Hello, everyone. Welcome to Cloud Native Live, where we dive into code behind Cloud Native. I'm Annie, and I am a CNCS ambassador, as well as a senior product marketing manager at Camunda. And I will be your host tonight. So every week, we bring a new set of presenters to showcase how to work with cloud-native technologies. They will build things, they will break things, and they will answer all of your questions. So join us every Wednesday to watch live. So this week, we have Matei David here to talk with us about mutual TLS on communities with liquidity. And a few other exciting announcements from the cloud-native sphere is the Cloud Native Survey 2022 is happening as we speak. So remember to give your answers and provide input. And as well, if you are attending the marketing committee meetings, that meeting will be next week, this week, as well as if you are looking to have these kind of great events happening in your company or whatnot, Q3 calendar booking for CNCS events has kicked off, so get your slot now. And as always, this is an official live stream of the CNCS, and as such, it is subject to the CNCS Code of Conduct. Please do not add anything to the chat or questions that would be in violation of that Code of Conduct. Basically, please be respectful of all of your fellow participants, as well as presenters. But now, I'll hand it over to Mate to kick off today's presentation. All right, thank you very much, and welcome everyone. Just gonna start by sharing my screen, as we typically do with these presentations. Cool, so yeah, welcome to MTLS on Kubernetes with LinkerD. I'm going to go to the next slide in just a second. All right, so my name is Mate. I'm one of the LinkerD maintainers, and I'm also a software engineer at Point. I also do not look like in a picture anymore, but it's the only one I have, so we'll have to make do for now. I've been with the LinkerD project for about two years and a bit now. Actually started as an external contributor when I was a student, and I was involved as a mentee through a CNCS Community Bridge Program. And yeah, been around the project for a long time, worked on a lot of different bits and pieces. And if you have any questions after this presentation, you have my handles right here on the slides, you can reach me on Twitter, Slack, or GitHub. So yeah, say hi, or if you have any questions, let me know. Cool, so today we'll talk about MTLS, but before we actually get into what MTLS is and covering protocol details, I'm just gonna give a brief introduction to computer security. So we'll talk a little bit about authentication and authorization and stuff like that. We'll move on and cover TLS as a protocol. Then MTLS, they're super similar, just a bit of a spoiler there. And then I'll have a demo with how you can get MTLS out of the box with LinkerD. So super simple. I usually like to be a bit more theoretical, but I think for the purpose of this presentation, we're gonna see more of a demo and sniff some traffic with D-Shark and just try to understand what's happening there and how we can verify MTLS in a Kubernetes cluster. Cool, so with that out of the way, I'm pretty much ready to get started. So like I said, I want to cover some computer security basics first. And I think if we talk a little bit about authentication and authorization and what those words actually mean and how they sort of fit in the computer security context, it's gonna be a bit more evident on the value that MTLS brings and why we need MTLS to begin with. So authentication is the foundation of communication security, or at least that's what I like to say. I'm not a security expert, by the way, by any means. So this is all just stuff that we're sort of dealing with and stuff that I've been learning on the job and in my personal time. But when we say authentication, we pretty much mean the process of identifying a user or a system or a device. So it's nothing too complex. It just means that when we do have a communication channel, we just want to make sure that the person that we think we are talking to is the person that we actually want to talk to. And this matters in computer security because oftentimes people think that once you have encryption, you have security and those two can be used interchangeably and they're synonyms, but that's kind of far from truth, at least in communication security. So when we talk about communication security, we typically want to have more than just encryption. We want to have some guarantees placed around our communication channel to sort of give us this security. And generally security experts and people in our industry like to use a simple model when they first start to create security systems or when they first start to put security into place. And this model is called CIA, it's the CIA triad. It's kind of a handy mnemonic to sort of understand it to sort of remember it. But CIA refers to confidentiality, integrity and availability. And when we say confidentiality, we basically mean that we want the data to be confidential and only accessible to the parties that participate in this communication. So this is where encryption sort of shines through and also where authentication comes into play because first of all, we want to make sure that our data is encrypted and nobody has access to it, but we also want to make sure that we only send this data or receive data from the advisor, the person that we want to communicate with. Data also needs to have integrity. So you don't want your data to be tampered with while it's in flight.  It would be a bit awkward if you receive some other bytes and it doesn't make sense. Inavailability sort of speaks for itself, right? Like you can have a very complex and secure system, but if it's not available, then well, you haven't really done anything with it. Perfect. There's a point from the audience already now. Hey, all right. So Denan asked, will the slides be shared afterwards? Yeah, I can share a link to the slides, no problem. I'll do that. I'll try to do that after the presentation, but we'll see, maybe I can do it while I'm presenting. Speaking and typing is not really my strong point though, so we'll have to see how it goes. But yes, I'll share the slides. Perfect. The reporting of the slide will be also available in YouTube afterwards, so everyone can check that out as well. Cool, thank you very much for the question. All right, anyway, what I want you to remember from the slide is that authentication kind of falls into the confidentiality part of security. And MTLS and TLS's protocols give us confidentiality through authentication and through encryption, as we'll see in just a second. But before we go to the TLS protocol, there's one more thing that I want to cover, and that's authorization. And I think in my job, sometimes I see this misconception where people think that authentication and authorization, again, mean the same thing. But that's also a bit far from the truth because authentication powers authorization. So a really handy way to tell these two apart is by the questions that they're asking. So with authentication, we're generally concerned with, are you who you say you are? That's the question that we want to be asking. And in the real world, we implemented through tokens and certificates. Offerization, on the other hand, is are you allowed to do what you want to do? And obviously, that requires authentication because to tell a device what it's allowed to do, you first need to identify that device. And in the real world, authorization comes in a form of access control lists or policies, generally, but not always. Awesome. So we're ready to start digging into TLS as a protocol. But before I go into the diagrams, really quick example of how TLS looks like in the real world. So I do not want to assume any prior knowledge about any of this stuff that I'm presenting, by the way. So that's why I'm going to be going for all of them. But a real life example is when you actually use a browser. You go to Google.com, you connect to Google and in the address bar right next to it, you will see a little lock. And what that lock basically means is that once the connection established between your browser and Google server, behind the scenes, the two kind of negotiated encryption. They negotiated encryption and as part of that whole process, the server sent a certificate with some key material and the browser looked over the certificate, looked at the key material sort of, and it knows to trust it because it's been signed by another certificate or an authority that browsers implicitly trust. And out in the world, I think there are like seven or eight such authorities and they're the authorities that generally issue certificates for other people and other devices. So that's why your browser trusts it. It's basically bootstrapped to trust whatever certificate signed Google certificate. So with that in mind, don't worry if it doesn't make sense yet, we're ready to go into the belly of the piece, so to speak. So over here, I have just obviously a very simple diagram that kind of details what happens with the TLS protocol. So TLS stands for transport layer security. It's a connection oriented security protocol and it runs on top of TCP. I'm saying this because it's very important to know that it runs on top of TCP because it gives it a lot of flexibility. Once you have a protocol that runs on top of TCP, it means that whatever application layer protocol use, it could be HTTP or GRPC over HTTP, which I guess is still HTTP. You can still use it. So it's pretty much protocol agnostic if you think about it that way. But anyway, I'm digressing. In this, sorry. There's an audience question again already, which is great by the way. There's a pieceman who asks SSL certificate question mark. Yes, so it is an SSL certificate. Certificates, I'll get to it a bit later. They're not specifically tied to SSL or TLS or anything else. But yeah, you can think of it as an SSL certificate. Nicole, thank you for the question. Just gonna go forward now. So yeah, anyway, in the example that I gave with the browser and stuff, we have a client and the client is our browser and we connect to a server and that's Google. And what happens, at least on the surface level, I'm not gonna get into the nitty gritty of the protocol details, but at a surface level, we connect to the server. The server sends us back a certificate as a client. We look at the certificate and if everything seems okay, we negotiate encryption and then we have secure communication. So in just two steps, we have secure communication. In reality. Another question. We can also take it as a spot if you want, but there's been not asking, can we use self-sign certificate as well or is it has to be TA sign certificate? That depends on the system. So with TLS, you would probably need to have a CA sign certificate, but with LinkerD, for example, you can use a self-signed CA to bootstrap identity in your cluster. So it depends, that's the answer. I know it's not very straightforward, but it will always depend on what workloads you have and what sort of communication you have going on. Cool, thank you very much for the question. And yeah, basically, when we have this connection between the client and the server, you know, we just sort of negotiate some things and then everything works, but in reality, it's not super straightforward. TLS has a handshake mechanism in the same vein as DCP's handshake. So the client will connect to the server. It'll give it a client hello and it'll say, okay, server, I'm ready to negotiate some TLS here. It'll send some configuration parameters. They'll both, the client and the server agree on the configuration and then the server will reply with its certificate and it will ask the