We continue today with chapter 21. The fear to look within. The Holy Spirit will never teach you that you are sinful. Errors He will correct, but this makes no one fearful. You are indeed afraid to look within and see the sin you think is there. This you would not be fearful to admit. Fear, in association with the sin, the ego deems quite appropriate and smiles approvingly. It has no fear to let you feel ashamed. It doubts not your belief in faith and sin. Its temples do not shake because of this. Your faith that sin is there but witnesses to your desire that it be there to see. This merely seems to be the source of fear. Remember that the ego is not alone. Its rule is tempered and its unknown quote enemy whom it cannot even see. It fears. Loudly the ego tells you not to look inward, for if you do your eyes will light on sin and God will strike you blind. This you believe and so you do not look. Yet this is not the ego's hidden fear nor yours who serve it. Loudly indeed the ego claims it is. Too loudly and too often. We're underneath this constant shout and frantic proclamation. The ego is not certain it is so. Beneath your fear to look within because of sin is yet another fear and one which makes the ego tremble. What if you looked within and saw no sin? This quote fearful question is one the ego never asked. And you who ask it now are threatening the ego's whole defensive system too seriously for it to bother to pretend it is your friend. Those who have joined their brothers have detached themselves from their belief that their identity lies in the ego. A holy relationship is one in which you join with what is part of you in truth and your belief in sin has been already shaken nor are you now entirely unwilling to look within and see it not. Your liberation still is only partial, still limited and incomplete yet born within you. Not wholly mad you have been willing to look on much of your insanity and recognize its madness. Your faith is moving inward past insanity and on to reason. And what your reason tells you now the ego would not hear. The Holy Spirit's purpose was accepted by the part of your mind the ego knows not of. No more did you. And yet this part with which you now identify is not afraid to look upon itself. It knows no sin. How otherwise could it have been willing to see the Holy Spirit's purpose as its own? This part has seen your brother and recognized him perfectly since time began. And it desired nothing but to join with him and to be free again as once it was. It has been waiting for the birth of freedom, the acceptance of release to come to you. And now you recognize that it was not the ego that joined the Holy Spirit's purpose. And so there must be something else. Think not that this is madness, for this is your reason tells you. And it follows perfectly from what you have already learned. There is no inconsistency in what the Holy Spirit teaches. This is the reasoning of the sane. You have perceived the ego's madness and not been made afraid because you did not choose to share in it. At times it still deceives you.  For you have realized that all the gifts it would withdraw from you enrage at your presumptuous wish to look within you do not want. A few remaining trinkets still seem to shine and catch your eye. Yet you would not sell heaven to have them. And now the ego is afraid. Yet what it hears in terror, the other part hears as the sweetest music. The song it longed to hear since the first time the ego came into your mind. The ego's weakness is its strength. The song of freedom which sings the praises of another world brings to it hope of peace. For it remembers heaven and now it sees that heaven has come to earth at last from which the ego's rule has kept it out so long. Heaven has come because it found a home in your relationship on earth and earth can no longer hold what has been given heaven as its own. Look gently on your brother and remember the ego's weakness is revealed in both your sight. What it would keep apart has met and joined and looks upon the ego unafraid. Little child, innocent of sin, following gladness the way to certainty. Be not held back by fear's insane insistence that sureness lies in doubt. This has no meaning. What matters it to you how loudly it is proclaimed. The senseless is not made meaningful by repetition and by clamor. The quiet way is open. Follow it happily and question not what must be so. And from the workbook, Lesson 169 By Grace I Live By Grace I Am Released Grace is an aspect of the love of God which is most like the state prevailing in the unity of truth. It is the world's most lofty aspiration for it leads beyond the world entirely. It is past learning yet the goal of learning. For grace cannot come until the mind prepares itself for true acceptance. Grace becomes inevitable instantly in those who have prepared a table where it can be gently laid and willingly received. An altar clean and holy for the gift. Grace is acceptance of the love of God within a world of seeming hate and fear. By grace alone the hate and the fear are gone. For grace presents a state so opposite to everything the world contains that those whose minds are lighted by the gift of grace cannot believe the world of fear is real. Grace is not learned. The final step must go beyond all learning. Grace is not the goal this course aspires to attain. Yet we prepare for grace and that an open mind can hear the call to awaken. It is not shut tight against God's voice. It has become aware that there are things it does not know and thus is ready to accept a state completely different from experience with which it is familiarly at home. We have perhaps appeared to contradict our statement that the revelation of the Father and the Son as one has been already set. But we have also said that the mind determines when that time will be and has determined it. And yet we urge you to bear witness to the Word of God to hasten the experience of truth and speed its advent into every mind that recognizes truth's effects on you. Oneness is simply the idea God is. And in his being he encompasses all things. No mind holds anything but him. We say God is and then we cease to speak for in that knowledge words are meaningless. There are no lips to speak them and no part of mind sufficiently distinct to feel that it is now aware of something not itself. It has united with its source and like its source itself it merely is. We cannot speak nor write nor even think of this at all. It comes to every mind when total recognition that its will is God's has been completely given and received completely. It returns the mind into the endless present where the past and future cannot be conceived. It lies beyond salvation past all thought of time, forgiveness and the holy face of Christ. The son of God has merely disappeared into his father and his father has in him. The world has never been at all. Eternity remains a constant state. This is beyond experience we try to hasten. Yet forgiveness taught and learned brings with it the experiences which bear witness that the time the mind itself determined to abandon all but this is now at hand. We do not hasten it in that what you will offer was concealed from him who teaches what forgiveness means. All learning was already in his mind accomplished and complete. He recognized all the time holds and gave it to all minds that each one might determine from a point where time was ended when it was released to revelation and in eternity. We have repeated several times before that you would make a journey that is done. For oneness must be here. Whatever time the mind has set for revelation is entirely irrelevant to what must be a constant state, forever as it always was, forever to remain as it is now. We merely take the part assigned long sense and fully recognized as perfectly fulfilled by him who wrote salvation script in his creator's name and in the name of his creator's son. There is no need to further clarify what no one in the world can understand. When revelation of your oneness comes it will be known and fully understood. Now we have work to do where those in time can speak of things beyond and listen to words which explain what is to come is past already. Yet what meaning can the words convey to those who count the hour still and rise and work and go to sleep by them? Suffice it then that you have work to do to play your part. The ending must remain obscure to you until your part is done. It does not matter, for your part is still what all the rest depends on. And as you take the role assigned to you, salvation comes a little nearer, each uncertain heart that does not beat as yet in tune with God. Forgiveness is the central theme that runs throughout salvation, holding all its parts in meaningful relationships, the course it runs directed and its outcome sure. And now we ask for grace, the final gift of salvation can bestow. Experience that grace provides will end in time for grace foreshadows heaven, yet does not replace the thought of time but for a little while. The intervals vices, it is here that miracles are laid to be returned by you from holy instance you receive through grace in your experience to all who see the light that lingers in your face. What is the face of Christ but His who went a moment into timelessness and brought a clear reflection of the unity He felt an instant back to bless the world? How could you finally attain to it forever while a part of you remains outside, unknowing, unawakened and in need of you as witness to the truth? Be grateful to return as you were glad to go an instant and accept the gifts that grace provided you. You carry them back to yourself and revelation stands not far behind. Its coming is insured. We ask for grace and for experience that comes from grace. We welcome the release it offers everyone. We do not ask for the unaskable. We do not look beyond what grace can give. For this we can give in the grace that has been given us. Our learning gold today does not exceed this prayer. Yet in the world what could be more than what we ask this day of Him who gives the grace we ask as it was given Him. By grace I live. By grace I am released. By grace I give. By grace I will release.


