Hello, my name is Daisy and I'm from China. I have just completed my 120 hours online course. I think this course is very useful and practical. It reaches my teaching theories and offers me so many useful skills to teach. I think I really enjoy this journey.


So without much ado, Chris Hanlon, everyone. I'm here to talk about Swiss cheese, holes in the foundation of modern security. This has been submitted to CERT under VU-919801. It's basically how I intercepted password reset tokens or requested the tokens, bypassed email encryption, intercepted the tokens, and exfiltrated confidential data for my own test accounts. If anyone wants to try this at home, I don't want you getting arrested, so please do it on your own test accounts. Before I get into the details of the attack, I'd like to cover a little bit about myself of being configuring and protecting desktops and servers since 1998. I've been self-employed as an IT consultant since 2004, and I have a few accepted vulnerabilities. Started with the Linux kernel vomph, then some proprietary software voms, and then a couple Google Apps voms. The second Google Apps vome got me into the Google Security Hall of Fame. The vulnerabilities that we're talking about today were reported to the international computer emergency response team, and there's actually five separate weaknesses involved. They're often referred to as CWEs or common weakness enumerations. Number 287, improper authentication. So the person sending the password reset token doesn't authenticate who's getting it. 291, reliance on an IP address for authentication. Is there anyone here who builds apps? Do any of you rely on IP addresses for authentication? But most of the systems reset passwords are effectively relying on IP addresses to authenticate who they're sending the token to. Missing encryption on sensitive data, in many cases it's both usernames and password reset tokens that are being sent without encryption, and both of those are sensitive. Most people don't want that broadcast over the internet unencrypted. Clear text transmission, I don't know why that's a separate CWE, but they've decided to separate it out, and weak password recovery mechanisms. I would say that sending a password reset token over an unencrypted connection is quite weak. So all of these tie into use of email to reset passwords. RFC3207 is the foundation of modern email security. The first draft was released in 1998, and then it became an official RFC in 2002. It has quite a few options on how the sending server implements TLS. They get to choose how picky they are about sending emails. In many cases, vendors use separate email servers for sending out reset links than their day-to-day email, but none of those seem to be configured. I tested over 30, none of them were configured to require TLS. So this isn't new that email can be intercepted. You've probably been hearing for as long as you can remember not to send credit card information via email, and researchers at Google back in 2015 covered four common ways that could be used to intercept emails. Strip TLS attacks are the most basic. It's a machine en route to the mail server that sends back an error saying, sorry, the server doesn't support encryption. And in every situation that I tested, the server sent the email anyway. They also typically don't check the security certificate. So I used, I tried testing again using the certificate for clonordivorceler.com instead of pandosi.ca. So they have absolutely nothing in common, but it happily delivered the emails to the server with the wrong certificate. The other two are DNS based, and they might look like the same thing. One of them is spoofing an MX record, and the other one's spoofing an A record. The big difference is that often the MX record will be through a different provider than the A record. So if anyone uses Office 365, it's your own name server for your domain that says send it to outlook.office365.com, whereas it's Microsoft's DNS server that says what IP address corresponds to that name. This is a real world problem. It's not just theoretical. Going back to 2014, we saw a US wireless provider where every single TLS connection was having TLS stripped. Similarly, we saw two large ISPs in Thailand around the same time. It's believed that both ISPs were compromised and that someone was primarily using this to steal credentials. That they, because people were connecting to their home SMTP servers, they would send a doesn't support encryption and hope to get the person's password. This is continuing today. We saw earlier this year, the AWS man in the middle attack that hijacked DNS and redirected my Ether wallet to a phishing site. This sold about $20 million of cryptocurrency in about four hours. And one of the other researchers at this conference, Chris Kubekka, her research showed about over 11,000 routers on the internet that were stripping TLS. Some of those were believed to be for espionage purposes, but there's a lot of other reasons why it happens. And that includes over 3,000 routers stripping TLS here in the USA. So one of the major factors that came up in Google's research was that many routers disable encrypted email for the purpose of scanning emails for malicious content. And one of the challenges with that is that a lot of the firewalls that you can use to scan emails, don't warn the users. When you set it up this way, it's going to turn off email encryption and all the email coming into your domain or all of your customers in the case of an ISP is going to end up coming through unencrypted. I believe that, all right, there's Chris Kubekka's work showed evidence of government espionage being a part of it. We see interception of confidential data because many people trust their email to send financial emails. And there's the password reset attacks. I expect that one of the best phishing attacks you could do would be to take a legitimate email and then modify the content to send someone somewhere else. The person is expecting a money transfer from you and you redirect them to a different server that looks just like where they're supposed to go. I haven't seen those in practice, but the weaknesses of how emails being handled definitely leave room for that to happen. So if you wanted to do this, you would need control over a router, a switch, a DNS server, or a mail server out on the internet. You need some kind of tool to intercept the emails. I believe, I'm gonna try adjusting my mic a little. I'm wondering if that, oh, that's worse. It's fine, okay, let's keep going. I think most attackers would probably use scriptable SMTP proxies. Those give them a lot of flexibility. They can pass through some of the emails, but not others. So typically, they'd wanna pass through all your normal emails to your mail server, but they wouldn't wanna pass through the emails where they had requested it and they would use filters in that script to do that. Those tools are quite commonly used by red teamers, the scriptable proxies. So if you know any red teamers, they can probably give you a more detailed look on that one. Another factor is that the term man in the middle can be a little confusing. First of all, it doesn't need to be carried out by a man, but secondly, you don't actually have to be in the middle. If you look over at the graph, the traditional route from Cisco servers that are actually in AWS to the Tuscany hotel where I'm staying goes all the way to Atlanta, then to San Diego, then through Los Angeles and here to Vegas. And most people don't consider Atlanta in the middle of Seattle and Vegas. Fortunately, I'm not running a mail server in the Tuscany hotel, but when you hear about the BGP redirects, like what happened with the Amazon attack, it's basically somewhat a router that successfully sends out a message, send that traffic here through Idaho or Oregon, it's gonna be faster, it's gonna be cheaper, and you'll get there the same way. And sometimes they're able to convince sending servers to send the traffic over a different route, and then that's part of how they do their attacks. So before I set everything up, I did a quick check to make a mail server was working properly. I wanted to make sure that there was valid TLS, had a valid certificate, and then it met modern security standards. If you're wanting to check your servers, you can do the same thing at checktls.com. So my upstream router was a Ubuntu Linux virtual machine running Ubuntu Linux 16.4, long-term stable. Took very little to get it to intercept emails that were passing through to machines after it. We installed Exum with one command, edited the config file, changed three lines in the config file. One of them was to have it run as an internet mail server. Basically means accept incoming email because the default configuration only accepts mail locally. To accept all host names and to listen on all interfaces, which if you were doing any kind of spying, you'd probably wanna listen on all interfaces and accept all host names. We then activate the config file and we use ifconfig to take over the destination IP address and restart Exum. Before I requested any of the password reset links, I checked to make sure that it really was being intercepted and this seems like a dead giveaway that we've got no TLS, no certificate and the vendor could have logged at the time of signup or at the time of a previous email. Hey, this server supports TLS but they still seem to ignore that and keep sending the links. So we got into a lot using this approach. Probably the most interesting one is Cisco Meraki firewalls and switches because once you get into that control panel, you can change their VLAN rules, you