Live from Anaheim, California, it's theCUBE, covering Nutanix.next 2019, brought to you by Nutanix. Welcome back, everyone, to theCUBE's live coverage of Nutanix Next here in Anaheim, California. I'm your host, Rebecca Knight, along with my co-host, John Furrier. We're joined by Faramaz Madavi. He is the Senior IT Group Director, Cadence Design Systems. Thank you so much for coming on theCUBE. My pleasure, nice to meet you. So tell our viewers a little bit about Cadence, based in San Jose, tell our viewers a little bit about your company, Cadence Design Systems. So Cadence has been a company in the area since about 30 years ago. So we make software to enable semiconductor companies to design, test, and build chips. So most technology that you see in Fries Electronics, it has some Cadence solution in it. So you guys have a lot of legacy in your IT. Talk about the Nutanix relationship. So our journey with Nutanix started about three years ago. I had actually explored Nutanix at a previous company. I've been with Cadence three and a half years. So I liked it, but there was really no opportunity to do much at that time. The company was very new at the time. But at Cadence, we identified some opportunities to explore Nutanix, and it's been a great experience so far. We actually are running a lot of our critical business applications on Nutanix, so we're all in. What was the door opener for you guys there at Cadence? What got them in? The overall architecture looked good in a presentation level. So it was worth exploring. But it's a new company, new architecture. You have to kind of go into it carefully. So it was a matter of identifying opportunities that were maybe not production, not super business critical to start. But as time goes on, you build confidence and you do more and more. So today we're using Nutanix, as I said, for business applications. We're using it for VDI. A lot of our Zen desktop instances are running on Nutanix today. We use it as what we call tier zero. So a lot of our shared services, you know, DNS, Active Directory, those sorts of services are running on Nutanix. So we're looking for more and more opportunities to expand it. So I always like to know how this actually helps you and your company, people do their jobs better, more quickly, more efficiently, more productively. Can you sort of walk us through what life was like before Nutanix and what life is like now in terms of the staffing and the overhead and the support?  One is we're in a cloud era, right? So a lot of companies are looking for workloads to move to the public cloud and we're no different. We're constantly looking for what makes sense in the public cloud, what makes sense on-prem. So from a support and skill set standpoint, it's very important to be consistent. Basically have the same support model for both on-prem as well as public cloud. So that's one big benefit that Nutanix offers because the same skill sets to support, let's say, AWS environment is the same as, you know, the Nutanix support environment. The other critical thing is just like any IT organization we're challenged with limited resources, you know, doing more with less. So the ease of administration, ease of support, just the inherent reliability of the technology allows our staff to, you know, sleep more at nights and, you know, work less often during the weekend. So the overall support overhead has reduced significantly.  Those are two very important things. Those are the two biggest things that we went into this, this engagement with. But, you know, we are pleasantly surprised that performance has exceeded our expectations.  I didn't quite expect this level of performance improvement. So that's been excellent. So again, we're looking for more and more opportunities to expand it just given that experience. You said the staff sleeps well at night. How have they reacted? What are some other anecdotes from the staff? Freed more free time? Is it management, playing? What's the, what was some of the feedback from your team? Well, I mean, I don't want to give the wrong impression. It's not like they're not working yet. Yeah, that's not quite the scenario. But, you know, I would say it's gone from a crazy environment to something a little bit more humane. So, I think not only with the staff but just across the company, you have those who are who kind of buy in and go into it positively and others who are more reluctant. And that's no different with the support staff. So I think just their own confidence level and, you know, their desire to do more with Nutanix as increased as they've had more experience with it. It's interesting, I did a panel yesterday with some customers from Nutanix and Mr. Mix, a big bank, mid-sized company and a good big corporate kind of IT. And it's very interesting. The legacy, where there was more legacy, there was a lot of these dependencies and they were looking at time frames for pushing stuff out like eight weeks to two months. I mean, two hours. So they went from eight weeks to pushing any kind of rule propagation or any kind of new stuff, eight weeks to two hours. And that was a huge number. Are you guys seeing anything around in terms of performance on the time side with Nutanix? What are some of the things that you're getting benefits-wise, operationally? Well, the more we do, the more cookie cutter it becomes. So each migration is easier and faster and so on. And that also has to do with confidence, right? The very first critical business application that we moved to Nutanix, the level of testing we did was insane. Now it's less so. For multiple reasons, that migration experience is much more efficient, much, much quicker today than it was early on.  You mentioned new company. They're 10 years old, so still new relative to the bigger guys. Getting it pushed, getting it through, getting it approved by executive confidence from the executive management around, wait, what's this new company? What's the benefits? All kinds of gyrations of approvals and sometimes politics and legacy kind of factors in. How does that work on your end? How did that go? Getting Nutanix through? Was it a struggle? Was it a challenge? Well, take us through that. So as you mentioned, the fact that it's new technology, new company, that has its own set of challenges from some application owners and executives. You know, why take the risk? Why not do the same thing we've done, you know, always. So that's one big challenge. The other was there is a tendency, especially early on when Nutanix was selling it as an appliance as opposed to license only. There is a tendency to view it as a hardware solution and it's exactly not that. It's the exact opposite of that. It's purely a software solution. That's where the value is. So it's very easy to get trapped into that hardware discussion where people will kind of compare with servers and storage versus Nutanix. So you have to kind of change that mindset and show the real value that hyperconvergence provides. The ease of administration, the high performance, reliability and so on. And then as you make that argument and convince more and more people, again, you have to start small and expand. But that was some of the main challenges, I would say. When you're talking about the migration experience and you said when the first business critical application, it was a long time we tested it. We really worked at it now. We have a bit more faith that it's going to work out. But can you talk about some best practices that emerged in terms of how to migrate and migrate well that maybe other companies could learn from Cadence Design Systems? Well, I would say the best practices aren't unique to Nutanix. Any migration process has various phases in terms of planning, testing and so on. And I think just having that discipline, a well-documented, consistent process so that you're not starting fresh every time there's a new migration initiative going on. But I think Nutanix makes it easier just given the, especially the Prism Management tool. But I would say it's not particularly unique to Nutanix. IT organizations just need to be well disciplined in the migration process. One of the things that you mentioned, software, which is a great point, that cultural shift, it's not a hardware box and there's probably all the best practices around evaluating hardware. Software is becoming more and more central to IT. How do you see IT evolving? Because you've got cloud right on the horizon, you've got public cloud, benefits there are clear. If you have green field, you have legacy stuff, you've got containers, containerization happening as a trend. Lift and shift versus evolve the life cycle management of apps and workloads are now under a new kind of view with software. How is IT changing as a practitioner in the field? How do you look at the evolution of how IT's going to change? So my side of the house is the infrastructure and operations side and they tend to be historically kind of manuals. Different network administrators, storage administrators, system administrators, that is all changing and all becoming more developer skillsets, scripting, automation, things of that sort. So I think that's the biggest change that's going on in IT today is kind of changing the skillsets and kind of viewing it as a full stack as opposed to just storage or just network. So having that holistic viewpoint, having that ability to develop automation that works across the stack, I think that those are the changes that traditional infrastructure groups need to adapt to. I was talking to a customer yesterday and he was a young guy, I think he was in his late 20s and I'm saying to myself, you know, 10 years ago he was in high school or college and so you see a new generation coming up where they gravitate towards DevOps. Right. And so they get that, so they don't have that dogma that, whoa, we went with this vendor so they kind of have this new thing. Any observations that you can share on this younger generation coming into IT or new talent that's coming in, that's developer oriented? What do they like? What's the work style? What do they gravitate to? What are some of the tools they like? What's the mindset? So I think they can teach us to be honest. We have, you know, the older folks like myself have a tendency to look at the way things have always been done, right? So having that fresh viewpoint is great to kind of come into it with a DevOps mentality, you know, off the jump. I think we should kind of welcome that and take advantage of that. You know, for Cadence in general, we are a pretty mature company in terms of our personnel. We don't have that rapid turnover of our team members. So we're trying to actually, you know, we welcome that new talent so that we can kind of get that DevOps mentality in-house and kind of mature it ourselves. So we're in the beginning of that journey. How do you work together? Because I mean, you're not that old, first of all. But this is the time where we have multiple generations together working in the workforce, these digital natives that we were talking about and the people who get technology so innately that grew up with it versus the Gen Xers, the Boomers are still there, the Gen Ys that are emerging and graduating now. How is it a challenge at Cadence to get all these people working collaboratively, productively together? Well, Cadence is an extremely technical company.  So it's a very technical environment. We try not to really focus on the technology actually, but to look at, you know, the business objectives. You know, what are we trying to achieve? What problems are we trying to solve as opposed to, oh, here's a cool technology, how can we use it? You know, the mindset is a little bit different. We're looking at the business side first and then using technology to solve for those problems. So once you have that focus, regardless of your experience, your age, your background, you work together, you know, to achieve that end goal. What do you think about the show? We're here at Nutanix next to Anaheim. What's your verdict on so far, the content, the positioning, your customer? What's next for you guys? Yeah. I see a very loyal customer base on what we've found. People love the product. What's next? What do you think of the show? I'm very impressed. I wasn't expecting it to be this large. You know, I went to a local smaller version that was in the Bay Area last year. That was pretty impressive too, but this is amazing.  So the tendency is to ignore those. This kind of gives us a chance to, at our own pace, kind of see who the key partners are up to Nutanix, look for opportunities and meet some of these other vendors. So it's been both educational as well as kind of entertaining, you know. Excellent. Well, thank you so much, Farmers, for coming on theCUBE. We really appreciate it. My pleasure. Good to meet you guys. Thank you. I'm Rebecca Knight for John Furrier. We will have much more of Nutanix next here in Anaheim coming up in just a little bit.


