Welcome to Hard Questions, where we gather pastors together to take on your tough questions and answer them right from the Bible. I'm Tom Hollis, the moderator, and today our panelists include Dr. William R. Glaze, Bethany Baptist Church in Pittsburgh, Ray Hypole, Providence Presbyterian Church in Robinson Township, Pete Giacolini, South Hills Assembly Guy Church, Bethel Park, PA, Anthony Gilbert pastor of another level in the North Hills area. Well, we're going to have a great program today. We're going to take on hard questions from our hotline and most that deal with everything from church membership to giants. Okay, so let's start with this. I want to, one, also by the way, my thoughts about God destroyed all the giants in the flood, but later on, what about David and Goliath? He was a giant. May you answer that question? Jacob, I love it. I love that you called in. I just love it and, you know, get your application ready for seminary right now, because that's great. Dr. Glaze, about the giants, the Nephilim. Yeah. Jacob, that's a very insightful question and one that took a lot of thought. So I appreciate you asking us that. And you are absolutely right that during the flood, all the giants were destroyed. They were called Nephilim and when the flood took place, they were all destroyed. So how did they reappear again is a question, which again is a very good question. Now when we think about the people that went on the boat, it was Noah, his wife and Noah's three sons and their wives. And so if all the giants were destroyed, you know, during the flood, it would make sense that within the genes of one of Noah's sons, especially the son of Ham, because we see that Goliath actually came from the Canaanite race who was a descendant from Ham. And so within Ham was still the genes to reproduce the giants. So even after the flood, there was genes that the people that want to know what sons possess to be able to reproduce the giants. So thank you for that. Thank you for that question. Wow. That is great. Great question. Great answer. Any other thoughts on this? The same thing that there's the genetic information that we all have is Dr. Glaze said genes or DNA and that's why people look different today because different groups of people went different places and, you know, Asians don't look like Africans and Africans don't look like Europeans because there's different amounts of genes that bring out certain traits. And one of those traits is height. And even today, Jacob, I don't know if you know this, but in Guatemala, the average man is five foot three inches tall. And the average woman is four foot 10 and a half. In the Netherlands, the average man is six feet and a half inch. And the average woman is five foot seven. So it's even possible, it seems to me, today, if a bunch of tall people went on some island and had some kind of, you know, new nation that we might see giants again because that genetic information is there. I got some Scandinavian in me. I don't know. That's tall. Yeah. See that? We got, we got. Let me jump in real quick. Years ago, Elaine and I did some college class in Sweden up in the Lapland and said, oh my gosh, I felt like I was in a land. Every woman was about six foot tall and the men were six, six and bigger.  I just love it so much, Jacob. And actually, we've got another question from Jacob. So let's go to the second one. Why did God create the devil and Adam and Eve even know they knew the world was going to be like this? Thank you. Bye. Bye. Cool. That's a joke. Why don't you? Again, I love the questions. Yeah. So I believe what he's saying there is why did God create the devil Adam even know the world would turn out the way that it did.  So he gave us an opportunity to be redeemed even in the midst of all the stuff that's going on in the world. And also something else that we don't always take into consideration is, you know, when Satan fell, he was the worshipper in heaven and God needs worshippers. And you can never be a worshipper until you have options and choices. And so if God is saying, all right, here's all the good things in life. And this is presented by me. Here's all the stuff that Satan has to offer worship is boy, I'd really like to have some of that stuff over there. But God, I love you more. And you can never be a worshipper until you have something compete with priority with what's important in your heart. And so God put Satan in the middle, say, okay, Adam, I want you all to choose me. Eve, I want you to choose me. But Satan said, I want you to choose me. Now we have to make a decision. And that's how we become a worshippers. And I believe that when we leave this planet, if we have served God and made him our Lord and savior, we will be the replacement for the fallen angels and for the worshipping spirit that is now missing in heaven, that Lucifer was once a part of, that now has become Satan. So now we will be the ones that will take its place. That we have not bowed the need to Lucifer, Satan. Now we have not bowed the need to the things of the world and we have chosen God. And so that is the reason why God's allowed this to happen. And all of it is going to come together. He knows exactly what's going to happen, even in the midst of all the suffering and the torment and everything that's going on. He has a plan and he has sent his son to redeem us and that we can also be overcomers in this world as well. Yeah, that's real good. And God didn't really create the devil. He created Lucifer who, you know, was an archangel who fell, right? Yeah, I would just emphasize that too, Jacob, that God never made anything bad. God doesn't make anything evil. God makes only things that are good and beautiful and true. And it's Satan who made himself evil. And he became the father of lies and liars and murderers and Adam and Eve sinned and they fell and became evil. But we never want to say that God did that. God made them good and they should have chosen the good and they should have followed the good, but they desired and chose evil. And we still do that.  And so we just want to recognize God always calls us to do what is right and good. And whenever we see anything bad, that was from a creature. That wasn't from God. Yeah. Well, I agree with Volka say we have a choice.  And remember God says, he says, I would that you would do good. Choose curses or blessings. And then you see the heartbeat of God. God longs for us to always choose to do good. Yeah. That's his desire. It's so true. And I just want to ask Dr. Glaze, why don't you speak to Jacob for a little bit there again and just, I just congratulate him on his questions and on his heart to follow God. Right. Yeah. Yeah. Jacob, you are a fascinating young man. You know, a lot of young people, your age, they're not thinking about the scripture in such a way. And so it just is a blessing to hear you ask these questions because again, it shows that you are thinking at a level, which is where God wants us to wrestle with the scriptures. And even the questions that you ask, you'll go beyond the surface. They go to a deeper level. And so I just want to congratulate you on just being one. And I'm sure, let me say something about your parents, too, that you must have some good parents, you know, that have kept you grounded in the world also. So I take my hat off to your parents also. That's right. All of us up here, we take our hat off to you, parents and to Jacob. Well, coming up in 60 seconds, we ask, are there situations where people should not be admitted into church membership? We'll be right back. Welcome back to hard questions. We're taking your calls from the hard question hotline.  Let me give you that again.<PHONE_NUMBER>. We would love to answer your questions on the air. Let's go to the next one. In my church, we had a man and a woman that were living together, but were not allowed to join the church because it was considered adultery. Also, we have a person that plays in a secular man, secular music, but he is not allowed to play in our church. Would you please consult on these two problems and give us your solution to your answer? Thank you. Well, thank you so much for the question, Pete, consult away. First Corinthians, chapter five. All right, there is a morality situation here that, and I think the church needs to stop and please hear my heart before you say I'm a Sadducee or a Pharisee. We need to stop playing patty cake. Fornication for the believer is fornication for the nonbeliever. To say that because you're a believer, you can fornicate. The Bible does not teach that. Sin is sin. And in first Corinthians, chapter five, it says it's actually reported and he's speaking to the church.  And then if you read that, I want you to take a look at it for yourself. Paul says, I'm not even there. I've already made a judgment call. It's a biblical judgment call. Put him out of the church. And the reason why he says that, he goes on and he explains why. A little 11, 11 is the whole lump. I remember as a pastor many, many, many years ago. My kids, they knew the people that were sleeping around and they would even, I mean, as, as 10 year olds and 11 year olds and they would say, daddy, is that right? So how can I say, just because so-and-so comes to church and I don't want to rock the boat per se, how can I later on teach my children it's wrong to fornicate if I allow it to continue on in church? Come on, church. There's this, it's not my standard. It's God's standard. And I know I may sound a little, ooh, maybe my heart's snubbing, but again, this is what the word of God says. No more patty cake. We really, and it goes back to what we talked about before. Warning the wicked man. Being, I've gone to couples and say, hey, listen, you know what? You need to get married or move out one or the other. But you cannot be a member here. Now the second part of that about the musician, I have no problem with that. If that is their talent, if that is, is what they do for a living, if they're a country Western singer, there's nothing wrong with them continuing on in their profession and being able to minister in church. There's clearly two different things here. Ray, why don't we go to you next? Yeah, I totally agree. And I mean, I don't know. I can only go by the way the questions were set before us. But if it's, if that's the case that a man who simply plays secular music isn't allowed to play in the church, well, that's clearly wrong. There's, you know, nothing wrong. There's no sin of playing secular music.  I mean, yeah, sure, that's inappropriate for worship. But I mean, to exclude him for that, that's, yeah, that's what you're talking about.  