For the next talk, we have Thomas Fricke here, who is hacking containers and Kubernetes. So as I learned from him with a little chat up front, it's a little effort to hack it, but it's also a little effort to write a few lines of code to protect it. So applause for Thomas Fricke. Yeah. Welcome, everybody. So let's go into the details. That's me. I'm partner, and I have been CTO at Endocode, and now I have the title of the chief cloud wizard. This means absolutely nothing, but it describes mostly what I do. I've dealt a lot with system automation, DevOps, cloud databases, and software architectures. So that's what you can ask me about. Personal history is I have more or less the time from the Apple II to Atari, then digital or open digital OSF Unix, and I've been using Linux since 0.95, actually. So I'm pretty old and have a long history, and by the examples, I think you will notice that a little bit. Okay. A disclaimer. We have partnered with CoreOS, which has been bought by Rated, which has been bought by IBM, with Rated themselves, and Google. So our business is consulting, trainings, workshops, and audits on Kubernetes. And this talk is not about the Kubernetes code audits. It's just about what from a user perspective you can find in Kubernetes and where you have to be careful and what you can do to protect this entire ecosystem. So the history of Kubernetes is exciting. The project has developed really fast and was really fast. I mean, in 2013, there was nothing like this. The Borg project in Google in 2014, they published it, and immediately IBM and Rated joined and forced it. Then it was a little bit of testing how it works. We did our first Kubernetes application in 2015. This was Telephony in the Amazon Cloud with all the G10 stuff. The G10, which protects your communication. Then we went into the design pattern mode. Helm came out. And then a lot of training started. It was like introducing beginners to Kubernetes. And from the history, you see the Borg system. You might remember 7 of 9 in Starship Voyager and Star Trek. The next generation has been the Borgs. So 7 of 9 inspired the 7 spokes at the wheel of Kubernetes. So it's actually the friendly Borg system. So this internal joke. We started with security trainings in 2016. All the applications more or less have been toy applications. This has to change in the last year. People came to us from a security critical environment. This means energy control, trading, traffic control. And at this moment we recognized it's time to make Kubernetes and the entire ecosystem really secure. And the talk is how you can do it. And maybe I want to inspire you to look into the stuff on your own and get a real impression on that. So this is where Kubernetes runs at the moment. And I missed the back ends of the car industry. And I even know some projects which I don't support in the surveillance industry. Face recognition in Kubernetes for airports is actually something I don't like. But it's hosted by some of the usual suspect companies. For those of you who have not heard about Kubernetes, it's a Greek word for hamsman. Same root as governor and cybernetic. And for you, what is important is it's 100% open source. It's written in Go. You can change it on your own. You can install it. You can compile it. It's not a product as a Linux kernel is not a product. Some people make products out of it. So the main message is Kubernetes manages applications and not machines. This slides from Google. So this is a 10,000 foot view on the left side. You have the user clients which connect with API or command line interfaces or user interface. Then you have the master servers which only have data which is persistent in the ETCD part. The ETCD is a distributed database. And you always talk only to the API server and everything is stored in the ETCD. So all your secrets, configurations of the entire cluster, the state of the cluster is in the ETCD. Schedulers and other controllers are starting processes. And on the worker node side, the very right side, you have cubelets which more or less take over the role to orchestrate Docker or any other container runtime to start your processes. And this is what you should really, so this is the marketing care about. You have the user side, the API and the container cluster. Okay. This is not what we are doing on this kind of events and congresses. Let's look into it. My main message is, Kubernetes is part of the DevSecOps landscape. DevOps is more or less dead, but it is revoked as GitOps, DevSecOps, SecDevOps or configuration as code as you want, how you want to name it. It's not well defined. And together with the typical stack of security, so confidentiality, integrity, accessibility, Kubernetes adds automation and what most people don't know, the possibility to audit your cluster out of the box in the latest version. So these are the missing things. And there is no good definition of DevSecOps. So for me, it's a philosophy. You take DevOps and add security to every step. And this means it's an educational process. It's about the mindset and mindset needs to be implemented in what we are. So in your brain, it must be clear what's going on. And if you have a map, what all belongs to DevSecOps, this is a typical map. And you see Kubernetes is doing a lot of this stuff. And cloud providers, and you can write your own cloud with Kubernetes, need to do the missing part. Just to remember, this is a complex map and we have to deal with it. So this is the background. Let's go technical. What is a container? So it's often compared to a light-white virtual machine. This is true and not true at the same site. For developers, it very often looks it's a virtual machine. I can install everything in the container. From an operations point of view, it's the wrong approach. Like you see on the right side, you can do it, but it does not fit very well. So from an operations side, you should follow the 12-factor philosophy. One process per container and have a well-defined behavior that the containers can be controlled. So what are containers? Actually, for me, it's not only, oh, Docker is a container. Yes, it is, but containers are a way of isolating and restricting Linux processes. You do the isolation by namespaces, capabilities, and have restrictions like in the C groups or second part of the Linux kernel. And the layout is what you have on the left side with virtual machines. Always needs a kind of hypervisor, typically QAMO KVM. Where you have processes, you can emulate every operating system. On the right side, you see containers are running in the Linux process space. So the real Linux processes in the Linux kernel takes care about the isolation. Whereas on the left side in virtual machines, you have simply the Intel or other processes that guarantee that you isolate with ring zero and other stuff. Linux namespaces are not so well known as intended.  