فشرف بالاشتغالي بالعلم ولا تبغي به ما عشت يا دادا دالا وياله من شراف عظيمي so the ayah is dala dilala the indication that the ayah is given is to follow Islam that is obligatory so three introductions number one there is a severe warning in the one who looks for a religion other than Islam number two there is a severe warning that will bring about destruction and the destruction will not be except to a person who leaves off where jib or comes with something haram and the third one is safety from destruction if the person surrenders and adheres to the religion of Islam these are three مقدمات which show that Islam is where jib then the author moves on to the second evidence to prove his heading and chapter which is the religion to Allah is Islam and the dala for this is that Allah specifically narrowed down to what is it that he is pleased with and he didn't say anything else other than Islam so the ibadah in which we were created for which we were commanded لا يتحقق حصولها it will not occur unless we come with Islam so Islam is where jib so we can come with the ibadah in which we were created for the third evidence that the author brings is and the way that the author is using this evidence to prove his chapter is number one فتبعوه follow it so we were commanded to follow what the straight part that was mentioned in the verse which is Islam because which is which is which is said that the so we are told to follow it and as you all know the amr shows obligation the second thing in the ayah that the author is using is فتفرق بكم عن سبيل and do not follow the path so it will take you away from the straight path which is a nahyu prohibition so we were commanded to follow the straight path and we were prohibited to follow a path other than that path then the author brought them the call of who مجاهد ابن جبرن one of the students of ابن عباس said that the other parts are innovation and shubu hat doubts and that he narrated in his سنن بسند صحيح authentic chain of narration so we are not allowed to follow innovation and we are not allowed to follow doubts سبول is everything that opposes the straight path كفر enters there and all types of they enter there the fourth evidence that the author is the hadith of a'isha رضي الله تعالى عنها that she said that the prophet said من أحدة في أمرنا هذا ما ليس منه فهو رد that's why the author said أخرجاه meaning he means by it مسلم but the wording that the author used which is من أحدة في أمرنا هذا ما ليس منه the wording that the author brought which is the wording after that one من عمل العمل ليس علي أمرنا فاوردن this is only in Muslim connected بخاري did narrated but he narrated it معلقا that wording من عمل العمل ليس علي أمرنا فاوردن what is it that the author is trying to use from this evidence he's trying to use from this فيديني the thing that's been introduced into the religion is rejected and it's prohibited because what Allah تعالى تعالى accepts as we all know is Islam the religion that was sent upon the messenger the religion in which the prophet ﷺ came with the religion in which Allah sanctioned so anything Allah didn't sanction it's not part of the things that he will accept it's not from the religion in which Allah acknowledges and accepts this the fifth so innovation is it from Islam are we told to stay away from innovation are you with me so what does that mean then what does that mean it's obligatory to hold on to Islam and it's obligatory to stay away from innovation that's what he's trying to use from this evidence number five he brings the Hadith of Abu Huraira that he said كل أمة يدخلون الجنة وخاري the author is trying to use this for the chaptering two things number one من أطاعني دخل الجنة anyone who obeys me will enter jannah that you deserve to be placed into jannah by following the command that was set for you and staying away from that which was prohibited from you and the greatest command that you are commanded with is to enter into Islam Islam is واجب the second thing that he's trying to use his Hadith for is ومن أطاعني فقد أبا and anyone who disobeys me he has refused to enter jannah so disobeying the messenger means to turn away from what he came with and from the greatest thing that a person can turn away from is al-Islam and due to that a person then deserves to be placed in the hellfire due to this sin that he has come with and there is no sin greater than a person turning from the obligatory command the obligation of the obligation of Islam the sixth evidence that the author brings is the Hadith of رضي الله تعالى عن أما that the Prophet ﷺ has said أبغض الناس إلى الله ثلاثة and Imam al-Bukhari narrated it 3 things 3 people are most hated to Allah تعالى and the author, the one he wants from this is سنة جاهلية it is anybody who in Islam takes a path of جاهلية سنة جاهلية is what كل ما قال فما جاء به الرسول صلى الله عليه وسلم جاهلية is everything that opposes that which the messenger صلى الله عليه وسلم came with it can be قول it can be a فعل it can be it doesn't matter anything that you say or you do or you believe that is not part of Islam سنة جاهلية and this is the most hated person to Allah سبحانه وتعالى the parts are two سنة للإسلام which consists of two things الفرائض والنوافل and the obligatory things and the voluntary things and those are all love to Allah سبحانه وتعالى and the second one is سنة جاهلية it's everything that opposes that which the messenger صلى الله عليه وسلم came with and that is most hated to Allah سبحانه وتعالى so anybody who takes a path in Islam a path of جاهلية is from the most hated people to Allah سبحانه وتعالى because he is going against the pathway of Islam which was obligatory for him to follow that's what the author is trying to take from that is and Muhammed with him in his وإسناده الصحيح، محاولة ترجمتي ودلالة على مقصود ترجمتي ومقصودة هذه الحديث للتصوير يتقيمو أن يكون أقرأة ومقصودة مع التكلم منه فإن أخذته يمينا وشمال وإن تأخذت ال right or the left فقد ظللت بلالا بعيد وذلك فقد تصوير مقصودة وإن تأخذت ال right or left فإن تصوير مقصودة لا تصوير أقرأة ومقصودة قراءة أقومت في عرشة سلف قراءة وإن تأخذت سلف ومقصودة العالمون بالقرآن والسنة العاملون وإن تأخذت القرآن والسنة وإن تأخذت بلالا لم يكن فتح الناس أن يرغب القرآن وإن ذلك how we use it today المثال الثقافة التي تأخذتها رحمة الله سبحانه وتعالى هو بالنسبة to this statement of حديفة تبنو اليمن أبو الفضر من حجر العسقلاني وفتح ال باريو أن هذه الحديث تأخذ حكم الرفع تأخذ تأخذ لأن الحديث لأن حديفة تأخذ في هذه الحديث عن غيب الله يدرى أنها ليس تعرفة وإذا أخبر الصحابي عن الغيب الذي لا متقل للرأي فيه قيل إن له حكم الرفع إذا كامبانيون يتكلم عن شيء من الانسي أنه لا يمكن أن يتكلم مع أفكار هذا شيء لا متخل للرأي فيه لم يكن لديه باستخدام باستخدام الشخص يقول إن له حكم الرفع أنه يأخذ بلالا لذا نقول إنه موقوف لفضن مرفع الحكم وإنه يأخذ بلالا لكنه يقول إنه يتكلم مرفع إنه يأخذ بلالا كما قلت الثلاثة أفكار يأخذ بلالا عبد الله عبد الله رضي الله تعالى عنه أنه يقول ليس عام إلا والذي بعده شمر منه إبنه وضح نريته في كتابة البدع والنهي والنهي عنها كما يأخذ وإسناده ضعيف وإسناده ضعيف حيث مريم لفوذ ورواه الطبراني في المجم العودة بالسناد الآخر أيضا طبراني يحويل تعمل في مجم العودية مع حياته العودة بلأة يوجد ثلاثة حياته في حبushة في مصنده في حياته إن هكذا يفضل كل هذا المسطرخ كل هؤلاء يقضي أن تكون الأثر حسنا لأن الأثر إنه تعالى يصبح حسن يصبح صعوب. عبد الله ابن المسعود ، by the way it is takes the ruling of Rafa because لأنه لا يقابل من قبل الرأي because لا مدخل للرأي فيه it's not something he could have brought about with opinion so it takes as though it is the prosa same statement أنا سبنو ماليك رضي الله تعالى عنه who said, it's better to be patient فإنه لا يتعامل عليكم إلا والذي بعدا وشر منه سمعته من نبيكم صلى الله عليه وسلم that the prophet said be patient that there won't come a time except the one after it is even greater I heard this from your prophet Muhammad صلى الله عليه وسلم and عبد الله ابن المسعود said something close to that he said that there is never going to come a time except the time after it is west and it doesn't mean as عبد الله ابن المسعود رضي الله تعالى I mentioned in that hadith it doesn't mean لا أقول I will not say to you that a year is more greener than another year ولا أمير خير من أمير that a leader is better than another leader لكن but ذهاب علمائكم your scholars are going to die وخياركم and the wise ones amongst you are going to die ثم يحدث أقوام than a group of people are going to introduce in the religion يقيسون الأمورة بأراءهم and they are going to come with analogies and they are going to come with opinions that are far from the textual evidence فينهديم الإسلام ويثلموا and then the religion becomes destroyed based on these people's opinions that they put forward I think the word ثلم it means خلل deficiency and it calls evil to the religion so what's the delala of the author's statement it means this لكن ذهاب علمائكم وخياركم ثم يحدث أقوام يقيسون الأمورة بأراءهم فينهديم الإسلام ويثلموا the author is trying to take this as the usage for his chapter because these people's dying and these people's going is going to destroy Islam is going to what is going to destroy Islam and the reason why is going to destroy Islam because they were sticking to Islam and those after them were not sticking to Islam when they were told to stick to it and it is wajib to stick to the religion that's where the author is using this as an evidence and today if you look at the situation that the Muslims are living in look at the majority of the people who are speaking about the deem and how they look and how they speak you will realize that they are on one side and the religion is on another side now وفي الصحيح يعني فعم روض الله عنه وأن رسول الله صلى الله عليه وسلم قال الإسلام وانتشد لله إله إلا الله وأنه محمد رسول الله واتفين الصلاة وتبتي الزفاك وتصوم روضان وتحجل بيت الحران إن استطاحت إليه سبيل أن تتفقوا معي وفيه عنه يطرد الله عنه والمسلم والمسلم والمسلمون بلسانه ويديك والمعادر من وعن بهزن وعن بهزن من حكيم عن بي عن جدي أن رسول الله صلى الله عليه وسلم عن الإسلام فقال أن تسلم خلبة لله وأن تولي وأن تولي وجهك إلى الله وأن تصلي الصلاة المنطوبة وتؤدي الزكاة المنطوبة رواه أحمد وعن بقلاب عن رجل من أهل الشام عن حلامية أنه ساله رصول الله صلى الله عليه وسلم من الإسلام فقال أن تصلي خلبة لله وأن يسلم المسلمون من لسانك ويديك قال أي الإسلام أصدر قال أن امان بله قال ومن امان بله قال أن تؤمن بالله ومنائك اتكي وكتبه ورسوله ويوم الآخر والبعث بعد المرخ والأمر رحمه الله هو أنه يتكلم حقيقة الإسلام ومعنه ما هو حقيقة الإسلام ومعنه إسلام وإذا كنت ترى لزاعة المتحدة بين المجموعة في الإسلام اليوم إذا كنت ترى خلاف أكثر يوجد يوجد تفسير الإسلام ماذا تفهم الإسلام ماذا إسلام هذه المجموعة التي تجد اليوم في ساحة الدعوة في في الساحة الدعوة تجد التي تفسير إسلام تفسير سياسي سياسي من أسلام يوم مكتب إسلام سأرى أعلى الموضودي مثلا سأرى أسلام وكتب وكتب كنت تفهم إسلام حقيقة الإسلام ومعنه ماذا تفسير و لذلك الشيخ عبد الحق التركماني who still alive who used to reside in Leicester now he moved to Turkey but he comes he opened an institute and he called it تفسير الإسلام and he brings very strong articles and very strong work in what it means تفسير الإسلام and I advise you brothers to take time out and to try to familiarize yourself with it let's look at what sheikh of Islam Mohammed bin Abdul Wahab defied Islam as الإسلام الشرعي my beloved brothers first of all له إطلاقاني it has two usages أحده ما the first one is a general general usage which is الإسلام لله بالتوحيد والإنقياد له بالطاعة والبراءة والخلوص من الشرك والأله which is الإسلام لله بالتوحيد it is to submit to Allah with monitism والنس in عبادة والإنقياد له بالطاعة and it is also to adhere to him in obedience والبراءة and to free yourself والخلوص من الشرك والأهلي and its people and as we said before if you just say الإسلام لله بالتوحيد the rest the rest فإن الجملة تيني المدكورة تيني it is بمنزلة التابع اللازم للجملة الأولى it is بمن باب دلالة للإلتزام it already enters it it already enters the meaning of الإسلام لله بالتوحيد the second usage of الإسلام is a specific usage and it has two meanings the first one is محمد صلى الله عليه وسلم the religion in which the prophet صلى الله عليه وسلم was sent with this is called Islam and that is the حديث