Hey there, I'm Drew and you are listening to or watching and this week You really should be watching the anxious truth This is the podcast and YouTube channel that covers all things anxiety anxiety disorders and anxiety recovery So if you're struggling with things like panic attacks panic disorder or agoraphobia or health anxiety This is the place for you and I'm glad that you're here this week. We're starting a special series on the podcast I'm going to take you to one of the places that used to terrify me They used to induce all kinds of panic and high anxiety and while we're there We're going to talk about the idea that you don't always have to figure out why you panicked Deciphering a panic attack is not necessarily part of the recovery process So let's get to it and I will remind you before we do start if you're not watching this week You might want to do that So if you're not sure where I am on YouTube, just go to the anxious truth comm slash YouTube You will find my channel and you will find this episode. That's enough of that. Let's get into it now Hello everybody, welcome back to the anxious truth. This is podcast episode number two five one recording in March of 2022 I am Drew lince a lot a creator and host of the anxious truth If this is your first time here in the podcast or the YouTube channel Welcome, I hope you find this all helpful if you are a returning viewer or returning listener I'm glad you're here. Welcome back So this week We're gonna start a special series of podcasts that I kind of promised to my folks on Instagram Where I'm going to take you to places that I used to refuse to go when I was struggling with the worst of panic attacks anxiety Agoraphobia OCD all of the things I would hate to go to these places I'm gonna start to go to these places with you and I'm gonna record podcast episodes in those places We'll talk about what my experience was and what I do to get over it And we'll also talk about whatever the podcast topic is for that week But we're gonna do it in those places and today We're gonna start in a special place that you might not expect But it was a thing So today while we're in that special place and starting our first series We're gonna talk about the idea that you do not have to decipher a panic attack A lot of people want to figure out why they panic and they get sucked down the rabbit hole of trying to figure out What triggered it? What can they do next time to make sure it doesn't happen? What can they eat or drink differently? What can they do differently? What can they avoid? That's not really part of the process that we're talking about here and today We're gonna talk about why while I take you to that special formerly terrifying panic-inducing place that will probably surprise you So before we get started just a quick reminder that the anxious truth is way more than just this podcast episode There's 250 other podcast episode. I've written books about anxiety and anxiety recovery. There's all my social media content There's courses and workshops all the goodies are on my website at the anxious truth comm So when you get a chance go check it out and avail yourself of all the resources And if you dig this work, and I am helping you in some way all the ways to support it can be found on my website Also at the anxious truth comm slash support that includes maybe buying a mug or a t-shirt or buying my books Or maybe subscribing to my Instagram subscriber group whatever all the ways to do that can be found there That is always appreciated, but never required and no matter how you choose to support this work and this podcast Whether it's just hitting the like button on a YouTube video or leaving a podcast review. Thank you very much Appreciate your support. So let's get into today's topic. Why do you not have to figure out why you panicked? Why is that not really part of the recovery equation? And let's go to that first place that used to really terrify me and that I would panic when I went to So let's get to it and I will come back here to wrap it up at the end Okay, so here we go as promised. I am recording this podcast at the end of my driveway Why am I doing that because I promised that I would do a series of podcasts where I record from places that I used to be terrified to go This is one of them the end of my driveway The end of my driveway is maybe 40 feet from my front door at the most and I'll put some b-roll in here So you could see just how short a walk it is down the down the out my front door and down to the bottom of This driveway where I'm standing maybe two more steps that I'm actually in the road in the street and Back in the day when I was doing the heavy lifting of recovery and I was going through anti-depressant withdrawal So we are talking about well over 10 or 12 years ago And that's that period between like 2006 and 2009 when I was doing most of this work This was a really difficult place for me to be and I might come here to put the trash cans out or take the trash cans in I really didn't want to do that But that was my job So I had to do it or I would come to the mailbox to check for mail or put mail in the mailbox So the postman would pick it up and there were many many times when I came to the bottom of this driveway in full panic because I was afraid I was just afraid. It's a little bit embarrassing now I mean not embarrassing, but it is sobering to say that but I would be afraid to come to the end of my driveway 40 feet from my front door and I would come here with my legs shaking and I would feel like I couldn't breathe And I was doing that thing where like I'm trying to fill my lungs and I'm taking these giant heavy breaths And my legs would be shaking and my vision would be weird and it felt like the sort of world was spinning Or I was leaning to one side or the other and I just felt very unsteady and I was just afraid I was just really afraid And I would come down here and do what I had to do and then quickly run back up and Get back in the house and it would take me a while to recover from that So I had quite a few episodes of panic right here at the bottom of my driveway And if I'm going to be completely transparent and honest with you guys And I'm going to record podcast episodes from places I used to be afraid to go I have to start here because this was my reality for a while So the whole podcast episode won't be here at the bottom of just about talking about my driveway But I will tell you that there were many times when I would stand at my front door And I would wait and I would debate with myself and I would ham and ha and go back and forth and Try to get up the courage to walk out the door To come 40 steps to the end of this driveway and I'd already be kind of in a panic and knowing that if I walked out the door I would panic even more And especially if my job was to take out a trash can and that trash can was heavy because sometimes they are That would set me off even more because that meant that I would breathe a little heavier Or I might my heart would race a little more and back in those days I was not in as good a shape as I am right now I'm older but in better shape now than I was then Because people with panic disorder and agoraphobia tend to be kind of sedentary And I still had some weight on me for my antidepressant days So that would trigger me in a big way if I had to take out a heavy trash can or you know heavy garbage bag I would really not want to do it because I knew that that my heart would start to pound that I would didn't want that I was afraid of that So anyway, here I am starting this little series of places I used to be afraid of at the bottom of my driveway And just know that if you're struggling to get to the bottom of your driveway or get out into your backyard Or your garden or whatever you call it wherever you live I get you because I was you too and these were hard days So if you're struggling like I was then just maybe take a little bit of Heart in knowing that I used to struggle too But now I wouldn't think about the bottom of the driveway if I wasn't here recording for you It's a non thing and we're going to go on in this series and do way more stuff I'm going to go into the New York City with you. I'm going to go to airports with you We're going to go to the beaches or do all this stuff So it won't be every week, but stay tuned. I will sprinkle them in as logistics allow So let's get to the actual meat of today's podcast episode, which is the idea that you have to figure out Why did I panic? Why did that happen? So always remember that here we're dealing with anxiety disorders a distorted state of anxiety where Part of that definition is that you are anxious about being anxious You are afraid about being afraid you are panicking because you panic So in those situations, we're not talking about just like life is stressing me out And I'm not ever telling you to ignore your emotions or ignore your life If you're an abusive situation if you're in a you know, in a bad relationship or you're being manipulated or even harmed Or you're working for a crappy company and you hate it there Those things do matter like the source of your stress does matter in life But when we were talking about why did I panic and you are in a situation where you are just afraid of the panic And the panic becomes the source of the panic and that original stress is Contributing but not really the trigger anymore than digging for triggers and trying to figure out why it happened is not fruitful at all So if you're kind of new to this and maybe you're just sort of new to the podcast or new to my books or whatever it is That might be a strange concept for you because part of your Probably desperate attempt to stop your panic attacks or control them or keep them from happening Was probably to spend a lot of time to try to unearth your triggers and know what your triggers are I have to find my trigger so that I why do you have to find your triggers so you can avoid them Right and that isn't working out so well So a lot of people do spend a lot of time going down that rabbit hole Where they are attempting to identify every possible thing that triggers the state of panic and I was there I blamed everything everything food that I ate like the too many phone calls I blamed every possible thing I could think of and after a while I ran out of things To blame and I ran out of things to avoid So I always tell the story once of having a real uh a panic attack Maybe half hour after I had eaten Chinese food with my family and I didn't eat Chinese food again for like four years Probably longer because I was 100 convinced that it was the Chinese food that triggered that panic attack No, it was the 10 panic attacks before that that week that triggered the one that I thought was all about an egg roll So I was wrong So the the bottom line here in this particular podcast episode is you do not have to figure out why you panicked Again when you get out of this state where you're just always afraid of yourself where you're always worried about panic You're always scanning you're trying to control it They just keep happening and really the panic itself has become the problem for you once you get out of that state Then yes stress management trigger management taking care of yourself Not not subjecting yourself to you know abuse or or nastiness or negativity Yeah, those are all reasonable bits of life advice that most people would follow And I'm a big fan of stress management and things of that nature and taking care of yourself But right now we can't get stuck in why did I panic at all that's not fruitful at all Now wait a way here. There's the most I either hear it from people who are kind of new to this And they think that okay cool I'm going to get involved with this dude from new york who's On his driveway recording a podcast and we're going to identify my triggers and no you're not because we don't talk about it