Hey, buddy. You getting ready to go for a walk? Yeah, today is Father's Day. Brick got me a new Father's Day t-shirt for the occasion. Happy Father's Day. Wearing a Father's Day shirt, too.  Yeah. It says Daddy's first Father's Day. We'll show you later. It's not a dad bod. It's a father figure. Chevy, you want to put this into the weed wacker for me. That'd be great. Come on, guys. Come on. Come on. The yard mode out here. Trying to get some stuff done. Our weed wacker, our weed eater, out of string. So I better refill it. Brick is just at the store right now printing off some some pictures. And Theo is sleeping just inside there. Got the windows open so I can hear him. And I'm out here trying to relax. Summer in the city is what the fair is called that comes to town every summer in the city. It was just winding down already today. We didn't go yesterday. We were busy yesterday with our baby shower. Which went really well. It wasn't a huge, huge crowd, but I come from a big family, right? So we had, I think we had about 50 people, right? We had rented a hall and it turned out really well. Had a good turn up. And it was really nice just to celebrate with our close family and friends. Theo's life that he existed. Theo's existence. Very special little guy. It was his big day. He's good the whole time. Didn't cry once, didn't fuss once. Just loved being held. So today when I'm filming this, as you know already, it's father's day. We're in my father's day shirt going on a nice father's day walk. Britt has asked me what I want to do with the rest of my day. And I said, I just want to sit on the porch with my family. I'm gonna sit on the porch and I want to have ribs for supper. So we have ribs in the freezer at the shop. I'm just gonna quickly run there and grab those. That way we don't got to spend a whole ton of money, right?  I already have Theo. That's all I need. I just need my family. How's it going, old blue? You ready for the truck show next weekend? By the time you watch this, it'll probably be close to that weekend or somewhere around there. June 24th. There's a truck show here in Steinback and you know, last year I was all excited to go. Turns out I couldn't make it last minute and I was disappointed, but this year's a new year. I'm gonna be there. I've already told this batch. I said, I missed last year. I'm not gonna miss this year, okay? So they're not gonna send me out too far this week or if they do, they'll send, they'll figure something out. So I gotta be home for next weekend. It's the truck show. It's technically, since I've owned it, old blue's first truck show. It's been in some before. I think it's actually been in this one before with the previous owner. He'll probably be there as well. Though he doesn't have his own truck anymore. I have it. It's mine now and I'm not giving it back. Diesel, you smell that? You smell that? Chevy, you smell that? Smells so good.  That's what they call me. It's my middle name. Rib-making factory? Yes. The more, you know. There's potatoes here. Oh my. She's going all out. Special occasion or sometimes? Father's day. Father's day. They didn't have the ingredients to make what you wanted. So making a rain check on that for next weekend. Ribs always satisfies. So Britt made my first Father's Day super special. I had a really good day and she went all out with her Father's Day gifts, too. I just wanted to show you this here. The envelope. It's a gift certificate.  It's also the the vehicle that we use to move the dogs around. And bring Chevy to daycare or you know, bring big Frank to get his nails done, right? His pot of cures. Your pot of cures. Like you had yesterday. I feel. Take a morning, dad. Hi. This gift was from you, I heard. It's a big one. Must have been working hard already. He's already got a job. Start him young. It's a gift to get to the detail and glass company here in Steinbeck. They're great. They do a really good job. Thanks Theo. And a very special book. That kind of made me tear up a little bit when I opened it up. It's a custom made daddy's magic hugs for Theo. Truly there's nothing as magical as a hug and the hugs that matter most are from the people who love us best. I love you Theo. Daddy, I love you too. The whole book is about different hugs. This is for Theo and his amazing daddy on your very first father's day together. I love you both more than you will ever know. Mommy was choking up a little bit when I opened this the first time. So I'll read like the first page. It says, I'm just waking up to the bluest of skies. What kind of hug helps me open my eyes? The good morning kind that squeezes me tight. A hug from my daddy is always just right. She also got me a card. To my husband on father's day, the happy marriage checklist. All the boxes are checked. And on the inside, happy father's day. 2023, which means that there's going to be more every year. Give me the risk for our lives. Every day. Every year. Every day is father's day. I don't have that kind of energy. The boys also got me that gift that I showed you already. The shirt. It's not a dad bod. It's a father figure. Thanks guys. Thanks. Saved up all your allowances. Milk bones. You paid with milk bones. That's nice. Should have you paid with fluff. You gave up some of your fluff for me? Wow. So I know you're watching this well after father's day. Is father's day a thing in other countries as well? I'm assuming it's the same across at least the English-speaking world, right? The Anglosphere, as they call it. Canada and the US. The UK, Australia, New Zealand. Is it father's day in Europe too? Or in anywhere else around the world? Anyways, it was a really good one. Like I was saying, Brit made it so special. We didn't even really do anything. We went to the fair, walked around a little bit. I just wanted to see everything. Didn't go on any rides or anything. We bought a poutine and we got this natural lemonade, blueberry lemonade thing. Which is pretty good. And I'm sort of wrapping this up a couple of days later. But now we came home, sat on the porch all day. That's all I wanted to do. I just wanted to sit on the porch. It was such a beautiful day. One sec. One sec here. Very important. Can I get an extra large coffee with two cream and a shot of espresso in it? And a sausage farmer's wrap with creamy barbecue sauce instead of chipotle. Yeah. I'm sorry, what was in your coffee? Two cream and a shot of espresso. And that was extra large, right? Yep. Anything else? And a hash brown. Okay, does that everything break today? That's it. 10-10. Thank you. You're welcome. I forgot to say super duper. Got to bring that back. Haven't said that in a while. Whenever I go through a drive through, I used to say super duper. And there's only one place that ever responded with something clever. And that was Sage Creek, Winnipeg, Tim Hortons. I would say super duper. And he'd be like, awesome possum. Never been able to get anyone anywhere to respond with a clever response like that ever again. Yeah, I just wanted to wrap up this video sort of like a little bit all over the place. This next week, we're going to be heading out on another trip. Unfortunately, we got to go back to work. You all understand we got to get a new house. Got a one track mind. Got many other things going on, but the one goal right now, our main goal, get into a bigger house. It'll be a little while. We've got to, probably a couple of years, but we're looking at now. They bought some new tires for the truck and got the safety.  We'll be okay though. Thanks for hanging out with me today. I hope you guys had a great day. Happy belated father's day to you. I'm going to grab my Timmy's now and we'll start the next video. Oh, I forgot. Oh, I didn't get this ready. Hi, 10, 10. Hi. I've got this as soon as this opens up. Oh, oh, sorry. I should have had this ready. It's going to show up soon, I think. There it is. And I'll pay with the card. There we go. Thanks, you too. Timmy, it's going to be a good day. I'll see you in my next video. Take care.


