Seriously, you can't sit down. There's at least like six or seven seats on this side. There's a couple up in the front. Shuffle in, squeeze in. So I totally thought this started at 140, and there was like four people here. I was like, great, we'll just have a little private Q&A. No, I have to give the talk now. It's all right. How many of you saw me speak two hours ago? Okay, how many of you know who I am? The same people. All right, that's not helpful. My name is Joshua McKenty. I was the lead architect of the team at NASA that built Nova. The first launch of OpenStack was on my blog, well, pre-OpenStack, the first launch of some of the OpenStack source code was on my blog in May of 2010. So I've been doing OpenStack for four years, and it's only two years old. And I'm so over OpenStack now, I'm kidding. I just, I like to be thinking about what's next. And I gave a talk in July at OSCON, which I borrowed some of these slides from, that was about the future of computing and how that was happening inside OpenStack. But I wasn't very specific, and I thought I would come up with a few more specifics and talk about those specifics here, where it really matters. This is the strategy track. And I like the strategy track because it means I get to sort of say whatever I want. I don't have to prove it. It's a strategy. No, the, I've started using the term para-cloud to refer to breaking down the wall between infrastructure as a service and the things that happen above it. In the sense that para-virtualization is when the guest is aware that it's inside a hypervisor, because you can do all the right things. But the guest can't know that unless the hypervisor tells it. So this is, it's a funny tension, is to take advantage of para-virtualization, you need drivers and the guest, but you need support in the host. And to take advantage of para-cloud, you need to change everything in your infrastructure as a service layer so that the things that happen above it can take advantage of those changes. But to know what we need to change, we actually need a conversation between those two communities. So that's really the strategy behind this idea is that those two communities need to start to talk to each other. When I talk about performance, I am not talking about efficiency. I generally hate the idea of efficiency. Those of you who've heard me speak before, I always use this quote. Bustalakoff was one of the fathers of systems thinking. And the idea behind systems thinking is that in a complex system, the behavior of the whole system is much more dependent on the relationships between the components than the performance of any single component. But another way, if we spend all of our time optimizing a single component of OpenStack, OpenStack as a whole will get worse, not better. We need to optimize the connections between those components. We need to focus on the right things, doing the right things, instead of doing things in the right way. All right, so this idea of cloud-aware applications or breaking down the wall between, let's say, platform as a service, or infrastructure, orchestration, or automation, first off, why do we want this at all? Why would this be a good thing? Then what are the challenges in achieving it and what is our strategy to overcome those challenges? It's a very boring format for a talk. But this is the only slide that will make any sense. So that's okay. We'll still have a good time. For those of you who were there this morning, I did emphasize that I always offend somebody any time I open my mouth. And so I try and be an equal opportunity offender. I will try and offend all of you rather than just a few of you. Use the term elasticity very broadly. When we started talking about infrastructure as a service at NASA, the idea was that elasticity management was any tool that VMs for you, basically. So why would you want that? Well, your application is consuming a whole bunch of resources for a brief window of time. You need more VMs. Or it's not doing anything at all. Those VMs should be scaled back down. It doesn't have to be about load. Elasticity can also be in response to policy concerns. It can be in response to resource scarcity. In other words, I might scale your application down so that I can scale somebody else's application up, which is more important than yours. But any characteristic in your cloud infrastructure that should deal with scaling up and down the runtime components, not the resource pools. When we talk about the resource pools, we're talking about capacity management. So this is about the running processes. And this is my equation for elasticity. Told you this wouldn't make any sense. That's a spork, just for those of you who are not keenly aware. The best thing about a spork is you only have one. You have taken two utensils, and now you just have one utensil. So when you're camping, sporks are perfect. What you've done basically is you've taken the best parts of a spoon and the best parts of the fork and given it a single common interface. When we talk about elasticity management across a set of resources, what we're really talking about is generalizing the metaphor for those resources and their resource allocation in the same way that a spork generalizes the metaphor for a utensil. We take a spork and we combine it with web hooks. That is the web hooks logo. Most people who are not familiar with that logo, you should memorize it. It is going to become more and more important. Web hooks encapsulates everything that we learned about scaling infrastructure in the last 20 years, starting with email. Email lessons, we have RSS lessons, we have dealing with mobile applications, we have dealing with large-scale infrastructure. And what we learned is that push is better. Generally speaking, polling is expensive and retarded. I did this in OSCON too, sorry. I will apologize for what I said in OSCON, which was to use the term retarded in the mechanical sense of it is slowed down. It is at throttle at low. So polling produces a whole bunch of traffic for zero results most of the time. It's like a guaranteed cash miss. Push notification is, hey, the notifying instrument knows that something has happened. That is the only time notification goes out. Web hooks is based on the idea of using push notification as a basic primitive in systems design. That's what it's for. If you combine this idea of reducing the abstractions, getting to a common interface, with this idea of push-based notification, you end up with the platform for elasticity. That's a very complicated way of talking about this. So let me come to some different metaphors. We'll attack this one statement in a lot of different ways. When I was in Europe, shortly after the OpenStack launch, we were building a large cloud system for modeling earthquakes at a global scale. Earthquake modeling was a thing called spatial correlation. It's really a way of figuring out if there's an earthquake that affects this whole city, and we have a lot of damage on this side of the city, or we're gonna have less damage on the other side of the city. Are these two spatial relationships correlated, and how, what variables control that? Earthquake science has chopped into two parts. There's the hazard calculation, which is how much does the ground shake, and the risk calculation, which is how many buildings fall down. Different groups of scientists, different communities, different conferences, different pieces of source code. And the challenge was, in order to do spatial correlation, we had to add features to the hazard calculations that the only people who benefited from were the folks doing the risk calculations. We had to get those two communities to talk to each other. We're the first people to do it. We have exactly the same challenge now in OpenStack, and I'll point out some really obvious examples. Let's say you've got an application running, and you need to add another web server, because the load has gone too high in one of your web servers, you need to spawn another one. Ideally, the host tells you, it tells the elasticity manager that load is high, because if the load spikes very dramatically, very quickly, the instance itself will die, and it will be unable to report it. If your network is totally saturated, your instance may not be able to tell you that your network is saturated, it has no bandwidth left. So typically we want out of band monitoring of our infrastructure, but that would basically say OpenStack needs to report other performance characteristics, IO bandwidth perhaps, to an arbitrary API. And let's say that that API is exposed to every orchestration tool, right scale, scaler, service mesh, dynamic ops and Stratus, you have it, that tier. We don't have that API because it's useless to the OpenStack community. We don't consume it. It's not an end user facing API, but we need it, and we need to work together with that orchestration community to build it. It's not just about load, but that's an easy example. This tug of war between the folks who need to consume the features and the folks who have to build the features is a challenging thing to overcome, but we have to get there. I mentioned Webhooks earlier, I just wanted to give you the logo and the chance to write down the name in case I was mispronouncing it. Jeff Lindsey was on our team at NASA when we first developed Nova, and this idea of Webhooks has always been in the project, but very poorly implemented. There's a notification framework that went in briefly in Nova, but we really need this to be part of the entire project from the ground up, preferably in OpenStack common if Mark is in here. Let me give another example of what you can do with a Webhook. And we prototyped this at NASA. Let's say you're gonna use Swift for enterprise document storage. It's a legitimate use case, we did a fair amount of that. You can use Swift as a backing to Microsoft products that everybody use. SharePoint, thank you. You can use it as a blob store for SharePoint. You can use it directly as a Fuse file system, you can just teach people how to use the API, you can use a jungle disk or whatever else connects to it. It's pretty trivial to set up Solar and Lucene to index everything that goes into Swift. All of a sudden you have a full document index for your entire enterprise document store. Okay, so far so good. It's actually even more trivial to write a Webhook into Solar