Thank you everybody for joining us today, and welcome to today's CNCF webinar on Mitigating Kubernetes attacks. I'm Michelle McLean Vice President of Marketing here at Stack Rocks, and I'm joined by my colleague and good friend Wei Lin Dang for he's our head of strategy at Stack Rocks, and we're looking forward to a great discussion around Kubernetes attacks. I'm going to kick off a couple of housekeeping items just to get things going so everybody's clear because we're CNCF is recording this for later playback. Your lines are muted, but we very much want to hear from you. Wei and I would like to do questions as we go actually. I think it's a lot more interactive and a lot more fun to take those when you have them. So please use the Q&A box at the bottom of your screen to drop in questions there, and we'll get to as many as we can as we go along. There's also a chat box. You can use that if you're having any technical difficulties, but please put your questions in the Q&A box. This is an official webinar of the CNCF, and as such it's subject to the CNCF code of conduct. So we ask that you not add anything in the chat or type in any questions that would be in violation of that code of conduct. At the end of the day, simply put just be respectful of your fellow participants and the presenters and everything will be great. So we are recording this webinar, and the recording and the slides will be posted later today on the CNCF webinar page, which you'll find at cncf.io slash webinars. So with that, let me give a hearty welcome again to my friend Wei. As we kick off our discussion on Kubernetes attacks, what they can look like, the form that they're taking, and steps that we can take to mitigate those attacks. Wei, can you take us through what we'll be talking about today? Thanks, Michelle. And good afternoon, everyone. Thanks for joining us. You know, I'm glad to be able to talk today about the Kubernetes attack matrix. And, oops, there we go. And, you know, more specifically, I'm going to be going over something called, you know, the Kubernetes attack matrix and how you can use it to think through effectively securing your Kubernetes clusters from the broad range of threats that you or your organization might encounter. And so here's what we have in store for today's session. I'll start by covering some examples of Kubernetes attacks that have been observed in the wild. And those include, you know, attacks from threat research that the Stack Rocks team has previously done. I'll, you know, then briefly touch on what makes Kubernetes threat vectors different from those that you may have had to protect against in other infrastructure environments, prior to cloud native environments. And then we'll turn our attention to the Kubernetes attack matrix itself. And we'll cover, you know, what it is and what it means for Kubernetes users. And the goal that I hope we can really accomplish today is to distill some main themes based on our analysis of the attack matrix and I'm going to be aiming to help you come away this afternoon with a few key takeaways and practical recommendations that you can immediately use to increase the security of your Kubernetes environments. One set of questions we often get asked about is, you know, what types of Kubernetes attacks exist. People are interested in what sorts of attacks, you know, other organizations have experienced or dealt with and, you know, what can we collectively as a community learn from them. And it's useful to start there because Kubernetes attacks and the ways in which cloud native software can be vulnerable and potentially exploited really falls within I think an emerging threat landscape and it's a landscape that we're all still trying to understand better. And but given that, you know, there have been a number of attacks and threat vectors that have been at least publicly disclosed and this is a representative set on this slide and we can see it spans, you know, different types of attack vectors, you know, they include campaigns to abuse resources by mining cryptocurrency at companies like Tesla. There's also been disclosures by Microsoft Azure regarding large scale campaigns for cryptocurrency mining being threat vectors such as, you know, the discovery of potential exploits via things like server side request forgery vulnerabilities at places like Shopify.  And initially, you know, at Stackrocks, you know, our team has also done quite a bit of research, you know, that has ultimately corroborated the notion that, you know, containerized applications are subject to various threats with some important qualifications and so, you know, to better understand some of these Kubernetes attacks, you know, we have done some work to set up a honeypot environment using a number of large scale Google Kubernetes engine clusters. You know, these clusters are running all different types of containerized apps. You know, these might be web servers or databases or developer services built using common images that are available from places like Docker hub.  And we also deployed them with, you know, deliberately with weak configuration so example might be, you know, we left authentication disabled. And what we found from running this environment for about five months exposed to the internet is that, you know, many of the types of attacker actions that we observe were not too dissimilar from those that can also impact non containerized applications and I think this makes a sort of sense, you know, since an attacker, you know, at the outset wouldn't necessarily know that a particular application is running in a container or not.  So way just to point of curiosity here in terms of these findings versus some of the some of the headlines you shared on the previous slide. How does how do they compare like what what surfaced in the stack rocks research that's either similar to or different from some of those headlines of known attacks on our known vulnerabilities in Kubernetes? Sure, Michelle. I mean, I think it's a good question. I think in terms of some of the attacks that we saw in the headlines or what have been was been publicly disclosed.  And what our research, you know, how our research of compliments that is that is, you know, sort of the observation that there are a lot of attacks that are still relevant to container environments that are not, but are not specific to Kubernetes. And so I think what you end up with is that, you know, there's always a potential that an attacker may seek to do both, you know, they may seek to, for instance, gain, you know, access or, you know, intrusion, you know, via, you know, something that's maybe not specific to containers, but then they might leverage, you know, as part of that or part of their overall approach of methodology, they might leverage, you know, specific aspects and are likely to leverage specific aspects of Kubernetes itself, you know, to go further. And so, you know, I think as the combination of both what's been publicly disclosed in those headlines as well as our own research suggests that you should be aware of sort of like these new specific attack vectors for Kubernetes but you also need to keep in mind that there are set of attack vectors that are more generally applicable when you're thinking about how to protect your Kubernetes environments. Yeah, that makes sense. So you need to have kind of the protections in place you would have for any infrastructure, but then be aware of the, the new attack surface that's kind of exposed by or introduced by Kubernetes. That's right.  You know, it's much more effective to approach security more systematically and, you know, think about sort of threat vectors in a more comprehensive way and, you know, as we get into it, I think that's exactly what the attack matrix enables.  It is a new attack surface. It has new components, for instance, you know, if you're looking at the control plane, for instance, you know, which makes global decisions regarding a cluster's operations, or whether you're looking at worker nodes, you know, each of those different parts of a cluster has, you know, introduces new components that are, you know, could be, you know, the form part of an overall attack surface within Kubernetes. You know, for example, you know, if you look at compromise of control plane components, you know, that could easily result in complete compromise of entire clusters. Versus, you know, if you're looking at worker node components, for instance, that could result in direct compromise of the containerized application components, you know, themselves, namely, namely pods.  And then additionally, you know, Kubernetes itself is complex, and this can often give rise to new possibilities for operator error, especially as you know, organizations are learning Kubernetes and getting started with it. And then, you know, finally, because these environments are, you know, highly orchestrated and automated, which has a number of benefits, I think that the trade offs or sort of downside impact of that is that, you know, things like any misconfigurations or unintentional exposures can actually be propagated much more quickly, you know, throughout the entire environment. So we do have actually our first question that's come in way. And I think it was spawned by your discussion around how threats can look different in this landscape so somebody's asking we have multiple. We have we. Oh, okay. Okay, so there's two questions here. One is around, we use a managed service, do we need to think about Kubernetes attacks any differently on a managed service versus if we were running Kubernetes ourselves. Let's start with that one. Sure.  And the other one is somewhat related and you touched on it a little bit, but this person asks, we have multiple managed vendors. Is there a checklist we can use for security to check on their offerings? There are good starting points, you know, out there, many that have been published, I would say by the broader ecosystem of, you know, folks that are stakeholders and interested in furthering Kubernetes security. You know, some of them are actually listed on this slide but, you know, it's a starting points for how to think about Kubernetes security. You can look at references such as, you know, the guide that the NIST, the National Institute of Standards and Technology put out. You can look at, you know, benchmarks put out for Kubernetes by, you know, Center for Internet Security or CIS. You know, there's also a wide range of resources that, you know, folks like Stack Rocks have put out there in terms of best practices and, you know, capabilities that you should look for when it comes to implementing Kubernetes security.  And this ranges from things like, you know, the security audit all the way to ongoing work by, you know, CNCF and Kubernetes sakes that are focused on security and so on. And so I think there's a wide range of resources. I don't think there's any single one size fits all or a single definitive checklist or framework to refer to. But I think that this is also because ultimately a lot of it comes down to you and your particular organization's needs. Yeah, that makes sense. But those are some great starting points. And the person must have been seeing ahead because it perfectly predicted the slide. So tell us a little bit about the Kubernetes attack matrix itself. Sure. So, you know, with all the context that we've covered so far in mind, you know, the, the Kubernetes attack matrix exists to help us think about threats and also how to mitigate them in a, you know, I would say systematic and comprehensive way. You know, again, you know, you don't want to be thinking about threat vectors or how to guard against them and sort of ad hoc or one off manner. You really do want to think about it more holistically. And so with regards to the attack matrix, my focus today is going to be on distilling some main themes from it and the techniques that are actually described within it.  