Hi everyone, Joe for jaspyscasebreaks.com coming at you with 2020 panini immaculate football number block randomizer the break itself will be in a separate video Dolphins bangles Packers are the R&B Our random number block. That's what that means. If you're not familiar with it check out the details right there Pretty much a serial number break just for those teams just for pick your team ten big. Thanks to these folks for getting into it They're the numbers right there. Let's roll it. Let's randomize it four and a three seven times for each list one two three four five six and Seventh and final time after seven we got David Nice down to a couple Townsend's right there four and a three seven times for the numbers one two three Good luck seventh and final time after seven. We've got four down to one. Now remember per the description Zero gets any and all redemptions for those three teams in that tab right there on the bottom of your screen Including one-of-one redemptions, but number one will still get any live ones one of ones David with four Jason with five Seth with six Adam with three Paul with eight James with zero Stanley with seven Daniel with two Paul with nine and one Let's order these numerically right here and coming up in a separate video will be the break itself Jasper's case breaks calm


All right folks, I guess we're gonna go ahead and get started then Thank you very much for coming out to our presentation this morning extending barbican managing secrets in a venture way Let's go ahead and start off with Kind of an introduction of our presenters today starting with My name is Audi Lee My name is Audi Lee, I'm the project lead for the dog tag certificate system, which is the upstream version of the Red Hat certificate system Dog tag has the ability to store secrets and issue certificates, which is exactly what barbican does Us working together. It was a perfect perfect fit I've been working with the barbican group for about a year or so now one of the barbican course and working mostly with working with the upgrade with the Plug-in framework, which we're going to talk about today And the certificate flows Right. I'm Nate Reller Yeah, I'm Nate Reller. I'm not Joe. Joe's here somewhere So I'm Nate Reller. I'm from APL. That's the Johns Hopkins University applied physics laboratory If you're not into that whole brevity thing So APL is a research organization We're what's called the University Affiliated Research Center. We have research in many different areas We have two spacecrafts that are mapping out the Sun. We have another on the way to Pluto a little closer to home We have Prosthetic limb research as well as cyber security and that's my group In particular my team is working on OpenStack and our goal is simple We just want to improve the security of OpenStack So we've been involved with OpenStack for over two years now a couple of features You might be familiar with are the cinder volume encryption We added that in Havana as well as the ephemeral encryption And of course if you have encryption you need secure key management. So that's what brought us together With Barbara Kim All right, so I'm Paul Kerr and I do a cryptography work for rex space and I'm actually operating on about One hour of sleep in the last 27 so I'm going to be mostly watching from the audience But I worked a lot on the pkcs11 plug-in that they'll be talking about here and in general I've been done a lot of work on the plug-in infrastructure So if you want to hear me ramble incoherently after the talk you're welcome to come and ask me questions Thank you Paul. Yeah, I'll do my best to go through his slides, but if I say anything wrong He can bump me over the head So my name is John Wood. I'm also with rex space and So my history on the project is I was the first I guess Developer on the project After after Jarrett so Jarrett rain had this idea and I'm you know, maybe a year or two before I started on the project And once he finally was able to form a team with Andrew Hartnett They they brought me on to try to set up the project get it off the ground And the idea was to try to get something ready in front of the Portland conference So we're talking, you know, almost two years ago next year And try to get something more people could evaluate the API and all that on there on their local machines And then I would say, you know probably around that time is when Douglas Mendeza ball came on board the PTL of Barbican And so it's been growing ever since so if they're if you don't like the structure of the project Please see me for complaints, you know Otherwise, I'd say let's go ahead and start on our presentation today So what is Barbican?  It is also an open-stack compliant secrets management service I'm gonna try this this cool thing out here. There is some Integration underway. This is just some of the integration work that's going on We also have scheduled tomorrow a design summit session Where we invite people that are interested to integrate with Barbican to come I'll show a slide at the very end of the presentation with all the schedule for those presentations And finally, there's a plug-in approach that we use to extend features of Barbican Which is obviously going to be the focus of the presentation this morning So big picture view just to give people an idea of what we're talking about here We have clients that wish to use Barbican Those could be other open-stack projects or just clients in general wishing to store and retrieve secrets out of Barbican We have Keystone for for authentication and authorization And then Barbican core will be referring all throughout the presentation to Barbican core and that's that's the API front end of Barbican, that's the the business logic of Barbican if you will Everything that's not plug-ins and so there's a certain amount of feature set then that we we want the plug-ins to deliver And so Barbican core will work with those plug-ins through a contract, which we'll be describing To to make those things happen And so then you have your basic plug-in you have a variety of implementations that are available once you have a plug-in contract in place And once you have that that interaction going Then you can start to use Barbican in your system so you can have clients working with Keystone to get their tokens Then they can make their arrest calls to Barbican Barbican core will then Work with Keystone to verify that token and collect the the role information applied against the policy and if all that Passes the Barbican can work with that plug-in to do its thing plug-in can do whatever is required behind that interface It responds with with its result and Barbican can respond back to the client And so once you have that interaction in place what you have that contract to find well Then you can start making other plug-ins that fit into that same contract so more plug-ins more better that's kind of the approach and so if you start looking at a contract is basically just a an abstract method or abstract class that is with abstract methods that Plug-in implementations would extend And so configuration we're using Steve door to to to pull those plugins in and use them and You can see a basic configuration would have namespace and a actual implementation class defined And that's how these things are looked up within the code So when you have a plug-in installed and you and you're ready to use it you can configure its behavior by Presenting in the Barbican config file a group of configuration Specific for that plug-in so every plug-in can have its own group of Configuration items within that config file and the idea being you can use chef or some other configuration management to To actually supply things like passwords out of encrypted data bags and so forth And so this is kind of the the landscape of the plug-ins so far for for for Barbican and So just briefly on the left hand side. We have the secret store interface, which is our basic secret storage and retrieval mechanism within Barbican Within that a subset of that secret store is HSM style plug-ins or crypto plug-ins we call them in the code base and these are Plug-ins that specialize in encryption and decryption of secrets, but they don't they don't themselves store those secrets So Barbican core stores the encrypted secret on on those those plug-ins behalf Then we have what we call certificate or see you know certificate plug-ins that work with CAs typically they don't have to but the idea there is Barbican core and those plug-ins work together to to so drive certificate generation workflows and finally we'll touch on the eventing plug-in structure that we're trying to get Working within Barbican. There's some early work on that So with that I'll hand this over to Nate to talk about the secret store plug-ins Cool. All right, so I'm gonna talk about the secret store plug-ins within Barbican What's cool about the secret store plug-in is this is what you can use to configure how you want your secrets to be managed by Barbican So for example, some of you may have requirements for how your secrets need to be stored So for example Some people have requirements that their encryption keys need to be created and stored on a FIPS compliant device That's tamper proof and has some auditing capabilities So if that's the case and your device is came up compliant You can configure Barbican to talk to that device using the came up secret store If it's not came up compliant We have a couple other secret stores that may work for you and if those don't work you can always write your own and I have a couple slides at the end that show how easy it is to do that So now I'm gonna give you a little bit more context for the secret stores show how they fit in with Barbican itself and then within Open stack in general So as John mentioned earlier, there's Barbican core What that provides is the restful API in the access control for all your secrets and the API for Barbican core has the basic methods for secrets So creating reading updating and deleting secrets and if you look at the interface for the secret store It's very similar has create read update and delete methods for secrets The big difference is the Barbican core Takes in the keystone token and and it needs that for the access control So the basic relationship here is Barbican core receives it does the access control and then delegates that method off to some secret store So we'll go ahead and look at an example to show the sequence of events for how this would work So we'll use the center volume encryption feature for that So we'll start off on the top left up there with Nova. That's the client so with the center volume encryption What Nova needs to do is it needs to get the encryption key for the center volume? so what it does is it talks to the key manager interface that's an interface that's within Nova and We have a patch out there for a Barbican Implementation of that key manager interface So if you like that patch, please give us a plus one But hopefully that should be in soon and what will happen is Nova will make a request to Barbican and say please give me this particular key so I can do the encryption At that point Barbican core receives that request. It does the