And you have all the namespaces. Most important, most important, you can set the namespace per process individually. You can have processes in the same network namespace, which are completely isolated in a process namespace with a typical thing, which is something you have to have in mind, because the Kubernetes ports are designed in a way that they share common network namespace. Capabilities are also something which is not so well known as the Linux kernel. These are 38 capabilities in a 64-bit area implemented in the kernel. And you have things like cap net admin, then you can change the network layout, can run IP tables, set up private devices, things like this cap net row, which gives you raw access to the network. CapSys admin is in root here. If you have capSys admin for a process, it can do everything. CapSys time, for example, can change the time in a container. You normally have the time, same time as in the host machine. So with capSys time, a container could change the clock. One word of warning, there is a lot of wrong stuff. And unfortunately, even the Bundesamt for Sicherheit in the Information Technik does not know very well about containers and Kubernetes. So it's more or less 50-50 truth and false, what they say about it. And unfortunately, even the EX article in the Heisen magazine is not really helpful. So don't believe what's done there. Just think of your own. And this is going to explain what is a Kubernetes port. A port is where you share the network capabilities. This means you have in both containers the same local host and the same IP tables rules, the same DNS, the same whatever tunneling if you do tunnelings, and everything can be separate. So one container could have access to a different part of the file system. Definitely has different users or mount devices, process IDs. And this is an example. On the right side, you'll see the simple spot. It's just starting an NGINX server. You should simply know a single container is always a port, but containers are really only good if you glue them together in a port. This is an example where you can ensure, can secure an SQL connection with a WordPress server. So I don't like WordPress very much, but if you have to create a WordPress server, it needs access to a database. And here you see on the left side, the green part is how the WordPress server is configured to use a local host, my SQL database. But it does not have a database running. So the right side is another container which is Cloud SQL proxy, which goes directly into the Google Cloud and connects you with additional credentials, which have a different life cycle than your passwords, and encrypt it and open a TCP proxy connection. The TCP proxy connection is secured if you don't like the Google approach. The Cloud SQL proxy is open source. You can, as everything here in this talk is open source, you can use it and redirect it to your own database cluster if you like it. It's not as difficult. So this is a use case where a port makes the database connection more secure than before. The secrets are stored in Kubernetes, so here is a way of generating the username, password, secret for the MySQL connection, and below you see the certificates and private keys for the Cloud SQL connection. So this is typical stuff if you set up a database in Google Kubernetes engine, JKE. If you want to look deeper into this stuff, here are some things I can recommend. For example, if you don't like the BSI stuff, start with the NIST stuff, so the National Institute of Standards from the American government has published a very useful report on how to set up Kubernetes and other container systems secure. So the security architecture is based on a very subtile system with users, service groups, service accounts, namespaces, roles, role bindings, and when you have pod secrets, cluster roles, role bindings, all the blue stuff is just an object in Kubernetes. You can also connect the Kubernetes service accounts and all the stuff to the Cloud identity and access management IAM. This has to be implemented by your Cloud provider. If you want to be your own Cloud provider, I would recommend to implement it on your own. The next thing is pod security policy. It's more difficult because here you protect the local machine from something inside the containers, especially the data layer is important. If you configure Kubernetes completely wrong, then you get access to the host file system and then a privileged container can do more or less everything. I have an example here how you can get access to... in a few minutes... how you can get access to Docker sockets. This is a security system here. What you should consider is setting up your own admission controller that you definitely control what's going on. The pod security policy implementation isn't admission controller. This is controlling the way you start pods in Kubernetes and it even can change the configuration of a pod or a refuser. This is recommended things you should read. If you start deployments, one thing I showed you is the capabilities. Docker has a default set of capabilities which in our opinion and most of the people is completely useless. So drop all the capabilities of Docker which are mentioned there. For example, you have some things like deck override. This is a disk foundationary access control. In Linux, it allows root to bypass, file rate, write and execute permission checks if it's forbidden for root. In my opinion, Steve Grapp is absolutely right and says nothing should need this.  