what do I have to do with me putting my money into my account? Well, because of money laundering. Our bank, your bank, is obligated to comply with the International Anti-Money Laundering Regulation. What's that? By performing customer due diligence. Essentially, just knowing our customers a little better. You know me. Your banking patterns and transactions. It's a relationship, and if we fail to comply, the penalties will be severe. Not just for this bank, but for St Lucia. If we? Yes. I never realized that. But what's good is that we have an oversight body called NAMLOK. What's NAMLOK? The National Anti-Money Laundering Committee. It monitors St Lucia's compliance with international regulations. The aim is to nip money laundering at its source. You know what you're saying? It's the money city-wise. The money volley. For further information, contact the Attorney General's chambers at 468-3200 or visit the National Anti-Money Laundering SLU Facebook page.


All right. My name is Evan Miyazono. I have done research at Protocol Labs. I really tried to just make sure that we have the best research we can have and have as much of it as possible. And I've been thinking about how to reward innovation generally. This is going to be a very fast talk about some things that are half to this audience asking, does this sound insane? Have you heard or have you heard of something like this before and half to the video audience of if this sounds interesting, would you be interested in working on it? Feel free to reach out. Thinking about ways other than IP to reward innovation, the idea being that if you were in charge of or received as a private citizen some corporate R&D lab alone, how could you make sure that that was sustainable given that it creates good things but may not be easily monetizable? Often the best of labs in the past have been connected to some monopolistic-like entity like Xerox or Bell or the US government, for instance. And the intellectual property is one reasonable way to try to monetize things. There are different types of knowledge or different types of outcomes of innovation. I would highlight these four as reasonably useful categories, explicit knowledge being things that you can write down and share very easily, the knowledge that you know how to explain and you know to elicit in a conversation, the tacit knowledge that you may or may not be able to convey in an easy way. There's only the hard way to learn it and then generalized impact. In terms of tools for value capture, we have a bunch of these things. There's not intending to be an exhaustive list, but mostly I want to talk through some weird things that I don't think I've seen in other places. One of them being if you have explicit knowledge, I think it could be interesting to have something that looks like a derivatives trading desk. First, I'll talk about the tech-transferry partnership. As you might imagine, you could have, as part adjacent to a lab, a group that identifies if you are working on technology A, which is a competitor to alternative hypothesis technology B, there are companies out there that are probably making bets that A will succeed or that B will succeed. You could potentially partner with those companies and try to elicit some sort of non-dilutive no rights included funding for those directions to try and increase the funding to increase the likelihood of success, if that's influenceable. You could also imagine having those groups empower those groups to raise capital and invest in those companies based on the outcome of the experiments. One thing that is a really weird example of explicit knowledge that I think would not fall under any existing monetization strategy would be if you found that these three vitamins and aspirin managed to reduce symptoms of some particular cancer or Parkinson's or something, I don't think you can patent that. I don't think you can trademark it or license it effectively, but the companies that manufacture those things will probably see some change in demand or their stock price or something like that. As it stands, there's no real financial incentive to generate that knowledge. The question becomes, if you had something like these groups that could monetize in this way, could you have an institution that incentivizes that sort of knowledge creation? The derivative trading desk could be something as weird as their breakthroughs that say this form of quantum computing might be closer to reality than we previously thought. Most big tech companies are betting on some form of quantum computing. The question becomes, when that happens, do you the stock market is the canonical place to profit off of information? If you have information about which of these companies roadmaps seem more realistic, then you could imagine if you are partnered, I don't even know if it's technically insider. I would imagine it's not even insider trading if you know of a scientific result that is not being done by company A or company B, and you do a relative trade on the pairing between company and company B. If that is perfectly legal, then it would be very interesting to see if you could do something like that, build a model, try it out, and look at past data and see if you could predict changes in stock price relatively based on scientific intuition. If so, use that to go back and fund the lab, see if there is a reasonable risk-adjusted return compared to other things. One thing fun about tacit knowledge, this was the know-how that fierce was talking about previously. I really like the idea that you could potentially train more people more effectively and give them like, I'm picturing some weird grad school where you give people PhDs and you strap them with an income share agreement and you make them especially well prepared to do things that are incredibly valuable, knowing that you will see some upside because you will get some like your institution that's training them will get some equity in whatever startups they create that could be like these hard technical startups and suddenly everyone wants to do that because they know there are aligned incentives around trying to deliver that outcome. Also, I think impact certificates have been mentioned once or twice in passing. I'm not going to go in them here for timing reasons, but I think that it's really interesting to start talking about formalization of bragging rights for impact and I think there are some interesting things that we're going to start doing in funding the commons, the conference that we're running in like every roughly quarterly next one's in New York and it will be I think very compelling to create use cases for those bragging rights. If you create a social culture where it's normalized to brag and have one of these things to brag, then it starts creating and ceding demand for these things. So anyway, that's everything I had. Thank you so much.