YouTube team keep it clean. What's going on with another video? And in this video you got another episode of NFL questions from subscribers This one came from a boy low schools hard 06 And he asked a real good question Some people have asked some different variations of this question But not this question exactly because there's a lot of people have asked. Oh, what if what if the Ravens have a losing season?  A lot of people ask that but they don't ask about the backup plan Not just being Lamar Jackson, but with the coach because he asked if if Could Lamar Jackson and and Greg Roman take over and Greg Roman is the current assistant coach right now assistant head coach I believe but could they take over him and Lamar Jackson if Slaco and hardball have a losing season because you know those two are joined at the hip You just got to you got to feel like can't be no other way I feel like it can't be any other way Yeah, I feel like if it's gonna be hardball and it's gonna be flacko to vice versa If it's gonna be flacko if flacko is gonna be out then hard balls gonna be up out of there, too because those two will really uh hardball Not saying Joe doesn't but vocally Hardball it seemed I feel like John hardball would die for flacko I feel like this dude will do literally anything for jovco. He will never throw him under the bus He will never call him out. He always Feel like that's his cuz this dude I feel like he just loves him from Joe flacko and of course why wouldn't because they had a lot of success together And they I mean I feel like he just ride or die for flacko and it ain't nothing wrong with that It ain't nothing wrong with him riding for flacko because that's his guy It's always been his guy from the very beginning since they first started in Baltimore from jump It's been John hardball and Joe flacko the J&J Foundation, it's been them two forever That's why I feel like if one goes then it would be both of us This rain is just it man. It's rain. It's raining raining raining rain But I feel like it's just it's both of them can't get out They can't get away from each other and it almost feel like it is a little early to jump the gun because it all depends on the situation and whatnot and of course we would rather have success then They're not have success, but I feel like If safe for instance just for instance Please nobody take it too seriously even though somebody always take it too seriously. Anyway, for instance What if a hardball if the Ravens have a bad season and a hardball gets fired and then they cuff echo Right say say that happens. I feel like and again like I said It's too early to get to this, but I feel like if given the right opportunity If John hardball is a head coach somewhere If he gets hired as a head coach somewhere else Then flacko is coming with him Flacco is gonna come with him flacko is gonna be right there and End up being a starting quarterback for whatever team hardball will go to obviously depend on the situation, but You obviously need a wow the people do this stuff. It's raining and still still want to cut people off I don't I don't understand why people are the way that they are, but it is Then he wants to stop in the middle of a road. He wants to stop in the middle of the road So shout out to this guy in front of me who cut me off in the rain and then stopped in the middle of the road Then try to get over to the left lane, but he decided he couldn't do it So he stayed in the right lane and I guess he just all kind of confused and now he's doing a u-turn Okay, yeah, I don't think he really knows where he wants to go. But anyway, that's all good. It's Friday. So give him a pass But anyway Yeah, I feel like John could end up he could like look at this weather. I wish can y'all even really see it I don't even think you can really tell from that like look look at this. I don't even think you can really tell from that I'm not sure but I feel like with with hardball giving the right situation because I feel like obviously if If if you are if you have to hire a head coach, then I feel like you ain't got your quarterback You ain't got no quarterback that you love you ain't got no quarterback. That's your franchise quarterback because I just feel that way and I can't and sometimes it could just be the coach maybe he just ain't getting people to click right but if if John hardball was hired as a head coach, you know, I feel like that would present an opportunity for Flacco too and They would just be joined at the hip man and I feel like he would bring them on and it would It would make sense. I was getting less rainy. Nice. It would make sense because those two know each other They know each other in in and out and they are they are each other's buddies So this was a good question though. So I appreciate this question. This was a real good one. I like this one I like this one a lot. So appreciate it. Good question. Appreciate y'all. Y'all know what to do to be part of NFL question from subs And I'm out


Hello, EnvoyCon. I'm Harvey Tuch. I work at Google where I tech lead the Envoy platform team. I'm going to be presenting today with Michael Payne who leads Kubernetes architecture at JP Morgan Chase. And we're going to be talking about Envoy's supply chain. What is this supply chain? Why do we even care? Security is only as strong as the weakest link. And the weakest link in software is often the components which you don't see. Any software system has a number of software components, some of which come to it indirectly through the transitive chain of dependencies. There is a very real attacks that have been staged in open source against the software supply chain, in particular in the managed language runtimes such as Python, Ruby, and JavaScript. But there have also been attacks such as Xcode Ghost which are attack developer infrastructure and those aspects of the supply chain. These are very real attacks which exist. It proves us to understand better what is Envoy's exposure to these and what can we do about them in open source and what can you as an organization do to limit your exposure to the supply chain. So this talk is going to focus on how the supply chain contributes to Envoy's trusted compute base and how we manage and maintain this and how you can understand it. As a starting point, we can look at Envoy's code base itself, the direct code that you depend upon from Envoy. And this is now around 170,000 lines of mostly C++ code. It's grown roughly linearly since the beginning of 2018. It's actually super linear if you look a bit further back, but this is the current trend. And we can actually break that down and view it between Envoy's core in blue and extensions in beige. And you can see roughly right now it's about 50-50 split between the two and the extension mechanism which was introduced back at the beginning of 2018 is actually very effective at helping to temper the growth in Envoy's code base, at least the mandatory code that you must include in your binary. But the core has still continues to grow. Okay, so looking at the same time period, but instead of looking at Envoy source code, we look at the number of dependencies that Envoy directly relies upon. And we're just looking at like one set of dependencies here, which are the ones that are linked directly into the binary and feature the datum control plane. They're grown from roughly around 20 or so dependencies to today where it's roughly 60, again roughly linear growth. And if we slice this data and look at it in terms of extension and core and other like components like things, extensions that dependencies that are there for build and test and APIs, it's roughly a third, a third, a third, a third for core, Envoy, a third for extensions in Envoy for the actual binary, and a third sort of of the remainder. And even core dependencies in Envoy have grown from roughly 10 to 20 today. And the sheer number of extensions of over 60 means you're in a situation where it's very hard to keep in your head exactly what Envoy is depending upon at any point in time. And we've introduced some metadata to help with this, which I'll talk about later. The next few slides will look at Envoy's dependencies through a difference visualization. And this is that of a tree map. And this tree map depicts the square, the rectangles are sized based on the number of lines that each component in Envoy contributes to the binary as determined by the debug lines, which exist in the Envoy binary. So it's somewhat of an over approximation, but it's the actual, the most direct way to map back from an Envoy binary artifact to the underlying dependencies in Envoy source code. So we'll go with that. It provides a reasonable first approximation of the relative size of each of these dependencies amongst themselves and between there and Envoy. And there's some interesting things to note from this visualization to begin with in pink, Envoy's, you know, flagship color, we have all the Envoy directs contributions to the TCB, which is about 20 to 25%. And the rest is actually external dependencies. And these are there for various reasons. We have boring SSL for our transport security. We have Qiche, HTTP, HTTP2 and HTTP parser for our codecs. We have things like LureJet for dynamic code execution, GRPC and protobuf for the control plane, and so on. So we have roughly at least 20 dependencies, but maybe 20 to 30 roughly, which we would see in a normal Envoy binary, which are there and we're linking against. We can look at this data through a different lens and ask which are essential and which we can optionalize and compile out. In blue, we have the core components, which sort of dominates the view. And we have in beige the optional components, the extensions. And you can, you know, by removing these significantly reduce the size of the TCB at Envoy by maybe 20, 25%, but most of these