We have a blog series, you know, on on this topic, which covers the details of, you know, each technique and the relevant mitigations and more detail. I'm not going to go, you know, to that level, necessarily today. But, you know, the, but please refer to those as they're useful. But the communities attack matrix was published a few months ago by Microsoft Azure. And I viewed as a great milestone for the community ecosystem and it really builds on all the fantastic work that some of the various groups and organizations which I mentioned just a bit ago have undertaken to date. You know, including, you know, the inaugural, you know, CUBE security audit and it was part of that audit a threat model was also published and it covers the major Kubernetes components. Again, there's work by, you know, relevant sakes and other organizations that have published these widely followed guidelines and benchmarks. The attack matrix is derived from applying and extending principles from the well known attack framework published by organization called MITRE. And, you know, to sort of provide a comparison on the right here is the MITRE attack matrix for enterprise and they're actually multiple matrices that exist. And this helps provide an idea of what the attack Kubernetes attack matrix is meant to be, which is it's really meant to be a knowledge base of adversarial tactics and techniques. Based on real world observations and it provides a way to classify, you know, different methodologies that attackers might utilize, you know, based on the particular objective they serve. And so by sort of taking some of those principles or this overall framework that's laid out by MITRE attack. You know what the Microsoft Azure team did was extend those to Kubernetes. And if we look at the matrix itself, the matrix consists of nine separate tactics that encompass 40 different techniques. And these tactics, these are objectives such as, you know, execution and persistence privilege escalation lateral movement. You know, these should sound familiar they're not not new, but they are really about the why, you know, an attacker might undertake particular action they really focus on objectives and you know these are not necessarily going to change. Just because you're in your Kubernetes or a cloud native environment these these objectives are general across different types of infrastructure environments. But when you get to the level of techniques which are really about the how of what an attacker might do. These are mostly dependent on the components and resources that are specific to Kubernetes itself.   You know, some of these techniques actually spun, you know, span multiple potentially multiple aspects of the attack surface and such so it may require, you know, multiple different mitigations to be implemented to effectively and completely protect against against them.  There's a reference, they reference an application vulnerability, for example, a remote code execution vulnerability, as well as your application exploit. You know, some of the mitigations that you might actually look to implement to protect yourself against these techniques, you know, these best practices will entail some of the following, you know, preventing vulnerabilities from being introduced into Kubernetes clusters in the first place. You can do this by taking steps like scanning your container images, enforcing policies at deploy time, you know, via capabilities like admission control in Kubernetes. In that you could seek to restrict external network traffic. You could do that via things like network policies in Kubernetes, and then apply permissions on deployments for that application. And again, you can do that via a capability in Kubernetes via role based access control. And then, you know, separately, you also want to ensure that the pods for that application are locked down as much as is, you know, sensible or appropriate, you know, via some of the measures, you know, describe at the bottom, you know, which is restricting privileges, restricting, and so on. And so, you know, this is a good example of how, you know, a single technique that's listed in the community attack matrix may actually require, you know, a half a dozen or more, you know, different types of mitigations to be applied. And I think that there's some nice promise in what you're saying their way because when you at first blush if you look at the Kubernetes attack matrix and you see, oh my gosh, you know, nine different, you know, nine different techniques and in total 40 unique attacks like that can feel really overwhelming. But what I'm hearing you say here is that many of these have common elements. And so there's some steps that you can take you might have to take multiple steps. But those multiple steps that you take could mitigate multiple attacks in turn I think that's a bit reassuring. So before we get into those kind of fundamental steps of like how do people start thinking about protecting themselves. I'd love to just pause for a moment and just recognize that the MITRE model is really familiar to people on the security side, right, they they're used to thinking this way, and it's the whole mandate of like think like an attacker, and put, like you said, really systematic approaches in place to mitigate these things very broadly. A lot of folks obviously on the coup side are coming more from the DevOps world. And I'm curious, you know, this could be new language for them a new mindset for them. How do you think about the potential for the coup attack matrix or some of this framework in helping bridge this gap and helping these two worlds kind of work together a little more easily to be effective at protecting against these attacks. Yeah, I think the attack matrix provides, you know, very rich framework and a great starting point for effective collaboration between security and DevOps teams, you know, security to some extent you know is familiar with these types of objectives.   So there's actually an opportunity for, you know, DevOps teams and engineering and platform teams to drive more security, you know, throughout the life cycle of applications, you know, rather than thinking about it at a later stage.   And then, and then go from there. Okay, that's, that's great. So let's dig in then on the steps that you've come up with to help people begin to protect themselves.  And so if you're thinking that, you know, don't worry. Well, the attack matrix originally, you know, did not document any ways to mitigate against the various techniques. You know, our team at StackRox has done that hard work for you and outline best practices for protecting against each technique. And again, you can find those details, you know, in our blog series and white paper. But you know, more importantly, what I want to highlight today is that there are a few key steps you can take that will really give you relatively broad protection to start across the majority of techniques.  And so it makes this, you know, makes sense to tackle these first. And, you know, our recommendation is that most techniques can be addressed by first using security features that are native to Kubernetes itself. And, you know, while others may require you to use things like cloud provider controls or third party tools, the majority of techniques outlined in the matrix can be addressed through, you know, native Kubernetes security capabilities. And today we're only going to focus on the techniques that can be at least partially mitigated using these native controls. You know, for the rest please refer to the resources we make available via our website. But, you know, our analysis across, you know, these techniques reveals that the best way to get started by applying these native Kubernetes controls, you can actually result in mitigating up to 35 of the 40 threats. And it doesn't have to be a ton of different controls that you apply either. If you use just three, you know, different native Kubernetes features, you will be well on your way to effective security against a broad range of attacks. Now, you know, one thing to keep in mind with this approach is that it also allows you and your organization to take advantage of the declarative and immutable aspects of cloud native infrastructure. So, as I was referencing earlier, it means that by applying these controls, you can proactively lock down your environment, you can do this programmatically you can do it in an, you know, a declarative API driven way, you know, to prevent attacks rather than having to rely on detecting and reacting to security instance after they've occurred. Another thing that we recommend in terms of using a native Kubernetes control is to configure Kubernetes role based access control or our back. And, as you can see as we've highlighted here this helps to at least, you know, partially mitigate nearly half of the techniques in the attack matrix. And some of the things to keep in mind when using our back. So the cluster admin role effectively grants unlimited access to a Kubernetes cluster and the users and groups that are granted this role should be highly restricted by administrators because any account compromises or errors can end up impacting the entire cluster. You know, second best practice or consideration that, you know, we suggest as part of using our back is you'll want to adopt a model of granting only the necessarily privileges to not just users but also service accounts as well.  That have been incorporated over time role role aggregations actually a good example of this but you know some of these features can be used to simplify privilege grants, for example, could allow new privileges to be combined into existing roles. And these types of features if, if, if using a more sort of, you know, ad hoc manner they can actually result in, you know, in changes to the intended use of a role and then additionally role definitions. You know, sometimes they have overlap with each other and this can make it much harder to, you know, grant or revoke access to users or service accounts, because it becomes complex very quickly. You know, one of our recommendations is to start with the baseline, you know, in terms of different set role definitions and then you know incrementally add from there as necessary, you know, rather than sort of, you know, granting privileges or permissions to different users or service accounts like, you know, as those come up, I think it's much better to sort of outline your approach to RBAC overall, and that will help you down the road when when you actually start to scale and have a larger number of users and applications that are running within your cluster. And so, you know, this example, you know, is one that goes to show that you're using RBAC can be quite complex, and you do need tools to help monitor your RBAC settings, you know, that there are different ones available out there, for example, you know, just to highlight stack rocks, you know, is one of them that automatically monitors RBAC privileges on role bindings for users and service accounts and, you know, this can help identify whether, you know, any elevated privileges have been granted in an unintended way. Okay, before we jump there, we've got a one a couple questions here that have come in. It's a little related not entirely this person's asking about the Kubernetes dashboard. And that if we're looking at the components that can be a point of exposure that that's a well documented one do you have any recommendations for enabling it for supporting and monitoring of Kubernetes and how to protect it. Yeah, it's an interesting question I think I think almost a question that comes to mind or that would pose back is, you know, what would the purpose or why would you want to enable it be. And the reason I say that is, you know, the Kubernetes dashboard has been shown to be your component that has been, you know, leverage for different types of attacks. And as a result, you know, most major Kubernetes platforms or offerings, you know, do not deploy the dashboard or disable it by default. You know, even within stack procs, we have a built in policy that alerts when the dashboard has been deployed. So, so I would say, you know, you should really strongly consider only enabling and using it with caution. And if there's actually good reason to, and if you do, you know, ensure that you utilize, you know, appropriate network and access control settings, you know, some of the examples where the dashboard has been compromised, you know, involved cases where it was exposed specifically to the internet as well as it was granted elevated