Testing testing one two one two.  Okay, very good. Thank you. I'm just doing a quick test test test Good afternoon everyone and thank you for joining us for today's public safety briefing led by deputy mayor for public safety fill banks Following our last speaker. We will take a few questions from the media Followed by some more questions that have been submitted by the public ahead of today's briefing I would now like to turn it over to deputy mayor fill banks. Thank you So welcome everyone happy st. Patrick's Day Let's hope that we have a very festive but safe st. Patrick's Day And I hope that it's March madness So I hope that Someone of you picked Princeton in your bracket if you didn't your bracket is going to be a little bit a little bit messed up So happy March madness everyone here. So today we are joined by three senior of every senior senior level members of the administration We're gonna be here from the NYPD chief of department the four-star chief of the NYPD and he is going to be Giving a briefing on some crom stats, but more importantly, he's going to be talking about community comp stat It's a lot of people who understand comps that have heard that term But they just develop community comp stat and chief manager is going to be speaking about that And then we're gonna hear from our corp council judge Sylvia Heinz Radix who is the top judge, right? She's the top judge in New York City, and she's going to be talking about the administration's efforts What we take against these retailers who are illegally selling license plate covers and she's going to go into detail about that And the last but certainly not least we're going to hear from the Department of Transportation Commissioner Edanus Rodriguez He oversees DOT and he's going to be giving us an overview on safety on our roadways and public updates on some of the Projects that they've been working on so we've had these meetings now three or four weeks now And we're gonna be fine tuning them and as you see each week We have different guests that come forth and you know We're trying to provide as much information as we possibly can on what we're doing But more importantly what we need to hear from you so that we can continue to do our jobs a lot better So a lot of this is communication But certainly we want to inform and be able to do our job a lot better So we certainly think for you who tuning in so tell a friend send a link if you have a link to different people because we need To hear from as much people as possible Now how do you get involved as a start go to NYC gov NYC gov and click on office of the mayor Once you do that you will receive an email and an email will inform you of what we're going to discuss For this upcoming weekly briefing and then it will give you the opportunity to submit your questions So that we can now answer your questions and kind of hear Which you've seen what you're feeling and the things that you need answers to or the things that you need us to know So that we can revamp our plans and our strategies accordingly So for the those who do we certainly thank you Please tell a friend and certainly for those who have not done it thus far who are listening for the first time You know, please feel free to go into their website. We certainly encourage you So kicking it off today. We're gonna have the four star chief in the NYPD So it's for those who don't know in the NYPD the uniform side of it You know, we have one star chiefs two star chiefs three star chiefs But there's only one four star chief chief of the department Everything funnels into the chief of the department and he is going to let us know about something that he's kicking off Call community comps that Jeff kicking it to you Good afternoon, sir. Thank you. I deputy mayor banks and good afternoon to all of viewers I bring greetings from the NYPD commissioner Sewell and I like to say a happy st. Patrick State everybody Before this forum, I was out on the parade route. I inspected everything in YPD. It's out there in full force We're monitoring all kinds of streams and at this time, there's no credible threats So I expect everybody to have a good day Enjoy themselves and to get home safely Just really quick touching on crime overall. We're definitely trending in the right direction, but it's going to be tough We're down in shootings about 20 percent homicides about 20 percent And we're pushing down most of the other crime categories that we monitor with down in robbery citywide We're down in burglary citywide. We're down at Grand Lawson in citywide We're still having some struggles with our car theft and our felony assaults But I assure our viewers our listeners that the NYPD is monitoring all the crimes With the point where we need to and we're going to keep pushing this fight. I'm confident. We're gonna have a good year What I really want to talk about is Our community comm stat that will be kicking off our first one on Tuesday March 21st So what what is the community comm stat? It's a forum It's an opportunity for the people of New York City to be able to join us discuss crime and quality of life challenges in their neighborhoods On the 21st, we will be starting with the Bronx So when you turn on to the forum, which is a virtual stream, you'll have a dais of myself You'll have a chief of crime control strategies our community affairs Bureau our housing Bureau our patrol services Bureau our transit Bureau transportation Bureau and Our city detective Bureau We'll also we have participation from other city agencies. Of course, we'll have a city hall rep We'll have a DHS Department of homeless services Sanitation the housing authority the parks department Department of Transportation our sheriff the health of mental hygiene and of course the DOE Department of Education and Our patrol borough commanders our housing borough commanders and our transit borough commanders will be providing an overview of crime and quality of life in their particular Command in their particular borough and then we'll discuss some of the community resources through community affairs It will spotlight particular precincts the precinct commands will stand up at the podium And they will discuss what's going on in their command and then of course we'll open it up for people to Ask questions and we will provide answers only thing I would ask is if you have something that's very sensitive Something that you know possibly could reveal who you are you just save that question and I promise we'll answer it offline We always have to keep people safe when we do these forums and then one other thing. I like to touch on as well Besides the community comes that the summer will be here soon today's a great day It's we're already through the midway point of March before we know it'll be spring and then summer will be here besides working very diligently to Put forth strategies that will reduce crime and improve quality of life We have to think about our youth and we're gonna have a strong youth strategy. We're gonna work close closely with dycd We're going to work closely with some of youth employment We'll open our doors to bring as many young people as possible Show them the opportunities that are available to them within the NYPD Our youth coordination officer program is expanded in every precinct. So our youth coordination officers will be working within their own precincts Doing doing a variety of programs that will focus on enrichment of the youth Academic skills sport skills and whatever else our young people bring to us if they want it We'll find a way to provide it for them And we'll use it as a way to bring value to them and have a positive impact on them and their families So these are the things I just wanted to discuss this morning, and it's really an honor to be here. Thank you Deputy mayor, you know, I had the privilege of working with Jeff for many many years In my opinion Jeff commanded two of the toughest precincts in New York City 73rd Precinct and 75th Precinct He commanded community affairs chief of patrol housing ball Brooklyn And I just want to tell you cheap that every place that you have gone to was better off that you were there And and this is not the first time I'm telling him this in terms of many many years ago so certainly I think the city is actually privileged to have you as the chief of the department and As the Adams administration is attempting to do this is actually relates to a question I was asked maybe one or two weeks ago about who's coming up here Is that constat is was a very revolutionary concept that was instituted years ago? And you know commissioner Bill Bratton has to get overwhelming majority of credit for implementing that and it was a great accountability system and Depending on what side of the day as you were on right? It was you had a different perspective in it But it actually changed a lot for the better and now the Adams administration is now saying bring other agencies involved into The process bring the community involved Let's let's open up this particular door. So I congratulate Commissioner Sewell for actually Originating this idea and moving it forward. So just had to offer. I actually think that's going to be very interesting chief So thank you for the kind words sir So next we're going to hear from our top judge in the city, right? We call up Council Head Sylvia Heinz Radix as we call her the judge That's what we call her around City Hall and she's going to speak about some legal action that they're taking And I just want to start off by stating is that early on in Adams administration We reached out to Amazon and we reached a deal with Amazon so that Amazon would not be able to they agree to not sell These license plate covers if you are ordering them from the state of New York So that was our first step and reached now So I just want to have a shout out to Amazon thank them very much And that's what that public private partnership is all about but we did not stop there We continued that particular fight and we're gonna hear now from the judge And I'm the city's lawyer see Thank You deputy mayor banks for this kind invitation to address you today And to talk about some sensitive issues that the law department has undertaken Of course, I am the corporation counsel and I had the law department that has a group of very Dedicated people who work tirelessly to protect the interest of New Yorkers One of our 16 legal divisions is tasked with filing legal lawsuits against individuals and companies That violate the law and undermine the interest of the people of this city For instance, we file lawsuits to protect tenants and members of the public who where we sue landlords Who are violating the housing laws and allow their buildings to become unsafe To get deadly ghost guns off the street we sued online retailers Illegally selling ghost gun parts into the city and today I'd like to provide you with an update of the effort that we've just started to prevent the sale of Licensed plates covers this merchandise in dangers New Yorkers And it has resulted in significant dollars of loss of revenue to the city of New York for several years And as you know License plate covers are used obscure vehicle license plates to evade law enforcement cameras and tolls These covers have no legitimate purpose, but to allow people to break the law No family should endure the loss of a loved one at the hands of a reckless driver These products promote that irresponsible Conduct the NYPD has since March of 2022 Associated unreasonable unreadable license plates with instances of traffic violence and crime Enabling reckless drivers to evade 1.5 million speed and red light cameras is is the estimated number traffic deaths during this period I have surged and and traffic fatalities Are at the highest since 2014 in addition? License plate covers cost a direct loss of revenue to the city The sale and distribution of material intended to cover a license plate is unlawful Pursuant to NYC local law 22 as well as section 402 of