dependencies are actually there to stay. Looking at this set of dependencies in terms of organization and the only organization which consistently is actually responsible for maintaining or being the sort of provenance of dependencies is Google. And they're responsible actually for roughly, I don't know, maybe 80% of our TCB there, which is pretty actually encouraging because, you know, you know, while between these projects, there's no uniform standards, there is at least some core common software engineering principles that developers coming from Google will bring to the table, which are not necessarily true in other projects. Looking at the projects to a different view again, we can think about how vulnerable they are, how many security vulnerabilities have occurred over a period of time. And the methodology I use on this slide is to look back since the beginning of 2018 and ask how many CVs have occurred in the project. So this doesn't take into account how many of these CVs affected Envoy or how many of these CVs would have actually even mattered because these dependencies weren't linked to Envoy at the time, but they give a rough idea of how scary different projects are. And the outlier here by far is libcurl or something like 14 CVs in this period. So this is actually really scary. We actually don't need to rely on libcurl, so that one's probably going to go away. We have an open issue to remove that. Anyone is interested in helping out. They have our full support there. We have a few trickle of CVs and other dependencies, and some have actually known whatsoever, which is either encouraging or just means they haven't had enough eyeballs. Looking at just CVs is no panacea. Many projects don't issue CVs when they discover security bugs. Some security bugs are treated as functional bugs, but are really security bugs. And some CVs don't get properly correlated with the CPs and so on. We can take another view of how much we trust or what we should be doing about these dependencies by seeing how often we update them and they should be updated. We can see in terms of updates, boring as a cell gets the most frequent updates and we'll understand that when we get to the next slide, but it's encouraging because that is one of the really most significant attack services that we have. But other dependencies like GIPC or quiche or protobuf are also updated relatively frequently. We can now look at the number of actual version tagged releases on GitHub for these different dependencies. And this creates a very different picture because many other dependencies actually have no version releases, which is kind of actually scary in so many ways because things like boring as a cell or quiche or something like the TC lap or this kind of thing. It's kind of like a little concerning that we don't actually have a way to know when we should be updating and when, you know, other than watching for CBEs or trying to pay attention to mailing lists or this kind of thing. So this isn't that we actually want to address and I'll talk about that in a few slides time. Final way to slice this data is to look at this in terms of what are the sort of the most scary dependencies from a security threat model perspective. And here I've color coded in red manually. Those dependencies which feature the data plane, which will interact with untrusted data plane traffic. And there's quite a significant number of these. There are ones which are sort of like in orange and yellow, which are sort of control plan or observability related, which are a little less scary. And in white, we have some dependencies that TC lap or PGV, which aren't going to be super important from a threat model perspective. So how do we even generate these visualizations and how do we keep track of them today? Well, this is actually a shifting story. In the last month or two, there's been a number of improvements to this. And we now have pretty complete metadata, which used to only be in comments or not at all about most of our projects that we depend upon. We have project metadata, versioning information, pinning, sharp pinning. We have when these parameters are last updated. And then information on the use category and extensions in CPE, which were actually very useful in generating visualizations, which preceded the slide. We're actually also providing a dashboard which tracks ahead the kind of version and externalizes all this information and links to CBE search and that kind of thing. And this gets included now in the onboard documentation in each release. So far, we've largely talked about things which are informational. They're not necessarily actionable in and of themselves. We're trying to actually take this information and use this to improve onboard security posture. And the way we're doing this is to start with this by formulating a policy. And this policy is already up, but we're working on refining this and making it enforceable. But this will say things like, well, you don't get to add a repository to onboard unless it has peer code, peer review, peer review of code. It has version releases, release notes, testing, fuzzing, all this kind of thing. Or at least you don't get to add it to make a dependency of the core or things like robust extensions because having a policy like this is going to help control the growth in extensions. And it's going to allow us to have greater confidence in them. We probably have like, you know, grandfather in certain dependencies which don't quite match up to this standard. But where possible, this will also use this drive a policy around replacing these older dependencies. The other way we can make use of this information is by trying to use this to follow best practices ourselves when it comes to dependency management. And this includes providing a clear bill of materials, which is essentially what this dependency dashboard documentation does. And we're working on making this more complete over time, recently added support for API dependencies, and also doing and making sure we're using sharp pinning wherever possible. We've been doing this for a while for core dependencies, but some of the Python stuff only recently got hashes. And then we can maintain these dependencies and update them as needed in a regular cadence or as releases occur.  And a large part of our security story really rests on his shoulders. So with that, I'll hand it over to Michael. Thanks very much, Harvey. Yeah, so dependency maintenance has been an interesting journey for me. I actually went to one of the first envoy meetups that Matt Klein gave in the Bay Area sort of many years ago and became very intrigued with the project and sort of tried to jump in straight away. I'm not like a strong C++ programmer, but also I sort of thought, how can I add value here and really got interested in how do we maintain dependencies, maintain their currency throughout the project? And so I sort of started doing some of this work and I was thinking about how do I actually, how do I go about doing this? And so essentially what I've done over over the years is sort of build up a process around maintaining the dependencies and going to share that with you. Now, in terms of some of the dependencies get bumped through the natural course of development on invoice. So people are adding features and they require specific features that are in dependency versions or commits that we don't currently have in the project. And so those PRs will bump those specific dependencies and we go through the process validating those that Harvey went through before. But then there's just the regular maintenance. And that's largely what I've been doing. And so what I've done is built like a large RSS feed that tracks most of the dependencies. And when a new dependency gets added, there was actually another one added today. I actually modify my RSS feed and then I monitor the updates from releases and for where we have dependencies without releases, monitor the commits. And as they come through, I can open those, look at those, determine if we think we need to actually make a change, whether it's significant, whether we can skip the change. And that's sort of just built up over understanding where all the dependencies sit over time. And there is a link down the bottom there. There's a GitHub guest which has that RSS OPML feed for those that are interested in looking at these, the frequency of these updates. And then we've got some teams also that use bots that look at GitHub release emails as well. And they can actually turn those release emails that come out of releases or commits and modify their repos based on those watches. Next slide, Harvey. And so just quickly, here's like a table that lays out where all of the dependencies in the Envoy codebase are. There used to be more than this. We've actually been trying to consolidate the location of the dependencies. It used to be quite spread out. And so you can see that most of the heavy lifting for the core dependencies is in the Bazel repository locations file. And then we've got some API dependencies on the far top left in those Bazel files. And then down below bottom right, we have some of the other test categories. And then the Python pip installs that we do that we do also. And as Harvey mentioned, we've just recently added a char pinning for those as well. Next slide. And so what I want to talk about here is how to actually go about testing these dependencies. And so what I found over time is that quite a few of these dependencies can be relatively volatile. So in terms of in between commits and even version changes, their interaction with the Envoy codebase can change, APIs change.  