that notifies you anytime a document is added to Swift that contains a single word. In other words, rather than searching the document once a day or once a week or once a month or whenever you happen to wanna do it, you just register a keyword with your document store and say anytime somebody saves a document with the word McKenty in it, I wanna know about it. That should be a feature of Swift. The same sense that anytime someone launches a instance from a disk image that I created, maybe I've put together, I don't know, Vision Workbench, I wrote some cool software for processing images and I've made it accessible to the whole company, but I'd love to know when somebody uses it. Callbacks are fun. It's like getting mail. I remember when getting mail was fun before it was all bills. In order for this to work, there are a bunch of places where we have to attack this and this one I wanted to point out in particular because I think this is a strategy that the community at large is working their way to. Of an instance, the idea of a disk image is a crappy abstraction. And I talked a lot in OzCon about that we need new metaphors. We have this idea that the thing that can be run by Nova is only disk images registered in glance and they're somehow different from snapshots which need to be registered separately so you could run them which are also different from maybe a tarball of a disk image that's sitting in Swift. That's a, or because the end user should be able to say, hey, if it's launchable, I wanna launch it. I don't wanna think about the rest of that. Take that away. Please hide that from me. Cinder is in a great position to work on this. We talked about this at the Cinder hack day when we were working on the API. This as a strategy, if it's launchable, I wanna run it. Please stop giving me configuration options. Software can detect what hypervisor this image was built for. Software can convert that disk image to run on a different hypervisor. It can convert from a raw to a KUKAO2 image to whatever. I should not have to think about it. The reason I have a picture of a cookbook up here is because we don't wanna go too far. How many of you cook at home? Those of you, you order fast food. And ordering fast food is essentially like launching a disk image. Totally pre-baked. It's got application state perfectly preserved. Ooh, it's got a hard-coded IP address and a hard-coded root password. So it's really only good for one thing. Fills me up quick. If you go the far extreme, you end up as Betty Crocker or Julia Childs and you make your own Hollandaise sauce.  The goal, the strategy for OpenStack should be the 10 second gourmet, right? The other way of thinking about this is there's a difference between preparation and configuration. And if you look at the tools we have in the ecosystem today, we have puppet, we have chef, we have juju, we have anyone missing configuration management tool of choice, CF Engine? Crowbar, thank you. Crowbar is a little different. Crowbar, and this is where we get into trouble. Crowbar is being used for hosts, not for guests. So I'm talking about the guests. What are we running in Nova? And the problem is we have the same set of tools for preparing those images as we do for configuring them at runtime. They're two different processes.  That's a different process from that last 10 seconds of boot time where I really wanna make sure it's up to date and I wanna make sure it's got the right IP address and I wanna make sure it's connected to the right auth server. There are a number of people in the community who have been attacking this problem from different angles. Yahoo, blueprints for runtime metadata. How do we actually get a communication channel between the guests and the OpenStack infrastructure that works in both directions and that is reasonably secure? So we inherited the metadata approach from AWS. It's not secure. It assumes any user who has access to the VM is an administrative user because it's an unsecured HTTP get. It's not read right so there's no way to use that to pass information back to OpenStack but it's got promise. It is HTTP. It is in the right place. It does solve this. How do we communicate between guest and host? We have to be able to do that in a way that's agnostic to the hypervisor we're using. So this idea of gourmet I'm gonna come back to in a minute. I know I can see in your eyes everyone's thinking that this is a solved problem. They're like oh we do that 007 agent. The problem with a secret agent is they always turn on you. You ever seen a 007 movie where somebody doesn't get turned? It happens in every film, right? An agent is a root kit. My co-founder Christopher McGowan is famous for having said that at the Austin Summit, the first OpenStack Summit, the first technical session, the first thing out of his mouth is that agents are root kits. But it's true. So if we're going to have root kits in our cloud, let's maybe be really, really careful about how many of them, which vendors they come from, what part of the infrastructure are they really? So we come back to this, how do we solve this push-pull, this tug-of-war between the infrastructure and the orchestration layer? We trust the infrastructure in a way that's probably appropriate. It's the bare metal tax and other things we should be worried about and we continue to work on them. But we should trust the infrastructure to tell us the state of our guests in ways that perhaps agents are not the best way to do. Now, we're never going to get to an agentless world. I just want you to think about that. And every time you install an agent in your guest, think of it as 007, right? What are the chances that at some point he will kill you? On that security front, by the way, Dreamhost, if there's anyone from Dreamhost in the room, has been working on the other end of that metadata communication challenge, which is read-write metadata blueprints from the Yahoo side, from the Dreamhost side, it's how do you actually create a secure channel at the launch of an instance? And I know Canonical solved this ages ago. It's called a CD, it's called ISO 9660, because at least we have ACLs on that inside the operating system. We can use that, and as this blueprint's been done, there's config drive that was landed. But as a strategy, as a community, we haven't looked at this as how do these pieces fit together to solve this problem? Actors in cloud computing, a job of specifying who the various actors are. We have what we called the five actor model at Piston. I just wanted to bring it up. Any time we're talking about who's using what piece of infrastructure, we need to think about that the end user of the application is not necessarily the user of the API. We have customers where the folks who are allowed to turn on instances to launch VMs are not allowed to log into them. That's a very legitimate, very common use case. The auditor of any cloud environment has a set of privileges they have to have about knowing where VMs are running. They're not allowed to log into them. They're probably not allowed to launch them. They're certainly not allowed to read the contents of the disk images, but they need to have a lot of lower level access. So we have end users, we have users, we have auditors, we have operators. The folks that actually create provisioned tenants. They may or may not have all sorts of privileges on that infrastructure, but most folks operating community clouds, certainly financial services, certainly genomics, would like to see the operators not have access to the guests, if possible. And it is possible.  You know, we're a vendor, we provide security patching as a service for folks running private clouds. We have a very complicated Chinese firewall relationship where they can only see those patches when they have said yes, we'll see patches from the Bastion hosts, right? But again, these are being built, some of these things are being built by vendors that really should be in OpenStack Core. And that being one, we did this with CloudPipe, which I know we submitted to OpenStack, which yes, it's a horrible implementation. It's still the right idea. Administratively controlled VMs as a first-class citizen in your infrastructure. Pretty damn useful. I want to emphasize here, and I emphasize this in OzCon, and I want to come back to this, it's part of the underlying philosophy for the OpenStack community is a posture of humility. We have not got a single thing right to start with. Not a single thing, right? But what we do is we're iterating towards good through a series of smaller and smaller mistakes. It is worth pointing out that handguns, tequila, and OpenStack are all roughly speaking from Texas. From Texas. Platform as a service and infrastructure as a service are first attempts, first approximations to encapsulate a couple of key ideas of how would you work with infrastructure in a future where you can provision it for yourself, where there are no middlemen. Replaced operators with very small shell scripts. And they are good ideas, but they are insufficient. They are too siloed. They are too separate. This is like when we started with storage and compute and storage was on a giant tape that we rolled in and out of the other room and we connected to our computer. It took us 30 years to get it all the way down to being on the CPU. But that's logical convergence. Get the storage and the computer as close together as possible. Where you have to go through the same thing now between platform as a service and infrastructure as a service. We've been working with the folks at VMware to get Cloud Foundry running on OpenStack. Partly because people want both. And it's a really common use case. Hey, we want AppDev. We want infrastructure and we want platform. Partly because people need both, there is no solution I've ever seen that can be done 100% in platform as a service. And yet I've never seen an infrastructure as a service deployment that wouldn't be better with platform available. They're incredibly complimentary, but we've got to get the wall down between them. Platform can't get any better without some support from the infrastructure. So the ask here, there's always an ask. There's always a hook. The ask is for the right people to help. My approach to strategy and OpenStack in the last two years has been to write very, very little code. Always ends up getting rewritten. To constantly find the