I was driving myself crazy because I wanted her so bad, but I just couldn't be with her. Oh, I didn't see you guys there.  Welcome back to our channel. So today we have some exciting, it's a cute sense of hold up, hold up, hold up. We'll just went into like, it's like boring. Let me just give me a quick pause really quick. It is freaking boring out. Look at this. Like I can't even really see. It's already flooding. It's flooding on the road right now. This video is going to be one of the most important videos. It's a video you guys have been waiting for for a long time. Now, besides all the pranks, besides all the challenges, we wanted to give you an insight on our actual relationship and how our first day was. We're going to take you guys to our first day. We want to take our marble squad, something fun. We want to show you, this is the same day we had our first kiss. Oh yeah. We got a little crazy that day, but it's a kind of a low key place. I know a lot of you are going to love this place that we're going to already. Like some people are obsessed with this place. But this was just where we decided to go. It means a lot. It does mean a lot. Low key, every time I go here, I think of us going there for the first time. I know, and we order the same exact thing. When he goes, what do you want? I go, I want this. And he goes, no way. He goes, I get the same thing. Should we explain that now? Maybe we should. All right, so we went to this place, right? And we ordered a drink. It's a fast food place. So comment down below before we get there what place you think it is. But we got here. He told me, hey, can you order this for me? And I'm like, no freaking way. I think we got the same thing. That was how we just connected on our first date. But anyways, thank you guys so much for being subscribed to us. If you are not already, make sure to go down and hit that subscribe button. Make sure to turn on your bell notification so you guys get notified every single time we post. And once you do those two things, make sure to comment down below when done. Let's get this video to 25,000 likes. Let's do it for love. For our love and your love as a family. If you're part of the Marvel Squad, make sure you give this video a big thumbs up. Let's get this video to 25,000 likes. I know you guys have been crushing it. I see it. I see the place actually.  This is insane. Everyone, we're rolling up on it right now. We're probably 30 seconds down the road. Oh my God, this is crazy. It's bringing back so many memories because this is where it all kind of started. So Bill's sister, before we got here, said that the place that we were going to was temporarily closed. And I was gonna get really mad and be like, it's closed. We were gonna get so upset, but it's open. All right guys, in three, two, one, Starbucks. I know it isn't something that's super like sentimental or like a date night. This is where our Marvel family started. It really did.  And I go, I like vanilla bean frappuccino with caramel throughout. And he goes. Oh my God, me too. Yeah, it was the cutest thing. Oh, while we wait in the Starbucks drive-thru, we wanna give the answer to the last video, end of the video question that we asked you all. I told you three things and one of them was a lie. I told you I was a cheerleader. I broke my arm on the monkey bars. And then he was adopted. I was adopted. And a lot of you guys had, it was between cheerleader and adopted. Here's the thing, I don't think they wanna believe that I was ever a cheerleader. I don't think they wanna believe that either. But I don't think they believe that I was adopted either. That was the main thing. Yeah, those were the main two. I only had a few people that said monkey bar, but we're gonna reveal it. You guys ready? The answer of the last video's question was, I was not adopted. You guys all got it who said I was not adopted. I kinda exposed myself here. I was a cheerleader when I was little. I cheered in the same group as my sisters. Yeah, that happened and now we're gonna get over it. Yeah, so he was a cheerleader. Make sure you guys stay tuned for the end of the video because I'm gonna do two truths and one lie and I know you guys really enjoyed that last time. If you did not know, at the end of every video, we do do an end of the video question for all those that have not watched our videos to the end. So make sure to get ready for hers today because I'm excited. I'm excited. This Starbucks line is hecka long. Crazy. If you guys don't know this, Bill will always on TikTok, he'll be like, this is hecka, you're gonna hecka strong. I wanna say hello. I like that. This is gonna be crazy. We need to get some breakfast food because I am starving and I'm gonna live on here. I agree, but I don't know what they have and there's four people behind us so we have to be lickety split. We don't have to be lickety split. What are you taking pictures of? It looks intense. For YouTube.  Yeah. There you go. I appreciate it. Have a great day guys. Thank you. Looks good. Hey, Starbucks was like low key hella protective. She had a coffee mug that she put those in so she didn't touch them at all. Comment down below what you guys like to get from Starbucks. Any of that. Like cake pop. Comment down below. So basically we're doing exactly what we did on our first day. We literally parked in the Starbucks drive-thru and drank our vanilla fabric in. It was so nerve wracking when we first went out. It was so, no, actually it really wasn't. I think what we were most worried about was like our first kiss and we were thinking about that the whole time. Like when is he gonna kiss me? When is he gonna kiss me? Hello, Q, everyone. I think that's when it was really like made us the most nervous. I don't know if you had had your first kiss yet. I'm sure a lot of you guys haven't. That's awesome. It's okay if you haven't. It is the most nerve wracking thing ever because we were both thinking at the same time but we just didn't wanna do it. Just because like we were nervous. It literally took that night. Her sister was like, just do it, just do it. She was like pressuring us to do it.  And I go and go, no. He was like, why? Why haven't you done it yet? Why? Oh my God. And then something goes wrong.  That was under a peer pressure. Don't do that because it makes it even worse. Wait, bro, you're crazy. That literally feels like it was yesterday. It does. That was three years ago. You don't want three years. It's like what your mom and dad always say, like your life's gonna just flash by. Like high school's already done. Four years of high school, we're out. Like we're done with high school. We've already been dating for three years, like that. Also, we are gonna be going to Florida in June. Oh, yes. Coming down below the couple you guys think that we are meeting up with. Hi everyone. Just like Mariah said, we are gonna be going to vacation down in Florida for about a week and we are gonna be meeting up with another YouTube couple. So, who do you think that YouTube couple is? It's nobody that we featured on our channel yet. No, they have not been in any of our videos. New to the Marvel Squad.  We're gonna finish our food in where we first dated. It's crazy how far we came and how much we grew with you guys. And that's the main thing that I wanted to get across is we would not be able to do it without you and we're able to bring you along anywhere we go on our anniversaries, our wedding, our kids, anything. You all are gonna be able to experience it with us firsthand. Stay tuned for the rest of the video. We have a lot of things we wanna talk about. That's the best part of the video. This is gonna be the best part of the video. It's about how we first met. Things that we have gone through together as a couple. Things that we've broken up. Yeah, and there's just everything to kind of give you guys also relationship advice and just talking about how we met and all the time. You guys want us to do an updated video. I know we've done this on our channel once but we're gonna explain more in detail because we've already come so far. And you can see that not every relationship is what it seems like. No. The relationship is picture perfect. Frickin' White House picket fence, you know. We've had some roller coaster speed bumps along the way that a lot of you don't even know about. So stay tuned, don't go anywhere.  