Right, we don't talk about that right here But most so you're going to have to sort of let go of that like I just said But so I hear it really most from people who are kind of down the road in recovery Where they're getting the job done and they're changing their relationship with fear And they're getting better at having panic attacks and they're losing the fear of the panic attacks So therefore they begin to have less panic attacks Which is I know where everybody wants to go and that is the happy secondary side effect of learning to be better at relating to panic and fear And maybe they're getting better and that's awesome because you start to realize like wow I don't panic as much as I used to or a man. I haven't had a panic attack I've had four panic free days for the first time in two years and that's an amazing day That's a day to celebrate for sure But then on day five you have a panic attack and most times people when especially the first time that happens to them They will immediately start going to but why I didn't have any for five days. I didn't have any for two weeks I didn't have any for two months and then I had a panic attack. Why what caused it? What was it? What was the trigger? What was I doing? What did I eat? Where was I? You can't go there. You can't go there. That won't help you at all So part of that idea that you have to then dig in and again try to figure out why you had a panic attack It's literally because you are still not terribly confident in that state that you are in trust me on this one People who begin to experience fewer and fewer panic attacks who feel less and less anxious Are often all over my facebook group and in my comment section Being anxious about not being anxious or wondering if it's going to last or not believing that it will last Like what if it comes back? What if this is fake? What if it all comes crashing down and I have a relapse? People who are recovering often worry that they are not actually going to recover and they worry about it all falling apart And they're always looking for the anxiety and they're still looking for the panic and then it comes and that's why it comes So that's okay. You don't have to dig in and start trying to figure out desperately Well, what caused my panic attack? What was my trigger? Why did it come back after so long? Well, it just did well mostly because you're still scanning and you're still afraid that it might come back So it does now if you're further down the road and you have an experience panic in a year and a half or two years And you do experience a panic attack or maybe it's been even longer There's still that thing where like I don't have to dig so much now I may be in a situation where I could say yeah, I'm not sleeping a whole lot. I'm not eating very well I'm stressed to the max like I I'm I can't take anymore I'm just bubbling over and yeah turn it to a panic attack Sometimes when we get to that recovered state we can identify that like oh, yeah life pushed me into a panic attack But that's okay because then you realize that and you think well It wasn't because something is wrong with me. It wasn't because I was going insane It wasn't because I was having a stroke or a heart attack I just got stressed to the max and it pushed me over the edge That's a good place to be but if you don't recognize that yet and you still find yourself drawn to What was the trigger? What did I eat? What was it? Is it something wrong with me like the old ways? That's where you have to remember my words right now So when you do have a panic attack after not having one for days or weeks or months or even a couple of years Try to remember my words Why did I have this panic attack? You're going to ask that because everybody just naturally does If you find yourself getting trapped on the hamster wheel of trying to figure it out Because you're afraid of the reason why you had a panic attack Then it's time to go back to the things that you learned that you were practicing that got you to where you were to begin with So go back to the things that had you panic free or not so anxious or having fewer panic attacks Don't get sucked in because it will try to pull you back in and it will try to make you ruminate and think and analyze and figure out It's going to do that recognize when it's happening and remember. Oh, that's right I just have to treat this like I used to treat panic attacks like they're not important It was scary. I didn't like it. I wish it didn't happen. I hope it doesn't happen again That's okay But I handled it and I'm going to have to do it the way I used to do it The things that got me to where I am now in recovery and I'm going to keep going And then one day if all goes to plan and all goes well You will wake up and maybe you will have a panic attack That you and you haven't had one for so long or you might have a particularly anxious day that you haven't had in a long time And you will be able to say I know why this happened Because my life my life is a mess right now or because I had a huge fight with my partner or because I just got laid off for my job Or because I'm having money problems or my kids are making me crazy or there's a big illness in the family Or I just suffered a huge loss. Maybe someone close to me has passed. You'll know you'll know That's what recovered people do. You'll know I had a panic attack because I got overwhelmed and that's okay I don't like it But it doesn't mean something is wrong with me and I don't have to be afraid of it And I can concentrate on the part of my life that sort of pushed me into that and I can deal with my grief or deal with my loss Or deal with my Financial problems or my career problems or my family problems or whatever it is You begin to know that the panic attack is just an expression of something happening outside of you And you stop trying to figure out what's going on inside of you That's when you know, you're done. That's when you know, you did it. You are recovered. Welcome. Congratulations So that's enough rambling on at the bottom of my silly driveway about why you do not have to figure out why you have panic attacks I know that for some people They don't like when I say that because it sounds like I'm invalidating their emotions or invalidating their experiences Your emotions matter and your experiences do matter But you have to recognize when you have become more afraid and more stressed by the panic itself Then anything that may have caused it in your life I'm not saying that those things don't matter anymore But recognize when you are afraid of being afraid recognize when you are catastrophizing about the panic recognize when you are You know finding meaning and panic that generally revolves around What's going to happen when you panic as opposed to what happened that maybe made me panic see the difference so Recognize when you're trapped there and remember I don't right now. I don't have to know why I panicked right now Maybe one day when I'm in a better place I can have a little bit more of a healthy normal productive relationship with that And I could look at that and I could do something about it. That's actually just good life management or good stress management But for now, I do not have to worry about why I panicked. I only have to know that I did I didn't like it. I prefer that it not happen again But once again, it didn't take me down and I can handle that. That's where you want to maintain your focus if at all possible So that's it. I hope you enjoyed me recording at the bottom of my silly driveway I hope you got something out of my driveway story the next time we do this I don't know where I'm going to go, but I will bring you along for that too I have a couple of ideas, but I'll just sort of let it unfold while I can I will pop back into the studio, which is just my office and I'll wrap this up the way I usually do And uh, yeah, thanks for listening. I'll see you in a minute Okay, we're back in the studio like I said, which is really just my office where I always am And I was really only about 35 or 40 feet in a straight line that way in recording this podcast episode It was a little unorthodox and it got a little bit uncomfortable a couple of times because I could see a couple of my neighbors Were out and sort of looking like what's that guy doing, but that's all right. We can handle a little discomfort, right? So I hopefully we have shed some light on the idea that you do not have to figure out why you panicked And in fact digging in to try to figure that out often things make makes things worse than they already are So if you're getting sucked down that rabbit hole, just remember my words from today back away from that I promise you'll be happy that you did that So that is it. That is episode 251 of the anxious truth in the books. We know it is over because The music which is as always after glow by my friend ben drake You can find more about ben and his music including this song at his website Which is ben drake music calm go check it out And I will ask you if you are listening to this podcast on spotify or apple podcast There's some place that you can leave a review or leave a rating Leave a five star rating and maybe take a second and write a review of the podcast because that helps more people find the podcast And we want to help as many many people as we can if you're watching on youtube Be sure to subscribe to the channel hit the like button on this video and maybe hit the notification icon So that you know when I upload new content Leave a comment I circle back to my youtube at least twice a week to answer comments Love you guys over there and that's it. Hopefully this has been a helpful episode I hope you enjoyed my little trip down memory lane to a place that used to be so hard for me to go We're gonna do it again. Maybe not next week, but we will I will be back next week with another podcast episode. Don't know what i'm talking about Don't know where i'm gonna be But I will be here and remember every step forward is a good step forward no matter how small it is See you next week


Now let's look at how to perform backward chaining. The definition of backward chaining is, linking together behaviors beginning with the last behavior in the chain. Let's go through the procedure with the same example of washing hands in order to see how this type of chaining differs from forward chaining. First, prompt your student to perform all the behaviors in the chain in order except for the last behavior and then reinforce your student's independent performance of the last behavior. Wash hands! Okay, we're going to turn water on. Get soaked. Rub hands. Go, go, go. Rub, rub, rub. Excellent. Water off. Great job. Your hands are all clean now. Here is your fruit treat. In this example, we see the instructor prompting the student to turn on water, get soap, rub hands, rinse hands, and turn off water. The instructor stops before the last behavior and the student must complete the last behavior of drying hands independently in order to receive reinforcement. Then, reinforce your student's independent performance of the next to last and last behaviors in order. Wash hands! We're going to turn water on. Get soaked. Rub your hands. Rub, rub, rub. Scrub, scrub, scrub. Great job. You remembered all by yourself. That's excellent. Here's your fruit treat. Now, you see the instructor prompts the student to turn on water, get soap, rub hands, and rinse hands. But then stops so that the student must complete the last two behaviors of turning off water and drying hands in order to get the reinforcer. Then, reinforce your student's independent performance of the last three steps in order and continue in this manner until your student can complete the entire chain independently following the SD. An advantage of using backward chaining is that the reinforcement always falls at the end of the chain, allowing you to use a variety of reinforcers.