You can't live in sin and be a member of the church. The church would be unfaithful for that. You know, Paul talks about fornication and all and cleanliness or covetousness. Let it not even be named among you preach it. You know, we do church discipline in our church, and it's a real difficulty because the next church down the road will just welcome them in and say, yeah, it's all wasn't that church. So mean to you. I mean, if we don't tell people who are living together and not married, if we don't warn them that God's judgment is going to be on them, unless they repent from that sin.  You have to repent to be saved. That's part of being saved.  Oh, I'm a murderer. You know, I want to join your church. Sure, you know, we love everyone. You have to repent from that. And that's part of the gospel that we repent. Let me ask you where I agree 100%. But a timing issue here. So a couple walks into your church and they start attending. They attend for three months and then, you know, in the course of things, you find out they're not married. I like, at what point do you say, hey, I've got to confront them? We've had this issue happen. And, you know, I do the new members class all the time. And people were, you know, you talk to different people and we had a couple who were excited about the church and they were coming regularly for weeks and weeks. And of course, you know, you don't know these things. And then it comes out that, oh, by the way, they're living together and they're not married. And I just point blank, said to them, well, you can't join the church. Either you separate or you get married. You either move out and separate or you get married. And then we can talk about joining the church. But until then, I can't even consider it, you know? So I just made it very clear. So it's when it comes to life. Yeah, yeah. And, you know, it was a good happy ending. They got married. Yeah, it's good. You know, I have a little bit of a, a little bit of twists on this. And what I mean by that is, of course, anybody that knows me knows, if everybody that was watching, I am not condoning that you should live together. But living together is not a sin. We have to make that clear. Just simply living together.  Two people living under the same roof.  What did they, what's their error? What's their error? If you had a guy that doesn't even date that girl and they live in the same house, but they're sharing the rent, he has one place, she has a place. Does that make them a sinner? No, I don't. We're talking about that though. Well, no, but what I'm saying, that's important that we mentioned that.  Well, I agree. If you're, now do I believe two people being married should or not being married should live together if they're dating? No, cause you're probably going to sin. You know, you're opening the door to that and I don't condone that. But I think that's very, very important. So my thing is also this, if they're not committing sin, they don't have to get out. That's just my opinion. Now, as far as like what they require in church membership. Now, maybe a church says, we don't want that. So membership is a man made thing. That is something that every church, you go to different, what you require to do for you membership, what's required to do for you. Sure, they're all different. That is something. But he saw, when we look at Paul in the scriptures, he's talking about the church. You know, now we have all these different churches with different names and you know, it's a little bit of a different setup. So I think it's important that we point that out as well as like even with a secular music. I agree that not playing secular music, but I also believe if a guy is in a bar where it's a strip bar and he's playing, he should not be a member. You know, we have to also look at everything individually. What is the sin being committed? It's not just, well, you can't play secular music. Well, some things are right until they become wrong. So I think that's also important to look at as well. And once again, I'm not dumbing down or watering down. I'm not saying that, but I'm saying we have to be careful because everybody's situations are different. So I might differ a little bit from where you are in regards to just, well, my question is, are you sleeping together? You need to be moving towards that. Well, as we reach out to the community, and our church has done this a lot and we see new people come in that don't have any knowledge of what it means to be a Christian and they're welcome, but if they're gonna join the church, then there's obviously some things we have to talk about. So are they not saved? No, I don't, that's God's business. So I mean, that's why I have to, we have to look at that, we have to be honest here. Well, if we're looking at something along that line and you get somebody that comes in, they give their life to Jesus and one woman doesn't work. And the other guy does. And we're saying, well, you can't be a part of this until you get everything right. Well, if that's the case, any person in your church that has any sin in their life, we have to get rid of them. Well, that's an interesting question because it brings up, do we have to be perfect to serve God? I mean, in order to join the church, do we have to have everything perfectly right? Maybe you can give us some. I would love for some feedback on that. Well, I think these guys covered it pretty well. I mean, what more can be said than has already been said. Okay, I'm not setting the standard. My church is not setting the standard. When there's a biblical standard there, then that standard has to be upheld. The Bible says, this is what Paul says under the inspiration of the Holy Spirit. When it comes time specifically, he who sins sexually, sins against their body. There's consequences for certain sins. And again, if we embrace, now we embrace the sinner to become repentive. But what I'm trying to say is there's not a difference. You cannot have a difference between Christian fornication and non-Christian fornication. I think we're all saying fornication. Tom, the question is not, are they in sexual sin? They were living together. It was considered adultery. That's why I wanted to be careful about that. Because we can't penalize for stuff the Bible does not clearly say is a sin. Oh, no, no, no. I agree with you, Jay. I agree with you.   I'm totally for that. But that's the only point I want to make clear. Yeah, I agree with you on it. Because Jay, let's be truthful. Let's all of us be truthful. Sexual sin is more prevalent in the church today than ever before. I totally agree. And in some ways, somehow. There needs to be a standard. And again, we're separating this completely from whether you go play polka music on Saturday night or something. So this is a clear biblical standard. And I think the question comes, can they attend? Can they, you know, where is that line drawn? I think different churches probably draw that a little differently. I mean, we are called to abstain from the appearance of evil. You know, and I've dealt with that question, Jay.  We'll just stay together. And I'm like, it's the appearance of evil. You're living together. We all know what that means. And that's always been the case. And so, and plus I said to them, look, you know, you don't want to get used to living with this woman.  If you plan on marrying her someday, you're setting a really bad precedent here. For sure.  And I would make a distinction too, between living in sin versus someone who sins. We don't say you have to be perfect, but you know, here's, here's first John 3.9. No one born of God makes a practice of sinning. There you go. You know, that's the thing you can't do.  This guy's a member. That guy's not. Gotcha. That's a good point. Good point. Well, coming up, we're going to, after our break, we're going to ask, does the Bible tell us we are to claim our healing? Stay tuned. Well, welcome back to hard questions. Let's take our last hotline question. My question is this. There are shows that I watch where it is said that we've already received our healing for physical ailments, emotional, et cetera. And that we just need to believe that we have already received those because those have been taken care of in Christ. Yet Paul had a thorn of some type, which we don't know what possible ailment it was that God chose not to heal him of in order to keep him humble. So I'm a little confused on how we can say that we have always received our healing for everything in Christ, although I know we'll be healed on the other side if we're not healed here. But there are many shows with prominent pastors who claim that if not being healed, you just haven't believed that you have received this healing in Christ. Very confusing. Thank you very much. Well, I really appreciate the scripture. And as the program director here, let me say this about the shows. We welcome a lot of shows as long as they are within the realm of orthodox, the true doctrine, but there's differences of opinion on certain things like healing. So we'll go there right now. So Ray. Yeah, and again, I'm just going by what I'm hearing. If what you're saying to the caller is that a minister is saying that as a Christian, you should never get sick. As a Christian, if you are sick, you can make yourself healthy. Then I would say that's false teaching. That's not true. We have clear examples in scripture. Paul says in Philippians two about a pathoditis, a fellow minister. He says he was longing for your oh, all he was distressed because you had heard that he was sick. Indeed, he was sick almost unto death. Now listen now, Paul resolves it. He doesn't say, but he declared his healing and healed himself. He said, but God had mercy on him. And not only on him, but me also, lest I should have sorrow upon sorrow.  Even the apostle Paul, who was, I believe, you know, he had the gift to do certain kinds of miracles, which I don't believe we can do today. But even the apostle Paul, who did heal people miraculously, he couldn't do it to everyone. Second Timothy 420, Erastus has stayed in Corinth, but Trophimus, I left sick in my elitist. Paul says, I left him sick because I couldn't heal him. God didn't give me the ability to do that. So, you know, I would say to you that we do get sick as Christians. We do get cancer as Christians.  They're gonna die of sickness. They're gonna die of disease. They're gonna die of an accident. You know, things happen to Christians in this world too. And to say that, you know, you should always be healthy and wealthy or whatever, because you're a believer. That's just not true. All right, good point. Dr. Gleis. Well, you know, Paul told Timothy to take a little wine for your stomach's sake. Often infirmity? Yeah. So, I mean, how come he just didn't go touch him and whatever his problem was, healing? You know, as a pastor, you know, I've prayed with people who had faith. I mean, they had great faith.  