This is gonna be lit. So we're gonna finish up here and make our way back home and we'll see you then. Woo! Bye! So we are currently back home. It seems like forever since we talked to you because we actually- We just did a T25 workout. We did an ab workout today. Oh my gosh, it didn't have any burning. So we're back and we have something so sentimental. I found this in my room and this is perfect for this video. This is basically the whole video.  So before we even show you guys the book- It gives you butterflies every time we talk about this. I know. So basically what happened was I worked at a grocery store called Burqat. We're actually starting to lose hours and I was like, I can't do this. I need more money. I need more hours. So I decided to apply at Mariano's. So my sister got a job a week early before me and said you should apply at Mariano's. They're hiring. So I applied. I actually went into Mariano's and I told them that I applied because my sister told me to come in. The manager actually told me that she'll give me a call back which you know if someone says that that means you did not get the job.  Honestly, they might, but in our case, I knew that they wouldn't have.  But if it wasn't for my sister, I would have never gotten a job. So where she's going with this though is she got the job at Mariano's. I already worked there for five months before the twins came along, her and her sister. Actually, I was low key flirting with her sister at first. They were low key feeling. I'm like, no, he's mine. I called dibs. We started talking first, that's why. I know, I was starting to fight with my sister. I'm like, no, because he bought her cookies and I had to pay him back the next day. So he actually came to my register and I gave him $5 and I'm like, oh my God, he's the cutest kid ever. I was actually low key nervous when I was going up to collect that money because you were like, you know, obviously very pretty and stuff and I didn't want to like make a fool of myself. But ever since then, we just started like looking at each other while working and flirting it off. I'm not even kidding. I fell in love with him the second I saw him. I would listen to music in the car and I would get butterflies thinking about you. Like, yes, I don't know what it was but I had this insane attraction to you that I just wanted more. I'm so glad that now I have you three years later. So basically we met at a grocery store. I was a cashier, he was a bagger. So whenever I would cashier, Bill would do this thing where he would make like these really funny noises and it would be the funniest thing ever. She was our Don laughing while she was like trying to do the customers. She'd be checking people out and I'd be like, and she'd be like cracking up. That was like her way of flirting. Yeah, that was our flirting stage. We had a blast together. It was the most fun. When we were at Starbucks earlier, we were talking about how we were inside having our first kiss. That was our first kiss. Like this is all this flirting Marianna stuff before we even went to Starbucks. You know, the Starbucks is our first official date and that night was our first kiss. Everything leading up to this point in the video, this is the highlight right here. We actually have pictures of our first YouTube photo pictures and our first ever picture we took after we kissed. That night that we were talking about you at Starbucks. So this is from 2017 through 2018. I think we started YouTube 2018. Yeah, this is a book that Mariah made me for our one year anniversary. This picture was our first YouTube picture. This is when we first started getting into social media and like getting used to like taking photos. So before we show you this picture, the first date night that we had that we took you guys at Starbucks in the beginning of the video, this was the same night we had our first kiss. Three years ago. And these are our first pictures. You guys ready to see this? Are you ready? Pictures after I think we had our first kiss. Yeah, this is right after. So these are the pictures on her couch. We were kind of just chilling there. That is right after we had our first kiss. This says, these were the first photos we've ever taken together. Something I'll always remember in chairs because we were both super shy but had the best time together. That's so cute. Look at me kiss. So these are some of our pictures that we took. And we're gonna show you one more picture out of this book because this means the world. This is when we actually started our YouTube channel before we had TikTok, before we even were anything on Instagram. This is the first of our social media career, these pictures. So Bill's sister Brittany actually came and took these pictures for us. And we wrote it down. That's how we know this is our first pictures for our YouTube channel. It says, I love this memory because we started our YouTube channel and we have come so far with it. We love being behind the camera and filming all of our memories that we will one day cherish in our future.  Wait, that's actually so cute. It makes me wanna cry. Here's some more pics that we took. Like, oh my God. So basically this book is the start of our relationship and the start of our YouTube career. That's why we wanted to bring it out because this is literally our foundation right here. Moral of the story, we just wanna say thank you so much for everyone that has came this far. We are about to hit half a million subscribers. We're at 450K and it's just crazy to think how far we've came in these two years of social media and how far we're going to grow and I'm so glad we can do it with all of you supporting us, watching us and just being amazing every day. And what's insane to us is we said when we were full time we're gonna see a really big change in our channel and honestly. We've only been full time for a month. A month and a half. And we've already grown almost 300,000 in this last month. It just shows what you can do once you put your full mind and attention into something. We are so happy. Like, I don't look at it as a number. I don't look at it as like we have 500,000 people. No, we have 500,000 amazing Marvel Squad members. Like we are just so excited for every single one of you. I never in a million years would have thought starting at a grocery store we would end up here and everyone who hated on us, people that tried to discourage us in the beginning. I'm so glad we didn't listen. We've gotten so much hate. So much bullying, unnecessary people, being jealous, just haters. You know what I mean? From people, from our work, from friends. But we know what was great about me and Bill is we never listened and we kept going. We took that hate and we put it into motivation. So we just want to give a huge thank you to you guys for supporting us and coming along our journey. I really hope you guys enjoyed our little story time and how we met and coming with us to our first date. I feel like it's so cool. We told you how we first met and we told you and showed you our first date. So now you can just get a better understanding of our relationship and where we are as people. And I also want to mention one more thing. Since the start, we've always had a slogan. Oh, yes. It was slowly but surely. And we've been saying that from before we even had one follower. I think it's actually on your computer. He has a little sticky note that you put while he was editing. It says slowly but surely. That was our day one. It's still in our Instagram bios too. You've had that in here since we were under a thousand followers on Instagram. Like we literally grew slowly in the beginning and we are so thankful for how it all went about because it made us even more thankful for what we had instead of just blowing up right away. We literally said slowly but surely we're gonna get there. Slowly but surely, keep working hard. And I'm really glad that, you know, we had to work hard to get to where we are because I feel like if we got it handed to us, we wouldn't be as appreciative of everything that we've done. And I am just so glad we went through all of that mass to get here. It makes you appreciate it more. If you just blow up in one day, you don't appreciate your followers as much as you would if you just slowly grew that and put in the work. And that's where we are at. That's why we love showing love to you guys. That's why we always love reading your comments and liking through all them.  