New York State vehicle and traffic law This past summer as was said by deputy mayor Amazon complied with the city's demand to immediately stop selling these license plate covers to New York City residents and Our efforts at this interest has not stopped several weeks ago It came to the city's attention that two of the nation's largest auto apart retailers With 33 locations in New York City were illegally selling license plate covers Through a cease and desist cis letters from the law department on behalf of the city Two of these companies were put on notice that they're unlawful sales Should stop or they would face legal action today I report that both companies has have agreed to follow the law One of the companies advanced auto parts, Inc. has confirmed in writing that license plate covers Were removed from their city stores and would no longer be available and To on sale online sale in the city We await written confirmation from the second company auto zone We've made it clear to their legal office that the city is prepared to see them in court If this promise is not kept other retailers engaged in this behavior should take notice The city is intent on enforcing its laws The city of New York will not tolerate Companies that float the law and put New Yorkers at risk. Thank you. Thank you Thank you. And those are the things that make a lot of difference, you know, those are the ears that make a lot I mean you just think about it for a second. What is the as the judge says? What is the reason or the rationale for you having? Something that's going to upscrew or cover your license plate. You're evading a toll Evading a camera or you're engaging in some other illegal activity. So I just want to applaud you and thank you very very much for that for that effort Okay, so now next up we have our DOT Commissioner, Donis Rodriguez and Though there are a lot of different agencies such as the Corp Council the police department the sheriff's office that do a lot of work When it comes to our highways the lead agency and the lead person is Commissioner Rodriguez and he's now going to take it from here shoot. Thank you the premier banks and We know that under the leadership of Mayor Eric Adams as we have seen from the premier and the judge and the chief and myself There's only one Responsibility that related that we all hiring things kept from DOT is to see a traffic a Violence as something that we are committed to eradicating and and even the data is showing Updated data showing the fatality It is also dropping, you know in different way that we're going to be showing through this slide And this is the result or partnership between you know NYPD DOT and all the agency Under our Mayor Eric Adam It is my pleasure to join you on behalf of New York City Department transportation And again, whatever I'm doing as a commission in the results of having a great leadership that I have Together with my further pre Margaret for Johnny Polo Chor Julie Berger and the great team of almost six thousand men and women that were very hard to be sure that safety industry Is a top priority? a Through our vision zero we've been able to see improving safety on our street throughout engineering Education and of course enforcement The loss of one life is too many for this administration And and we are committed to reduce it to zero the numbers of petitions and cyclists that lost the light because of crashes And we have seen reduction for the first time on traffic fatality in York City a Declining for the first time since 2018 These that these decline runs counter to national wide trends as we have seen the city being increased or crashes and and numbers going up on a fatality New York City is leading a decline of those numbers To help combat the the increase in reckless driving during the pandemic DOT last year Secure authorization to operate our speak camera 24 hours seven days a week Most crashes were happening from 10 p.m. And 6 a.m. And we went to Overnight and we secure speak camera 24 hours We also improved safety at 1,600 intersections as we continue to install Live-saving infrastructure to support save three on the delivery or a beating who oversee everything on planning in our street in slide 2 we will see how How the data that we are seeing so far this year we all those that are in here today as February 2nd 2023 all traffic fatalities are down 30 percent from 2022 and down 9% from 2019 Pedestrian's fatalities are down 32 percent from 2022 and 2019 motor vehicle fatalities are down 47 percent from 2022 and bike hill and severely injury are up 30 percent from 2022 but down 8 percent from 2019 course the whole portfolio looking at those data is also followed by Julia who is also here with us So they're doing great job in that particular area at DOT All severe injuries are up 14 percent from 2022 but down 26 percent from 2019 All injuries are off 6 percent from 2022 but down 20 percent from 2019 When we look go to a slide 3 what we see securing how securing 24 hours peak camera Enforcement was a major victory for the whole city of New York Not only for Mayor Adams and his administration Before the state granted this authorization last year this camera were not allowed to operate when a spirit Speeding was happening on on night and on weekends. We have seen remarkable result from expanding enforcement Since August 2022 the first month of around the clock enforcement the city has seen 40 percent Reduction in a speed violations. We are not telling people not to drive But we're telling people is drive at a speed limit, which is 25 mile per hour Our speed camera safe lives and this that is another reminder that this program is a valuable tool to To change driver behavior and make our street safer We are also working closely with our partners with the MTA to expand automatic enforcement on both lane on a slide for we will see how Traffic safety is not about enforcement. It's also about engineer and let's look at some of the project we completed in 2022 picture in our Bronxdale Avenue road died in the East Bronx over the five years before our project Bronxdale Avenue sold 17 deaths or serious injuries and 179 total injuries We removed a travel lane from the street and added a protected bike lane to calm traffic and support cycling Road died have shown no reduced deaths and serious injuries by 30 30 percent Sorry that and Correcting that the road died like these have shown how reduced deaths and serious injuries Happened by 30 percent big numbers there, too and protected bike lanes have shown to reduce Cyclists injuries raised by 34 percent On the slide see in slide six as I mentioned petition fatality are down 32 percent from 2022 and 2019 we are always working to protect our vulnerable streets and users Seen here is our safety project at the intersection of Broadway Flushing Avenue and Graham Avenue in Boswick Boswick Brooklyn in the five years before this project There were five deaths or a serious injuries at this intersection and 75 total injuries We extended the curve and sidewalk through shorting petitions crossing and provide safer turn for vehicle Curve and sidewalk extension like this has shown how to reduce death and severe injuries Having happening for pedestrian by 45 percent When we go to a slide seven we look forward to many great project and initiative this year This is just a sampling of what we will do in 2023 and we are already on the way Just last weekend I still we may add in to announce the star of our next phase of Broadway vision To add a new plaza and share streets along this iconic Manhattan corridor Rest assured we have exciting project across the whole board Including our plan to deliver a road died and protected by lane on some view Avenue in the bronze And on hillside Avenue in Queens where we plan to install pedestrian island So what we are showing is that when only we are looking at Manhattan. We're looking at the bronze We're looking at Brooklyn. We're looking at Queens. We're looking at a starting Island We're doing everything we have to do to be sure that we make our street safer for everyone especially for pedestrian and cyclists our team in Enclosing our team at DOT is working every day to make our streets safer for everyone who used them I can give you a sample. I had Joshua here who overseeing all the lighting pole that we have in New York City We had three hundred thousand light pole in our street So D.O.T. is the agency that run the larger transportation system in the whole nation And we know that with the support of your honor with the late leadership of deputy mayor a and a banks and many other NYPD We will continue to be sure that 2023 we will see even lowest number of their Oppositions in cycles. Thank you. That was very informative commissioner. I just to thank you It was a lot of information. I know the takeaway for me was when you know, 40% speed valleys and cameras were reduced which means people are Adhering to a degree So, you know, you've heard, you know, our information for this week a lot of good news we're trending in the right directions and a lot of different areas Does it mean it's there doesn't mean we ever get there? You know, but the a is in the effort and I just want to thank my colleagues here very much so and now Derek I turn it over to you Thank you deputy mayor We will now take questions from the media related today's announcements Please use the raise hand function if you would like to ask a question Our first question comes from you have gone in from the city You have your line is unmuted. All right. We'll try to come back to you have our next question comes from Jeffrey Maze From the New York Times. Jeffrey your line is now unmuted Hey, good morning This good afternoon rather this question is for chief madri deputy mayor banks We just won't recently about Madison Square Garden sending private detective To follow a state law enforcement officer I'm wondering if the NYPD has had any such issues as it goes about its investigative work And I'm wondering do you think it's appropriate for a private entity to send a private detective to follow a law enforcement? Agent I'm gonna take that repeat the question. I was not a one-topic question. I Didn't I missed the question. It was sort of with MSG sending a private detective Yeah, MSG send a private detective to follow a state law enforcement officer I'm wondering if the NYPD has had any such issues With that and secondly, do you think it's appropriate for a private business entity to send a private detective to follow a law enforcement agent? You know, you know that that's a question I would need more more data to be able to answer that question when they said they sent a private Investigator to follow a law enforcement I certainly would need much more information other than to answer that particular question there So if you you know, Jeff if you if you get a little more a little more about that Then I can actually attempt to give you a more intelligent answer, but just a question about a private business I don't know who they sent it on I don't I don't the parameters are it's a little bit more difficult to answer that question in that format And if I may I'm not aware of any incident where any private detectives were following Members of the NYPD in regards to anything that's going on in Madison Square garden All right, our next question comes from you have gone in again from the city you have your line is unmuted All right. Thank you very much. Oh This week the administration reached out to New Yorkers asking them to submit questions for the officials that have joined us here today We will now get to as many of those questions as we can with the time that we have left Our first question comes from John in Manhattan This is for the Department of Transportation Asking how is the city addressing commercial vehicles parked overnight on the street? Yeah, and first of all, I also want to say thank you to Ryan Lynch my chief staff also for the great job that he do Leading our agency and