So they require a lot of testing. And so I do all this sort of testing locally. I run Linux x86 64 bit environment, an arm 64 environment, and then Mac OS as well. And I found having these multiple architectures also really helps with the testing speed and quality as well, because I can find a platform specific issues before PRs are raised, and we sort of kick off the CI jobs that test the pool requests. Another key thing here is that I don't rely on Docker for any of this. I've got into Twitter flights with people about this. But I generally find that when you're adding Docker, it either slows you down or just adds another layer of abstraction, if you like, that can make this sort of testing more difficult. So what that meant up until recently, Bazel 3.5.0, I was actually compiling Bazel from source on my Raspberry Pi 4. So I do all this for arm 64 on a Raspberry Pi 4. Next slide, please. And so what are some of the tools that I use to go through this process? So mainly this refers to how do we generate the shards that we use to pin against in the build process. So the first one is just shards 256 sum. That's just a Linux tool that's very freely available. And essentially what we're doing here is just downloading dependencies out of GitHub or wherever the source of the dependency is. You just run that against the tool and generate the shard. Then that goes into the metadata that Harvey showed before that is used to verify as part of the build process. We just added the same requirements for the PIP installs. We use a tool there called hashen. And essentially you run that against a requirements.text file passing in the dependencies and it generates the shards there. I actually think that this is actually fairly important. So the integrity of our docs is important to us as well. So we don't want anything that has the ability to modify or interrupt that sort of quality of the doc side as well. So we think that these additional hashers are important here as well. Then the last one, this is API only. This is some of the Go modules. And I've had a really hard time working on how to generate these sums. And I've tried everything from custom Go.mod files to playing around with the Go command line tools. And what I've resorted to now is I find the version bump in my RSS file. I then bump the version number, then run a test and have it fail, which generates the actual correct sum that I can then put into my testing. So I'm not ideal, so I open any suggestions there on how to auto generate the Go modules, sums and hashes. Next slide. So what I wanted to talk about here is strategies to minimize your supply chain. So what that is is how do we actually minimize the dependency lines of code in your binary. And I can feel very confident saying that there are many extensions that Harvey showed before that you don't use or won't need to use as part of your envoy deployment. And so the current images are currently built as what's called a kitchen sink image. That is that they have all of the extensions enabled as part of the build process. And so why kitchen is misspelled there is that if you actually look at that issue, Matt Klein actually misspelled the word kitchen sink. And whenever I would try and go back and find reference to kitchen sink, I remembered it by knowing it was misspelled and searching for kitchen without a T. And so the way to, there's a couple of strategies here on how to minimize your envoy binary here. The first one is a custom dot baselar C file. There's a link there that show, link to the documentation on how to do this. But essentially it gives you a way of disabling certain features of the envoy binary as you build it. So an example here is hot restart. There's quite a few scenarios where you don't need to require hot restart. It's a fairly sort of complicated feature. You can just disable that out of the actual source code out of the build profile to reduce that feature. And then secondly, and this is probably the biggest bang for the buck is compiling out extensions. This is where there is a fairly large extension definition file. And even that you can actually just comment out or remove the extensions that you don't require. Some examples here is ALTS. That's a protocol that you don't need to use if you're not running on GCP, for example. Another example here out of a list of many is double the double double RPC protocol. And then this can go on for all of the different types of extension types, whether it be observability, data dog versus light step or database filters is a very large list here. So you'll find that you'll be able to significantly reduce your exposure to the extensions via this method. And then lastly, for the teams that are actually importing envoy into their internal repos, you can actually using tools like copy barra actually delete the extensions out of the source tree, rewrite the basal files and essentially take those extensions out of your import. So you end up with the much slimmer and streamlined envoy source code base. And so with all of these all of these methods can be combined. You can really reduce your build times and more importantly, reduce your exposure to the dependency supply chain. And so this is the last slide here. Just to point out, there's multiple ways to maintain these dependencies. So it's not certainly not one size fits all. And so you can either rely on upstream envoy to maintain and track those dependencies for you, both the consuming projects. You can rely on your local package management systems, the ARM app, and there's a variety of other ones as well. Or you can actually maintain your own versions and override the dependencies in the workspace in the root of the envoy repo. So many different approaches here depending on your needs, your sophistication, and your requirements. That's it. Back to you, Harvey. Okay, I think we're done and we're happy to take any questions. Thanks. Hey, Michael. Yeah, happy to answer any questions or talk about envoy dependencies or supply chain, or generally, if there are any questions. I fear that this is not as exciting as some of the other tracks, Harvey. Oh, okay. Well, I think that's why it's super exciting. So do I. So do I. All my other stuff in there. But yeah, we can hang out a few seconds. Otherwise, I think maybe we can just leave our Twitter and email addresses for folks to reach out to. Okay. Yeah. And that one's for you, Michael. Yeah. Do we have to make many changes to dependencies? Yes, quite often. So we often where there are, what we try and minimize is carrying patches. So if you look at the actual envoy code base, you'll see that there is quite a few dependencies that actually have patch files. And that's where Harvey and I are both committed to try and reduce or eliminate those patches. So we often go back to the upstream dependencies and ask for them to make changes. Sometimes that's easy because they're controlled by friends of envoy, in particular Google and others. Sometimes that's more difficult. But yeah, we often have to make changes to dependencies as we bring them in. Yeah. I mean, yeah. Yeah, I think that that's pretty much it. I was just going to stop you to this other question that came up from Matt, which is, I know, how does supply to other projects? And sort of as an industry problem, I think, yeah, I think it's well recognized that supply chains are big problem in open source specifically. And GitHub and a number of other organizations have an initiative called OSSF, I think it's called OSSF, something like that. Anyway, they're basically planning to put together a scorecard, which will allow us to get an idea of what qualifies as, you know, for example, a good dependency versus a bad dependency. And in terms of trying to like, you know, audit the supply chain, like the kinds of things we did in this exercise and making sure you're not out of date and scanning for CVEs. Yeah, thanks, Brian. That's the link. There's actually a lot of tooling in out there, which does us today, some of companies whose business that this is, is to scan your project for this, but they mostly work with managed languages or languages with manifest files. So Python, Node.js, Ruby, even Rust. Unfortunately, there's no standardized C or C++ format for this. And so we're essentially having to make things up and build our own tooling as we go because C and C++ are sort of like the less popular languages ones, which folks aren't as interested in building standardized solutions. And what it's just finally really hard to do. So yeah, that's kind of where we're at right now. But we do plan on like, you know, sharing what we've been doing on where once we're, I guess, in a little more of a final state and a blog about that. We are also doing some work to integrate the CodeQL capability of GitHub. There's been some initial work there as well, so doing sort of additional scanning. That doesn't reply to our dependencies, unfortunately. So that's true. And it is already slow enough that you can get it to run fully on all more. It's kind of a bit of a problem. There was also a question from Fabrizio about there are some documented is there any documentation on how to actually minimize the build? And I don't think we actually have a good guide there. So I think opening an issue around that or I can do that actually, or country and PR would be very useful because I think it's obvious that then reduce the number of extensions you have compiled in. And most folks aren't quite clear on what that is. So she gets back to a point Matt made in one of the earlier talks, which is having profiles like a minimal profile secure profile. And we are actually opt out most extensions by default in the build will probably be advantageous. Yeah, I can I can I've documented some of this internally, but I'm happy to help out there and sort of write up a more concise guide about how to go through binary minimization. Okay, great. Thanks. I think we're out of time now. Thanks everyone for listening and all the great questions. Thank you very much.