It is really hard to get back to everybody and I don't want you guys think we're ignoring you. It is just really hard and we try our hardest. That's like one of the things that me and Bill always want to keep the same as we grow is to try to get back to every single one of you. Obviously it's impossible, but we're gonna try to. But we make that a main thing in our day. We spend hours every day liking comments and responding to comments just solely to give back to you. You don't want to just throw out content. We want to have a community and talk with you. But yes, Marvel Squad. On that note. We hope you guys enjoyed today's video. Make sure to give this video a big thumbs up. Like you said at the beginning of the video. 25,000 likes. Let's get this video at 25,000 likes for our first date, our first time we met and everything. Also, our video is almost at 30,000 likes on our last video. So I might be shaving his eyebrow next video. What's it at? 26,800 likes. By the time this video posts tomorrow, it's gonna be at 30,000. That's crazy. No! She's gonna put a slit. All right, pick which eye. Which eye should she put a slit in? My right eye or my left eye? You guys get to pick in this video. Comment down below what eye. So before we end the video, we do have to give our end of the video post notification shout out. And this shout out goes to SI12MN. Shout out to you, SI. She commented, who else loved it? They actually spend time liking basically all the comments. That's funny. We just talked about that. I know. Literally, we try so hard to like all of your comments. So do not feel left out if we don't. We literally get thousands of comments. So we try to like through as many as we can. But if you don't get your comment like, don't worry, try the next video. We will eventually get around to everyone. Yes. So before we leave, one last thing. We do a question at the end of every video for those who are supportive to watch our videos to the end. Well, last video we did two truths and one lie for me. So today we're gonna switch it up and do the same thing for Mariah.  Are you ready? So the first answer is I've played hockey before. The second one is I have a twin. And the third one is I've gone into a car crash. So comment down below which one was a lie out of those three. And we will tell you in the next video whether you are right or not. So make sure to comment which one you think is a lie down below. Thank you so much for watching our videos all the way through. You guys are literally real Mariah Squad members. We love you and we will see you in the next video. But until then, peace. I love you. Oh, just kidding. I thought we were gonna kiss. Oh.


Casual sex and one mind stands. Some people find them exciting, irresistible. Others find casual sex discussing, opting, reprehensible. There are numerous myths and legends about casual sex. For example, the myth that men and women react differently to it. The truth is that quite a few studies have substantiated that men and women react to casual sex exactly the same. In the end of two casual sex, during the act and in its other month. Exactly the same. My name is Sambani and the author of Malignus of Love, Narcissism Revisited.  But only in certain kinds of people, not in everyone. People who were drunk or who were drugged during the encounter. People who acted under view pressure and didn't feel that they had any autonomy. People with conservative or traditional or religious upbringing and the moral code that prohibits and proscribes casual sex. People in societies with such more age where sex is a sacred union in male and female. People who via casual sex had violated promises, boundaries, rules and vows that they have made to themselves. Violated their personal integrity or promises, boundaries, rules and vows they have made to others. People who get attached to sex partners or develop long term expectations of a relationship following a single sexual. And also people above the age of 40. These profiles of participants in casual sex are likely to experience shame and personal guilt, depression, allure, self-esteem, anxiety, regret, remorse and memory gaps following the wrong. All other types of people react with excitement, satisfaction and even pride to their reaffirmed desirability and to the modicum of palliative affection, covert attention, acceptance, fleeting intimacy and closeness that is ineluctably involuntary casual sex.    Most true casual sex, and one night stands and so on, most of it is nearly anonymous, you don't know much about the partner. All animals practice sex without intimacy or notions, with very few exceptions. The human animal is also not exception. So why the righteous brouhaha about casual sex? Well, first of all, there is speciesism. The belief that humans are superior to animals and should never get in to their animal nature, but rather seek to transcend. Speciesism is a form of grandiosity, fostered originally by religious teachings, the book of Genesis. And then there's conflating and confusing, lust and love, emotional intimacy with mere physical intimacy.  The partner becomes an animated dildo, a sophisticated and unpredictable sex doll, replete with smells, tastes, but that's it. Nothing more than that. Very little intimacy is involved in this act, except the physical of the physical kind. But we have physical intimacy in numerous other settings. In a hospital, in a crowded bus, at dinner, physical intimacy is not limited to one night's tent.   They are addicted to falling in love.  And this complicates methods and leads to heartbreak that is best avoided altogether. I am bothered by casual sex, but I'm bothered by it only recently. I've had my share of casual sex.  I think it's very bad and sick that hookups have become the standard practice, that there is a hookup culture among those born after 1995. Why am I bothered by it? Because it may affect the ability of these people to form meaningful intimate relationships further down the road when they grow up. The jury is still out of this. There are no studies to substantiate this connection. But I strongly and intuitively say that if you spend your entire teens and twenties banging people about whom you know nothing or close to nothing, casual settings of one night's tents, not seeing them afterwards, not concerned with their fate, their history or their future, I strongly suspect it will be difficult for you to form meaningful intimate relationships with other people when the time comes and when you really want it. I also think that casual sex definitely disposes the matters of these generations. To regard sex as nothing more significant than other bodily functions that is substantiated by research. It renders them way more prone to cheating, adultery, deceiving your power. Indeed, cheating is up dramatically among both genders in these equals.  So emotionless casual sex is not the problem. The problem is its preponderance. The problem is that we are beginning to know only this kind of sex. We are beginning to practice only this kind of sex. It's not the act itself. It's what the act says about us.