right partners to drag into the community. And most of the folks that I have badgered into being involved, it took six to 12 months in a lot of cases. It takes a while for people to understand what's in it for them when I show up. And I'm like, I want you to put at least 10 people working full time for free on this thing that by the way I'm gonna sell. But trust me, it's a good idea. We've got a lot of the right partners now. Some of them are engaged. Some of them are not deeply enough engaged. So I'm really, this is a shout out to the orchestration community specifically. Chef guys, the puppet guys, right scales, the strategists, the service meshes, the dynamic ops, the scalers. Please stop fighting over the host. So we get another version of another set of recipes for deploying OpenStack on the bare metal. Okay, you're not contributing value. The guest is lonely out here. Let's focus on the guest. And by the way, there's like 100 times more guests than hosts. I don't know if you did the math, but like there's way more of them. So we need this community to work together. We need the orchestration folks to tell us what the API should look like. We know they need one. And we really need federated auth. Keystone is a great framework. It is not the tool that we need. I know Tim has been talking about what CERN's done, Active Directory, there are other folks presenting on SAML today. I have been pestering Microsoft and Centrify and Okta and others to get involved because they have the expertise and auth that OpenStack needs. If we try and reinvent single sign-on, we will shoot ourselves in the foot so badly. It has been done. So those folks are willing to come and help. We need to give them, we need to help them help us. All right, so my, again, the strategy in the strategy session is to find the right people who can be press ganged into building this thing and then try and communicate not at the detail what needs to be built, but at the vision, the problem we're trying to solve. The other thing is I'd like to point out again in that we always make mistakes. I was wrong in the specifics about every single partner. On every case, we went out like the quantum project, for instance, ton of folks involved. It's fantastic. When we started, I had no idea, in fact, I don't think anyone else had any idea, that Nasir was going to take such a leadership position. It didn't seem obvious at the time. It seems obvious in retrospect. It did not seem obvious at the time. My money was on someone else. I was happy to see Nasir involved. They were not the folks I was really pestering. I'm like, no, you gotta get involved in this. I've been wrong so far of Cinder as well. I did not expect Solid Fire to step up and be like, no, we got this. We're gonna put the time in, we're gonna do the work. So I totally expect to be wrong about who's gonna lead the charge in orchestration. And I'm saying this, if you have a play in that space and you wanna dive in and get deeply involved, please get deeply involved. But for the folks of you who I know are involved, you could bring a little more to the table. Okay, so the summary here is webhooks. I didn't really talk about why, but I think I sort of talked about why. If we don't have this as push-based infrastructure, if the infrastructure is not responsible for telling everyone else what's going on in the infrastructure, polling will kill us. We can't scale that and we can't secure it. Scheduling is a first-class concept. And the idea of the guest is a first-class concept. We can't build this one hypervisor at a time. We can't build message channels around some hypervisor-specific way of passing messages. We can't build this around a deployment-specific method of scheduling resources or launching more resources. We need these to be very general idea. That's what I threw in there just cause I'm addicted to a location placement of data and the relationship between storage and compute. It is, oh, central to what we're trying to do with OpenStack. Still such a second-class citizen. It's a really hard problem. It would be fun to get some folks who really understand data locality to help out in common. Let's not do this in Cinder. Let's not do this in Swift. Let's not do this weirdly enough in Nova. Let's do this in OpenStack Commons so we have one general approach to these problems. And then we launch all the things. This is gonna take a while. Strategy means I'm usually like five years off in my time estimates. I thought we would be done with OpenStack. When we launched OpenStack, Nova was like 6,000 lines of code. I think the code base, the whole thing is one and a quarter million, right? So this will take a while, but I think this is the right direction. It seems like if we get this right, like there's no point in having any other kind of, about webhooks that's so powerful conceptually. I'm not advocating a particular protocol. I'm advocating the approach. The approach is that the subscription is ad hoc. In other words, you've got an API, it's like, hey, I wanna hear about this and only this. In a sense, I get to register ahead of time for a very specific class of events. And you can think about this, let's say elasticity management. I only wanna know when an instance is over 80% CPU utilized, right? So I can specify that in the elasticity manager and let's say scaler. I can say just tell me when any instance in the infrastructure is over 80% utilized or tell me when any network segment in quantum is over 20% packet loss or X rate of, like whatever the event is, we don't have to be prescriptive ahead of time in terms of defining those. We can have a very broad spectrum of saying these are the kinds of events the infrastructure could generate. And we just, honestly getting collaboration happened between the orchestration folks and the infrastructure folks is going to be the hardest thing we do. So if we get that as generic as possible the first time through and we let both sides build on it for as many iterations as it takes to get to something great, later on it will be easier to perform. Sure, so the question's about SAML. I wasn't endorsing it. I was just mentioning there's a talk about it today scheduled. So somebody's done a SAML implementation for Keystone. We worked on it at NASA because it is a federal government requirement under U.S. EOS. It is a very heavyweight protocol.  Then we've been trying to make better single sign-on at the protocol level, at the concept level, for 20 years. SAML, like, most of the solutions are adjacent to the problem. They're not actually a central, they haven't attacked it squarely. So let's just work with LDAP. It's the best thing we got, we'll just make it work. I mean, how many of you have dealt with Active Directory in your life? Thank you very much, I know it's right after lunch so I'm glad you stayed awake.


social justice. If you're interested and you believe in teaching maths through open-ended collaborative discursive approaches and you want to make a difference to a children's life then you might be interested in this book. There's two premises behind the book. The first one is that providing students with meaningful context for applying mathematical concepts in real life can enhance their mathematical understanding and the second idea is that there are some social justice issues which you just can't understand unless you have a good mathematical understanding. So I've just talked to you about one of my favorite activities which is called counting the votes and this activity starts with a group of three very democratically minded friends. You want to go and see a film. There are five films at the cinema though and they can't decide which ones they're going to go and see so they decide to have a vote where they all express their preferences for the five films. The activity encourages students to discuss which would be the fairest film to go and see and it usually leads to lots of discussions around should you give more weight into a first preference or to avoiding a fifth preference film or should you try and come to some sort of consensus and it leads on nicely to introducing the idea of border points which is something that was introduced by a mathematician called Borda who was also a political scientist who came up with the idea of using mathematical sequences, arithmetical sequences, geometric sequences to try and determine the outcome of an election. So the link there between mathematics and social justice issue is really clear. So there are seven other projects in the book. Each one has several activities and they cover a wide range of things like measuring inequality, economists, economists and statisticians use things like Lorenz curves and the Gini coefficient to do that and it deals with those issues and things like fair trade and so on. There are also some really short accessible research articles that you'll find in between the projects. So I would really recommend having a look at this book. It will make you think differently about mathematics and it will make you appreciate just how strong a link there is between learning mathematics and learning social justice issues. Thank you.


TEFL New York City Our New York TEFL Tezal School is perfectly located for anyone who wants to study for their teaching certificate, while experiencing all that one of the world's most famous cities has to offer. Our Training Center's Midtown Manhattan location means that you will find all the main attractions at your doorstep, with some of the best entertainment and shopping in the city just a short hop away. Being out of a real English language school, our New York City course gives trainees the opportunity to hone their teaching skills on genuine language students. The school's 14 comfortable classrooms are fitted out with all you will need to teach successful lessons and to help with lesson preparation there is access to a very useful resource library, Wi-Fi Internet and a photocopier. To keep you refreshed on your breaks there are also tea and coffee making facilities available. The courses usually run during the third week of every month and classes are kept small to ensure that each trainee receives all the attention necessary from our dedicated and well qualified trainers. Combine this with the school's excellent facilities and fantastic location and it is easy to see why our New York City course is so popular with TEFL Tezal trainees.