access control checks Using keystone if everything goes goes well, and it's authorized to use that key It then calls a secret store and so secret store. Please give me this key At that point the secret store then does whatever it needs to do to retrieve that key in the case of the came Up secret store what it does is it actually makes a call out to an external came up server That came up server will return the key to the secret store secret store passes it back up to came up core Came our sorry Barbican core and then Barbican core passes it back to Nova at that point Nova has the key and then they can set up DM crypt and set up the encrypted center volume So we created the secret store interface in the Juno release and we also created some implementations of it So there's the hardware security module. This is the Barbican HSM secret store So John is going to talk about this one next. So I'm not going to go into too much there There is the came up secret store, which is the key management interoperability protocol That's an OASIS standard for talking to key management devices And the third one that we have is the dog tag secret stores So this is the one that a day developed and this talks to a dog tag server So this slide here just this lists the methods that are required for a secret store implementation So I'll go over these real quick just to give you an idea of what needs to be there There are two supports methods So what happens when Barbican core receives a request the first thing it needs to do is make sure that the Secret store can satisfy that request. So there are a couple supports methods there for that So it just basically checks. Hey, can you generate a AES-256 key for me or can you generate asymmetric keys for me? So it does that check first just to make sure that it can satisfy the request There's store secret. So if you have an existing key that you want to store it would call this There's get secret then we have a couple of generate methods. So generate symmetric key and generate asymmetric key So sometimes the user just wants you to create that key for them. That's what these methods are for and Then we also have get transport key This one I'm not going to go into too much detail. I think Audi may touch on it briefly But essentially what this does is this allows the client in our previous example That was Nova you can wrap the key between the client and the external server if you like This way Barbican cannot see that your secret while it's in transit through it So now I'm going to have two slides on secret stores and actually how you would go about implementing a secret store if you would like So I envision most secret stores Are going to be Adapters so they're going to call out to some external piece of hardware for the storage of their keys So this is how the came up and the dog tags secret stores actually work so essentially all you're doing is Wrapping the interface that is provided by your back-end device to what is provided by the the secret store interface So if we take a look at the table here, this shows the secret store method and the corresponding came up method So you can see how they map nicely together. So generate symmetric key calls create in the came up method Similar for asymmetric key and create key pair and so on and so forth so if you look through the code for They came up and the dog tag secret store All as you do is you get the request you have the Barbican objects You then translate those to your back-end device objects You open a socket send the message request across and then you wait for the result so the result the result is The only part that may be a little unexpected So if you notice for each time each of the methods that generates a new key This will be like generate symmetric generate asymmetric and store key the return value of that is what we call a secret metadata and This is just a dictionary. It can contain whatever you like in most cases What it will be is it will actually contain the ID that is from the External device that's storing your keys So essentially what you're doing is you're creating a mapping from the Barbican ID to your back-end appliance ID And then that metadata is then passed to subsequent calls to Retrieve update or delete that key So here you can see this is actually the return value for the came up secret store when you generate a symmetric key And then when you call get key for example or delete key, this is passed in You look through the dictionary make sure the UU ID is there and that's what the the UU ID you would pass to the came up device So that's all I have for the secret store, so I'll hand it over Thank you Nate So the next Next plug-in that we were gonna focus on was the HSM style and again I'm speaking on behalf of Paul who has very little sleep in the last day or so So like I said, if I if I say something wrong Feel free to throw something at me rotten tomatoes or whatever. I know you have some in that back back there, so Let's see so an overview So as I mentioned before the HSM plug-in Performs encryption decryption. It can also generate secrets, but it doesn't actually store the secret information So it uses a key encryption keys or keks that we'll call You know that we'll use that acronym all throughout the rest of the presentation Uses those keks to actually encrypt those secrets and so Barbican stores that information in its own database And then as as Nate mentioned there is a adapter plug-in to adapt the secret store plug-ins to the HSM style plug-ins And the actual implementation we have available now with the code base is a pkcs 11 based interface using that protocol and it's talking to a safe net HSM, but You know you could be wouldn't take much trouble to get a pkcs 11 based HSM to work with that I Will note that throughout the rest of the presentation as well. We're using p11 is the shorthand for that In fact, if you look at the code base will see p11 Referring to that There is a team also working on our HP etolic HSM interface So the contract for HSM plug-ins then starts with the crypto plug-in base abstract class and There's the familiar supports method to determine which plug-in to actually use There's a bind kek metadata method that we'll go into on the next slide more detail But the idea is that each project has its own key encryption key And this is an opportunity for the plug-in to establish that key and whatever mechanism that it needs to do And we'll show the p11 example in a second Encrypt and decrypt, you know your basic operations for HSM You would expect those to be on there and then to generate methods one for symmetric one for asymmetric keys Very similar to the secret store So if we look at what the p11 plug-in then is doing currently It establishes a master encryption key within the HSM and the idea is that's going to be used to wrap project key encryption keys and And so the idea is these these project project keys are actually going to be doing the the encryption process and So we also have an HMAC that's being established and that's being used to verify that encrypted project kek so As it turns out both those those pieces of information can be stored in Barbican But the MEC and HMAC itself will be established on the HSM and never leave the HSM So if you look at the process then We have Barbican core on the left-hand side and it's the Barbican database And then we have our plug-in in the center there p11 plug-in and then the HSM that it's interfacing with and So as I mentioned the MEC and the HMAC are established in that H in that HSM and So when Barbican core is ready to call that buying process and again that buying process will be called every time a secret Process is encountered for a project ID that hasn't been seen yet. So once that project ID is established it won't do this again And so the p11 plug-in orchestrates with the HSM to create that kek The master encryption key then is used to wrap that kek and an HMAC process is run To to aid in verifying that project kek later And so that produces your wrapped kek and HMAC result both those pieces of information are passed back to Barbican core and stored in its database So that but like I said that that's going to be once that's established that will be reused for all operations with that project from now on and so as a It's kind of a anecdote I would also mention you have to be this is this is going to kind of lead into a conversation We'll have a little bit later about plug-in versioning. Okay, so We what we ended up doing originally we were putting these project level keks right in the HSM And the problem there is for the HSM's we're using at rack space anyway There wasn't going to be enough space to store all the projects that we were going to support it be supporting secret storage for So Paul ended up changing his original design to use the master key encryption approach So that was the wrapped kek approach that we just discussed And so the good news is the contract didn't need to change Barbican the bind the bind kek results are stored into Barbican's kek database and Everything's fine. You know, I mean that's that's how it works so the plug-in determines what that that That metadata looks like and Barbican stores it on the behalf of that that plug-in and hands it back to the plug-in So that was good, but the problem is the semantics changed right so Now we were putting wrapped kek information that increased the kek information for the projects into that metadata When before we weren't and so that means when we tried to retrieve secrets using that old style Well, obviously that data was missing and we effectively broke retrieving those old secrets So even though we were using the same plug-in by name and that information is recorded on the metadata The information put into that metadata changed and that was enough to wreck things. So as I mentioned there's going to be a design summit to kind of dive into that and Try to standardize ways to control that probably through versioning So if we move on to encryption then as I mentioned before we have our project kek Wrapped in the Barbican database and we have our Mac and H Mac And so this is the starting point for for your your operations And so the seat the secret is provided by the client through the API and So Barbican core with retrieves the project kek for that sends that over to the P11 Who then orchestrates with the HSM to place that information into the HSM So the wrapped kek shows up there The H Mac then is used to verify it based on the H Mac Results that were stored when the kek was created in the first place and then that's unwrapped by the mech And then that unwrapped kek is used to encrypt the secret And so that's passed back out and then stored into the Barbican database So this is an essence where your encrypted data encrypted secrets come from in this process So if we move on a decrypt well, you know, it's as you might imagine. It's the reverse process So when you're ready to encrypt a particular secret You you pull those pieces of information the project the wrapped project kek and the encrypted secret pass that along back to the HSM same sort of H Mac verification and unwrapping process goes on and then unwrapped kek Then is used to decrypt