Okay, welcome to the Monday, February the 7th, 2022 meeting of the Montpelier Design Review Committee. I will let members and staff introduce themselves. Meredith Crandall staff. Martha Smersky, member. Liz Pritchett, member. Eric Gilbertson, vice chair. And Steve Everett, member. And I will let Meredith review the remote meeting procedures. I can even say it tonight. I will try and keep this short. Right now, the only person other than DRC members that we have on is our applicant, our loan applicant for tonight. But we may have some people watching via Orca. You never know. Alrighty. So for anybody watching via Orca tonight, you can participate in tonight's design review committee meeting via the Zoom platform. You can either use this link here, click on it, and it should open up the Zoom platform, and you'll be able to see anything that we share on our screens as well as participate in the meeting. Or you can call in on this phone number, use this meeting ID, and you'll be able to hear and speak. And then if you actually turned your volume off on Orca, you'd still be able to see everything that might be a little bit of a time lag. If anyone is having problems accessing the meeting, please email me using this email, and I will do my best to get you into the meeting. So this is mostly going to be for Lance, just so you know. Turning on your video is optional. A reminder to everyone who's on to please keep your microphone on mute and you're not speaking to reduce background noise. And Lance, if you do have any technical difficulties, feel free to use the Zoom chat function with me. We try and use the chat just for those kinds of issues and keep anything substantive to the actual speaking part of Zoom. That way everybody via Orca can hear what's going on. Okay, just so that everybody knows, if for some reason I get emails and members of the public are having a hard time accessing the meeting and we can't get them in, then we'll have to continue the meeting to a time and place certain. So far that has not happened. So fingers crossed, knock on wood. All right, I'll hand the meeting back over to Steve. Next item on the agenda is the approval of the agenda. And we hear a motion to approve. So moved, says Eric. I second it, says Martha. All in favor of the agenda, speak your names. Eric. Lance. Ben. And Steve. So the agenda is approved. The next item is annual election of committee chair. Do I hear any nominations from the members? I nominate Stephen Everett. And I second it. That was too quick for comfort. And actually, there is an error. It should be nomination election of the committee chair and vice chair. Do I hear a nomination for vice chair? I nominate Eric for vice chair. So unless there are any objections, do I hear a voice vote by speaking your name for the two appointees? Do you want to do them together, Steve or separate? We can do them separate. How about the first nomination for Steve Everett? I say yes. This is Martha. Eric says yes. Liz says yes. Ben says yes. And I guess I can't say anything. You can decline or recuse. I've been outvoted anyway. So I accept. And how about approval for the vice chair? I say yes. This is Martha. Say yes, Liz. I also say yes, Ben. And I say yes. So Eric, you have been voted as vice chair. Thank you very much. And thank you all for continuing to serve on the committee as well. And we can now move to the first application for this evening for 707 Stonecutters Way, owner applicant FHS Holdings. Is there someone there from FHS to explain your application? First of all, it's nice to see some familiar faces. Hello, Mr. Everett. Hello, Mr. Cheney. Hi, Lance. Hi, Lance. Yeah, it's going to be nice knowing that two people here are going to kind of get a gist of what's going on in the air because you're frequent fliers. First of all, on behalf of Joe Miles and RK Miles, I want to thank you for making the time in your schedules for this proposal. And Merida, thank you very much for making this process pretty easy and enjoyable so far. You're welcome. Go ahead. I just said you're welcome. Can you give just a brief overview of your application? I can pull it up. Basically, we're just proposing some accessory structures placed throughout the air to simply organize and make our material handlers much more efficient in turn. Lance, I'm having a lot of trouble hearing you. Is anybody else? Yeah, it's kind of echoey. Can you sit closer to your computer? I think there's some background noise to some paper shuffling and so on. Is everybody muted? That might have been Steve, his microphone was right next to his papers. I moved his microphone away. Is it better? Yes. Okay, good. We're basically just proposing some accessory structures placed throughout the air to simply help organize and make our material handlers job much more efficient. In turn, giving us room and options to use space that was taken by the manually organized material that is currently being used under the building roof currently. So where I'm moving the hand here on the screen is where there's some rack systems. You can see there's kind of little squares. That's where there's going to be some new rack systems put up. I did a site visit with Lance. Most of these locations are places where in the summertime they already have materials outside. There are pictures in the packet that Lance provided and that you all have that show the rack systems installed in other locations. I don't know if those are other RK miles locations or if that was material supplied by the manufacturer. I think it was both, to be honest. Okay. Lance, if I understand this correctly, you'll be able to see these structures only from your parking area. Is that correct? Correct. I guess that, you know, coming in through the entrance of the gate, obviously you're going to see across the yard, but yes, inside the yard only. Yeah. I'm having just give me a second. I've lost you guys for a second. I may have been scrolling too fast. Are you showing something right now, Merida? I am. Are people seeing it? Yes. So, I'm showing a picture of the rack system. Yeah. Photograph. One is a crystal clear audio, even if the lingo isn't. Zoom, phone. Oh, there we go. Thank you very much. Yeah. Well, I just did it. I stopped the share screen and it was causing problems for you, Lance. Is the canopy part of the rack system? It is. Yeah. Basically, it's a steel roof truss with some screw down metal on top of this rack. It's not bolted to the building. It's off the building and bolted into some concrete pads. Thank you. What I apologize about, Merida, is when, obviously, when you share your screen, I lose you, but I don't know at all to get you familiarized with it. There's a building one, building two, and building three. And if it helps you or anybody on the board to let you know where L should one, L should two, and so on is, I can help you out with that. Basically, building one and two are going to have you know, racks that the overhead, the overhang of the existing building is 25 feet tall. The base to the bottom of the roof of those two buildings is going to be 18 foot 11 with five foot two from front to back, you know, from the base of the rack to the big, to the back of the column. The only, all of them are basically going to have the same height and imprint except for building three, which are much shorter. They're going to be on the same concrete pad. Those, the existing building overhang is 12 foot tall. And from the base to the top of that roof is going to be eight foot seven. Yes. And these are going to be sitting on a concrete base. Is that correct? Correct. The space where these proposed racks would be going has, you know, Ben and Steve might know is where we've stacked. Hitch is a lumber in the past, you know, for overstock and things like that. So basically this is just going to be using that print of where we put that lumber in a much more organized and safe structure. I see this as a continued industrial use of an industrial site and have no problem with it at all. Just a quick question, Lance. This is Steve. On building number two, is that center bay, which is existing, will that be closed off? It will. We're in hopes of eventually, like I said, this is going to organize what we've manually put inside, but Steve may be in future driving door, well, near L two, but drive, you know, door one, two, three, we might try to have a drive through from one to three. Yes. Just be able to bring in more materials for the customer. Okay, no, it was just a question. Does anyone else have anything else to add? Any comments, questions or suggestions? Nope. If not, I can go through the criteria. I'm not sure if Lance has a copy of that, but I will read for all projects, exterior design in materials of new construction or alterations of existing buildings shall be consistent and compatible with the characteristics of the existing building or other properties in the district. That's acceptable. Existing building shall be recognized as a physical record of their time, place, and use. That's acceptable. Architectural features, including but not limited to two, cornices, windows, shutters, fan lights and tablet or trim and other forms of molding or character defining, detailing, prevailing on the existing building shall be considered in the alteration. That's acceptable. It's a little iffy of whether or not we could call this an alteration, but I know there are times when accessory structures are put up, you're supposed to be looking at whether or not it's hiding features on other buildings. Here it doesn't really matter, but I didn't want to just say that one was not applicable for everybody, which is what I did for most of the criteria for this particular application. So that's in fact all the criteria that apply in this particular application. So based on those being acceptable, do I hear a voice vote? Speak your names if you approve of the application. Ben? Eric does. This is Martha. I say yes. Okay. And I say yes as well. So five in favor. So the application is approved and I will let Meredith explain the next step. So Lance, I need to finish up the administrative site plan report for this and then we'll be able to get the permit out the door. Do you want us to mail it or do you want us to email you when it's ready and you or somebody else can come by and pick it up? We've been having some issues with mail getting delivered lately. Yeah. Email's fine, Meredith. Thank you. Okay. Great. Okay. Thank you very much, Lance, for coming to for the meeting and good luck with your project. Again, thanks for the time, board members, and continue on with your meeting and have fun. Have a great evening. Thanks, Lance. The next item on the agenda is to review and approve the meeting minutes from January the 18th. Does anybody have any questions, comments, or suggestions regarding the minutes? This is Martha. I moved to accept the meeting minutes the way they are. Eric, second. All in favor, speak your names. Is this everybody all at once? And Steve. So I think that's everyone. Does anyone have anything else to add to our meeting this evening? Not for me. If not, do I hear a move to end the meeting? I'll move that, says Eric. And I'll second it. This is Martha. Okay. All in favor, speak your names. Martha. Liz. Eric. Ben. And Steve. So the meeting is adjourned. Thank you all very much. Thank you. We do have items on the agenda for the next meeting, which is Tuesday, the 22nd. Oh, that didn't get put on here when the next meeting was going to be. That's two of us missed that in the planning department. So yeah, the next meeting is Tuesday, the 22nd, because the 21st is a holiday and City Hall will be closed. And we do have a couple of applications. Hopefully for Langdon Street, we'll be back. And another one. I'm going to just say thank you to Steve and to Eric for continuing to serve. Thank you very much.