client, okay, are we good? Can you verify me? The client verifies the server. They both agree on an encryption secret and after that, you pretty much have established secure communication. Easy peasy when you just talk about it. But anyway, before we move on to MTLS as a protocol, just gonna give you some quick nerd facts about all of this stuff. So TLS, like I said, is implemented on top of TCP. It's built using asymmetric cryptography. So we rely on a key pair, a public key and a private key, one key encrypts, one key decrypts, and this is how we sort of make use of certificates in TLS. When we do TLS setup, this is known as a handshake and we agree on configuration, we authenticate and then we negotiate encryption. Now generally, there is a latency cost that's paid when you do TLS and MTLS, but this cost is usually paid at connection establishment. And as you start going along and the connection is already established, this is not actually felt as much. And then finally, a point that I really sort of want to make known is that authentication relies on certificates and does relies on public keys. And public keys should be available to all parties. It's kind of in the name, you know, they're public, but I do see a lot of people who sometimes send me manifests to look at or they send me some repro steps and the public keys are obfuscated or hidden. Just want you to know, it's totally fine to share public keys and certificates because they're public. And with that being said, we're finally on the topic of MTLS. And- Can we go to audience questions before we- Yeah. Perfect. Yes, of course. There's a lot of questions that you're going for being so active. If there's starts to be too much, but they just say that we will take them in like chunks if you want, but whatever works. So- No, just keep it coming. Yeah, perfect. You can go to self-signed needs to be pre-configured as trusted since it's not from one of the CA folks, more of a statement than a question, but any folks there? Yeah, I do understand the question. So if you're referring strictly about Linkerty itself, then it does not need to be configured to be trusted or signed by one of the major CA or one of the major authorities that usually sign intermediate CAs. So with Linkerty, for example, I know I'm going to give some spoilers here, but if it answers the question, then I don't really mind. With Linkerty, when you install it, you generally have to provide a root CA. We call it a trust anchor. And the trust anchor can be self-signed. We actually encourage people sometimes to have it self-signed. So it does not need to be signed by someone else. You can sign it by your enterprise CA, you can sign it yourself, whatever actually works. The thing is, because this sort of forms the trust route and it bootstraps the whole identity for Linkerty. For Linkerty, it's enough if you trust it. So generally with self-signed certificates in general, if you bootstrap your identity system with that self-signed certificate, it's enough for you to know that you created it and then implicitly everything will trust it. But if you have like a publicly accessible web service, again like Google or anything else that's on the web, then I think generally it's better to have it signed by one of the major folks. And I'll quickly give you an example before I move on, but if you have ingress termination in Kubernetes, for example, you would very likely expose this sort of ingress point to a broader audience. So in that case, you might want to have your CA signed by one of the major CA folks. But then what happens inside the cluster itself can be self-signed because you know you bootstrap the identity yourself. And I hope that answers the question. Perfect. And then there is two more. Suter asks, what TLS version is supported slash used in Kubernetes and pervert TLS encryption strength? Well, it depends. I'm not sure in Kubernetes exactly what version the API server uses. I would have to check the docs. In Linkerty, I think we use TLS 1.2 or 1.3. Yeah, that's kind of the answer. And should we take a few more now or move on? We can maybe take one more and then progress the presentation a bit and then get to the rest. So can we have multiple CAs to sign server and client search? It depends on what you mean by that. You can definitely have a chain of certificates where one certificate signs the other then signs the other and so on until you get to the bottom certificate that's not signed by anything but you cannot have two CAs signed the same certificate. It doesn't really work like that in a sense. Yeah. I hope these answers were satisfactory to all of you. And I love seeing that you're also enthusiastic about this. It's actually really great. Great, yeah, let's progress a bit and then let's get more questions then let us know when you want some more questions, yeah. Yeah, there's more exciting material, I promise. You'll have more questions. At least I hope you do, if I've done my job right. Cool, anyway, MTLS, really easy to understand compared to TLS because it's symmetric authentication. Suddenly we have a client, we have a server, the client connects to the server, they negotiate all of those TLS parameters or MTLS parameters, we should say. The client authenticates the server, the server authenticates the client and then the communication is secure. You might be wondering, well, you know, how does this help? Is this more helpful than just doing TLS? And the question is, well, the question, the answer is it depends. Basically, you would use TLS when you have a public website where people connect and you actually don't care about the identity of who connects to you and certainly that is the case with Google. Google doesn't really care what browser connects to it or where you're from, they might care, but not for the purpose of security. But if you have an API gateway or an API service, the scenario kind of changes because once you have an API that's accessed by other clients, then first of all, you want to authenticate it because you want to prevent malicious requests. You don't want just anyone to hit your API endpoint and get data off of it. And then you also want to know which clients connect to you so you can do a bunch of cool things such as rate limiting, right? Like if you don't know who connects to you, then how can you rate limit their calls? You need to have some information there. And this is where MTLS shines through because it allows you to do this at a sort of platform level because suddenly, and I'm moving on to the next slide now, suddenly you have cryptographic proof of both the client and the server identity. So MTLS is exactly like TLS, but it has these extra steps where you perform symmetric authentication of both parties. This gives you the cryptographic proof. And because you have this cryptographic proof, you can do really cool things such as client-based authorization or rate limiting or anything else that crosses your mind and can use this identity. One more thing about MTLS in general is that for cloud-native environments, it allows you to do zero trust. And that's a sort of a buzzword or at least I'd noticed it's becoming a buzzword. So what I mean by zero trust is that you basically do not trust the network. You implicitly assume everyone on the network is out to get you. So you only trust everything at a security level and at a platform level. In this way, when you do MTLS, you can get true workload identity because you have very clear security boundaries. You're not tied to the network topology, right? You don't care what subnet this request came from or stuff like that. And for enforcement is granular and everything happens at a pod level. And you can also extend it to arbitrary cluster topology. So for example, if you have two or three clusters, you can still do MTLS if all of these clusters are using the same root CA. And you don't have to implicitly trust anything, right? Everything is just going to come to your server. Your server's gonna authenticate the client. Your client's gonna authenticate the server and you don't actually implicitly trust stuff. Also you have a mechanism for secret loss at almost any level. There's a bit of an asterisk there because sometimes you can get, you know, your root CA's private key lost or you have to revoke the root CA. So you do have a mechanism for secret loss but depending on what level this happens at, it might be a bit painful to do everything but certainly better than, you know, having people access your data when they shouldn't access your data. Do we have any more questions? Yes, there's a few. So then there was a question from Khardeeb. Other than identity of the server slash client, what other advantages does it provide over just having HTTPS server serving APIs? Okay, other than identity, what other advantages? Well, it doesn't really, it's a tough question and I'm glad you kind of asked it. I'm not sure I fully understand it. So the basic thing that you have is the ability to look at the client's cryptographic identity. So other than that, it doesn't really have any other advantages over plain TLS. That's kind of what makes MTLS better in that sense is that, you know, authentication just happens both ways. So other than that, it doesn't necessarily have any advantages at least that I know of. I don't want to be super generic here and say that, you know, maybe it does have other advantages but for the purpose of this presentation and for the purpose of what we're doing in LinkedIn, what we're really interested in is authenticating the client as well as the server. Great. And then there was a comment from Oksana. Multiple CAs are implemented in Istio though. Yeah, I find it hard to believe, it depends again what you mean by multiple CAs are implemented in Istio. Like multiple CAs sign the same certificate because I'm not sure it would work like that due to how signatures are actually done. But you know, I'm not gonna say it doesn't happen. I would definitely love to read up on it. So if you do have a link, let me know. Or if you have a feature request for LinkedIn you think that would be a thing and if it can be done, we're also not opposed to it. Great. And then there is from Indang. We have, this is a bit off topic but could you elaborate a bit more on search? Yeah, I can definitely elaborate a bit more but I'm not sure exactly what you would want to know. So why don't we do this? If you tell me exactly what you would want me to elaborate on or what I could say to make it a bit clearer, I can come back to it and try to explain it a bit more. Great. Waiting for more info from you, Indang, then looking forward to that. And then the last one so far is best practice for storing TLS certificate comes with here. Okay, I can give you some best practices or at least like what we think about the operational model and LinkedIn. So first of all, in LinkedIn for the operational model we deal with a trust anchor which we call the root CA and we deal with an identity issuer which is an intermediate CA. Now for the trust anchor, we really strongly advocate that you do not keep your private key in the cluster. So ideally this private key you use it on your local machine or whatever bootstraps use it in your PKI, whatever bootstraps your root certificate and you never put that in your cluster. You only put the public information of the certificate in your cluster. For our intermediate CA in LinkedIn, we have it in a Kubernetes secret because that's how we can actually mount it to the workload that needs to do stuff with it but only that workload mounts it because it has access to the private key. So the workload that I'm talking about actually sign certificates for all of our proxies in LinkedIn and we mount the secret but only that pod mounts