privileges which then allowed, you know, people to take, you know, certain types of actions that led to, you know, compromising aspects of the cluster. Okay, so if possible just avoid for that open door in the first place. And there's another question here you touched on cluster admin credentials do you have any suggestions for integrating Kubernetes authentication with LDAP or active directory authentication. Yeah, I would say a couple considerations or ways to approach it or break it down, you know, is to, you know, think about authentication authorization. And certainly, you know, authentication I think is going to be dependent on tying into and based on the particular type of platform, you're running and so, you know, if it's, for instance, you're running, you know, on prem and, you know, you need, you know, LDAP or authentication, you know, then, you're going to want to continue to, or if that's what you use for identity identity management today then you're going to tie into that. But if you're on a cloud provider, for instance, then you're, you know, likely going to want to, you know, hook into and utilize, you know, their, I am offerings, you know, for authentication, but then once you've handled authentication you're going to want to think about authorization and that's where you know Kubernetes RBAC comes into play and setting appropriate permissions on both your, you know, users that are operating within your clusters as well as, you know, the applications that are running and, you know, the privileges that they can take on the API server and other aspects of the environment. Awesome. Okay, that's really helpful advice. All right, let's get into the next step folks can take to use native coupon controls. Sure, the, you know, the seconds that we recommend is to apply a capability built to Kubernetes called, you know, Kubernetes network policies. And, you know, this can help mitigate several techniques in the attack matrix as well. Your network policies enable you to restrict both ingress and egress traffic to and from your applications, including pod to pod traffic so you can get to that level of granularity for network segmentation. So you'll need to use a network plugin that actually enforces network policies. You know, even though Kubernetes always supports operations on the network policy resource, simply creating the resource without a plugin that supports your network policy API will actually have no effect. So if you think that if no network policies are applied to a pod then you have no network traffic, you know, to or from, you know, is permitted but in fact, you know, in Kubernetes the opposite is true. If no network policies are applied to a pod then all network connections to and from it are permitted, which means, you know, by default, you know, all, you know, all network traffic is allowed and, you know, there's a good reason for this to even though it's advantageous from a security perspective which is it's really designed to enable operational convenience for users and so on. And so, you know, the best way to get started, which we recommend is to configure a default deny all network policy and you know this will help isolate all pods by default. Once this is in place you can add network policies to further enable either internet access or additional pod to pod traffic as is needed or warranted. And, you know, again network policy management as you scale your cluster scale the number of pods and applications that are running within it can get quite complex and so you know you want to look for tools to effectively allow you to you know, think about how you can more, how you can automate and manage these types of policies at scale and you know stack rocks as one of those tools helps with this type of configuration. There are a lot of aspects of visualizing to, you know, automatically generating and applying your network policies but, you know, this is, you know, it's a network policies and some of the other network capabilities within Kubernetes are an area of continued investment for the community and we look forward to seeing where all that continues to lead. At the end of the day this is really about kind of reducing the blast radius right and just like if you if somebody gets in what can they do and trying to scope that down. There's a question here about the the network side. Is there any difference between understanding the networking or applying networking policies on managed services where you don't have access to the masternodes. No, I mean I think in terms of, you know, even though the cloud provider for instance would be managing those components or say like the API server, you know, in that scenario, you know, there's not, that's not to say that there are, you know, any additional network restrictions in terms of what you're able to achieve. Again, you may want to look at what the default settings for some of those scenarios are for example things might be open when you don't expect them to you know, the API might have a public IP address, for instance, and so on and it may fall on you to actually configure you know and restrict network traffic appropriately so you know it's worth keeping that in mind but there would not be any sort of restrictions in terms of what you're able to achieve, you know, from a network perspective you know between your pods and applications and their need to talk to you know the controlling components and so on. That's everything for now way. Cool, and you know so we're going to the third step and you know what what we would recommend is to, you know, once you've thought about using, you know, native controls like RBAC and network policies, you know we then recommend that you harden pod configurations You know this can actually be done using several different in several different ways and using some options in terms of what communities enables. It's also I would highlight sort of an area of ongoing discussion and innovation within the communities community. The starting point for thinking about hardening pods is concept called security context and security context allow you to configure settings that restrict pods from doing things for example like running privileged or ensuring that the containers root file system is mounted as read only. You can set these settings at both the pod level, you know, or container level if you wish. And then can also enforce policies on the conditions that pods must meet in order to run within the cluster. This can be done using native capabilities like pod security policies, which utilizes an admission controller, or it can actually be done with using other ecosystem So the open policy agent or OPA gatekeeper and others if you look at some of the, you know, provide platforms out there like Azure community service they've taken steps to move towards implementing gatekeeper for enforcing policies, rather than utilizing pod security policies, you know, and then also, you know, keep in mind that since most pods are created indirectly as part of a, you know, Kubernetes controller, you know, which might be, you know, deployment or, you know, Damon said or things like that. The best way to authorize policies is to grant access to the pods service account directly. And so, you know, I mentioned some of the tools out there that can be utilized to help you enforce policies and ultimately harden and secure your pod configurations. You know, among those tools, as an example, you know, stack rocks, you know, will utilize, you know, dynamic admission control to enforce some of these policies as well.  Alright, we've got one quick question. I think it was triggered by your earlier comment. What would be best practice for pod security policies to prevent running privilege pods.  So utilizing that pod spec to say, you know, certain criteria should be met, you know, for it to be, you know, deployed into the in running within the cluster and then while it's running a certain set of security configurations or settings that are applied.   Okay, we have a couple questions, but I want you to go ahead and ensure these key takeaways and then just invite the audience. If you have any more questions, we're going to have a few minutes here after Wei wraps up that we can tackle those questions. So go ahead and send them over and Wei, help us with some quick takeaways. Sure. So, you know, we've now covered the major aspects of the Kubernetes attack matrix and how you can potentially put it to use. You know, the attack matrix gives you a systematic basis for thinking about how to protect against a broad range of potential attacks, you know, made up of, you know, one or multiple types of adversarial techniques. So native controls, native controls and Kubernetes can help you at least partially mitigate most of these. So, you know, recommend focusing on three to start, you know, these are configuring Kubernetes RBAC, and then security context and or capabilities like pod security policies to help harden your, your, you know, individual application components. And, you know, finally, while all these measures, it will certainly strengthen your security posture. When it comes to your communities clusters, no methods are foolproof. And you should always be prepared for the unanticipated and this means you're ensuring you still have runtime monitoring in place to detect your different types of activity that are indicative of attacks when they arise. And with that, you know, appreciate you listening to sort of our overview today of Kubernetes attack matrix and we'd love to open it up for questions. Awesome. All right, thank you for the great information way super helpful. And I think it's a really good point there's a lot we can do given the kind of infrastructure we're running into be much more proactive about security in terms of implementing a build and deploy time and getting those controls built into how we configure everything but still complementing that with the runtime securities is still really important. Okay, so there's a couple of other questions that have come in. We're talking about protecting Kubernetes. How important is it to keep upgrading Kubernetes and staying current people recommend staying current but sometimes cloud providers are a couple of revs back. What does that affect your security and when you upgrade. How does it affect running deployments. Yeah, so I think there are a couple considerations there, you know, with some trade offs to help you make the right decisions and I think that cloud providers give you several options, you know, to allow you to make the best choice for your organization based on those trade options. You know upgrading is certainly quite important from a security perspective you get the benefit of all the latest security fixes, even additional new security features you can take advantage of.  