that secret which is passed back out to Barbican core and is returned back to the client So generation. I'm not going to go into too many details on generation. It's it's a fairly simple process As you can imagine the wrapped kek and H Mac are always the inputs to these processes You know once that's established that's kind of a familiar familiar pattern But then for generation you have to provide the client would have to provide through the ordering process What the actual secret that they want to to generate is bit link algorithm, etc. So that information is provided and Then the HSM will actually generate the random bits for for symmetric It's it's relatively easy to do that and then the encrypt process that we just talked about is is run on top of that So just a configuration example then You can see we have you know the things you would expect out there a login password You can also see the MCAC label and H Mac label the labels are how Barbican refers to the information that's in those HSM they The H Mac and the Mac that never leave the HSM are still referred to via these labels So so Barbican core and the plugins can access those And so again, this would be Something that your configuration management would override those values as needed for your environments And with that Pass Okay, so certificate plugins So of course certificate plugin is just basically the plug-in that interacts with the certificate authorities To do certificates for x5 or not for x5 or nine certificates for pki Currently for Juno, there were two plugins that were written about tag and semantic of kilo. There's a digital digital plug-in That's being currently production The current planned use of an open stack is the load balance as a service for neutron Adam Harwell and and his guys have been working pretty hard on on getting Bob again in there but of course there are lots of possible future use cases any open-stack service that needs SSL server suits or needs User suits potentially signing suits like keystone tokens or something like that for pki. Those are all possible play things that could be done So the contract is pretty straightforward of the for the certificate plug-in you have Some support. Yeah, basically the same kind of methods So you're gonna see the same kind of supports methods that you've seen in the other plugins as well, too So this would be for example where you'd say whether or not your CA a supports generating an ecc Certificate or certificate with a certain key size or whatever the case may be your extensions or whatever Issue certificate request is going to be the call that you're going to use to Talk to your particular CA and start the enrollment process for getting a certificate coming out of it And that could ultimately return either a certificate automatically if it's automatically approved or It could return a status that says, you know, basically we're waiting for the approval on the CA side And so if you if you don't have a certificate that's already approved there You can of course always either modify or cancel the certificate request And then ultimately you're gonna want to check the status of that certificate request To make sure that you know when you get a suit when you get a suit It's gonna be returned and then it'll be returned back to my while we can core So then these are the methods that would be need to be implemented by a plug-in So they're pretty straightforward They all take three three parameters because the certificate plug-in comes in through the order Interface in the barbican API and then you're gonna have you can have an order Essentially associated with it. So it's an order ID the order metadata is gonna contain all the things that you need to specify what kind of certificate you want so things like the CSR or the The requester ID or something like that the plug-in meta has the same sort of role as Nick mentioned in the secret store it's basically a Dictionary that's used by the plug-in to store any data that it needs in order to keep track of the state of the certificate request So obviously for issue specific request one thing you're gonna Watch is the ID of that request on your on your CA so that when you check the status at a later point in time You have that ID ready to to go ahead and check It's gonna return a result objects will result DTO dotted data transfer objects Which essentially is gonna have the status the certificate any intermediate certificates retry parameters that kind of thing So just to kind of see how this this would work Some client is gonna make a post to order so that's new to on over there Load balance is gonna make a post to slash orders It's gonna the body of that request is gonna include all of the relevant parameters that you're gonna need To make the request So the CSR and so on all of those are going to be stored in the order metadata And an order ID is going to be returned to the client that that points a certificate task is going to be queued and once it is executed a CA plug-in is going to be selected by going through all of the plug-ins and and you know going through and specifying the Sports methods and so on Loaded by stevedore and then we're gonna call issue certificate request on that plug-in Which is going to make translate that into a CA specific API call To generate your certificate request on that certificate authority now at that point Certificate authority is gonna return a status It could be pending it couldn't have the suit itself That is going to be a CA specific type of Output which will then be translated by the CA plug-in into result objects which goes back to Bob again core and gets stored The orders updated so it's a sword and someone so it turns out that we store the suits Using the secret store interface, so they're actually stored When you when you get them back you're actually getting back something that'll be a reference to a secret Eventually we're going to get the order We're going to retrieve the order and the certificates and we're all going to send that back Now it's a little more complicated and not on on the get side of things over there because As I mentioned we actually store the suits as as secrets and we aggregate those into some sort of container So the order will contain a reference to a container Which will then contain references to secrets and then you get the secrets and then you just But it's just a series of gets So Just to give you some idea as to some of the state the machine that's going on here You could have a post to orders That ultimately will call issue certificate request on the plug-in At that point it may come back as as pending And so we have a queue in which retry tasks or which tasks are are are stored or queued up So they'll run periodically and you'll get checks to get a check certificate status checking it It'll check it periodically and then once you actually have a certificates or you have an error It'll come out of that Store the certificate and then ultimately later when the client goes to get the order and ultimately goes to get the secret You're gonna get your certificate. So there's a there's a State machine that's in there. That's within Bob it can core that manages this whole operation So just a little bit about dog tags. I'm gonna talk a little bit about the dog tag certificate plug-in in particular Dog tag in case you don't know is the is the upstream version of the red certificate server It's been used in some of the largest deployments In the world millions of keys millions of suits it's been around for 10 12 13 years, I guess it is It does interact with a bunch of HSMs through pkcs 11 It's common criteria certified which if you've been through common criteria certification means you've been through a long and painful process of Certifying that you have all the required or authentication authorization Auditing that kind of thing signed audits so that the audit audit log is tamper proof and so on as well as making sure that Secrets for example that go through are never in the clear even in memory So Nick mentioned the wrapping thing So this in in the case of dog tag you have a transport key Which is a public key which is used to wrap the secret on the client side and therefore It cannot be decrypted until it eventually gets into the HSM Where your dog tag system resides and then it automatically immediately gets re-encrypted and stored So that it's never out in the clear in memory anywhere. It's only in the HSM so There's two components of the dog tag system that that are important for our case here There's the certificate authority which is issues the certificates and the key recovery authority Which is used to be the component that just stored private keys, but we've extended it to extort just about anything You know any kind of secret private keys Symmetric keys and so on And there are many for the dog tag plug-in. There are many different types of certificates that are available The server suit user suit based on what certificate profile you have the profile Within dog tag talk is basically a thing that maps towards a type of certificate So it will specify the types of inputs that you need on the certificate will specify how to create the subject DN Any kinds of extensions that are available in that and that kind of thing and of course It comes automatically with a bunch of different profiles, but you can specify Custom profiles to get whatever you want in your certificate and The dog tag plugins are set up to interact directly from Bob a can to the CA in the KRA With a trusted user so that you automatically can get your certificate approved. So you don't have to wait So just as an example of how this will work You would do a post to Bob a can to the orders interface And the body of that is going to be it's going to be a type of certificates The green parts over there are the parameters that are going to be passed in And I mentioned those in particular profile ID and that suit request and so on those are specific dog tag Parameters are there and the reason that there's specific dog tag parameters It's that in Juneau these parameters are just passed directly to the plug-in and those are passed directly to the CA And so dog tag knows what to do about that And so you have if you happen to know that you have a dog tag CA at the back end you can do everything That you would ordinarily be able to do with dog tag Bob a can essentially proxies it through does the authentication with keystone and then proxies it through for you In Kilo We're going to add an API to allow you to generate any to not even know what CA is behind there So you can get certain simple kinds of certificates and so on by specifying these these the parameters Which will then have to be translated by the plugins to whatever the appropriate plug-in interfaces Okay, and there's a design session that will be coming up later this week on on that specific thing So if you're interested in that, please, please attend and Once you do that you get your order order again contains a container reference at the bottom at the bottom over there get your container and Then you have you can see you have a series of secret references over here get those secrets One of them is going to be your your