I prayed with them that, that, you know, I always pray that, Lord, your will be done in their life. And so I think that anytime we deal with healing, it has to be according to the will of God. Now, you know, some people will say, well, it's always God's will. But, you know, I would differ with that just based on some of the things that Ray said. So, you know, I pray with people. And then a couple of days later, they went home to be with the Lord. So, you know, God, it does not always heal. But eventually he does heal when they go to heaven. It's not that you had a lack of faith or that they had a lack of faith. It was just at that time was the time.  That's one of the distinctive doctrines. Divine healing. Divine healing. So, talk to me about this. So, we do believe in divine healing, but we also can take a look at the life of Elisha, who did twice the miracles of Elijah and he died of a sickness known of man. So, what I'm trying to say is, yes, is healing there? I believe healing is available. But to heal at will, nowhere in the scripture does it say. And then again, some of these teaching of some of these people, they make you believe that every time you pray, they gotta be healed every time. And some of them have had some great things, even in Paul's life. We discussed what Paul was talking about. He would take up his apron because he was a tent maker and he would cut it up and he would send portions of his apron to people that when the cloth touched them, they were healed. So, but again, the thing. I'm okay with that. I don't want to send that to me, but it's got to be real. It's got to be something. We gotta stay away from formulas. Right, right, exactly. Look at Matthew chapter eight. You have three distinct healings there. The leper, the servant, and then Peter's mental law. So again, when we try to create a formula, I believe we're in false doctrine. Thanks, Pete. 20 seconds. 20 seconds. All right. Real quickly, I think also mentioned about Paul. I don't think that's a good scripture to use for believers all the time. First of all, you haven't written two thirds of the New Testament. You haven't been caught up in the third heaven. When you had that he was given that because of the abundance of revelation. So I think we have to compare that as well. When I'm time to go on anything else, but that's something that we need to look at. This is important because we have heard a lot of people in the charismatic movement especially about that it's always God's will to heal, but yet we see a lot of people don't get healed. Then you start, are we blaming this person because they didn't have faith? Next what they did? What about us? Did we not have faith when we prayed? So it's a very important question. Well, we like to end the program with a scripture. And today we go to Ecclesiastes where it said he has made everything beautiful in its time. He has also said eternity in the human heart, yet no one can fathom what God has done from beginning to end. That's Ecclesiastes 311, interesting book you should read at some time. We hope that you enjoyed today's program and we wanna hear from you. Email us your questions like Jacob to hardquestions at ctvn.org or call into the hotline at<PHONE_NUMBER>. We've enjoyed being with you. Please send us your questions here on Hard Questions.


Okay, my name is Daniel. I'm a PhD student in the Department of Neuroscience here at Karolinsk Institutes And I'm originally trained as a clinical psychologist, but these days I do more like molecular biology So just to get a feeling it would also maybe be good to sort of get like Do people here have any sort of like background in molecular biology or like no idea about the general biology Yeah, okay. What what kind of like background? Okay, okay Yeah, but then I'm going to go over those parts a little bit more in detail and like not not dwell on the details the drug like Show what can be done with molecular biology these days So this is all in mice and I'm going to talk essentially about what I refer to as a never anatomical information system and The idea behind never anatomical information system is to be able to create essentially maps of the brain And when I talk about maps of the brain is digital maps So there's a perfect analogy between a never anatomical information system and Geographical information system that for example Google Maps use and other mapping surfaces So the idea is that like individual researchers can create their own whole scale Whole brain representations of their data So you do not have to rely on Allen Institute anymore. You can essentially generate your own whole brain data With a brain Atlas from a single like laptop computer like this and a microscope It works on a cell phone it works essentially there's no requirements. So The software suit is actually composed of many two parts. So there is a Back-end application and desktop application, which is essentially image processing and image analysis That's mostly coded in C++ and then The user integrates with it through an R package called the whole brain simply So you have all the plotting function now On top of that, it's a front-end server as well, which is called the whole open brain map of work Which is also the whole never anatomical information system in terms of like brain at us that is open source and rely some gets to be updated So that's basically two Different things so more into detail when we talk about Geographical information system. So if you come from an fMRI by background This might not really make sense to you because essentially an fMRI there is only one kind of like Computer graphics and that's raster graphics You're representing an object, but you can also do a vector representation. So if you look at like Google Maps That's a vector representation for most kind of informatic system when you have read a high resolution spatial resolution That's what you want in them when you do your computation and when you do your analysis The raster information. It's nice like a satellite image You can see certain things and you can use it in qualitative ways, but it's not the end product of complication So what we essentially want to be able to do in the brain is having these kind of information system And how are we going to develop systems where we can actually get to this point? So you see red souce vague That's where my lab is and the bagpipers. I don't know if people are familiar here with it It's a beer place where I think it's like 80% postdocs from Kerensky Institute. There are inhabitants there Through the Google Maps interface I can query about pathways through from this point to this point I get a lot of information I see that for example There is some traffic jam here and I get an estimate of the time if I take it by car if I walk and I can See different pathways. We don't really have anything sort of the equipment when it comes to the brain Look at the Alan brain at last. It's essentially a huge qualitative notebook There the quantity data is so low resolution and for data integrity But it cannot really be used in this kind of like various other way and the resolution and the data system are not really in place there So what do we need in order to get this kind of like? information system Yeah, just as a point like rastrographic is the norm in neuroscience these days and even like the labs that really tried to push it In terms of like freeman and colleagues at the Amelia farm. This is from the recent nature or no It's a whole brain analysis of calcium imaging in the zebrafish embryo So you can basically see here that you can map different behaviors towards different pixels But you also see that the pixel Analysis creates a lot of artifacts and you have actually a cellular resolution in the image, but you're not using that information So this just creates parametric maps and This is like the norm in neuroscience and if you look at all the C++ Different like libraries. They are geared towards this kind of analysis based on fmri and it's Different coding regions that started way back in the 90s and it has been with us Yeah, so why this this doesn't really work for the new kind of data that were that is generated because we're starting doing Imaging on the subcellular level and we do it through across the whole brain So if we compare for example here in neuroscience like a standard data set could be like this and here was there a midiolateral Ventral this is kind of like a pixel dimensions. We're talking about When we're doing mouse brain images, we're talking about like sliced tissue Hundred sections if you do clarity and those kind of techniques. We're talking about 2,000 Sections optical section and we're talking about 20,000 times 13,000 pixels and that kind of dimension So what kind of vector graphics are there in neuroscience these days? Well, it's actually very little. It was an attempt by By currency enga To essentially create a lot of scaling variant atlases with vector graphics But as you see the resolution is really poor because all they did is taking a pixel atlas and convert it into vector graphics I mean you starting by very low resolution and you end up with even poor resolution when you do that approach You have to rebuild the whole atlas and start with a vector Graphic revolution to start with And the basic argument is also like this, but this they don't have to tell you in this kind of crowd-setting It's about like having transformations that are in variants So for example in raster graphics, I can do a transformation I'm gonna transform it back and there is a lot of information that's completely lost Those kind of things never happen in vector graphics So what we essentially want to do is build this kind of system Never anatomical information system where we have the object We want to represent in this case a mouse brain and we slice it, right? So we put it on a shock board and then we slice it in very very thin micrometer slices and we image the slices and then we want to map it back into a vector Representation and do it through a lot of sections. We also want to map features in the game So with analogy of like the Google Maps that you have different regions Like cell bodies, you know exactly their location and all the information can be clear So how do we create a Staley-Marion representation so their current effort the the initial effort would for example Alan reference Atlas was originally drawn on missile plates like By hand and that was actually a vector representation, but it was just a hundred sections or so Later on when the computer scientists came in they started doing like basically fMRI research They just melded everything into like an area representation. So you have this like 25 micrometers No, nice a topic resolution. So each voxel you can query What region does this voxel belong to it belongs to with this identity number, which is an unsigned integer 32 bit That's a very inconvenient format for streaming on a web It's a very inconvenient format to work with in terms of gits. It doesn't really work It works for a lot of things if you take it and push it through an fMRI pipeline So currently what Alan is trying to do is like they're trying to redraw that that's with polygons That's also a bad idea because