as I mentioned the other members of the great team that we have in leadership at DOT You know definitely a having Ryan, you know, I've been added as our chief is that it's a great accent that we have at DOT legal truck is real and trucking is a part of the topic that is very important for me I didn't you know together with the men and women the leadership the chief and that we were there with me you add And in Queens Removing illegal truck that they were parked in residential area So what we will see under this administration is NYPD Leading together with DOT and other agency EDC a plan of how we address a Truck that are in the park in illegal area. I just came from Brooklyn Terminal You know working in that area inside and outside and we know that there's a Three outside in front of the other of the Brooklyn market the truck are not supposed to be parked over there But we are you know Identifying we walk in the neighborhood and we want to be sure that the task force that we have that city hope put it together We'll continue doing all the work that we got to do to address Truck that are parked in illegal residential area. They are no allow and this is a big issue for us Our next question comes from Catherine from Manhattan Who asks what is the city and the NYPD doing to invest in youth sports in the high schools or creating more athletic? Facilities ice rinks hiring more coaches to help keep youth engaged. We wonder if this would help with teen violence Um, I believe it would help with teen teen violence, but that's not really in our purview to you know Open up ice skating rinks and sports facilities. We do work closely with our communities We work closely with our schools We do have youth centers that all offices run programs out of we have our youth center in East New York Right on the corner of Pennsylvania and Liberty Avenue where we do a lot of things with young people Involving academic sports. We have a full-fledged music studio in there. We have a aeronautics program in there So we have a lot of great things in there, but that's just one center We would love to partner up with other people or the donors and possibly open one center in every borough two centers in every borough Where not only can the police work with the youth But other programs can come in and they can do their programs with young people to keep them out off the streets I think that would be a tremendous help in our communities. I just want to add on Catherine I think it's a very you know a very good question um If the question is The more we invest in our youth doesn't have an impact on crime and the answer is yes And you know you just gave an idea and maybe we'll have in the short future We'll have a briefing where we talk about all of the city's efforts How we are investing into uh the youth and then we can hear ideas on what we need to do a little bit more of or differently So but that's not just on the nypd. That's one of the agencies of course But then of course there's the there's the do we there's yss There's just a host of different agencies and uh, we can all bring them together and have a forum or more on that I think it's a good question and uh, I appreciate the uh the question First time that the city has a A the office of sport sport and wellness A Created on the menu add-in. So this is also something that we have I don't think that many city has a office for sport and wellness And this is something that is happening on the menu add-in Our department also has a program that we are also doing now for youth And we started an apprenticeship program that will be going in this summer. So there are lots of pieces Absolutely Our next question comes for judge hinds radix People are defeating red light and speed cameras by they're covering their license plates with plastic or paint What is the city doing to crack down on this? That question may have been Right on topic we we we answer that and and we will we will continue the enforcement that At the city has and we will we are we intend taking all of the legal avenues That to ensure that people are Are complying with the city's laws and just to add on to i mean Our entire presentation was about that and the distance we spoke about amazon But also, you know the chief here in connection in coordination with the sheriff We look at the three one complaints that come out about these vehicles that have these ghost plates and these covers And there's operations that we go out to to illegally tow these vehicles there as well So if you see these plates On your streets call in three one one and we monitor that particular data We'll we'll we'll start sending out resources there to be able to uh to take action against them Next question comes from louis in brooklyn for commissioner rodriguez He asks in light of the drop of fatalities for pedestrians in 2022 What other plans are there in the works to keep new yorkers safe? Well, we oversee All our spit we overpass all the expectation that we have in january 2022 and may you add a nine in november's announce A how we improve safety of 1,600 intersection when our goal was only 1,000 in january 2022 We also did 100 race crosswalk In 2022 we also improved a number of intersections around schools and senior centers So what we have again and under the division led by every tune is that the whole planning team at dot We are taking to a new scale at the level of improvement may you add as increased 400 million dollars to dot So we will have all the resources that we need in order to improve safety Again from the length of equity and this is the different This is what new yorkers is seeing right now that in the past all attention transportation was mainly given to downtown Manhattan downtown brooklyn in long island city What we have seen right now in 2020 we saw in 2022 and we continue seeing 2023 is a more attention as giving Following the data where crashes are happening that we are also using new technology To be sure that we take care of the lighting that we take care of the improvement And also we're going back now to ovany, you know, and I stand that we center of john louis And something that is important for many items which is about improving reducing the level of alcohol That are allowed for someone when they're driving. We don't tell no one again not to drive What we're telling papa not to drink what we are telling people is about if you drink don't drive So what we are looking to accomplish is in a package or safety bills called the road A bill in ovany one is leading a Among this package is about to reduce the numbers of the level of alcohol that someone is allowed to have when they drive From 0.8 to 0.5. We are combining on vision zero Redesigning our street through engineer Education through vision zero and working with the ypd to be sure that all drivers know that we are watching then when it comes to How they're driving our street and enforcement is a condition Thank you Our next question comes for chief madry. This is a question we get quite often with summer coming up What are you going to do about noise problems? We have parties so loud that our windows shake. Where can we report this? Well, of course, you can call 311 to report any complaints as well as speak to your neighborhood coordination officers Well, we have locations that we know about in advance We can send our neighborhood coordination officers to the location We can speak to the representatives the host of the party Ask for some cooperation and just inform them that this is a quality of life issue and it affects many people We have to work in within the parameters of the law When a party's playing an indoor location, we just can't kick in the door if there's no other emergency We have to work within the parameters of the law But we're willing to go out and talk to people and do all that we can And then the places that we can do enforcement We will do enforcement to gain compliance But our first our first option the first thing we want to do is be able to talk to people Just ask for their compliance so everyone can enjoy themselves But our neighbors can sleep as well and we'll be doing that all summer long For Commissioner Rodriguez, Valerie from Manhattan asks, is it possible to make the street lights brighter at night? Or are there other ideas to increase roadway safety at night? Definitely improving safety as I said before is a top priority you know the Light the the light pole that we have in york city is around 300,000 That make it one of the cities that have the larger number So improving lighting will always be something that we are looking we always looking for new technology But I can say that when anyone you know see the command center that we have in long island city You know coordinated by do t NYPD and new york state department transportation All in your condition know that we are always looking for you know How we improve lighting and how we address you know crashes that happen at night I say before the trains Or reckless drivers is the epidemic that is affecting the whole nation All the city they're looking at new york city on what are we doing to reduce as mayors say we are 8.6 million new yorkers But we are 100 million is a different opinion So anyone can come and say at the dot and say these numbers are higher What we are looking on crashes and fatalities about those numbers are the results Or a lot of reckless drivers driving trunk Over speeding especially many of them in the highway So what I would like to encourage people is to see what are we doing at the intersections Book because before vision zero before this administration most crashes are happening at intersection What we saw in 2022 was a reduction many of those crashes were happening at night And yes, we are continuing doing everything we came to reduce or something because one One life that we lost in new york city is too many for this administration Thank you And our final question comes from christin in the bronx She asks I take the a and one train to school in the bronx same as my students When I transfer to the one at 168th street in the morning I often don't see officers. What can be done to increase enforcement to increase enforcement around school hours Uh christian, thank you. I will speak to the command and officer of that respective train district I absolutely want you to see more police officers there. I want the young people to see the police officers there We want a young people We want everyone to get to school safely and get to work safely. So we'll put some extra coverage there. Thank you On behalf of the adams administration, I would like to thank everyone for tuning into today's briefing We look forward to seeing you all at our next one. Have a great day