Hi guys. Happy Halloween. It is a start of a new vlog. Thank you so much for being here. I really appreciate it. Hope you all are doing really well. It is Halloween. It is Monday. This is outfit is a whole live. Valerie got the old boom box out. How long has it been since you guys have seen a boom box? I mean, just look at that. Crazy, crazy. Sherry. Happy Halloween. Happy trick-or-treat. Yep. She's got her little boo shirt on. Mickey's not so scary Halloween party shirt. And we got the candy already for the kids.  They're so good. All right. It is Halloween night. We just had our first trick-or-treaters, but here's our little set up here. Valerie's working with the boom box. Sherry's keeping tally. So I said there are going to be 60 trick-or-treaters. Sherry said 75 and Valerie said 150. 150. Okay, so this is our lab and these are the instruments I need to know. I just wanted to show you guys. I'm not going to do like any close-ups, but anyway, yeah, crazy. And that's why I'm here early to look at them by myself and stuff. I'm going to get confused on these things because like there's a few that like have the handle and stuff, but the head's different. Anyway, yeah. Okay, so I haven't vlogged at all this week, which has been insane. So that's why you've just seen like a few clips from my phone, but I want to show you guys. I got a couple packages. So one is a FabLux package that I'm going to open later. The next package I have a gown and gloves. So I'm going to show you guys how to properly gown and glove yourself in a sterile field. So that'll be exciting. But first I'm going to go shower. I'll probably gown and glove probably on Friday when I get home. I don't know, but I definitely know right now I'm tired, but I just wanted to pick up the camera and say hey because it's been a while. All right, Valerie and I are going to a rotary meeting. We are. Yeah. And I changed out of the scrubs into this outfit. So I'm just wearing a splat top with the denim jacket, denim shirt. Yeah, denim shirt. All right. So I want to do a quick little unboxing of the shirts that like I designed for the class. I feel like that tech top, please don't be ugly. Please don't be ugly. Also too guys, our whole living room is really coming together. We got the ladder thing all good. We got the ladder thing all set up and everything. So anyway, all this. Okay. So Mrs. Ruiz doesn't have a period after the misses, but it's fine. I think she will be okay with that. Um, maybe she doesn't want to name online, but you don't know her first name. But anyway, cute. Let me find mine. Oh my gosh, they look so good. Oh, here's mine. Here's mine. Here's mine. Okay. So it says Alex right there underneath class of 23. And then this is the back, the backbone of the OR. That is so, that is so cute. I love it. Yay. All right. Everyone say hi to Sherry here. Hello. Her back's a little better. She's been doing well. If anyone's wondering. But look at this progress, progress. No boxes here guys. We got to situate. We got to take care of this little situation. This is the music area. I don't know. Don't ask me. Do you know where this picture is going? Yes, right on the wall right there. Right here? Oh, that'll be interesting. But this is all cleared. That is going up there, I think. And then we have this little crane guy here. So we're looking, we're looking pretty good. I mean, much, much better. Now don't ask about the upstairs because the upstairs still has boxes everywhere. We still need to hang stuff obviously. Okay guys. So it is seven in the morning, but I got my Starbucks because it's coffee Friday. And I got the sugar cookie almond milk latte. I love this drink. It's very sweet. So if you guys don't really like sweet, but it tastes so good. And yeah, I just, I'm in love with it. I can't have it like every day. And also too, it's like so expensive, but you know, it was worth it today. Okay. So I know in the vlog you're going to see I'm wearing this outfit, but I wanted to show you guys the package I got from Faboletics because I was going to, because I was going to show you guys this in this vlog. So I don't know guys. It's kind of difficult to like keep track of like what days and all the footage is just going up. But I want to take the pictures today. So that's why I'm going to open it on up. Ooh, I already like the color. Oh my gosh, these are so soft. So I got these shorts. They're super cute. Very fun. This is the top. And I love these. They're really good support.  It's not crossed, but it looks like it's crossed. So look how cute. I love these tops. So I'm going to go put this on and take some pictures. After this clip, I'm going to show you guys how to gown and glove and stuff probably in this outfit because I don't know it's kind of funny. I wanted that to also be in this vlog so you guys can kind of see it's super fun. But definitely we all need a lot more practice because I mean, just to get better at it and everything. So yeah, I am going to put this on now. Okay, so this is the outfit. I should have gotten a smaller size in the bottoms, but I think the top fits really well. But this is what it looks like. And I absolutely love it. It's super, super comfortable. This is definitely going to be a go to outfit for spin class. Okay, so I ended up changing back into this because I use this more as like loungewear rather than like workout attire and all honesty, but I'm starving because it's like two o'clock. So I promise after lunch, I will show you guys the gowning and gloving. And then I need to edit both of these videos because I just feel like I have so much to do and so much to edit. Oh man, guys, I am just a hot mess. Forgive me. Okay, what you've all been waiting for, the gowning and gloving part of this video. So basically, this is nowhere near a sterile environment or even clean. That matter. And I'm not a teacher. I'm just practicing what I learned in school. So also for any of you guys who are search techs and like see something that I'm doing that's weird, call me out because every time like we practice and stuff like my teacher and like other classmates like we call each other out like, Oh, you just contaminated your gown because you touched the mayo stand and stuff. So for any of you guys who are search techs, I know I have a couple search techs who watch my channel a little bit. This is an XXL because yeah, anyway, it's just a little big just know that. So first off, I'm going to, I don't know if you guys can fully see, I'm pretending that this is like a mayo stand. It's totally not. First, we always have to hold our like gloves in our hand when we open this. So we open up the pack and we take out the gown and then we can throw this away conveniently located right there. And then we want to make sure that there's a little flappy here, if you can see, and we want that pointed to us so we can open it up. So I'm going to open it up. And this is before you scrub because you'll see why. But we open this on up like so. It doesn't actually look like this when we do it at school, but you never want to reach over the gown because it's a sterile field. So you just come around like this. And so your pack is open and there's your sterile gown. Then you take your gloves and obviously you can't be touching all this stuff. So you're going to open it and then like pull it back like this. So see, I wasn't supposed to be reaching over the sterile field like that. So anyway, I'm going to open up the gloves, shake it out. There we go. And then I'm just going to throw that away. There's trash. I'm going to wet my arms kind of like how I would. They would be wet in a surgical scrub. So I'm going to put my hand like this and then just like this is weird doing this at home. But anyway, so you never want to go back and forth. You just want to go in one direction like this. And then obviously in a real world too, you couldn't like turn off the thing with your hands.  So now we have to dry our hands.  And so you take the napkin, you give it like a little shake like this.  And honestly, I should be more further back from this thing because you don't want to contaminate, you don't want to be touching that. And then you just pat down like this.   So take your hand and get the other end and then start with the other hand. So starting off drying each finger like this. And then pat all the way down. Don't rub and just go all the way down like that. Then you're supposed to throw this away, but I don't want to be touching anything. So I'm just going to put it on the floor for now. I hope my teacher doesn't watch us because she's like, don't put it on the floor. Then you're going to get your gown. So you don't want to take too long. So I'm just going to reach. There's like a smiley face. So you want the smiley face, the you part looking at you.  As you can see, this is way too big for me. In the real world, you would stand here and someone would help you Velcro the gown. But since I don't have someone to help me because my mom is like getting changed and stuff, I am going to do this part. But really, you're not supposed to do this part. But you would in the real world, like I said, have someone Velcro and then tie this little thing. Pretend someone did that. Okay. So now we're like this and you always keep your hands up because you don't want bacteria to get on your hands. And if you put your hands down like by your waist, like this, then you're not sterile because below the waist is not sterile. So now taking the gloves. This is kind of big on me. So bear with me. So you take the gloves and then you open the glove pack like so. So it's like laying flat with the left hand here and the right hand here. Again, I'm not supposed to be like touching all this stuff. Anyway, okay, so you're going to open one of the gloves. Then you're going to put the text facing down. Okay, so the text faces the hand you're going to put your glove on. So this is the left. So the left, the writing goes towards the left hand. So then what you can do is flip this over and then you pull. And then you can pull this down. And you don't have to have it fully on. So you can just get the other glove like so, making sure the text is facing the palm of your hand. And then you're going to take the glove like so. See, I'm way too close to the thing, but it's okay like for now.  So then you're kind of like looking kind of crazy like this. But then you just fix the glove and put make sure you put your fingers in the appropriate holes. And because the gloves are sterile, like this hand can touch this hand. So and the blue gown is also sterile. There we go. In the OR you would always just stand with your arms here because this is so you know the song like your no no square. So your no no square in the OR is like here to your waist. So you can leave your hands like this, but you can't go like this. You have to keep them here or you have to keep them up like this. Okay, so anyway, someone else cleans this up like in the real world. And to complete the gowning process, we have this little card thing. This is sterile. And people like to keep them to like write notes on because it since it is sterile, you can keep it to write notes on I don't know how else to describe that. But this is called you spin with somebody. So I would take the left string here, making sure it doesn't hang down. And then I would hand this to you. Let's just pretend you're there. So I'd hand this to you and you would take the green section, you would hold that end. And then I would turn pretending you're holding this still. I would turn you still have it. And then I would pretend you're still holding it, you would hold it and I would pull. And then I would hold these up making sure they're not down. And then I would tie a bow like this. Again, this one's kind of big on me. So anyway, but that is how you gown and glow. And yeah, so I am going to finish off the log here. I hope you guys enjoyed this video. Make sure you give it a thumbs up. Don't forget to subscribe to my channel and I'll see you guys in my next video. Bye