ابن عمر رضي الله تعالى عنهما which he says in حديث صحيحين من حديثه ابن عمر بونية الإسلام وعلى خمسين إسلام was built upon five pillars the second usage for the specific is the apparent actions it's the apparent actions and that's what it means when when Islam and Eman are mentioned together Islam becomes the outer actions and Eman becomes the inner actions and the author he used verses that show the general Islam for the specific meanings of Islam and he mentions five evidences the first one is which is the reality of الإسلام تفسير الإسلام it means the reality of الإسلام is الإسلام العبد لله بالتوحيد is to place your face in submission and surrender to him وهذا هو تفسير الإسلام but this is what it's general meaning وقوله and also he's using it within that same verse ومن اتبعني أي ومن اتبعني مسلما وشهول الله and also the one who follows me the messenger is saying after me and also surrender to you our Allah سبحانه وتعالى the second evidence that the author uses is the Hadith of Abdulrahman bin Omar الإسلام وانتشهد الله إلا الله the author attributed this to Bukhari and Muslim and the dilala of the scholars the sheikh's usage here is الإسلام وانتشهد الله إلا الله that's what it means from it that the تفسير الإسلام is لا إله إلا الله and especially this is the specific usage of the word الإسلام it is the religion that the messenger صلى الله عليه وسلم was said with the third evidence that the author uses here is حديث أبي هوريرة رضي الله تعالى عنه المسلم من سلم المسلمون من الإسان هو يدي which is in Sahihain من حديث عبد الله من عمره من العاص and it is not from حديث أبي هوريرة أسفد حديث أبي هوريرة رواه تلمذي والنسائي وإسناد وحسن and the usage of this hadith for the author, for the chapter in his main is what that the Muslim his Islam is connected to what سلامة الخلق من الإسان that the people are safe from his tongue and his hand and all of that to occur from him first of all what is in place that he is a person who is already surrendered to Allah because the hadith is trying to say that you don't use your tongue against the people and that you don't use your hands against the people except that which you have been given permission for and then the permission comes from somebody you surrendered to and that's the حقيقة to the Islam that you're a slave that the master tells you you can say this to this person okay you can't say this to this person okay all of it is based upon what إلا فيما أذين الله except that which Allah has given permission to you for that servitude that slavery the fourth evidence that the author puts forward is what حديث معاوية بن حيدة رضي الله تعالى عنه who narrated from his granddad بحز بن حكيم and now he asked the messenger عن الإسلام what islam means فقال the prophet said انتسلم قلبك لله إمام محمد narrated in his muslim with this wording the usage of the author here is apparent because the question that was put to the prophet was about what islam and the definition of the prophet is what islam is the prophet defined it here and islam encompasses brothers that your heart faces Allah إقبال الباطن you face Allah internally you surrender to him internally and you also surrender to him from the outer and تسلم قلبك لله is that you internally surrender to him وأن تولي وجهك لله it means that you externally surrender to him سبحانه وتعالى and that's the reality of what islam is باطن وظاهرة that you surrender to him internally and externally and that's the حقيقة of islam which the hadith mentions this fifth evidence that the author brings forward which is the last one is أيمان من أهل الشام عن أبيه أنه سأل رسول الله when he asked a messenger فقال the prophet said أن تسلم قلبك لله and the author did not attribute this hadith but in his مجموعة مجموعه في الحديث it is مجموعه في الحديث he attributed it to مسند إما محمد but it's not in مسند إما محمد the usage of the author here again is the same usage that he used the one before it which is أن تسلم قلبك لله that you face your heart towards Allah which is internally and you also face Allah externally وأن يسلم المسلمون من لسانك ويدك and that the people find safety from your tongue and from your hand we'll stop there now إن شاء الله وتعالى we'll take a break and we'll come back after اعفت صلاةه الظهر


This week started with me getting zoom bombed and it was one of the most traumatic couple minutes I've experienced in quite a while So here's what happens.  I put it on Facebook as a public event page mistake number one with my zoom link Not it's not a mistake to use a public event page on Facebook But to put my zoom link in there Trying to make it easier for my audience to find it. That was a mistake. So 15 minutes into my meeting it started first of all I suddenly started seeing Somebody writing on my screen f you see, you know, etc. So large You know curse word and then suddenly they took over my screen They shared their screen with very gross pornographic videos Right there on the screen. Of course. I was shocked. I was in shock for a couple seconds like what's going on This has never happened to me in Many years of using zoom I do I've done I've accounted something like over a thousand zoom meetings many of them group meetings and this has never happened before so gross pornographic images came videos came there and Other people on unmuted and started saying racist things verbally and then Once I disabled the ability for people to screen share and to unmute Then they started chatting because chatting, you know typing in Hi, everyone. How's everyone going and asking for people's questions and seeing their comments and those that's a very valuable part of a Zoom meeting you want to get the people's feedback and get their get the pulse of what's what they're thinking and Well, they started putting Racist and hateful just really terrible chat messages in there and not only were they doing that They even renamed Themselves as other legitimate participants in the meeting. Yes. So one of them renamed them as you rename themselves as me another first several people renamed themselves as other people that I that I personally knew as Very thoughtful students of mine, you know renamed and then read after renaming themselves impersonating them They've then chatted the raceful things that of course those real people would never say so Once I started, you know, once I saw people doing these kinds of things Of course, I try to remove them from the meeting as fast as I could But it was a coordinated group attack. This all happened in a matter of three to five minutes Before I finally ended the meeting for everybody. So in the first, you know 10 seconds I was in shock not knowing what to do and then I started thinking wow, how are they doing this? Okay, let me restrict my screen sharing capability. Okay, let me not let people be able to speak by not allowing them to unmute Okay, let me stop allow them not to and let me disable the ability for them not to rename themselves I was starting to do these things once I realized what they were doing but the problem was that and Then of course once I started realizing was a group of people. I locked the room so that nobody else could come in But then I still couldn't remove the right people because they had already they are once they came in They renamed themselves. I didn't know which one was the correct, you know, Alisa, which one was the right, you know Jennifer or whatever that I knew personally right who was right one couldn't tell so I You know, I fortunately of course that ruined my meeting that that had to Get canceled early or ended early and it was a traumatic experience for everybody who was there But especially for me the facilitator and speaker You know as a solopreneur Chances are you're probably doing most of your group zoom meetings by yourself You probably don't have an assistant for those of you who have an assistant or facilitator who can help with this kind of thing Wonderful, but for those of us who don't we have to think of ways to prevent the trolls from coming in at all Okay, and that's that's what I want to share with you today is I thought a lot about how to You know because the thing is I Actually regularly need my attendees to share their screen with me so I can help them with something on their website Or to show me something else that they're looking at or My attendees need to share their screen with me. They need to chat They sometimes need to rename themselves because they join the zoom meeting as their spouse on their spouse's computer Or they join their zoom meeting from their phone and then their name says iPhone So I don't know who they are. They have to rename so I have to keep these features available I can't restrict screen sharing. I can't restrict chatting. I can't restrict unmuting sometimes they unmute to Say, hey George, you're still on the wrong slide or whatever it is that they need to to alert me of right? I can't restrict the chat because that's how so many so many people get to know each other in my meetings and former community so I Most of the articles and videos You know articles you read or videos you watch about preventing zoom bombing will tell you to do these things restrict the screen sharing restrict the chat restrict the the muting restrict people of Course we could do that But that would be restricting the freedom of our attendees to actually interact with us Which is what we need to build community to build a relationship with our audience So the real answer and and also some people say well George, you have to stop using zoom Because zoom is not a secure platform The people who say that in my opinion don't really understand What zoom bombing is about the the zoom bombers the people that the trolls the trolls who are doing this They're looking for easy targets They're not going and look and trying to guess zoom meeting numbers because zoom meeting numbers are always What is it like? something like Seven or eight digits long. No one is gonna guess your meeting number and be able to show up at the right time. Nobody is Capable and yes, I've heard about software that can find zoom meeting numbers and test But to be honest, I have never I don't think the trolls who typically teenage boys You know what what's still underdeveloped brains and too much testosterone They're not using sophisticated methods like that. Okay. It's not that what what they're doing and I'll show you real quick They're simply going onto places like Facebook and going to the event section of Facebook and searching zoom Okay, and when you do that, it's within minutes You can find lots of zoom meeting IDs for public meetings I did I'm not going to show you on the screen because I don't want to well I mean, I'm sure there's the trolls already know how to do this But but I have a blog post and if you read the blog post associated with this video There's a link that shows you wow. It's easy for you to find and within two or three minutes several free Public Facebook event pages that have their zoom meeting IDs listed like mine was So I'm not the only one getting bomb lots and lots of people are getting bomb a zoom bomb. So The solution so people said we'll stop using zoom use something else Well, if I use something else, I still need if I'm doing a might if I'm doing a public Free Meeting where I want lots of people there interacting with me I still need people to register in some way and if I allow the public to register why couldn't trolls register Why couldn't spammers and hackers register? It doesn't meeting if you go it doesn't matter if you go to Webex or Google Meet or you know Other tools that come out that are supposedly more secure if anyone can register for your meeting anyone can bomb your meeting So I thought a lot about this and really the most secure and practical solution is To have a strategy for preventing for vetting the people who sign up And if you vet the people who sign up for your meetings, it doesn't matter if you use zoom or something else You're vetting the people who have the link who have the access information to your to your