me and ladies and gentlemen now to begin this evening I would once again invite Mr. Anurag Bhattra Chairman and Editor-in-Chief Exchange for Media and PW Business World to please say a few words to all of you. Good evening I won't make a long speech I just want to welcome all of you the awardees and the nominees I just want to again re-emphasize the point I said in the morning that our awards are jury-led awards and I can see Mr. Gurmeet Singh who's the Chairman of the jury and who's the Chairman and Managing Director of Johnson Controls in Kitachi Air Conditioning our awards are a lot about jury we can improve in the process in the quality of entries I got specific feedback all that we can improve and every year we try and do that but one thing our jury chair and other jury members I see some other jury members in the audience will tell you that our jury decisions are final we have no agenda we don't have a say in who wins except being custodians of the process in that way we are the most honest incredible award we have no influence Mr. Singh you were there in the jury I was not even there in the jury so I just want to congratulate our jury chair and our jury members for putting in the hard work that they did to arrive at the winner so I want you to give a big round of applause for the jury members and the jury chair so I just don't as I said I won't make a long speech I look forward to celebrating the winners tonight and I hope the work that these winners are doing inspires others to do good work and deliver ROI and stickiness to the brands that you leave God bless you thank you


Since early 2020, scientists have discovered much about COVID-19, how it develops, how it spreads and how to fight it, but much more remains to be learned, as millions of individuals are still at risk of contracting the disease. Researchers at the Dasman Diabetes Institute in Kuwait are working to understand the risks COVID-19 poses for people living with diabetes. With nearly one in five people in Kuwait diagnosed with diabetes, researchers at DDI are uniquely positioned to explore the intersection of COVID and diabetes, and provide recommendations that could help save lives. Research has shown that people with diabetes mellitus, severe obesity, heart disease and hypertension are more likely to become infected with and die from COVID-19. In fact, among elderly patients who are at higher risk of death from the disease, more than a quarter have diabetes mellitus. While the reasons for this increased risk aren't entirely clear, researchers at DDI are exploring various possible factors. One is the increased expression of proteins that enable the coronavirus that causes COVID-19 to gain a foothold in the body. For example, high expression of the protein H2 in the lungs, kidney, heart and pancreas is believed to enhance binding of the coronavirus. Close to home, researchers at the DDI are also looking at the clinical characteristics and outcomes common among patients in Kuwait, affected by both COVID-19 and diabetes. One study showed that compared with patients without diabetes, patients with diabetes had a higher rate of admission to ICUs, higher mortality, a higher prevalence of comorbidities such as hypertension and a higher incidence of complications. In addition, clinical data from Jabba Hospital argue for strict glucose management on admission, as even a small increase within the normal range of fasting blood glucose was associated with a substantial increase in risk of ICU admission for COVID-19 patients. DDI is also leading a multi-center clinical trial to test whether the diabetes drug Pyoglitazone brand name GLaDOS can improve symptoms of COVID-19. In addition to improving glycemic control in patients with diabetes, GLaDOS suppresses inflammation and reduces the risk of heart attack and stroke. These properties could help reduce the severity of symptoms in patients with COVID-19. As vaccines against COVID-19 become more widely available, the effects on people with diabetes require close attention. These individuals have an immune system characterized by chronic low-grade inflammation that can make their response to vaccination different from that of healthy people. To better understand this issue, DDI has designed a prospective study to measure immune cells and molecules and coronavirus antibodies in vaccinated people with these morbidities and compare them with those of healthy people. As more data pours in, researchers at the Daswan Diabetes Institute are learning more about the risks and complications that people with diabetes face amid the COVID-19 pandemic. The insights gained at home and abroad could help patients and clinicians around the globe better prepare for those risks and develop more effective treatment plans.