It all comes down to relationships in humans, our spouse, our kids, our parents. I wrote Giftology as a business book, but a lot of people have reached back out and said, John, my marriage is better. When people are like, oh, that's a business book, or I don't own the company.  And if you want good relationships, then you need to find ways to show up in our common ways, not just with gifting. It could be a video. There's a lot of ways you can show love to people. What's up, everybody? And welcome to the show today. We drop great content each and every week, and we want to make sure that you guys get notified. And in order to do that, you're going to have to smash that subscribe button and hit that notification bell. And if you've gotten a lot of value out of this, make sure you give us a like and share our videos with your friends. So I don't have to think of utility. When I get a shirt in the mail, I'm thinking, yay, I got a shirt. I'm thinking, what, how's it fit? What's the style?  I'm not gonna, I'm not a billboard for you. I'm very particular about all the clothes that I wear. And I think most Americans are, and we're certainly brand aware. That's all everyone's been hearing about since social media has been prevalent in everyone's life. Brand awareness is you are, you are now branding yourself online. It's on everybody's mind. Yeah. No, I think that the end of the day, like I don't even wear my own brand. I don't wear a giftology. I think that's cheesy. Even my own company. I wear, I'm black, black t-shirt, loose lemon. I want the logo as small as possible. Like, and I think the more affluent you're targeting people, you know, up the food chain, like they're that way. Typically, unless it's a brand they love, they don't want, like, yeah, you're actually like, and subconsciously, everybody knows, like you're trying to disguise a gift, but really it's a billboard. It's a manipulation. So I want to say thank you, but really I'm trying to turn you into an advertisement. Does that feel good? No, it feels gross. It feels icky. When you, like book launches, horrible. Like the amount of people that do book launches and like, here's a wristband. Here's a sticker. Here's a, you know, like they send out 500 books that are like in some box with like a water bottle and a flashlight and I don't want any of that stuff. Now I feel guilty about throwing it away and I've just stopped responding. Like unless somebody takes the time to hand write a note and sends the book based upon the relationship, that's why, like when I published the mythology, I had 50 copies made. There was $300 a piece through like $300 for a book.  It went to Vaynerchuk, Seth Godin, Michael Hyatt, people that were either client's mentors or people that I respected. I didn't ask for anything. I said, thank you for inspiring me to write this book. Here's what I got from your stuff and this is what I'm putting onto the world and it was personalized to them on the cover. It was monogram to them and their spouse on the leather them and the spouse asking for nothing. The amount of people that reached back out, unsolicited saying, this is the nicest book I've ever seen. I get thousands of books sent to me. I want to buy 20 copies from my team or 50 copies. I want to have you on my show. I want to whatever and people made fun of me at $300 book. They're like, we can get them for $3 and I'm like, you'll spend $300 on a bar tab. Nobody cares. I'll spend $300 on one book and we've sold now 120,000 copies of a self-published book, giftology. I never big publisher behind me, but I ate our own dog food and now we have a $3,000 version of the book. We have a $300 version of the book that has a video screen built in, but every single one that we send out, handwritten note personalized to the person. None of this generic BS on a tight, like Manila envelope, like that communicates mass. It communicates mediocre. It communicates, this was done to everybody. And so the more you can take this concept of giftology and really apply it to all other parts of your business, instead of doing something for 100 people at a dinner, take people out, 10 people out and make it a once in a lifetime experience.  Like the more you can go all in on the details and flip the script where everybody goes cheap, I go expensive, where everybody goes expensive, I go cheap. I don't have a pitching match over here where it's just noise. I want to be in a blue ocean and gifting and how we show up for people. Like what everybody does just go completely opposite and go all in on those little things. And when you do that, people respond. They're like, wow, I feel special. So how has this impacted your personal relationships? And for those in our audience who aren't business owners, who aren't necessarily generating leads or clients or referrals for their business, but want to deepen those potential relationships with mentors and people who could impact their career, what advice do you have for them? I think it's the same.  And at the end of the day, if you don't do business with companies, they do business with humans, with an individual, with a sales rep, with a manager. And so I sent one of those crazy mugs to my neighbor. Do I have anything to ask of him other than being a neighbor? No, he's a friend. But I think that when you show off for other human beings, like we all like the quality of our life locally at our school, our church, our charity, our board that we're serving on, like, it all comes down to relationships in humans, our spouse, our kids, our parents. And so this, this really, I wrote giftology as a business book, but a lot of people have reached back out and say, John, my marriage is better. I had somebody reach out from Vietnam saying I read the book and now I get why my wife wasn't responding the way because I wasn't showing up for her in this type of way, the surprise and delight and going all in. And so when people are like, you know, that's a business book or I don't own the company.  And if you want good relationships, then you need to find ways to show up in our common ways, not just with gifting. It could be a video. There's a lot of ways you can show love to people. Handwritten notes. The best is when you take all the love languages and combine them together. You spend quality time with somebody with a handwritten note, which is words of affirmation. You give them a world class artifact, which is a physical gift.  