Asked about Trump's disqualification ruling in Colorado, U.S. President Joe Biden said on December 20 there was no question Trump supported an insurrection, Donald Trump was disqualified from Colorado's presidential primary ballot by the state's Supreme Court on Tuesday, an extraordinary ruling that could be struck down ahead of the November 2024 election.A slim majority of the Colorado Supreme Court ruled that Trump is disqualified from appearing on the state's ballot under Section 3 of the Fourteenth Amendment of the U.S. Constitution, which bars anyone engaged in insurrection or rebellion from holding federal office, speaking to reporters ahead of an event in Milwaukee, Biden said he leaves it up to the court to decide whether the Fourteenth Amendment applies in this case, the Colorado Supreme Court paused its own ruling pending review by the U.S. Supreme Court, which Trump said he will immediately seek. No question about none, zero. And he seems to be doubling down on about everything. Anyway, I've got to go do this.


All right, so my name is Seko Brozek, I work for Red Hat. I mostly work on the SSD. There's my Twitter account. If there's no time for questions, you can just tweet me or meet me somewhere here in the hallways. I also put the little scripts I will be showing in the demos on my GitHub. And there's also a copy of the presentation in PDF, so we can grab it read later. This talk is about SSD, but it's not about the things that most people use when they use SSD, which is normally login as a user from Active Directory, LDAP, whatever. But it's about the parts that are not as well known. They are very often in development, not so stable. There is few topics. I will be going quite fast, not into many details. So if you are interested in any details that I'm not going to cover, feel free to catch me later. In particular, I will be talking about the APIs that SSD has. How can you talk to SSD from a program? It might be a good idea to let SSD handle local users from its e-password and group. Why and how SSD handles smart card logins? Because as we heard, pump-pk-cs-level-1 is dead. And the last topic is how can SSD manage Kerberos I'm not sure even if I'm going to go to the last topic because we'll see how we are with time. Right, first topic is SSD APIs. How can you talk to SSD from your program? The first thing is why you might even want to do something like this. And the primary use case is that there are applications, quite a few of them actually, that implement some sort of an LDAP driver or LDAP connector. Typically, this is because the application wants to let people log in with their LDAP credentials or whatnot and use data about these users. For example, the application might want to know which groups is the user member of to make some policy decisions, or the application might want to, for example, know the email address of the user to display it in the UI. This sounds easy, and it's easy to do it in some sort of trivial way. You just bind to LDAP, read the data, display it. But doing it correctly, there are a lot of details that you might not even know about the problems in the first place, much less to solve them. And some of the problems are stuff like which server should I talk to? We already heard about activator sites. If one LDAP server goes down, what does the application do? It should, in the ideal case, connect to a different server. What if the LDAP server is, what if the network is completely down? In that case, you might want to keep serving some data from your cache. In general, SSSD is a kind of expert in how to talk to LDAP. And it might be a good idea instead of doing your own thing in your application, just let SSD do its thing and provide you with an API that your application uses. Of course, it's already possible to talk to SSSD somehow. If you just have SSD to log in as an LDAP user, you can already run get-and-pass-for-d your username. It will display the user. This is already talking to SSSD, right? But it's not a kind of publicly available API. In the case that I said in the get-and-pass-for-d user, you talk to an interface that is called NSS, Name Service Switch, which inside calls the libc function getPWname, which then talks to SSSD through a function that SSSD provides, the NSS SSS getPWname. This is not trivial to call directly from the application. It's somehow possible you can DL open the library and DL send the functions and then call them. But that's really awkward. And it's not really flexible. So if you call this interface the getPWname, you only get a fixed set of attributes. You only get the username, home, there, shell, and so on. But I had the example with the email address. It's not there. So the way you can talk to SSSD directly already in the versions that are released is currently through a D-Bus-based API. We chose D-Bus for several years because of some advantages we saw that primarily there are many language bindings for D-Bus. I'm going to show some little demo that will use Python. D-Bus is type safe. D-Bus has types. So if you request a number, for example, the UID number, you get back a number. You don't get back a string that probably contains numbers, but maybe not. D-Bus has some advanced features that might be useful like you can get notifications, which are called signals in D-Bus lingo. This can be useful if you have a UI. And you don't want to continuously pull SSSD for if anything changed. You just get a signal when the thing changed. You can redraw your UI. As we found out through bug reports and through feedback, not everybody likes D-Bus. There are disadvantages. The primary one we saw was that it requires a system bus, the message bus running, the broker. That's, for example, not available in containers. Some language bindings were not really great, and we only found out that people started trying to use the D-Bus API. I think the Java bindings were even unmaintained at the time where one project started to use them. But nonetheless, this is used by several projects already. Many of them are head-based because we talk to the people directly, like Manage IQ, Keycloak, which I think they had a presentation earlier today, the Apache module, model-cap identity. Because of the problems we encountered with D-Bus API, we thought maybe it might be appealing to offer some other kind of API, but we never did it. We thought about REST because that's what many people are used to. It's easy to use. And we even talked about offering the LDAP protocol over LDAP. But this is really just discussions. This talk is about, especially, doing more than LDAP client, but I'm not sure if we want to do LDAP server. A little demo time. So I will be showing two scripts. One is written in raw Python LDAP, which is maintaining. And the other is doing exactly the same thing except it's talking to the D-Bus API of SSD. So let's see here. Here. So I'm going to run the first script, which is using the raw Python bindings. And what the script does is that it finds the user who I put on the command line as an argument, and it would print their email and their group membership. That's right. So boom. We know that the FOSDEM 2018 user has the email of FOSDEM 2018 and FOSDEM, and he's a member of three groups. So I'm going to really quickly show the script. It's not ideal on this small screen, but you can see that even in the script I have the user who I authenticate as, and I have the password of the user in the script, which is really not ideal. And there is a lot of parsing and low level LDAP stuff that probably as an application developer you don't want to know. So the script is about 70 lines long. So now I'm going to run the script that does the same thing, except it's using the SSD API. It returns the same data, except I think the groups are in a different order, which is kind of expected with LDAP. So if you look at the D-Bus example, it's about half the size. And more importantly, I think the language is kind of more natural. So requesting the email attribute is calling a method that is called getUserAttribute. Requesting the groups is calling a method that is called getUserGroups. You really don't get down to the raw LDAP level. Right, that's all about the first part about the D-Bus APIs, details. If you want more details, catch me later. The next section is about managing local users and how the SSD relates to users and groups in the HD files. Again, why do you might want to do this at all? One of the reasons is faster access to the users that are stored in the files on the disk. Traditionally, you could use NSCD, which is a name service caching demon that comes from Lipsy. But what we found out through the way of bug reports from users is that people who used NSCD, because they wanted to have faster access to users on the disk, but they also used SSD because of some remote users in LDAP, they were complaining about these two caching mechanisms not really playing well together.  