Great. Thank you very much, Char. So I think I'm going to kick things off. I'm just going to give a quick agenda of kind of what we wanted to go through. I'm just going to give a very brief, very brief overview of what Firefly is, what the project is, how it's used, and kind of the brief snapshot of the roadmap of what we're working on currently. And then that will kind of segue into Peter talking about how identity works in within Firefly, and then hopefully from there we could kind of open it up and have discussion about it. So, my, my other disclaimer is that before about a couple hours ago this morning I didn't realize this was going to be a presentation. I think it was more of a conversation so, so that there's my disclaimer. I'm going to go ahead and share my screen, because I do have some slides to go through here, and we'll jump right in. So, just kind of want to give folks if you're not familiar with the Firefly project. Like I said, a very brief overview of what it is. I could talk for a really long time about this, but I'm going to try to keep this short. So, we describe Hyperledger Firefly as a super node. And it, we described that as a complete stack for enterprises to build and scale secure web three applications. So, what does that mean what that means. Firefly is not a DLT. It sits a layer above the blockchain, and it is a platform that you can build web three blockchain powered apps on top of. So, what, what does that give you as as a developer what's the benefit. When you look at the landscape of open source projects, there's a lot of projects down kind of at the at this low level of of blockchains, DLTs, all these, you know, tools for for doing stuff on the blockchain. That's great. There's, there's lots of, you know, there's, there may be lots of stuff at the top layer to you know where you have your user interface and there's there's lots of great open source frameworks for flashy cool web apps but if you want to build an enterprise web three application there's all kinds of things that sit in between those layers that you have to build. And one of the things as Peter was saying this is out of the journey of Kaleido at Kaleido as we built more and more web three applications we realized that hey that all these applications need it the same or very similar set of plumbing and pipes and connections to different things and messaging buses and event management and all this stuff that sort of sits in between these layers that lets you build a really robust enterprise web three app that can scale and is secure and it is ready for enterprise production. So that's that's what hyperledger firefly does it's it's meant to fill this gap to give you a common platform with a an easy concise set of apis that you can build an application on. So so it sits like I said a layer above the blockchain itself. And let's the developer focus on the thing that's really of ultimate value to their business which is solving their business problem. So the developers can focus on the logic of their of their business app. And they don't have to spend time thinking about, well, how do I actually get data from this, this one piece of our network architecture over here over here, Firefly handles all those things has connections for all those things. So, what's in the box. So think about Firefly in kind of providing three major categories of things that allow you to build apps flows and digital assets and I'll kind of break down what each of these are in just a minute. So that those are like the main sets of things that it lets you do and build those are powered by the Firefly core Firefly core is has an orchestration engine in it. That is sort of the the brain and the connector and the the organizer for for all of these different systems that it's connecting and what are all those systems well there's there's obviously a blockchain node. There is a shared storage service, there is a private data bus for privately exchanging data. Firefly core has its own database where it's keeping track of state of the network of things on the chain, and also its own internal state as well. So this, of course, is done with security, this is enterprise ready so there's, you know, there's security running through all these layers. There's also a really robust set of tools kind of have on the chart over here. There's a an SDK for Node.js. It's written in TypeScript so has great type definitions. There are more SDKs coming. That's the one that we have today readily available on npmjs.com. There is a command line interface that can be used to create a local development environment on your machine that will start all this stuff up and let's you play with it with just a few commands. And obviously there's there's a fantastic API for for all of this stuff. There's a web UI, the Explorer. I forgot to mention here at the top. The Explorer is a fantastic user interface that lets you see what's going on inside Firefly. And all of this is designed in a cloud native modern distributed architecture in mind. So it's meant to run in Kubernetes. It has Prometheus monitoring built right in. And, and, and it's great. So let's kind of break down kind of these apps flows and digital assets and describe a little bit more in detail what we mean on each of those. So, one of the really cool features that Firefly has is that it will let you build HTTP APIs from smart contracts so you can import a custom smart contract. If it's Ethereum, you could provide an Ethereum API and Firefly will generate on the fly an API for it so it lets you sort of rapidly build integrations and applications it also stores information about the about that the API on the chain and could broadcast that to other parties as well so you can inform other parties about a certain contract that's on chain and there's some really cool features there, including the ability to subscribe to events being emitted by those contracts to index those events and be able to query them and get state out of the contract as well all through Firefly's API. Firefly is one of the main use cases for it and this is a use case that is is growing there's a lot of functionality being built into it right now is to use it as a Web three gateway. What do we mean by that so, for example, if an enterprise has they want to build a an app power by blockchain, but they need to have a control point or a one point in their IT infrastructure that is can communicate with a public chain for instance communicate outside the business network that needs to be in a very specific area of the network Firefly can can fill that role so Firefly becomes the gateway to the Web three world in the same way that an internet gateway is a mechanism for applications inside a network to reach out to systems outside of the private business network Firefly can act in the same role for the Web three world. And this can go both ways as well so everything coming to and from the blockchain goes through Firefly and to a web three app. So this provides a lot of power for businesses. One of the other use cases, or, or sort of usage patterns I should say it's it's much broader than than a specific use case but we describe as a usage pattern is for consortiums or multi party networks as we refer to them as sometimes. So, and this was this was really like one of the very first usage patterns that was built out robustly in Firefly. So, a lot of the demos that you if you've seen the demo already a Firefly it was probably the consortium multi party usage pattern demo, where you have multiple organizations that are interacting with each other through the blockchain. They're broadcasting data throughout the whole organization hashing it pinning it to the blockchain. Maybe they're privately sharing more sensitive pieces of data directly between members, and they can perform transactions with with custom smart contracts as well. And so Firefly allows these consortiums of businesses to build a network powered by blockchain to perform business transactions with each other, all through the chain. Okay, and that that third box was digital assets so Firefly also comes out of the box with really robust APIs for tokens, which are one of the fundamental building blocks of a web three app of a blockchain app. Tokens could be fungible or non fungible there are our patterns for both in Firefly. And it is, it doesn't actually matter which specific token contract to use it could be a vanilla off the shelf open zeppelin ERC contract, whether that's ERC 20 ERC 721. It could be a completely custom token contract, and as long as it implements the ability to mint transfer and burn tokens, it, and Firefly also has the ability for token approvals as well. There are first class API is built right into Firefly, there's a fantastic dashboard that lets you inspect everything. This is a little screenshot of the the Firefly Explorer the Firefly UI that shows kind of what's going on inside this particular token pool, but there's great support for tokens right out of the box makes it super convenient. We've had a lot of people come to the project and try it out, just so that they can actually learn about tokens because Firefly provides just a really easy on ramp to get up and started running a system being able to to mint some tokens transfer them play around with an external wallet and just understand how different token contracts works and it's been really great. Okay, I'm going to go through these next couple slides. Maybe a little quicker, but one of the just briefly touch on the Firefly core and so the Firefly core is it's important, especially to the next part of the conversation as well when we start talking about identity so Firefly core is, we have, there's a picture of a brain in the middle of this diagram because we often refer to it as the brain of the system, and it's sort of the, it has inside it an orchestration engine that is in charge of making sure events are delivered in the correct order based on the ordering set by the blockchain so that the ordering is established by the chain. But then Firefly in the orchestration engine needs to make sure that everything stays in that order as the, the events are presented to the application, as things are put in the database, and it handles, it handles a lot of the heavy lifting of the grunt work of what an application or would normally need to build into their application to have a reliable, you know, stateless web three app and the Firefly core orchestration engine takes a lot of that for them. So it's coordinating between things that are on chain data that's being pinned to the chain or tokens or events that are coming off the chain. And it's also coordinating that with with off chain data as well, whether that's documents that are stored in IPFS, whether that's private messages that are sent directly from node to node, and all kinds of things like that. And I've touched on a couple of different places that the Firefly stores data. It has a, like I've said it has a