Frontier published their annual financial trading report to the London Stock Exchange yesterday and as a result we're starting to get a much better handle on the effect that the launch of Odyssey has had on the company as opposed to what the board had anticipated was going to happen. The trading update that Cambridge developers have published to the stock exchange also talks about their plans for the complete portfolio of games for the year ahead including Elite Dangerous. In this video we're going to break down some key points of the announcement and take a look at the year ahead and what it may mean for Odyssey. To make sure you don't miss any of our videos hit like and subscribe and remember to click the little bell icon and select all notifications and if you'd like to help directly support this channel you can also join our Patreon via the link in the video description. Before we dig into the financials here's a bit of background based on the company's previous financial reporting and comments made by Liberum one of FDev's official stock brokers. In March of 2021 two months before the launch of Odyssey Liberum stated that Elite Dangerous had somewhere in the region of half a million active players. Furthermore there were around 3.5 million inactive or lapsed players that a relatively small proportion of whom Frontier was hoping to re-engage with with the launch of Odyssey. On top of this the giveaway of the base game on the epic store the previous year had further created a potential pool of something around 8 million accounts Frontier clearly hoping to attract some of those accounts to Odyssey. In the financial year 2021 that's up to the end of May 2021 Frontier expected to get around 11 million pounds in revenue from Odyssey in pre-orders and initial sales. These sales would have been, remember, predominantly all achieved before the problems Odyssey was having were apparent to the public. In the following financial year of 2022 that's the financial year that has just ended at the end of May they were originally anticipating around a further 21 million pounds but this had anticipated sales of the console version of the expansion included as well. Odyssey have now however reported this week that they have decided to quote fully amortize unquote Elite Dangerous Odyssey's intangible asset to the tune of around 7 million pounds. That's basically saying that they have decided to pay off the remainder of the development debt early that otherwise would ordinarily have been spread over the course of a few financial years and this 7 million quid amortization has now left Odyssey with between 1 and 2 million pounds worth of profit. It would seem that the board realized Odyssey wouldn't be performing anywhere near as well as they had expected and so they resigned themselves to paying off the remaining development costs during what turns out to be a bumper financial year for the company overall. This essentially means Elite Dangerous Odyssey is moving into the new financial year with a clean slate which would indeed seem to be a sensible approach for the future. Even if the numbers we have available to us aren't exactly correct the huge disparity between what the board of Frontier thought would happen and what actually happened demonstrates in some quite stark language the very real cost of a troubled game launch. As a company overall however Frontier continues to do extremely well. Overall their profits this year are at record highs again a full 26% above last year's equally record high and they continue to have a portfolio of otherwise very successful and popular titles including big hitters like Jurassic World Evolution 2, Planet Zoo, Warhammer 40,000 Chaos Gate Demon Hunters and they just started taking pre-orders for F1 Manager 2022 which immediately smacked to the top of the steam charts when sales opened. Moving again at the Elite Dangerous Odyssey roadmap Frontier published in May there are a further two updates remaining this year one around August and another around November. Frontier aren't saying exactly what is included in the patches obviously not wanting to deliver spoilers all they have said is that August contains what they have described as quote narrative content unquote alongside further stability and optimization changes and the November update contains the next quote major narrative phase unquote alongside further stability changes Arthur mentioned on a live stream in May that the company is working on something for Elite Dangerous that they have never attempted before as yet we don't know what that thing is or when it will likely arrive. The roadmap also stated that in early 2023 we will see the overhaul of a key feature of Elite Dangerous. In the report to the London stock market with regard to Elite Dangerous in the coming year Frontier have said quote we are focusing on supporting and growing our player community and will build on the narrative aspects of Elite Dangerous during financial year 23 unquote. So even with Odyssey's less than stellar financial performance there is still a clear statement of intent from Frontier to continue to support the game, the existing player base grow that player base and expand upon their narrative efforts in the game. The report goes on to say that Elite Dangerous is quote set to benefit from new DLC during financial year 23 unquote. That line did generate some chatter in the wider community. Here at the Burpit we'd advise a degree of caution when interpreting that particular statement we've seen Arc's store items referred to as DLC in financial reports from Frontier and Liberum before and we think it extremely unlikely that there is a further as yet unannounced paid expansion coming to Elite Dangerous in the next year. With that said we do believe it extremely likely that more has been and is still being developed for the game. When David Brabant announced that the console build of Odyssey was being dropped he noted that the narrative needed to move on and that in going forward it would proceed with new content updates on the Odyssey code base only. The question at the moment is just when will that content arrive with the player base and what form will it take? There was a leak from within Frontier three years ago that is pretty much confirmed as genuine these days that spoke of on foot Thargoids and base building as being part of the games development. We do think it likely that on foot Thargoid encounters are almost certainly a given at this point but what of base building? In a forum post in June 2020 the then community manager for Elite Dangerous Tim Smith posted to the official forums stating that base building was not part of the company's roadmap for Elite Dangerous. Players have dug into the code for Elite Dangerous Odyssey and found references to base building in there so it's clearly something Frontier have at least considered in the past. Base building schematics are of course a collectible on foot material in Odyssey albeit not currently used for anything. Star Citizen has plans for base building, No Man's Sky has base building already and this week Bethesda announced that Starfield also was jumping on the base building wagon. It's a very much requested feature from players and it would seem to be very easy to monetize in Elite Dangerous via numerous cosmetic items. So if the feature wasn't implemented in a galaxy the size of Elite Dangerous it would seem to be an awful waste of space. Do you think we'll see on foot Thargoids in Elite Dangerous Odyssey and if so when do you think they'll arrive? Would you like to see base building in Elite Dangerous? Let us know in the comments below. That's it for now, thanks very much for watching. If you enjoyed this video consider subscribing to the channel and maybe take a look at one of our other videos linked on screen right now.


So welcome and thank you for joining us again for China is not our enemy. And I'm very excited for this guest we have today. Because, you know, as we've been looking at the situation with the, you know, US pushing this war on China. We're not listening to the voices that are at the front lines of this war. And we've talked about how Asian Americans in the United States have been the first casualties. But today we get to look at surrounding what surrounding China and how they're already paying the price. And also just the anxiety that brings, you know, after the United States has experienced something like 911 to terrorize other people to wave war in front of their faces is bad behavior. And it's not good for those people who are in Asia that look at a pending war on China as something that will affect all of them. So I'm excited today to have say, oh, Saruta with us. She's one of the founding members and the director of the new diplomacy initiative, a Tokyo based thinking for issues around diplomacy. So I'm so happy because at code pink, we know how important diplomacy is. After she graduated from a city university. She joined an NGO which included helping out in a refugee camp in Tanzania. So she, after passing the bar exam in Japan in 2002, she specialized in international human rights law and received her masters from Columbia University Law School and practiced in New York in 2009. In 2012, she received her second master's degree in international relations from the American University in Washington DC. She was just telling me where she she got to know Colonel and right. One of our superstars that could pink. So now she's working on us Japan diplomacy, and happy that she's been able to join us today to talk about what are the issues. If you're looking at this war from the space of Japan. Okinawa those places around China. What, what do you see, and also the issue of two nuclear powers. This is, this is frightening for us around the world but what is it like when you're right next door. So first, CEO, thank you for being with us and why don't you start by telling our audience why you founded director, the new diplomacy initiative and what are your goals there. Thank you very much for this great opportunity. I'm very honored to be with you today, Judy. And thank you also, you know, for you a very good question about why I founded the organization called new diplomacy initiative. And also, I actually just, you know, came back from Washington DC, but why I would like to go to Washington DC very often, even after my graduation from my master program, you know, I went back to Japan, I moved back to Japan, but I go to Washington DC very often. And what I'm doing there is, I think, now the diplomacy is just occupied by the people who have a very, you know, strong power in the government, and also who don't have a chance to listen to voice from grassroots people in Japan. Maybe in the United States, as ever, but in my case, I'm really afraid of that, you know, so many diversity of voices exist in Japan, like the voice from Hiroshima, like the voice from Okinawa, like the voice from, you know, voices from Fukushima, but these voices are not hard, not blow to the United States at all from Japan.  