And so those are, you know, best addressed by being able to upgrade on a relatively, frequent basis or at least staying close to the latest version of Kubernetes that is available. But I think the trade off is, you know, our operational considerations such as you know stability, you know, and ensuring that you know, especially if you're running production like not potentially not wanting to upgrade too frequently to minimize any disruption to your applications. And so the way I think that the cloud providers and other platforms overall have handled it to reflect this is that if you look at particular providers that they'll give you the choice of different either versions when you deploy clusters as well as different channels right if you look at GKE they're different channels that reflect, you know, the most stable, you know, versus something that potentially is less stable but you know has some of those benefits of being on a later version. And so I think that it probably depends at that point on what type of environment you're running, you know, how critical are the applications and workloads, you know, within that particular cluster and so on. And so I do think that, you know, you have choices when it comes to what version to be running on and so it's not to say that, you know, upgrade at all costs, but upgrading can certainly help with a lot of these vulnerabilities and Kubernetes that we've seen. Yeah, that makes sense. And just for people's reference, we've done a really comprehensive look at all three of the managed Kubernetes services and how they compare how they stack up what tradeoffs they've chosen to make in those managed services so you can check out the Stack Rocks blog for that just detailed review of AKS versus EKS versus GKE. There's another question in here. Is it possible to use namespaces as a hard security boundary? I think the way to look at boundaries, you know, across your Kubernetes environment are, you know, they're different delineations or distinctions, you know. And I don't know what whoever asked the question had in mind when they referenced hard, but I think you can look at physical boundaries, and then you can also look at virtual boundaries and I think both are important in applying in the context of Kubernetes. When we look at physical boundaries, you might consider, you know, clusters or nodes as, you know, important boundaries for potential isolation, depending on what types of containerized workloads you're running. I think beyond that namespaces does form an important form of virtual boundary for your application components that may be running across nodes. And so, you know, as a best practice, for instance, you may want to scope, you know, an individual application or deployment, for instance, to an individual namespace to gain the benefit of that, you know, greater isolation and that doesn't just mean type, you know, in terms of management, I think it means that, you know, you can scope controls, some of the controls we even talked about today, you know, to particular namespaces to think about, you know, sort of your overall security approach and how you want boundaries, you know, between workloads to look, you know, across your environment in a more consistent way. So I would say namespaces is considered a critical boundary, you know, within the Kubernetes system. And, you know, you should certainly consider applying it and leveraging it to your benefit, you know, to isolate and segregate, you know, different types of workloads based on the criteria you deem most important. You know, might be business criticality might be the data, you know, type of data that it's processing or interacting with and so on. Okay, that's really helpful. You talk about the importance of runtime monitoring. Do you have a system that you would recommend?  But again, it may come down to your individual needs. But, you know, as an example, you know, we will monitor at runtime, you know, all pertinent system level activity for every container and then help identify based on other contexts within Kubernetes, you know, what might warrant further investigation or what might be indicative of an actual attack and so on. Yeah, having the opportunity to compare it against baselines things like that looking what what's different can stand out better with this infrastructure. We didn't talk about secrets but this this person's asking. We talked about using native Kubernetes capabilities. What do you see as the pros and cons of using Kubernetes native secret resources versus something like a hashi court vault to distribute secrets.  I think the benefit of going with Kubernetes secrets is that, you know, it's completely built in it's much easier you don't have to worry or think about as much from an operational perspective, managing a separate solution or you know how to, you know, securely, you know, for instance maybe distribute those secrets and so on. I also think, you know, the communities team itself or a broader community has taken steps to provide greater security for secrets, for example, by adding encryption, you know, with an LCD of secrets at rest and so on. So I think there are benefits those are some of the benefits for going with built in secrets and Kubernetes. So I think if you're looking at something like hash code vault or their other secret management solutions cloud providers have them available as well. You know, some of those considerations are you might be looking at how you can have a single solution for secrets within Kubernetes but also secrets or other sensitive data credentials and other types of infrastructure environments. That may make more sense. And in that case, you know, you have to weigh the implication of some additional operational overhead or complexity. But I think if you're focused on Kubernetes, Kubernetes secrets is a great option that you should turn to first. Okay, I think we have time for just maybe one more question here. There's one come in that's come in. Well, you get a big thanks way so somebody said it's been super helpful session he appreciates your advice. This one is the stack rocks provide PCI compliance or other Fed ramp mandated compliance. We do. You know, compliance has is among is one of the several areas that we focus on with the stack rocks platform. We provide compliance for PCI as well as number of other industry standards or known benchmarks, for instance, so this is PCI HIPAA, as well as, you know, adhering to enabling compliance with best practices outlined by, you know, NIST SP that I referenced earlier, CIS benchmarks and so on. And we do work with a number of organizations that you know have PCI workloads running in Kubernetes for which that type of compliance is required. And, you know, aspects of PCI or there's some overlap with other types of standards such as Fed ramp, for instance, and we also have a number of federal agencies we work with, you know, to that, for which, you know, those standards are applicable. And so, you know, something that we look forward to continuing to innovate and lead in, as we have so far and that's because we see, you know, many different types of sensitive or compliance, or workloads that need have compliance needs, getting to getting deployed into Kubernetes in production. All right, that's super helpful. And, you know, we invite you to check out the Stack Rocks blog. Wei is one of our major contributors on that blog. He did the nine part series that looked at this Kube attack matrix in lots and lots of detail and went through for each attack. What's the mitigation you could take? Is it something that you could do native to Kube? Is it something you could turn on in your cloud? And so you can get more information there. We invite you to just take a look at the other technical content there. And of course, if anybody wants to take a look at the Stack Rocks software in action, we would welcome that opportunity with a demo for you. And with that, I think we're really at time. You guys have asked some great questions. Thank you for bringing them along the way. It makes the presentation a lot more fun. Wei, thank you so much for sharing your great insights on how to mitigate these attacks. I really appreciate your time today. Thanks everyone. Yeah. And the webinar recording and slides will be on the CNCF site later today. And we and all of CNCF and look forward to seeing you again online in a future CNCF webinar and we hope everybody has a great day. Thanks so much.


Well hello, I'm at work and no one's here so I'm gonna vlog really quick. Welcome to Vlun day 12. I am working and I just got lunch at one of my favorite places. I didn't bring my camera in because I don't usually like hang around with a purse or anything so I've just got like my wallet and keys and phone and that's it. But I need to turn you around and show you my favorite lunch. It's every Monday is goulash day and it's freaking delicious.  And the lady like completely like overflowed me like that is so much oh my gosh but it's amazing there's like like a crusted cheese cover on it too but that's like it's like underneath so anyway I just had to show you guys this because it's amazing. If you guys are ever in Fridley, Minnesota I'll put somewhere down below their either website or Facebook page. Actually fun fact used to work for Bob's produce back in the day like a long time ago I worked in their bakery in deli section which is where you get the goulash so yeah um it's it's just so good it's so good and they have the best lunch because they've got hot stuff they've got cold stuff they got an amazing salad bar um they've got this guy named Tom and he does like sandwiches every day of the week like Monday through Friday and they're usually hot sandwiches not always but it's just funny and he's hilarious so anyway I highly recommend Bob's produce and I'm gonna eat my lunch now before it gets cold and then I've got a lot of work to do today so pray for me. Hey guys it is 4.45 oh my gosh almost two extra hours today but there was just so much to take care of today and it's a Monday which makes my life even more hectic. Mondays and Fridays are like the worst at my job but that's okay I got it all done and every time I went to go back in the like workshop to go see my boss there was like three or four more things added to my list and it's like okay then I was like all right do you need anything else yep three or four more things added to my list to like take care of so I'm like anyway but it all got taken care of which is good people are happy today which is good so I'm happy but I am gonna finally get going home but I'm gonna stop at the townhouse first my mom was there and did a little bit of painting I didn't show you guys this on Saturday the last day I was there but we actually did one coat to the interiors of the exterior doors if that makes sense the homeowner decided to paint them the same color as the like entryway walls and we are painting them back to white so we only did one coat on Saturday and my mom went over there today for just a little bit did a second coat but she's like it definitely needs three coats if not more because it was such a dark color underneath there and they're like metal doors you know so anyway I'm gonna head over there and I will show you guys around and I'm actually gonna unload some of the stuff I got at Walmart so I will show you what I got at Walmart too because it's really not that interesting but you guys find it interesting so let's show it all right I am getting loopy so I am gonna go and listen to some Dave Ramsey on the way home and I'll see you guys in just a moment well hello I am at the townhouse whoa let's check out the front entryway since where my mom was working today what's no there's like wow okay so these are the doors I was talking about let me give you a little so I don't know if you can see it on camera yeah you can kind of see it it's a little streaky because the dark is still like wanting to come through but it can't come through so anyway um I think we definitely need at least one more coat maybe even two I don't know so we'll see um oh and then my mom ended up putting up like all of the switch plate covers back on even though like some of them are changing but yeah um oh and then my mom was here the target delivery came and these are there we go hello um these are the shears that I'm using for the two windows right there both windows and yeah I don't know I kind of like it oh there was a few people that wanted to see the backyard so like let's go see the backyard it's really freaking boring back here but whatever okay so I think I showed this before but I've got this like nice little awning um it's not like drilled into the ground or anything but it's just you know there and the cool thing about this unit is that they actually poured a double pad so you can like have more space which is kind of nice and then I have like a little privacy on that side and on this side I've been getting a lot of questions too if I'm fencing this I can't fence it because I live in an association and they don't let me so that kind of sucks but that's okay um also that's the interstate right there that's about as loud as it's ever gonna get because it's rush hour right now which is like nothing but um on the other side of that berm right there is like a little walking path so I think that'll be nice and then um the original homeowner left these and then left this as well but trust me it's not my favorite but it'll do and let me get real with you guys for a second I am not an outdoorsy person because the outdoors doesn't like me and my body so I don't like it um like see that welt on my arm I don't know if you can see it very well it's like in the middle of your screen right