Hello everybody, welcome to this Outreach Linux Karen internship report. My name is Ellen Koike, I am a Linux Karen developer and also outreach alumni and also outreach co-coordinator for the Linux Karen project together with Vaishali who is the coordinator. I'm going to start with a quick presentation about the outreach program then we're going to move to the presentations from interns with Brian Osler, Jules Inge, Kaira Gupta, Burdres Pedrajas and Shriha Patel. Outreach is a remote paid internship to work with free and open source software. Interns get $5,500 a stipend plus $500 for traveling going to conferences. This year due to the pandemic was a bit different so organizers decided to pay the $500 anyway to help interns. The internship lasts for three months and interns are paired with mentors from the false communities. The program is organized by the Software Freedom Conservancy. It was previously the outreach program for women which was organized by NOM. We have two rounds per year so one in May and another one in December and the internships are financed by industry sponsors or false organizations. Who is eligible? So women, cis and trans, trans men and gender-cured people. US residents and nationals who are Blacks, African American, Hispanic, Latin, Latin, American Indian, Alaska Native, Native Hawaiian or Pacific Islander. Basically it is anyone who faces systematic bias or discrimination in the technology industry of their country and interns must be able to work full-time during the internship. So how does it work? The application process for applicants is the following so applicants must fill out an initial application for eligibility check, then eligible applicants make contributions and then they submit final application for the project. The application process for the false community is the following so coordinators sign up their community in each round then may enter submit a project under a community and the community coordinators approve the project. So this is a generic timeline just to give you an idea. So for the December internship the initial application deadline was in September 29th. We are now in the contribution period until the end of this month and the internship is going to start on 1st of December until 1st of March. The Linus Karnoff project has been participating in outreach since round six in 2013. Sage Sharpe was the first coordinator then Julia Lowell then Vaishali with Shadra and now Vaishali and me. We had a total of 50 interns and about 40 different mentors in a very diverse kind of project from several device drivers, three wide changes and other high-impact projects. During the contribution period we required interns to join the outreach Linus Karnoff main list to go through the first patch tutorial, do some cleanup in staging drivers to learn about patch structure, coding style and tools, then move to specific project tasks, start communicating with mentors and start doing the proposal to the list from the mentors. Then they record all the contributions on the Outreach's website and submit the final application. From the past two rounds, so just to give an idea, in December 2019 we had nine candidates with five slots, with projects from Spinlock, DRM, Esparas to NPS Store and last round in May this year we had 11 candidates for four slots from in networking, sound open firmer project and Linux media. We are now in the contribution period of our next round in December this year. We have four internships, four slots open with six mentors for changing internal API, scheduler, DRM, Moody Media and SPI. How can you help? So companies and individuals can donate funds to support interns. Linus Karn developers can volunteer as mentors and help reviewing patches and you can also outreach about the program in your professional circle and local communities. Here is contact information, so if you want to contact organizer you can send an email to organizers at outreach.org or if you want to talk to Vaishali or me feel free to send an email and you can also join the main list to help reviewing patches from applicants, from candidates. Now let's move to the presentation from the interns. So we have Brianna Osler presenting about improve and extend kernel networking self-test running in namespaces. We have Julis Airenge with fixed lock-related warnings reported by SPARS, four core kernel code, Kaira Gupta, Linux media and Liby camera, moodstream test support with Vink, Lourdes Pedrachas, improve and extend kernel networking self-test running in namespaces and Shria Patel, add SOF fuzzer support for IMX8 platform. Thank you. Hi, my name is Brianna Osler and I am here on the Outreachy Internship panel to discuss my summer kernel internship with mentors Deve Kharavi and Stefano Rivio. My internship project was titled improve and extend kernel networking self-test running in namespaces. In particular, the internship focused on TDC, the three-letter acronym for a testing suite of the Linux traffic control system. TDC is a unit testing suite implemented in Python. A little more about the internship. The goals of the project were to add TDC to kernel self-test in order to broaden its user adoption, promote its addition to kernel testing suites and catch regressions to traffic control more quickly. To add tests of the Berkeley packet filter or BPF classifier and to highlight TDC's scabby plugin by adding a test making use of its functionality. Lessons learned. I learned technical information, how to use certain tools and workflow with the community. Technical concepts I learned about were BPF. BPF allows analysis and filtering of network traffic. Filters that work in traffic control should be able to be replicated in BPF so I was to test and add and delete of a filter. We selected filtering on MAC addresses which involves writing a user space program to provide a list of whitelisted MACs which then get pinned in a mask to the file system for a BPF program to pick up and check against when it receives an incoming packet. TDC had this pre-existing scabby plugin and I used that to generate packets and pass them through the TDC filter. That work is actually still being completed on my end. More about that later. In order to learn about this I made extensive use of the kernel header files for BPF, read kernel code, man pages, and had lengthy discussions with my mentor to get to the current state. Tools that I worked with during the internship were MAC, Git, Git Bifects, C, Python, scabby, and BPF. The workflow. My work went upstream to the net dev community. I submitted code to Netnext and the IP Route 2 package. IP Route 2 contained the user space implementation of traffic control which can be run with the command tc while kernel slide changes went to Netnext current state. TDC has been added to kernel self-test in Netnext. Of the goals I've listed here that's the one that's been completed and achieved. I also did fix a few bugs that arose during regression throughout the course of the summer using Git Bifect and proposing fixes. My mentor David is looking into effects of the addition of TDC to case self-test on kernel ring and into better understanding adoption of TDC in current time. I do hope to get the work filtering MAC addresses out to the community here in the next month. My timeline has been somewhat slower than I had hoped for. However, I do have a working basic case that I am extending to add that MAC filtering to. I will say that actually working with that scabby plug-in was a lot easier than I thought so I'm pretty proud of that. Moving forward to talk about the experience. I did enjoy the experience of working with outreach this summer. I found the kernel community and the outreach community both to be quite helpful and friendly. IP route 2 and NetDev were both really friendly and welcoming to me as a newcomer. It was really a great experience getting to work with everybody this summer. I also learned a lot quite quickly and I'm really proud of that accomplishment. Before the start of the internship namespace, kernel self-test, traffic control, the difference between user space, kernel space, and scabby or packet generation were all new terms or ideas that I needed to learn about. In the internship application round I worked a little with a net test in kernel self-test and that was my first introduction to kernel self-test. So I really did pick up a lot during this time. I'm actually entering my third year of my computer science curriculum right now and I'm currently taking an operating system class. So it's interesting to me to see that same information presented in a different format right now. I'm very grateful to the community and to everybody who helped me during this internship and to everyone who is attending this panel today. Thank you for listening to my presentation. Welcome everyone to the outreach panel. My name is Jules Irenge. I am a PhD student. My mentor was Bokun Feng. My internship was titled Fixed Lock Related Warning reported by SPARS in the Linux kernel. In this Linux kernel internship I worked with SPARS which is a static checker for kernel code developed by kernel engineers. SPARS was originally initiated by Linux Torval himself. So to run SPARS in the Linux kernel code we run the command makec is equal to two in your directory. When you run for the first time you do makec is equal to two. For the second time when you have changed the file it is advisable to run makec is equal to one which only compiles the file that you have just changed and check if the issuer you are working on has been solved. A typical SPARS lock related warning in any file look like this. For example in a subsystem for this example I took a RCU subsystem but it can be any subsystem. We can find like warning like context imbalance so this lock warning only means that there can be a real bug here or there can be a missing annotation. Programmers can be sloppy sometimes and forget to write annotation for their codes or we might be in a situation where we have just its SPARS limit. My internship task was to go through all lock related warning in the call Linux kernel and fix the warning one by one accordingly. By fixing the by fixing I mean most of the time I added a missing annotation adding but we can add annotation like acquires. Annotation acquires only is added when the specified lock is held on function exit but not on function entry. We can also add must holds annotation when the specified lock is held on function entry and on function exit so held on entry held on exit. We can finally add a release annotation when the lock is held on function entry but not on function exits. We can also clear the warning by refactoring the code structure especially when annotation cannot fix the issue. This is a typical patch of mine a sample one it was a cleanup of 30 warning and someone in the mailing list sent me a note after reviewing saying that he was wondering whether this is a tree of mine or I'm applying this patch to my tree. I found it personally I found it quite a bit funny because I'm still in I was a kernel newbie I'm still a kernel newbie but he's talking about a kernel newbie having a tree that was funny to me. The returns are I got working I got experience exposure to the linux channel got experience working within the linux channel community I interacted with people in the mailing list I improved my understanding of the linux channel and also found a new passion I'm currently doing phd with verification of bpf subsystem. I found it quite interesting my huge thanks go to the outreach community and sponsors for making this opportunity available thanks to my mentor Bokun Feng for his guidance patience support and encouragement I would like to thank the linux channel community I had a great experience in the mailing list thank you for listening to me hello my name is Kairah Gupta and I am a junior at IIT Roorkee India I'm doing my engineering from there and I was someone I'll teach you in turn with lip camera I'm in the next kernel my mentor was Kieran Binkham let us first discuss what is whimsy so the virtual media controller driver or whimsy is used to emulate complex video hardware for testing purposes it uses the media api and reworld to be api for animulating the hardware it has a hard-coded topology which looks like this in the whimsy core which can be changed and the driver we compiled to suit the user's need it does have a look at the major problem we intend to solve during the internship so lip camera which is an open source camera stack gives support for multiple streams and it has a pipeline handler for whimsy which can be used to perform tests on lip camera but whimsy does not support multiple streams hence lip camera's multiple stream ability could not be tested on whimsy so let's see what I did the solution was divided into two paths first the multiple stream support in whimsy and second the multiple stream support in the pipeline handler of whimsy in lip camera so I first implemented multiple stream support in the pipeline handler of whimsy in lip camera using a path set by the class which allows multiple captures to attach for the single sensor so the scalar in whimsy by default triples the dimensions this can be changed using the controls but the default is three times so in