you will get good resolution But in the future we want subcellular resolution So you're going to start seeing these jagged lines and you constantly have to read or the Atlas a better representation is to do it with these lines So these points you can have in different formats I mean one very common format on the web based on the XML based format with this The good part with having representation in this kind of format is you can treat it with it So if someone there is a discussion about me dissenting a definition of an anatomical region You can come to an agreement by using this then I mean business as usual The important thing here you don't have an array of data that is like on the order of several hundred megabytes binary data here you have like something that's readable And So basically this is the regional and reference that's like when you download it and try to do a certain computations on it you have like this I Forced isotropic resolution because the cutting is in 100 micrometer section But you have essentially an array of data where each of these voxels have an Unique identity number depending on what region in the brain it is What you're not trying to do with Alan is Essentially creating polygon data where they draw polygons on top of this and the final reading is in terms of polygon measures What we instead try to do is actually creating nerve surfaces, which is essentially 3d representation of Beespline it's a non-uniform rational beesplines. It's what's using cat softwares For example most likely the shares here the table all these things are done with nerve surfaces at some point They also makes computations really really simple when terms of for example computing intersections with a plane so you can like redefine that plus depending on how you want to cut the brain And as I already said since you have the format in some sort of like XML Jason kind of format You can then do an aftermath of social construction So you can have like different people don't agree on a certain region I mean certain regions were defined by some old guy 100 years ago By looking for a microscope things evolved and maybe want to have a social construction how we agree on the anatomical boundaries So the boundaries are also highly questionable. So this can easily be done with with git So there's also this part where maybe nor anatomy shouldn't really be defined by social construction I mean with the current molecular tools such as CRISPR engineering You can actually do lineage tracing and trace the development from a single cell to like the whole Organize throughout development, and I think in the future That's how we're going to define your anatomy, and that's how we want to do But importantly you can apply the same kind of git framework to the Never-anatomical boundaries when they come when they happen and do margin pull request and Get at that sort of like that So what can we do with this kind of framework? So here is an example section of a coronal section of the brain. This is around like Middle of the brain. So here you see the stratum into hemisphere for you. How many people are familiar with mouse brain? No, it's just like yeah, you recognize this image where it is in brain Okay, this is straight them here. You see the cortex here We have genetically labeled a population in the stratum. This is a D1 positive neurons They have the D1 dopamine one receptor Express and we label them with GFP But we also have engineered a virus that basically jumps monosynaptically and also labels the monosynaptic Direct input from cortex. So we're looking at the corticostreatal pathway here This is how we can get the connectivity tracing throughout the brain genetically So through the framework we can then fit Atlas and also segment out all the labeled features This is roughly 1000 to 2000 or somewhere there But you also see in the image that we have labeling of axons For example here, we see the contralateral input to the this side of the straighten So we can basically trace where are the fibers crossing the corpus callosum at what they and this we do by Segmenting the processes as well. So we have a representation that more looks like a Google Maps kind of framework Automatically we get the quantification of like how many cell count if the latter all of this can be queried through our package You can plot it here. I have like how many fibers you have in the different regions We see that most of the fibers are not unsurprising An ipsilateral side to the injection and they are in the codotifatoma the straight and then the second largest corpus callosum Most cells here are in the stratum. That's the injection side And then we see the most abundant input is from layer five in motor clinics So for example when we are mapped it back to Atlas, which is the reference Atlas This is how the data can look from a single section and this is then how it looks on the web So this is the intermediate step on the computation to get the fiber processes And then you can represent it like the highway you saw in the Google Maps You also then have the cell bodies and everything and everything can be queried in a uniform reference Atlas for multiple different So when we then do it across the brain Everyone gets that approach. This is the kind of black data we start with like essentially taking sections and then Transforming them to the reference Atlas and building it up a single brain in 3d So these are all 80,000 neurons that sense input to 2,000 neurons in graphonucleus These are certain nugget neurons. So these are all the monosynaptic neurons that directly control graphonucleus and the production That's how that can look So if you then so this is how the Atlas looks The reference Atlas, so this is the main starting page of openbrainmap.org So you can see here immediately that we can like zoom in and have a really high resolution detail We have a small Small inset here where we can quickly move across the image and have both resolutions levels Simultaneously so we can get a good feeling of our image and move around so for example here We are in hypothalamus and when you are at a certain resolution I would also see that the boundaries are defined And you can see that this is the boundary to MPO the LPO without you even like having to like Look at the centroid of that So that's how it looks You can then query that last for example, I can put markers here We can both draw if you want to for example create new brain regions You don't agree on this kind of definition of straight and you think this is a good definition of straighten You can draw it then someone else can go in and essentially say like no you're wrong I think actually we should define it more like this and change it Here the markers Basically the markers here is that I put marks a single location in the brain I both get pixel coordinates They are useless because microscopes you can do imaging and different pixel resolutions all of it This is completely useless unless you're really interested in developing image processing algorithm More important you get still tactic coordinates and these are the coordinates that I use when I do Injections in the brain when I do surgery put in probes This tells me a millimeter where I'm at the brain It's in from anterior posterior Meteor lateral and then dorsal ventral so I know exactly where to go in the brain through this coordinate system I can then query what are the most abundant genes in this region compared to the rest of the brain And I get a list of two thousand most abundant genes sorted according on the server And now we're going to add all the like inputs and outputs as well. So you can query from one location to the other For example, I can take up simultaneous in the Regions like that and see the difference You also have a different set of tools for example if you want to quantify your injection site You see in real time the radius is like, yeah, 500 micrometer. I don't know radius there So all the measurements are in real time you can draw Can your surges for example go distances? All of this can be done saved and download through this button You get it as text file which you can import into our directly in your console And you get the same sort of like your metric You can search that class and you have the same sort of like hierarchy here and search through region And also this kind of information. So this is where we want to similar to like Google Maps Unlike Google Maps, which is like a single pane the brain is multiple pain So we can move throughout the brain for example, if you know a surgery, you know I'm teriopostero medialatron dorsal ventral and this in millimeters. So let's move maybe minus two Then one millimeter to the right and then let's move maybe two millimeter to down in the brain And then it places a market exactly at that coordinate and we're taking here now to the Dental gyros the cell layer of Dental gyros in the hippocampus So you have the whole brain at last like this rather than multiple windows and a lot of light to differ in So The segmentation are words are based on wavelength transforms And the reason for that is because we want to define biological features Not by how they're labeled or anything like that, but rather the space to occupy So here you see for example an original image tile with this cortical Cells label you see that the dendrites here and by filtering the image in these kind of steps we can segment out the dendrites and the cell bodies in different way that's a platform What this enables us in which one now going to get both the processes axons dendrites and Cell bodies and this is just to show the signal a different key So the signal to noise ratio for neurons the cell bodies It's high as the D3 here the scale and this also has to correspond to about 10 micrometer Which is the size of our cell body a thickness of an apical dendrite is normally like two micrometer And that's also what we see that the peak of the single intensity for processes are around there And also what we see is that the GFP is most localized to the soma So we see this as really really high intensity signal compared to the processes It works in different kind of microscopes epipressants confocal microscopy and light sheet microscopy So light sheet microscopy enables us to do all of this in 3d as well So we can go through an optical stack and then segment out everything in 3d registration algorithms Since we work with thin plate-based lines And we get the contour automatically. This is actually the idea is very similar to snapchat actually We don't want to do this sort of like information Pixel by pixel shaking the information intensity and then optimizing that that mostly doesn't never work in this kind of data Because your section in the tissue every brain section is going to look very individual with so it's better actually to get a set of correspondence points between your atlas Here and your regional side section and this is