now you see that yeah that's a bug bite it was like a little tiny mosquito it doesn't matter my skin like welts up like crazy and like I want to itch it so freaking bad but I can't because if I itch it it will scar and the scars will last up to I don't know I think I have scars like on my hands from like years ago yeah it's really irritating but I live in Minnesota there's a lot of mosquitoes and there's a lot of I mean like like a bug lands on me and I welt up it's just disgusting but that's way too high today but I told you guys that I was gonna show you my walmart haul from Saturday that I never got to show you so let's flip you around and I'll show you because it's it's on the ground so walmart haul I ended up getting one of these um this is one of those like gel mat things and I've always wanted one so I figured I would get one I think it'd be nice like in front of the sink or I don't know maybe in front of the stove I don't know I just thought it looked nice it's like 25 bucks um okay so I also got this this is this is a little steamer oh that's the espanol side I'll show the English side from all my English speaking peoples um yeah I thought this would be nice for you know like the drapes and stuff so I think this is only like 12 so if it doesn't work I'm gonna take it back but we'll see okay so here is the rods that I was really excited about these are the better homes and gardens add or black finish add on drapery rod and it expands out to 120 inches so I'm excited um I actually was kind of playing with the tape measure here and this is like 106 which is like the minimum of what I want to do if you guys can like kind of see it it's so hard because this is all like blown out but I want it to cover like quite a bit of this big wall because I just I don't know I think it would look nice and I guess if it doesn't look nice then it's all my fault right also this little rod is going upstairs so it's just like a little tension rod and then my mom picked these out which I'm kind of debating about still but let's bring them upstairs and look so this color I think is called stone yeah stone and I don't know if it's going to look good with the paint I was thinking about it and thinking about it and I just I don't know actually it doesn't look that horrible it's hard to see because it's so like blown out but yeah it actually doesn't look that bad I don't know what do you guys think oh and this is this is the actual panel of the outside of the packaging it's got a little bit of like that crinkle to it that's just like kind of how it is but yeah so it would just like go in here but it would be a sheer so I got two panels my mom's gonna just hand hem them because she's very good at that and I am not so leave that up to the mama and then the wood wall is done these little scuff marks my mom came up here today and actually just sanded some of the areas because there were like some drip marks that happened after we left on Saturday which obviously I had a lot of coats of paint on there but that's okay and I'll end up redoing that this Saturday when I'm here again so yeah so I think the plan is for this Saturday since I know people are gonna ask is I'm gonna start doing like the baseboards you see over a drip right here I don't even care because I'm painting that shit white okay so I think I'm gonna start doing the baseboard here the steps I don't know if I want to tackle that yet but I mean I do want to tackle it but I don't want to tackle it and then I want to do all the trim up here at least on the floor like down here this rail my god I would love to get this done but I just I just don't know if I'm gonna get this done before I move in but I'm hoping fingers crossed that I do but I need to get this all sanded and kills the these boards on the set like the casings I'm not gonna worry about these until after I move in because literally I can do this on a weekend just fine but my biggest concern is all the stuff by the carpet because that is gonna be such a pain in the butt to do after I move in so whatever um so yeah all the baseboards and then baseboard baseboard all the baseboards in here as well I'm not so concerned with that window I mean I'd like to get it done but it doesn't like have to happen but I'm pretty sure I'm gonna get this window done for I'm pretty sure like 90% sure and then all the baseboards in here and I would love to actually get the like casing trim done in here too just to have it done in my bedroom so it doesn't smell like paint in here um and then the um window casing as well so yeah I mean this room I want to do the entire thing just because it's my bedroom and I just I want to get it done and by the way I'm like really loving this paint color like when it's super bright outside it looks so gray without like any of my stuff in here but when it's overcast outside it actually looks like more on the gray spectrum which is what I was looking for anyways but I think once I get those curtain rods up downstairs it'll be a little bit less bright and also once I get some stuff in rooms it'll start to kind of like suck the color if you will I just I'm like loving this paint color it's so good but yeah like this dark like I like I like it when it's dark I don't know anyway so that is what's going on now so I think what I'm gonna do is I'm gonna load up my vehicle with all the things that I need to return from Lowe's that I bought last week and then it's actually my dad's birthday tomorrow but I don't know what he like wants to do for dinner I talked about that in my plan with me so who the heck knows but I think we're gonna go out to dinner tonight because my mom is at a exercise class so she's probably not gonna get home to like eight o'clock because it's like quite a distance away from where she lives I think we're gonna go grab some dinner somewhere but I don't know for sure but I'm gonna load up my car get that stuff ready and then I will just check in when I check in how does that sound I am now home for the evening and talk to my dad he is not in the mood to eat anything right now apparently he had some taco john's last night that is still not agreeing with his system so I think he's learning from his experience but I figured I'd show you guys what I'm eating for dinner so let me turn you around I think this is like a really odd dinner but um I have this a lot unfortunately so anyway um we had two more slices of bread so I decided to go for a grilled cheese and then since I don't like any of my food to touch and I'm obsessed with pickles I have like a whole bowl of pickles and then I've got my water my tripod is still on the dining table I need to take that off and because I have cheese I've got a dog right here hi hi I gave him a little piece of cheese while I was grilling it hi doodle a little doiledog so funny all right well I'm gonna start eating that before it gets cold and I will talk to you guys soon oh and I love pickles does anybody else out there really just enjoy pickles I could just eat the whole jar in one sitting but I hear that's not great for you hi all right so it is pretty late well late for me it's like 9 45 950 somewhere in there and oh I am beat for the day I just took my naik will so yay so I can sleep but oh I still have like I still cough at night so I need to take naik will to just suppress the cough so I can actually get like a good night's sleep so I don't know the summer cold is like totally beating my rump here so hopefully at some point I won't have to rely on naik will to like actually have a restful sleep so who knows but I'm gonna close out the vlog here I hope you guys are enjoying it and um yeah I don't know what's happening tomorrow tomorrow's my dad's birthday he's turning the big seven zero so today is his last day in his 60s and there's only a couple more hours to go so I think he's gonna make it to 70 guys I think he's gonna do it but we don't really have any plans the one restaurant that he was like thinking about going to actually isn't open until like Wednesday or something they're doing some construction either like in the parking lot or like in the actual restaurant I don't know so we might go grab something for dinner we might not I have no idea and he's actually gonna be in my neck of the woods tomorrow doing some painting randomly with a friend so he didn't paint anything in my house but he's gonna go paint his friend's new like taekwondo studio so whatever anyway well it's his birthday he can do whatever the heck he wants I guess and he's retired so he gets to do whatever the heck he wants all the time but anyway I am gonna jet here for tonight I am so beat and so tired I hope tomorrow is an easier day but I suspect that it won't be sometimes I wish like this is a total tangent here but sometimes I wish I could talk to the vlog about a lot more things than what I can talk to about it because I feel like you guys are like my pals you know what I mean unfortunately because this is so public YouTube you can see it anywhere I wish I could say certain things I can't say ugh anyway it's just personal stuff not bad personal stuff like not bad personal like for me but just like just talking about my day and like just you know like just the minor irritations and things but like I kind of have to be PC like political correctness and take people's feelings into consideration that may or may not watch these videos so I don't know I'm in a venti mood and I've actually already like vented to like both my parents so thank goodness that like they're around but oh anyway it's just it's just been one of those days it's been one of those weeks it's been one of those months it's just insanity so anyway I'm gonna go because I need to go to bed and like take my makeup off and just like for the day hope you guys are enjoying balloon I will see you guys tomorrow with more good stuff and tomorrow because today's Monday so you're seeing this on Tuesday so tomorrow is Wednesday so you're gonna see me twice on Wednesday because I'm gonna do a balloon and I have a regular schedule regularly scheduled video coming up so stay tuned for that but make sure to give the video a thumbs up if you're liking the balloons and also you'll leave a comment and tell me something good I don't know you can comment about anything it's fine right down there that's that's where you do it also feel free to hit the red subscribe button um I'm doing obviously balloon but it's every day in the month of June I am vlogging but the uploads kind of happen randomly sometimes they're in the morning sometimes in the afternoon and sometimes like late into the evening um but I am trying to upload every single day regardless of my normal posting schedule so that's not really effective by it all right I'm like rambling on now because I'm like deliriously tired but I gotta go and I will see you guys tomorrow