So, I would like to bring these voices from Japan to the United States to, you know, it's maybe not very easy, it takes maybe long, long, long time, but try to at least, you know, or let them understand, let them means, you know, the decision makers of the United States are lawmakers or government officers to understand what we Japanese people really think. Even the voices of the Japanese government is saying this thing, but, you know, people in Japan have sometimes very often have different voices, which Japanese government even doesn't want to bring to the United States. That's why, you know, that is my, you know, that is, you know, because of my experience as a student of master, master courses in Washington DC. And then, you know, oh my gosh, in this city, nobody is trying to carry the voices from Bukinan people, from Fukushima people. So, you know, why not me, we should do that. Then I established the organization called New Jersey Initiative. Then, you know, when to go to Washington DC very often, sometimes only by myself, sometimes with a diamond members, sometimes even former prime minister, Hatoyama, I went there together with him, like arranging the meetings for him and the counterpart in the United States. And that's what I want to do. And that's what, you know, I want to do, try to bring more voices to change the better diplomatic policies in the United States and also, of course, in Japan. Well, that's impressive. Thank you so much. Yes, because as you said, the people don't always agree with the government. So what are the people thinking right now, as we're watching Japan cozy up to the United States and become, as we know, fodder in this war on China. We look at the patterns of the United States, and they promise a lot, don't deliver anything and use countries and people on the way to their goal. And how is that being seen in Japan? I think the, you know, diplomatic channels are very, very narrow. I think everywhere in the world. So only voice from the United States to Japan is, you know, we have to be very tough on China, tough on China. So whenever, you know, the select committee on China in the House of Representatives, the United States decide something very strong or tough on China, that is the only voice from the United States. Then that really scares us a lot actually. Maybe the Japanese government hesitates to set up to the United States Congress or to the United States government because the United States and Japan are the allies each year. So it's not very easy for the Japanese government to make a complaint, to complain about something which the United States decides.  It is because, you know, we have lots of people who live very close to, live in the area which is very close to Taiwan Strait, where, you know, there might be, you know, real or military clash, you know, happens very near future. So people are really afraid of, you know, seeing how the war is happening, or even, you know, people have to be involved in the war as victims of the war.   But, you know, that's not the right way to do, even if you do that, China will not change. That's not the, you know, way to try to, you know, improve the people's lives in China. Then, you know, only the things you're doing is to just escalate the tension between two countries. Please don't do that, you know, that's a feeling of us, the Japanese, you know, civil society. And so, do you have a map that you kind of show our listeners what, what that relationship is between. Great. So there we are. We can see Beijing and Shanghai to the side of them we see Taiwan. Right there. So that's right there and you can see where Japan is from there, and then also Okinawa. Can you talk to us about Okinawa, which is now part of Japan. And, you know, kind of the situation with Okinawa, which is a beautiful place with a beautiful history, and the Indigenous people that have lived there have suffered a lot through wars. And what is the situation for them right now? Thank you very much for the quick question. Actually, the, as you know, Okinawa has a lot of US bases. You see the orange map here in the left side of this, you know, screen that there is a long island called Okinawa. The blue shape is the Okinawa island. But there is a part, parts colored with red. That is the place where the US base is occupying actually, the Okinawa land. That is almost 15% of the Okinawa land. And, you know, if we have only US bases in Okinawa, then without any problems, that is okay. I think, you know, maybe I shouldn't say that, but that's okay. Okinawa people, for a long time, trying to get along with US military officers, military, you know, service men in Okinawa.  Then, you know, even if there is a very severe crime committed, you know, we cannot bring the case to the court because of the so far, the status of forces agreement. So we Japanese are not allowed, you know, on certain conditions cannot bring these, you know, cases to the court in Japan. So, you know, people in Okinawa very suffered from the very huge military presence in over the United States. Yes, you know, I can talk about Okinawa's issues, you know, for maybe like one day or two days, but you know, now we are talking about China and the United States. So in the context of, you know, context of competition between China and the United States, as you see in the map, this red, you know, islands are called Okinawa, you know, belong to the Okinaw prefecture, which is one of the 47 prefectures in Japan. Then, you know, these small dots, you can magnify it like this.  You can tell how close it is between Taiwan and these Okinawa islands. Even, you know, from the coast of the nearest island of Okinawa to Taiwan, you can see Taiwan from your, you know, from Okinawa.  So that's a relationship between Okinawan people and Taiwan people. But now, you know, as Okinawa has a lot of US military bases there, if something happened in Taiwan, I mean the military crash in Taiwan, military contingency in Taiwan, from where the United States will say, if the United States decides to send troops to Taiwan to help Taiwan people, that is actually not from the United States, continental United States, mainland United States, but it is, it will be from maybe not, you know, not only from Okinawa, but from Okinawa as well as other areas in Japan. Also, we have, like you say, the corner of this, you know, PDA, another base, other bases are also located in Japan. But the things I want to say is, if the United States decides to support Taiwan people by sending troops from Japan to, from the United States to Taiwan, that is not from the United States. That is from Japan. It means we will be, you know, retaliated by China, you know, maybe immediately after the United States decides to send troops from Japan to Taiwan, or maybe a few days later, you know, we have to be, you know, damaged by the attack from China. So now we really believe that. I mean, let's just hope that this never happens. I just want to start there.  So, but what we see happening is the US being provocative in the China seas. And that's where you're talking about, is where all that provocation is happening. So it's probably going to happen on the seas, not on the island of Taiwan, because that would, it would mean the United States would have to attack Taiwan, because China is not going to attack Taiwan, Taiwan is China. So, so what we see is all this provocation, provocation happening on the water, we see lots of US military ships surrounding Taiwan. So, and, you know, the US is preparing for war, which is a very dangerous situation when you prepare for war. It usually means war is inevitable. But what I'm, what I'm seeing is that Okinawa is right there in those waters where all this provocation will be happening. You know, I know you could talk a lot about Okinawa, but, you know, for our listeners, it's a, it's a beautiful pristine, you know, coral reefs and an fantastic wildlife and this is a place that's been used for war, not by the choice of the people who live on Okinawa, but it's really been occupied by the US military. Could you explain what a prefecture is for Japan? You know, so the US military basically occupies Okinawa, but it's part of Japan. If you could kind of explain that, you know, contradiction for us, that would be good. Yes, I just wanted to show, you know, how beautiful Okinawa is, but I cannot find the best picture where maybe you can insert the picture later. Yes, Okinawa is a very beautiful place and I think that you, I mean, if any listeners are going to get married, why don't you choose Okinawa as your destination for your honeymoon? I think that's the best way to go, I guess. Yeah, but yes, Okinawa was a kingdom for a long time until like 200 years ago. Then Japan annexed Okinawa, so they lost their own kingdom, then they are now losing their language and they are losing their cultures. Then, you know, as I told you, yes, Okinawa has a lot of US presence as a basis in their land, but that is because we Japanese lost the war during the Second World War. Then Okinawa battle was very, you know, infamous battle. Then, you know, one fourth of people, including American soldiers and of course Okinawan people, you know, had to die, you know, because of the very severe battle there. Then, you know, the outcome from the war is occupation by the United States until 1972, you know, since 1945. Then that was in the United States, it was a part of Japan, but occupied by the United States. Then during that time, the United States created a lot of bases, military bases, you know, which Japanese didn't have any chance to say anything because the occupation was done by the United States. Then in addition to that, the photos in front of you is the new construction plan right now going on.  