can forward ports in from the outside and it greatly expands your attack surface. The next interesting one was Google Nest security cameras. When we got in there, we were able to remotely turn on the microphone. We were also able to download the last 30 days of recordings and the list went on and on and on. Windows desktops now recommend you use a Microsoft account. They make it a little hard to not use a Microsoft account and even once you've set up the account as a local account they'll prompt you over and over again to use these Microsoft accounts. They let you, if you can man in the middle of the email, you can reset the password remotely. Even if the machine's BitLocker encrypted you can then log in whereas most other password reset attacks you can't log in to the machine. You can't use like a bootable password reset if you have BitLocker encrypted. It got worse because the machine started prompting for people to upload their BitLocker key to OneDrive. So even if the machine was totally dead you could remotely download the BitLocker key and then decrypt their volumes. Through that same Microsoft account we got into their Skype message history. We were able to impersonate them and send messages to their contacts, get into their Hotmail, their OneDrive. The same type of approach worked on Dropbox, Amazon Web Services, Oracle Cloud, my own online medical records. So I'd gone to an online medical clinic that referred me out to a specialist. I had someone else set the password and then I reset it. I was able to log in and check my sleep study. For me it's not a big deal. I mean anyone breaks in they can find out that I snore pretty loudly and that I believe it was about 30 times an hour I was struggling to breathe in my sleep which isn't very good but I think you can imagine more sensitive information. Many people if they had an STD or something they wouldn't want that out in public and it's something where there's a history of people being blackmailed over their medical records. So it needs to meet a higher standard. Similarly we were able to get into LogMeIn and the list, oh we got into three major online backup providers and those ones were awesome because once you get into the online backup provider you're able to download their password lists because multiple web browsers and email clients stored the passwords in a place that was being backed up. You download that and then you have a couple options. A, if you're only man in the middle in certain connections to their mail server you can get into all their email and get it even more of their password reset links. The next trick is you get into password reuse attacks. How many other sites are those passwords used on? So there's a guy at Microsoft who came up with the quote, attackers think in graphs, defenders think in lists. And when we look at it, once you are able to reset someone's password you can get into other systems and it just expands and expands and expands. This is a small version of the graph. The graph would fill up the whole room if we looked at how many places you could get in from man in the middle in a single mail server. Then, even more fun. I left the interception server online and when it was online I wasn't expecting this but I kept getting emails from the vendors. So even if you didn't know which domains were on the other side of the router you had broken into you'd start getting these emails telling you about accounts and domains that email was going to. And as those came in, especially if you were using one of those scriptable proxies you would be able to reset those passwords as you found out they existed. We had some fun ones like LinkedIn. LinkedIn encouraged my test account to add me as a contact probably cause we were on the same IP range. Similarly, Adam Bennett works with me. So I'm guessing that's also tied to the IP range and I don't know who the third person is they recommended but it's someone in our area who is in the same industry. A single compromised host shouldn't expose services on hundreds of systems. And that's a big problem right now because it doesn't matter if it's an admin's email account or a router that the client does not control cause most people only control at most one upstream router from them. So there were three services that we can take some inspiration from. They blocked the attacks at least to some extent. Apple right away as soon as you try and reset a password it puts a push notification on the person's phone. If their phone is offline, you can, if the phone's offline and you can't get it back online quickly Apple will give you an option to send you an email at a random time within the next 24 hours. And that approach is popular because it means even if you borrowed someone's phone you couldn't reset their password which is a little bit of a risk. You ask someone, hey can I use your phone to take a picture and if you can keep their phone a little longer you can start getting into their other accounts. Same with a single compromised computer. If someone's desktop is compromised and it accesses an email account that links go to you can request those links and get at them via the computer. Azure had some great approaches. Well, a very simple one. They have mandatory two factor authentication. If you try to reset a password on an account that doesn't have two factor you will have, it just tells you sorry you need a second recovery technique. They don't even tell you contact support you're just out of luck. But they do push very hard for adding that second recovery technique. Gmail had good security questions but only when you were logging in from a new machine on a new network. So at first it looked like it was really easy to get into Gmail but as soon as you go to a different network and a different machine they ask you when you created the account which if you're off by a little it gives you an option to talk to support. But you also have to say the last password you remember. So if, I don't know how many passwords they keep back but I'm thinking it's in the neighborhood of your last 10 passwords. So even it's very hard to reset these ones. There are some dumped passwords so I'd be curious how well people can do it getting past this but it really slows people down and I'd like to see more providers use one or all of these approaches. Now log me in was a really scary one because people think they're setting up two factor authentication that goes to their phone. But down at the bottom if you don't get the email or if you don't get the two factor via the phone you can just click get the code via email which means it's not really two factor authentication it's more a one factor authentication because you can reset the password via email and you can get the token via email.  If you have a bump in the number of password reset attempts it's worth responding to. All resets should have some form of verification question or a second form of authentication and the secure email standard has been out for 17 years. It's time to require TLS especially on sensitive emails like password reset links. That seemed to go a lot faster than I expected. Does anyone have any questions? Yeah. Can you talk a little bit more about how you actually experimented in that portion? I know you said you used to have a virtual host. So I contacted quite a few virtual machine vendors and one of them was willing to configure it so I'd have one router or one server that was upstream from the others. Linux has built-in routing functionality so I just turned that on and there's kind of a switch on the second interface. A virtual switch. So it's just a simulated attack. Yeah. Yeah. Yeah. So Meraki, I'm not aware of any Meraki devices that use iOS. Okay, the Meraki, we got into the Meraki dashboard. At which point you control it through the web. I didn't check, but I got into the dashboard. The dashboard had multiple routers and it multiple switches. Yes, because that's the purpose of the dashboard. What was that? Okay. Are you with Cisco? Okay. Then I'm happy to talk. Are there any other questions? It doesn't look like there's any other questions. Oh, shoot. There was, yep. And it looks like I had my slides a little bit out of order and that's why it was finished a little sooner than I expected. So we've got what you can do to protect yourself. So the EFF, after I submitted they added a option to register your domain with them as one that requires TLS. If you register right now, I don't think it helps all that much, but as more and more vendors start looking to that database they'll be able to see, hey, this is a domain that's supposed to have TLS. Why isn't it getting here? I would say, just like the CIS top 20 talks about inventory in your software, I think it's a good idea to inventory your service providers. Keep track of which ones have confidential information on them and what practices they're using to reset passwords. There's probably a few people here who use single sign-on services where everything ties into their active directory or another service. When you do that, as long as your active directory doesn't support these resets you're making your system a lot more secure. And I don't think, I don't think that's been advertised right now by the vendors that support the single sign-on but I think it's a huge benefit at this time. And if you're requiring two factor, I've even seen some of the physical token two factors that will downgrade to email. So it's really important to know whether both the email and the token or both the password and the token can be accessed via email. I am looking for new projects. I'm open to projects as short as a day or as long as 40 years. Thank you.