the secret. We generally do not advocate that you mount the private key anywhere. The public key, you can distribute it in whatever you want. You can use a config map, you can store it in memory, you can store it in the environment, you can store it in a volume, you can pull it off the web. It doesn't matter because it's public but the private keys, you need to be very careful what you do with them. So my general rule of thumb at least in LinkedIn land is your trust anchor root key should stay off cluster and your identity issuer key should stay in the secret and only be mounted by the pod that actually has to use it. And I hope that sort of answers it. Perfect. And then there was a bit of extra info that hopefully helps from Mingdong on thanks, cool. How it works, I guess. That is a bit of maybe a big question but if you have any thoughts there. Yeah, I do. Wait just two free minutes and I'll get to the certificates bit and I'll try to expand there a bit. I won't forget, I promise. Anyway, just to sort of end the chapter on MTLS, is MTLS all you need in Kubernetes or in whatever distributed system that you have? And the answer is no. And if I would say yes, I would probably have to expect a bunch of security experts with pitchforks outside of my window. So no, it is not all you need but it does provide a lot of value when it comes to on path attacks. So that's when someone wants to sniff traffic whenever you try to connect to a target and someone's in the middle because you have encryption and you have confidentiality, right? So they can sniff the traffic but they're just nothing to understand there. And we're actually going to do something similar when we get to the demo bit. It protects against spoofing attacks when an attacker pretends to be the client or the server because you do authentication. So again, sort of in the confidentiality side and it protects against malicious requests because like I said before, TLS only authenticates the server but now you also authenticate the client. So you can pretty much not accept any requests that are not authenticated and you also have the basis for authorization. However, it will not protect from any malicious attacks that happen from local host unless you also want to do TLS over local host but that's a bit of a waste because if someone has access to your pod's network namespace in Kubernetes then I guess someone sniffing traffic is the least of your worries, at least in my opinion. It does not protect against unauthorized access to nodes. So an attacker might be able to access keys or do nasty stuff if they have access to the host. This generally tends to happen especially if your proxy runs on the host because it becomes susceptible to like the confused deputy problem and also it does not provide encryption at rest. And TLS is about communication security. It does not really encrypt your database or your disk or anything else. And now I'm going to be talking about certificates. So first an analogy. If I want to fly into a different country this summer and if I want to go on holiday and I most certainly do but if I want to go on holiday and I want to take a flight I need to go to the airport and they need to see that I'm authorized to go to whatever country I want to go to and that I can travel. And generally they need to know your identity, right? They need to know my name, my date of birth and everything else like where I live and what nationality I am and stuff like that. If I write all of this stuff on a piece of paper and I just go at the airport and I present this to someone in the best case scenario I will just be turned away and they'll laugh at it and the worst case scenario well it's probably gonna be pretty bad. But if I go with my passport all of that changes, right? Even though it's the same information whatever information I have in my passport I can just write on a piece of paper. But the difference is that my passport was issued by a government agency and government agencies are implicitly trusted by people unless you're an anarchist I guess but they're implicitly trusted by people. And that's why when I present my passport they can look at that information they can look at me and say okay well I trust that this is your identity and now I can, you know, offer you to go or tell you to leave. But with the piece of paper there's really no trust there for them to check, right?  They don't trust me. So certificates work in a very similar way. You have a name or you have some identifying piece of information and you have a public key. This public key is bound to the name or to the identifying information by signature and the signature comes from another certificate. A certificate that they trust. If they don't trust that certificate they have to check whoever signed that certificate and so on. And this is probably where, you know, I'm gonna start to talk a bit about Route CA. So I wasn't planning on doing this but I think it is valuable to know. When we verify certificates we generally go through what's known as a verification chain, right? So I'm sorry I don't actually have a diagram for this you'll just have to listen to me talk. But basically when a client and a server talk to each other they have what's known as a leaf certificate. That certificate is just signed by other certificates. That certificate doesn't sign anything itself. Every certificate has a signature and that signature is what binds the public key to the name. So each certificate has a public key it has a name and it has a signature. Another certificate will sign the signature with that certificate's private key. And then we can use that certificate's public key that we get from the certificate itself to undo the signature and check, you know, that it's been signed basically. If we can actually, you know, decrypt the signature then it means it works. And the public key belongs to that certificate or rather the public key and the private key are associated. I'm not sure if I'm making too much sense but basically picture this. You can use a public key to encrypt or decrypt and you can use a public key to encrypt or decrypt. The thing is only the other corresponding key can do the reverse. So when you have a bunch of certificates they all sign each other and the root most certificate is the one responsible for, you know, signing the next one and you know, the next one signs the other one and so on. But when you go through this verification chain basically end up at the root certificate and that root certificate where you have two choices it either signs itself or it is signed by, you know, one of the agencies that sign certificates like let's encrypt. You know, with someone like let's encrypt everyone sort of unanimously trust them kind of like the government but a self-signed certificate is a bit different, right? Generally in a cluster, if you use a self-signed certificate you sort of implicitly trust it because you create it, right? So you create it, let's say on your local machine it's probably not the best example but you create it on your local machine and then you put the, you know, public key or whatever you put it in the cluster or you start taking CSRs you get an intermediate CA and that signs other things and other things and so on and when it gets to the root most certificate it'll trust that implicitly because that's what boosts track the whole identity. Does that make sense? Have I answered the question now? Hopefully, Ying Dong, you can let us know how did it go? And there's a few questions as well. We can take them now or in a while, how do you feel? Yeah, let's take them now. Yeah, so there is Rackage asks are certificates refreshed frequently? Yes and no. Certificates have an expiry date and they're refreshed as often as you want to refresh them. With LinkerD, for example, the proxies are refreshed every 24 hours. That's like the maximum amount of time they can go without refreshing. The issuer certificate that signs proxy leave certificates that can be refreshed every three days, every seven days, every 10 days, you know, so on and so forth. It depends on how you want to do it. Generally, our recommendation is that, you know intermediate certificates are rotated every week. For some people, that's a bit overkill because it's kind of an operational responsibility. So yeah, the answer is depends. The quicker you refresh them, the better because it lessens the chance of them, you know, actually being stolen, so to speak. But yeah, it depends on how your system works. Great and we got a, there's one more question but before that, we got a review for Mingdong. Passport example is perfect. Cool, thanks again. Absolutely, so well done there. And then Hitesh asks, how can we validate that MPLS is enabled in the cluster or for services at Kubernetes? Okay, that's actually part of the demo. So you'll have to stick until the end to see.  So real quick introduction to LinkerD. So LinkerD is a service mesh, which is yet another buzzword, kind of like Zero Trust. But a service mesh is basically just a platform tool.  What I basically mean by that is LinkerD as a tool ships with a data plane. We call that a data plane.   They will talk between themselves. So proxy intercepts the client's traffic, it talks to the server, it sends stuff to the server proxy and then the server proxy sends everything back to the server. But the proxies between themselves, they do MPLS and they also pull all of the metrics that you sort of want to look at. So that will be success rate, latency, fruit putt and so on and so forth. And because the two proxies talk together, it also allows them to do retries, timeouts, load balancing and everything in between. Now the real value comes from not having to implement all of this stuff on an application by application basis. So imagine for example, you had three or four microservices that talk to each other but two of them are written in a different stack. So you have a Rust service, you have a Java service and a C++ service. Suddenly you have to do MTLS in all of them and you have to get metrics in all of them and you have to handle retries in all of them. And while for free microservices that might not be too hard, it does make it more cumbersome to do. So that's sort of the problem that service measures want to resolve. Instead of having to do all of this in your application trust me like implementing MTLS is really not as easy as it sounds. The spec is a bit under specified, there's a lot of stuff to go through and there are a lot of corner cases and edge cases. So basically all of this happens at a platform level without you having to make any changes to your application. So I think it's pretty sweet but I'm also very biased. Anyway, Demo, should we take, I see there's one more question, should we quickly take it? Yeah, sure. It's from Vinod and it goes during any compromise, is it possible to rotate the certificate automatically or is it manual process? It depends. I think if you know it's been compromised to say, you know there's a security incident or you think there might be a security incident and your certificate expires in 10 days and you're like, no, we need to change it now. Otherwise, we're liable for stuff to happen. You would have to do it manually or you would have to kick the process in whatever tool or a PKI that you use inside of the cluster to manage these certificates. So for example, with Linkery, you can manage the certificates yourself or you can use some PKI like cert manager to manage these certificates for you. So depending on what process you use, you'll have to definitely kick this process manually if you think they've been compromised. Anyway, let me quickly go to my terminal and I don't know if the font is big enough. Can I get a quick act if it's better