database that Firefly stores network and chain state in. It also works with a shared storage system right now that the implementation for that out of the box is IPFS, and it also has a private data exchange as well. Firefly has, like I said, a lot of tools with it. Here's another screenshot of the explorer from the dashboard, touched on quite a few of these already the CLI API in the SDK so won't belabor the point but it has a lot of tools and they're really great. They make using it easy. And I think an enjoyable experience for developers. It's all like I said cloud ready modern distributed architecture design. One of the other really cool things about it and it will talk more about plugins here and just a little bit is that it's one of the points I haven't touched on is that it's a very pluggable architecture. Not only is Firefly itself distributed into many microservices. The the orchestration engine has a really robust plugin system that allows the implementation for any of those services to be swapped out so if if you're the out of the box implementation of shared storage is IPFS. But if you have a specific need to use a different shared storage mechanism, maybe it's, you know, Amazon S3 or some other, maybe it's some on premise data storage system that can easily be swapped out via a plugin to the Firefly core to talk to a completely different storage service that sits outside of Firefly core. So it's both a microservice architecture and it's also a very pluggable architecture as well. So a quick comment on kind of the roadmap of what we're working on, and then we'll segue into the work on identity kind of we're working a lot right now on enhanced support for public blockchains, as well as multiple ledgers and blockchain connectors at the same time, and in different usage patterns at the same time so I talked about kind of the gateway and the multi party usage patterns, allowing Firefly to to operate in both of those modes at the same time. In different namespaces with different sets of plugins. And so, so all three of these active development bullet points are very much related so I also commented on that you know there's there's a lot of work going in right now to enhancing Firefly's Web3 gateway capabilities and giving operators more control more granularity of how their, their, their Firefly node interacts with the rest of the blockchain world. Coming up soon, we're working on more samples, more SDKs, and it looks like I had a duplicated bullet point the Web3 gateway was supposed to be on the left side, sorry about that. Also, pluggable API security and pluggable identity management are coming up very soon. And so those are those are things that people are really excited about as well. And so speaking of pluggable identity management, I will end my my little slide where talk here now and I will turn it over to Peter to talk about that topic. That's, that's great. Thanks Nico so let me let me just share my screen. And just to give you a feeling for what Firefly is first hand. So if you stand up Firefly, and I do encourage you to have a look at some of the recent demos and we can send some, some of those, those through afterwards. Maybe what you get in about five minutes when you choose fabric or a private Ethereum chain or maybe even connecting to a remote public chain, you'll, you'll get a stack on your, on your laptop which is running everything you need. It's running all of the Firefly components, which is a micro service architecture part of making it pluggable is allowing different components to be different languages. It's running a bunch, bunch of different, different containers for you, including the blockchain IPFS.  So you get a sandbox, which is sort of an exercise for blockchain constructs. So being able to play with tokens, create or launch your own phone, your own token on your, on your laptop transfer mints, mints and burn tokens, interact with smart contracts of any description on the blockchain itself so you've got some custom fabric chain code you've got a custom to see smart contract being able to generate a rest API for that and interact with it. And, and also Firefly helps you coordinate together the off chain pipes that exist pretty universally across enterprise deployments of a business use case on blockchain, whether they're well organized between the, between the parties as part of a sort of multi party application that everybody's running a copy of, and sort of the off chain pipes are standardized between everybody who's building in that solution, or whether it's much more ad hoc. The reality is that blockchain isn't great for sensitive data, going directly on the chain so you need to coordinate off chain transfer with on chain so that pattern again it's all built into into Firefly. And you'll also find you get an explorer, which, as Nico showed a little bit, gives you a bit of a view into into the system so I suppose that what you've done on on your, on your note that you drill into all the different things that Firefly can do. Obviously, if you are going to be doing things like off chain coordinated transfer of data between different organizations. What that means is you need to know who you're exchanging data with it's just, I don't need to tell this group that that's a reality of life in the blockchain space that a head string and a period address is not great for business to know who they're working with. So, so far fly does come out of the box. When you're using it in the multi party system mode, where you're assuming everybody else is running a fly nothing that's an important point because our flies and technology does not make that to say that assumption that does provide that as an option for you. So just with a sort of built in network map a system of identity just out of the box inside of inside of Firefly. So, just before we started talking I sent, I sent a message that came from another party in the system they need to see who it came from. Then I actually get to see the, the identity that came that that message came in on. So if I open up the message here. We'll see that we represent identity in fire fly using the DAD syntax. And I want to put it that way because we far flies itself, just like with every blockchain technology, not trying to be the full implementation of core blockchain constructs. Firefly is not a DLT. It lets you plug into fabric, Ethereum, even as called a call to support there, connect to all of those remote blockchains that you might be connecting to even things as varied as Bitcoin are connected are you know, fit into the pattern of firefly off chain pipes or maybe you're using, you know, just the open source mutual TLS connectivity peer to peer, maybe you're using a queuing technology like rather than queue or Nats or, or Kafka, or JMS provider but all of that can can plug in. And that was the reason for choosing DID to be the way that we represent an identity of something that you've received. In this particular case, piece of broadcast data that was pinned to the blockchain with the blockchains has action at the hash. All sensible solutions, the data itself didn't go on to the blockchain itself. In this case, the broadcast went into IPFS, but my firefly node is telling me it's done verification, but it's from this author. And what does that actually mean? Well, in this case, it's using the built-in identity system of the Modify system of firefly. And that is the only option today. I think that's a really interesting thing to get to in a minute or so when we sort of have the discussion at the built-in identity system. And so there's a, you know, a DID resolver that we just picked of firefly to say that this is the built-in resolver inside of firefly itself. And if you go to the network map, you'll see that there are these sort of constructs like organizations, nodes, and custom identities, which I don't have any of, which are a simple built-in with a sort of profile way of advertising your identity within the network, which is backed by performing a simple verification using a key. And I don't have an example of it here, but if there was a charlotte identity, like I created a custom identity, but it wouldn't just be the identity you would have had to be the key that you're using yourself to prove that you have ownership of. There would also be a verification by whoever you're saying is the next identity of the tree. So a very simple system, you know, a lot like a PKI system where there are some root identities in the system that are trusted because they just established themselves through sort of a gatekeeper construct, they came on board, and then a claim of verification system to generate multiple identities where you need one transaction on the blockchain from the parent to say they attest to your claim, and you need to claim it yourself and, you know, a pretty simple solution. What really makes this sort of interesting is with a fully pluggable architecture, why not have other resolvers, right? Why not have Firefly in much more sort of in that gateway mode where you're just connecting to ecosystems that exist, where some of the members are getting the acceleration of using a stack of technology like Firefly, other than members, you know, maybe built everything from scratch and really want to use the lowest level technologies. I'm being able to join that community and participate in it using sort of middleware stack that makes it much easier for you to connect to applications and core systems to us. Well, that would mean you'd need to work with whatever the identity system is of that group of participants. So that's why we chose DID. We're not choosing DID because we want to be a self-sovereign identity provider. We're not choosing DID because we want to be an accelerator for solutions, regardless of what technology choices they've made in the blockchain space. So that means that projects where there is a self-sovereign identity system or other identity system involved that's backed by DID, they're going to plug that in and say, don't resolve this inside of Firefly with the multi-party system built in thing. Resolve this using the plugin. And the plugin doesn't need to be, you know, just because maybe Firefly Core is Go, doesn't need to be rewritten in Go. That can be any existing system. If it's got APIs, if it conforms to the standard, it can be plugged in. So I talked quite a bit there, but I really wanted to give that flavor of sort of what it is, but also what it isn't for this community, because I didn't want to give any impression that what we've tried to do is, you know, that there's, I think there's a great synergy with projects like Ares and Indy and software, not a contention with them. This is about an accelerator that helps particularly focus on enterprise projects go faster in Web3. It's not seeking to replace any of the technologies, whether that's the BLT layer or technologies like IPFS and quite a bit of transfer and self-sovereign identity systems.