certificate you get that secret and there it is So Talk briefly about the notification plugins that we're using within Barbican And so the idea that we're taking right now is to have kind of domain specific You know specific to workflows within Barbican an interface that has you know natural methods on it That makes sense for that workflow And then leave to the implementation Exactly how to create tasks and in QM or whatever it needs to do as far as the implementation is concerned So you can see in this example we have a notify certificate is ready So we would use that as far part of our certificate workflow to surface those sort of events And so your choices right now, you know, we're thinking Oslo messaging notifier is used in projects like Nova and so that would be a natural plugin to implement and use We could also, you know, folks can make their own plug-in to adapt to whatever corporate system that they have corporate ticketing or whatnot Customized system law system is logged system logs We might use that for example in Barbican to surface events that associate a knowledge article with with an exception perhaps and And allow admins to have an easier way of maintaining and troubleshooting Barbican and Multiple of these events could be installed at a time So I could say notify certificate event and if there's three plugins three certificate event plugins installed It would fire up all three of those and So let's get into the challenges then for for kilo then Multiple plugins versus one the minute you have multiple plugins installed You need some means for for selecting which one to use and so we've already talked about the supports method as one option for that Migration between back-ends. Let's say you have a bunch of secret stores stored with an HSM And you want to convert over to came up or dog tag Well, what do you do with those old secrets? Do you migrate them in mass? Do you maintain the HS at both both plugins effectively and only for new secrets to use the came up those sort of things? with we need to discuss and I mentioned through my anecdote about the HSM plug-in, you know versioning within a plug-in is something we'll have to definitely contend with and Then as adi mentioned on the certificate plug-ins If you have multiple plugins that are working with multiple CAs you need some way for clients to discover which of those plugins they want to use and And so that's something that we want to discuss as well As well as common parameters across those CAs identifying those and standardizing those if possible and So Tuesday is going to be a big day for for the barbequan project Starting with a a wonderful workshop hour and a half workshop Barbequan securing your secrets if you want to really get your hands ready with the API, please. Please attend that There's also going to be a tech talk given by Joel securing data at rest and Then we have four design sessions Any great Barbo came with other open stack projects as I mentioned if you if you have an integration use case with Barbequan, please please come to this Comment certificate issuance. This is all about CAs and trying to come up with that that search discovery API for example Driver lifetime management that gets into all the verging issues that we were talking about is as well as you know Any other issues related to managing plug-ins and Finally a per user entity level RBAC So trying to find trying to make a more fine-grained access control for our back for Our back in Barbequan. So maybe a per secret our back would be better than just using trust at a project level for example And so we do have an ether pad Please go out there and view you know what feel free to view what we what we've identified as issues for Barbequan so far We're gonna have a table if you have questions, please come on by and finally this these are the the folks that Made things happen today for the presentation Feel free to contact us with any of these mechanisms or talk to us after the after the conference Thank you very much. Appreciate it guys


I don't advocate for hybrid systems. I wanna see everything privatized. It strikes me as stunning that in every other industry we understand that central planning doesn't work. We've tried central planning, bread production. We've tried central planning, food. We've tried central planning, all kinds of things. Doesn't work. It creates shortages. It creates lines. It creates malinvestment. It creates unbelievable inefficiencies. And yet in healthcare, somehow we think is special and unique and different. It's not. It's an industry. It needs to be produced by GPs, by nurses, by hospitals, by people who produce the service. And they are customers to somehow believe that we can take this unbelievably complex system and centrally plan it, given a bunch of bureaucrats, the power to decide how to allocate resources, who should get what, what are the best treatments? Instead of letting a market work where it works so beautifully in where it's allowed to work, in every product where we allow markets to work, we get beautiful results. Why not try it in hell? Well, we know.


everyone and welcome back to another episode of our Pokemon vgc 2019 battle series we are in the moon series for only two more days so saying that guys we are back it's thursday hope you're all well having a great week we did finish up with the Mewtwo team yesterday after a resounding result in the poll that we put up last friday so thank you again to everyone who voted on that if you'd like to go back and check out the last few days with Mewtwo you can go back up here i put a comment for you people to check out all the good games that we had but getting on to today's matches games teams and everything like that kindly Cameron who is one of our channel patreons provided me with the team that you've got on your screen right in front of you now which is going to be a lot of fun to play it is a team that he's created himself so big shout out to Cameron thank you so much for giving us a team to feature today in this fun last week in the moon series before we move into the ultra next week so just to recap the team for you guys we've got the cure and black the whole tappie finney incineral stack attacker and the ludicolor quite a solid team we've got the isinium on the cure and black though which is going to be a lot of fun because we've played cure and white we had a real good run with cure and white actually and came up with that really nice team that we finished up with there so to play cure and black i know james becks had a lot of success with it on his channel in the moon series so it's going to be nice to feature at least we featured both curams in the moon series as well it's going to be a lot of fun as always though the team is in the description down below as well as the paste so go ahead try it out and give all big props to Cameron for his kind suggestion and giving us a team to play but without further ado guys let's get into today's episode as always if you enjoy this content please remember to leave a like down below subscribe to the channel don't know what's with the accent um but yes and leave your comments because i love hearing your comments hearing from you guys in general and remember next monday because there's no battle spot because the rules are getting updated for tuesday when the ultra series kicks into gear we won't have an episode of our daily battle series we will have instead some new content on the channel which is going to be all about sword and shield so i'm really excited about it if you've got any questions that we'd like me to answer in the first episode though of this new content that we're doing the coverage of sword and shield then leave them in the comment section below and i'll make sure to try and answer as many of them as possible for monday's episode but we've got our first opponent so let's without further ado jump straight into it right we're going up against nylega holo we've got the mirror already um tapofini ludicolo incinero and kayoga so it's gonna be a really interesting match for us to go into we've got the restricted combination of holo and kayoga we've got the ludicolo there supporting that kayoga with its swift swim ability that it loves in the rain you've got intimidate support faker support from the incinero nylega is going to be a bit awkward to deal with it does do really good damage to pretty much everything we've got on our team so dealing with it is going to be very difficult and we're going to have to make short work of it how it is we go on the defensive side of things so if we can get a trick room up potentially then it will help us out we've also got ludicolo so if the rain is up then my opponent is going to find it difficult to um take number of numerous amounts of those water type attacks but i feel like this is a pretty difficult matchup for us to kick off with today cure and black is going to be really good for us it does hit the hall all very good the finny and the kayoga we've got to watch out for the intimidate support from the incinero so we've got to have something in the back to switch it on um okay let's go incinero let's go ludi and let's go holo because i feel like we need to bring our restrict it's here okay let's click in with this and go for it so good luck to my opponent hmm nilego is the one thing that you think right well this makes things super difficult for us i don't know what that clicking was either bird clicking but yeah ignore me i'm sorry something just clicked behind me though and i'm like what the heck was i'm in this room alone so i'm haunted okay so we're gonna see how and incinero come out we're gonna have to deal with that intimidate support but cure and black still not in the worst position ever we've got to watch out for obviously sacred fire that could come out from that hall or potentially burn us um i do see the intimidate cycle from the opposing incinero which indicates that it's either faster than the one that we're running or it's a speed time we're just bouncing around intimidate so what are we gonna do i think we trade fake outs for sure fake out into the hall and bring an hour on hall and then we're not intimidated at all are we um i am i do worry about the potential kyoga switching in here that's the only thing i'm kind of tempted just to you turn out on the incinero so i've got the intimidate to bring in again and try and maneuver ludi in if the kyoga does hit the feel for my opponent because they might not go for the fake out they might just you turn pivot into kyoga um although with cure and black sitting on the field it might not feel like the best thing to be doing right now but we'll reposition anyway so i've got to try and cover the whole hall if the kyoga does come in and i feel like this is probably the best way for us to do this so we do see the fake out there's a tailwind from the opposing hall and uh we can get ludicolo in it's fine we'll get some damage onto this incinero anyway because we can switch straight back out from ludi and get another intimidate onto the opposing hall or start doing some damage and at least by doing this we kind of detract the the kyoga hitting the field so soon um okay i'm just gonna brave bird the