As it happens, I will also be talking about radar. So, I worked for Edis Research, we built us up here, so I've been mentioned before. I'm going to talk about it out of tree module called GR Radar, and I'm not the author of this out of tree module. So, I was involved in its creation, but the only reason I'm talking about this is because I really think it's very cool. I just like that out of tree module so much. I thought I'm just going to come here and talk about it, and as I was preparing these slides, I came up with lots of ideas how to improve it. I think I might make that a project of mine for the coming year, but that's just a side note. Point being, I didn't want to claim fame for the actual code that I'm presenting. I usually present my own stuff, but this is just someone else's project that I just like so much that I thought it was worth presenting. So, GR Radar, I'm going to skip this because Jean-Michel talked about radar. Jean-Michel talked about active versus passive radar. Just to be clear, I'm actually going to focus more on the active side because if you have something like this, then that's the four and a kilowatt like aerospace, you know like plane detection radar. Then you need lots of power, but there's actually so many like the radar business has shifted from like a military thing to just like general purpose electronics. So, vehicular radar is becoming more and more popular and a USRP for example will be outputting more power than your vehicular radar already. So, those are very low power devices and you could build them yourselves. Now, the usual disclaimer like if you start transmitting, then you need to know what you're doing like from a legal perspective. So, if you're interested in any of this, like please don't do anything illegal, but you don't have to just do passive radar if you want to get involved as a hobbyist. Okay, there is one theoretical thing I would like to introduce here because it's going to be relevant for the presentation and that is the point scatter model. Now, radar is interesting science because there's actually much less science than engineering and radar than you might think. There are all these models in radar that sort of try and describe various effects and the point scatter model is sort of like one of the very first and easy things. So, if you do like a radar one-on-one class in your undergraduate radar engineering degree or whatever you take and this is something that will probably be taught. So, the idea is you have a transmitter and a receiver. The transmitter sends some kind of signal. It could be yours, it could be someone else's. And then everything that reflects electromagnetic waves is modeled as one point from a geometrical perspective. And if it's moving towards you or away from you, it'll have a Doppler shift. If it's big, like there'll be a lot of reflection. If it's like little or it has like some odd, like non-ideal reflective characteristics, the reflection will be smaller. Mathematically, this is very, very simple. So, you have a transmit signal S and every point will reflect this signal once. And let's say you have H of those, then you have a linear superposition of those reflections. The transmitted signal will be delayed, depending on how far it took to go to the signal and back. If the signal was moving, then there will be a Doppler shift, so it'll also be shifted in frequency. It'll be attenuated and now the attenuation, this is the most elaborate factor in here and it has several things that are interesting. First of all, the distance is in here as power four. The center frequency is also in here, squared. So higher frequencies mean more attenuation and the radar cross section is a factor that sort of describes how much of the energy this point is reflecting. Of course, in our sort of complete model, we have thermal noise and we also have a random phase shift. So if you translated this to an estimation problem, then what you get is a received signal R, you know S and now you have to sort of back calculate H, like the number of targets and then for each of those, the property is tau, which is the delay, which corresponds to the range. FD, which is the Doppler shift, which corresponds to the relative speed and the phase offset is really not necessary. It's a nuisance parameter because you have to carry it around in your estimation problem, but it doesn't actually give you anything interesting. Okay, this model has its shortcomings because first you make so many assumptions that they just don't even theoretically make sense. Like you say Doppler delay a constant during your measurement, but how long is your signal? Is it 10 seconds? Because that's just such a thing does not exist. Then of course you say, well, my object is a point, but it also has a radar cross section. Like it makes no sense. And clutter is just another target. So there are other models that are more elaborate where clutter is its own thing. I don't want to talk about any of that. The point is like, this is just a model. I know it's just a model. It's very useful. It sometimes helps us do stuff. Okay, that's it. That's all the theory I want to talk about. Now GR Radar, what is GR Radar? It's an out-of-tree module, which means it is an extension to GNU radio. You can download it from Sea Grant and install it. And where did it come from? So while back, like myself and a couple of others were experimenting with active radar and we wrote some UHD-based codes. They were sort of integrated in MATLAB and it was not really very good. So there was this desire to just rewrite this properly and put it in the best DSP framework, which is GNU radio. And a student named Stefan Wundsch, who wrote the majority of this code and who deserves a big round of applause afterwards, actually wrote all of this, like 80% of the current GR Radar toolbox in Google Summer of Code 2014. It was one of my, personally, my favorite GSOC projects. And he still maintains it. He accepts pull requests. So very successful project. And the only thing that I can take credit for is that I mentored him through the process. So I could tell him about radar, but I didn't actually do any of the work, at least at the beginning. And this module was extended by other students from the CL in Karlsruhe. Yeah, and it's still there. So you go to Sea Grant, you download it, you can type pi-bombs install, Jerry just takes a minute to install. It's like really not a big deal. So that's it. That's my only slide on how to install it. Okay, so let's take a look at the toolbox. Now, I had the idea that I would bring stuff and demonstrate it, but you just carry so much gear around to do active radar. I just really didn't want to carry it all the way from California. Plus, like a little room like this, you can't actually show all that much because range resolution, Jean-Michel told you all about it. Now, what do I do? Just happened. Let's take a look. I'm just gonna spawn, can you read your companion? There are really nice examples in there as soon as it loads that I wanna take a look at. I'm just gonna close all of this. I just had this open while I was going over the slides.  And then simulation is a whole bunch of simulation tools. And what I really, this is something that I really like. This is an approach that is very rigorous and it sort of takes away the immediate satisfaction of doing radar on like day one, but it produces code that is very correct. So, and here's what it does. And this is why I introduced the point scatter model. And I don't know who's manning the door right now. Like, can you please make sure that people don't walk in and out? I think we're, we still have some space. Okay, so this is what a typical flow graphics. I'm just gonna close this here.  Actually, wait a minute. I had these two slides on the wrong order. So, if you install the toolbox, you will see all these tools. So, this is just a screenshot from Neurator Companion.  So, at the bottom we have like generators. This is just calculate some tools. And some of these are very simple. Like CW continuous wave is literally just a cyan tone. It adds like things like TSBs in there that become useful. But this is not a very complicated box.  It's just like the exact thing that you need. FMCW is a typical wave form that is used in radar. I don't wanna go in the details of that. FSK is already interesting because you can, if you can do CW or FMCW, you can also do FSK, but you can also transmit data with FSK. So, that's something that I researched when I was still in academia. Like combining data transmission and radar in your active signals. And there are actually a couple other signals you can use. There are some GUIs that sort of extend the utility. There is tools is sort of just a bunch of blocks that I've really not related to radar, but we need them in this toolbox. And estimators, this is probably what I like best about this toolbox. These are algorithms that take the output, like your Doppler range diagrams, for example, and then give you a table of targets. And this is in an automated, like when you write software that's automated in an automated fashion reacts to your tags. And that's what you need. Like your Doppler range diagram looks cool, and that's it. Like if you have an operator staring at a screen, they are useful, otherwise they're not. And then there's a whole bunch of other things, including, and that's what I really like, the static target simulator. I'm gonna show that off right now. Okay, so you generate your signal. You put it through your static target simulator. Now this will, on its output, will give you like the backscatter some, we add some noise first, because that's what we have in real life. And how do you calculate anything from like a continuous wave signal and its backscatter? Well, one method is to do the multiply conjugate. Why is that? Well, you take out any kind of frequency component that you don't care about. You get phase offsets, and you get one of them for every target. And then the end result gets passed through in FFT. So I'm glad like Jean-Michel talked about the theory a little. I can gloss over that a little. And instead of like plotting a Doppler range diagram, we send it into a C-far block. C-far is continuous false alarm rate. This is our estimator, part of our estimator. This will sort of take out the peaks out of the FFT and try and identify where they are. And because an FFT peak itself still not quite useful, we have another block that actually translates it into range information. So here you can see, well, that's just a tone. Guess what? No big deal. That's what we expected, because that's what we're transmitting. But here, this is interesting. You can see I'm getting like continuous updated range estimates, 49.99 something. And where did my windows go? No! And I'm not sorry, it's the velocity here. In meters per second. And that's exactly what we put in here. Why do we only estimate the velocity? It's because we have a continuous wave. We have no range information. So let's see if we have some more elaborate simulations and add range. And one thing you can do is you can just add another sine wave. Now you've got bandwidth all of a sudden. And you can do the same thing as Jean-Michel did. So original tone, so we have two tones here. Now we have velocity in range, 30 meters, 50 meters per second. And this is already being tracked in a separate plot. So if I start changing the range, it'll also go up here. So this is very nice for sort of like running experiments. And you can see here our estimates are still printed. So this is something a computer could like act upon very, very nicely. So let's turn that off. Let's see how am I for time. A lot of the work that was done here was also like geared towards theoretical work. Bachelor's and master's thesis was supposed to come out of it. This is the same simulator except it now adds an estimator for the radar cross-section. I mean, I'm just gonna quickly run it. It has the same overall effect, but it does estimate, you can see like the radar cross-section. So we have an estimate for radar cross-section, velocity at range falling out of that. And okay, so FMCW will look very similar. I'm gonna skip that for now. I would have to go into the reason like why you do FMCW for radar. It's really not that hard, but I wanna focus on a couple of other things. FSK, this is just cool because like I said, the signal that we use is an actual FSK signal. So we could, so in here we generate random data, but we could also be transmitting actual data. So, and you can see in this setup, the result, so this is like what we, like in reality would come back on our receiver antenna. We again do a multiply conjugate with our original signal to do further processing, but then we need additional blocks to do the post-processing. And here in this case, we actually do separate processing on both of the, like this is a two FSKs. So we have two effective frequencies, like we sort of bounce between those randomly. So it's really the same thing as the, I'm sorry about that. It's really the same thing as the dual CW, except that we sort of turn one of them on and off at a time. Let me skip that, kill it. All right, now if you wanna get more fancy in the last two simulations here, these are more fancy for various reasons. So this one here is an actual, starts by generating data. So this here could also, this could be an actual file that I'm transmitting, except like in the simulation it's not. So you'll see what happens with this. So I generate data, I do various things to my data and then, oh, look at that. I'm actually sending it through an OFDM modulator. So what I'm generating here is an actual OFDM signal. And I'm gonna sort of siphon off just