Lavrov The war between the West and the Russian Federation is no longer hybrid but almost real. What is happening in Ukraine is no longer a hybrid but a real war between the West and Russia. This was stated by Russian Foreign Minister Sergei Lavrov at a press conference following talks with his counterpart from South Africa, Naledi Pandor. According to Lavrov, Western countries have been preparing this war against Russia for a long time. They are trying to destroy everything Russian, including language and culture and forbidding people to speak their native language. The head of the Russian Foreign Ministry once again stressed that Russia does not refuse negotiations, while in Ukraine the negotiation process with the Russian Federation is prohibited at the legislative level. Lavrov also noted that Ukraine should, through intermediaries, explain its vision of the further development of events and possible negotiations with the Russian side. Those who refuse must understand that the longer they refuse negotiations, the more difficult it will be to find a solution, he said. The pressure that the United States is exerting on African countries, it is not only on them but also on Asian, Latin American countries.  Returning and exerting pressure, the United States and the British too are crossing all red lines, Lavrov said.


If working hard is a choice, then not working hard, that's also a choice. And it can't be one that we choose to make very consistently if we want to be the best versions of ourselves and if we wanna make a maximum contribution to everyone and everything around us. We need to make the choice to give the best effort we're capable of as consistently as we're capable of. And when we do that as leaders, then we can expect that of our team. I don't believe you can expect something of your team that you don't expect of yourself. I don't believe you can ask members of your team to do things you're not willing to do yourself. So before you can hold anyone on your team accountable to giving a great effort, you need to make sure that you are doing that to the best of your ability.


Welcome to the International Daily Roundup with People's Dispatch, where we bring you some of the top stories from across the globe. Let's take a look at today's headlines. Colombian movements convene the National People's Assembly as strike continues. Petro Castillo points to win Peru's election as the vote counts near its end. New Zealand's health workers go on strike for fair, pay and safe conditions. Government workers enter fourth week of strike amid police repression in Lesotho and in our video section, we take a look at six years of the Ne'Una Mianos movement against gender-based violence. Colombia's social movements convene the National People's Assembly in the city of Bogota this week. It is composed of workers, Afro-Colombian and indigenous communities and rural peasant movements. Starting June 6, they met for three days to discuss ways to strengthen the ongoing struggle. The Assembly will now present a series of joint proposals, agreements and a mobilization agenda. In the meantime, people have continued to take to the streets as part of the National Strike. Social movements have argued that they have not found proper representation in the National Strike Committee. Negotiations between the committee and the government have been stored since last month. The committee has now called for intensified protests on June 9. This is to pressurize the government to sign the pre-agreement announced in May. People have been demanding guarantees for social protests and an end to police brutality. Meanwhile, the government has responded by deploying the military and increased violence by the police. Rights groups in the past, the Mblores and Pays have recorded 3,798 cases of police violence between April 28 and May 31. At least 41 people have been killed and there have been 25 reported cases of sexual violence. 356 people have also been forcibly disappeared and another 42 people were also killed in 9 massacres across Colombia during this time. The Inter-American Commission on Human Rights has arrived in the country to examine the rights violations. It will be meeting with the National Strike Committee on June 9. Peru's left-wing presidential front-runner Pedro Castillo declared victory on the night of June 8, speaking to supporters in Lima. He asked voters to remain vigilant in the final hours of the election process, while the counting of votes is still underway as of tiny local time, an official result is expected soon. With 99.79% of the votes counted, Castillo from the Free Peru Party has won 50.2% of the votes, meanwhile, power-right candidate Kierkefuri Muri from the Popular Force Party has a vote share of 49.79%. Around 30,000 nurses, midwives and healthcare assistants held a country-wide strike in New Zealand on June 9. The strike took place after the New Zealand nurses' organization rejected a third pay offer made by the district health boards. Nurses and other health workers have been mobilising against low wages and understaffing. Strike notices were first issued on May 14 after nurses rejected two agreements offered in February and March. Most non-urgent and outpatient care services were cancelled on Wednesday as health workers began their eight-hour strike. Nurses were held in places like Auckland, Hamilton City and Dunedin, among other places. Hundreds of people also gathered outside the parliament building following a march in Wellington. Chances of fair pay-safe staffing could be heard. Picket lines were also set up outside hospitals and several areas. The government's latest offer was made on May 27, including a lumped sum payment of $4,000. However, this amount would be a portion of the back pay already owed to the workers through their ongoing pay equity claims. The union also stated that the current pay rise would only amount to 1.38% per year. The hike for midwives would be 1.25%, which is below the annual inflation rate of 1.7%.  According to a December 2020 report by the NZNO 250-hour Safe Staffing Incident took place in Auckland in three months. Negotiations are expected to continue after the strike, however, the government has stated that it will not be able to provide the demanded pay increase, citing pandemic-related constraints. Prime Minister Arden also indicated a possible three-year wage freeze in May. In our next story, we go to Lesotho, where government and textile workers have entered the fourth week on strike. Nearly 95% of the 40,000 workers in the sector have downed their tools since May 14th, organised by a coalition of trade unions that are protesting. The non-renewal of wages for two years, the United Textile Employees Union, has stated that the government has failed to hike wages despite prices rising by around 20%, meanwhile wages have remained stagnant at 150 US dollars per month since 2019. No agreement was issued showing the negotiations in 2020, following which the government decided not to visit any hike at all. As negotiations resumed in February this year, the Employers Association offered a 5% hike, meanwhile workers demanded a 20% increase proportionate to rising prices. However, the government once again decided not to renew wages. Workers held demonstrations in the capital of Maseru and the town of Maputso on May 14th, however, police soon reached the scene and attacked workers with tear gas, rubber bullets and batons. Police opened fire again on May 17th, injuring several workers including one in the eye and another in their knees. The Unite Union reported that one worker was killed after being hit by a truck while being chased by the police. The government informed workers on May 25th that it would invite the ILO to mediate the issue following days of repression and government delays. The government established a committee of five ministers on May 26th, a prime minister also announced that a Gazette Notifying the Wage hike will be issued by June 14th. Workers have stated that they will remain on strike till the notification is published. And for a final story, we take a look at the UNAMENOS movement in Argentina, June 3rd, marked six years since the start of this struggle against homicide and other forms of gender-based violence. The movement has spread across Latin America to include a broad range of interconnected social struggles. Here is the video feature on six years of UNAMENOS. And that is all we have for this episode of the International Daily Roundup. For more such stories and videos, visit our website peoplesdispatch.org, subscribe to our YouTube channel and follow us on Facebook, Twitter and Instagram. Thank you for watching.