case of ambiguous user impulse such as raw given 30 by 30 and RGB given 50 by 15 we prioritized the raw configurations and adjusted RGB accordingly then Nikolaus path set couldn't be used to allow whimsy to multiple stream as the path set created as many threads as the number of streams requested while in the case of multiple streams we need the frame to follow just one path by E just one thread so we decided this design for the streamer and implemented it whenever an enabling signal is sent to the start stream of the streamer it starts the stream it starts the individual stream and then it checks if a thread is present or not if it is then it unlocks the muting and if it isn't it initializes the pipeline the pipeline and then it starts the thread i.e the thread is started just one and the pipeline is initialized just one similarly if a signal for disabling is sent to a stream it stops the individual stream then it checks if all the streams have been stopped using the KRF if no then it unlocks the mutics and if yes it terminates the pipeline and it stops the thread so let's discuss the current status of this work the path set is still under consideration on the meaning list and the width pipeline which is a common object for all the streams is a common array of all the entities in the graph i have implemented it currently like this and it means improvements weren't it currently was first let's see what happens if i bit first search the graph starting from the RGB capture mode it gives the sensor in the middle well if i start the searching from raw capture sensor comes at one end while the captures come at the other end this width pipeline array is very important because it is what tells the thread the order in which the stream should be passed hence it needs to be in the correct order which is which in this case is the second order so in my implementation i check if it is the RGB which tries to initialize the pipeline if it is i go to the next entity which is capture and then i make it the know and start the searching from raw and if it is raw then there is no problem the search goes as well so this currently needs certain improvements certain optimization which is one of my future goals then i would try to get the entire path set merged i also have to change the pipeline handle of lip camda as several changes have been introduced in lip camera and pipeline handler ever since so i have to reuse it on the top let's discuss some of my other contributions as well so on the kernel side earlier mc did not show the order of expected colors over test image so a small colors which like blue in place of red or red in place of blue it's unnoticed at times which actually happen so hence i added a control which shows the expected color order description over the test image i on the lip camera side i added a stream parsing for pixel format in cam and q cam arguments earlier we had to give the hex values of the pixel formats in the argument for cam and q cam and now we just have to give their name similarly i modified the two stream helper in the camera for pixel formats b4l to pixel formats as well as for embers to give the pixel format names the 4cp values and the amber strings respectively so this makes it very much easier to understand the log and find the errors so all in all it was a very interesting experience and i enjoyed it a lot thank you there are several test screens created with the intention of testing the code of red however currently there is no standard to create common tasks such as the configuration of the space of the red name tunneled by the resultation of each other with which the logic is re-implemented of different sperms in addition to a test repeating the work carried out by other programs in addition when you need to add new tests take care of the creation and configuration of the 3rd row of a virtual test to be able to use it during the test it is a task that we consume for a long time the goal of my practice was to combine all the nuclear definition with similar work with the end of creating a standard variable base reducible that is suitable to perform the creation and configuration of virtual networks that will be used after the test this will help to create new network tests with ease and speed for example with those simple tasks you can create and configure the space of names, directions, routes, bridges, tunnels, etc. your idea of reducing the time that you could take to write these tests with the programming team you can focus on the task that you need that is to write what the test does this base module has the intention of setting it under the directorial tool testing set test net if this work is done internally between my team and these spaces are still pending to be sent it has been a great experience, clear, slow, and more useful to see how the community works, how it contributes, how it feels this is part of a community contributing from an open source the most part of this project is very well written I request you to learn from these complex algorithms and how to solve the problems hello everyone I am Shriya Patel and I am here to present my project called sound open firmware that is SOF for my Outreachy Linux kernel internship under the mentorship of Daniel Baluta so here's a little bit information about me I recently graduated as an IT engineer and I also work as a DevOps engineer at Volta's Clover since one year I have always been more interested in debugging and troubleshooting so I thought DevOps would be a great field to explore I also work as a freelancer on Upwork where I mostly deal with Linux kernel related projects and as you know I have also been selected as an Outreachy Linux kernel intern this year I started my journey with Linux kernel in my first year of engineering back then I did not even know how to install a Linux OS it took me almost three years to be here in front of you all so yeah it has been a pretty awesome journey now let's move on to our project what is SOF sound open firmware is an open source audio digital signal processing firmware infrastructure and SDK SOF provides infrastructure real-time control pieces and audio drivers as a community project why SOF what is so special about it SOF is developed in public and hosted on github platform and that is the specialty since it is very rare to see open source firmware it helps developers around the world to customize firmware for the devices they have in their mind it also improves the security of the system and ability for others to collaborate on it makes it even much better the main component in operating a DSP are a host and a DSP host has the SOF Linux kernel driver which communicates and instructs DSP on the other side DSP runs the SOF firmware and performs the processing as per the instructions received from the host now before I move on to the objective or goal of my project I would like to explain some components which I touched in order to better understand my project first is fuzzer fuzzer or fuzzy testing is done by a software component that generates random inputs and sees behavior of the system SOF fuzzer is an IPC fuzzer that loads and manufactures IPC to send two DSPs it acts as a host in our system which means we use a fuzzer instead of a linux kernel for now the process is the process for fuzzer goes something like this it first initializes the host platform establishes connection with the DSP reads the topology file sets up the DSP accordingly sends the first IPC signals our next component is QMU DSP emulator it is used on the other side of of fuzzer which means fuzzer will be on site A and QMU DSP will be on the opposite side which is site B it acts as the DSP QMU emulates the IMX8 DSP for example it emulates all the functions of the IMX8 which would include what to do on particular instructions how to react to some changes what responses to send back now the next part is messaging unit this is the most critical part of our project messaging unit is used for communication it has two processors one is processor A and other is processor B messaging between these two processors is done with four write only transmit registers and four read only receive registers which are present on both the side of processors also to control these messaging we have two more registers called status and control registers again on both the sides so finally how do we how does all of this fall together i have created a rough diagram to show the workflow here as you can see we have two sides side A and site B fuzzer is on site A which is acting as a host and QMU on which IMX8 DSP has been emulated is on site B in between we have shared memory and we have also emulated MU here MU A acts as the processor A which carries the messages from the fuzzer and MU B acts as the processor B which carries the messages from our DSP site so that's the kind of architecture and workflow here what has been my role in all of this we had a working progress implementation for IMX8 fuzzer that didn't work because MU was not emulated correctly and since there was no proper communication happening DSP never booted so to fix MU implementation I had to understand the components like fuzzer messaging unit QMU APIs or SOF firmware all these things are critical to understand to fully implement a testable emulation this meant a lot of digging and jumping around the code following function calls getting lost on the way doing it all over again so finally we came up with an implementation that successfully emulated MU and our pipeline was executed successfully now let's have a look at the terminal output of before and after phases for better understanding what changed after fixing the messaging unit in this picture as you can see I have highlighted a message which says DSP boot timeout platform IMX8 failed to initialize this means DSP waited for some time to get the message from fuzzer via the messaging unit but it never received it and hence it timed out after digging debugging and digging a lot of code we understood that there were problems with the messaging unit emulation in the next slide you can see the output where it says firmware boot complete which we finally got to see after correcting the MU implementation firmware then also successfully parses the topology file that we provided and that's the happy ending so I would like to conclude my presentation by saying thanks to my mentor Daniel Balluta I wish I could be his student forever there is a lot to learn from him a lot of thanks to Julia Leval and Jonathan Cameron for always supporting me throughout my Linux kernel journey even when I knew least about it outreachy coordinators and organizers have been amazing and did a fantastic job thank you all thank you for watching our interns and also thank you for their presentation and all their contributions to our community please sponsor outreachy or become a volunteer thank you


So the date the tour is there something different about today? Yes, it's a large group. It's a tour. You've never been in the area It goes off to get me mounted in another process and it can become a sheet. It can become, maybe became one of those gaps, the holes until then you got two. We'll remember you, but this might help you for us. So we're going to put that on right now. I'll put it on right now. We toured the Alcan facility today and got a feel for what the expansion is going to mean. It's going to be huge. It's going to reduce their carbon footprint really significantly and it's going to increase their capacity. So as a productivity gain, it's really big and the lesson in this is that you come to a place, you come to Alcan, which has existed for over 50 years in British Columbia. The product of really purposeful private sector government community involvement and has created thousands of people years of jobs and the lesson in this is that if we want to have jobs in British Columbia, government has to do its part in enabling their creation and then the private sector will step up and make it happen.