But I call BS and people are like, I don't have the budget for it. I'm like, re-invest a portion of your commissions back into your relationships, like you own the company because your commissions will grow and you'll be, you'll have companies coming after you based upon the value and trust that you have of your relationship. Don't give me the excuse you don't own the company or they won't pay for it. You pay for it yourself. I did that when I was working with Cutco. I used my own freaking dollars as a college kid to re-invest in relationships. That's why I grew so fast. So I think a lot of people have this limited, they say they're playing the long game because Vaynerchuk does. And their long game of day is not decades. And frankly, we're all going to be probably in business for the next 10, 20, 30, 40, 50 years act like it. We drop great content each and every week and we want to make sure that you guys get notified. And in order to do that, you're going to have to smash that subscribe button and hit that notification bell. And if you've gotten a lot of value out of this, make sure you give us a like and share our videos with your friends. Such an important viewpoint. Even if you are just an employee to think about your managers and those who could mentor you in open doors in that future career development that you have, it's so important to invest in every single one of those relationships. Not just think this is something that business owners have to do to get more clients or sales people have to do to close more deals. Every single relationship that you have personally and professionally has a profound impact on your life and that future that you hold so near and dear and you're excited about. So taking the time to be thoughtful. And I really love that involving all of the love languages in the gift. It's such a thoughtful way, especially if you're thinking about the holidays here with your spouse or your significant other or anniversaries or birthdays to involve all of those love languages into one shared experience that has a bit of each is such a better way to go about it than just planning the same old dinner you do every year, the same old florist you visit every year, and thinking you're being thoughtful, pretending that you care about this person. Amen.  I've never felt the way I feel because you're hitting people from multiple angles with, you know, I call them love bombs now. It's like a gift feels cheesy and lame. You know, I love bomb communicates like you're doing something at this atomic level of like, wow, like there's ripple effects into the future.  It's like that feels tacky and cheesy. Love bomb is more appropriate in my mind.  I can't remember the last time I got a mug in the mail and I rushed to tell Amy, Hey, you got to see this mug, right? We don't do that with many of these gifts that are just thoughtless that we're receiving. What gift have you received that stood out for you? We've heard a lot of examples of how you've helped clients, but I'd love to hear what the gift giver himself received that stood out. I think a lot of people are intimidated to give me a gift because they know that like I look at things critically.  I mean, there's a couple that come to mind. One, the mug was the artifact mug was a big one. That made me cry. It made my wife cry. It was a big one. Paul, my original mentor, buying 100 gifts and then giving me his social capital. He'd say, go give this gift to this person, this business owner over here, whether he buys or not. Let him know I love this product and I love what you're doing. So he transferred his trust in social capital, which as a 20 year old was a big deal. Like I still to this day try to give him credit in the book. He won't take any of the credit because that's just who he is.  I've had somebody, you know, recently send me a top of the line. They know I love Sauna's and so they upgraded me to a brand new like sunlight and $5,000, $6,000 Sauna sent me a cold plunge tank. You know, they sent me a trip to Disney with my kids. You know, they'd heard me speak at a hospitality event there with Hilton. That was cool. And that each of those when they unveiled it to me, they sent me a gift for each of my girls that was customized to them with a handwritten note packaged just for them and my wife and me, like the humongous box of like all these other boxes on top of, oh, by the way, we're going to cover your tickets in your, in your hotel stay and whatever else. So I've had, I've had some crazy ones and I have some things in my head that I'm like, I hope somebody sends me that someday. I hope I had enough value to the life that they send me a vehicle or, you know, the paddock watch or the whatever. Those haven't showed up in the mail yet, but I've still had some pretty insane ones, relatively speaking, like dropping $10,000 on a gift for me that I'm like, you know, from my roots of being a farm kid, wanting the Air Jordan to now like this, like it's, I'm super grateful for what people are willing to do and show up for me. I love that. Well, we always ask every guest what their X factor is, what it is that makes you extraordinary. I have a feeling we know the answer, but what is your X factor, John? I think I help people, you know, be more radically generous and scale their thoughtfulness. And that's my super power. I think I can inspire it, but I also have been able to help people leaders think about how to show up in uncommon ways and radical generosity, even in 2021 never gets old. And I think that's my X factor. Awesome. And you, I know you dropped the URL, but we'll put it in the show notes. Where can our audience learn more about this gift giving recipe and giftology? Yeah, giftologysystem.com is the free resource. Give the givers edge is the 10 worst gifts to avoid giving. Either one of those places is a great place to start. And really, like, as much as we love having clients, like the goal for us is to give away our entire recipe so people can go do it on their own. They don't have to hire an agency to do it. Like there's no like, we keep this behind the curtain and like, there's no secret sauce. It's like, it's all out there for people to latch on to and start doing immediately. Wonderful. Awesome. Thank you so much for joining us. Enjoy the holidays. Thanks for having me, guys.