meeting That's what you need to do so there are basically two options for Creating a public large meeting Where you vet the participants two options? I'm going to share with you one option is This you selectively invite, but then you stream publicly. Let me explain what I mean First you you what what I know you want to do is you the reason why you're having a lot What you're trying to have is a large public meeting, right? What you're really trying to do is to get that content of that meeting out to many people So first of all, let's let's get clear on something here if you just want to get your content out to many people You can simply do a Facebook live or a YouTube live video You know and and have people chat and you can look at the the chat along the way like I do with my videos And people can you know people can give you questions through the chat Through Facebook or YouTube while on zoom you're by yourself. That's the most secure and And still very public way of getting your content out there. However, what if You want to interact with some people right in the zoom meeting and Still have the public be able to see it then you selectively invite Some people that you already know personally that you think would be good attendees that you would like to interact with so let's say five or ten of your clients or Colleagues or fans or friends five ten fifteen twenty however many you want to do this for You invite those people only you send them the zoom link and Simply tell them listen. Please keep the zoom link zoom link private It should never be shared anywhere and I've been doing this. I've been first of all I should have said this earlier. I'm not going to change anything For my private meetings and for my paid zoom meetings. That's very important to say I've like I said, I've done over a thousand zoom meetings. Most of them group meetings In my client group and in my paid courses Never has there been random people who joined let alone trolls and zoom bombers Because why the zoom bombers aren't going to pay money to join a meeting to bomb it It's ridiculous. You can easily find lots of free ones. Why would they pay for a course to go there? No, they're not gonna do that They're also not going to join private meetings if you only sent the meeting ID out to your clients or to your Set number of colleagues and every time I do that I always tell I put the zoom meeting link and underneath that I put in parentheses Please keep the zoom link private going forward. I'm going to add another line. Do not share it anywhere to Respect the privacy of the attendees and the security of meeting whatever you want to say But that's all you have to do. So private meetings paid meetings. No problem. All I'm talking about is public free Zoom meetings. So like I said the first method selectively invite Three five ten twenty people that you want to interact with Okay, give them a zoom meeting ID. Tell them not to share it. Okay, and then once you're on the zoom meeting You can then stream that meeting through Facebook live or YouTube live and have the entire public be able to watch and Chat in Facebook or YouTube and yes, you might say, well, can't they do racist or bad? You know spam type of chats in Facebook or YouTube they could but we're all more used to seeing okay There's spam. We kind of ignore just it's just a chat. It's not it's not a video that's playing right on your meeting or anything It's just a chat and also you're allowing Facebook and YouTube to do the to do a bit of vetting for you because YouTube and Facebook quickly shut out spammers and People like that. So anyway, so selectively invite people tell them it's private link and Stream publicly if you want that content out public or if you don't want to stream public and have to deal with the comments That are coming through then just record your zoom meeting and then share it as a video later Then you're not streaming in you don't have to worry about the chat thread in real time on Facebook or YouTube. Got it selectively invite Record it optionally you can stream that publicly. Otherwise just upload the recording later because that's option number one selectively invite Maybe stream publicly or just share the video later The second option is if you really want a large number of people interacting with each other So it's again, it's a free public zoom meeting where you want Dozens or even hundreds of people interacting with each other. Here's what you need to do you need to Have people register Okay, and my suggestion is to use mail chimp or whatever email newsletter software You use a Weber constant contact, whatever but use an email newsletter software to take registration So people are essentially signing up signing up for a mailing list for that event about that event Okay, so so create a mailing list just for that event have people sign up and in the sign-up process Ask them at least one open-ended question to vet their interest in the event. So you might want to ask Please describe with at least 15 to 20 words your interest in this topic Okay, something like that then those you know For example, if I'm asking people to sign up to talk about authentic marketing Then they're gonna say well, I'm interested in authentic marketing because I've I've been I've seen the mainstream ways of marketing I don't like the pop-ups. I don't like this the false scarcity and things like that That's why I want to talk with you. Okay, so this person clearly has a passion has an interest in this topic So I know that that person is legit. So in other words, you ask an open-ended question In your registration besides their email address and their name That open-ended questions, so that's the first thing you do is to have an open-ended question in your registration Trolls and zoom bombers aren't going to go through the trouble of thoughtfully answering an open-ended question because again They're looking for easy targets and looking for just zoom links that are freely available on the internet They can bomb I mean, there are so many of them out there at any time of the day that zoom bombers can just go there They're not gonna worry about a registration form and answering it correctly. Got it okay, so registration form open-ended question thoughtful question and then also very importantly you need to Be clear in your registration marketing of the event that the event registration ends Four hours before the event starts you need to make that clear in the marketing of the event event that registration ends four hours before it starts Which means that you need to schedule for yourself Three hours before the event starts you need to just have cleared your calendar so that three hours before the event starts Oh, sorry you for four hours, right? But in in the registration confirmation page So once they register they finish registering the confirmation page and email Should not have the zoom link. Let me repeat that the confirmation page and email should not have the zoom link But they should explain thank you for registering to maintain the privacy. We are vetting each attendee and If you are accepted into the event, we will email you the zoom link two hours before the event Got it Tell them you'll email them the zoom link two hours before okay So three hours before the event you sit down at the computer and you look at all the event registrations and the answers Okay, and if there's any answers that are super short or questionable you then email that person To say if you're if you're able to respond before the event We can still let you in but please let us know your interest because we need a longer response than this That's it And then if they have any email you with enough time for you to send it to them great If not just then if we don't get your response in time, we will send you the recording afterwards Thank you for your interest So so that's it so then you you you you delete or respond to people who seem suspicious and The remaining people you send them through the mailing list software like Mailchimp or cause because they already they already signed up So you delete the ones who are suspicious maybe and you send the zoom link Two hours before the event to the people who are legit. That's it That's simple. Remember they're telling them to keep the zoom link private and I can almost guarantee you by doing that You will never have to experience the zoom bombing experience, which is like I said terrible It's a humiliating. It's shocking. It's traumatic It made me not want to do zoom meetings for a while But I I kept going and it's really not not a problem unless you post it publicly Remember, how did they find my zoom meeting because it was a public Facebook event page with the zoom meeting ID and and also I streamed my my meeting publicly on Facebook live with the zoom meeting ID in the Facebook event Sorry in the Facebook video Description area to so just don't put your zoom meeting ID zoom meeting links anywhere publicly And you should be fine. That's really the main message So I hope this is helpful and I look forward to seeing if you have any questions or any comments And in fact, I am streaming this on Facebook live right now So I'm going to give you a moment to add a comment below While I look at the comments and and see if there are any questions that I should answer right now So go ahead and comment below while I look for the comments that are live here Yes, okay, and thank you for those of you who are joining me live Liz Peter Prem Tina Susan Captain So that's it. I I'm trying to balance between Security and privacy on the one hand and practicality and freedom on the other hand That's the balance because most people who do security Take it way too far and it's like every everyone must be perfectly safe There'll never be any danger which also means we cannot interact with each other I mean if I could talk about the corona virus, I mean, that's that's kind of like what we're doing here Decidely too. It's like so much lockdown So that that the economy is is just terrible for everybody because we can't interact with each other Anyway, so it's this balance between security privacy and and freedom and and Community on the other side. That's the balance here. That's what I that's the methods that I'm showing you that will Achieve those aims for zoom public free beating. So all right. I'm George cow authentic business coach I usually talk about building a business authentically so only subscribe to this channel if you actually want to learn about Building a solopreneur business in an authentic honest way doing marketing honestly and with love Otherwise if you're just here for zoom advice, don't subscribe to my channel. I don't usually talk about zoom stuff So alright, okay, I'll see you in the next video about authentic business or authentic marketing. See you soon. Bye. Bye