Wynston to throw it under pressure as the ball knocked out of his hands it's floating around it's a bumble it's a fight it's a scrap back at the 36 Harold Landry who has it it was batted up in the air and Landry fighting Watford is able to win it at the 36


in the sense, we have a creative person on the panel. Not that you don't have business sense, I'm not saying that. We have a brand owner, and a business person, and we have a media and tech player, right? So a media owner, a brand owner, and a creative leader. So really they represent three different sides of the business, a part of the ecosystem. Let me start with Deepak. Deepak, there's a lot of talk of digital transformation of businesses, right? The usage of AR, VR, and I'm not talking communication. I'm talking in supply chain. I'm talking in research. I'm talking in communication. I'm talking in terms of crowdsourcing of ideas. Tell us what you're doing in Mondales to kind of be future ready for the next 10 years, 15 years. Hello, good evening everybody, and thanks, Amrak. This is a very, very big question. So let me start with a joke around this. So two years ago, we didn't know the D of digital, to be very honest. I went for one workshop with a consultant, and I got really shell shocked about seeing what things are happening there. So we said we must come and make a digital strategy. We drew up a page on strategy. After three months, we figured out it was outdated, we tore it apart. After six months, we realized we have version two, which also didn't work. Some in substance of it, what we realized is that it is about getting something out there. It is not about waiting for the very, very big idea to happen. And this is not something which will touch only digital marketing. It is not something that will touch only the front end.  So we just changed our thinking. We said, okay, instead of having a chief digital officer, why don't we have digital ambassadors? So all our leadership team said, at that time I didn't even know what's the full form of IoT. Yeah, so connected devices, okay, great. So I heard one of the gentlemen in... India on top. India on top, yeah, there you go. So I heard this famous quote. The amazing thing that I heard was this gentleman was the CEO for a white goods company. He said, you know, I have placed a camera in my fridge. It will not be, it will be very simple, not to do it, but having placed it, I don't know what it's gonna do for me. So we started in all places, and I think, you know, today where we are, we have something going in sales, something going in marketing, something going in our factories, something going in our supply chain, something going for our employees. Let me talk about what we did in the factory. So this entire thing about connected devices. So one of our factory street city, right now all equipments, all machines are digitally integrated. So the integrated digital factory. So we get on one console, every parameter of every machine. So instead of having 10 people manning one machine, there's one console which can man almost everything. This is how you get connected devices to like. The other big thing is pretty, learning. So we've got sensors in all these machines. We have a lot of data, we don't know what to do with it, but someday in life we'll tell us, if the pressure is so much, if the vibration is so much, the machine will fail. So we'll move from annual maintenance to a predictive maintenance kind of a mode. We still haven't moved, but at least we started a journey. And we don't even know how long it'll take. Version 2.0, maybe version 20.0 we'll get there. Likewise in sales, we have 600,000 villages. How do you know which one to sell to? But then you can be smart, like using the open stock architecture, like Uber or Ola use. There's GPS, there's a Google map, there's big data out there. You can figure out from the maps so how many villages have a metal road, how many electrified. So there's so much that you can do out there. So I think we're touching every field. There's not one function today, which I can say has been laggard in our department. But we haven't cracked it all. It's just a start. And when I met Mr. Mehta, and I talked to him at the marketing white book, and he talked about how fantastic HUL is doing and which it is doing. It shows in the confidence they have and the confidence the shareholders have. But he said, I said you haven't mentioned a word called Patanjali. Now I know since last year, the growth of Patanjali has peated out, relatively speaking. Now Patanjali is an example of a newcomer of an outsider who's playing by unconventional rules, who has advantages that other players don't have. We really work in this hookah world. Tell us two, three disruptions that you fear that may kind of take your business in a direction that you don't want it to. I mean, if I knew, I would be solving for it. But honestly, the disruptions are disruptions and they happen, right? So today, let me tell you what is the thing that we can learn from. So if a dollar share company happened, right? Of course. You can't say that there won't be a similar in the chocolate world, right? So we don't know what it's going to be. Chocolate for weight loss. Now, okay, that's... Okay, that's an instruction, brilliant. So now I think you need to join the team that we have. So what we have put out is a bunch of teams and senior leaderships, each of them with a mandate, saying that, listen, you are a disruptor, this is Halo, this is Winning in many India's and all those various kinds of stuff. So there's one team actually working, going out there saying, we don't know what to find, but we want to know who will disrupt and how. But what keeps you awake at night?  But what keeps you awake? That's one thing that keeps people clear of wake-up. Part of the fact is reading or answering mail or having conference calls. Yeah, since you called me a brand guy, so I think whose brand will it be? And this is something that has been bothering us for a while now. So if you look at what's happening, and there's a story that I told in one of the other meetings, I'm right where you were there, right? So nothing enters my house unless my wife knows the brand, correct? So only trust is what finds its way in. One day I saw her in the evening, she showed me a screen saying, what do you think about these shoes? I said, they look good, which brand is it? She said, how does it matter, it's sold on Amazon. That's a huge insight. The day a retailer's brand becomes the brand, because what they have delivered is trust, correct? So the one thing that I would really like to keep in my mind is this is my own wife, correct? And I'm sitting with her almost every day. So it sort of brings you to life, saying that you know, the reality check to say, listen, there could be a disruption like this. By the way, the anniversary issue of impact is the trust issue. Last year was the good luck issue. This year is the trust issue, and hopefully tomorrow I'll write my piece for impact. Coming to you, Prasoon, you know, since the time I entered this profession and for the last 18 years that I've been part of Exchange for Media, been talking of Madison Avenue, Silicon Valley, and Hollywood coming together. So let's say you are Hollywood, you look like Guy from Hollywood. He is Madison Avenue because he's talking of brand, and he's clearly Silicon Valley. Tell me, is it really manifesting when you create communication, you create ad, do you create ads still for TV? I know Rajan's company is a digital company, but it still advertises a lot on television. You know, almost every player in digital advertises a lot on television. So tell us, you now make ads for digital, you make ads for television. And how is this real convergence of Silicon Valley, Madison Avenue, Hollywood happening in India? I must tell you, Anurag Kashyap, sorry, Patra. It's even. I should give it back. No, you know, making a commercial has got nothing to do with whether you're doing it for digital or not. So making a commercial is a painting. You could paint on canvas, you could paint on a wall, you could paint on paper. When a lot of people come to us and say, are you making a digital commercial? And I tell them, you know, I can't understand the question. So a lot of stuff that I do, it is the same commercial that is playing on television, that is playing in a movie hall. Which is your favorite medium? No, I think it's a question of who am I talking to? So that will decide which is my favorite medium. Now there are certain opportunities in each medium. And so if I knew that a client of mine is going only digital, then I know only digital has a certain encatchment. Yeah, and it has its own opportunity, its own pitfalls also, you know. So there's a screen size, you know, if I'm doing it actually for cinema, I'm actually utilizing, you know, six point, you know, whatever sound, okay? I'm not doing that to your, you know, to whatever is going digital. I'm also aware of the screen size and stuff like that. But these are minor, you know, issues. The main issue is, how do I grab the audience? And that's a creative issue. So that is where we are involved really only with the painting, you know.  