the latter the river Arno was at that time low enough to be affordable yet the water reached to the shoulders of the infantrymen and to the saddles of the horsemen on the morning of 10 June 1328 the Florentines commenced the battle by ordering forward a number of cavalry and 10,000 infantry Castrucio, whose plan of action was fixed and who well knew what to do at once attacked the Florentines with 5,000 infantry and 3,000 horsemen not allowing them to issue from the river before he charged them he also sent 1,000 light infantry up the river back and the same number down the Arno the infantry of the Florentines was so much impeded by their arms and the water that they were not able to mount the banks of the river whilst the cavalry had made the passage of the river more difficult for the others by reason of the few who had crossed having broken up the bed of the river and this being deep with mud many of the horses rolled over with their riders and many of them had stuck so fast that they could not move when the Florentine captains saw the difficulties their men were meeting and moved higher up the river hoping to find the river bed less treacherous and the banks more adapted for landing these men were met at the bank by the forces which Castrucio had already sent forward who, being light armed with bucklers and javelins in their hands let fly with tremendous shouts into the faces and bodies of the cavalry the horses alarmed by the noise and the wounds would not move forward and trampled each other in great confusion the fight between the men of Castrucio and those of the enemy who succeeded in crossing were sharp and terrible both sides fought with the utmost desperation and neither would yield the soldiers of Castrucio fought to drive the others back into the river whilst the Florentines strove to get a footing on land in order to make room for the others pressing forward who, if they could but get out of the water would be able to fight and in this obstinate conflict they were urged on by their captains Castrucio shouted to his men that these were the same enemies whom they had before conquered at Serravale whilst the Florentines reproached each other that the many should be overcome by the few at length Castrucio seeing how long the battle had lasted and that both his men and the enemy were utterly exhausted and that both sides had many killed and wounded pushed forward another body of infantry to take up a position at the rear of those who were fighting then commanded these latter to open their ranks as if they intended to retreat and one part of them to turn to the right and another to the left this cleared a space of which the Florentines once took advantage and thus gained possession of a portion of the battlefield but when these tired soldiers found themselves at close quarters with Castrucio's reserves they could not stand against them and at once fell back into the river the cavalry of either side had not as yet gained any decisive advantage over the other because Castrucio, knowing his inferiority in this arm, had commanded his leaders only to stand on the defensive against the attacks of their adversaries as he hoped that when he had overcome the infantry he would be able to make short work of the cavalry this fell out as he had hoped for when he saw the Florentine army driven back across the river he ordered the remainder of his infantry to attack the cavalry of the enemy this they did with Lance and Javelin and joined by their own cavalry fell upon the enemy with the greatest fury and soon put him to flight the Florentine captains having seen the difficulty their cavalry had met with in crossing the river had attempted to make their infantry cross lower down the river in order to attack the flanks of Castrucio's army but here also the banks were steep and already lined by the men of Castrucio and this movement was quite useless thus the Florentines were so completely defeated at all points that scarcely a third of them escaped and Castrucio was again covered with glory many captains were taken prisoners and Carlo, the son of King Roberto with Michela Nyolo, Falcone and Tadio Dele Albici the Florentine commissioners fled to Empoli if the spoils were great the slaughter was infinitely greater as might be expected in such a battle of the Florentines while 20,231 men whilst Castrucio lost 1,570 men but fortune growing envious of the glory of Castrucio took away his life just at the time when she should have preserved it and thus ruined all those plans which for so long a time he had worked to carry into effect and in the successful prosecution of which nothing but death could have stopped him Castrucio was in the thick of the battle the whole of the day and when the end of it came although fatigued and overheated he stood at the gate of Focechio to welcome his men on their return from victory and personally thank them he was also on the watch for any attempt of the enemy to retrieve the fortunes of the day, he being of the opinion that it was the duty of a good general to be the first man in the saddle and the last out of it here Castrucio stood exposed to a wind which often rises at midday in the banks of the Arno and which is often very unhealthy from this he took a chill of which he thought nothing as he was accustomed to such troubles but it was the cause of his death on the following night he was attacked with high fever which increased so rapidly that the doctor saw it must prove fatal Castrucio therefore called Pagola Guinegi to him and addressed him as follows if I could have believed that fortune would have cut me off in the midst of the career which was leading to that glory which all my success is promised I should have laboured less and I should have left thee if a smaller state at least with fewer enemies and perils because I should have been content with the governorships of Luca and Pisa I should neither have subjugated the Pistoyans nor outraged the Florentines with so many injuries but I would have made both these peoples my friends and I should have lived if no longer at least more peacefully and have left a state without a doubt smaller but one more secure and established on a sureer foundation but fortune, who insists upon having the arbitrement of human affairs did not endow me with sufficient judgment to recognise this from the first nor the time to surmount it thou hast heard, for many have told thee and I have never concealed it how I entered the house of thy father whilst yet a boy, a stranger to all those ambitions which every generous soul should feel and how I was brought by him and loved as though I had been born of his blood how under his governance I learned to be valiant and capable of availing myself of all that fortune of which thou hast been witness when thy good father came to die he committed thee and all his possessions to my care and I have brought thee up with that love and increased thy estate with that care which I was bound to show and in order that thou should not only possess the estate which thy father left but also that which my fortune and abilities have gained I have never married so that the love of children should never deflect my mind from that gratitude which I owed to the children of thy father thus I leave the avast estate of which I am well content but I am deeply concerned in as much as I leave it to the unsettled and insecure, thou hast the city of Luca on thy hands which will never rest contented under thy government, thou hast also under whether men are of nature changeable and unreliable, who although they may be sometimes held in subjection yet they will ever disdain to serve under a lucizi Pistoia is also disloyal to thee she being eaten up with factions and deeply incensed against thy family by reason of the wrongs recently inflicted upon them thou hast for neighbours the offended Florentines injured by us in a thousand ways but not utterly destroyed who will hail the news of my death with more delight than they would the acquisition of all Tuscany in the emperor and in the princes of Milan thou canst place no reliance for they are far distant slow and their help is very long incoming therefore thou hast no hope in anything but in thine own abilities and in the memory of my valour and in the prestige which this latest victory has brought thee which as thou knowest how to use it with prudence will assist thee to come to Florentines who as they are suffering under this great defeat should be inclined to listen to thee and whereas I have sought to make them my enemies because I believe that war with them would conduce to my power and glory thou hast every inducement to make friends of them because their alliance will bring the advantages and security it is of the greatest importance in this world that a man should know himself and the measure of his own strength and means and he who knows that he has not a genius for fighting must learn how to govern by the arts of peace and it will be well for thee to rule thy conduct by my council and to learn in this way to enjoy what my life work and dangers have gained and in this thou wilt easily succeed when thou hast learnt to believe that what I have told thee is true and thou wilt be doubly indebted to me in that I have left thee this realm and have taught thee how to keep it after this they came to Castruzio those citizens of Pisa, Pistoia and Luca who had been fighting at