equivalent to essentially what Here we generate the correspondence points is essentially what snapchat is doing but Snapshot you have several years of research into facial features to detect them But you detect these kind of facial features and then you can get a millisecond registration and run it on a cell phone If you get equivalent for these kind of like really large-scale tiff images We can have millisecond registration on like 500 megabyte tiff images and have 2,000 of them You can do a registration of a brain within a couple of sections in order to get the data We need a lot of brain images in this kind of format on our server roughly 2,000 images per chronal plane That's the basic idea here you can see how the framework looks on a single on your raw data So you can see what kind of resolution we're talking about that this kind of data have you see that we see single cell bodies You also see that this will work on your cell phone. There is no like so down I can both see all the region bounders that are fitted here. You see perfectly that this is a five, right? In Cortex and then I also can get my cell bodies here. So these are the 2,000 cell bodies Each cell body here. I can then click on anything I get the identity where it is and also since we're doing our stuff like that in your data frame What role we are in so this is how you look like at your output how it's working You can move around and sort of like look how accurate it is and you have the same set of tools here More importantly since we are in both the pixel image System and the still tactic system. I can actually plan my soldiers within this Tissue section. So if you look at the mouse when I'm moving around I see millimeter where I'm at in the still tactic frame seems in this last of war It's an image. What can we do with this? We can trace connectivity. I'm just going to do this very quickly We can trace connectivity throughout the brain with genetically engineer viruses. So rabies virus Everyone are familiar with the idea of a rabies virus. The rabies virus is a single-stranded RNA virus It's very aggressive in a sense that like if you get bitten by a rabies-impacted dog will travel Exclusively in the retrograde direction. So you will not travel anterior grade just retrograde And it will travel synapse by synapse up to the brain and then jump across synapses like this in a retrograde fashion The rabies virus is evolutionary very very primitive in the sense that you only have five genes and it was discovered a couple of Years ago that if you know knock down one of the genes here the g which is glycoprotein gene Which is the glycoprotein that coats the the matrix envelope If you do that the rabies virus cannot jump synapses it will Get into one neuron and then it cannot jump across synapses So the idea is what you actually do then is you knock out or you remove the Glycoprotein instead you insert a GFP a fluorescent protein in there It's yellow fish fluorescent proteins so we can visualize it and now we have a virus that can enter a cell expressed GFP, but it cannot jump synapses. So how can we then Get the proper back again of the jumping synapses? Well, we express with a different set of viruses AV viruses Which are single strident DNA viruses we express in a Cree-dependent manner meaning we express it in individual cell types like dopamine neurons only or this kind of neurons We express the glycoprotein and then we will actually get a rabies virus that have it The glycoprotein in trans so it will sort of like coat itself with the glycoprotein We were able to jump once in apps But now we will find itself in a cell that doesn't have the glycoprotein anymore and it will stop there So that's how you get a genetic system where you can label Monosynaptic inputs and it's in in one direction retrograde And you can do it in a cell type specific manner So this is how you get this kind of like connectivity data Which we need in order to create this kind of queer database it where I can ask the same kind of question of like How do I get to bagpipers from here? I want to know if I'm in a particular brain region. What is the fastest way to? Synapse by synapse to go from here to here That's how you get that kind of data This is just like how it enters the Daxon terminal and then travels retrograde layer up into the cell body and expresses there These are the helper viruses where we label the glycoprotein as well But then also label with the fluorescent marker the Primary population so we can then actually get what are post-synaptic and what are presynaptic cells and count them So we did this in different cre lines and here you see essentially Several brains reconstructed and here we see all the 30. What is it? 40 50,000 cells that receive in that gives input to about 2000 neurons in the dorsus rate them and these are D1 neurons We see D2 neurons Then we can also trace connectivity in a step up like in motor cortex. What the motor cortex gives input to motor cortex? Well, we do a cancunus creed which is roughly excitatory neurons and then gabarra itself you can see the difference and Colonary into noras in straight them and through this we can build this kind of like Network of how the cells are wired in the brain So that's like the step one the step two is then looking at function of the brain regions We're here. We're giving a mouse. I'm just quickly show this video This is a very very good task. So Then it's an IP injection of either a sedan vehicle or Cookin so you have an extremely strong behavioral effect the mouse on the right that's okay So you have this enormous strong Locomotoric output and then we can look at activity markers like seafoas and count them in the brain like this and count Intensive of the protein levels as well like this and Then we can actually look so this is the mouse that you saw in the video with the cocaine and here is without the cocaine the whole brain activity Representation we can see for example in different brain regions how the states go up and down and then this is across animals We think can and correlated with the velocity the animal was moving at We cannot figure out like what kind of coding do we have in different brain regions for example here We can figure out the decoding scheme for orbital cortex in terms of which send inputs to the dorsus straight on is that it Works as an input game in terms of activity pattern Next what we're going to do is verify of course that this anatomical whole brain tracing works and the way we do that is essentially through This nice assay where the animal moves around in a virtual Environment what you have here is the equivalent of the old Mouse that weren't optical so it's this ball and then you have sensor on it So you get all the movement with millisecond precision when like slightest movement when the animal is moving with the good part about that is of course that We can record in the brain And we can then also catarise the animal and do Direct Infusions into the blood vein of cocaine and not getting this delayed where it goes through the liver So here you can see the cocaine injection and here you see the cumulative distance ran on this ball You see me laughter 20 second you get the effect of cocaine unlock a motion and Simultaneously in this assay you can of course give rewards and stuff like that to figure out What is the coding scheme for different neurons in terms of reward properties and and local motor effect That's how it works. Other things you can do is cancel types It also works on RNA it's got here is an RNA molecule and you can then classify cells according to where they are But these are the kind of like brain maps we're starting to build. So, yeah So questions Yeah, it should also end with if you're about to finish your PhD or anything else We started up a company now and we got funding for it So we will this summer start hiring engineers preferably we're looking for One developer with knowledge of C++ the CPU programming Open CV whips these kind of things is nice And you're working on the back end then and then we need a JavaScript and go lang mongo DB these kind of things So if you feel that this is you or you know someone and are interested in like developing this Google Maps for the brain One man who may


I welcome folks to this talk on Salsa and Fresca. I subtitled it The Road to Unfalsifiable Providence, because that's what I kind of believe it is. And this talk was really born out of conversations that I had with folks at previous conferences where there wasn't a lot of awareness of Salsa and Fresca. So I wanted to make sure that I submitted a talk that brought more awareness to both of these topics. So that's really kind of what this is about. My name is Christopher. I go by Chris. I shorten everybody else's name, so you're welcome to shorten mine. Consultants, I'm an instructor, and I help folks build platforms and adopt new technologies. And it's been a number of years that I've been doing that. So I helped with some of the certifications in the space. So for example, I helped write some of the questions and help author the CKS test. So if you're going for that certification and it's really, really hard and you want to curse my name, you're welcome to do that. All right, so what is Salsa? It stands for supply chain level for software artifacts. It is a framework for assessing and communicating the trustworthiness of software artifacts that are produced by the software supply chain. So think of it as like a checklist. You check off a number of items from Salsa, and you can communicate that your artifacts are compliant with Salsa levels in the supply chain. We're going to go over those as we go through this talk. The framework is aimed at software producers. So there's another framework that's about ingestion consumption on the consumer side. So this is all about you producing artifacts for consumers downstream. They want to be able to verify that those artifacts are indeed what you told them you were building, right? And the idea is to provide that transparency to consumers downstream so that they can do that. And when we build artifacts, we include verifiable trust metadata with those artifacts so that they can do exactly that. There's details about how the artifacts were built, the platform where it was built, and then we cryptographically sign those that made a data so that we can ensure that there's a guarantee about how that artifact was built, and then the consumer can trust it. So the Salsa 1.0 standard is split into tracks and levels. The previous, before 1.0, we didn't have tracks or levels, but when they released the 1.0, they broke it up into tracks. I misspoke, actually. There were levels before, but there weren't tracks. The idea behind having tracks is that as an organization, you may be really good at one part of this and not so good at something else. And so that could block you from being higher on the scale, being a higher level than you