Monsoons impact millions of people every year. Farmers rely on rain for their harvests, and lives are threatened by flooding or landslides. And yet, it remains very hard to predict monsoons early and accurately. European researchers have now devised a way to estimate the monsoon season in India. This innovative approach uses a rare isotope, Beryllium 7. The forecasts are not only more accurate than traditional methods, but also available earlier, which could give governments and residents more time to prepare. This unusual weather-tracking approach works because of how air circulates on earth. Each hemisphere features three large-scale patterns, or cells. The Hadley, Farrell, and Polar Cells, where two cells meet is a convergent zone. Monsoons, seasonal shifts in wind that trigger heavy rain, happen at the Intertropical Convergent Zone, or ITCZ. Monsoons are seasonal because the earth's tilt affects the ITCZ's location. In the summer, sunlight is strongest and warms the air more to the north. That coincides with India's rainy season. In the winter, the ITCZ and hence monsoons move south. Beryllium 7 comes into play because it can trace what's happening in the atmospheric cells. It's created in the upper atmosphere when cosmic rays bombard nitrogen and oxygen atoms. The isotope attaches to aerosols and is transported in atmospheric cells. Beryllium 7 can then be detected by ground monitoring stations and therefore help predict monsoons based on the movement of the zones. Beryllium concentrations are high, right under the Hadley Farrell Convergent Zone, where air moves downward but low in the tropical area under the ITCZ. It turns out that when these fluctuations are plotted from stations in Russia and Australia, the Beryllium 7 concentrations follow opposing trends. When the concentration at one location increases, it decreases at the other. The researchers found that they can predict the start of the monsoon more than seven weeks in advance. With an accuracy of three days, that's an improvement over current methods, which predict monsoon arrivals only two to three weeks ahead with an accuracy of plus or minus five days. Similarly, monsoon withdrawals become predictable with this method about six weeks in advance and accurate within plus or minus one week. The longer lead time could save lives and help India's economy. The researchers also hope to apply their novel technique to other monsoon regions and other seasonal weather phenomena influenced by the movement of the atmospheric cells.


This session is about Kubernetes and confidential computing, so hope everybody's in the right room. My name is Moritz Eckert. I'm, yeah, having a background in the software system security space, a lot of, like, binary analysis, reverse engineering, spend a fair bit of amount of time in the capture-the-flag competition scene and, yeah, on my day job I work as a, yeah, architect at Agile Systems, which is a startup from Bochum, Germany, and we build open-source software for confidential computing. On the right-hand side here you can see at least some of the team in our office. I'm also a member of the organization team for the Open Confidential Computing Conference, which is a free online conference focusing just on confidential computing that happens online every year in spring since three years now. And I also attend a lot of conferences giving talks just to spread the message a bit, do a bit of educational work for this fairly new topic of confidential computing, which also, yeah, which brings me to this talk. What I like to talk about today is first giving an introduction. I know there have been two other talks on confidential computing here, so if you've seen them and you saw the introduction or you attended a talk at some under-conference, you might be familiar with that. I'm sorry to bother, but yeah, it's still a fairly new topic and I don't want to lose anybody, so I will give a short introduction, the fundamentals, and then we focus on, first of all, why? I mean, this is a security technology, so the threat model and the use cases are kind of important, and then we will see how we can actually use that a more practical approach and see how this fits into our cloud native Kubernetes-based world in the cloud. All right, so if you've heard anything about confidential computing, you probably have seen that graphic, where the states of data and how we protect it, you all are probably familiar with the fact that you can encrypt your files, your disk, whatever is your data at rest. That's pretty much straightforward and we can, if we send data over the network or some other channel, we also have transport encryption for that. Yeah, that's nothing new. What confidential computing brings into play is now that we want to protect the data also by its use, I'm pretty much filling the gap, so then we can have encryption or protection in all states of the data, making it possible for the first time to have real end-to-end encryption or protection of that data, and there's not only confidential computing that aims for that goal, there are other solutions like common-morphic encryption and some other privacy-enhancing technologies, maybe. So the way confidential computing approaches this is via a hardware feature, new hardware technology, that creates usually called trusted execution environments, that means a space, a context from your processor that allows to isolate your code and data from the rest of the system, from the rest of the hardware, and that adds the nice property that the data is actually encrypted while it's in the main memory and that you have a form of remote registration. Remote registration is probably a term that pops up in other areas as well. With confidential computing, the goal is that you can attest cryptographically proof the integrity, identity and confidentiality of your trusted execution environment from a remote location and basically have the root of trust only in your hardware, in your processor, in your CPU. What that means depends on the implementation of this trusted execution environment. We'll take a look at now. Probably the first iteration and most have heard of it by now in a good or in a bad way is Intel SGX that isolates an individual process. So your trusted execution environment is a process that's isolated from the rest of the system where your code and data resides and the advantages that a process can be very small. Very little amount of pages inside that process that are inside this confidential context. The disadvantage of Intel SGX is that since your guest OS or your system is not part of that context, anytime you have a context which you also have now a context which from that secure trust execution environment to the untrusted world which can have some significant impact on your performance and also means that you don't have a regular system interface. So you can just lift and shift any kind of application into an SGX, TE or enclave, whatever you want to call it. Instead you either need to adapt your application or you need some compatibility layer like a library as. Think of like a vine emulation in Linux. If you're familiar with that concept in a similar way you need to do that here. So small context but no real lift and shift. And the next generation if you want to call it like that is now that the latest hardware generation instead of isolating a process we cut off above the hypervisor and isolate an entire VM. That means the guest OS of that VM is also part of that context. We increase this confidential context but the advantage is now that we have a more better interface for running applications inside. They have a full system interface, they have a kernel on a guest OS inside. So here we can have a better lift and shift approach. And AMD SCV was probably the first implementation of that that now is available in the third generation called SCV S&P Intel has an addition to SGX called Intel TDX that follows the same pattern. ARM has a specification called ARM Confidential Computing Architecture. There's a reference specification for RISC-5, IBM Secure Execution is the same thing essentially. So this is where we are heading, where we already have confidential VMs isolating an entire VM. So far this exclusively focused on CPUs but we see a bit of a trend that especially with this AI hype that we are not only dealing with CPUs anymore. What about GPUs? And it's just a processor, right? So we can have the same properties. We have isolation of workloads running on that GPU. We have the memory encrypted. We can also test GPUs technically. And NVIDIA has now released with the H100 the first implementation of pretty much the same principle for trust execution environment on your GPU. And essentially the way it's now attached to that context is that you have a confidential VM. There's a driver. It does the communication with that GPU, does the attestation and connects that to your context. And in the future this other PCI Express devices will follow a similar pattern. So we can have network accelerators and so forth working more or less in the same way. Any questions regarding those hardware principles, building blocks? All right. So the question is why would we do all these gymnastics to create those trust execution environments deal with these hardware extensions? What are the use cases and what is the threat model for these use cases? And the first one is definitely infrastructure security. There's this notion of the cloud just being somebody else's computer. But the idea remains the same if we move out of our own hardware or do we even trust our own hardware and move into a space where there's shared resources, where there's a third party, a service provider having direct access to that or some edge location that's potentially hostile. How can we protect against the infrastructure? We'll go into detail of that use case in a second. The other use case is more of like new types of things you can implement with that technology and multi-party scenarios. Confidential computing is not the only solution making this possible, but it's probably one of the most performant one right now. There was a talk, there was the Confidential Computing Mini Summit on Monday and Sven Tieflinger gave a very interesting presentation on how we can combine different privacy enhancing technologies to implement such multi-party scenarios and Confidential Computing can play an integral part into that. Yes, with all I said, the GPUs with all of this hype about AI, large language models, they also embarked a discussion on now that there's somebody owning that model providing that service and we're feeding that data either through wire training or also via inference. What if this data contains personable identifiable information? Or if the data potentially contains some intellectual property from a company, do we need to shut down, should we block chat GPT for example? So there's a lot of interesting use cases that embark from that. Can we provide any type of AI solution in a privacy-preserving manner or can we bring models to where the data is and protect the model so the owner, if there's the owner of the model, doesn't need to fear about losing their IP. And finally, supply chain security. Confidential Computing of course can be like the last link in the chain where you also protect the environment your solution is then running in so all of the links before don't end up in an untrusted environment but it can