now? It's a bit better, right? It could be a bit bigger, so. Okay, how about this? It's starting to look quite good to me, but if the audience has any wishes they can let us know. It could be a bit bigger maybe, I'm guessing. Okay, gonna go, okay. Okay, I think it's hopefully good now, yeah. Cool, I am running a bit out of time, so I'm gonna speed through the first part and the first part was just to show you kind of how Linkery looks like. So let me just look at what cube cluster I'm using. So sorry, I'm gonna be using an alias here and K stands for cube cuddle and yes, I am pronouncing it cube cuddle. But anyway, over here, and of course sorry in advance for the clicking, over here, I already have a cluster with Linkery installed and this is the Linkery control plane. So the control plane I forgot to mention, we have a data plane and a control plane. The control plane is responsible for pretty much managing configuration. We have an identity service that serves proxy certificate signing requests. We have a destination service that does service discovery and policy discovery and then we have a proxy injector that's an admission webhook server in Kubernetes. And I also have a demo application called the MojiVoto where I have a couple of microservices running and what I quickly wanted to show you is the state that we wanna end up in after we install everything fresh in a cluster without Linkery. So I'm gonna use the Viz CLI tool. Viz CLI tool we have called tap which allows us to tap into the traffic stream and this is basically going to confirm for us that we have TLS. So we tend to the traffic stream, we look at everything that comes in, everything that goes out and we have a confirmation here that TLS is actually enabled. And I'm going to also check the dashboard and the dashboard should, you know, spoiler alert, say the same thing. Let me just go over here. So if I go into my MojiVoto namespace, I'm not gonna spend too much time talking through the dashboard because, you know, I think it's not what the presentation is really about but basically at the bottom of the screen here, we can see the edges for this particular pod and we can see which namespace and in which service traffic is coming from and whether that edge is actually secured. So Linkery already gives you the tools to check for MTLS. But I figured, you know, since this is a presentation about security, you might not wanna take the word of a random person you've just met on the internet and you might want to verify everything yourself. Which you probably should do in most cases. I mean, we are pretty trustworthy but, you know, it's always good to double check these things. Anyway, over here, I have a new cluster, all namespaces, sorry, it's sometimes hard to type and speak at the same time. Like I said, multitasking, not my strong point. But this cluster doesn't really have any Linkery stuff in it. It doesn't have any manifest deployed. So it's just whatever is shipped with a cluster. I'm using K3D by the way. So we don't have anything in there. And what I'm going to do the first time around is deploy a different set of microservices called BooksApp. So BooksApp has three, four services. It has a web app and this web app is like a frontend. It listens in on port 7,000. It connects to two other microservices to get information about offers and about books. And it also has a traffic generator that sends, you know, synthetic traffic to the frontend. As part of this BooksApp, I also have another container. It's a debug container. So Linkery does ship with a debug container. You can pretty much inject it into your service so you can check stuff. But I wanted to cheat a little bit and just add it here because I want to have access to a tool called T-Shark that we're going to use to sniff the network. So yeah, just a normal debug container. It has some tools inside. I give it some system capabilities so I have to avoid, you know, running into any issues because live demos aren't always smooth. So anyway, I'm going to first create the namespace and then I'm going to apply this thing in the namespace and I'm sorry, if I get any notifications here. Cool, do we have any questions while I'm waiting for this thing to get deployed? Is it all making sense so far? It is, it is wonderful. And there are two questions so far. So there is one for Z naught. Can we use AWS certificate manager to issue the certificate for MPLS? Can we use, yeah, I suppose you can. So if, for example, you want to generate the trust anchor in your PKI, then you can definitely do that. You'll just need to make sure that the public information is available in the cluster. So like I said, keep the key in AWS secret manager but then you'll need to make sure that when you install Lincredi you provide the certificate to Lincredi, just a public bit. But yeah, you definitely can. Great, there's two more then if we have some waiting time still. So what is the difference between Anthos Service Mesh and Lincredi? It's a good question. And I do not mean to sound super ignorant but I do not know much about Anthos Service Mesh. So if you can give me some material to read up on I can give you more information about it. I can tell you what stands out with Lincredi in general. And I'm not sure that the team from Anthos does the same thing, but we run our own proxy. So we do not rely on Envoy and our proxy is written in Rust and it's purposely built for Lincredi's control plane and for interacting with Lincredi's philosophy of keeping things simple and operationally simple in general. But if you give me more information and if you wanna reach out to me I can definitely talk to you more about it. Perfect, is the wait over since there's two more questions to go or do you wanna take them now or how does it look like? I will quickly go through this just so I have more time at the end for questions. So anyway, we have our deployments running and I'm just going to exec. You can see the auto-complete there. I'm going to exec onto the spot and I'm going to do it in an interactive mode. I'm gonna choose the debug container and the command that I wanna execute with is spash. So I planned on giving you like not in depth but a bit of an introduction on T-Shark. I may not have the time. So if in doubt just do man T-Shark and have fun reading through all of this text. It's not hard to make sense of but it's also not super fun to read. Anyway, so T-Shark is a capture tool. It can sniff traffic and capture on interfaces. We can see what interfaces we have available if we do IP link show and that will show whatever interfaces we have attached to the pods network namespace. So in this case, we have ethernet, you have a tunnel and loopback and when you start capturing packets with T-Shark you can specify the interface that you wanna capture on. So I'm just going to capture on ethernet. I'm going to say I only want TCP traffic and I want to capture on port 7000. This is gonna start a capture and it's just going to print out the packet summaries. So over here, I'm just going to do a Q, quick cube, cuddle, get pods just so you can see how the IPs that we have for the pods correlate with what we're seeing here. So for example, in the last packet summary in this capture we can see that we have the source of the traffic here 1042.012 that corresponds to our traffic pod and the traffic pod is the source and the destination is 1042.09 corresponds to our current pod web app. Over here we have some TCP things including the TCP flag here, the sequence number, the act number, the length of the packet and so on and so forth. So these things are not super important right now but basically where I'm going to go with this is I'm going to show you how using T-Shark we can actually sniff the traffic, we can tell what HTTP information we have in plain text and then after we install LinkerD we'll see that it's not possible anymore at least I hope it's not possible anymore. Now I'm kidding, it won't be possible. Anyway, so with T-Shark what I'm going to do is going to decode all, so that's what the dash O means I'm only going to decode information for HTTP packets and I will have the output as Jason and again I'll choose TCP so this time I'll go for port 7001 and this is one of the services that our web app is connecting to to get information. So we'll see that again, we have a lot of things that are being printed out but this time we also have information about all of the other protocols. So protocols are sort of multiplexed on top of each other in a packet and we'll basically take all of this and we can see we start from the layers, we start the multiplex in everything, we start from the frame, we go down to the internet information, IP, TCP and finally we get to our application layer protocol which is HTTP and you'll notice that here we get all of the information that has to do with HTTP. We can get the server, we can get the content length for the header, we can get the response number and also the file data. So we're sending everything as application Jason and the content I think is somewhere up there but basically if we combine this with something like grep and we say we want to see file data, we're going to be able to see everything that's being sent here in plain text. Now, obviously this is not ideal but imagine that someone would run something like this and they would sniff your traffic, they don't have to be in the exact onto the pod like I am now, they can just sniff the traffic and see all of this stuff. So imagine these books are super secret, maybe they are, maybe they're not but yeah, you'd be in a lot of big trouble basically especially if you process credit card numbers or just anything. I think the rule of thumb is that we don't want people to see what we are actually sending through. So now I'm going to install Linkerty. Linkerty install is just going to actually print out the manifests, it's not gonna install anything so you can have a look through the manifests again, don't take my word for it but I'm just going to install Linkerty, pipe it to keep puddle and wait until everything is deployed. And while that's happening, should we take some questions? Yes, perfect. So there is a question from Hariharan who asks, with service mesh enabled, sometimes troubleshooting might be a bit difficult. Any pointers on how troubleshooting is better in Linkerty versus Istio or any other service mesh? I'm going to be general here and sort of lob them all into the same pot so to speak. I think yes, troubleshooting might be a bit more difficult because suddenly traffic is being taken over by something else that you don't necessarily own but what's really great about service mesh is in general is that everything is open source so you can go and look through the code yourself and more than that, we basically put all of these metrics available for you to use so I would argue it actually makes troubleshooting a bit more easier because suddenly you have metrics available where stuff breaks, you can correlate it with logs and usually proxies as software can have like variable log level so you can go as verbose or as quiet as you want to be and with the proxy itself actually we support modifying the log level on the fly so you can say okay, everything is at an info level and now suddenly I want to make a debug because I have a problem, let's see all of these logs and you look at the logs and then you can correlate them with the target IP or the client IP and actually it becomes way, way easier to troubleshoot what's going on and I'm saying this is someone who loves to help people out on Slack and I have people coming up with issues to me and problems and you have to basically solve these problems without ever having access to the environment and I'd say that if the