Huge win, my friend, over the defending Super Bowl champs. Saints lose, Falcons lose, Caroline loses. Let's get a buck in your vibe check. How we feel? We just need a win, you know, obviously. You know, with the three games skid we had, losing three in a row wasn't a good feeling, wasn't a good testing out. It definitely was a good feeling, you know, to finally get a win and a chance to, you know, the dynamics in the locker room. Changers, that's what you're seeing. Yeah, I'm hearing that and I'm hearing turning point. I'm hearing Tom Brady slamming that table and I just have a weird feeling about this team. That was awesome. That was awesome. How much more meaningful was it coming off a players-only meeting that I hear you were a keynote speaker in? It was real good, you know, kind of makes you feel like your message was received, in a sense.  You know, getting started the way we wanted it to start. But like I always say, man, I got a lot of football left and I got a lot of conferences, guys in the locker room. Yeah, so take me, I've never been in a players-only meeting, but of course, I need to know more about them because everyone says, oh, they had a players meeting, blah, blah, blah. Who decides that you're having one? Is it like an email zoom link or is it like a group text, like, yo, meet me for protein shakes, buy the bleachers, have to practice? Like, how does it go down? Nah, it really just random, you know, just random.  You know, you could talk to everybody, you know, personally, you could talk to everybody all together. And that's what we try to do, man.   It's always good, man. He knows he's a great player. I tell him he's a great player. So you can't let that outside stuff mess with you, man. You know, obviously the message was received, so he definitely wanted people to know that he's still Devin White. Me being 11 years in the league and dealing with a lot of things, got dealt with.  I think I'm doing a pretty good job and I feel like he's taking it really well. You are, you can tell him and the difference from a week from before the Rams game to what we saw against the Rams and I'm sure what we'll see this week and against the Seahawks. You have a lot to do that.  But you, my friend, specifically, you lead. I do even know this. You lead all active players in solo tackles. Did you know that? No, I did not know that. You do. You do with 900, 908 solo. By yourself, you do it alone. Lafonte, David, they do everything linebacker. They're doing it for Tampa. There's someone on your team on offense we can't avoid here in this conversation. He's been doing it for 20 years in this town, Brady. And you've spent like three seasons with him now, I think. What's the one most important lesson that you've learned from him directly or just being around him? Just always being positive. He's a very positive guy. Always encouraging. You know, he's never down. You know, just having that competitive nature. You see the stuff that goes on, you know, on the sidelines, whatever. But after that, you know, he's back positive, back being himself. And it just encourages him to see.  Lafonte. You know, so far so good. There are some Microsoft surfaces, those tablets that would say, Lafonte, my life was lost. I was in the hospital. I know Microsoft said I was in the hospital for three weeks after Tom threw me. But you're saying, are you saying that there's these moments that are incredibly competitive, but they don't matter? People want to say like, he's yelling at people. He's like, it's really not how it's taken by teammate. Right. It's not, it's not taken that way. You know, it's a competitive edge that we all have. Yeah. And you know, when he's getting after with people, you know, shoot, I get after with people too. So I just don't get captured doing it. So it just a competitive thing. You know what I'm saying? Everybody receives it well. And it just a will to win. And that's what he has. Was you and Bobby Wagner drafted in the year, played each other Sunday? I'm looking for footage of the, you know, this is like the perfect Jersey swap depth of scenario. Two studs, two future hall of famers. I was scouring the internet. Did y'all not swap jerseys? We swapped jerseys already when he was in Seattle. So he did that before. But we seem to encourage the messages throughout the year and stuff like that. So Bob is a great deal, man. He definitely got who motivates me. We motivate each other to keep the same goal. Okay. So your next game, let's look ahead here. You're going up against three hops who are fire right now. Speaking of Seattle, it's in Germany. I want to get you set for your trip. And I learned all about Germany. I don't know if you've ever been there before, but I'm going to give you a scenario and you have to pick a teammate that you're going to do that scenario with. Okay. And you can't pick Devon. Okay. I can't pick Devon. Can't pick Devon. You're on this, you're on this long plane ride over. You have to pick your morning teammate to sit next to and control the music. Who are you picking and what are you listening to? I'll probably pick Carleton Davis because we're from the same neighborhood and like we kind of like to sound the same music, Miami music, some of that fast type music. And then we could probably switch it up sometimes. You know, Carleton listens to some old school, he listens to gospel. So we definitely have a similar vibe on the music. I love it. I would pick the first, I would pick Todd Bolst. I think he would not talk. I think he wouldn't listen to music. I think he'd be quiet for a while. Yeah. I love Todd Bolst. He's the best. That's a great pick. Okay. So there's this thing. I don't know if you're familiar. It's called the Audubon. Okay. And it's this, it's crazy. I just found out what I was. So what teammate would you want to drive down the Audubon with? I'll probably go Leonard. Leonard kind of was a fast driver. He's a speed guy sometimes. He'd be pulling out of the facility, going fast and stuff. So I'll probably take the pick limit. We're kind of car, what kind of car y'all driving? What kind of car we driving? Should we drive in a Ferrari? A Ferrari? Yeah. Leonard, Fornet and the Ferrari. That's a good one. Okay. So then we have this thing called October Fest.  Beers on beers on beers on beer. Which teammate would you pick as your beer guzzling partner? Now Tom can throw them down. Listen, listen. I can't just pick one person if you say that.  Go. I go Vita Vale. I go Pato Conner. I go Will Ghoston. I go Jamel Dean. Okay. Levante, have you thought about this before? No, honestly, this is just guys who I've been out with and I know how to get down. Vita Vale flew out your mouth. Yeah, yeah. Vita for sure. He's definitely getting the more. I love that. Okay, Germans are also famous for their food. They've got things like this, okay? It's called Schnitzel.  It's the whole thing, right? They've got sausages. They've got pretzels.  Eat my way. I should. I'll probably go Vita again. Okay, I can see that. Not Tom Brady. Not Tom, no, definitely not Tom. You know, Tom may eat that type of stuff. Okay, last one. This is later hosts and this is with Outfit, right? I'm sure you've seen it before. Which teammate would be most likely to wear this as their fit and pull it off? Their game day fit? No, honestly, I would probably do Pat O'Connor for sure though. Why Pat? Why is Pat getting all his love in this segment? You know, because he's good to Pat. Pat do a lot of dorky stuff. And he would do something. Yeah, he would do something like that for sure. So wait, so tell me for real. Does this team have any vibe of a, I know you don't want to get ahead of yourself, but does it have any sort of feeling for the future? Like you had that year you were in the Super Bowl? Uh, not really. You know, like I said, man, we dug ourselves in the hole. So we're just trying to focus on one game at a time right now. We're not looking ahead. We're just focusing on the right now. We got Seattle, we're about to play, who's been, like you said, on fire. Our greats got some great players. They're doing a lot of great job, you know, as a team. Are you going to be the team that brings this Gino party to an end? Hey, man, we trying to, you know what I'm saying? We want to, and we're going to work at it. Levante, we are such big fans. You are amazing and we are wishing all the best things for you. Thank you so much for making time. No problem, Kate. Thank you. You're going to do it.  Bye.