I'd like to thank everyone who is joining us today. Welcome to CNCF, or welcome to today's CNCF webinar, Encrypting Data and Kubernetes Deployments. Protect your data, not just your secrets. I'm Kristy Chan, Marketing Communication Manager at CNCF. I'll be moderating today's webinar. We would like to welcome our presenter today, Maxim Gankovsky, VP of Engineering at ZSET. A few housekeeping items before we get started. During the webinar, you are not able to talk as an attendee. There is a Q&A box at the bottom of your screen. Please feel free to drop your questions in there and we'll get to as many as we can at the end. This is an official webinar of the CNCF and as such is subject to CNCF Code of Conduct. Please do not add anything to the chat or questions that would be in violation of that Code of Conduct. Basically, please be respectful to all of your fellow participants and presenters. With that, I'll hand it over to Maxim to kick off today's presentation. Take it away. Thank you very much, Kristy. Good morning, good day, and welcome everybody. As they say in the airline business, when you board a plane, you realize you have a lot of choices when it comes how do you spend the next hour of your time. Actually, with the quarantine today, you don't have a lot of choices, but we're still going to try and make this hour very educational and very informative. So, with that, I'm Maxim Jankovsky, the vice president of engineering at ZetaSet. Brief bio of myself is I've been working with data security and encryption software for the past over 14 years in companies such as Ingrid Networks and SafeNet, and my team has been responsible for developing coordinate security solutions, including the key secure data security appliances that are still being successfully sold and shipped to customers as part of SafeNet, Jamalta, and now Talos security portfolio. And at ZetaSet, we're developing encryption and security software that has been used in today's ever-changing marketplace. A brief agenda of what we're going to do today, this is not linear, it's kind of a summary of what we're going to talk about. We're going to talk about global security challenges, the state of encryption, where we came from, how we ended up here, and what it looks like now. We're going to talk about data breaches, data protections in terms of DevOps and DevSecOps. We're going to talk about what it would take to engineer an application or an application system with security in mind. And, of course, through to the topic of today's webinar, we're going to talk about how do we protect enterprise data, and then we'll have enough time to go into Q&A, of course. So, first item on the menu, data breaches. The cyber attacks are increasing in frequency. Everybody has been targeted. You'll see a number of companies mentioned in a small phone down there at the bottom of the slide, but there are some big names there.  Essentially, data breaches are done, they happen very often, but in terms of the cost of the breach, they're actually quite pricey to the enterprises. There are about 3.62 million per breach, and the breaches happen often. And if you look at it, over 42 percent or around 42 percent of the cost of the data breach is actually the cost that enterprises incur in the lost business. That's quite substantial. So, nobody's going to be surprised when the next data breach occurs. What remains to be seen is that what enterprise are going to be doing to prevent this data breaches from happening. And again, through today's presentation, we're going to talk about containers. We're going to talk about containers in production. Containers is relatively new technology. It's been on a rapid adoption scale over the past several years. And several things that these graphs that you see on the screen show is that the use of containers have been increasing pretty dramatically, and the containers used in production has also been increasing. On the second graph especially, if you look at the number of containers that people are running in production, you'll notice a drop in the number of containers used in production of clusters 50 and fewer containers. At the same time, you'll notice the increase of the number of containers in a larger clusters. What that indicates is that a lot of containers are people moving from kicking the tires and moving containers into production. With the number of clusters and number of containers in production increasing, the number of attacks are obviously increasing. Consequently, the importance of protecting from those attacks increases as well. Some of the surveys indicate that 69% of those surveyed, they intend to store sensitive data in containers. Around 76% use containers for storing and manipulating data that fall under some sort of regulations. The staggering number, that's 94% of those surveyed experienced one or more security incidents in the past 12 months. I think the other 6% are just not saying. What are the challenges? Why data protection is such an important topic? In fact, data protection and data security is a super important topic when you talk to enterprises regarding their storage challenges. Also, it's in the top three of the security challenges with protecting the data in containers, along with vulnerability, management and runtime protection. In the CNC survey conducted in 2019, the survey indicates quite a good uptick in respondents using Kubernetes in production from somewhere in 2018 up to 2019, about 20% uptick in the number of containers that are being used in production. Users are certainly expecting more security with their deployments. Compliance, 68% of those surveys indicate that compliance is critical and it must have. Those who indicate that it's nice to have are probably those moving into larger scale deployments and also moving more containers to production. I fully expect the numbers of this 28% spilling to the 68% and that number increase as well. These few slides, if there are a few takeaways from these slides, is that containers are on the upswing. Container environments are becoming more and more prevalent. Regular potential prices are moving data into containerized environments and they're increasing the sizes of those environments and storage and data security and compliance are becoming one of the several major factors on the road of successful container deployments. How do you protect your data in general, not just in container environments? Encryption is, I would say, the best form of data protection. By the way, encryption in and of itself is not the end-all data protection for your enterprise environment. Data protection is usually a combination of tools, but we like to call encryption kind of the last line of defense. After your firewall is compromised and your environments are broken in, the next thing you have is the safe new living room that stores your most valuable information. So you have to encrypt throughout the process. You have to start a collection, you have to encrypt all data manipulation pipelines and preferably you do that at the time when data is created. Any sensitive information that must be stored must be encrypted. And of course, you have to log and monitor all data activity because oftentimes log mining is one of these tools that gives you visibility and early visibility into a data breach. Encryption is super important. Data protection is super important. So why aren't more people deploying it? Why is it not the norm? And this is where we talk a little bit about what encryption was and what it is now. Encryption used to be quite complex to deploy and to manage. It used to impact performance to a substantial amount of degree. There's a lot of crypto accelerators and a lot of specialized hardware that have been built over the years to address performance concerns. And if you look at those surveys back in 2017, they clearly indicate that 78% are concerned about deploying encryption because it's going to impact the system performance and latency and enterprises just cannot slow their applications down. Also encryption, it used to be and some of the current encryption solutions still are not simple to manage. You have to identify which data you want to encrypt and then you have to manage the encryption solution. You cannot just point and encrypt and you should be able to. Enforcement of policy is another chief horrible to adopt encryption. And of course, with increased cloud and on-premise and hybrid deployments, it's concerning for people how well encryption is supported in those hybrid deployments. Of course, with the rise of cloud and virtualized environment systems scalability becomes a problem. We used to just deploy encryption server in the data center and call it a day, but now we may not even have access to the data center. And the number of environments is increasing, number of containers is increasing, and therefore obviously the number of cryptographic keys that are used to protect those environments is increasing. One of the surveys we don't show here indicates that over 40% of enterprises are not using key management tools, any key management tools, and actually storing encryption keys in the combination of text files and spreadsheets, which, you know, it does not really sound like a 24th century security practice or as a security practice in general. And of course, one of the other concerns is integration with other security tools because large enterprises, they have a combination of solutions and combination of tools, and encryption needs to integrate with those. So it's not easy. Integration, integrating encryption has not been easy, and it's still not. So when your enterprise is at the point where it has to either comply with the regulation or it's just doing kind of a good housekeeping of protecting their customers' data and your task or one of your colleagues is start with choosing an encryption solution, what is that that you look for? What does it mean to have a good encryption solution in your enterprise? As we already talked, performance is super critical. So you want a solution that introduces performance penalty, but in a very small percentage numbers. Encryption is not free, even with today's crypto accelerators and native encryption support in Intel chips. Encryption still costs performance cycles, but you want to keep that to the minimum. Businesses, they don't want to have any impact on their existing processes. If you talk to some of the especially healthcare providers, they cannot have, they cannot be adding even a minute to a patient appointment because their practice essentially runs on seconds. Scalability of physical environments, virtual environments, hybrid environments, the environments come and go. They get deployed several times a day. They get decommissioned several times a day. And of course, you cannot have a person run to the data center and install security appliance every time a new environment comes on board. So back in, I can't really say back in my day, but back in late 20th century and even early 21st century, enterprises had to have dedicated people on their stuff that understood how encryption works, how encryption is deployed, what's an encryption key, what's a key wrapping key, what's a hash key, what type of algorithms are recommended, what types are not, and after you deploy, how do you manage and troubleshoot that system? And it's pretty difficult and pretty expensive. And so anything we can do, anything encryption solutions can do to make it simpler to manage and simpler to deploy. And anything these solutions can do to make sure that you don't need specialized cryptographic expertise, that makes a better solution. And of course, there's a number of compliance initiatives going around since the first data breaches back in early 2000 that compromised the financial sector pretty severely. That's where MasterCard came up and Visa came up with the PCIO Payment Card Industry Standards. And so all of these compliance initiatives around PCIO, around financial sector, around healthcare sector that later resulted in HIPAA regulations and so on and so forth, one of the notable ones in GTPR as of the past few years, all of those compliance initiatives, they are, encryption is a very good vehicle to address chief concerns of those compliance initiatives and essentially pass the compliance audits. So one thing I'd like to put to rest right at the beginning, or right at the beginning of a more technical part of this presentation is there have been tools that have been created over the years that attempt to simplify or make it simpler to deploy encryption and to manage encryption. And some of them are self-encrypting drives, some of them are file encryption solutions and so on and so forth. And so why would we just not use them? So on the left of the slide you can see what I would call the encryption stack, which is essentially a software stack and hardware stack where you can apply encryption. Starting from the hardware, you can go all the way to application level encryption. The interesting thing about this stack is that as you go higher up the stack, you're talking about more purpose-built solutions and