the modulation symbols. I don't care about like cyclic prefix and like all those things get in the way when I do radar post-process. So this arrow that goes down here, that's my reference. So this is a lot like doing DVB, TO, DAB, passive radar, except you have much better information about your transmitted signal. So this FFT is part of the OFDM modulation and we add a cyclic prefix. And then once again, we send it through our static target simulator. Before we do any processing, we remove the cyclic prefix again and do the inverse operation to the FFT wall. This is actually a forward FFT. The post-process signal is actually a division of the complex modulation symbols with each other. And then if we run this, we actually do get a Doppler range plot because this is just a matrix plot of the actual OFDM symbols that get received. So like on every frame that we send, we get like one matrix and that's it. So this is very nice. So here's my target. I can move it around. Of course I don't have enough screen real estate to do it at once, but you can see it moves around. And I still get the estimates here though. So that's still happening. Okay, let's close all those windows again. And finally, this is something that I actually have a video of, so I'm not gonna run it. What this does is it actually extends the estimation part. So I said we don't stop at the range Doppler diagram. We actually do target detection. Now we go one step further, which is we actually track targets. So this is what a real radar system actually does is for example, if you track planes, you do lots of radar measurements all the time. And it might just happen that the plane is at an odd angle or something. Like the reflected energy is too little to trigger our radar response. So we actually don't see the plane on a single measurement. Like the air tracking people, they don't think the plane just vanished. They assume this is like a glitch in their sort of radar measurement. So you can make a model of the trajectory of a plane. You can say like it was here like a minute ago. It was there now. So it's probably here now. So you can do that. And you can also put that into a model. And this is also in this toolbox. So very, very cool. And I was gonna set this up, but I just couldn't get a better video than the one that Stefan had originally made. So I'm just gonna show this. So it's actually running. So this is, yeah. So this is the setup he was using. Let me just full screen this. Yeah, this is the dual antenna setup. So there's one transmit, one receive antenna. This is the flow graph that I just showed you, except that the static target simulator was replaced with an actual radio control. And you can see that this is a very confined space. So the, like you need to do some post processing. Otherwise you'll just get clutter from like everything, like the door frames and whatnot. The Doppler shift is enough though to actually do something useful with it. And if you now look at the post processing. Yeah, so this was like continuous measurement. You hear you have the Doppler going one way and the other and you have to sort of, like you can't just like draw this like from the received signal. You have to sort of know what's going on. So in this case it was like, we knew there was like one big target that we want to track. So we plot that instead of the Doppler range diagram would have just been full of energy. Okay, thank you. Let's go back to here. So actually no, I did, I have one more thing I want to show here. So yeah, as you can see, like this is only your standard IQ sample processing up to a point. After that it's just all message passing on individual items. So this is like these tracking blocks, they don't actually look at the time information in the sample stream. So they don't make the assumption that, you know that like input signals are coming on like every 100 millisecond or so. And then we, you know, if we're running at like one mega sample, then that means that's like, you know, a couple of hundred of thousands of samples. What they do is they make the assumption that you've given them a correct sort of pulse repetition frequency and then they just use it as input to their own algorithm.  So you need to make sure that that's happening. But then on the flip side, this whole processing becomes way more efficient and it's sort of, you know, more in line, like this is not something that you wanna do a sample-based processing on. Okay, I sort of glossed over the actual inputs to this block. I'm quickly gonna pull it up. It's very simple. So this here is just a list of targets. So I can just add another target by putting another value here. So 10 meter range, 1,000 meter range, et cetera. And the same with the velocity. Like I don't know, like there was something about like these radar cross-section values there. They're all pretty big. I think there might be some math bug in the code and I'm gonna take a look at that sooner. But one thing that you can actually do, it's just very complicated to show off, is you can actually do a fake MIMO setup. So you can say, okay, I'm not actually gonna process one return signal, but I'm gonna pretend like I have a uniform linear array, like, and they don't even have to be equal to space. The antennas, they just have to be in one line. And there's like a simple trigonometric model inside this block that will include, like, azimuth information, so which this line is. So I can say like, okay, this is like zero azimuth, so right in front of me and then like 10 degrees, so this is degrees, minus 45 degrees or whatever. And then I'll sort of do a phase shift between the output signal. So you can actually do a whole bunch of things with that. And yeah, so this is why this becomes really, really useful. There's a little bit of hardware impairment in there.  So you will always see your own signal on your receive antenna and it'll be very, very strong compared to the return energy that comes from the other targets. So because that is a real problem that you have to deal with somehow, it's also built into this block that you can actually put it into your simulation. So you actually don't get too good of a simulation compared to what you really do. Now, how do you go to actually turning this into a real experiment? It's so easy that it's almost, that it's funny. You see all these simulations have the exact same names. Sorry, these are not simulations anymore. These GRC files have the same name as the simulations. What's the difference? The only difference is that, where is it? Where's the block? There it is. The static target simulator is replaced with this block called usurpy ecotimer for the name has historic reasons. So there's a whole bunch of settings. But basically the idea is you say, okay you have one user that's dealing with transmit, one that's dealing with receive, you put in all the information here and the block will take care of all the timing. So in radar you have to make sure that you transmit a signal and receive it at the same time. So that's one of the problems that Jean-Michel talked about with the timing synchronization of the RTL-STR dongles. If you have a usurpy, that problem is solved by the driver. So all you have to do is prime the FPGA appropriately. So I need to hurry up a little. So I'm just gonna go back to my slides actually. But it's very, very easy to set this up. So I'm just gonna quickly show you how before I go. So if you have stuff like this lying around, then you're good to go. Just hook it up, like the software will take care of it. Not all users are currently supported. And in particular the XP10 would be interesting for that because it has a high bandwidth. The B210 is the cheapest that would do all of this. It'll have a lot of leakage. So I haven't actually measured that. So I'm not quite sure how bad it is, but it'll be worse than on the others. Antennas, you can do whatever you like, but if you have like high directivity, it'll be good. So this is a setup that I actually used a while back, like sort of as before we were, before we had GR8 up, but the concepts are all the same. You can see directive horn antennas connected to usurpy N210s. This is all battery powered. This is what we measured. And this is the Doppler range plot. And this is the output of the estimator. So you can see relative, like these are vehicles that are moving away from us. These are coming towards us. And this is clutter, which we can calculate like we just remove algorithmically because we know we're looking at a motorway and there's little, like people usually don't stand around unless it's a traffic jam. There's a whole bunch of things that are missing, but I don't really have time to go into them. But like better passive radar support in GR8 would be cool because I agree with Jean-Michel that it's hard to sort of replicate some of these setups. And that's exactly what GR8 is trying to make easier. Okay, if you're interested in any of this, that would be cool. And you could join us in working on GR8. So if we're lucky, fingers crossed, there will be a Google Summer of Code project, a GNU radio. And then I've always like advertised GR8 as a project, like even the last two years when I wasn't really working on it. If you're doing radar work at university, you might as well do it on GR8 radar. Okay, so thank you. I know. All right.


It's time to make a change So here are the subscribers of the week guys and if you want your name on our phrase for an entire week All you have to do is like this video subscribe if you haven't already and in common now done when you're done Right now, we're gonna be asking our dad who's a retired spy Questions we all want to know do you cover the cameras on your phone and laptops? Absolutely, when do you think life in the US will go back to normal summer? What will be the end of humanity humanity the aliens exist on earth? Next question what country would you least like to live in North Korea? What's your favorite memory as a spy? Meeting your mother-in-law was 9 11 a conspiracy So we're always fighting about who we think Tokyo loves more so right now We're gonna run in opposite direction and whoever she chases is the person she loves more two three I feed her to why does she choose you? I'm clearly everyone's favorite twin including Tokyo's even dogs now are picking up. Yeah, all right So I have this tan dream right here now. I'm gonna prank Alan with that down right here There we go. All right, so put your hand up now stick your finger inside this straight ahead Yes, you can go ahead and take off your blindfold So there for this week is fart while in the middle of a conversation did you guys know that? That's what we're gonna be doing excuse me. Yeah, could you help me find something? Yeah, I'm looking for a It's like a watermelon slicer. I don't think we have something like this in that case. Do you think you could? Do you what you saw it online on YouTube or something? Yeah, but I mean I guess we can just find it ourselves It's not here Thank you But now that we did one of your dares we dare you guys to like this video Hey, Alex, did you hear about the kid napping at school? No, what it's all good.  Hey twins, what do you call a baby cat? What a kitten? So I'm seeing a lot of comments saying that you guys aren't gonna subscribe because our half court shots are fake or It takes us a lot of tries so I'm gonna pull over right now to a basketball court I'm making on my first try you guys had to subscribe So last week you might have seen me get in a fight with a kid and my biggest mistake in that fight was pushing him What I should have done was the one inch punch I'm gonna teach you guys this move today and lying your hand with your opponent's chest And then you transfer all the energy from your shoulders down to your arms to your fist like this Now let's try this in real speed. All right guys. So right now Alex is outside But when he comes back inside, we're all gonna play a prank on him by being extra mean to him and get his reaction Oh God already Did you get a haircut? I did Stop saying that Jeremy probably farted Stop saying that doesn't look a little frizzy. Yeah cotton. I swear you First question most likely to dye the hair a stupid color Flamingo look at that hair Most likely to eat someone's leftover Most likely he actually does it Most likely to gain a weight while on a diet Most likely to never get a girlfriend Most likely to be the least favorite friend in the friend Right now we're gonna be finding out who the better shooter is we're gonna have two teams here It's gonna be me and Jeremy on one hand Ben And Brent on the other team. All right, I'm gonna be all y'all by myself You know, I don't see you. Yeah, I didn't you're not playing When he's guarding his plate The first team to make two in a row wins this challenge, okay?  I get five minutes. So we Are we going right now? Yeah, we were as a reason for four so one two three four. Oh, that's perfect. Yeah, let's go for it This will be take us there and drop us off get out here. I'm gonna not I was that dude. This is just a prank if you say it's a joke I'll believe it from them, too, but these two especially when they're throwing stuff No, the sad thing is they actually treat me like this Okay, I know how to make Alex feel better you guys can't make them feel better, but you guys can we're almost at seven mil This video gets to your K likes I'm gonna bring Alan to like a brother correction facility because he keeps on pressuring us to be mean to his own We're just so close to seven mil guys Whoa