his side and whilst recommending Pagolo to them and making them swear obedience to him as a successor he died. He left a happy memory to those who had known him and no prince of those times was ever loved with such devotion as he was. His obsequious was celebrated with every sign of morning and he was buried in San Francesco at Luca. Fortune was not so friendly to Pagolo Guiniti as she had been to Castruzio for he had not the abilities not long after the death of Castruzio Pagolo lost Pisa and then Pistoia and only with difficulty held on to Luca. This latter city continued in the family of Guiniti until the time of the great grandson of Pagolo From what has been related here it will be seen that Castruzio was a man of exceptional abilities not only measured by men of his own time but also by those of an earlier date. In Stature he was above the ordinary height and perfectly proportioned. He was of a gracious presence and he welcomed men with such a vanity that those who spoke with him rarely left him displeased. His hair was inclined to be red and he wore it cut short above the ears and whether it rained or snowed he always went without a hat. He was delightful among friends but terrible to his enemies just to his subjects ready to play force with unfaithful and willing to overcome by fraud those whom he desired to subdue because he was want to say that it was the victory that brought the glory not the methods of achieving it. No one was bolder in facing danger none more prudent in extricating himself. He was accustomed to say that men ought to attempt everything and fear nothing that God is a lover of strong men because one always sees that the weak are chastised by the strong. He was wonderfully sharp or biting though courteous in his answers and as he did not look for any indulgence in this way of speaking from others so he was not angered if others did not show it to him. It has often happened that he has listened quietly when others have spoken sharply to him as on the following occasions. He had caused a ducket to be given for a partridge and was taken to task for doing so by a friend to whom Castruzio had said you would not have given more than a penny. You answered the friend then said Castruzio to him a ducket is much less to me. Having about him a flatterer on whom he had spat to show that he scorned him the flatterer said to him fishermen are willing to let the waters of the sea saturate them in order that they may take a few little fishes and I allow myself to be wetted by spittle that I may catch a whale and this was not only heard by Castruzio with patience but rewarded when told by a priest that it was wicked for him to live so sumptuously Castruzio said if that be a vice then you should not fare so splendidly at the feasts of our saints. Passing through a street he saw a young man as he came out of a house of ill fame blush at being seen by Castruzio and said to him thou should not be ashamed when thou comest out but when thou goest into such places. A friend gave him a very curiously tied knot to undo and was told of all do you think that I wish to untie a thing which gave so much trouble to farsen? Castruzio said to one who professed to be a philosopher you are like the dogs who always run after those who will give them the best to eat and was answered we are rather like the doctors who go to the houses of those who have the greatest need of them. Going by water from peas at a leg horn Castruzio was much disturbed by a dangerous storm that sprang up and was reproached for cowardice by one of those with him who said that he did not fear anything. Castruzio answered that he did not wonder at that since every man valued his soul for what it was worth. Being asked by one what he ought to do to gain estimation he said when thou goest to a banquet take care that thou dost not seat one piece of wood upon another. To a person who was boasting that he had read many things Castruzio said he knows better than to boast of remembering many things. Someone bragged that he could drink much without becoming intoxicated. Castruzio replied an ox does the same. Castruzio was acquainted with a girl with whom he had had intimate relations and being blamed by a friend who told him that it was undignified for him to be taken in by a woman he said she has not taken me in I have taken her. Being also blamed for eating very dainty foods he answered to spend as much as I do and being told that it was true he continued then thou art more avaricious than I am gluttonous. Being invited by Tadeo Bernardi a very rich and splendid citizen of Lucca to supper he went to the house and was shown by Tadeo into a chamber hung with silk and paved with fine stones representing flowers and foliage of the most beautiful coloring. Castruzio gathered some saliva in his mouth and spat it out upon Tadeo and seeing him much disturbed by this said to him I knew not where to spit in order to offend thee less. Being asked how Caesar died he said God willing I will die as he did. Being one night in the house of one of his gentlemen where many ladies were assembled he was reproved by one of his friends for dancing and amusing himself with them more than was usual in one of his station. So he said he who is considered wise by day will not be considered a fool at night. A person came to demand a favor of Castruzio and thinking he was not listening to his plea threw himself on his knees to the ground and being sharply reproved by Castruzio said thou art the reason of my acting thus for thou hast thy ears in thy feet whereupon he obtained double the favor he had asked. Castruzio used to say that the way to hell was an easy one seeing that it was in a downward direction and you travelled blindfolded. Being asked a favor by one who used many superfluous words he said to him when you have another request to make send someone else to make it. Having been wearied by a similar man with a long aeration who wound up by saying perhaps I have fatigued you by speaking so long Castruzio said you have not because I have not listened to a word you said. He used to say of one who had been a beautiful child and who afterwards became a fine man that he was dangerous because he first took the husbands from the wives and now he took the wives from their husbands. To an envious man who laughed he said do you laugh because you are successful or because another is unfortunate? Whilst he was still in the charge of Mesa Francesco Guinegi one of his companions said to him what shall I give you if you will let me give you a blow on the nose.  Castruzio praised greatly those men who intended to take a wife and then did not do so saying that they were like men who said they would go to sea and then refused when the time came he said that it always struck him with surprise that whilst men in buying an earthen or glass vase if it were good yet in choosing a wife they were content with only looking at her he was once asked in what manner he would wish to be buried when he died and answered with the face turned downward for I know when I am gone this country will be turned upside down on being asked if it had ever occurred to him to become a friar in order to save his soul he answered that it had not because it appeared strange to him that Fra Laceroni should go to Paradise to the Inferno he was once asked when should a man eat to preserve his health and replied if a man be rich let him eat when he is hungry if he be poor than when he can seeing one of his gentlemen make a member of his family lace him up he said to him I pray God that you will let him feed you also seeing that someone had written upon his house in Latin the words may God preserve this house from the wicked he said the owner must never go in passing through one of the streets he saw a small house with a very large door and remarked that house will fly through the door he was having a discussion with the ambassador of the king of Naples concerning the property of some banished nobles when a dispute arose between them and the ambassador asked him if he had no fear of the king is this king of yours a bad man or a good one? asked Castruzio and was told that he was a good one whereupon he said why should you suggest that I should be afraid of a good man? I could recount many other stories of his sayings both witty and weighty but I think that the above will be sufficient testimony to his high qualities he lived 44 years and was in every way a prince and as he was surrounded by many evidences of his good fortune so he also desired to have near him some memorials of his bad fortune therefore the manacles with which he lived in prison are to be seen to this day fixed up in the tower of his residence where they were placed by him to testify forever to his days of adversity as in his life he was inferior neither to Philip of Macedon the father of Alexander not a Scipio of Rome so he died in the same year of his age as they did and he was doubtless of excelled both of them had fortune decreed that he should be born not in Luca but in Macedonia or Rome end of the life of Castruccio Castracani of Luca part 2 end of the prince by Nicola Machiavelli translated by William K. Marriott recording by Paul Adams www.jaungei.com