I showed the APIs previously. Another reason why we might want to use SSD for local users is that the API that I showed might actually be used also for local users. SSD is serving them in the first place. And then we could have a nice API for user, not management, but reading user information on Linux for all kinds of users, be it remote or local. SSD uses a database to store the user data. Database comes from somebody. It's called LDB. And in the database, it's possible to store additional attributes. So we were thinking about storing stuff like maybe the keyboard layout or your preferred language in the database. And then this information could be through the D-Bus API offered to whoever is interested in them, desktop environment, for example. And the last reason is smart cards for local users. SSD, in order to authenticate some users, it must first know about them. Therefore, SSD must be serving the local users. I'll have a separate section on the smart cards later with the demo. So this is already underway in Fedora. If you're running Fedora, since the Fedora 26 version, SSD is running by default on all installations. And it is mirroring the contents of its e-password and its e-group. We have an iNotify watch that updates the database and drops all caches if anything changes. The way the caching works is that if there is a request coming from application like LSL wants to convert the number to name, the request goes first to SSD. The first request goes to the demon, which is a little slow. But then the demon, as part of the reply, puts the reply into memory mapped cache. So any subsequent request would not even hit the demon. It would just be in the NSS module, which is loaded into the memory space of whoever is calling it. As I said, the reason we're doing this is that this way caching for local users interrupts easily with SSD that might also be running on the same machine and serving users to mold up. Disadvantage, SSD is bigger, fatter, more complex than an SSD. If you just care about local users and nothing else, you might just be happy with an SSD. There's nothing wrong about it. And the other disadvantage is that this actually, in order for this to work, we had to revert the order of the NSSWITCH Conf modules. So traditionally, files was always first in the NSSWITCH Conf database. In Fedora, since 26, we reversed it, so SSD comes first. This does not require SSD to be running at all. It doesn't require a SSD to be installed. If the SSS module finds out that the daemon is not running, it would just gracefully fall back. So if SSD is not running and you want to access root, it would work. So this is very much work in progress. The next thing we want to do is improve the smart card integration. You'll see later why it is currently very user unfriendly. We want to make it possible to extend the local database with more attributes like the keyboard layout or whatnot that I talked about. Currently, it is somewhat possible we have a command line tool that is called SSOverride. But currently, it only allows you to add public certificate for the smart card authentication. But right now, there's no general API or command line tool. There are some people who wanted us to extend the D-Bus API to allow write modifications. This, I think, came from cockpit. So if you had some kind of create user method on the D-Bus API, it would call to lip user and create the user locally. And as I said, we would like to have a unified API for providing information about local and remote users. So what we're thinking about is to merge with this project from Freedestops account service and implement or offer the same API from SSD. Hopefully, this would happen this year. But this kind of project that we've been working on for a long time, we never have the time. That was local users. The next section is smart cards with SSD, primarily for local users. So I'm not a smart card expert by any stretch. The previous Jacob who had a talk right before me is just a link to his talk. He also gave a similar talk on a different conference last week or two weeks ago. The second link is to recording of his talk if you haven't seen it again. I even didn't write this part of SSD. I really literally learned it as I was preparing this talk. But I can illustrate how it works. So traditionally, if you wanted to use smart cards, and login as a local user with smart card, you would use PAM-PK-CLS-11. It has a lot of features. It was super stable, but there's also no development. I think the primary developer abandoned the project and nobody else stepped up. It even doesn't build again recent OpenSL versions. And for that reason, it was dropped for Fedora. So currently, in Fedora, there's no way to authenticate it, I think, as a local user with a smart card. Kind of in parallel to that, SSD was gaining support for smart card users, which wasn't at first meant for local users. It was meant for remote users. The primary use case was free IPA and trust with Active Directory. The way it works on a very, very high level is that the certificate is stored in the directory. If a smart card is inserted, then the SSD runs a search against and tries to find, based on the certificate, tries to match the user. And then either does a PK in it, so Kerberos authentication with a key, or does kind of a local authentication and just on that machine. It's functional for local users. I'm going to show you. I would not call it usable by anyway, because it requires a bit of manual configuration. So first, SSD must be serving the local users, which is already default in Fedora, but I think not elsewhere. The smart card doesn't have to be a real smart card. It can be anything that influence the PK-CLS7 interface. I'm going to use a UbiKey for my demo. You need to load the certificate into the user database with the SSS override tool. I'm not going to show this, because I don't have the time. And most importantly, the authentication, even though it's a local user, must be handled by PUMSS, not PUMUNIX. We haven't really thought through how to change the PUM stack in Fedora to make this possible in kind of generic way. But I'll show a demo. This is something we will be working for Fedora 29 to make it more user-friendly. And everything should work by default, but we are not there yet. Right, demo time. So this is a VM. I wrote a simple program that just runs a PUM conversation and authenticates a user. So first, I'm going to authenticate a user called test. So hopefully, I can write the password down. So the user was authenticated. If we look at the journal, the first line here is from audit. And it says that PUM authentication was successful. And the grantor, the module that allowed the authentication, was PUMUNIX. So this is what you do normally, authentication against its C-shadow. So now I'm going to run second authentication. And as you can see, this time, I was prompted for not for password, but for PIN. And I don't remember the PIN. I have it here in the... This is not secure. Don't do this, except if you are demoing something on FOSDN. Good that you mentioned that. 47231. And I was authenticated. So PUM authenticate return success. And I'm going to show the journal again. And there is user auth. So user was authenticated. And it was authenticated by PUMSS. And the user I was using was called local smart card test. And if we look into at C-shadow, you can see that there's something missing, right? There is no hashed password for this user. So I couldn't have authenticated against at C-shadow with a password, even if I wanted to. If we look at the first user I was using, right? There's a password. OK, how much time do I have? A few more? I haven't been here in my 12 minutes. Good. So I'm going to run the last section, which is why it might make sense to let SSD handle our Kerberos tickets. So I will not go into details on Kerberos. But for the purpose of this, let's just say that if you authenticate against the Kerberos KDC, you get back a ticket. It's a blob of data. And this blob of data must be stored somewhere. That somewhere is called conventional cache in Kerberos speak. There's several options. The easiest one is that you can just write that blob into a file. You can write it into directory that can subsequently