normally would have been if it's going across disciplines. So right now, in the 1.0 specification, there is just the build track. This was an important one to release first because of the fact that software prominence is such a challenge, right? There's going to be additional tracks that come along, so there's going to be a source track that's planned, build a platform operations track, et cetera. So you're going to be able to assess your Salsa level for these other tracks when they come out. And then, of course, saying we're Salsa level 3 build, then recognizes your progress, even if you're source level 2 or something. That way, we're not boiling the ocean because that would be really difficult. And oftentimes, when we try to do that, we fail. So each track has levels indicating the supply chain security level guarantees. So of course, higher levels indicate that you're providing more guarantees to your consumers. And having these levels also encourage iterative improvement, right? So we don't have to hit the highest level at the beginning. We can just start with something. And a lot of the folks that are working with Salsa and as well as Fresca, they'll tell you, right? Something is better than nothing. And so even if you're at level 1, you're doing something. And it's better than just not having any sort of provenance on your artifacts. So why Salsa? We want to be able to prevent any sort of unauthorized changes from unauthorized actors. The background of Salsa and the open source security foundation comes from partly from Google and then partly from the NSA and the CISA. And so the SolarWinds attack was a really bad one. I'm sure everybody here is sort of that. And so we want to prevent that type of attack from happening again. And so because the governmental agencies rely a lot on open source, they want it to be able to verify the provenance of those artifacts that they're using and as consumers have those guarantees. So other reasons, we want to prevent pulling materials, build materials from code repositories. Let's say an attacker switches out the Git repo that is being cloned in the build and swaps it out for their own nefarious loaded Git repo. If I have made a data that was signed related to that build, and this comes from concepts of Intoto, which is one of the things that Salsa relies upon, I can detect that sort of change and prevent it. Again, giving confidence to the consumers that the software that they're using is not compromised. So let's talk about the build track. Right now, 1.0 has three levels. There is a fourth level plan. So this is also changing over time. Again, you don't have to hit four right away. Start with one. It's a long road. That's kind of the reason why I titled this talk, the road to falsifiable provenance, because it's going to take a bit to get there. So the focus here in the build track is on provenance. We want to track from the source all the way to the artifact, the build ingest, the code sources, all the dependency sources that we're bringing in, all the build parameters that are used for that build, and any sort of outputs. That will give us a full transparency log of everything that was done during that build. The provenance statement, as I mentioned before, is currently in TOTO, is the standard. I kind of remember the first time I heard the word in TOTO dating back all the way to DockerCon 2016, where Justin Capos was on stage talking about Content Trust, which is a Docker product, and then immediately identified the problem, which was, well, upstream, if your build infrastructure was compromised, you just signed an artifact with your key that says, yeah, it came from me. And then you let someone use it. So it kind of opened my eyes to this large problem, and we're a lot of years down the road, and we're gaining maturity. It's nice to see. So shout out to that talk. It kind of changed my perspective on things. If you get a chance, go back and take a look at that talk on YouTube, it's good. So the in TOTO attestation is actually not required. The reason they're using it is it is easy to generate. It's easy to consume. It's easy to verify. But if you're just doing this internally in your own organization, it's OK to use another format if you want to use it. So why would I say that? Well, not all the tools that are available right now can generate an in TOTO formatted attestation, or they can't generate the version that is recommended. So that's OK. Again, something is better than nothing. So I'm actually going to show you an example of that because Docker has a way to do this, but it doesn't follow the salsa v1 standard. But that's OK. They make it often easy to do things. And so we're going to see some commands that it's fairly easy to do it. And that way you have some prominence that you can generate even if it isn't an official in TOTO attestation. OK, so level one, a couple of different requirements. The producer follows a consistent build process. You have a build script of some kind so that we know that it's a correct build or we can reproduce that build from that script. The only command, maybe the command that's used to kick off the script is imperative. That's OK. But we want to use a build script. We want to make sure that prominence exists, which means that this is going to describe how the artifact was built, build platform, the process, top level inputs to that artifact. So really any builder that generates provenance at all qualifies for salsa level one. So if you're generating provenance right now with some tool, even if you're not signing it, congratulations, you're salsa level one. So easy, right? We're already making progress. And then the producer distributes the provenance to consumers. The OCI registry, the registry specification was modified to allow for this type of metadata to be pushed with the image. Again, you don't have to use that. There are other ways to distribute the provenance as long as the producer and the consumer agree upon those things, then that's OK. But I'm a strong believer in if it's hard to do, we're not going to do it. One of the reasons why Docker gained so much popularity was they made things really easy to do. I remember listening to Solomon Hikes say this on the stage, right, their former CTO. The tools should get out of the way. So as long as it's easy for you to do, we make it approachable, then maybe you'll do it and you won't avoid it. So we'll try and do that. So we're going to do a build level one example here. I'm just going to use Docker desktop, right? You can use Minicube. You can use Cubadmin. Anything that will throw up a Kubernetes cluster doesn't have to be hosted, but it could be. And then we're going to use Tecton pipelines. This is going to run tasks to build our artifacts. And then TectonChains is our pipeline observability piece. And that will give us the prominence generation. So I'm going to switch to the terminal here and we'll run that. So there's a number of different commands. This Docker desktop is just empty, right? Let's just say you're coming at this from scratch and you're just using Minicube or some Kubernetes cluster doesn't have anything set up. The idea here is that this is fairly easy to set up. So what are the commands we're going to run? We're just going to apply the latest release of Tecton. We're going to wait until all the pieces are ready so we can move on. We're going to apply then TectonChains. And then we're going to patch chains configuration to use OCI storage, right? So you have a choice in which storage to use. I want to deploy my attestation with my registry. So I'm going to just patch it to use OCI and Tecton for storage. We'll then just restart our Tecton's controller to pick up that change and then apply a few tasks. These are just example tasks that come from the catalog, right? So Canico and Git clone are just standard tasks. This SIFT one, I modified a little bit because I have a local registry here that I ran that I'm just running through kubectl proxy. And it's not secure. So basically what I did is just, for the purposes of the demo, I modified the SIFT tasks to just allow me to do something insecurely, right? So I don't have to worry about logging into a registry somewhere. I didn't want to rely upon conference Wi-Fi to do all that. So this is my way of avoiding that, pushing up to the cloud or something. And then it's going to apply the demo pipeline. I was just going to invoke those tasks, right, one after the other. And then it'll cat the pipeline just as a reminder for me to show it to you. And then another note about starting the pipeline. So let me run that real quick. So that's going to deploy everything. We'll wait there for a second while it deploys. Fairly straightforward to get this up and going on just on my laptop. And at the end here, we'll look at the pipeline, and I'll show you the different tasks that were created. All right, so these are the things I was talking about. I'm telling SIFT to skip the TLS and using HTTP again, just so I can use a local registry.  Now, this is not required for Salsa Level 1, but it's easy to do, so I wanted to show it. So I'm just using cosine, generate key pair. And I'm just going to upload it to my local Kubernetes cluster. And that'll give me a key that I can use to verify the secret when I'm done. So I'm going to kick this off. And we're going to watch for the tasks and the pods that get created by Tecton. And it'll go through, and it's just three stages or three tasks. I didn't include something like a scan of the image before we signed it just because it's not necessarily pertinent to this particular conversation that we're having, but you would want to make something more sophisticated that made sure you didn't have CVEs in your image before you ran it. So yeah, so it threw an error, I think, because it's probably trying to pull an image from the cloud. And it's not going to do that because of Wi-Fi. So I did a thing where I recorded a video so that we can watch the local demo here, because I assumed that that was going to happen. So we'll jump ahead here a little bit. OK, so we're back to the point where we were creating the demo pipeline. We're going to watch that go a little bit bigger here. So I had more reliable Wi-Fi, and I was able to download the actual build images. So give that a moment. We've got the cloning of the repo, which is just a demo application. It's a Python sort of hello world thing that we use for our classes. And then the build and push uses Canico, just out of the box. And then the generate bomb is, again, the customized sift. But it's mostly just the out of the box sift that comes from the tecton catalog. All right, so at this point, what I'm going to do is I'm going to use a crane. And I'm just going to query for that metadata. So I'm going to pause it there. So you can see the artifact. It's the tag is salsa1. And then you can see the artifacts that are using the shahash. So I've