Hey everyone, welcome to our monthly update for our trade results for the month of March. March is in the books, so I wanna take a few minutes to recap all of our closed trades for the month of March. So if you go to our navigationtrading.com slash performance page, this is updated each month and we post all of our trades winners and losers. So in March, we came out a little bit in the red, minus 12.90 on our income trades. We had a couple of little flushes in the market this month that kinda smoked us out of a few trades that are typically very profitable. For example, our Iron Duck, which is one of our most profitable strategies, got smoked out of a couple here. One in Zoom, one in Roku, an Iron Condor in Baidu, weekly double calendar. You can see we did well on a string of Iron Ducks here, plus 660, plus 635, plus 145, plus 125. Took a loss in SPF's weekly double calendar, so you can kinda go through and see. Did take a loss in Netflix on one of our strategies called the Vertigo. And then a couple winners on some weekly double calendars. On RUT, we got smoked out of a couple Iron Ducks when the Russell just really flushed down. And then a couple weekly double calendars, couple of earnings-based trades that were winners. Another Vertigo in SPY that was a winner. So net net on our income trades, minus 12.90 on our day trades. We have three different strategies that we trade. One is the Mighty 90, a little bit in the red for the month on our Mighty 90s. On our pairs trades, actually did the best this month. Booked over $1,600 on 17 pairs trades. Over 70% win rate there, so those continue to do well. Runner strategy, booked a profit of a little over 1,200 on 123 trades. So net net on the month on day trades, $2,380. So net net between our day trades and our income trades, booked a little over $1,000, which is quite a bit less than is normal. But that's gonna happen from time to time, but it was green, nonetheless. So that is our recap. The day trades easily could have been a four, five, $6,000 a month. We actually had a couple of losing days right at the end of March. They kind of brought that P&L down. And really basically due to just a couple trades that were a mishap on my part from a couple of decisions that I made of letting some losers run that did not follow my rule set. So sometimes that happens. You have kind of a brain fart and you have to refocus and get back to the rules that you set that create the profits that we've continued to see. All right, so that's all of our closed trades for the month of March. If you're interested in learning more about joining our community, you can just go to the products page here, this button right at the top of any page on our site. And we've got really a couple different memberships. One is day trading only. So if you're only interested in day trading, we have a membership for that and includes the step-by-step master course for the strategies that we teach. It includes the scripts for the indicators that we put on our charts, our watch list and the most important thing, access to our live stream day trading room. That's just 59 bucks a month. On the pro membership, these are more for our income trades. We have a monthly membership. This includes all 12 strategy courses, step-by-step courses for each strategy. This includes trade alerts that are delivered via text message and email and access to our pro channels in the trade hacker community. So if you wanna just do one or the other, you can do that. If you want access to both, you can get access to both by just paying annually and you save over $1,500 a year and you get access to both the income trades and the alerts as well as all the day trading and access to the live stream room. Let me take a second. I'll show you our community is built on a Discord platform. So it's very easy to navigate. Here's kind of a quick snapshot of what that looks like but we've got a tech support channel. So if you ever have any tech issues or admin issues, you got that and we've got our support team led by Josie in there answering any questions. Each morning in our positions and updates channel, we update all of our positions, the action on that, the expiration date, some notes about what we're doing with that trade. Our navigation alerts that are delivered via text message and email are also put here. So you're gonna get obviously the trade date, whether it's an opening or closing trade, the exact alert filled specifically directly from our broker, which in this case is thinkorswim and then you're gonna get trade comments of exactly what we're doing and why we're doing it. We've got a red updates channel. So this is red is one of our strategies, revised and enhanced double diagonal taught by our resident red strategy director, Tim Weiss. So he posts updates in there each week along with trade alerts when he's actually placing trades in his personal account for that strategy. We've got a whole channel dedicated to chat on that strategy. We've got a channel dedicated to earnings trades, iron ducks, if members have trade ideas, trader chat, we've got a bot room where you can actually look up technical analysis on different companies or you can also look at like institutional ownership. There's a lot of cool things that these bots can provide. We've got a channel all dedicated to the trade hacker mindset, which is a podcast that we just released. And this is all about making sure that you are mentally prepared for trading. And then on the day trading side, we've got a channel that's all about just posting, each day we do a daily recap of our profits. We have other members posting summaries of their profits, it's a great little way to kind of see what everybody's doing. And then just a general day trading chat. And then as we are, I'm live streaming, so I am calling out these trades each morning. We stream live for the first 90 minutes of the market open. So from 8.30 to about 10 a.m. central time. And I'm calling out trades on the live stream, but they're also posted in text format in this day trades channel by one of our team members, Amir. So it's all good stuff. We've got a really growing, great, vibrant community. There's hundreds of traders in here interacting on a daily basis. We'd love to have you join us. So if you wanna check that out, just go to navigationtrading.com forward slash product or click on products at the top of any page. And we look forward to seeing you on the inside. Take care.


Okay, everyone other than us, us being us, me and a few other people, identify as Western civilization with Christianity. And the best current work of our civilization comes from South Korea. I guess he's talking about technology and automobiles and things like that. Isn't it time to switch to human civilization or just civilization? Yeah, civilization is good. The only thing is you want to differentiate it, because there have been lots of civilizations in history. Western civilization does not refer to where that civilization is thriving today. Indeed, in many respects, Western civilization is doing better in Asia than it is in Europe and the United States. It's in decline in Europe and the United States. Western civilization relates, in my view, to ideas, individualism and respect for reason. And as a consequence of that, I respect for markets, so a market economy. So those three aspects, reason, individualism, capitalism or markets, those are the three.  And then I articulate what I mean by that, and often when I talk about Western civilization, I say, well, but that includes anybody who adopts these values. And I know that people associate with Christendom, but in my view, one of the most important battles that those of us who are fighting for civilization must fight and must win is to divorce civilization from Christianity. To show the world that Western civilization, the founding of America, is not a product of Christendom, but a product of the enlightenment, of the enlightenment values, of the enlightenment ideas, of enlightenment thinkers, and that they were primarily dominantly secular and that the key idea of the enlightenment is in its alternative name. The enlightenment is also called the age of reason. So if we're going to fight for civilization, one of the only ways we can do that, one of the only ways we can do that is by separating the idea of Western civilization from Christianity. And I don't believe we should give up on that fight. I think it's an important fight. And I think it's important for the Koreans and for the Japanese and for some of the Chinese and whoever is adopting Western civilization to know what they're adopting. That is to identify the characteristics that they are taking from the West, that they're adopting from the West. Isn't it cultural expropriation? Ooh, I think we should go after the Koreans and the Chinese and all these people for, I mean, it's our culture. Wait a minute, it's ours, right?   But they never talk about it in reverse. They never talk about the values other cultures take from the West, which is the dominant cultural so-called expropriation. But no, so I'm all for keeping Western civilization and identifying it as an 18th century phenomena, as a product of the Enlightenment, as a product that starts with Aquinas and the Renaissance and the Rediscovery. Really, it's roots in Greece and the Greek identification of reason and individualism. That's what makes it so and in teaching that and talking about that. And I think Western civilization is not shortcut for that and we must fight the battle to separate it from the idea of Christianity. All right.