contain multiple traditional caches for multiple Kerberos principles. You can put it into Kerberos keyring, which is the default on Fedora and in rel. Or you can use KCM. This is what this part of talk is about. I should mention that KCM is not my idea. It's not our team's idea. It comes from the handle Kerberos distribution. I looked at the Git logs as I was preparing the talk. And the first commits for the KCM part of Orhandal are more than 10 years old. The idea behind the KCM credential cache is that it's not, unlike the files, which you just put a blob right into the file, right? That's it. Here, the credentials are handled by a demon. And the advantage of this is that the demon, because it's kind of active component, it can then do things with the credential cache that, I'll get to the deal later, but there's more functionality you get out of this. If you will read some documentation about KCM, the terminology is that the KCM demon that is managing the credentials is called a KCM server. The tools that are the whoever is talking to the KCM demon, typically it's some command line tools like KNIT or an application that uses Lipker 5 is referred to as a client. Even though there is a server and client, there's no network communication. It's all local communication over a unique socket. At the moment, Heimdall implements the KCM server. MIT doesn't. MIT only implements the client part. So MIT implements the support for this KCM protocol over the unique socket for the tools, but not the server. You can mix and match them. And that's how I was testing our KCM implementation. I was using a KCM server from Heimdall against KNIT from MIT, and it worked. I'm not sure if it worked in some production environment, but it worked for me. So why would you want to do this? As I said, the KCM demon is stateful, so it can do things like renew the Kerberos credentials. Kerberos, the credentials you get back in the C-Cache have a limited time, but sometimes the time is not enough. For example, if you're running some batch job on some cluster, that job might take longer than the lifetime of the credentials. What a demon like KCM can do is renew the credentials for some time. Again, notifications. That's one of the things we want to do. If the credentials are acquired, about to expire, have been renewed, you can send a notification. We would like to use the D-Bus API that I was talking about earlier. And I think GNOME was already interested in using these notifications for this environment. You can also do things like if the user who was using these credentials logs out, you can get a notification from LoginD and wipe the credentials out. The credentials are also not written to the disk, which might be beneficial for sharing the credentials between two processes, because if they are on disk, they need to be in a predictable location, and this might not be super secure. What we also wanted to do is this way make Kerberos usable for containerized environments. The way we thought this would work out is that because the KCM server has a unique socket, then you can run a KCM server in a container. And then if you have other containers that are maybe running some applications, those containers can bind mount the unique socket of the KCM server. And this way you can share the credentials only between selected containers, unlike, for example, the kernel keyring, which is shared between everyone. What we found out is that nobody is really interested in using Kerberos with containers for various reasons. I think mostly. Really? Awesome. We can't talk out. OK. So one person only is interested in using Kerberos with containers. Cool. So the implementation of the KCM server in SSD is called SSD-KCM. It reuses a lot of SSD code, which is one of the reasons it lives in the SSD code base. But it doesn't need the rest of SSD. You don't need to have SSD serve any users, even local or remote. You can just system control enable the KCM socket, and then it works. We're also planning to use some private APIs of SSD. Again, another reason why this is a project inside the SSD umbrella for features like notifications and so on. KCM is the default Kerberos Cache since Fedora 27. There are bugs, though. Some are still open. I didn't really have that much time to look into them. But I will in the next couple of weeks. The current version of what we have in Fedora is just equivalent to the other Cache types. We don't really have implemented the features like the renewals, notifications, and this. But we are going to, it's on my to-do list for Fedora 29. If you want to learn more about KCM, there is a design page on the SSD Wiki. And there is a link to the MIT Kerberos Wiki page which describes much more details about, for example, the protocol that libraries use. That's all. Thank you. Do you have any questions? I would like to ask about the caching of SSD. How often is generated that in case, for instance, the server goes down and the bros management, how long will it be valid? The cache? Yes. As long as SSD stays offline. So if SSD is offline, it never removes anything from the cache. It will just serve cache data. And if you log in with the cached credentials, in that case, you don't get a ticket. So it's just local authentication. And then, for example, if, repeat the question, how long is SSD cache valid? So one interesting case there might be that SSD is offline. At that time, the administrator removes, for example, removes some of your group memberships. The next authentication that would happen online would refresh the cache data. But as long as you can't reach the server, the cache just stays the same. How often is generated? It's configurable. And there are two answers to this one is that for just if you run something like get-in-pass-ready or ID from the command line, there is, I think, 45 minutes or 30 minutes, something like this. But if you log in, as Volcker already said before, log in is the only time where you can get precise group information. At that time, we never use the cache. We always process the reply from the server. I had a question that sort of relates to that. In terms of debugging SSD and knowing where a problem is and knowing when a cache has expired or when SSD probably has issues contacting the server, what are the typical ways of debugging SSD? Enable debug locks. It can look there. So what are the typical ways of debugging problems? In order to learn that SSD, for example, is offline because it cannot contact the remote server. It's just a random example, but it could be like any other problem. So we just talked about this with Fabiano over lunch, that our debugging is very suboptimal. And currently, you need to enable the debug level in all the SSD conf sections and just look there. We have on the SSD, we have a troubleshooting guide, which might help you. I'm not sure if you saw that. And what we did in the last two or three releases, we have a command light tool that is called SSS Control. And that tool has subcommands. One of that subcommands is, I think, domain status or domain info that would show you domain is offline. Another command there is something like user status or user show. I don't remember the commands precisely. And this will show you, for example, when was the last time that the user was refreshed from Alda. So these two maybe can be used. Do SSD support transitive trust relationship? No, only WinBank can do this. Because, repeat the question. Does SSD support transitive trust? No. Somewhere in the backlog, and maybe it is something that Andreas might work on someday, no? But if I understand it correctly, and maybe Falkirk can help me. But I think, so SSD, if it's. We need metal with my integration to SSSC. Yes, yes. We need these phone calls again. Yes. So if SSD joins to an active directory domain, it has credentials only from that domain, a key tab that represents the machine account. And time is up, I will just finish this one answer. And that key tab cannot be used to authenticate or to even to authenticate you against directory servers in another forest. I think WinBank does this by the private, the Windows RPC calls. We don't. We just ask all the mechanisms for authentication. Yes, but we do that over a network. Right. OK. And SSD only uses LAP and Kerberos. And that's not possible. Yeah. There were some phone calls we had maybe one, two years ago where we talked about splitting some parts of WinBind and making them reusable. But nobody did the work. We need to revise that. OK. Use it. Do you want to start with names? Sorry, guys. Time is up. Thank you very much for listening.