incinero and i'm gonna switch back into our incinero from ludicolo because it's an obvious target for a brave bird from the opposing holo saying all these pokemon way too many times just confusing myself going round and round the circles switch into our incinero we're gonna target the incinero switch out our holo and hopefully the other holo doesn't brave bird uh incinero so which is gonna there we go okay so we're bringing incinero i'm gonna stop the shenanigans this is the last week of the moon series so i'm sorry i apologize it'll be so much more serious into the ultra series looking forward to it the guides are gonna be starting on monday as well guys just for your information uh we do see a brave bird there's a u-turn come on bring that kyoga in take a brave bird okay it's not going out what's coming in it's gonna be nilega maybe like if you haven't brought nilega to this match i do question because it's so good against the team that we're running it's not about switching now i mean you probably don't want nilega to take a massive chunk of damage but at the same time it is going to resist a brave bird and it does make the appearance one pokemon that we did not want to see but we will get a brave bird into an intimidate so we should still do a decent amount of damage i mean that's not bad is it it's not bad it isn't bad at all um okay we've got the fake out nilega i think we go into curam black black curam and uh we fake out nilega this is trexy trexy because curam black isn't going to enjoy taking a power gem neither is hot or really neither is incineral this is what i mean the nilega totally destroys this team hot all gonna reposition itself we're gonna see the incineral come back onto the field now it's fine i think but at some point we're gonna have to switch something in on nilega to take an attack so we do get curam black and tera volt activating get the fake out into the nilega put it in brave bird range now although we're not gonna be able to take any attacks from it um i think curam black probably is strong enough to take at least one attack um the problem is that we have is incineral is right on the money for a power gem although we probably take a power gem from this range do we do we want to risk it that's the thing because i could you turn i could you turn i've got to get around this fake out for sure let's bring in ludi the problem is ludi's one of those pokemon i need for the kyogre that's lurking in the back and if my pot goes for a sludge bomb here it would not be the best situation ever power gem okay yep incineral okay it's all that's really helping out there you turn not so good oh man oh dude that is that is brutal that you turn damage okay whole all incoming inbound right um tailwind does pitter out pitter pitter now do we just fusion bolt the nilega i think we've got to chase that down we've got to get rid of it if we can and just switch in incineral we've got to keep ludic all around for if that kyogre's in the back which i probably expected to be getting an intimidate onto that all whole all's going to be good it's just the risk of a sacred fire now um like i say i think cure is probably strong enough to take a power like a power gem the double up into it maybe no maybe intimidate does help but maybe i'm underessering cure and black as well at the same time i just feel nilego way more than i probably should but i have a good respect for it so that's that's the other thing power gem coming out gonna be in yet oh that does so much damage tailwind okay that's fine that's fine that is all right because we'll get the nilego now now the next thing we've got to deal with is the the kyogre stall out the street because kyogre's gonna hit the field now for sure incineroid incineroid you say this makes it a bit easier for us because now i've got an easy enough switch into hot all um i think what i'm gonna do is protect cure and white and i am going to bring in hot all for incinero then the next turn we've got the potential switch out with cure into incinero to get a double intimidate onto that hot all intimidate onto your poison incinero and we can start chucking our break birds once again with hot all and it does have protecting this build as well so it makes it a little bit easier to kind of get achieve a good board position i should say so incinero going out for us hot all coming in look at these hot alls in tandem synchronized flying it's beautiful okay we do protect there's the fake out perfection and sacred fire yeah so that's not so bad it's not so bad um let's get a good old incinero back onto the field and let's go and did we go recover here that's the other thing like i could just recover um kind of like the idea of just doing that because it means hot all's gonna potentially stick around a bit longer although the opposing hot all's minus two so i'm not massively worried about that i'm gonna break i'm just gonna brave bird the incinero slot because with the fake out we can we can recover the next day okay so i get the intuitive cycle back onto the hot all onto the incinero probably see you turn from there's the sacred fire yeah just checking that slot i'm gonna do too much to a fire cat platelets hmm doubling up now switches it kind of screams more and more and more like the um the kayoga's just not here do you get the brave bird kayoga's definitely here i know who were kidding okay but that incinero is definitely in range this next turn of another brave bird um i don't really want to fake it out though that's the problem um i'm gonna just you turn out onto the hot all and i'm gonna just brave bird again into incinero so if i fake out i proc a berry i don't pick up the knockout onto it whereas if i yeah i do this there's a lot like the platelets should be that minimal at this point on to either told it that we've got it shouldn't proc the berry the recoil i'm hoping hmm it doesn't feel like it's that close to proc in the berry but i could be wrong i could be wrong and it could over of course it could crit so that's the other big thing here or the whole could protect snot i mean it's not ideal that we're not actually getting out on incinero out especially when the kayoga's there definitely sitting lurking in the back because now hot all definitely tailwinds and kayoga just attacks and lulie's knockout but i mean the whole all yeah kayoga the opposing hot was minus two so i mean got that kind of going for us i guess uh we've got a sack incinero i think now you can try a snarl a snarl would be handy if we can get a snarl off and let's get to protect see what this kayoga is if it's scoffed or not so protect kayoga waterspout scoffed i think i think it's scoffed hopefully we don't see a tailwind tailwind would be disastrous but it would make sense for my opponent to set up an end game for the lulie coming in right lulie probably i think when they assault us we probably do take we're probably to take a waterspout but we can always fake out and brave bird the kayoga yeah let's do that because your opposing hot all probably target down on lulie here if we can get some damage onto this kayoga just to weaken that waterspout it gives cure and black a little bit more of a chance when it comes onto the field but we're so low health with cure and black after taking that power gem it's it's really difficult because like yeah it's just the margins aren't the best right now but the rain is helping cure and black against the sacred fires at least there's a fake out curve a flinch z move of course this will be into hot all minus two should take us down i think hmm and our only hope now is that ludicolo is faster than the hot all in this tailwind that is our only hope if we can damage this kayoga enough with a grass knot then cure him can deal with the hall come on ludi do it for the team prove me wrong about how i feel about you in this format please you dancing pineapple you know you want to do this i know you can take the waterspout you've got an assault vest you're ready for the assault you can take it come on ludi let's do this ludi why oh come on well i mean there's there's just no coming back from this now pineapple head i mean to be fair to be fair it was a pretty tough match we could have maybe played it a little differently places you don't get the double protect in the waterspout will be enough telling you though the nigh lego we identified from the start we had nothing to hit it super effectively and it did enough to allow the kayoga and the whole auto just clean up at the end there but good game to my opponent and we'll quickly fly over to our next game hopefully it doesn't take too long to find the opponent ah yeah i mean it's a really tough match up nigh lego is one of those those pokemon when you're building teams in the moon series in particular it's not something that you kind of springs to mind straight away think dang i need to have that nigh lego check because otherwise i mean you are playing hot all but i mean at the same time it's not so popular so it's one of those pokemon you can easily forget about but never mind we'll move into our next one which you got straight away so let's have a look ah this looks tasty we've got incinero ludicolo kayoga whimsicott sogaleo and malamar so malamar for you guys out there that don't know because there might be a few of you it's a psychic dark type it gets contrary as well it gets access to superpower so it's it's a pretty good pokemon um right what are we gonna do though how good is cure and black in this game i mean outside of the sogaleo it's pretty decent doesn't do too bad against it well it does really good against the kayoga good against the the ludi malamar it's not too concerned about um what's our finny got let's have a quick gander so nature's madness heal pulse here's icy wind okay here's could be decent i guess definitely the nature's madness we're gonna bring finny in this game um i don't think we see the kayoga lead i'm gonna bring her up top i'm gonna bring ludi and i'm not gonna bring in tim there it's pretty useless anyway it's like it would be good against the sogaleo but it didn't really affect that because of the full matter body we're not gonna do anything but proc the contrae on the malamar um and the incineroar yeah it would be useful but i mean we can deal with incineroar we've probably faced more incineroar than we've faced any other pokemon on the channel in the combination of the sun and the moon series it'd be interesting to know to know that like we've probably faced quite a lot of arcanine i can imagine from the 2017 season but probably not as much as we faced incineroar which is every game every game maybe not this one though maybe my opponent didn't bring it we're gonna see the sogaleo the women's ago come out for my opponent so uh the misty train's a little bit hindering to us because we would like to secrify the sogaleo and burn it but at the same time we can't have it all can we um okay so they've got to expect tailwind i think uh they've got to be a little bit worried about a sacred fire i'm just gonna i think i'm gonna icy wind and i'm gonna brave bird no i'm not i'm gonna sacred fire the women's ago could brave bit it but i really don't want to take the recoil and i think the