Hello, everyone. Nice crowd. Thanks for being here. So today, we are going to talk about development on OpenSIFT. It's mastering development on OpenSIFT. It's just an introduction to OpenSIFT Developer Console. And for introductions, my name is Rohit Rai. I'm a senior software engineer. I work out of a Bangalore office in India. And I work on OpenSIFT Developer Console. So what's the purpose of this talk? The first of all, introduce Developer Console. Just show up the shiny new thing that we built. Get some patch on the back. So why do we need Developer Console? That's what we are going to find out. Why do we need it? What was the reason that we built it? And try it out. Hands on experience and deploy some applications and check out the experience. So what is Developer Console? Any of you have used OpenSIFT before? It came with Web Console, which had an admin perspective. But being a developer, personally, when I started with OpenSIFT, I was kind of lost in that admin console. Because it had a lot of things which I didn't care about. I usually would like to see experience where it's focused on developer. I would want to get the app deployed and managed and test it out. So that's where I was kind of lost. And that's the reason that we built Developer Console. It's a fresh new perspective on OpenSIFT. So it will sit beside the admin console and introduce developer-focused workflows to the developers. So that's the main goal of Developer Console. So why do we need Developer Console? I just answered that we add this new perspective. And we give this whole new workflow experience for developers, where developers can easily focus on their workflows and don't worry about cluster admins or administration, those things. You don't have to worry about. You just need to deploy the app, test it, and go away with your life. So developer perspective can make a developer productive without even knowing OpenSIFT and Kubernetes. So OpenSIFT and Kubernetes world is really big, huge. You have to understand a lot of things, get the foundations done, then only you can start to get productive. So Developer Console can get you productive in no time and without even knowing or having the deeper knowledge of OpenSIFT and Kubernetes. So what else it does? It enables a developer to focus on the full lifecycle of a app, like deploy it, test it, manage it, and monitor it. It helps you do that. So it seamlessly integrates OpenSIFT and Kubernetes. And also integrates a lot of other projects, like OpenSIFT serverless, OpenSIFT pipelines, and code ready workspaces. It integrates that and gives you a nice experience. So I really like this line. It's copied from one of our PMs. It says use Developer Console to feel home in OpenSIFT and Kubernetes world. So if you feel alienated in Kubernetes world, use Developer Console. You'll feel like home. So what else do we get? What are the features? The first one, I would say, is developer-focused workflows. So we've designed these specific workflows around whatever day-to-day life tasks that our developer does. And we've created experience around that. We've given you the workflows that makes your life easier. And one of the examples would be deploying and testing an application that you have on a GitHub repository. That's the most common one, I would say. So this is just a screenshot from Developer Console. These are the workflows that we get if you use Dev Console. First one would be from Git, wherein you import a GitHub repository, and then you deploy your application and test it. The other one would be you already have a container image built on some Quay or Docker Hub somewhere deployed. And then you import that and deploy on OpenSIFT and test it. The other one would be we have a catalog of resources, catalog of applications, builder images that you can use as a sample, or you can use your own code base and build on top of that. The other one would be Docker file. So you have a Docker file in your GitHub repo, which defines how you need to build your project. How do you deploy that on OpenSIFT? So this workflow is specific to that. Then we have a YAML where you can import any of the Kubernetes native resources, YAML resources, and create your own applications. Then we have a database workflow wherein most common workflow happens wherein you have an application and you want to add a backend service or backend database to it. How do you do that? So you import a database and then you connect those applications. So next feature would be the topology view. What is a topology view? You might have seen topology in other projects, like Kiali has a network topology. So topology is the simple way to visualize, monitor, and manage your applications in OpenSIFT. It's built around the application workloads, not around the network. So you get to see the application data, application health. So this is a screenshot for our topology view. You can see you have a different set of workloads deployed on it. You have different connections showing up. You click on a workload, you get the sidebar open up, and then you get the details of those workloads. Like you can see there are pods, there are builds. You can start a build. You can check the logs of the build. You can see the routes.  Yeah, so one of them would be to take you to the route of the application. One of them shows the build is successful, the green check sign. If the build fails, it shows a red exclamation mark telling you that, OK, your build failed.  OK, what else? So we also integrate OpenSIFT serverless into Dev Console. Just to give you a little introduction about serverless. Using a serverless mode, your application only uses a fixed amount of compute resources. And it can scale up or down based on the number of users that are using your application. So it uses Knative as the foundation. And Knative is a Kubernetes-based platform. And it helps you deploy and manage your serverless workloads. So that's integrated into Developer Console. This would be a screenshot of a workload that has been deployed as a serverless application. So if you see the first one, the Node.js one, it shows that it has a traffic going to 100% to that revision. And the other one has two revisions. The square thingy is denoting the service. And then the round icons, those are the revisions. So you see the other one, they have 50% traffic set to both of these revisions. One of them is black, one of them is blue. So one of them is receiving traffic. The other one is not receiving traffic. So it's terminating the workload. It's terminating the pod. It's getting down. The other one shows just white blank circle. That means that the pod is already scaled down to zero. And there's no traffic to the workload. So you can easily visualize. And you can easily manage your Knative workloads here using topology. And we also have OpenSIFT Pipelines integration.  So it's based on Tecton. Tecton is a community project that defines the building blocks of building your pipeline. So we have integration of developer console with OpenSIFT Pipelines as well. So just to give you a brief introduction of how a pipeline works, there are multiple CRDs, multiple custom resource definitions, defined by OpenSIFT Pipelines operator. And one of them is tasks. So a task basically defines what you want to do in a pipeline. Just one basic simple task. And you define multiple steps in it. It runs in one pod in multiple containers. And you define your pipeline building out of these tasks. So it creates your tasks that does something. And then you say, in what sequence your tasks would be executed, that would define one pipeline. And then your pipeline would be run, and it would create a pipeline run resource. And that has a task run resource. Every pipeline needs some input and some output. For example, it needs a GitHub repo input, and then supposedly it needs an image registry output. So the URL to the image registry, it builds some UI repo, and then it deploys it on the image registry. So those are done by using pipeline resources. You create these resources saying that, OK, this is a Git resource, and your URL is there. You give them, give your pipeline the input. And then it outputs the build pod or build image to your image registry. Then the Tecton controller runs your pipeline, and you get the results. OK, so this is a screen sort of how your pipeline would be visualized on Pipeline's details page. So you would see that, OK, there are two parallel tasks, build API and build UI. And then there are sequential tasks, which needs to be run one after another. And you can check the ML of the pipeline. You can see the parameters. You can see the pipeline runs and see what are the last pipeline runs that was successful or failed, what are the logs. You can check that. OK, so the other thing that we did was we created a new operator called Service Binding Operator. Usually what we do is we create an application. We deploy it on OpenSift, but it needs some kind of operator backed service at the back end. Suppose the most common example is the database. But in order to be useful, in order to use that database in your application, you would need to pull all the secrets, config maps from the database deployment to your own application, add them as environment variables, configure everything manually. And then that becomes very cumbersome. So we created this operator called Service Binding Operator that helps you manage that task. So it automatically takes the secrets, config maps, and it injects into your application. So we have Service Binding Operator, Service Binding Operator available as a community operator. And we have that integration into topology. You can easily use Service Binding Operator through topology. So this is a basic diagram of Service Binding Operator. What it does is you need to create a Service Binding request, which basically defines that, OK, this is the application. That other thing is the database. You need to service bind it. So you need to pull all the secrets and config maps from whatever is available and inject into the application so that your