proxy wasn't built as good as it is and you wouldn't have all of this information it would actually be much harder to track what's going on but with LinkerD we put all of these tools available and also have the metric stack that helps you sort of troubleshoot this further because we don't believe that you have to actually be a proxy expert to realize what's happening there. Anyway, so my deployment is done. What I'm going to do now is I'm going to get the book sap namespace and I am going to pipe it through LinkerD inject and what this is going to do is just going to add this inject annotation and then whenever new pods come up and they have this inject annotation the admission web hook is going to take them over and inject the sidecar. Now you can do this on a pod by pod basis or you can do it on a namespace and then the pods will inherit this from the namespace and that's what I'm going to do now. It's a bit easier than annotating all of our workloads. So I'm going to inject it, pipe it, apply it and then if we get the pods in book sap you'll notice that nothing changed. That's because we have to restart all of the deployments so they can be picked up by the admission web hook. Cool. And now this should be pretty quick. I have time for a quick, quick question. Okay, perfect. Is there any authorization policy supported like OPA or OIFMT for massage? Yeah, so LinkerD does its own server side policies. So we have our own server side policies CRD that basically lets you restrict traffic or allow traffic or require NTLS and stuff like that. We don't have any OPA integrations ourselves but it's something that you could integrate with OPA if you wanna spend time doing that. But generally we found that for user experience it's just a bit easier for us to roll out our own stuff and then the user experience around it is sort of dictated by us and you don't introduce another tool. But check it out. I think if you just do a quick Google LinkerD offset you should be able to find information on that. Anyway, what I'm going to do is go into this web app and I'm going to go back into the debug container.  So I'm gonna decode the packets as HTTP, JSON, TCP port, I think it was 7001. And then I'm gonna grab for HTTP file data and I'm gonna wait. And nothing displayed so far, but the packet count is going up. So we're capturing packets, but nothing is being displayed. And I wonder why, but secretly I know why this is just a prompt. It's because we no longer actually have any HTTP flags and HTTP packets in here. Just gonna scroll up. Right, instead of HTTP we now have SSL. So this is curious because before with the exact same configuration, we had access to the HTTP data and everything that had to do with the HTTP protocol, but now this has been overtaken by SSL. So something clearly is happening here. I'm gonna use a different command. I'm gonna use dash P, which means print packet details and dash X, which means do an ASCII thumb. I actually didn't choose the port. I'm gonna say only TCP traffic, port 7001. And again, it's gonna start to capture and this is just going to print the exact same thing as before, but it's going to do it in a different format. And we can see here that this would normally print application traffic and application content. But now there's just this application data for TLS and well, we can't actually make sense of whatever else is in here. And again, don't take my word for it. You can definitely try it, but let's see if we start the same capture, but on local host instead, which is not in TLS, if we can see anything different. And yeah, we can. Basically here, we have everything as HTTP. So I guess what I wanted to show with all of this, sorry, I don't actually have a dramatic ending to this presentation or to this demo is that, you know, Linkerty adds out of the box in TLS and it adds tools for you to verify if M TLS is working. But if you wanna roll up your sleeves and do it yourself, you can definitely do it. And, you know, you can use a packet sniffing tool like T-Shark, but basically what I try to do with T-Shark here is show that before Linkerty, we could sniff traffic. So we didn't even have to be in this container. We didn't have to be exact in this container and we would see everything in plain text. And now you can't do that, except if you're in the container and you're listening on local host.  So, but yeah, that kind of wraps it up. So I'm just gonna go back to my slides here. And I think we have quick minute for questions if we have more. Yeah, we have about two and a half minutes maybe.  Yeah, so there's a question. Is this the same functionality as Keali? Keali is more of an operating system, right? Or do you mean Keali, the tracing thing? It's not really a same functionality, you know. Okay, great. So someone's asking, what do you use for autocomplete? I use fish shell and that gives me the completion automatically. Perfect, then there's a question. Does Linkerty work with EBPF? It depends. It does not, like it does work with EBPF and CNI plugins, but it doesn't do any EBPF on its own. We still use IP tables for routing. But we have people who use it with Calico or Silium, so it's not a problem. Great, then there is, can you demo how to uninstall Linkerty if I happen to run into an unexpected issues? Yes, of course. I'm just going to exit from here and I'm going to do Linkerty uninstall. I'm gonna pipe it to cube cuddle delete. Well, I guess I don't need that Chef flag. Well, I first need to inject all of these. So I am going to get the namespace. I guess I'm, do we have an un-inject command? We do, the more you know. Actually, I did not install it very often. I just delete the cluster itself, but then we roll out the pods and then we do Linkerty uninstall. It still complains about something, but you kind of get the point. Right, then I think there's maybe time for one more. So what do we use for cert rolling? Cert rolling as in rolling certificates. I'm not sure I really understand the question. I'm sorry about that. Great, that was great. Or we can continue the discussion in the cloud native live Slack channel, by the way, for everyone. Okay, cool. Yeah. You can ping me there. Perfect. Then there's a few questions that the questions asked there, a bit of out of scope and then there is a final question. So app existing apps are encrypted ALS, the increased controller from Denon? So you can, if I understand a question correctly, you can also inject your ingress controller. Linkerty is not going to handle any SSL termination at the ingress level. Your ingress controller is going to take over that, but Linkerty is going to take over anything. So it's going to encrypt anything that goes from your ingress controller to whatever target that you have. Great. So there are about three questions that we didn't get to, but as mentioned before everyone can help into the cloud native live Slack channel within the CNC app or Kubernetes Slack, essentially. And I see that you have some academic here that you want to mention, maybe. Yes. So just a quick announcement. We also present all of these things related to Linkerty and service meshing at what we call the service mesh academy. So this is all free training and free knowledge. We do love to spread the knowledge. Jay, if you want to see more material, especially around certificate management or failover or multi-cluster, yeah, check it out. And with that, thank you very much for your attention. Yeah, thank you everyone for joining the latest episode of Cloud Native Live. It was an amazing session by Mathe. Thank you so much. We also really loved the interaction, so much interaction from the audience today. Really great to see that. And as always, we've renewed the latest Cloud Native Code every Wednesday. So join us in the upcoming Wednesdays as well. See you later, everyone. Thank you, everyone. Bye-bye.


Welcome back fellow techies to our latest tutorial video, I am The Technician Project and today's tutorial is going to show you how to export multiple tracks out of audacity. So first of all we're going to select all our tracks, we can do that by click and dragging or we can do Command A. Once all our tracks are selected we're going to go to File, Export, Export multiple or Shift Command L. The Export multiple function allows us to export each track individually as one group. So it will do track one on its own, track two on its own and track three on its own. We can export these as a wave form or as MP3 files and we're going to select our desktop and we're just going to export all the files to our desktop. And there you go, three files exported out of audacity as a multiple file. Thanks for watching, don't forget to like the video if you enjoyed it and subscribe for more and also ding dong that notification bell to get further updates. Thanks again, goodbye.


Good afternoon, folks. This is Steve Rhodes coming to you live from the shores of sunny Delray Beach, Florida. This year, 1 p.m. update and currently we have all the U.S. indices trading to the upside. The Dow is up 258 points, about three quarters of a percent, 1% for the S&P. That's 45 points. One in six tenths for the NASDAQ 100, 232. Russell's up six tenths, 13 points. The Summys are up about six tenths or 21 points out there. You've got gold trading out at 19.20. That's right at support. That's down 9 bucks. Silver trade out at 24.88. That's down 42 pennies. Let's recruit up $2.34. 10978 is the print there. Let's go figure out what all that means by take a look at our nine panel market update chart. We begin with the ESMini. We see the ESMini is trading above the top of its bearish structured weekly profile. Hmm, something to think about. That suggests if we see it close. Now it's a weekly profile. It's only Tuesday. Today Tuesday. I think today's Tuesday. So it really matters where Friday's closes. But nonetheless, it's trading above a key level of resistance. Again, that was the 44.80 level. We're trading right now at 4500 spot. Volatilics. It is targeting the level that we thought that it would, which is that lower bobbinjer band. Still has a little bit of ways to go. Lower bobbinjer band is printing right now at 22.21. The spot bix is trading out at 22.98. As long as it continues to move lower, the S&P, the ESMini should continue to move higher to sideways. In the case of the NQ, she's up at profile levels. So taking on buyers and sellers right now, 14650 is the is the center of its daily profile. Price right now is printed at 14616. We take a look at the US dollar index. It's regained its daily profile, but it's also found resistance. That's at this descending trend line. So really has kind of a neutral signal. Neutral to bearish, I would say, but neutral. Neutral overall, because price is also holding the bottom of that profile. As is gold, you can see we've seen a push below 1960, but as long as that level holds, and it's a bullish structured profile, it's doing what it's supposed to do. In the case of silver, it's trading into a rising trend line just slightly below the bottom of its daily profile. The bottom of that profile is 2497. Now, if price were to close below that rising trend line, that could signal move back to the 2258-2312 level. Not until we see that. If you take a look at LightSuite crude, it is trading above. It closed above yesterday at the top of its new daily profile. It's pulling back inside there right now. So not really clear what it wants to do. It looks like a breakout in natural gas, but truly it needs to close above $5.19. And the 30-year treasury get trashed again. But today, I believe, is bar number nine of 18.9 count. Folks, thank you for the Trader's End Show, but if you're off to start during Tuesday, have a terrific one. We'll look forward to seeing you again soon.