also be applied to the actual supply chain itself. Mike Brazell gave a really cool talk on that on Tuesday at Supply ChainCon on how you can apply confidential computing to those stages and really establish trust for the environments where you package, where you build or where you sign your software. So infrastructure-based threats. As I said, confidential computing is not a solution that will solve all your problems. It's really important to get the idea that we're not talking about attacks through the front door, a vulnerability in your application, a CVE in your container. You expose that by the internet and somebody exploits it. Confidential computing won't help you there. But we're talking about threats where there's more than indirect access. Another tenant in the cloud gaining access to the cloud infrastructure and going vertically horizontally through that infrastructure and into your application or your data. Or somebody that has legitimate access like a foreign government that demands access to that. Or just some employee that might get compromised and somebody's attacking you via that vector. And of course right now this is mostly the concern of very regulated or paranoid industries. They either fear their IP or they're dealing with very sensitive information and they simply can't modernize their IT. They can't adopt the cloud because they are simply not allowed to, either because the legal says no or their fear about compliance. So their confidential computing can be a very promising solution where you can say I can isolate myself from the infrastructure because of the properties of runtime encryption, isolation, and then attestation. I can also verify, cryptographically verify that what's running there is indeed isolated. I said currently the focus is mostly on highly regulated or paranoid industries. But Marc Racinovic, the address CTO at OC3, gave a keynote where he said we're heading towards a fully confidential cloud. Whatever fully confidential cloud means, I think the general idea is often referred to the Let's Encrypt movement, where initially before Let's Encrypt getting a certificate for your website was very tedious and there was not a lot of HTTPS traffic, simply because it was not, was hard to get there. Let's Encrypt and the ease of making this use of TLS allowed to really make this the norm. And today it's hard to browse the web without using TLS encryption. Most browsers won't even let you easily surf to a website. And I'm not saying that it's the same, right? That transport encryption is the same as runtime memory encryption or confidential computing. But there's definitely something to be learned from there, some lessons. And the first one is I think definitely my focus is we need to make this very easy to use. We need approachable, usable, make it almost invisible so that you don't have to deal with all of the details, but instead can just adopt this pattern and then become more to the step where we say, like with TLS, right, initially I would just have my bank, my online banking have used HTTPS and you were saying, why would I use that for my personal blog? There's nothing secret about it. And similarly here we could say, there might be a future where you say, why would you not use the trust execution environment and confidential computing? Because it's just there and it's encrypted. Yeah, and of course we need to make it abstract. We need to make it neutral. When the neutral confidential computing is very vendor specific technology so far. And yeah, finally commoditize confidential computing in a sense. And we're here at Open Source Summit. So the question is why is Open Source so essential also for confidential computing? I mean for the obvious reasons. Don't need to tell you that. But with confidential computing with this notion of remote attestation, the fact that whatever you are testing needs to be somehow verifiable, semantically verifiable means that the software that's verified there, you need to have access to that source code. Otherwise you're verifying a black box and you say, well, you can say, well, this is the black box I might have seen before, but you don't know what it's doing. So there's not much gained. So yeah, attestation requires, in my opinion, requires Open Source, right? Any questions regarding the threat model or the use cases? Okay, so let's see the how. That's the interesting part of this presentation. I probably don't need to explain you that, but just for a slide here. Yeah, if you consider a Kubernetes cluster or typical cloud environment where we have a Kubernetes node, it's usually a VM, at least if we talk about the cloud, or workload package inside a container that runs in, or that is handled as an entity called pot, and they are scheduled and reside in those nodes. And then the node has some agent called the kubelet to talk to the Kubernetes control plane, which itself are just a specific type of node that runs the orchestrational services of Kubernetes. And we can have multiple of these VMs. So our question is, I have my containerized application. How do I make use of confidential computing? How can I deploy my application as a trusted execution environment, potentially in the cloud? And the first approach would be how we do that with SGX. SGX, as I said, is just a process-based solution. So you can package your container by basically making the process that's running inside there in SGX. And that's more or less it. The question is, how do we do that? As I said, it's not straightforward. You can just lift and shift the application. It's a bit more tedious. So there are different projects that try to aim to make this more easy. But I would still say that this mainly applies to where you write new types of application and not really lift and shifting existing applications. So there are definitely two approaches taken. One is having a language-specific runtime, like ego for go or ENOX for web assembly, or as I said, this library as a space pattern where you have a compatibility layer like Oculus or Grammina, and that they try to make it a lift and shift of experience to move your containerized workload into an SGX enclave. So what you do is basically repackage your application with one of those tools, create a container, and then you need to make SGX available to those containers. And SGX appears, for ENOX, appears more or less just a device, or is a device. So there's an Intel device driver that you install in your cluster, and that, first of all, exposes the SGX device to your containers. And then it adds some form for making this schedulable. So essentially, you add some annotations to your deployment files where you say, for example, here, I need that amount of memory from my enclave, and then the scheduler knows, first of all, that this needs to be moved to our node where SGX is available, and how much resources this consumes from an SGX point of view. This is for Gram or Grammin. And then you can have multiple containers for running SGX if you have the nodes available with SGX capabilities. And then this is pretty much where we were a couple years back, facing the problem now that we have all of these SGX enclaves running in our cluster. How do we orchestrate them? How would we provide a config map to that SGX container and can still be, and can trust that what we specified in the config map ends up in the container? Or how do we provide it with a file? How do we attest all of these enclaves, all of these SGX containers? We need to verify that this is really an SGX enclave running there, and it's really the enclave we expected to be running there. Because we can trust the Kubernetes control plane. It's in the untrusted world. We can trust the Kupelet. How do we do that? How do we allow them to communicate with each other so that the container on the left knows that the container on the right is also running inside an SGX enclave, and it's the enclave it expected to be there, and then establish a secure communication. So this orchestration is a challenge. And yeah, we built an open source project called Maverun to tackle these tasks. Essentially the idea is that you create a trust controller. When I say trusted controller, I mean a controller that itself runs inside an SGX enclave. That is there for, first of all, bootstrapping this deployment, and then for you for orchestrating that during the lifetime of this deployment. So essentially you verify the controller, you provide it with a policy called manifest, and then it takes care of these tasks. I've mentioned testing the individual containers, providing them with their identity and configuration and then allows them to build up a microservice architecture. And there, Maverun is not the only solution that's based. There are a lot of proprietary things that do similar things. The cloud provider like Azure has something in place. But yeah, Maverun is probably the, I wouldn't say the only, but the most prominent open source solution for this. All right, what it would look like from a deployment kind of perspective, you would create a Kubernetes cluster. All your nodes need to have SGX capabilities and then you create the device plugin or install device plugin. If you want to install Maverun and go through that procedure and then you apply your application with those edit annotations and then your scaler would put them on the right node and things would roll out from there. That's how the SGX world would look like. Any questions regarding that? Okay. There's a prominent example for this. In Germany we have the electronic health records that's currently being rolled out, currently opt in, potentially opt out end of next year. And the specification for this specifically requires that the operator of that system is excluded from the data itself. And yeah, confidential computing provides promising solution to implement such system. And in fact, there is a production environment for the APAR that is based on SGX. Now, it kind of matches here because new types of application like new implementation anyway and small trusted context and an easy ability to exclude yourself or the DevOps and the administrators from that application. The second approach and as I said, confidential VMs is more of where the future is because it's the better abstraction for really not caring about the confidential computing specific cards when building and packaging your application. And the next approach would be bringing together confidential VMs so MD, SEV, TDX and containers. And the general idea probably the most promising is the idea of using VMs for every container or every pod in your Kubernetes cluster. So that means instead of just creating a container you create a confidential VM when you create your pod. And ideally that would be in a nested way so that you have your note which is a VM and then you can have a nested VM for that container. Nested is a tricky thing and especially nested with confidential VM with confidential VM is a very tricky thing. So this currently is not possible. There's a preview on Azure that allows you to do that but otherwise we're not quite there yet. Instead a pattern emerged where you say I use something like a remote hypervisor where instead of creating that VM locally you create that VM just somewhere else in the cloud and tunnel the traffic through. So that means you don't need nested. You have a workaround around that. The downside is of course you now deal a bit of an overhead. You