sogaleo switch is out or protect it and we probably see a tailwind from the women but let's see we'll soon find out sogaleo withdraws you see kaya oh my oh no okay and wimmy so we're just literally just we're just giving the uh the the good old malmar oh we're not we can get away with it by the skin of our teeth okay that's fine gotta worry about rockslide on malmar because it does does learn rockslide um i think we need to buy this that and we have to readjust we have to readjust rockslides like one of those things it's really not ideal for us to be um facing down against okay do we bring in ludi we get the faker the next turn which isn't too bad yeah i just worry worry a lot about rockslide here from malmar on call not ideal and it does hit this time okay so here we go malmar speedy gonzalez yep speed rose by one goes for the knockoff okay interlude you just get rid of that assault rest it could have been a lot worse we're seeing leftovers on wimmy which is an interesting choice we're gonna have to switch out um let's bring in curem and fake out the malmar and i don't even care about getting on call locked with ludi just to stop this malmar from doing anything going into this next turn it's gonna be pretty important for us as we see it till wind but then again we don't want to take any unnecessary damage with curem black do we nearly said white there's a fake out till wind yeah superpower is the one thing that we have to worry about quite a lot from this malmar i mean and it's just gonna boost and boost and boost we need to get tap a finny and haze it let's just scold and get some damage onto it because superpower is going to come into the finny here no doubt about it yeah uncle ludi the boosts ah wimmy why do you do this this is why leftovers are so good um let's his let's switch to hall hall and let's hope we don't see a rock slide okay wimmy gonna switch out ludicolor coming in hmm if we see a rock slide here we're done but at least wimmy's left the field oh malamore protecting huh the hay is coming in super handy though there and now it disappears from the field so we'll protect we'll nature's badness the malamore and we'll just protect her all because we haven't got the wimmy on the field now so we're not so worried about the the uncle coming in but we might like knowing that finny doesn't really carry protect it's kind of a safe toilet for the the fake out as well so my opponent could take advantage of this but at the same time we've just got to protect this hall try and get some damage onto this malamore the next turn scald and just mindless is this malamore doing knockoff potentially okay trick room now we want the icy wind as the tailwind pit is out that's kind of nice hmm now there'll be more indication now that feel like we've got to read readjust again let's let's go for the icy wind and get ludi back on the field it's just a revolving door of pokemon because i just don't know what to expect from this team there's them and there's another knockoff scald as well yep doubling in not so okay but dealable oh you come on icy wind finny i thought we got past this finny i thought we got past this obviously not um right i mean we can heal pulse a good old ludi to keep it around a little bit longer might not be a bad idea to be honest um and just go for that icy wind once again just to kind of screw over the malamore but it's actually slower but it targets the why didn't i why didn't i fake out with ludi what did i actually do with ludi i i don't even know what i've clicked this is all finny's fault this oh i see winded okay okay yeah heal pulse i see yeah just so confused so confused um all right we will switch into hall and we will scald the malamore which might be enough now to take it down we've got to worry about a potential gigadrain from the opposing ludicolor but hopefully it attacks the finny switch it does and hopefully this scald is enough to take down this malamore want some malamores out the question ugly picture still not enough burn yes burn come on ludi you're pulling it back for the team but is that a lumberry no it's a super berry okay that's still all right because we take that like a champ like a champ we say okay right the burn i think brave bird's gonna be enough to get that malamore now i'm pretty i'm feeling pretty pretty certain about that although we have to take a scald from the ludicolor how many turns of trick room we got left okay one yeah we have to break the malamore to get rid of it um we could just grasp not the ludi as well let's do this yeah we'll get scalded into hall but it's not the end of the world i mean it does so much damage critical hit we're not not getting the rubber the green in this one are we really this has to take down the malamore but after the defense boost you've got to think probably doesn't you need to double into it super par it's fine we get we get our cure him in although now the malamores uber fast which is not what we wanted at all um yeah it's got knockoff which is not ideal let's get finney in it's our only hope and icy wind plus the burn should get it i think that's all we can hope for all we can hope for right now it's not looking too good it's icy wind and let's hope that the malamore attacks or to protect its beloved pineapple head that it's got partnered next to it can we do it can we do it opponents really taking their time though aren't they i mean i don't mind i'm just kind of pointing it out because it feels like every turn is like dragging dragging dragging knockoff into the hole please let the icy wind hit finney you did well hopefully this is enough plus the burn to take down the malamore giga drain yeah the malamore doesn't go down to burn here we're royally royally screwed and we we need to double protect that's the only thing we can hope for now double protect and then we do that oh and then the kyogre comes in and yeah we can't really do anything against it so we go for the protect we go for the protect because yeah if we get it the malamore goes down the wimmy comes in it on core locks us in to protect with which everything it would like to do you still have the z move on cure them but i mean we kind of need the electric z move rather than anything else we get it we get it so that that's that's a huge plus for us knockoff at least we can say we took down the malamore and now it enter the wimmy i wonder if an icinium z is enough to get the ludi potentially could be you're going to lock anything in it's got to be that that cure and white now do we recover no we break it we get rid of the whimsy cop and we go for the the icinium z the subzero slammer into ludi because we'll outspeed it now oh even better i can't believe it i'm nearly choking okay i don't know why you protect wimmy there when you've got a perfect chance to lock in either target to protect but you might i don't know yeah i don't know but we're gonna get this this ludi this should be enough at least we get the z move off this episode as well which is ideal easy peasy okay now brave bird yeah kind of protect a little recovered there but the thing is recovering there is a bit dicey as well because we get locked into recover and if kayaba comes out into the field it's still no good i mean we can still oh it's a course it's so gollio what am i worrying about hmm i know what i'm worried about is we've got to recover with hot all we needed to recover there if we are a bit smarter about things and hopefully we can get nice being often to the wimmy if we lose hot all here we're screwed okay get the brave bird that makes a lot of sense we should have protected there oh actually faster than the so gollio okay can hot all see out these encore turns no phytonium z the super par okay a downfall was predicting and forgetting that the so gollio was in the back but that is because everything else took so long i just lost concept of what was in the back so in my defense that was there but i should have definitely protected with the whole of this last turn taking down the wimmy kind of would have expected the so gollio to be faster than a cure in black because we've got no speed investment here but we do prop the berry so there is still hope there is still a lot of hope here since you'll strike how many turns of encore we are we gonna have to deal with oh we can only break bird we can only break bird can we still do can we do this come on if we can do this this makes everything all all right doesn't it it's a long episode today as well so gollio just protect one turn for no reason fly blitz super fly blitz super par probably got some steel strike you're taking recoil well i'm taking recoil right one or nine probably i mean may get away i don't think we're gonna get away with this maybe the encore doesn't end we need the encore to end oh it's so painful okay so we go down to it in like 70 76 and then 60 we might if the encore ends this next turn we can still do this for sure and we can still do it we can still do it i still believe so it's just right it depends how much this does though this will be more than a fly blitz oh and there's no recoil here on yeah we're not gonna we're not gonna be able to do it now we need another berry or crit the biggest crit in the world and the encore ends and so do our hopes and dreams um let's recover in case for some reason the Suggler protects but nah it's not never gonna never in a million years but very good game to my opponent um the whimsy cock causes loads of problems we had issues in our brain just remembering that there was no kayoga there just scared of it but nappo very good game and guys i hope you enjoyed it at home that is a homage to camera i'm sorry we didn't get the wins for you today my friend but it's been really fun featuring the team we've got the see the z move and this is the last fun week on the channel as well before we go though i will just say don't miss tomorrow's episode because out of all the janky teams that we've had the last couple of weeks tomorrow's one is extra special and a big shout out to our good friend johnny hacks so this tomorrow's episode is going to be the last one of the moon series so i'm hoping to make it an absolutely amazing one i hope you guys have a great day thank you so much for tuning in again and uh well hopefully see you for the last one on the moon series tomorrow but until then take care of yourselves have a great evening morning afternoon night whatever time of day it is and i'll see you then so until then okay and bye bye


An open pneumothorax is similar to a pneumothorax, except that there is also a wound in the skin. Now there is a communication between the pleural space to the outside. When the patient inhales, the ear preferentially enters through the hole in the chest and not through the trachea. This can potentially cause a tension pneumothorax. The treatment for open pneumothorax is a three-sided, occlusive dressing. This dressing should be non-porous and only three edges are taped down, leaving one edge open. When the patient inhales, the dressing is pulled closer to the skin, sealing the open wound. When the patient exhales, the ear releases from the wound through the untapped edge. This is temporary. Patient should also receive a chest tube afterwards.