application recognizes it as the operator backed service. But all this seems very confusing again. Like you would need to create this Service Binding request. How is this easy? So what we did, we included this feature into topology where you create your node application and you create your PostgreSQL database. And when you hover upon the workload, you see a blue arrow. You pull that and leave it on the database. It automatically creates Service Binding request. It automatically pulls all the secrets and injects it into your application. And your application starts to create a new part so that it's available. So the next thing we did was we integrated code-ready workspaces into developer console. The next thing that we need to do is we already deployed the application. We already have a database back to it. We already saw how we can write pipelines or how we can create a k-native service. The next thing is how do we edit the code? How do we integrate that with already available online ideas like EclipseJ? So code-ready workspace is the productized version of EclipseJ. And we have the integration into Dev Console wherein you directly get the link to your EclipseJ dashboard or Workspaces dashboard. And on every workload that you create, every application that you import, you get the little icon there. You click on it. It automatically creates a workspace for you in code-ready workspace. You start to edit that, post it to GitHub. Again, your application builds. So it follows the whole lifecycle of your application. OK, so where's the demo? It's demo time. Let's see some of these use cases and live code. So this is a fresh new cluster, 4.3 cluster. Let's log in. Too slow. What do we do? This is just safe. OK. I don't have the code. OK. If you don't have it, I don't have it, so it's me. I have one in my bag, actually. So we are done. Finally. OK, so we are logged in. And this is what we get when we log in to the open set web console, the admin console. But there's an option to change the perspective to developer. I'll just change that. I'll create a new project called defconf. And you get redirected to topology where you see the same ad flows. Like, there's no workload in your namespace. So we see that there's an option to create new workload. It says that there are no workloads. Just go create some. So let's start with import from git. I have a GitHub repo here. It's a Node.js application, crowd application. I'll put the URL here. And it starts to validate. It validated the URL. And then it automatically directs that it's a Node.js project. So it selects the builder image to you. And it says that, OK, this is the recommended builder image. If you want to change it, you can change it. But I want to use a Node.js builder image here. If you want to configure your git config here, wherein you want to define some context directory that you want to build into, you can define that. You can define the git reference, which branch of your repository you need to build out of. And you can create a source secret wherein you would be able to pull a private repository as well. So I just hide that. Then you can change the Node.js version here. I would go ahead with 10. Then this is the application group name. I would say it's NodeAppGroup. And then I would say NodeApp. There you get to select the resources that you can create. The deployment is the native Kubernetes deployment. And deployment config is open safe deployment config. And then there's an option to create a Knative resource as well. But we'll save it for later. And we have some advanced options. There will be a route created for you automatically. And you can configure that route. You can add the hostname and path to it, target both to your route. If you want to secure your route, you can add your certificates as well. You can add some build configs. You can add some environment variables. You can configure your deployment. You can add environment variables and set triggers here. You can set up scaling, how many parts you want. Let's just make it two. Then you can define some resource limits that your application can use. And you can define your own custom labels. So I'll click Create. And we see that this is a workload that has been created. I click on the workload. I see the resources that it's created. You can see that build one is pending. It has started the build. I can see the build logs here. So it's cloning the repo. There are no pods currently, because the build is still in progress. There is a service created. There is a route created for you. But then if I access this route, I won't be able to see the application, because the build has not finished yet. So we'll wait for the build to finish. In the meanwhile, we can see these decorators here. It says build running. This one is for route. This one is for code ready workspaces. While the application is getting built, let's go and check the code ready workspaces dashboard.  Let's open this up. Since we are using self-signed certificates, it's saying that it's not secure. It tells me to log in. Get permissions. Create the user. So the workspace is ready. But there is no workspace created for any of the repos here. It's just the dashboard we can create the workspace. So let's just leave it there. Meanwhile, you can see the build is finished. It's been green. And the pod is getting started. Once the pod is up, we'll be able to see the application. So you can see that the application is ready and it's usable. But then for the database connection, it says not applicable because it needs a database and we've not connected any database yet. So what do we need to do? We go to add. We go to from catalog. Here we see all the applications that we can create from the catalog. And we want an operator backed service. So this is a operator backed database that can be easily bindable to your application. So let's create this application. So the database is created. You go to topology again. And we see that the database is getting created here. What else we can do is we... So this gray thing, this is the application group that I talked about. We created this application group to kind of group all of the applications that are related to each other. For example, if it's a front-end application, if it's a back-end application, it might have a service. It might have a front-end. It might have a back-end database. So you can group all those applications together and you can easily do that. This one is not in any group. So what I'll do is I'll just drag this and drop this into the group and automatically add the labels and it becomes part of this group. So the database is ready. This is ready. Now I want to bind this to the database. So you can see that these blue arrows, I drag this and drop this. It creates this service binding. And now you can see that a new container is getting built because it did something in the background. We'll just check what it did. So we'll go to this and environment variable. Now you can see that there's a secret getting mapped and it's getting injected into the deployment. So this secret contains all the database details. Let's just check what these secrets contains. Let's search for secrets. And you can see that there's a secret that was created and you see database config, DB host, DB name, DB password. All of these came out from the secrets from the database. So who did this? Let's see the service binding request then. And you see this resource getting created. This is the YAML. You see that, okay, we want to bind node app to database and then it says that binding status is success. So it's already successful. Now, if I click on this, it says DB process. So now you have the database connection and you just had to drag and drop one arrow from one application to the database. So it makes you much more productive and easier to use. Okay, so let's go back. Now what we want to do is, now the other part is how do you edit this, application edit some code and then redeploy it. How do we do that? So what we can do is we can set up a GitHub web hook trigger. We go to build config and there's option to copy URL with secret. I'll go to the repo settings, web hooks and web hook. Okay, so we just paste that same URL that we copied from build config. We say that we want this to be a JSON and since it's the cluster that doesn't have proper certificate, that's why we want it to be HTTP, not STTPS because it won't recognize that and it won't send the request. So we say add a web hook and you see this green check mark says that the web hooks addition is successful and it can successfully ping the server that it needs to ping. So now we need to be able to edit the code and then push something to GitHub. It should ideally update your application in topology. So now we click on this decorator. It says edit source code. What it does is it takes you to a URL in code ready workspace which creates a dev file for your repository. If your repository already has a dev file, it takes that and it builds out of that. If not, then it uses a basic dev file wherein you can edit your code and you can use it. So it's starting the workspace. In the meantime, let's go and create a k-native service while it's creating the. So this time I choose deploy image workflow wherein you have a container image already present on Docker Hub or Quay and you pull that and you create your application. So I already have this image on Docker Hub. I added that and pressed enter. It serves that image and it shows the details of that image. So now I want to create another application group called serverless, name would be fine and I want to select k-native service instead of deployment or deployment config. So this defines that you want to create a serverless application and not a normal application. So you see this square box. This defines the k-native service.  