got the software bill of materials. I've got the attestation. And then I've got the signature. Now, again, the signature is not really required, but I wanted to show you how easy that was to do, to include a signature for that. And so what I'm going to do is download the attestation and just decode it so we can look at it. So we do that. And then we'll cap that attestation. We'll see that it's, of course, machine JSON. So I'll redo it again. And we'll look at it through JQ, just so we can read it. And so there's my attestation. And now I don't have to do anything extra to distribute this because it's already in the OCI registry. And people can rely upon my attestation. And it's in the salsa v1 format. So then I restarted the video there. OK, so fairly straightforward. I just did everything on my laptop. But I still had to fire up a Kubernetes cluster. I had to install chains and all that. I added all the commands here. So that it's not magic. You can repeat all of these commands. And they should work for you, except for the one special SIF task. But everything else is kind of out of the box. So I included that in the slides. Let's look at an alternative. As I mentioned, Docker has the ability to generate provenance and S-bombs. So we can use the buildX command with building. There's a couple caveats to this. The default Docker image store doesn't support attestations. So we have to push it. So the workaround is to use a push flag and push it directly to a registry. Or use container D for pulling images. And that works around it. So let's take a look at that. So this is the first command. BuildXBuild, we're just going to tag it. I'm going to tag it salsa0.2. Why am I tagging it salsa0.2? Because it doesn't, right now, follow the salsa version 1 specification. It follows salsa0.2. So I just wanted to make that clear. We're going to create an S-bomb. We're going to generate provenance. So hoping again that this builds, pulling images down. And yeah, it looks like we've got a successful build. So now what I'll do is use image tools inspect. I'm just going to inspect the document. And there I have my annotations. I've got the manifest associated with it. And if I go and add the extra provenance.salsa, I can inspect the salsa part of the attestation. So we can go through here and see all the different pieces of that attestation. Now again, it's not signed, but that's not required for salsa level 1. So again, fairly easy, right? If you're already using Docker in your workflows, you can use that right away. So again, I included that. So again, it's not magic. I want to make sure that we're transparent about all the commands here. OK, so let's move on to the salsa build level 2. This is all of build level 1, right? You have to have provenance. And then you have to do it hosted, right? So if you're already hosting your build platform, you're getting even closer to build level 2. Provenance is then tied to that build infrastructure through a cryptographic key, right? And that signed key should only be accessible to that build platform. So the factory for repeatable, secure creation of artifacts, say that 10 times fast, Fresca is much easier. That is capable of build level 2. Part of level 2 is, of course, then downstream when a consumer goes to consume the artifact that they validate the signature. That's the goal. So what is Fresca? Fresca is a reference implementation of the Secure Software Factory white paper, which itself was a reference architecture for the secure software supply chain white paper that was before that, right? So we went from things that were more abstract to things that are more concrete, right? So we have a reference implementation of open source tools that will help us create a hosted build cluster, right? And let's take a look at its architecture. There's a lot of pieces here. We've got, again, tecton for the pipeline build. And when I do a demo, I'm just going to run the exact same pipeline. We've got chains, again, for pipeline observability. But we're adding to that spire, and vault, and some other pieces here that we're going to go through. Why? Because the goal is what? It is unfalsifiable provenance. So I could falsify the provenance in level one, right? We want to get to the point where we can't do that. And so through Fresca tooling, we're going to try to get as close as we can to that. So how does that work? Spire gives us the ability to attest to these build workloads, right? So when I deploy spire on the cluster, the agents will go through a node attestation where they can prove that they are an actual agent running on a node in the cluster, right? So how do they do that? It's through a third party. It depends on what sort of platform you're talking about. You've got AWS, Azure, GCP. You can even do it through Kubernetes projected service account tokens, right? Once we prove that that node is indeed a process running in our cluster, now when we go to build, we want to make sure that that process too is also a process running on the cluster. So we use the workload API and workload attestors so that the workload has attestations associated with it, right? So we use things like the fact that it's a UNIX process, the fact that it's a pod or a container running on the platform. This is all important because we have to validate that these things are real, right? That they can't be spoofed, that it's not another process that generates the artifact, but this process that did it, so it can't be spoofed. So once we have Spire up and running, we have, by the way, authored a blog on a Spire deep dive. I'm sort of taking a high approach to this, but we went through Spire concepts, agent deployments, agent configs, workload registrations in depth. So you can understand all the different pieces and all the registrations that you make. And then we even test a spiffy ID, the idea being that once we have that spiffy ID, we can use that to integrate with other systems. Vault specifically is used to keep our secret material safe. We do that through putting our keys rather than on my file system as we did locally. We put it into Vault and then we use Vault's transit secrets engine so that that key never leaves Vault, right? We have that workload who gets assigned, right? The agent has attested that the workload, the builder, is a process on a node, and it will assign it a spiffy ID. We then tell Vault to trust Spire and trust spiffy IDs. We do that through an OIDC endpoint on spiffy so that Vault can then call, sorry, through Spire. Vault then calls Spire and can validate. Again, we're doing what? Third-party validation again, right? So we're presenting a token. And then the system that's holding the key is saying verify this for me, right? Trust but verify. And that way the key material is safe and we can sign the attestations so that, again, we're trying to get closer to unfalsifiable provenance. We're about to publish a blog on Vault, so that's coming soon. So if you follow our blog, you'll see that. We talk about the OIDC configuration. This is a lot of hard-won information. We learned a lot through this process. And then we even test secret access. To tie it all together, again, we go back to Tecton and we use Tecton chains. So what happens? The Spire node attests that the Chains Controller is a valid process running in our cluster, right? It will then grant the Chains Controller a SPIFI ID. Vault can then validate the Chains Controller SPIFI ID via that OIDC endpoint. And then Chains Controller is then granted access to that Vault signing secret and uses that secret material in Vault to sign the artifacts and the provenance. So now we have signed provenance. And we can attest that all of these processes were indeed in our cluster, and they weren't done by someone who injected some sort of malicious payload into it. So we're going to look at the Solstice Level 2 example. And so typing with one hand is harder than you might think. I'm going to actually SSH somewhere, because this can't be on my laptop, right? So we've built a hardened Kubernetes cluster using Kubernetes operations or cops, if you've heard of that. And so this is a Bastion server that is in front of a cluster that has been hardened and doesn't have public access. So we'll just back through these commands. Again, same command. I'm going to create that demo pipeline. I already created all that stuff. I don't need to create it again. And then we'll watch. There's a previous run here, so we're going to watch this next run happen. Again, same steps. Clone the repo. Build the artifact. Create the SBOM. And then change is going to sign it. And we should be able to verify this provenance if the cluster behaves. So we'll give that a second. So as it's doing that, in the background, I described a lot of things happening between Spire and Vault. The idea is that this is transparent to developers. This should all happen in the background and happen automatically through automation. So we have a successful completion here. So we will then use Crane again. OK. So in this case, I'm hitting a registry. Again, that's running in this cluster for the demo purposes. I've got the SBOM. I've got the agitations. And I've got the signature just like before. Except for this time, again, the signature we know was done in a safe way rather than just on my file system. And so I can validate that signature. Whoops. I'm typing validate and it's verify. There we go. Cosign verify helps if I use two hands. There we go. The cosine claims are validated. The signatures are verified against the secret material. And I use the secret material that's coming from Kubernetes. I'm not using the local key. I'm using the key that is stored in Kubernetes for validating these cosine claims. So before, I was using the local key. And so there you have it. Now we have a much more robust way of building artifacts. And I can have more security guarantees that my secret material wasn't compromised. And the build process was done through attestations that we can link directly back to the processes on my build cluster. We already looked at the attestation file. So we won't look at that again. But because it's going to look the same. Now we're not at salsa build level three. Build level three has much higher requirements. We have to prevent runs from influencing one another. And we have to prevent secret material used to sign the provenance from being accessible to any of the user-defined build steps. We're pretty close. But Fresca doesn't qualify for this because tecton chains right now will essentially just observe tecton tasks and then just sign things. So I could inject in between that maliciously and then just have change sign something. So it's not right now non-falsifiable. However, there is work being done to improve this so that the integration between tecton and spire is tighter. And that would guarantee our non-falsifiable provenance. So it's a work in progress, but we're getting