But for the Okinawan people, still the war is continuing kind of, you know, not the war itself, but, you know, they have to oppose the decision made by the mainland Japan and the United States, which the Okinawan people doesn't have any chance to say anything about. Then, you know, this, you know, plan is for new marine base in Okinawa, of course, for the United States marines, but then they have been, you know, strongly working, you know, to oppose the new construction for already like about 20 years. But when, while they are very busy opposing the new construction, now, you know, United States started a very massive military exercises with the United States, with Japan and other sometimes even European countries in the Okinawa. See, to data China, deterrence, deterrence, deterrence. That's the key word for all military exercises and this, you know, the base in front of you and, you know, other bases in Okinawa and also new missiles try to introduce into Okinawa.  But, you know, deterrence means to secure somebody else, right? But is Okinawa people are secured by these military actions? Actually, not.  But maybe Tokyo, I'm now in Tokyo, so my life will be maybe protected by that. But, you know, Okinawa people are really afraid. If you decide to introduce me. Wait, wait, wait, wait, we cannot, we cannot say these things. Okay. Not no one is made secure by weapons and war. That doesn't make anyone secure. It just makes sense. So the fact that we can have this conversation or listen to people try to convince us that somehow all these weapons and these bases are going to protect anyone. I mean, ask the Okinawans about what happened during the war. No one like Okinawa was protected by those bases. They were killed because those bases were there. If there's a, I mean, if there's a war, what would be attacked? But the US bases that are closest to China.  The fact is, you know, there's no, it's a lie. When, when there's an US military base on your island, you're the one that will be attacked and they know that from World War Two. And so what we're, and what you just said is very powerful that the war ended in 1945, but the war has not ended on the people in Okinawa. We know earlier about the rapes and about the murders and having absolutely no access to justice for what's happening to them is criminal. And so here we are on the front lines of this war that the US is pushing. And what you're saying is the people of Okinawa are already paying the price. And I know they have fought that base for a very, very long time. But you were showing me that a poll was done about how people in Japan feel about the US war on China. And, you know, we see Japan as an ally of the US. But yes, here, here's a public opinion poll. If you could tell us a little bit about this poll. Yes, you know, as I told you that the Japanese people are really afraid of the Taiwan Strait, possible Taiwan Strait war, this number shows that, you know, 80% of people are really concerned about war, and not only about the war itself, but also we have to be involved in the war. That's a feeling. If something happened there, that is very close to us, then we are recognized as allies of the ally of the United States. It means, and then also the Japanese government, you know, even vice prime minister said, we are ready to fight against the fight in the war. I don't think they said that. He said that, like, you know, just 10 days ago. So, you know, government says that, but we are really concerned. We are not very happy about, you know, to be involved in the war, which is not the war of us, which is, you know, of course, the war shouldn't be, you know, of anybody, but definitely it's not the war of us. We will not start the war, but why do we have to get involved in the war? That's a feeling of us. That's the first public poll. Then, second one is kind of shocking, shocking not only to the Japanese government, but shocking to the American government as well, I think. This says, you know, 75 or almost 75% of Japanese people disagree to send Japanese self-defense force, I mean troops of Japan, send Japanese troops to Taiwan to, you know, help American forces. You know, the vice prime minister of Japan said, we are ready to send troops to Taiwan to help American people, American government, then American officers usually said, you know, if, you know, Japanese government will help us to fight against China, that would be very helpful. Like, you know, these are conversations between two governments. I mean, I think that's because the people of Japan can look at the people of Ukraine.  The Ukrainians are dying and they're on the front lines, you know, we've just heard that there's 200% casualty rate on this, in this war, and there's no US soldiers are dying.  But they are doing this war with Ukrainian soldiers. There's no, you know, very few American soldiers over there. There are mostly Ukrainian soldiers and Ukrainian civilians who are being put on the front lines and slaughtered. So of course, I would understand the Japanese people having watched what's happening in Ukraine, the very concerned about what could happen to them in the US war on China. I thank you so much for showing us these numbers. There are greater numbers than what we see, you know, in the United States. And like you said earlier, like why you started the new diplomacy initiative is that we're not listening to the voices that are on the front lines of this possible war. And thank you for raising this up because I think these are voices we should be hearing. Also, I wanted to ask you, you know, this is two nuclear powers. This is the end where, you know, we live in a time where all we should be thinking about, especially after this horrible summer of so much devastation and heat and flooding. We all should be cooperating on climate change. Instead, we're still hearing the drumbeats of war that would be two nuclear powers. And, you know, you're from Japan, you have suffered the unthinkable. I would assume that that's one of the great fears that must be in the hearts of those from Japan around this confrontation. Yes. The logic of the governments is always like, you know, extended the talents of nuclear weapons. So in order to have, you know, peace in their words, peace, we have to have nuclear weapons, nuclear umbrellas to keep us safe. But, you know, we have experience of Hiroshima and Nagasaki in Japan, then once, you know, it was used, it is used, nobody can survive anymore. Not only nobody, but this globe will, you know, be devastated just at all. So, you know, threats to use nuclear, data means to use the threat of nuclear weapons, right? Otherwise, it cannot deter anybody. So we cannot rely on the power of nuclear weapons anymore. That's what we learned already. Almost 80 years ago, that is 80, almost 80 years ago, 78 years ago. So, so I'm very frustrated to see the outcome of the G7 Hiroshima summit. You know, this G7 countries prime minister and president wanted to use the name Hiroshima to show, you know, how they are cooperating each other. But, you know, with the name of Hiroshima, they said, you know, the talents by nuclear weapons is very important. It, you know, actually triggered the anger of Hiroshima survivors, atomic bomb survivors and Nagasaki survivors. So don't use nuclear weapons as an excuse, you know, for peace. You know, it's not going to make any peace at all. So we have to understand that, you know, from our experience. You know, it's not because of the American people's fault. You know, maybe some of them, but the Japanese government always say, we have to do that in order to make the better world. We have to have the nuclear umbrella, you know, for now. They always say, for now we need it. Now we have to have it. But when you can say that we don't need it, you know. Now is the time to do it. That's what I'm going to say. Thank you. Thank you. And I think with this film, Oppenheimer out right now, where it's finally being talked about that those two bombs were unnecessarily dropped by a brutal US president who was just trying to flex a muscle at Stalin and with the costing the lives, the innocent lives of those people who lived in Nagasaki and Hiroshima is criminal. But, you know, there's no one being held accountable. And instead we have to get rid of these horrible weapons that really are, you know, a dark shadow over all of our heads. And as you said, if they're used, it, it's a nuclear winter and we won't be surviving that. So, yes. I wonder if there's any other issues that you want to discuss with our audience from the viewpoint of Japan sitting very next to, you know, what the US is pushing. Thank you for asking. The United States is, you know, very important country after this super power in the world. So I go to the Washington DC, then try to meet with, you know, high rank officials or, you know, senators and congressman with not only by me, but by me, but we, you know, say like a former prime minister or, you know, minister or that members, but it's not very easy to work together with American people. You know, always they said we are very busy. And also, you know, we have, you know, in Japan is a very important country, but still there are so many things we have to work on. So the things I'm going to say is it's not very easy to work together with American people. But I understand the United I like United States very much. That's why I live in the United States.  So I really respect that. But I think, you know, we have to work together internationally. Otherwise, we cannot change the world anymore. So international solidarity is very important. So, you know, it's not very easy to work together with somebody who don't speak very good English or who don't understand the culture, but we have to work together. Yeah, that's it. Please. And I think the people who watch this, you know, listen to this interview already understand it. So there is no meaning to tell that to you. But still, you know, international, you know, cooperation is the, you know, only things we can change the by which we can change the world. Please, you know, consider that even more than now. That's what I want to say. Well, that was beautiful. What a great sentiment to leave on because it is international solidarity that we need for the people and for the planet, that there's no greater contributor to climate change than war. And so let us be cooperating, especially in this moment in history. Thank you so much for all you do. And thanks for sharing your voice with us today. Yes to diplomacy. Yes to cooperation. And I just celebrate your work. Thank you so much. Thank you very, very much.