you're talking about greater performance degradation. As you go lower up the stack, you're talking about more generalized solutions. And you're talking about better performance, but oftentimes you have to sacrifice some granularity, especially in databases and applications where you might not be able to encrypt a column. In the database, you might have to encrypt the entire table. Or you might not be able to encrypt the entire table, you will have to encrypt an entire partition that the database stores files on. So the goal of this slide is to show that there needs to be a compromise between performance and granularity. And self-encryption drives are very low on the stack, very appealing, but they're not a compromise. We're going to talk about what does it take to make a good encryption solution that you can trust with protecting your data. To make it short on this slide, I'm just going to say that self-encryption drives are shortly not going to help make you a good encryption solution because not only their key management is borderline non-existent, or if it does exist, it's very much substandard. Also, how do you manage a data center of 10,000 self-encrypting drives when you need to replace or manage those installations? And finally, if you're in a cloud environment, do you really have a choice as to whether or not self-encrypting drives are used, how often they're decommissioned and how often they're replaced? So not the answer. And with that, we're going to talk about DevOps, DevSecOps and why do we need to put security in place at the design time and why security is a very, very bad idea. So DevOps is essentially an ability to deliver quality applications, quality software fast. And DevSecOps is an ability to do this with security in mind. So not only are you delivering quality applications and you're doing it on a fast and predictable schedule, you're also developing secure applications quickly that enterprises can trust to store their sensitive data. So security should be baked in from the very beginning. You need to identify your primary drivers for your security initiatives. Is that compliance? Is that a good housekeeping? Is that the desire to protect customers' data? Usually it's a combination of both or at least hopefully it's a combination of both. And so how do you balance security with regulatory compliance? And the reason I bring this up explicitly is because regulatory compliance is usually done on a timeline and enterprises oftentimes attempt to achieve compliance with the least amount of investment in security initiatives. So there is a fine line, there is a balance that you have to figure out between how do you make environment more secure and also achieve compliance. You have to look at what security solutions are appropriate for your environments, not just today but going forward as well. And tempting as it may be to just say environments come with secrets and passwords and all different kinds of ways to store your sensitive data. And secrets and passwords are great, they're very important, they're critical to environment functionality, but they protect your processes. They do not protect your data. So a good security solution is a security solution that you can trust. Because if you can trust your security solution then why bother deploying it in the first place? Security solution as we talked is a combination of components and all those components talk to each other, they have to be able to trust each other. That is why pretty much every security solution needs to have one or another form of what's called the certificate authority, which is think of it as a United States Department of State that issues passwords to security services or DMV that issues driver licenses. It's essentially a service that authenticate security processes and other processes to one another. So when you talk to a processor in a system you can trust it. My favorite knowledge is that you encrypt your environment, you have one or more encryption keys, and so where do you put your encryption keys? You need to have a key manager, a system that is capable of securely and safely storing those keys. I mean you wouldn't put your house key under a door mat. Some of us do, some of us put it in the wheel well and you know we hide it creatively and we're surprised when we're broken into. So no keys under the door mat and there's a number of key managers that are available in the market but different. Depending on your security requirements you can opt for software-based key managers, you can opt for hardware-based key managers, that's up to you. But when you look at a security solution and it doesn't make a specific mentioning of how to store and protect your keys, I say look somewhere else. And of course there should be a root of trust and when I say root of trust, I mean the root of trust for storing what's called the master key. Essentially your key manager protects your most valuable assets is the encryption keys. So who protects your key manager? And for that there's a special component in security solutions that's called the security module. And there are a number of security modules which are hardware-based, a number of security modules which are software-based, but that's kind of a given that if you have a key manager it needs to have a specific security module component so that the encryption key database is protected and encrypted itself with the security module, with the keys stored in the security module. And the security module knows how to store the small number of master keys and stores in a secure and compliant way. So container as environments, they're quite different. They look for when you're within the container, you can feel it say necessarily that you're within the container. Because the containerized and virtualization environments, they do a pretty good job of hiding the fog that you're within a small container from developer or from the end user. But containerized environments are very, very different. So storage in containers is different and therefore the data, especially the sensitive data, might be protected in different ways. The first one, the first key point is that encryption must follow storage, which means in multi-tenant container environments the storage will be shared. But even if you share the storage, you should never share an encryption key. I mean to me, and then to a lot of people, you know, if I say it's slightly different is that you better trust the people you give your house keys to, right? That's kind of obvious. I'm a little bit surprised why, you know, not sharing an encryption key is not so obvious, but apparently it's not. Storage must be independent of hosting containers, meaning today your container might run on one host, tomorrow it might run on another host. That actually means that, you know, the storage must be shared between containers. So we cannot use legacy approach of hardware-defined storage, where the storage is directly and physically tied to the host. We cannot use that approach when managing storage for containers. And last but not least and also super critical is the separation of duties. We have different roles and different actors now. We have developers, we have platform operators, we have administrators, we have a number of other roles, but there needs to be a clear separation of duties. And not that you shouldn't trust your developers, but the developers are not in the best position. They're not the best people to ask to make security decisions. These decisions have to be made elsewhere in the enterprise and you want to maintain that separation of duties. So let's look at an example of a topology that you may see in a typical maybe even simpler docker environments where you have one or more docker hosts and each host runs one or more containers. Containers are obviously belong to different applications. That's the whole purpose of virtualization is sharing resources between containers and sharing resources between tenants. So you can have different docker host running different containers for different applications belonging to different customers. The key point is the storage and the containers. Every storage unit associated with every container must be encrypted with its own unique key. Why is that so important? Because compromises happen with the beginning of the presentation that environments will be compromised. When the environment is compromised, you want to limit the exposure. You don't want one of your environments. If somebody compromises my development environment, I don't want that exposure to spill out to my payroll environment or my finance environment. If I am a solution provider and if I host more than one customer, I certainly don't want one compromised customer to compromise my entire monitoring environment. So that is why no sharing of keys. So how would we do this? How would we accomplish that? Let's say with docker. We would look at docker storage mechanisms and we would create a what's called an encryption volume driver. So at the time that container requests storage, it would be given a storage volume that is already encrypted. It would be encrypted with its own key that is not used for any other storage volume anywhere else. And the key will be securely stored in the key manager with all the certificate authority and the security module infrastructure we already talked about earlier in the presentation. This is done by directly integrating with increased volume driver that is part of docker. And we are going to have some sort of volume provisioning and some sort of volume management. What we show here is a very simplified, very simplistic volume provisioning based on a traditional Linux storage model. But the volume group provisioning might as well look at provisioning specific cloud based storage in AWS or in Google Cloud. The most important part is that by the time container gets the volume, the volume is already encrypted. So let's look at a more fluid environment where Kubernetes makes it easy to orchestrate a very large number of containers. And Kubernetes has a number of worker nodes similar to docker nodes, but now containers can run pretty much anywhere. In docker world, at least there is some association between where container runs today and where the container will run when it's restarted tomorrow. The container can be scheduled on one node and rescheduled on another node at different times depending on the environment load. That's the Kubernetes way of running containers. The storage is most likely shared. The same storage for them is that every storage unit associated with every container has to be encrypted with its own unique key. And Norie specifically emphasized that on the Kubernetes master level, we have secrets and the secrets, as we all know, stores in HCD key value pairs. Up until the latest revisions of Kubernetes, HCD was not encrypted. Now there's an option to encrypt it. But an important part to realize is that secrets, just like I said at the beginning, is kind of like a password file. It is critical, absolutely. To Java developers, secrets are kind of like the JKS key store. So what do we store in a key store? We store keys, we store passwords, we store certificates, and so on and so forth. But we don't use the key store and we don't use secrets to store encrypted data. And so the same approach would be beneficial to that type of environment is you see a Kubernetes code layout a volume claim for a particular storage unit or a storage class as we call it in Kubernetes. That storage class would hopefully refer to an encrypted volume driver that just like a specialized volume drivers know how to provision NFS storage or AWS storage or any other type of storage, an encrypted volume driver would know how to provision an encrypted volume on request. An important thing to note is that every part will get its own separate and distinct volume. And every volume will get its own separate and distinct encryption key and its own separate and distinct