there. It's a road. It's a road for organizations. It's a road for the open source community. But the idea is to get there. So I mean, if you're using GitHub Actions or Google Cloud Build, you're already there. But if you're sticking to open source, like we've been going through the last few slides and demos, then we're getting there. We will get there eventually. OK. So thank you. Hopefully, you learned a lot about the Salsa standard and the Fresca architecture. Again, we've got deep dives in our blogs for each one of the individual components. So we're going to keep going with that. Because I almost subtitled this Fresca the hard way, because that's the idea was to deploy everything piece by piece and really understand what was going on. Because I found that when we did the research for this stuff, it wasn't always clear what was going on. And we want to make sure that we're clear about that. And I do owe some thanks to a couple of my colleagues in the audience. My colleague, Valentin, Sigstor, is one of his favorite topics. So if you see him hanging out with me after asking him about Sigstor, Ilian did a lot of research on Spire. I'm just the guy that got to get up here and talk about it. So thank you, Ilian. And then my other colleague, Christian, he's not here. He's back in the States. But he had a lot of input on Vault. So I just wanted to make sure that they got proper credit. Thanks, everybody. I appreciate it. I guess we're taking questions. I wasn't keeping track of the time real well. Did I go over? Go ahead. Why did you add Vault to the whole thing? I mean, the Sigstor supports keyless signing. Is Vault really necessary in this scenario? So in the Fresca architecture, the important part about Vault is that the transit secrets engine, because it keeps the key material in Vault so that we trust Vault. We use the spids to cryptographically sign the annotations essentially in flight so that the key material stays there. And that's the most important reason to use Vault. So your key is secure in Vault. Thank you. Yeah, I'm a bit sidetracking maybe. Outside of this, for the actual build and artifacts, is there anything going on for tracing provenance of configuration? Because with stuff like him, for example, I'm loading configuration from a bunch of random places on the repository. That I don't think I can answer. We were talking about when you deploy workloads, like deploy actual applications on clusters, is there efforts for tracking the actual configuration there? Is that the question? Yeah, exactly. Because more and more stuff is going into the OCI registry and stuff like that. So I was thinking, is this framework maybe in the future going to be adapted to also the other parts? That's a good question. The specification allows really for any sort of arbitrary metadata to be stored in an OCI registry. So I would imagine that it wouldn't necessarily be something you couldn't do. I'm not aware of any particular efforts to do that. But the registry will support that type of metadata and the new specification. OK, thank you. Yeah. Over here? Yeah. Thanks for the great walkthrough. So I have kind of a basic question. So you went through all this effort in making sure that the node assigned and so on, configuring spliff here and so on. As a consumer, can I verify that you actually did this correctly or do I have to trust you that you set up everything? So that's what the Providence is about. In that Providence document, we didn't really deep dive it too much. But yeah, you know the identities that were associated with my build infrastructure. And those can be verified. So it's full transparency of not just the materials, because the SBOM gives you the materials. The attestations give you the additional information about what the process was, how the thing was built, and all of those extra details. There are a lot of details that we skipped over because we only have so much time. But yeah, absolutely. You can validate all of that. And I would even add you want to do it automated in an automated way. So I don't know the state of the support for that type of automation downstream yet. That's really what that other group I was talking about at the beginning was for consumers, for ingest. They're really working on that sort of thing. So that once we have the artifact signed and we have the attestations, then there's an easy way for you as a consumer to then consume it and validate it. So I can't say I'm paying attention to that or part of that effort. But they are trying to do that. Yeah. Thanks. Yeah. All right. I think they're serving beer somewhere in the other room. So probably a good idea, right? Congratulations. You made it to the end of the first day through KubeCon, right? That's always an achievement.


Hi everyone, my name is Mary Thengval and as Jason said I'm taking you to the land of avocados or in other words We're talking about developer relations. So if you're familiar with the terms Community management developer advocacy, they all kind of fall under the same umbrella as developer relations So I'm gonna talk a little bit about what it is and why you should care about it First of all, it's built on the foundation of open source community management And I know all of you here are passionate about open source and I'm sure we have some community managers Yes, there we go. All right. All right So it's it's built on that foundation and it contains a lot of different roles some of them are up on the screen So developer advocate community manager developer evangelist and there's a lot of nuance in each of these, right? So I'm gonna explain a little bit about what each means so you have a better understanding Developer advocate first of all is the technical component of the team So they're typically the person who has a developer background a CS degree code school degree something along those lines They do a lot of live coding a lot of demos a lot of technical deep dives with documentation Helping their community members understand the technology You've got technical community managers who may or may not have a developer background, but they're definitely tech savvy They're really good at assessing out what the problems are that people need to have solved How to communicate that back internally to their company and their coworkers that they better understand the problems There's also what I like to call technical ambassador or some people call a developer evangelist Who helps people understand how that product fits within the greater landscape of the overall tech industry? And all of these roles and a couple of others that some other teams include Help push forward one goal of enabling our technical audience to be the best that they can possibly be at their job And this is an hugely important role because it connects the community with the company and it helps people Better influence the decisions that we're making internally and with the right manager who has a business value of developer relations And understands that value that we can contribute We're able to really provide that value back to our community members This is where the mantra of developer relations that I use all the time comes into play So to the community I represent the company to the company I represent the community and I have the best interest of both in mind at all times And it's a difficult balance to keep because you're constantly going back between the community and the company and making sure that you understand both sides But when we do understand both values We can provide relevant content to our community members and we can also provide valuable feedback Internally to the company to help the community better do their jobs The important thing about this is that we understand that when the community succeeds the company succeeds But when the company sets the community up for failure, especially when it's an open-source product that needs that contribution from the community There's no coming back from that mistake So we're kind of the liaisons the jugglers the teachers the journalists We're the connecting bits between these two and we understand the Landscape of both the community that we're following as well as the company that we're working with So we can make these introductions community member to community member or community member to Co-worker to provide value on both sides of the spectrum and these connections are something that I call DevRel qualified leads You familiar with the term marketing qualified leads There's a few marketers that are nodding Okay, so it's this idea of understanding that I might not be able to influence this particular Community member to become a customer or guarantee that the hiring manager is really going to appreciate the particular hire that I pass along Or even that the really excellent Community member who's awesome at the forums is going to be able to translate that into a blog post But I've made those connections and I know that the value that those connections can provide Because it can provide value again both to the community and to the company So developer avocado if you've heard of it There's a bit of an analogy here to help you understand this and this all started when I was back at spark post about three Years ago helping out with their DevRel team We had one of our project managers that had a hard time pronouncing developer advocate and it would often come out developer avocado And we as a team decided we love the title and we ran with it And we came up with an analogy around it because you see avocados are the good kind of fat and used in the right ways at the Right times and the right combination of items we can provide a benefit to both the community and the company We also take on the flavor of things around us So there's a lot of shifting goals maybe shifting departments But we're fluid in those goals depending on the needs of the company We also go well with a lot of different cuisines, right? And like the best types of chefs who are constantly experimenting with ingredients and trying to come up with the right combinations We're pulling different levers to make sure that we have the right combination of items for our communities Avocados also take a long time to ripen and DevRel is a long game It's not a short quick fix but with the right investment and nurturing we can make a lot of good Lastly avocados are good for your heart and just like a healthy product and a healthy community is good for the heart of the company So again, my name is Mary thing of all if you want to hear more about this I have a full-length talk tomorrow at 4 30. You should all come it's gonna be fun I also talk about this stuff for a living and the founder of per se consulting My goal is to provide resources for developer relations and community professionals Some of those resources are on the screen behind me and I'd be happy to chat more with all of you if you're interested Thanks. Have a great night