Welcome, this rockin' audience. I'm Nolan Karpinski, the product lead at Immutable Systems. And for the last year-ish of my life, I've been living and breathing this idea of immutability as a way to secure cloud workloads. Excited to be at Cloud Foundry in particular, because I feel like the idea of immutability in immutable infrastructure is sort of alive and well within these walls. I'll be talking to you about how immutability, known typically as a DevOps concept, can also have a positive influence on security. And I won't use symbiotic or symbiosis because the bells will go off. But there is an opportunity for ops and security to work together and have a shared common goal here with immutability. I'll also be showing you how we have, at Immutable Systems, a new piece of technology that's specifically looking to actively implement this level of immutability that I'm going to be talking about for the security buyer and security people. So let's talk a little bit about immutability and what it means. So we define an immutable system, and the plan words ceases to amaze me, when you write it in written collateral, like Immutable Systems does an immutable system. But it's the fact that systems that cannot be tampered with or modified at runtime. And so that's how we define it. And there's plenty of other ways to define immutability. Someone came up to me at the booth and was like, well, do you mean functional programming and immutability in that context? And I'm like, no, but I'm glad that you know what immutability is. The other way that I think sometimes people think of immutability is immutable data. So once something is written to disk, it's read-only can't be overwritten. And if maybe you do need to overwrite that data, you have a scratch disk or some sort of delta disk that you can revert back to a good known state. And I want to key in on that idea, the good, well-known state. That place in time when you want to begin to say, yes, this is immutable going forward. And for us at Immutable Systems, we define that as the time a system goes into production. So this is really important to define when immutability starts. Because at that point, it's known, it's good, it's blessed. And the issue for forever and ever has been that point in time changes when you have developers and app teams and operations teams on the box in real time trying to care for and maintain long-lived servers over, honestly, years. Because if an ops person gets into that system and starts modifying system files, the known good is now ambiguous. But the exciting piece and exciting for Cloud Foundry as well is that assumption that once a system goes into production, that is a known good state is an assumption we can finally begin to make. The way we deploy infrastructure, especially in cloud environments, and I'll define VMware here because I feel like I have to, as a cloud environment, it's no longer a super long-lived application. You don't have literally enterprise applications that have been up for five, six, seven years, 10 years, running on that same server. We don't have to have huge instances because we're running microservices architectures. And upgrades and updates are happening with infrastructure as code by redeploying containers as opposed to on the box live and saying, hey, I want to update this security patch right now. And so with that, we have sort of an opportunity, and I'm going to get into what this is, but an opportunity to use security knowing that that known good state is when you went to production. So these next few slides are just to prove a point that it's not just a me thing. Other people think this too. And it's typically in a DevOps context. So I ran across this data point, I don't know, a month ago. And it says that 46% of all cloud developers are using immutable architectures. And I think in order to qualify this, you'd have to use immutable architectures as a goal. The idea that you're never going to have your ops team with SSH access into whatever container environment you're using, that is a goal, not necessarily some place that we're at yet. And so that's an important caveat to this assumption around immutable infrastructure that I'm going to get back to when I talk about the solution. Second point here is from the Netflix engineering team, which has been using immutable architectures for years now. There also have been at the forefront of AWS adoption at one point in time. I assume that they still are. We're the biggest users of AWS infrastructure. And so they're saying that modifying instances in production should be highly discouraged to reduce, and important here, configuration drift and ensure repeatability, which of course is actually an operations sort of value proposition, not a security value proposition. But we get even closer here in a Martin Fowler blog, sort of well-known DevOps blog, that he says any change to a running system introduces risk. And in the context of this statement, he's actually using risk as operational risk. Like, oh, what if this has a dependency that I didn't know about? But this is getting really close to that security value proposition that we're talking about. And I define this as sort of the new modern DevOps workflow. And what this really means, if you're using immutable architectures, is that once the system goes into production, we do know that it's known and good, and it shouldn't change. And we have an opportunity now to rethink about how we implement security in this context, when we know that things shouldn't be changing in production. So this is this mutual value proposition. And I want to go through a couple examples of, OK, an operations person is going to say, my executables can't be modified, or no new code can be installed. And why is that a good thing for a security person? So let's think about an attack chain and a threat model here, and let's focus on the sort of toolkit example. So an attacker gets access to a container and can download code to that container and then execute that code. So in that example, you need to do two things. You need to download that code, which means write it somewhere, and then you need to execute that code. And so if we decouple those and never make the possibility of doing those two things at the same time, then we can thwart that kind of attack vector. So if you cannot download code and then execute it, then that threat vector just goes away. So if you have an executable, it can't be modified. If you have a writable directory, you can't execute out of that writable directory. And it's a pretty easy thing to do, but more difficult to implement. Going to get into the next one of these, which is that random scripts can't run, no interactive shells of any kind. That's, again, sort of an immutable architecture value prop. But security likes this, too, because immutable systems working with an education startup right now, where they're so prescriptive about what runs in their container that they have one process per container image. And they know what that is. And if we know what that is, then why should anything else ever be running in that container? And if we have a way to implement no other process besides this one process associated with this container image, that is a security value proposition. Because it means that attackers cannot run additional code on your system. I'll get into this next example a little bit more, because I actually have a demo of a privilege escalation in a recently released February 12th mainline version of the Ubuntu 16.04 OS. But the idea that if privileges can never change, my capability struct can never change, that is a good thing, both from an operational standpoint as well as a security standpoint. Because then you can't do privilege escalations. And then finally, no one can hide in my OS. You can't install additional kernel modules. You can't be updating my kernel live. That is also a good thing, because we know that is how Linux kernel module rootkits insert themselves. So making sure your debug registers are immutable. Making sure your system call table is immutable. Got all that. So security people should just, this should be exactly what you want, right? As long as you have a way to implement this, this should be something that you want. So let's take a look at specifically a Diego cell, specifically Cloud Foundry, implementing this kind of intelligent immutability where you're focusing on core components of the runtime and making sure they don't change is actually really hard. There's sort of three things you need to be able to do as a system that's enforcing immutability. First, it has to be very specific. You need to know this file, this directory, this specific set of privileges, this kind of process. It has to be very specific. It also has to be dynamic. And I'm going to go back to the assumption, the caveat to the assumption that I made, which is that immutability is a goal. However, if you go to an ops person and say, yep, you never get SSH access into any of your systems ever again, they're going to tell you to screw off. And so it has to be able to be dynamic. You can't just lock down a system and never let it change.  And the final piece here is it has to be hardened. And what that really means is that, especially in a Linux OS world where you can get on your Linux box and go into slash lib and just delete everything. And your Linux OS is going to be like, sure, no problem. Happy to totally brick your machine. That's sort of the blessing in the curse of root access as a Linux user is you can do whatever you want. And so in order to implement immutability, we need a way to prevent those kinds of changes. Because any barrier that we throw up that is going to be circumvented by either an ops person or a malicious attacker, those kind of barriers aren't worth putting up. So that's like any agent-based approach really. And so here at Immutable, this is the cool piece of technology that we implemented. It's called MetaVisor. And it is quote unquote super root. And I know that's sort of like a marketing term. But the idea is that it's truly underneath your operating system. It is a very lightweight virtualization layer. There's like a million ways that I could explain this. And like half of you will understand it one way and half you'll understand it another way. So I'm going to try a couple different things. But it's truly outside the operating system.  We're going to look like a Zen hypervisor because we're actually virtualizing your virtual machine. So I'm going to go into a little bit about how we actually deploy that because this can trip some people up. So typical system. A stem cell root disk. So as you know, like that stem cell light, you can just pull down the recent AMI version. Every stem cell you build is just an Amazon AMI, which is just a pointer to a disk snapshot. Some, a lot of bits, right? And typically, you just boot that.  