backing storage. So that backing storage will be transparently provisioned in the encrypted state by the encrypted CSI driver. So this type of approach, it lends itself very, very well for enterprise use cases where, again, as we talked earlier, encryption is not the one to solve every data protection problem. A big problem of data protection is can you trust your environment? And so in the example of Red Hat OpenShift, where they provide an infrastructure and framework for essentially certifying containers and Kubernetes operators, that gives you a certain level of certain additional level of assurance and security that whenever something develop, someone develops and certifies a solution, it is going through a certain certification process that assures that container images are built on top of a trusted platform, that you can trust the container image, you can trust the deployment mechanism, you can trust all of the components that run within this certified environment, and you get all of those images, all of the container images, all of the operator images, everything basically related to any software including encryption so far. When you get it, you get it from a trusted source. So we talked about different places and different levels at which we can apply encryption, and what are some of the advantages of implementing encryption in the way that's native to containers? We already talked about unique key per valid, so each persistent volume is encrypted with its own cryptographic key, so one compromised container does not compromise the entire multi-tenant environment. We talked about secrets are not protected by default, although they can be now protected from later Kubernetes releases, but the important notion is that they do not protect the data, so a separate data protection solution is required. As we talked earlier, password files don't protect data, they protect your environments, and JTSs don't protect your data, they protect your environment, so every unique system has a password file, but that doesn't mean that every unique system doesn't have a separate encryption and security solution that it comes with. One huge, very large benefit of native container encryption is that you can securely, with the proper key management infrastructure, you can securely erase the data without actually having to erase the data, and that is done by decommissioning the cryptographic key in the key manager, and so therefore when the container goes away, and if the container was to come up again, it won't be able to acquire an encryption key necessary to decrypt the data. So if the number of nodes in the classroom grows, sometimes the nodes get compromised, sometimes nodes need to be decommissioned and replaced, and if these nodes have sensitive data, you don't always have an ability to connect to a node and delete the sensitive data. With the secure node removal feature, you can actually do that by executing administrative commands so that even if the node is compromised or even if the node is later brought up and connected to its native network, the corporate network, it will not be able to access the data. That's again done by managing what's called the certificate revocation list in the key manager. And last but not least is the container storage separation. We already talked about why it's important to encrypt each container volume with its own unique key. So the container storage separation allows you to go even deeper on that, where every container volume is mapped to a unique logical volume, and that logical volume is only available when it's in use by one or more containers. So these are the things that you want to look for in a software-based security solution, in any security solution you choose to deploy, and hopefully with proper deployment mechanisms and with proper identifying of solutions you'll be able to deploy a solution in the enterprise that will protect your data. It'll protect your enterprise from breaches and it will protect your enterprise and hope that it stays in compliance. That's, I think that covers the entire presentation for today, and let me see if there are any questions. Yeah, awesome. Thanks, Maxim, for a great presentation. You're reminded of folks that we do have a Q&A box at the bottom of your screen, so if you do have a question for Maxim, feel free to drop it in, and it looks like we do have one question already that allowed for you, Maxim. It's from Miguel. It says about encryption storage. My first concern is reliability. If we lost damage to some bytes on storages, we can still recover the disks or most part of the contents. From my experience, this is also a problem, even in my laptop with BitLocker. How is it solved on containers? Okay, very good question, and yes, encryption is essentially an additional process and that's done on the data, so it does put heavier load on storage, so it's a very valid concern as to how do we recover from lost or damaged or even worn out bytes on storage, especially if you look at some of the more recent developments in the storage methodologies and you look at solid state drives, they are known for their wear. So how do we do this? You deploy a proper storage mechanisms that provide you a certain level of redundancy. You backup your storage regularly, and you use specialized backup not just the RAID, not just highly available disk volumes. You're also backing up the data regularly. When you deploy encryption, one of the critical portions of your data pipeline become your encryption key. So therefore, one thing you look for in a security solution is what kind of key manager infrastructure they provide. They provide key manager, great, that's already put them ahead of many security solutions. Is that key manager highly available? Is it hosting the data or is storing the data on highly available storage volumes? Because that's essentially what you want to do is to make sure that not only your data is protected, but your keys are also protected. Okay, awesome. Looks like we have another question. It says, from an anonymous attendee, can you elaborate on what you mean by transitioning my DevOps environment to DevSec off? Right, so this is essentially good question. It's essentially how do you take your environment where the goal of the environment is to quickly deliver quality solutions to an environment where encryption and security rather is part of that quality differentiator. So you'd like to not just say I'm in DevOps, which is kind of like agile, quickly develop solutions that have a certain level of quality. Also, security become part of the implicit part of quality. That's the transition from DevOps to DevSecOps. Great, okay. Yeah, I'll read it. And I'm apologizing if I'm butchering listening, but it looks like Saruba is asking, could you please elaborate on secrets are not protected by default? Right, so Kubernetes secrets are not protected by default. Secrets are essentially stored in FCD, which is part of the core Kubernetes deployment. FCD is a key value pair storage. And the storage that's used by FCD to store the key value pairs, it's not encrypted by default. So if your FCD is compromised, then the storage is exposed, and the secrets are exposed. Later versions of Kubernetes provide a way for you to encrypt the secrets stored. And that adds a certain level of protection, at least when you look at the secrets, you will not be able to gain access to the underlining secrets works. Great, all right. Well, I think that covers all the questions today. Thanks again, Maxine for a great presentation. That's all the time that we have for today. Just a reminder that the webinar recording and slides will be online later today. Thanks again, and we look forward to seeing you all at a future CNCF webinar. Have a great day!


Tapes up and we're away. Certainly, Doyle has made a smashing start. And then, but... Ato Smalsik having dropped back through the inside. Here he comes! Feminist move from Smalsik. Made a big long straight down the back straight, coming out of turn two. Ato Smalsik is a country mile away. There's a chance to line for second. Doyle hangs on. But that'll settle the nerves, won't you, when you can ride like that. And that stunning move out of turn number two. Settling down now, tapes are up, we're away. Becker's got that. Certainly, he holds the inside. Here comes Lingwin round the outside. Becker's going to be vulnerable down the back straight, and he is. Oh, my goodness gracious me. Freddie Lingwin there, clowns the fence. Doyle didn't give him a lot of racing room. But Freddie Lingwin has surged to the front. Lou Becker has just pushed aside. Coming out of turn number four. Wants this, doesn't he? Wants it. Yeah, he did. And he's through the last corner. And he's going to win heat 15 and whaty. And now, how did he go about it? Just being the right place right time. Here we go, heat number 18, tapes are up. Bully's made it. He hits the front. Labbers alongside him. Here we go, round that first corner. Becker's on the outside. Certainly, Frick's lifting. Becker coming through into third place. Bully hits the front. Here comes Robert Lambert, pushing up the inside. Becker's come round the outside. Labbers having to respond. Slaps the door shut. Let Becker having to elect to go back to the inside. Bully now under a lot of pressure from Robert Lambert. The tight battle between the two British riders. Down the back straight for the final time. Lambert now. Lambert round the outside. He's got lots of speed. Robert Lambert would have smashed him right from him. And it gives the holder a real shot. Lambert Smarsley's hit the front. Looks good right now. It's taken the opportunity to slip up the inside of the second. Last blast is written superbly. Number two superb stuff from him. Besselik now being swallowed up by Leo Madsen. Oh my goodness, and Besselik has gone to the back. Can you believe that? Superb out-of-gate number two. One last blast down the back straight. Freddie Lindgren, a fabulous ride from fast Freddie when he really needed it. He's got some character there. Through the second place.


Hello everyone. My name is Dominique Peltier and I'm the Chairperson of the Implementation and Capacity Development Committee, also known as DIC. As you may know, the purpose of DIC is to ensure that contracting parties to the IPPC have a common understanding of the convention and of its standards, and that they have the necessary capacity to implement them. One way to do this is to develop guides, training, and communication material to assist contracting parties. The following video is one such example. It presents a collection of tools that beyond compliance tools to assist with implementation of systems approaches. Because they are a viable alternative to complex procedures like treatments or to restrictive import measures like prohibition, many countries including my own are resorting to systems approaches to allow for the import and export of plant and plant products. While the requirements for systems approach are outlined in ISPM 14, grasping all the nuances and understanding how the different measures can be integrated into systems can be hard. The beyond compliance tools are there to help. There are a collection of templates that were designed by the Imperial College London to provide a visual experience when developing measures as part of a systems approach. Even better, they are available for the whole IPPC community to use. The IC welcome implementation material such as this and will continue to welcome guides and other resources developed by other organizations involved in implementation and capacity development in the future. On behalf of the IC, I would like to thank the Imperial College London for their dedication in developing the tools and for making them available to the IPPC community. I would also like to thank the standards and trade development facility for the funding that made this project possible. With that, I wish you happy viewing. Thank you.