Welcome to another episode of Frightfully Forgotten's VHS Tales. What are you drinking? We just rented a bunch of movies and we're about 13 years old. It's a big old glass of coca-cola. Oh my god. Yeah, you're right. It's just a big old glass of stone.  Today we're gonna bring to you our Story of when we used to rent seven movies for seven nights for seven seven bucks At home movie rentals the local video store. Hey, yeah, and it's funny. It was just called home movie rentals That was the name of the place. Yeah, and the place was awesome It was loaded with movies was one of the better rental places we had in our neighborhood Massive it was huge.  Yeah weird movie They would get that like I remember like tourist trap for example wasn't at home movie rentals Yeah, I was at some other weird it was like camp or corral. Yeah, you know, yeah So there was things like that which was kind of cool because you had to actually search around If you wanted a movie or if you heard of it or read it in a magazine, yeah You had to actually search around for which is neat about the old home movie rental days Like you'd have a mom-paw store to be like have a couple of gems Weird low-budget things you wouldn't see at the big stores. Yeah, just kind of need the literal mom-and-paw Stores you'd wonder how these old people would even have Think of getting this This one yeah, it's like what the hell are you guys thinking? Yeah, I'll take it, but still It's like weird So home of your rentals back in the day had a promotion seven movies seven nights for seven bucks Yeah, and we do it often, you know like on the weekend every weekend We'd go and do that back and forth each weekend and there's always like the same There's a few movies that were to switch up But there's always a staple of same movies would always get we'd usually get like the whole evil dead trilogy would get One to an army of darkness the shining sometimes you'd get demonic toys. Yeah, dolls Dolls we would get yeah Prince of Darkness. We'd stay up like all night We try to bang out as many movies as you can watch in one night, right? Yeah drinking two liters of coke coke Right, and we'd have a kind of running gag words like we tried to make each other laugh Yeah, as the other person was taking a sip of coke or something and like it all All over the floor and everything the next day the floor be all brown and soaked and sticky Not realize their parents have to clean it up Those are great days to be a movie lover because you can walk into like home of your rentals or I'm sure a lot of people had you know these big rental stores that were Wurth blockbuster had a great horse selection. You can walk in and see all this cool Stuff these neat covers. There's lots. I remember seeing that we couldn't even rent We didn't have the time to rent them all yeah jumbo video was one of them Yeah, we had a jumbo video here, which is cool because it had a horror room Yeah, that was cool. It was always kind of a little eerie to go into I never went into it like all that much I went into it maybe once or twice like a Michael Myers mannequin and there is a you know Jason Vorhees mannequin and yeah, but it was cool like walking around in the place because they gave you free popcorn They did You know the sad thing is you know, we had these big Places that weren't part of a big chain. They had a great selection and then blockbuster came in And it's funny that we just watched both The last blockbuster yeah, and how they talk about how they came in it took over these monpah shops And we saw that happen in real time and it was like oh man. Yeah, man. I hated blockbuster I hated it. I hated it with the passion and I you could feel it when it when they moved in when they took over home movie rentals Yeah, you could feel that it's like okay. These guys are taking over everything Yeah, it's not the same. It's not the same and it's like this is this is something's happening This is ruining and it was all sterile wasn't inviting It felt very sterile and like and you go look at the horse section and suddenly All those cool movies that like you know like slaughterhouse With that fat guy with the Yeah, leave her out all those those iconic horror movies that you'd always see on the shelves at home movie rentals those great covers We're all gone. It's just suddenly just the staples. Yeah, and it went from like a selection like this to like that Yeah, and they overnight they focused more on like the new releases which made more money, right? Yeah Which sucked because where's the variety? You had nothing after that the gaming section Yeah, for home movie rentals was enormous.  There was like three games Yeah, there's like well I have this expensive system here, and I can't play it Digressing a bit.  Is that downtown? Yeah, there was comic factory Yeah, yeah, yeah, I remember that place.  Yeah all that was gone Yeah, and even stuff like cartoons like the children's section with like the cartoons You can rent like all the stuff you watch them Saturday mornings like all the Ghostbuster cartoons and he man and cartoons All that stuff there was the whole section for that and suddenly it was all gone Everything's gone and streamlined right all to whatever could make the most money before the days of the internet before streaming Before downloading.  Yeah, there's garbage. It's pretty bad I remember when blockbuster moved in and took over home of the rentals It was kind of like I almost first saw the decline of yeah of Movie rentals. It's like ah, it's like this is it man. This is something's happening Something's changing here like it's it's one thing to go to walk in to a place and rent a movie It's a different thing to walk into a place and rent a weird obscure movie or a weird Underground straight-to-video movie. You wouldn't see yeah anywhere else, right and blockbuster kind of took that away And us right yeah, and and then on top of it, too It's like the cost of everything went up. Yeah, and so our parents like I know my parents They're like they didn't want to rent. They don't pay the money half the time So one of the movies we did rent for the seven movies for seven nights for seven bucks was edge of the axe Yeah, which we had kind of forgot about is that movie even any good Yeah, I can't remember remember like oh Christ like it was so long ago And obviously like wasn't a movie you rented all the time so couldn't have been our favorite But yeah, it was a good wasn't bad. We don't remember I remember a lot of the axe hits Yeah, is it any good? Is it any good now once we've Matured walls find out So our next task is to rewatch edge of the axe and we're gonna include it in Trash or treasure. That's right. So next week stay tuned and until next time Keep drinking coke coca-cola


update vlog from me because it's been forever but I've been so busy a lot has been going on over the last few months slash probably last year actually I've really struggled to do vlogs and videos and stuff like that but here we are I have left GP I know I'm gonna say I've left I've left I've left the NHS all together um I can't say who I'm working for and I can't say anything about my role because it's very confidential and stuff like that um and can put me more at risk of being harassed and targeted and stuff like that so I'm not gonna go into it too much but I'm still in us I'm working from home it's a lot more money a lot less stress and I've got a way better work life balance right now with everything it's just it's just yeah it's been the exact change that I needed um I was feeling myself getting really burnt out I had a lot going on like I said over the last year and stuff and I just needed something else to get me motivated and look after myself again um which has nurses we don't do very much and I felt massively guilty for doing this because my passion was always GP I always wanted to get into GP and it's still my passion don't get me wrong I love it um and I'll still promote it and I'll still be part of the GP and SNN and stuff like that um but I just needed something else to get me back to how I am and my bubbly happy motivating self again so that I can be a benefit to everybody else so I have changed jobs um if you want to inbox me please inbox me if you want to know a bit more and stuff like that I just can't put it out there public or anything like that or talk about it what I'm doing but it's amazing and I'm loving life next update look at this what does that tell you a new fur baby coming tomorrow I know I'm getting a cat and um its name is his name is Isaac Muton which the RSPCA have named him and I love it so we're keeping the name um he is absolutely adorable he's a black and white short-haired cat and he's gorgeous and I'm so excited I wanted an indoor cat and he's got FIV which is HIV but in cats I know which I will talk a little bit more about if anyone wants to know a bit more about that because I'm researching and getting more information myself on it in cats so I've never heard of it before in cats so this is really new and exciting and he's very very healthy don't worry he's healthy he's three years old and he looks like an amazing character so I'm really excited and I'm going to go get him tomorrow so I will show you him when he comes home when he's a bit more confident because he's got to get used to his new surroundings so yeah on other times I've painted the kitchen look at this it was very boring and white before and I've changed it and then my landlord rang today to say that they're coming to do a spot inspection on Wednesday so I'm hoping they're gonna like it they said I could decorate so we'll find out that's a lot of updates all at once so that is my updates for now um I hope everyone's okay with everything that's going on at the minute and everyone's getting burnt out at the minute there's a lot of negativity in the world so I hope that everyone's taking some time out for themselves my thoughts and prayers are with Ukraine, Russia um everybody out there that's suffering as a result of these silly people in powers decisions um I hope everyone's okay I don't agree with weapons I don't agree with I don't agree with anything like that I wish the world could just live in happy harmony wouldn't that be lovely but I just hope that all of the innocent people of Russia and all of the innocent people of Ukraine that are being targeted and injured as a result of this I hope they're going to be okay and I hope that this can be resolved soon I hope and and not escalate we'll see it's quite a scary world but I hope everyone's okay whoever's watching this I hope you're okay and um yeah look after yourself and as always my inbox is always open for anyone that's struggling right now please inbox me because I will respond and if I can in any way help I will obviously I don't know everything but if I can help in any way I always will so yeah inbox me so that's it for now I hope you'll have an amazing day amazing week whatever you're doing whatever your plans and I'll see you next time