incredibly rough as well wow it's really annoying actually hi I'm Lavi and I'm Oli and this is our hero bumblebee together we are attempting a Guinness world record to become the youngest pair to circumnavigate the globe by motorcycle join us for season three here in South America I think our beloved tent starts to break the zip is giving up here I hope we can fix it somehow we have to clean it later out and see if we can repair it good morning world welcome back to the channel it's day number 259 on our circumnavigation around the globe by motorcycle we're here in the small town of Cerro Castillo in Chile just next to the border to Argentina yes and we had a really good night here in our tent underneath this bus station we actually had a little bit of a lion as well yeah it's pretty sheltered from the wind and it had a cover at the top and it was actually really cozy very cozy very nice but let me show you guys where we're heading today so we are here and today we're gonna be crossing over the border back into Argentina and following the route of 40 up and around to the town of El Calafate yes today we'll be crossing the Chile-Argentina border for the fifth time so far on our trip we've got some really really cool mountain spots to check out on the Argentinian side starting with the town of El Calafate where we're heading today which is just next to an amazing glacier called the Perito Moreno Glacier so hopefully we can get to this town and then get over and see this glacier so we have about 150 miles to cover which is Tarmac Road and dirt road and it's already 10 o'clock so better hit the road let's go goodbye bus station goodbye peaceful camp shelter home you know I still didn't see any any star for anyone around the whole place is just completely dead yeah super crazy it feels like a ghost town here yeah I mean yesterday when we came in I didn't see anyone around no I didn't see anyone around maybe it is like a ghost town very cool place so what a location hey wow epic location for a town oh it's the border here oh yes maybe this is already the border can we park up and we'll see quicker than expected yeah I did not realize that we were right in front of it what it's funny okay let's go take it out rock and roll so that was pretty easy I gave them our passports to be stamped out of Chile I gave them the temporary import permit that we got when we entered Chile and they took that back and gave me a little slip of paper to take over to the Argentinian side so that's it that's out of Chile back into Argentina whoa man look at this surroundings here such a nice day as well as 18 degrees wow yeah I really like these remote border crossings like the one we did the Diyama border between Montetanian Senegal here it is barrage the Diyama the border of Diyama and we have officially entered Senegal it's just a different feeling when you go through a remote border and there's just a little heart surrounded by the mountains and you're just like everything's like nice and calm and hello yes whereas when you go through like major borders they're like next where are you going oh where's your hotel yeah they have to deal with a lot of more people yeah so if you get a chance when you're doing overlanding you should always go for the small little remote borders even if you've got to take a dirt road you will appreciate it bienvenidos a la república argentina all right Argentinian formality is done we've got our temporary import permit again and we're officially entering Argentina for the third or fourth time muchas gracias ciao all right I feel like having a martin now so from here it says on the sign there it's 200 kilometers to El Calafate I think we've got quite a bit of dirt roads to do before we hook up with the larger road so it should be a very nice and wild open ride today back in the Patagonian step super is 153 it's a little bit more expensive I hope it's open look look at this cute little fuel station wow oh yeah the sign says open there you go okay see if someone's around mil mil peso mil peso gracias so that's a thousand so it's like six liters gracias muchas gracias so now it says it's 99 miles and we've got in the tank plenty plenty absolutely plenty yeah look all the stickers though in the window yeah we really really really have to get our own stickers yeah such a cool petrol station a cool place so from here there's actually two ways to have Calafate there's the main tarmac way going that way which is about 150 miles or we can save 50 miles by taking this little cut through dirt road so we're gonna do that now we're dirt road pros we're gonna we're gonna try and see how we go yeah don't say that too loud yeah maybe we have to turn around yeah it's quite rocky here big rocks it is actually very very rocky isn't it yeah let's see if we just stay on this line here yeah some flamingos over there as well some flamingos nice and fortunately it's not there whoa whoa haha not the greatest quality cut through unfortunately but it's a pretty stunning place to ride through if I get a chance to look around which you don't know you have to concentrate on the road Jesus that's a bumpy road oh man oh man oh Jesus oh I think actually I think the line looks better okay on the right let's try it yeah okay so relaxing I love this rural cut through road conditions are still pretty pretty bad very bumpy very stony yeah indeed bumpy stony I hope that our tires will make it yeah but thank God we got that bash plate hey yeah as we had a lot of bonk bonk bonk from some pretty large stones hitting it yeah I'm really hoping that it doesn't stay this bad for the rest of the 30 remaining miles we just stopped to fly the drone but it doesn't look very good I think the road might have killed the drone we had a problem like this before that the gimbal broke and I think it happened again how is it no oh no so that was a bit of a failure with the drone in the end it looks like the gimbal motor is broken or the gimbal doesn't work so basically the camera is just flopping around and it doesn't work at all yeah really really really sad yeah we're gonna have to get in touch with DJI and see what we can do about it but luckily we have our backup Mavic Mini but we didn't use it in such a long time that actually the battery level just went down naturally over time so when we started to fly it just then it was already at about 40 percent battery so we managed to get like one shot in and then it was like nope I'm done the Mini is a good backup but it's not very strong it's like a really really mini drone yeah not really good in strong winds and I can't really fly very far and it can't like auto follow you and stuff yeah so you're really really restricted with the Mini yeah yeah yeah definitely I guess that's the price you have to pay on these dirt roads things are starting to break down let's just hope the bumblebee is not breaking down that's the main thing it's the most important yeah incredibly rough as well wow wow that was really rough ah it's really annoying actually now Jesus just stopping here for a little lunch break before we joined up with the route to 40 again behind the bike because of the wind so what have we got for lunch so we had the one boiled egg and we mixed it up with mayonnaise and some hot sauce and then we have it in a wrap it's probably gonna be pretty tasty do you want some crackers in there as well yeah maybe let's crumble some crackers into there as well we're just using like all the food that we've got left over and just sort of all chucking it together so boiled egg mayo hot sauce cracker wraps job done so it looks like we're coming back on the route national 40 that is the end of our dirt roads so I think we'll just pump up our tires before we get back on in the end I'm not sure that that cut-through was worth it I hope we can organize a new drone yeah just coming off of the step wow look at this ahead that looks actually unreal what a view hey incredible the distance you can see again the snowy mountains that's kind of where heading towards so this is El Calafate up ahead and you can just about see as well Largo Argentino Lake Argentino and all the crazy mountains behind so first destination here in town is now that we check out the tourist information center that we can see and figure out how we can visit the glacier here yeah that's pretty much what this town is famous for it's the gateway to the Perito Moreno Glacier and then after we will meet Glen and Agnes again because they took a bus this morning to El Calafate and they found a really nice and cheap accommodation actually on booking.com and yeah we can spend the night together good evening guys we made it happy and alive yeah and this accommodation that Glen and Agnes found is absolutely awesome come check it out I will sleep here Ollie I will sleep here look at that I mean I'm sleeping in like a fold-out drawer bed brilliant kitchen it's a little bit messy in here because we're kind of organizing cleaning and doing everything that we need to do all of the maintenance on the road I'm doing a washing machine at the moment our socks and our underwear where everything needs to get a good wash yeah absolutely the shower is really nice too and then this is the room where the guy sleeping so very very cool very cool absolutely and this one was like 40 pounds 42 pounds for the place split between the four of us that's really not too bad a price and look the view we can see pretty much the entirety of El Calafate we can see Lake Argentino and the mountains behind it's an amazing view that's it for us today we did at the end 150 miles and we hope you enjoyed the episode if so please give us a thumbs up subscribe to the channel share the video with your friends and family comment below and we will see you next time