need to create a separate VM in the cloud for every pod and you need to handle the traffic and the interaction. The concept is based on Cata containers. Some of you might know that creating VMs for pods the idea is essentially for Cata the idea is to protect your infrastructure from the container and turning that concept around is essentially what we have here and there's a CNCF project called confidential containers that implements that. Super promising project. Unfortunately there are still some roadblocks. Some things need to be implemented in terms of making this work. Some prototypes already exist and the main problems that are coming up is the same with SGX. We don't trust the control plane. We don't trust the Qplit. How do we do orchestration? The problems I described, right? Providing a config map to such a confidential container. How does it work with attestation? How do you verify that? With Mabra need to be applied to confidential containers. There was a talk specifically on that here on Tuesday from Magnus. So a lot more of the details about this project, where it is and how it works. I'm not going to go more into the details of confidential containers. If you're interested, please check the recording. Super cool talk. The last approach would be probably the straightforward one with confidential VMs and how we bring that into a cluster by taking what is already a VM and applying the confidential VMs there. That means our Kubernetes nodes. So instead of applying it on a container, we apply it to the entire VM, the entire node. And this can also include the control plane. Then you have to deal with the problem again. But you can also include the control plane and essentially create a confidential context for the entire cluster. And there it shifts a bit, right? Before you could isolate a container or a process inside the container which probably is then the same. But now you isolate the entire cluster. So it's a different threat model. You don't exclude the operator of the cluster anymore, but you isolate the cluster against the infrastructure. So this is the thing that makes sense if you do want to lift and shift and you can't trust the infrastructure, you can't trust the cloud service provider, you want to isolate against that, but you don't want to isolate against your own administrators. So not the electronic health records type of thing, but more this lift and shift thing for regulated industries that want to adopt the cloud or I don't know deploy a cluster for themselves against that. And the cool thing about this is we can use that today, we have the confidential VMs. We don't have the problem of nested virtualization. We have a project called Constellation that implements that pattern that shields the cluster as a whole. And the technical trick here or the challenge is how you can make an entire VM verifiable, attestable, how do you build up the NodeOS image, how do you do the attestation procedure and continue to do that during the lifetime of that cluster. And if you solve that then you can have an isolated cluster. So the workflow for example for Constellation would be it's more or less than like a Kubernetes distribution that is don't really want to make comparisons but essentially if you want to create a Kubernetes cluster in the cloud and don't want to use the managed offering. That's more or less how it feels like. You use the computer resources, the VMs and then you have client-side tooling like that here. You can of course also use infrastructure code like Terraform or so. But essentially what needs to be done is creating that infrastructure, creating that confidential VMs, as a cluster and as I said, then it's isolated as a whole so if you go inside, if you have access to the API server from the inside then it's just Kubernetes. So you don't need to deal with these orchestrational tasks. You can just use Kubernetes as is. Examples for Constellation of course there are a bunch of them it's really hard to pinpoint right, it's any kind of application that runs in Constellation, sorry that runs in Kubernetes and you want to shift that to the cloud because it's a lot of regulated industries. Yeah, it's a lot of this more healthcare, public sector kind of applications like a hospital information system or a collaborative tool like Nexthelter and so forth. But one very cool use case was OCCRP. It's an investigative journalism organization that targets organized crime and corruption and they have very very paranoid for legitimate reasons and want to be very sure that the data they're collecting their sources need to be completely protected and isolated from the infrastructure and they make use of Constellation for running their software in the cloud and there's a case study you can find online that, yeah, super cool use case. Questions on either SJX, Confidential Containers or Constellation. Alright, takeaways. I think important to understand is that confidential computing is not a solve to all your problems solution it adds these features, runtime encryption attestation and isolation and this shifts a bit of the trust model to the cloud. Depending on how you implement it it allows you to exclude a fair amount of chunk of the stack we have in the cloud today so that you can reduce that to trust the hardware you trust the CPU of course and of course you trust the vendor in a sense you do that already if you run on a CPU you trust that it does the computation correctly but we can reduce the trust to that now and of course then we trust the software that runs inside the context and depending on how big the context is you have to trust more or less components that's the idea and yeah, we have the three approaches SJX it's probably a bit of like the legacy of confidential computing but as I said there are still use cases so I thought it would be interesting to also show that confidential containers very promising very much looking forward to what's coming there I would say it's not right yet for production but there's super cool concepts in the pipeline and then the more straightforward approach with the downside of having a different model where you can't exclude yourself but you exclude just the infrastructure then you get real like the closest you can get to lift and shift check out the confidential containers talk from Magnus to learn more about that so now the question is how to get going how can I bring that to use where is it available the important thing is you need the hardware you need the AMD, SMD chip the TDX chip or the SJX chip and your processors where can I get it and I would say most cloud providers have some form of confidential computing offering first of all they have the infrastructure as a service so they have the confidential VMs or the SJX capable machines I think it's fair to say that only IBM and I think Microsoft have the Intel SJX and all others all of them have the confidential VMs this is the focus now AWS has something that's called Nitro Enclave I didn't cover that today to not overwhelm you but AWS now has also SCV capable machines and you can go there and you can create these as infrastructure as service and you can of course use any kind of projects use confidential containers and you can create a bit of prototypes or create a constellation cluster today on any of these and much more just try to put the big ones on here alright that's it if you have any questions I guess we have a bit of time left thank you yes hello thanks for the talk I'll make the same question I made too what about monitoring of station computing and I probably have to give you the same answer it's monitoring is a tricky tricky challenge we need it but it somehow contradicts a bit of these confidential computing principle that your thing is isolated there's no physical law that will prevent to build smart solutions for monitoring these but we need some concepts for that so what you can do today is from the cloud provider's perspective this is infrastructure there's a VM or there's a confidential VM you get some kind of observability from there you can't get the full observability because you can't peek inside so then you need monitoring from the inside for example for constellation you can deploy your usual monitoring stack inside constellation it's a Kubernetes cluster so why wouldn't you and then you need to make smart decision on who has access to that monitoring what kind of data is visible there and what are the endpoints where this is consumed and for confidential containers it's probably similar with the additional challenge that you only trust the container itself and you can't trust the rest of the Kubernetes stack so there's a bit more challenges involved thank you for the talk so what's the largest challenge do you see for the third approach the cluster the largest challenge for the the largest challenge the biggest challenge is that because you exclude the control plane from you include the control plane in that confidential context your service provider like your cloud provider can have access to that because if they have access you break that isolation that means you can't straight forward you can't really implement this as a managed Kubernetes offering this if you go to I don't know Azure or Google today they will offer you a GKE with confidential nodes that doesn't include the control plane and this gives you runtime encryption for those nodes but it doesn't have any kind of isolation or like no real isolation against the cloud provider or the infrastructure because as soon as you get access to the control plane you get access to the cluster and the reason why they don't include the control plane because then they would need to exclude yourself and how can you make it this managed without being excluded and of course the constellation we try to implement a lot of approaches to make this easy, make this feasible but in the end this is the challenge do you guys do any sort of performance testing for example like the SGX the process based confidential computing performance is usually one of the biggest concerns and therefore that's focused for us yeah it's hard to pinpoint and say you get like 5% overhead really hard to say if you ask the hardware vendors Magnus already said that they will tell you something like 2% and then the question is 2% of what is that realistic and is the main overhead so what we observe is the runtime overhead is actually not that high so between 2 and 10% is also what we observe but is that the main source of overhead is more on the IO side probably with SGX the context switches so if you do a lot of IO that's the biggest concern with VMs we see better performance due to this context switch not happening too often and yeah on our get a repository you find benchmarks for example for constellations specifically running applications inside confidential VMs and yeah it varies a lot but usually you're in that I would say around like this 10% mark right roughly for an application but then 10% of what is the runtime overhead or let's say if you have a GitLab or I don't know a chat like a rocket chat how many users you can surf in parallel and then you have like a 10% reduction if you run it on that 10% for like AMD SCV S&P yes that's currently on AMD SCV with SGX you can generally say one is worse than the other but I would say SGX because of these context switches is more prone to overhead thank you any more questions alright thank you very much enjoy