Since the pod is starting, it's not showing anything. Once the pod is up, it shows the revision in between. So you see that revision is there and it's still getting created. The pod is getting created. It's still starting the workspace. It takes some time. Okay, so the pod is up. You can see that it shows a URL here. Route for this service, it's still getting up and you see that this arrow says 100%. So this square thing is the k-native service and then this circle thing is k-native revision. So every time you change your service in k-native, it creates another revision and you can manage your traffic to various revisions.  Okay, so the application is up. Let's create another revision for this and see how the traffic splitting works. We go and edit something. I'm just editing a random thing here. Save this and go back to topology. It should be creating another revision here. Yes, so you see there are two revisions now available. Once this revision is up, we can set the traffic. So you can see that there are some labels, namespace, details of your service as well. You have some accents here wherein you can edit application groupings, set traffic distribution, edit labels, edit annotation service or delete the service. So the revision is created. Either we can set it from here, edit traffic distribution or you can right click on this and you see the same accent menu. You click on traffic distribution. So you can see that 100% of the traffic is getting redirected or directed to this particular revision. I want to make it 50-50. I say this old one and this is new. And select this revision, the second one. Click save. So you can see that the pod is getting terminated. The black circle means that pod is getting terminated and it's because we don't have any traffic to the application. So that's why it's scaling down to zero. You can see it's scaled down to zero. You have autoscale to zero, so on here. Now we're good and you see that the pod is getting up. You can also go to a particular revision by clicking on the route icon on that particular revision. It will open up that new revision. So if there are some changes you want to check that out, you want to test that, you can go directly to that particular revision and you can see that the pod is up again. Okay, let's go to the workspace again. Again, the same problem with self-signed certificates. It's stopping this to open up. So let's just open this up and browse it directly. Okay, so we have our workspace ready. You can see all the code files are there. You can edit something. Let's just edit something and post it to GitHub and see if the deployment works correctly. So let's just change the title here from DB to database connection. Save it, add a commit and post this to GitHub. So it needs your username and password. So it's post the code to GitHub. Let's go to GitHub and check if the code has been posted here. You can see there's a new commit just now and if we go back to topology, you would see that the new build is running. So once that build is finished, the new changes that we just pushed. So since we configured the webhook, it triggered this new build and once the build is complete, we can see the new change in the application directly. Okay, while the build is running, let's just check out the pipelines feature, how we integrate pipelines. So right now we don't have the ability to create pipelines directly or have a good UI use or experience to create pipelines but you can create it using the YAMLs. So I have some pipeline YAMLs ready. So this is a task that defines applying some manifest for your application. So I'll click on this. This is import YAML flow which you can also go through this. I add this task, add one more task and finally I add this pipeline. So this pipeline just defines the sequence of tasks. So if you look at it closely, it says tasks and it defines what needs to be run at what sequence like build API needs to be run. Then after that you need to run apply manifest after build API. Then you need to run update API image, things like that. So it's a sequence of tasks. I create this pipeline and you can see the details of this pipeline. You can see what are the steps in your task. These two tasks are going to be run parallelly and then you get these tasks that are running sequentially. You can check these tasks by clicking here as well. YAML of this task is also visible. Now you can click on accents and you can click on start. So we need pipeline resources in order to give the input and give the output. So let's just create those resources and Dev Console lets you create these resources on the fly. So let's add API repo at the URL. It just created a pipeline resource for you. Similarly, we need to provide the output image URL which is the internal open-sift registry. So all the resources, whatever the pipeline needs, whatever input, whatever output it needs, we've already created those pipeline resources. I click start. It takes us to pipeline run. Here we can see the visualization that the first task build API and build UI is running. You can check out the logs by clicking here. You can see two different tasks are running parallely and you can check those logs directly here.  You see that the task is running here. If the task is successful, it shows green. If it fails, it shows red. You can start the run again, start last run, which is basically whatever resources you had earlier in the last run, it would create the resource again. Okay. So let's go to topology again and see if that application has been built again. So now you can see that the change is already there, database connection, Postgres, and whatever change we did in the editor, it automatically sent to GitHub and it automatically built the application for you in open-sift. So I think that's it for the demo. So what's coming next? So we have plans for Helm charts integration, wherein you would be able to create your applications using Helm charts and see all the Helm releases and update and roll out. And then we have interactive pipelines builder. We just created this pipeline using the YAML, but we will be seeing a pipeline builder wherein you will be dragging and dropping some tasks and you will be able to create pipelines easily. Then we'll see network and service mesh data wherein you'll be able to see the traffic data from one application to service or database and then you'll be able to see the application health in the topology. If any application is having some errors, you would be able to easily debug them and check them. Then we'll have improved experience around operator backed services and a lot more features. So thank you. If you have any questions, yes? Yeah, right? Okay. So you can use the same thing. So usually you would have a cluster admin who would create these roles and give it to all the developers. They create these applications, they test them. So it would be in a developer environment or testing environment and then there would be a production environment managed by your cluster admin or your SRE team or whoever and they will manage those applications. So it's basically, it lets you create these applications and test it easily and then push it out to production before actually pushing it out to production. Yeah, yeah. So right now we don't have that capability wherein you create and deploy a set of applications and then you directly import those configs and it would be deployed on production. Yeah, it's not there but we might have some plans later on. It's just a very new project. We started with this in 4.2. The first release of developer console came with open set 4.2. We are still learning and we are still adapting to developers' needs and what needs to be added as a feature. So we might have something like that in future. From, sorry? From a pull request. Yeah, so you can create custom pipelines and you can watch for your web book triggers and based on that you can build your pipeline whenever the pull request comes. So while creating the web hook, you can say that, okay, just ping me when a new pull request comes in and when that comes in, you would create a custom pipeline which would pull the code from that particular pull request and then build it up and then deploy it so that anyone can test it. And we've actually done this previously in our testing environment wherein we were using some other repo which we needed to test with open-sift console repos. So what we did was we created similar CI pipeline wherein you create a pull request and that bot would create a new deployment on open-sift and give the URL to your pull request as a comment. So any reviewer can come and click on that and easily test that UI or your application. That's like a pipeline you guys built that's not native to this. Yeah. It'd be really cool if it was. We have plans for adding pipeline templates to a pipeline operator. Pipeline team is working on that and we already have integration into Dev Console while you're creating your application while importing from Git. You might have seen a pipeline section but with exclamation marks saying that there's no pipeline template for your runtime. So later on when the pipeline operator team adds those templates, you'd be able to use those templates easily and create that. So that's the plan. We'll have those templates which would do something extra from what build config and deployment config does for you. So similar thing. Yeah. Okay. Yeah. So we have a team working on GitHub Spark wherein it would make it easier for you to do GitOps using Dev Console and open-sift in general. But right now we don't have that capability but yeah, it's coming. It's a very new project. We are still a very kind of a newborn child. So we'll grow. I think my summit... Yes, so for serverless, the same triggers are available. Whatever you saw, like web hook trigger or image change trigger or service change trigger. So whenever a service changes, it creates a new revision or whenever your code changes, you can set up those web hook triggers and then you can easily integrate that. Yeah? App group concept. Right. Is it implemented via labels or is it actually a resource? Yes, it's implemented via labels. So you see that same thing in Odo as well. Via the CLI, it creates this application group concept wherein it uses labels to manage those. Yeah? Okay. Thank you. Great audience.