You're looking at our remarkable ocean, responsible for supporting all life. Yet below, the ocean is in crisis. Depleting fish stocks. Destruction of habitats. Pollution. We need to do more to sustain our ocean, much more. Fiscal policy tools, things like subsidies, taxes and fees can help. Governments can subsidize innovation that protects marine life and discourage harmful practices like dredging with higher taxes or penalties for those that still use them. But many fiscal policy tools aren't currently working in this way. Large fishing fleets continue to receive massive subsidies, which in turn encourage dangerous overfishing. And many governments aren't able to collect taxes and fees effectively. What if we could end harmful subsidies and even offer rewards for practices that support sustainability? What if we could build government's capacity to collect taxes and fees more effectively? What if fiscal policy tools were designed in a way so that the benefits are fairly distributed, such as channeling resources towards sectors that employ more women? At IIED, we want to bring together experts, policymakers and communities to share this knowledge and generate evidence to inform a positive shift in marine governance. We want to start a new conversation, one that leads to not only sustainable oceans, but a fair and equitable life for all people. Join our conversation, IIED.


Hi everybody, welcome back to our chats at Upstream. And today I had, this afternoon I should say rather, have Carmen Bianca Baker of the Reuse Project from the Free Software Foundation Europe. And, you know, we've been talking today about what it is that we owe each other. And traditionally in open source, one of the very key critical things that we have owed each other is, what is our license? What is it that we give each other software under because a core plank, if you will, of how open source and free software, of course before that has functioned is an irrevocable promise under a license to allow people to use, modify and redistribute. As our software has gotten more complex, corporate users in particular have increasingly demanded not just the right licenses, but the right metadata about licenses. When we had five packages in our application, it was easy to say, oh yeah, we'll just read the license files. But now that we have 5,000 packages in an application, it's a little more complicated than that. And so Carmen works on the Reuse Project, which is an initiative to standardize information about licensing across all free and open source software projects in a way that is, I think, I'd love to talk some more about this, both human friendly, but also very much machine readable so that when we are building these towering piles of software, we can understand the whole thing. So Carmen, first of all, congrats. Just a couple of weeks ago, reached 1.0, did a 1.0 release. That's an awesome milestone. The project has been going on for several years now, right? Yes, correct. I joined the project in its infancy in 2017 when I was an intern for the EFCV and I kind of stuck around. In the way of all great free software projects. Yeah. The best people just sort of get sucked in, yeah. As a matter of fact, when I joined the EFC, I was supposed to work on something completely different, but that kind of fell through because of scheduling. And I saw this project lying around the reuse project and I was like, I know a little bit about software licensing. I can do this one. I'm waiting on the other project to pick up. The other project never picked up and this kind of became my thing. Well, very cool. So what drew you, I mean, well, so you were just saying it was there, but what's made you stick with it for five years? Because I do like programming, but I like this project in particular in a very egotistical way because it's very core Python in a sense. It just allows me to do really, really Pythonic stuff and improve my Python skills, but also because I've come to kind of care about software and licensing. And I'm also a little bit of a stickler for getting things exactly right. And this is the kind of project that helps people get things exactly right. Well, let's talk a little bit more before we go into the why's and the where for's. I mean, for those who aren't familiar with reuse, what is it like? So the what is getting done exactly right is licensing information, licensing metadata. How does reuse help with that? Reuse helps with that, it helps with that in the sense that, so reuse is made of two parts. One, it's made of a specification and general guidelines to the developer. And two, it's made of a program and they kind of in sync with each other. The way reuse helps most of all, well, that would be very egotistical of me to say that it helps most of all because of the tool, but it helps because it has very clear instructions and those instructions can very easily be verified using the tool. So it's the two reinforce each other. Right, so for those of you who are following along at home, I believe it's reuse.software, is that right? Is the... I do believe it's, yeah, it's reuse.software. Yeah, I had no idea until I stumbled on reuse some years ago that .software was a top level domain, but now you two also know that information. Yeah, so reuse.software and yeah, like you say, it's very clear specific instructions for developers on how to do this thing. And then software, I don't think you should sell the software short, right? I don't think it's egotistical to say mere documentation without validation. I think that's actually one of the core learnings of modern software as opposed to 10 or 15 years ago, right? There's much more of a sense of if it's not tested, if a computer can't help you do it, then it's often not gonna get done, right? And I think if anything, that's one of the key learnings of unfortunately in the day job at Tidelift when I'm not hosting chats, one of the things that we have to do sometimes is go into very old software and try to understand what is the license. And like you, I'm a stickler for getting things right. And yeah, that means sometimes I pull my hair out because I have to go, what were they thinking 18, 19, 20 years ago when they put this software together that like they thought that this sort of jigsaw puzzle of license information was good enough, right?  It's time for us to just gonna say professionalize, professionalize is a loaded word but certainly standardize where our license information is, right? Yeah. And to just be as clear as possible is the trick. And so one thing that I've forgotten the exact name for it but it's become really popular in the last five years or so is to, yes, a single source of truth. And the idea of reuse is by adding the software, the copyright licensing information into the header of every single file. The information is as close as possible to the single source of truth. Right, yeah, that's a great, I mean, that's one of the many, I think things that reuse does really nicely, right? Is this idea that the single source of truth is the software and not some other database, some other.  It's based on other older practices and standards, right? Do you want to talk about that a little bit? Right, so it's based on a couple of things. A lot of the credit goes to the SVDX which was starting to really pick up steam by the time that reuse was getting started. And it kind of just, we noticed that the SVDX gave this very clear way of conveying information about licensing, which well, why not use that? And then the other conventions that we kind of copied is most projects or a lot of projects already have like a blur at the top, which has the copyright holder and the license, but this was never standardized. There was just a massive text at the top of every file. And we're like, what if we could make that a bit smaller? That's really nice. And if we could standardize that, so it works for every single iteration of license. Right. What we also, one old thing that we partially kept and partially changed is providing license file. So in most repositories, you'll have the license file in all uppercase at the very root of the project. We changed that into a licenses directory because most projects actually do have ultimately multiple licenses. And it's very unfortunate because this kind of breaks the nice GitHub UI where it tells you what's the license of the project is. We've bugged for you, sorry, we've bugged GitHub a couple of times about that. They keep saying that they're gonna work on it, but we'll see. Yeah. I mean, I think this is actually one of the interesting tensions for, you know, not just for GitHub, right? We like to have a sort of polite lie that we tell each other is, oh yeah, this package is under one license. And, you know, often, I don't know about in our, most is a whole, we could do a whole another talk about data on licenses. So I'll put that one aside for right now, but like, suffice to say, yeah, you're right. Many, many packages, certainly hundreds of thousands of packages do have well more than one license. And a thing about reuse that I would imagine is somewhat challenging sometimes is that you make it hard to maintain that fiction, right? If you're doing reuse properly, you really have to sort of come clean about all the many licenses that are in there, right? Do you get pushback from developers because of that? I've not personally experienced any pushback about that other than, of course, not having the single license file. But I think people are, all developers are realizing like, yes, actually there are multiple licenses. So I might as well declare all of them. It's a bit more work, but while reuse is ultimately a little bit more work. Right. Well, that's actually, that gets one of the things, like how, you know, theme today again is what do we owe each other? And certainly one of the premises of reuse, I think it's fair to say is that as developers, we owe each other accurate license information. And, you know, how do you go about, but well, but also suffice to say that isn't necessarily something that we've actually, we might pay lip service to it, but we haven't done it very well in the past. So how do you all like, you know, reuse as a group? How do you persuade, obviously step one is provide clear directions and step two is provide software. You know, but then you've got to go out and tell, like explain it to people and what are the kinds of arguments that you use and how do you persuade people? I think the arguments make themselves a little bit in the sense that you have to do this anyway. And when you turn it around and you are like, would you, when you're trying to find a code that you would like to use, would you like it to be reuse compliant or would you like the licensing to be an utter mess? Then most people will be like, yeah, I'd like it to be reuse. So the golden rule kind of applies.  