I'll get a different kind of oil for it. But that is an aorta of what we do. Okay, let me take you back to a conversation I had with Piyush 10 years back, he was at an event like this, and there was a talk about market research and Piyush said, you know, market research is fine. But I talk to people, I go to villages, I talk to the consumer. Fine was a very kind word he used, you know, normally he uses. Yeah, I mean, I know, I remember what he said, but he kind of trashed it and said, that's for people who don't know what's happening in the market. But today you have data, and data doesn't lie. And friends, there are companies that can predict elections, there are companies that can predict the sales of a company, they can predict almost anything. And second is, Deepak talked about this, know and phenomena, you know.  How do you factor that when you create that pain thing? Okay, there are two parts to this. On research, I too have very scant respect for it, okay. Because I do not know, not just in India, since you use that example, not just in India, world over, you tell me one election prediction which got it absolutely right. Arvind Kejral won't be the next Prime Minister of India, I promise you, I know that. So that, you're not doing a data research, your heart tells you what is happening, okay. You, if you are sharp enough, I think, I genuinely believe, and they'll beat me up for it, okay, immediately after this chat, I genuinely believe. I'm not going to. Most of research is basically stuff material to cover your backside if you have no gut feeling. So you will get promoted in life, you will get promoted any which way, even if your campaign fails as long as you can say, I researched it and it worked well, okay. So nobody's going to demote you. So you've lost your gut, you know. What is it that you believe in? If you go with gut and your belief will come, if you roam around in the market, if you see what people are doing, most of the work that we do is observations of life.  And in fact, what I'm watching is also being depicted in my commercials. Data. It'll ensure that you don't lose your job, you know. But typically- You're being cynical, but can you talk to lots of people in the private equity business? You know, the best commercials that we've done, and a lot of my clients ask me, how can we do Fevicol kind of work, okay.  I said, that's brilliant.  No wonder I've not had vodka in my life. And Madhukar Parek says, let's make it, and we make it. Okay, that's how I call it. Between three people, you know what is going to work, okay. You're not saying, let me research it, I'll ask 15 people, I'll ask 10 people.  And I said, now why do you want to release it? Let's write something new, because in one year, you've gone personally and shown it to the entire bloody country. They've already seen it, but they haven't shown it yet. So we'll come back to you on this human versus technology. Rajan, while you went to MIT, you work with technology companies, you work with Dell, you work with Microsoft, you do a fair amount of angel investment across sectors. You see lots of business plans, you see lots of ideas, you see lots of entrepreneurs, apart from seeing the data from what Google throws up. Tell us three predictions for the future. Rajan and Nandan's three predictions for the future. Three predictions for the future. Well, if I could really get them right, I wouldn't be here. You got some of them right, that's where you're at. No, I mean, I don't know actually. Look, I think, let me maybe focus on technology, because that's sort of what I tend to focus on. I think the first is AI and machine learning will actually impact every industry and everything that we do. Give us an example. Last week, Alphabet, which is Google's holding company, launched the world's first driverless taxi service. So in one city in the US now, you can pretty much order your taxi and it'll show up without a driver. So what's going on there is it's the first true application of artificial intelligence and really things like sensors and IoT and so on and so forth to an entire industry where this is a fundamentally different kind of car because this car pretty much drives itself. You don't need a human. And it actually goes back to what can machines do better than humans? See, so far, machines actually, as of today, right, December 7th, 2018, machines now can actually do a lot of things better than humans. One thing we're still quite a ways away from is what he does really well, which is creativity. And if you think about the act of driving, you don't need to be a creative genius to drive. So what the machine has done over a period of years, millions of miles of driving is machine has learned how to drive, machine can recognize, computer vision can recognize a cat from a dog, computer vision can actually recognize that's a child that's about to cross the street. So that's just in the auto industry. And you can go through industry after industry. So we do think that AI and machine learning will dramatically impact industries. And eventually, we don't know whether it's five or 10 years from now. Today, by the way, you know, you can listen to music. It's not mainstream yet, but the music may actually have been composed by a machine. That's done. Right now, the best composers are still composing music that's much better than machines can, because in many ways it's still a creative view. So that's, I think that's the first thing. I think the second one really is genomics and gene therapy. I think you open by saying you'd like to be like him. I think we're a few years away. Actually, that's a solvable problem. Maybe like Anurag Kashyap now. No, but you can certainly, you know, like, I don't know whether you all read, but the first gene-edited baby was born in China, right? So maybe Anurag, maybe the two of you won't look alike, but theoretically in a few years, if you really wanted to, you could make a baby that kind of looked like him and acted like him with his voice. And actually, maybe you could get his voice. I don't know about the rest of the, you know, because it's real. That's very disappointing. No, I know, I know, but, you know, but maybe you like the self, you just want his voice, right? We could gene-edit your voice. So I think that's another big thing, right? So I think life sciences will go a long way. And by the way, just coming back to machines, today computers can actually, so you know, there's technologies that have been built where just by looking at your retina, you can predict, the machine can predict whether you're going to get diabetes or not. Today, the machine can do that better than any ophthalmologist in the world, right? Because of millions of pattern recognition, you see all the little changes and boom, you're going to actually get diabetes. So that's just an example. So I think- For example, there are companies using AI to predict the, if there's no natural disaster, to predict the age of a person because they look at the, you know, position, they look at body markers, they look at past data, so they can, with a lot of accuracy, and that is being used to calculate insurance premium. So AI is getting used in ways that it wasn't used earlier. Yeah, absolutely. So I think, so life sciences I think will be, will be a massive change, right? And I think the third one really is as, and there's a huge debate going on with this, right? What happens 10 or 15 years from now? As technology is able to produce more food than the world needs, as technology dramatically brings the cost of energy down and so on and so forth, right? What do people do?  And I think you're going to start seeing new kinds of, you know, what I call social models developing in the world, which none of us can really predict today. I mean, there are different points of view of how this could evolve. But you know, the way we think about life today, I think is going to pretty dramatically change, and that third one really is a confluence of everything, right? So today the reality is, there's a Kleiner Perkins funded company that makes burgers out of vegetables that taste better than burgers. Wow, that's cool, right? For those of you that, you know, for whatever sort of reasons, don't really want to- I don't eat burgers, okay? Let me tell you that. No, I know. I mean, I think- Isn't it banned here anyway? I mean, is it banned in this state? I don't know, is it banned in this state? I don't know. There are some states that have banned it anyway, so you can't have it. But hey, guess what? Now you can. Because actually it's made out of vegetables, right? So you know, like everything is changing, and it's changing at a accelerated pace. You know, Rajan, we love Google, we love the tech companies because they're really making things happen that weren't possible, and there are lots of positive things there. But let me take a technology insider, a technology leader, a technology entrepreneur from Silicon Valley. He recently said, and he talked about social media. He said, Facebook is the new cigarette. It's killing people. He talked about social media's impact on children, on