Four big movies hit theaters this week. We got Migration by Illumination, a new family film. It's animated, it looks fine. I'm sure it'll be another standard illumination fair. We got 824s. The Iron Claw with Zac Efron looking gigantic. I don't know what's going on with that guy, but he's ready for battle. I'm interested in this one. I think it could be great. We have Aquaman too. Jason Momoa back as Aquaman for the last time. One last ride. Looks to be hot trash. We'll see if they pull it off though. Who knows, maybe the DCEU will go out with a bang. And last and probably least, anyone but you with the new Tina Hartthrob flick featuring some good looking NPCs doing things for a couple hours. Who knows, maybe it'll win me over and it'll be the biggest surprise of the holiday season. Let me know your thoughts in the comments. Are you excited about any of these films?  I will unfortunately go to all of these and review them on my channel, so subscribe if you haven't if you wanna hear those reviews.


Hi, hands, welcome back to my channel and a very special welcome if you're new here. My name is Jen, I'm a certified weight loss and nutrition coach and I'm on WW Personal Points. Happy Saturday, it is Saturday, so it is grocery haul day. I shopped at two stores this week and I have all of the points included in today's haul. So if you're excited, give this video a big huge thumbs up, make sure you're subscribed and your bell is turned on because we do a grocery haul every Saturday and I upload five videos a week. Don't forget to check the description box out down below for nutrition coaching where I offer personalized to you macros and calories. Cannot recommend this enough as well as one-on-one coaching if you would like to chat with me directly. Links, discounts to my favorite things and come join our Facebook group. We'd love to have you. So let's jump in to the grocery haul. So here is this week's grocery haul. I went to both Sprouts and Walmart.  Get together on Sunday with my in-laws and then some groceries for the week. I have some great recipes coming your way in meal prep. So stay tuned after the grocery haul for what you'll see Monday in meal prep. So I picked up some Moondrop grapes. I don't think I've ever had these and I've heard that they are really, really good. They were like $1.98 a pound at Sprouts. So I think this whole bag was just a couple dollars and I'm really excited to try them just for something a little bit different. You guys know I really gravitate towards berries. So this will be something different for the week. I am making stepped mushrooms for our Halloween get together and this huge pack of mushrooms was only $6.99, these are organic. So I thought that was actually a really good deal. So I picked those up. Sprouts is already getting all their fun holiday stuff. They've actually gotten rid of most of the pumpkin and bringing out Christmas already. So I picked up the Choco Love dark chocolate candy cane chocolate bar. I thought this would be such a good sweet treat and you guys know how much I love peppermint anything. Like I mentioned in my What I Eatin' a Day on Wednesday, I'll link that video if you missed it. I've been obsessed with protein pudding and I thought this would be so good shaved on top of protein pudding. Yes please, so I picked that up. They had quite a few different flavors so I'll be trying a lot of their holiday stuff as we get closer to Christmas. No surprise, my shredded chicken so that I can make my mashed potato, gravy, veggie, copycat KFC bowl. They had my favorite cottage cheese on sale for $3.99 which is the same price as fries. So I grabbed two of those because I've been out of cottage cheese and I have really missed it. I grabbed another one of the Vermont uncured pepperoni meat sticks. I actually really like these and I thought that this would be a nice thing to just throw in my purse so I have a protein filled healthy snack on hand. I did grab a pumpkin because Troy and I were going to go to the pumpkin patch in Tucson but it's almost an hour one-way drive and we have just been so busy and with my injury at boot camp, having a cold, we just didn't make it. So the pumpkins were two for five at Sprout so I grabbed one. I want to put on my front porch for Halloween along and keep it there throughout Thanksgiving. So we won't be carving it and I thought he was a pretty cute pumpkin for only $5. They had their true whip on sale two for six. Really good deal. So I picked that up. I like to add whip topping to my protein pudding and then I stocked up on spices. I went through my spice cabinet, got rid of everything expired and everything I was out of. So I did quite a big spice restock starting with thyme, all of the Sprouts brand organic spices are $3.99. So that's a really good deal. And then I was also completely out of garlic powder, ground ginger, which I actually use a lot and then I'm also completely out of Italian seasoning. And then of course, lots of produce from Sprouts. I love sprouts for produce. So I got one huge organic sweet potato for a dinner recipe. I needed parsley for a couple of recipes, a big yummy red bell pepper, two gala apples. That is for my meal prep, a couple of tomatoes for one of the Halloween inspired dishes for Sunday. If you don't follow me on Instagram, make sure you come follow me because I'll be posting my Halloween charcuterie board and all of the fun Halloween stuff I'm making for Sunday. So definitely come follow me on Instagram, a big bag of avocados for avocados and for guacamole. This huge bag of Taylor Farms Brussels Sprouts was manager special 99 cents. I love Brussels Sprouts. So I had to grab those. I am either going to shave them or cook them up and have them as a veggie. And then I also needed quite a bit of green onions for a few recipes as well as for Halloween dinner. So moving into Walmart, they had this cute little striped tiger three-count pumpkins for $1.98. These were $4 a piece at Sprouts. So I'm glad I didn't buy them there and I waited until I went to Walmart. And again, three of them for $1.98. I want to put them next to my big pumpkin on my porch and then I like to have them for decoration for the holidays. I'm going to be making a crock-pot beef stew.  So make sure you're subscribed and your bell's on so you don't miss it. So I grabbed some stew meat for that. For Halloween, for the Halloween dinner, I needed squeezy sour cream to make a spider web design on this kind of seven layer dip that I'm making. Again, I'll post everything on my Instagram. So I picked up the squirty Daisy sour cream. Some more of the Dean's French onion dip for Troy. He still has quite a few of his Fritos left and he bought the Lay's in the jar French onion dip. It is not very good. Neither one of us really liked it. So I grabbed this for him so that he could finish up those chips. I did grab another one of my no sugar added peppermint mocha coffee creamers. Somebody said you could throw this in the freezer. I know it says specifically on the container, not to freeze, but I've done it before and it keeps it just fine. It's thaws out just fine. So I grabbed another one. I'm gonna throw it in my freezer because this is my all-time favorite coffee creamer. I needed some cheese tortellini for a dinner recipe this next week. And then this is new to me. I am making muffins in my meal prep and they called for whole wheat flour. So I was going to buy just your traditional whole wheat flour and then I saw this. This is the Kodiak protein packed power flour and it says whole grain. So I thought this would be a great substitution for just processed wheat flour. The exact same nutritional information as far as calories go is regular flour but you're getting 10 grams of protein. So if I like this, this may just substitute flour in all of my recipes. So stay tuned for Monday's meal prep as I'll be making those muffins. We'll try it out, see what we think.  This is for the seven layer dip for Halloween. And then I also needed quite a bit of large black olives for that same recipe. So I picked up two cans, some organic tomato sauce. This is for a dinner recipe. This next week we are just about out of our light shredded cheese that I grabbed from Trader Joe's last week. So I grabbed another bag at Walmart. I'm going to be making some fun Halloween cupcakes for Sunday. So I wanted the Halloween fun fatty cake mix until I realized it was chocolate and Troy doesn't like chocolate. So I wanted him to be able to have dessert too. So I grabbed this spice cake mix to make cupcakes out of. And then I decided to get the whipped cream cheese frosting. Then I can throw this in a piping bag and make a pretty design on top of my cupcakes. If you struggle with the really thick frosting and spreading it out, get the whipped. It tastes just the same, but it's just a lot easier to spread and a lot easier to manage. I also grabbed some more of the Gilbert's Caprese sausages. These are my favorite. I've tried all the flavors that Walmart carries over the last couple of months. And I have to say this one is my favorite. It has basil, mozzarella and sun dried tomato. 130 calories per link and a whopping 13 grams of protein and I love these for breakfast and for lunches. Some Jimmy Dean sausage for these stuffed mushrooms for Halloween. And then on Friday, the final Friday of the month, apparently at boot camp, we do a 5K, whether we run it, walk it, run and walk it, whatever we want to do. We all do a 5K around the lake in our community. And then afterwards we have a healthy snack. So I grabbed some roasted red pepper hummus and then I'm going to cut up my non rounds that I have left over into little wedges so that we can have non bread and hummus. So she said healthy snack. So that's what I thought would be a good option. And I'm really excited to do a 5K. My first one in, I don't know how long, on Friday at 5 a.m. Some light butter. We are just about out.  I needed some salsa for the seven layer dip for Halloween and I need this for a dinner recipe this next week. Sprouts didn't have chives available. So I grabbed them at Walmart. These are just some freeze dried chives. Some frozen corn. This is for my lunch meal prep.  I find that it's a lot less wasteful to buy it in a tube. It's more expensive but you don't have to throw it away once you open the can. So I picked up a tube of tomato paste. I also grabbed a case of Coors like for Troy. So that is everything that I picked up for the week. Let's jump into what's on my dinner menu and what you'll see Monday in meal prep. So here's what is on my menu for the week. So today's Saturday out to dinner as always. Sunday is our Halloween dinner with my in-laws. Monday I'm actually making slow cooker beef stew. I'm so excited for this. Stay tuned for this recipe.  Tuesday's leftovers. Wednesday is cheesy tortellini sausage bake. Another recipe I can't wait to make. We'll do a burger night on Thursday and then Friday we always eat up any leftovers from earlier in the week. So here's what you'll be seeing in Monday's meal prep. I am making whole wheat apple muffins. I'm going to be using that Kodiak cake protein flour. Lunch is turkey burrito bowls. Super excited for this. And then for dessert I'm making chewy pumpkin oatmeal chocolate chip cookies. Also very excited. So stay tuned for all three recipes in Monday's meal prep. Thank you for joining me for today's grocery haul. I hope you enjoyed seeing all the good stuff that I picked up for the week. And like I said, don't forget to follow me on Instagram to see my Halloween inspired meal coming out on Sunday with my in-laws.  Make sure you're subscribed and your bells turned on so you never miss a future grocery haul or video in general. Check out the description box down below for nutrition coaching, links and discounts to my favorite things. And don't forget, we'd love to have you join our Facebook group. Happy Saturday friends. Happy Halloween weekend. And I'll see you in tomorrow's video. Bye.