So, quick disclaimer, I'm a Star Wars nerd, I grew up on Star Wars. If you are more nerdy than I am, please don't just shout out that I'm doing something against Canon or anything like that. Come talk to me afterwards and we'll nerd out about it, alright? So I'm taking a little bit of liberty with Athenae. But if you will join me on this journey, pretend you are building a website with ambitions to take over the entire galaxy. Initial launch was a great success, right?  However, there's some bad actors out there and those bad actors are plotting to take down your website.  So, luckily, as Drupal has progressed over the years, its defenses has also gotten better as well as its offenses here. But the rebels are smart, they continue to come back, but luckily for us their ways are consistent. So, no matter what, we can learn from their patterns and from reusing plot lines over and over again to see how these hacks happen. So if you are new to cybersecurity, new to developing, we're going to be going over some basic hacks today. If you are an all-pro, chances are you have one of these vulnerabilities in code you've written, so go back and look at it. But today we're going to talk about Death Star Security and how all it takes is a few rebels to take down your website. So this is going to be interactive, it is 5.40pm on the last day of the last session. So if everyone can get out laptops or whatever, if you want to join along with us and go to DeathStarSecurity.com, surprisingly this domain wasn't taken and I haven't gotten a cease and desist from Disney yet. So for as long as it's up, I'll leave it up there. And while you're going there, I'll tell you a little bit about myself. I'm the founder and CEO of Locker and Cellar Door. I've been fortunate enough to work with everything from startups to large enterprises. I've been working in Drupal for about a decade. I've also been working in WordPress lately as well. Don't hold it against me. They're actually a really fun group of people to be with. And then more recently, I've started getting into policy and advisement and I sit on an advisory committee for the Department of Homeland Security for privacy and data integrity. So, but for this, I am taking the role of the security architect for the Empire. And we're gonna look at a few plugins or modules that I have found in our code base and some issues that they introduced for us.  But down at the bottom, there's gonna be two links that you're gonna be following there. So we're gonna be talking about the droid scanner search module that one of our developers built for us. And we're also gonna be talking about Stormtrooper customer targeting. And so I love that I get little laughs because I've given this talk before and nobody got that joke. So the first one, droid scanner. This was an advanced search module that they wanted to consume data from an outside source whenever a search happened. And then also after that search was done, they wanted to do some telemetry and some metrics on it. Now, you might think what harm can a few droids do, right? Well, the harm that a few droids can do is they can connect your site with what we call a DDoS attack, a distributed denial of service. And the idea here is that through nefarious code, bad actors can spin up a whole bunch of browsers or a whole bunch of connections to your website and take it down. Particularly what they're looking for is forms and slow loads, right? Anything that takes a long time to do. And so this search module unfortunately took down our website. And so this is a, if anyone can read the code, it just says sleep. You don't just sleep a module, so. But this is an example of code going out to an external source, right? And I've actually had this happen. We didn't get DDoS on it, luckily. But if you have code that goes out to an external source, and it has to do some processing there, there can be some lab time in that processing. Then if you're doing additional stuff, if you're doing additional work, after the results are back and you're processing through them, and you're connecting a whole bunch of things, we as developers want to do as much as we can with the code that's in front of us. However, if an attacker can see that your code runs slow on a specific form, and they hit that form over and over and over and over again to the tune of millions of times, they can take your site down, right? And so if you go to the website and you click on the droid scanner, what I did is this is actually the code running there. It is on every search result. It's just going to wait four seconds as it's rendering that. And so if you, it's all loremips and then there's just typing some Latin word into the search on that site. And you'll notice that it takes an incredibly long time. If enough of you do it in the room, it'll likely take down the server as well. And that is an example of what a DDoS is. So one of the ways we can do this is move your slow functions to asynchronous processes. I built a site once that was an airline ticketing reservation system, right? There is a lot that goes on once you swipe the card or enter in the details before that ticket is actually purchased. And if we were to put that all in the page load, it would take 30, 40 seconds in order for something to happen, right? I've seen this a lot of times where people will just hook into a knit or right at the beginning of the bootstrap. And then they just start doing a whole bunch of processing and it just slows everything down. So if you're doing anything that a form submission will slow down, move it off to an asynchronous process. Create a queue, Drupal does a really good job with the batch API of working its way through queues. And then you can either create some sort of internal webhook that comes back and does more work on it. The easy way that I've always done it is just to create a cron job and then have that cron portion of your module just churn through all the slow stuff. So A, users are happy, the website loads fast. And B, the company is happy, or in our case the empire is happy because the website wasn't taken offline. This is where we're going to spend a little bit more time, is in the stormtrooper customer targeting. And so how does this module miss? And this module misses because what we're doing here is we're saying, okay, I want this to be some customer tracking. I want to have an identifier that I'm going to give to the customer to track them through their whole process, right? As we start looking at these digital experience platforms and more of the content is dynamic. We're doing a lot more processing like this. A lot of the times that's getting passed in URL strings. So if you ever click on a link and you get these really long URL strings, those are normally just tracking tokens that are being passed along. And so what our module does here is it says, I'm just going to take whatever is in that query string and assign it to a variable to then output into my theme. As a developer, you might not think that that's that bad of a thing, right? Because you know that your front end developer is smart and they're going to be taking care and sanitizing the data that comes in. But our front end developer, or this is dangerous, don't ever trust anything coming in. Sanitized at the moment, it comes through the doors. Because what you don't know is if your front end developer doesn't know that that's sanitized, that's not sanitized, they're just going to use it, right? They're just going to say, hey, whatever's there, just output it. I'm running into some issues I need to hack around. I'm going to turn off, if you notice here, it says the value is get tracking raw. If you put raw as a filter on twig, it will just output and not auto-escape, right? It's a nice hack that for some reason the formatting's not going well and instead of going back and actually talking to the developer and saying, hey, let's figure this out, I'm just going to put raw on it and let it output. What that says is whatever I get, just put it out. So if you click on that next link, and we'll do that here, because this is a fun little demo to do, we're going to, nope, people are playing around with this one already. I purposely made this site to hack around, so you guys are doing a good job. Let's see here. So by doing this, you'll notice up here in the corner, I get a little shake going on. If this was actually able to plug into audio, this would be playing the Harlem Shake right now. This is a really fun script that you can put on. And then pretty soon here, our entire page is going to do the Harlem Shake. So what I have done is I have injected, if you look at the URL up here, at the very top I said, well, instead of input and putting a value into the input, I'm just going to load an arbitrary script from a server that I can control. Once that JavaScript is in your browser, I have full control over it. I can do whatever I want. And while I may just make you dizzy by having things moving around, I can scrape your cookies, I can key log, I can do a whole bunch of things. So cross-site scripting is actually a very common bug or vulnerability that we see. Luckily though, yeah, so it allows you to run arbitrary or remote JavaScript. It can exfiltrate data so it can look at what data is on the screen. If you're in a banking application, it can take that information out. It can capture cookies, and if you're not careful and you're not using your cookies properly, luckily Drupal does. If you're building a website that's not managing its cookies properly, you can actually leak your session data, and then the hacker can then act as you. And there's nothing that will stop that because to Drupal or whatever system, it's a request from you. They can do key logging. For those of you here in the EU and the UK, this is what happened with British Airways when they lost all the credit cards. There was some nefarious JavaScript that was running. And as people were entering their credit card numbers and CVVs and everything into the form, all they were doing was just key logging what was happening on the screen and then sending that back to a server so they could collect all the credit card data. So this can get really nefarious really quickly. So sanitize your user input, never trust anyone, including your admins. Because if a session leaks, a bad password's out there, like is on the demo site there that a few of you have already hacked into. Your admins can put out some bad input as well or somebody can act as an admin and get in there and do stuff. Luckily though, or in the other thing, your inputs aren't limited to what you put out into a form. So just because you have a select list doesn't mean that I can send you back something that isn't in that select list. Luckily, Form API does all this for you. So if you're building a form on Drupal and you're not using Form API, stop and go use Form API. There is zero reason not to. I will be honest, in building this little demo and the couple of click-throughs, it took a really, really long time to figure out how to hack Drupal.  The same demo and WordPress took me about 10 minutes. I'll just say that. But how do you sanitize the text? You have cross-site scripting classes that you can call with filter and filter admin. Filter admin will allow a little bit more HTML through. So if you say, okay, I can trust my admins a little bit more, it has a broader set of allowable characters in it. But it will filter out any cross-site scripting or any JavaScript. People get really fun and they try doing base 64 encoding their payloads. They'll do a whole bunch of stuff. This takes all that out. So again, the form API, it will sanitize all inputs, outputs, it'll sanitize things that are going into markup. It sanitizes everything. And it sanitizes it as it comes back in after you submit it as well. In Twig, don't use raw filter. Period, full stop, just don't use it. Because Twig, if all you do is you put the double brackets and you put a value in there, it will auto-escape every string that comes through it. So that was one of the nice things of moving from Drupal 7 to Drupal 8, is you had a lot more inherent security in the theming layer itself. And then lastly here, use a code sniffer in, I like to use VS Code now. I'm a convert. I used to think only nerds used this, but it is awesome. Microsoft actually created a really good product. And so, what's really cool is we have official docs up on Drupal.org to how to configure Visual Studio and put code sniffers and linters in there. Not only will you be creating nice and pretty code, that's according to community standards. So your modules will not fail any tests. It also will highlight, hey, you haven't sanitized this, or hey, you have an error here. And the nice thing about VS Code is it makes that very apparent. If you look at your code, and then also it will do some, every time you hit save, or I haven't set up, so every time I hit save, it'll come up and tell me all my errors, all the issues that I have.  And it's caught errors that I've been putting in code as well. So with that, I want to leave you with the idea of Death Star security. We focus on the perimeter a lot. We put up WAFs. We put up as strong of servers as we can. But it doesn't make up for bad code. So make sure that as you're working on your systems that you're also focusing on the little functions and the little things inside your code that could eventually blow up the entire thing. So with that, we have about five-ish minutes. If you want to go get beer and food, you won't offend me by leaving. If you have a question, I'll take those now. All right, I think a lot of people want beer and food. So with that, thank you. Make sure that you go to the contribution sprints tomorrow and be sure to take the surveys as they're up there.