society, on relationships, on health, on focus, and then there are concerns about technology players using data. What do you have to say? Because you're at a seat where you see what's happening, what's good, what's not good. How do you keep up with these challenges? And I'm not just talking about Google. I'm talking of there's this huge push to regulate big technology players in Europe, now in America. Tell us, what do you think about it? I don't work for Google, so... Yeah, no, I mean, look, I think, look, you know, at a very fundamental level, right? It's very important that we make sure that technology is used for good and improving mankind as opposed to not, right? I mean, and I think this is a very, very important discussion and debate, and I kind of break it down to a couple of different things, right? One, you mentioned privacy. How do you make sure that, you know, all your data is held private, right? So, and I think there's a huge responsibility on platforms like Google and others to make sure that we're keeping your data private, right? And if you just look at Google, our principle is you should control your data. I don't know how many of you know this because I'm surprised how few people know. You can actually go to my account at Google, you can go to, and pretty much you can, you know exactly what data Google has on you. The signups. You can go to, yeah, no, and actually, you can figure out all the data that Google has on you, and then if you decide, look, I don't want Google to have any of this data, you can just wipe it out. Or you can say, I wanna take this data from Google to some other platform, you can port it instantly, right? You can say, Google, I don't want you to collect these kinds of data. So being able to give users the ability to control their data is very, very important, right? Secondly, it's very important that platforms, right, take even more care not to actually use data in ways that they shouldn't be used, right? We've seen a whole set of examples over the last year or so, so that's one. I think second is tech, you know, there's a big movement now called tech for good, right? So if you look at the reality is there are segments of society, so take the highly connected young who are probably spending more time online, right? So for instance, there are a bunch of companies including Google where we are now actually really developing technology. So you should be able to say, look, after eight o'clock, I don't want notifications, right? Or if you, you know, you should have settings for your kids that says after eight o'clock, the network just shuts down or your connectivity shuts down, right? But again, it's up to you, but how do we make it super simple for parents to be able to moderate the online behavior of their children, right? So you'll see a lot more happening there. So for instance, you know, you might say, look, I'm most creative, actually, I'm probably creative all day, but you might say, look, I'm most creative between six p.m. and, you know, three a.m. Or whenever I'm having vodka. Yeah, whenever I'm having vodka, right? We have two p.m. How do I tell the machine that I don't want these sets of things? I don't want any phone calls, I don't want any notifications, I don't want, you know, et cetera, et cetera, right? So I think that's sort of the second big thing.  And you know this, you know, social media is, you know, Google is not social media in sense, but it's big, it's bigger than anything else. What about people today? Media like yours, platforms, whatever, are being used to slander people, anonymous content being put. What are you doing to deal with that? You know, because today, if something shows up in Google search, it can impact somebody's job, it can impact somebody. And the source may be entirely malicious. And how do you make sure once it's gone, but it wasn't true? So how do you update that? Yeah, no, so I think look, you know, high quality content and not having content that's illegal content that, you know, fake content and so on and so forth. I think that's very, very important. Look, so we are doing a whole set of things, right? So about, I think in 2017, we had a whole set of issues on YouTube, for instance, advertisers were worried that their content was showing up against content that shouldn't be shown, you know, whether it's extremism, extremism and so on and so forth. So we've actually gone now, you know, massively what we're trying to do is use technology process and people, right? To flag content that is not desirable and we've got, you know, 20 classifications of type of content that is not desirable. We then let the machine sort of flag that content, then we have human reviewers. We actually have 10,000 people around the world that actually all they do is just review content, right? And the review content to just understand whether this is content that's not desirable, does it violate local laws, et cetera, et cetera. So that's a third thing, right? And the third one really is process. We're trying to make it much easier.  We wanna make it easier for you to flag it and then build the infrastructure and capability within Google to be able to review it and so on and so forth. So those are the sets of things we're doing ourselves. But then we're also actually doing a lot of work to train journalists. So in India actually we are training 8,000 journalists on exactly this topic, right? How do you actually make sure that when you, you know, how do you write content that's good and then how do you actually use technology to, you know, we have an initiative called Google News Initiative. We've committed to invest $300 million in independent quality journalism, in training journalists and a whole bunch of other things. So it is a very, very important point. You know, you started with something that I wanna clarify. We are a technology company, not a media company. Because you do realize, we don't actually make media. So that's why Murdoch is selling. That's why Indian media owners are selling, right? Technology gets you higher valuation. Look, advertising is a revenue model, but it's actually a very important difference, right? We are a platform for content creators to reach the world, to give creators a voice. We have a revenue model called advertising. You also have a revenue model called cloud. Eventually we'll have revenue models around consumers paying for subscriptions. We'll have, you know, so those are all revenue models, but at the core of it we are a tech company and I wanna clarify that. Sure, tech company has valuations and tech company has a certain halo. I just wanna end this because we really wanna announce the impact person of the earth. But two questions and I want short answer. One, what would Rajan Anandan be doing three, five years from now? Would he still be at Google, or would he have, he would have turned in an entrepreneur? You made so much investment. I know you said it is your eighth year and every day you look forward to going. Look, I love what I do, right? I think in life it's very important to do what you really love. And I love technology and I love the idea of getting people online. And so one thing you can guarantee, not three or five years from now, 40 years from now, because I'm hoping, you know, gene therapy and all that kind of helps and works in our favor.  Fantastic. And if you had to choose the impact person of the earth from the other eight nominees, who would that be? I would choose all of them actually. I don't even know why you pick one. Why do you pick all of them? It's an old idea, you know? Just pick one. If you had to choose one, I know. I mean, I really want one. If exclude yourself and out of the other eight, who would you choose? Look, I don't think it's fair because I'm not, I don't know, I didn't, I don't know all the things. Are you standing for election? I pick Deepak. I pick Deepak. Okay. Deepak, what would Deepak Ayer be doing three to five years from now? I wish I would be in a beach with nothing to do but then unfortunately we still have to work for our bread and butter. So, as we call it, chocolate is my bread and butter right now. 17 years I sold Pepsi. Two and a half years I sold Wrigley chewing gum and some good candies. Two and a half years I'm selling this amazing chocolate called Cadbury's. So all the three things I like, I'm sure it's going to be a thing that I like. That's exactly what I do, selling moments of joy, right? So that's what you would like to do, create moments of joy. Fantastic.  Rajan. Prasoon, we'll get these two questions for you. What would you be doing three years from now? I'd be creating. Babies or reverse? No, no, so I'd be, if I'm not doing films, I'd be creating something, you know? Because that's what we do. Sure. And who would be your choice for the impact person of the earth? Deepak and I struck a deal, so Deepak. Okay. Clearly it's the client always at the last laugh out of three, two votes for Deepak, one vote for Rajan and no votes for Prasoon Joshi.  We'll figure this out in a while. But please give our impact person of the earth nominees a big round of applause. Thank you so much. That was good fun.