It's not a very good first impression. For a channel that's all about autism and mental health, I seem to get this...  Looks like I'm going spiky. Autism has a lot of positives. You've got that attention to detail. You've got that extreme passion and concentration. You've got that sticking to routines. You've got all sorts of lovely stuff that make being autistic cool, but all powers come with weakness and today I'm here to talk about one of those weaknesses and that is executive dysfunction. Yes, it's a very flamboyant and scientific-sounding word. Why is executive functioning so difficult for autistic people and what can you do to improve that executive functioning? Executive dysfunction is one of those common things that just seems to pop up in most autistic individuals, or at least that's what I found talking to people on Instagram and Twitter and all sorts of those social media sites. Seems that executive dysfunction is rampant in the autistic community, but why and what is it?  Think of executive functioning as the centre of your brain, the thing that pulls your life together, like an executive board, like a meeting board, where all the businessmen in the little suits and ties get together and talk about different areas of the company. In a neurotypical brain, this executive function is considered to be normal, you know, I'm going to say it, considered to be normal and normal does not mean good or bad. They have a handle on the sort of little intricacies of that day. Everyone's a little bit different, some people are good at things and some people are more organised than other people and all that kind of stuff. All these little areas of the company work together to form a functioning healthy system. Some of the things that you can expect from an executive dysfunction is difficulties with hygiene, food preparation, hydration, cleaning, exercise, washing up the dishes, sleep, studying and education. For some reason, as autistic we find that imperatively, not the right word, extraordinarily different, difficult, god damn it. When you're autistic, your executive board is a little bit more focused on specific things like, for example, your special interests. Those special interests, for a lot of us, considering most autistic people have either some sort of traumatic experience at school or in childhood and also tend to have a lot of mental health problems, that makes special interests a really big grounding thing for us. It relaxes us, it entertains us, we're excited to do it, we're excited to learn about it and because of that sometimes we can neglect other areas in our life. Now you may be thinking, as I probably am editing this video, why is he rattling so much about boards and executives and companies and stuff? Well I know it's a little bit tedious but I think it's a good metaphor. On my journey to personal development, I've literally gone through the entire list of negative traits related to an autism diagnosis that I had and tried to improve on them. So I went to my socialising, I went to my ability to form relationships. But one of the things that I have been neglecting for a long time is executive functioning. I am absolutely terrible, that's the short answer. I'm absolutely terrible at my executive functioning. I really struggle to get a solid brushing my teeth schedule, I struggle to make food for myself. I do struggle in those areas and it's something that over the year or so I've been trying to work on. Hygiene was the first thing that improved. When I went through a bad breakup I sort of looked at myself and realised just how disgusting I was. So I started showering more often and I started doing my hair up which has obviously gone to hell. Now we're in isolation. There's been times during lockdown where I've decided to work on for example washing my clothes and I've managed to develop a good schedule around washing my clothes and getting them dried and hanging them up, taking out the recycling, taking out the rubbish. I still haven't got to the bottom of the cleaning. One of the difficulties of it is I find that I'm very good when I have one task that is extremely hard and it's something that I have to work on a lot and for long hours. I'm great at doing that. I'm brilliant at doing that. I don't have the documentary like any sort of video or podcast that I do. It's all the many little things that I have to maintain constantly in my environment. I'm sure you can agree that the thought of having a list full of small little things even if they only take a minute or something. It's just so much harder to get through them. It's trying to manage all of those things and organise them and a lot of time for it and know how much time things are going to take you. I'm working myself up just talking about it. So let's get into how we can deal with it. Can you improve your executive functioning? Short answer, yes, but it's going to be really hard. So I've got four or five little points that you can use, just some sort of psychological trick that you can use. I'm not going to say tricks because the idea of tips and tricks videos just makes me want to regurgitate. I don't want to watch those videos. The boring. I'm going to give you three pointers that you can use. Do not get loads of things and say, right, I'm going to work on my executive functioning and do and do everything that you're supposed to do and do and maintains everything all the time. Because if you do that, you're going to overload yourself. You're going to be mega stressed. So it's important to choose one or two things to work on. And also, you know, if you're going to start making your own food, start small. Start with using a microwave. Start with using a toaster and then move up to using, I don't know, like an oven and then move up to using a pan and making your own stuff. For example, one thing that I'm trying to do lately, which I failed at today, is making avocados on toast. It's relatively healthy, maybe not the toast aspect, but the avocado aspect and there is a partial amount of preparation that I need to do for it. But having that one thing to focus on helps you incorporate it into your routine easier. Number two, incorporate things into your routine. Slowly, of course, I've been doing my washing while I've been working on my media stuff. I use the washer as like a timer. I'll set it on and use the washes for about two and a half minutes. And I use that as a signal to have a break because I will just go the entire day working and I'll burn myself out. This doesn't have to be specifically to do with washing up, but it's just an example that I've used. And maybe there are some other areas of your life that you can do the same with. Tip number three is tying something that you're interested in with something that's productive and with something that's mandatory, one of those aggressive functional things that you need to do. One of the ways that I do it is I start off with something that I like and I do something that's mildly productive, but doesn't require much attention. So, for example, the thing that I'd be interested in is playing RuneScape, you know, doing a bit of woodcutting, fishing for some lobsters with a cage, you know, all that exciting stuff. I have started to listen to an audiobook while I'm doing it. So it's got me used to and I quite enjoy listening to audiobooks. So now if I want to do some washing up, I stuck on an audiobook, a wash-up, and I'll, you know, I'll get something out of it because I'll be interested in the book. Another thing that you can do is use, you know, I could listen to an audiobook while I'm exercising just to get me out of the house to do a run. By tying it with things that are productive and only doing it with things that are productive is a good way to incentivise you to do it. Another thing that I've been doing is I've been watching a short educational video while I'm brushing my teeth in the morning. That's a good way to get into brushing my teeth because I find it absolutely horrific. I don't like the feel of it. And if I don't have something to distract me while I'm doing it, it's going to be very hard to get myself to do it. The last point is give yourself a reward. Give yourself something positive. Being able to focus on being healthy in the long run with a little bit of a treat now and again, just to keep going. It's going to be better.  They might even want to help you out, learn new skills and do something together. It might be a more of a social thing, you know? You've got to tie things in to make it more appealing to do. Or else your dopamine system is going to be like, hell, no, I'm not doing this. I'm going to go play RuneScape in my room all day. OK, so in conclusion, the bottom line, improving your executive function is always going to be difficult. It's going to be a long, slow process that you're going to have to work on constantly for a long period of time. You've got to ease yourself into it or else you're just going to give up. That's the bottom line, or at least it's going to throw your life into chaos and get rid of all your routines and stuff. There are a lot of benefits to, you know, having good executive function. You'll feel more independent. You'll feel more self confident. You'll have a healthier mind because you'll be eating right. You know, if you get some exercise in there, do a bit of education, you know, feed the brain, all that kind of stuff. And you fancy having a girlfriend or a boyfriend. It's attractive being able to take care of yourself. And it's something that I've been lacking in. And I'm sure many of you out there would struggle with. Executive dysfunction. It's hard and there are a lot of negatives to being autistic. And you just got to deal with it and you've got to deal with the cards that you don't just play them very well. Just don't compare your soft over people. So imagine like the autistic brain is like this intricately coded, specific computer that's designed for a certain set of tasks.   