So if everyone, I mean, this is a big hope, I guess, but if everyone kind of did it, then it would make the life of every developer a lot easier. As pertains persuading people to actually do it, this is a little bit harder, but we are doing a couple of things. Some communities just adopted. So I know the Linux kernel and the KDE community have been adopting reuse or a variation of reuse internally. I also know that the European next generation internet project mandates reuse compliance as part of all the projects that are delivered. So that's cool. And certain companies are also internally enforcing this. I know that the German COVID tracing app is completely reuse compliant. That's cool. Yeah. Yeah, I was gonna ask, what are some, I mean, I knew about the Linux kernel and I, as an old, you may or may not know, I'm an old GNOME guy. So I, maybe I'll go nag some people over there, though it's now many generations away from when I was involved, but the COVID tracing app, that's very cool, very timely. You know, have any of the, I noticed in the 1.0 release, you mentioned that this is a very Pythonic application and, you know, I mean, I guess I hadn't thought of it that way, but it makes a lot of sense, right? Given that so much of Python's strength is ultimately in text processing. And this is at some level, right? A text analysis and processing app. So I noticed that you distribute the app through PyPI, so you can pip install. Is it, for our Python listeners, is it pip install reuse, pip install? So if you, I would recommend to mostly use it to do a pip x install reuse. It's the new hotness. It is literally my job to keep up with these things and yet it is still hard. And well, but so have you ever talked with any of, like PyPI or it sounds like you've talked to GitHub, which is obviously a key part of the bigger ecosystem. Have you ever talked to like PyPI, for example, about, and I know there's an ongoing discussion amongst Debian developers about whether or not, or how to integrate reuse into Debian. Have you talked with like PyPI or NPM or any of those kinds of? I'm not aware of, so I don't do a lot of the communications. I'm also not aware of any talks with PyPI. I think it could be cool, but it's also, I think Python is a little bit behind with regard to licensing anyway. I believe it was, wasn't it NPM that really, yeah, NPM was the first to enforce a license. Like you have to choose a license if you want to distribute on NPM. I'm not sure if Python ever adopted that. I'll just say it's complicated. And to your earlier point about SPDX, right? I mean, this is one of these things where, as you know, when you're processing, I should step back a second. SPDX, something that Carmen mentioned earlier is the software package data exchange format or software program data exchange. I forget what the P is. I think it's package, yeah. Yeah, spdx.org, it is a couple of things, one of them that's most relevant is that it is sort of a universal list of open source software licenses, free software licenses and a set of standardized short, this is what all the license lawyers really love about it is more than anything else. This is a set of standardized short acronyms for licenses, right? So like MPL-2.0 is the standardized name for Mozilla Public License 2.0. Why I grimaced when you were mentioning PyPI, and this is not specific to PyPI, but PyPI for variety historical reasons, one of the more problematic ones is that it did not enforce SPDX as a, it slightly predates SPDX, I believe. So a lot of people put in license information that is looks like SPDX, but it's not actually SPDX and good luck getting from one to the other, right? And I think this gets to this question of, and there are certainly many developers who when you pointed out to them, hey, what did you actually mean by this? They're happy to take patches, they're happy to fix things up, but there are many others who are like, eh, good enough, don't care. Yeah, I know, it's a bit dreadful. I maintain the Fedora package as well. Fedora also doesn't use SPDX. So for the, so the reuse tool itself is like four licenses because you borrow stuff. And one of the licenses is the CC buy SA license, but it's just, I think in Fedora, it's just CC buy without a version number and it's dreadful. And there's no, we also have some CC zero stuff and there's no CC zero in Fedora. Yeah. I know they, I mentioned Debbie and I know Fedora is also having that discussion of how to modernize, right? I mean, this is one of these sort of unfortunate, you know, the XKCD comic about, you know, we have 16 standards, this is terrible. Okay, well now we've created a 17th, we'll create one standard to solve them all and now we have 17 standards, right? SPDX is a little bit of that, right? Because it did actually grow out of the Fedora stuff, but getting it back into Fedora and the has been, I follow along on that mailing list if I say it's, there's a lot of work to do, right? I mean, I think this is one of the things, you know, I think this is one of the things that I think is both fascinating and so challenging about something like Fedora is that the good news is your, I mean, about reuse is that you're building on 25 years of knowledge about licensing, but that also means there's 25 years of software to be fixed. And some days, I'm sure on your optimistic days, you're like, yes, we're gonna do this. And I would, if I were you on my more pessimistic days, I would just sort of curl back up under the covers, right? Yeah, so in response to let's do this, we have an internal project that we're trying to kind of kickstart called reuse booster. And the idea is to just approach projects and either encourage them to apply reuse or just do it for them. So it's a good way of, well, I'm not sure if it's a good way, but it's a way of really, you know, getting started. But I think if any listeners are keen to participate, yeah, change your favorite projects to be reuse compatible. I mean, I know we have had, I've certainly had conversations with the GitHub folks about their licensing tools. And so hopefully, licensee folks, licensee is the GitHub tool that if any of you are out there, well, Carmen and I are saying hi again.  If you've only got one or two licenses, the tool can help you very quick to standardize more complex projects, it's gonna take more time. I mean, booster sounds like a great initiative to help, especially with bigger projects. And I suspect, I mean, have you, I suspect you all must have gotten good feedback from early adopters about how to improve it, right? Make it easier. Continue to say, like, we have a lot of issues that are being opened by people who want to improve it just very slightly. And a lot of the issues get incorporated, but also sadly, a lot of feedback is just very slightly out of scope. And it's like, I would love to solve all of your issues, but we have to stay a little bit focused. Right. Well, especially, I'm sure a lot of these issues are things like, I mean, I'm just guessing here, but I'm sure some of them essentially fall into the category of we cannot answer your legal questions for you, right? Right. We do our best. We have a massive FAQ on the website, not legal advice, but it does answer a lot of very common questions. And a lot of them, like, it's a massive list at this stage. Oh, interesting. I should check that out, because that is something, certainly, that comes up at tidalift, right? When some of our tools flag, for example, you mentioned that GitHub does license scanning. A common problem that we see is that what GitHub says your license is and what your package manager says your license is don't necessarily agree. And sometimes that's a scanning bug, right? The reason why I've talked to the GitHub folks is that I've discovered, on occasion, issues in their license scanner that we've been able to help fix, right? But sometimes it's simply, you know, perhaps the source of truth for the package manager is different from the source of truth for GitHub. And so they disagree and somebody has to do the code archaeology. And boy, it sounds like maybe that FAQ is a great, because we certainly have, you know, we tell developers who are working with tidalift, like, hey, yeah, you should do this code archaeology. And they say, but I'm not a lawyer. I don't know how to do that code archaeology. Sounds like that FAQ could maybe be a good resource for them. Yeah. And also recently begun providing some helper scripts, like building on top of the tool. And one of them, it's like a couple of lines of code that you can copy and paste into Bash, which basically takes, I wouldn't necessarily recommend it, but it's one way of doing things, which takes all of the commit history and all of the authors from the commit history and just adds them to the file for every single commit. Which is really cool. Maybe not the best way of doing things, because an author is not necessarily a copyright holder, but it's maybe a way to get started and then clean up afterwards. Right, right. Well, and that's one of those things. I mean, one of the challenges of licensing and copyright more generally is that it's not something you can reduce to a script a lot of the time, right? Scripts can certainly help, but they can't make calls about things like, I was involved in a discussion with some lawyers just a couple of weeks ago, actually, that basically boiled down to, if something is not copyrightable, how do I indicate that in the source code tree? And the correct, I thought the correct answer was, none of us can agree on what is or isn't copyrightable. So when in doubt, slap creative common zero on it or whatever, or one of the other zero licenses on it. And that didn't go over very well, actually, sort of surprisingly. I know that's been our recommendation as well, that reuse to slap CC zero on it, because we have to choose something, like because of the restrictions of how reuse works, we have to choose something. And also SBX, like SBX doesn't really have a, sorry, there's no license here. Well, there is, but it's not, it's complicated. On top of that, even more complicated is public domain in the sense that there's no public domain identifier for within the SBX. So if you take code that was entered into the American public domain, there's no way of actually conveying that information in reuse. Well, and to be fair, I mean, I think this is one of the interesting, the interesting sort of myths about public domain is that when you say American public domain, that's explicitly American, right? Europeans, in fact, do not have a right. The US government reserves the right to start charging all of you for all this NASA source code. So practical matter never gonna happen, right? But like, I mean, this is one of these things that I would imagine you all run into on a fairly regular basis as an objection or a concern, which is that there's this tension between the work we should do for each other in the name of getting it right, right? Like I don't know quite what the name for it is, but as you were saying, I just want it to be accurate, right? Like there is a, but there's a tension between that and okay, but as a practical matter, X is never gonna happen, right? Like we would love to have perfectly accurate public domain United States information, but like the US government's not gonna sue you over that kind of stuff, right? Like the relevant case law for that is like a hundred years old. It's still accurate, but there's no new case law because the US government doesn't bother, right? Yeah, and how do you negotiate, or maybe you don't, that tension of a developer saying, okay, but the risk is low, the risk is implausible. Well, we can't solve everyone's problems, even though I'd really like to help everyone. So at some point, like if you really disagree with something we've done, you can reuse this free software, you can fork it and change it very slightly and do it exactly as you want to do it. No, that's always the solution, right? We're taking patches. So I wanna end on, I think this has been a great conversation. Thank you so much for your time. I wanna end this on a fun note. If you could do one thing to like help adoption of reuse, right? Like snap your fingers and like, you know, what is it that you would love to see happen? I think the thing I'd love to see happen is, so a lot of people, I'm always very inspired by projects like Prettier and Black, which kind of auto formats your code for you. If reuse could be incorporated into Black or Prettier, like that would force so many people to actually bother with adding the information. I think that is the dream to, in the same way that programmers have gotten used to just letting a tool format that code, also letting a tool verify whether they're copyright licensing information is correct. Right, right. I would love that. Speaking of somebody who has to pick up all the pieces professionally, that sounds amazing. I'm with you, let's make that happen. Thank you so much for your time. Thank you so much for, we were talking right before we recorded. This is very much a volunteer project of love or pedantism or whatever at this point for you. So, thank you for the time that you're pouring into this community. Really appreciate that. And I hope that the next five years of reuse, the next from one point out or whatever are successful and happy. And maybe we'll get to that point of universal adoption. That would be terrific to see. Thank you so much for having me. My pleasure.