All good to go. It turns into a Diego cell or whatever else needs to. When you're booting a system that has MetaVisor, there's an additional disk on that AMI. The root disk for your stem cell is completely unmodified. I can't stress that enough. Bit for bit, exactly the same. We're not doing anything at all to the root disk. But we're adding an additional disk and putting it at the boot device. So what actually boots first when Bosch is like, OK, go spin up another Diego cell over there. What actually boots first is the MetaVisor runtime. And then it chain boots whatever guest a West that is on top. And then your guest operating system still has its virtual ring three, virtual ring zero. It doesn't necessarily know, actually it doesn't know, that it's being virtualized. But it is. And what this enables us to do is have this super root privilege. And so now, anytime we see file access, anytime we see privilege escalation, anytime we see kernel memory being mapped or unmapped, we're also managing your memory for you, anytime we see privileges being escalated, anytime we see new ports being either connected to or bound to, we not only see that, we also have the ability to say yes or no in a way that even the mandatory access control on your Linux system, I see Linux or AppArmor, can't. So that is MetaVisor. This is how we're actually implementing this idea of immutability. This is the ecosystem of what it looks like. It has a one outbound port that has a management control plane. I talked about the need for this to be dynamic. And you'd be able to flip it on and off really easily. So we have what we call the MetaVisor director that can basically, every 10 seconds, update this. So you can say, yep, OK, Etsy can be written to now. Yes, you can install kernel modules if you really need to do that. But then once you lock it back, it can't be changed. So this has a lot of benefits. I've sort of laid a few of them out. But I want to sort of go over a few of them and then show you a demo of this working live. The demo is, as I sort of mentioned up front, a stock Ubuntu OS being exploited with a kernel vulnerability that was released on February 12. Actually, an exploit that we took from a POC, a public POC, and then modified a little bit. I don't know if there's legal ramifications of that. So there's sort of four Cloud Foundry benefits in specific. The first is you get container-specific visibility and enforcement. So we're still working on this in the lab. But basically what we do is we are listening to the Docker socket on the VM. And with that, we can look at the API calls the Docker daemon is making, and we can associate namespaces with a Docker image. And we're working on being able to do that same thing with Cloud Foundry and potentially even with their new garden implementation. So you get that, you get visibility out of the box. You also get zero-day protection from a lot of things that we can lock down because we know that they're bad. We know that if you have interactive shells being spawned from web processes, that is a bad thing. We know that privileges being escalated, i.e. container escapes, are a bad thing. Your capability structure should simply never change. We know that Linux rootkits and OS level persistence are bad things. You shouldn't be installing additional code. You shouldn't be inserting additional binaries into your operating system. This last, this third point, is actually also really cool. So if you think about it, we're in line with the network traffic. So we have our own network stack. What that means, and this is, again, also in the lab, unfortunately, but we can redirect traffic to third-party appliances. So especially in an east-west configuration, we have a lot of microservices. It's difficult to insert, like, I don't know, a Palo Alto box IPS device in between two microservices. Because you'd have to hairpin every connection. But if you can do that selectively and transparently to the application, you can say, OK, I thought that this virtual machine or this container needed to talk to this container, actually we're going to reroute that through a third-party appliance completely transparently to the application, because we're actually owning the network stack and can basically change header. It also, and this is the fourth sort of really important point, especially for host-level runtime security for a Cloud Foundry environment, they don't play with agents very well. Do not play with agents very well. And so what that means is that it's tough to install things post-deployment. Bosch can sort of do some of this, but the nicer way that we insert, of course, is deploying as part of the AMI that you never have to worry about. Once Bosch does its thing and spins up a new instance, that's the only thing you have to do. You've just added a disk to your AMI, and that's the only insertion mechanism that you need. It's just going to automatically install and deploy. So at this point, I'm going to show you a demo of this working live, and hopefully it goes well. And I have a video if it doesn't. So I have a stock Ubuntu Linux OS, 16.04, and here it is. Start over from scratch. This is always so scary to do live. Oh, it's not showing. Oh, OK. Sorry. Can I just mirror? Sorry, y'all. Now I can't see me, though. Let's just try to mirror real quick. So Linux AMI, connect to it just like a normally would.  But again, completely stock Ubuntu 16.04 from February 12th. So Docker build, Docker run, I'm in the container. But as we all know, the capabilities of a root user as a container are not true host root. So yes, it looks like I'm root, but if I actually print my capabilities, and if I search for the ability to insert kernel modules, I see that I don't have any. So now if I try to insert my kernel module, it's not going to work. Linux says, no, you don't have those capabilities. But I have an exploit here. Again, completely stock Ubuntu 16.04. And I have an exploit here that's capabilities. And what this is going to do is it's going to overwrite the place in memory that has my capability struct. So it spawns a shell. So this is actually a new shell that you're seeing here. And now I have those capabilities. So if I do that same thing ID, it's going to look like I'm root again. But if I print my capabilities, full capabilities. So I'm now a root user truly on the host. And so ends mod, and so if I go to my management control plane, that metavisor director that I was talking about, CF demo, that's great. Well, it worked. And now I'm going to show you it not working. So what I can do here, what this would have shown if I had done it on the right instance, was it would have shown an alert. It would have said, hey, capabilities being exploited. And then what I can do is I can actually, so right now, this is an alert mode. So if I go here, this is my kernel guard actions are all alert modes. So what I can do is I can change everything to prevent. Again, that's going to update in 10 seconds. And I can actually go into that instance again now. This is going to be a different instance. And do the same thing. So 0, 0, 4, 5. I'm not going to screw it up this time. So make sure it got the policies already. See if I go to events. Time stamps right. So I actually spawn a shell there. I had to exit twice. I go here. All right. I'll show you video instead. So here's what it's going to look like. So I'm going to do the exact same thing. This is saying the metavisor always knows. This is what it looks like, capabilities escalation. And then I'm going to go back and do the exact same thing. So I'm going to change this to prevent mode, which means that when I see that escalation, I'm actually going to revert that those capabilities in line. So that container cannot escalate its privilege. And then when I go back and do the exact same thing, once again, I don't have the capability. And I try to run my exploit. It fails. And metavisor is preventing that action in real time. And I don't have the capability to insert a kernel module. And when I see the events here, I actually see that I killed the process when that happened. And I see that as the prevent action. Anyway, that is the demo of the container escalation. And I think the important point to harp on here is, if I go back to my slides and stop sharing, the first point I want to make is the attack agnostic point here. And that is that although I showed this one vulnerability, which is CVE 2017-16995, that is just one vulnerability of many that that immutable privileges protection could stop. So it also stopped Wade ID on day zero. I don't know if you've heard of that one. Timeout Pwn stopped on day zero. There's a bunch of these exploits that have happened over the last year, two years, that this is going to stop on day zero regardless of how that vulnerability works or what that exploit does, because your container simply can't escalate its privilege. That's the same case for any kind of kernel root kit. It doesn't matter what it is. It matters what it does. And so you just can't change your system call table. You can't hook those functions regardless of what the actual root kit is. And there's a lot of things like this that we do. It doesn't matter that you have this specific vulnerability that allowed this one root toolkit to overwrite a binary on your system. We just don't allow that regardless. So it ends up being attack agnostic from the perspective of the vulnerabilities that we stop. Broad coverage, and I want to touch on this point too because the vulnerability that I just showed you was a kernel level vulnerability. There is no other product in the world that I know of that's going to be able to actually stop that. So SE Linux can come close. And the fact that we're protecting from kernel level all the way up to the container is what I would call broad coverage. And then the final thing, and this is just such a cool thing specifically for Cloud Foundry environments, is that it inserts not as an agent, but as part of the AMI itself. So you're deploying security without having to install additional agents or anything else on that host. Once it goes into production, you know that when you deploy things, that is when you're saying, yes, this is known and good, it's in production, therefore it can't change. And that is security through immutability. And I'm working on it every day, trying to make this a thing. So thank you all for listening. Any questions? Yeah. Totally, I mean, basically, if you took what I said in one direction, you could have been like, well, he's running a hypervisor and a hypervisor. So that sounds crazy.  Just for some context, and I'll get into the numbers. We don't do binary translation. We're passing a lot of things through. So from a memory perspective, we're just going to carve out about 500 megabytes at the beginning of the runtime. So when it boots, the guest just cannot access that memory, regardless of how big that instance is. So you do the math on however big your memory is. So memory footprint, not an issue. CPU is going to have some overhead because we're proxying your system calls. So if you run a web server test against us, those systems aren't CPU bound. So you're going to see, honestly, 0 to 5%. If you run a kernel build against us, you're going to see 15 to 30, because that's just hammering system calls the entire time. So mileage may vary, I guess. But I wouldn't tell people today, maybe tomorrow, to run this under a DB server, for instance. A, that's not the kind of attacks that we're really stopping, like we're not a DLP. And most of the vulnerabilities that you see are going to be in the app tier and the web tier. So it's more relevant to us and fits our performance profile better. From a response time perspective, it's like two microseconds. So especially in the cloud with Amazon, that latency is going to be in the noise. Anything else? So we deploy it with a concourse pipeline. So you're going to have a step in there that it's going to send an API call, it gets the latest AMI in whatever region you're at. And what it's going to do is instead of just deploying that directly, it's going to take that, add the disk that I talked about. So it's going to switch out the root disk, insert the publicly available MetaVisor snapshot, and then use that from there on for each of the subsequent jobs within that concourse pipeline. Other than that, Bosch is just going to do its thing. It's not a big deal. So I actually have a demo environment of running this under PCF. And there are certain things that work really well and certain protections that, at least initially, we're still sort of ironing out. Especially trying to quantify every directory, because they have this base OS, and it has to be able to support every container they're ever going to run on this thing. So the number of directories is a lot. We had to put a lot of exceptions in. From the kernel protections and your container can't spawn an interactive shell from a web-facing process, those things are still going to work. There's still some work for us to do to iron this out. But it runs deploys. It does actually work, I can show you. Especially for the kernel stuff, you have to be able to tell an ops person that, don't worry. You don't have to run this in prevent mode. So for most cases, we're actually going to mimic the underlying mandatory access control. So SE Linux, the app is going to appear that SE Linux is doing whatever it's doing. And so there's a cool demo where, as root, you can try to remove RM minus R star in slash lib. And what that's actually going to do is it's going to give you a ton of permission denied, which is the exact same thing that you would get if you ran it as a standard Ubuntu user. So we're actually mimicking the same response. Cool? Thanks, guys. Thank y'all.