Does all the things it needs to do, shuts down. But you've got to leave some of that processing power for maintenance. You know, you've got to keep those cooling fans on. You've got to do all of the regular tasks. You've got to have, you know, a few apps that let you organise things and structure things out and all that kind of jazz. You know what I mean? It's different. You're different. And that's OK. Thank you very much for watching. Yes, the t-shirt is coming out once again. The Asperger's Grave Merchant that I sort of store is available now. It's pretty cool. It's down in the description if you want to check out the link. This is my favourite t-shirt so far, but we've also got three others, including one that has both the back and the front. This one's just one sided. We also have some mugs and some bags and some stickers that you can order. I'm not expecting many sales. And to be honest, I'm just doing it for you guys, just in case you want to have some Asperger's Grave stuff, have some things that to do with me. Why would you want that? But it's pretty cool anyway to get a t-shirt. Of course, I will be trying to upload on a better schedule. You can expect videos at least once a week. Still waiting to hear back from the National Diversity Awards, but I'm hopeful and there's a lot of good stuff happening, guys. Like, at some point, we're going to break into the mainstream. At some point, we're going to have an impact on things. I'm going to try and bring as many of the autistic advocates on the Instagram community and on YouTube with me to try and make a change in our society, try and improve the mental health services available for all you lovely people. Try and integrate children more at a younger age so that we don't have all this bullying and social isolation and all those horrible experiences that are so common to autistic people. You know, if you want to follow my journey, you know, you can find me on pretty much all social media, Facebook, Twitter and Instagram. All Asperger's Grave. So if you fancy looking a bit more behind the scenes and stuff, then consider giving me a follow. Absolutely awful out there now. And I have promised myself that I'm going for a run. So I promise you that I'm going for a run because that seems to hold more of a weighting in my mind. So I'm just using you to go for a run, basically.  And I'll see you in the next video on the Asperger's Grave channel. But on the same way, bye. Don't know why I have to sneak my name in there. You know who I am. I'm the man.


Hi, I'm Akasha. I'm one of the integrated thoracic residents at the University of Maryland Medical Center. I'm just completed my third year in clinical training and I'm transitioning into my research years now. So I started as a medical student at this hospital and during my rotations here and elsewhere it quickly became apparent to me that this was the place I wanted to train. You know, not only do you get a great exposure to cases in the operating room and an early operative experience, but you form a great relationship with the other residents as well as the attendings. In terms of the exposure on the operative side, Dr. Gamie is an expert in mitral valve repair. Dr. Dawood does quite a bit of arrhythmia operations as well as tavers. Dr. Griffith, Dr. Kazarowski and Dr. Matathil are all transplanters and do mechanical circulatory support devices, particularly so minimally invasive implantation of alvads. Dr. Taylor and Dr. Greshy, they lead our aortic program and are doing some really exciting things, particularly with ascending and aortic arch endovascular therapies. And they also do coronary vascularization. So, you know, we're not missing out on that either. And then Dr. Koshil and Dr. Dietrich are congenital surgeons. So when you're on the cardiac side, you're paired with, you know, these individual super subspecialists, and it's more of a mentorship type model. On the thoracic side, Dr. Friedberg is an expert in mesothelioma, and he also frequently operates on large thoracic tumors. You know, I don't think there's anyone who's a more patient teacher or loves teaching more than Dr. Burrows, and he does quite a wide breadth of general thoracic cases. Dr. Law and Dr. Kropnik have a particular interest in lung transplantation. And then Dr. Stewart and Dr. Henry are both minimally invasive and robotic surgeons. And Dr. Kraus, who just joined and, you know, finished training in our program, is following in their footsteps. So you get to work with these really extraordinary surgeons, and, you know, they not only teach you how to do these cases, but they let you do them. And because you're working so closely with them, you get to know them well and develop a great relationship with them. You know, I think they really do become your greatest advocates, and enjoy watching you progress and succeed. In terms of the research experience at Maryland, there are a number of R01 grants that both in the cardiac and the thoracic divisions. Dr. Griffith particularly focuses on mechanical circulatory device development. Dr. Gamme works on minimally invasive device development, as well as novel mitral valve repair techniques. Dr. Koshel works on stem cell therapies. Dr. Law and Dr. Kropnik focus on lung transplantation research, and Dr. Friedberg works on mesothelioma research, as well as development of lung-related therapeutic devices. And, you know, aside from that, all of our faculty are really involved in a wide breadth of clinical projects. So as a resident here, you really have the opportunity to get involved with pretty much anything you want. Aside from the cardiothoracic experience, I think one of the really great strengths of our program is that you get to participate in these ancillary rotations. Just to name a few, we get to rotate with the interventional pulmonologists, the heart failure team, the echocardiography team, and as well as the interventional cardiologists teaches you how to do heart cats. So I think all of that makes you a pretty well-rounded and overall a better physician. You know, the camaraderie amongst the residents at this program is one of the main reasons that I chose to come here. Become really a tight-knit group as you work with these residents over the course of several years.  So, you know, having people that are around willing to help you, willing to learn from each other, I think really helps you get through it. During my time here, you know, the residents that I've worked with have become some of my closest friends. We go get lunch together. We hang out outside of the hospital and even go to each other's weddings. So I think, in my opinion, that's probably the best part about this training program. I'm Sheila Pousatis. I'm one of the sixth-year integrated cardiothoracic surgery residents here at University of Maryland. And I've really enjoyed my residency training. I think that we have a unique program because our clinical volume and the amount of independence that you'll attain throughout your residency is just completely unique. You'll do cases skin-to-skin. You'll have a wide variety of cases. We do everything from complex aortic work, both open and endovascular, close work with our vascular colleagues for those aortic patients, close work with our interventional cardiologists to work with TAVR and MitraClip. We do many, many mitral valve repairs here at this institution more than you'll see anywhere else.  We have tons of other adult cardiac surgery, cabbages, valves. So you'll have the full breath of cardiac surgery and you'll really get to be the one in the driver's seat. Our thoracic experience is also fantastic. You'll do many esophagectomies, parasophageal hernia repairs. You'll use minimally invasive techniques as well as open techniques. And the faculty are one of the, you know, shining stars here at University of Maryland. They're fantastic teachers. They love what they do. That's why they work here. And, you know, they don't mind if the case takes a little bit longer or is more work for them because they want you to get the learning experience. And they really enjoy seeing you progress throughout the years. So besides just, you know, our huge clinical volume, we have a very diverse patient population. And we not only learn from our faculty, but we learn from each other as residents. One of the things I remember when I was an intern was learning how to put people on ECMO from my fellow residents. And it was like a rite of passage. You know, my first day working at this hospital, they called me. I wasn't even on the cardiac service and they invited me to participate in an ECMO cannulation. And I just remembered that and it always stuck with me from the beginning that they cared enough to involve me in things like that right from the start. We do both vino-vino ECMO as well as vino arterial ECMO and we do hundreds of them every year. And we've been participating in putting COVID patients on ECMO, of course, and for all of the other indications for cardiogenic shock and ARDS. We have a fantastic research program here. Whether you're in the lab or you're doing research during your clinical years, there are endless opportunities and the faculty are so supportive. And the last thing is that as a resident cohort, we really support each other. Everyone wants their co-residents to shine and to be happy and balanced people. And so we're not only friends, but, you know, colleagues who support each other and really do delight in each other, succeeding both in the OR and in life. You're welcome to ask any of the residents about this. You know, everyone would feel the same way. No one's going to say that there's anything different. But you won't get a clinical experience anywhere else like you get here at University of Maryland. There's just so many patients. They're so diverse and you will really be able to, you know, exercise your clinical judgment and to work closely with the attendings to learn how to take care of them. So you'll be very, very prepared by the end of your residency.