If your container needs this, it's probably doing something horrible. So please switch this off. The only thing you could use is a net bind service which allows your user space application to use privileged pods in the container. But if you use unprivileged pods, you don't even need this privileged. Yes, the privileged system is complicated and we have even things like the exact VE system can escalate privileges if you don't have a flag which says new prifts added to prevent systems like this. This is in the Linux kernel 3.5. It's not a good idea.  If you say, I don't want to do privileged escalation, then you don't get these privileges with the following exception. This is weird. When a container is privileged, okay, I can understand this. When CAPSIS admin is added to the container, it makes sense. But when a container is not run as root and UID 0 is added, so this privilege is added to prevent breaking said UID binaries that you can do as a Zoodo in a container which is nonsense.  Unfortunately, you have to check it with this cat proc 1 status in the second line here that it's not really getting escalated. Thanks to Andreas Peters-Petty from Spiegel online pointing to this issue. I have shared the link where this is discussed in detail. So what can go wrong with some metal configured cluster? You all know the bash-bomb. Here is the cloud-bomb. If anyone has a Kubernetes cluster up to version 1.6, this probably will work. Don't try it in production. Still works in MiniCupid without protection. Here you can start from inside busybox, a Docker process, getting access to the Docker socket and running the Docker binary from inside a container which is nice if you want to build containers, in containers, a security point of view. It's a serious flaw and it should be definitely turned off. We have talked a lot about complexity and everybody agrees complexity is worth any me of security. This is a site from Bruce Schneier's interview in Hong Kong 2012. What he also says is we absolutely love complexities. This is not... I don't want this kind of thing. We have to discuss it. Effectively, my personal conclusion is a philosophical or religious discussion. What we need and what we want is different. We can talk about this, but this is not a technical issue. Here is a network view. You have been warned. More complexity. What you see as a blue part again is what happens in Kubernetes. The example here is if you set up an Ingress which controls the way Kubernetes is accessed by the outside, you can use a certificate in your cluster. In the Google Cloud, it can be connected to regional or to the global load balance which is unseen, as I think, and then you get a global rule to your cluster, which means you have exposed the TLS certificate to the Google global load balancer which is implemented as Maglev which will be in talk on its own, and then you get a certificate. It takes 8 minutes or 10 minutes to get ready, and then Google injects the traffic into your network endpoint groups which gives you 40 gigabit per second performance on the high end. So this is definitely what you want. On the other side, this complexity must be handled somehow. And if you want to write your own Kubernetes application for your own provider, you have to implement kind of custom controller which definitely takes over these roles. On the light blue level, this is on the Linux level. You see here running containers they are orchestrated through container network interface. You have traffic rules, border gateway protocol, and all this stuff. The bottom layer is the hardware which is configured through your Kubernetes stuff. So we have virtual machines, physical fabric, software defined network, virtual private cloud VPC and things like this. So it's a perfect buzzword being what I'm doing here, but this is more or less the main part of the network system. Okay. What we do is customers come to us or we need more security and then I started to offer audits which means we look into Kubernetes clusters of our customer and give them advice what could be better and what should be fixed or start with writing a security model. You don't even know what you want so how can you implement something with security? These are the top findings, the first thing is storage which is not part of Kubernetes. Then images, installations, pod security, audit logs and networks, I will go through this. Most pain point is everybody does distributed databases wrong. So here's the reason for it, if you want to have a positive talk how you can do it right, look into the Berlin buzzwords talk from Bloomberg, Houston, Putman did it quite right I think and anything else is try to understand at least the theory. Just the beauty database has a cap theory. You can only have two of these three parts and replication is hard even if you do it with MongoDB where replication is implemented the easiest way so try to understand it and databases are not well-factored don't do it in Kubernetes if you are not knowing how to do it outside. Next thing are images so you need image policies, registries, image stream things like this and what we see here very often is you are running code from an unknown source S route with full access to the cluster resources which is a terrible idea. It was always a terrible idea and this includes something like kubectl create minus F which can be hijacked, this would be a different talk but it's actually it's a 30 minutes exercise to do it on your own to implement it in any language if you want to learn go it should take 30 minutes and take I don't have time to go into the ham chart part it's the same for the ham charts. We have seen malicious code here in 2014-15 there was hardly any ghost in images and we would never forgive Microsoft for such a mess and this was the problem two thirds or three fourths of the container had high or medium priority insecurities in the docker hub in 2015 and you can protect it by adding special checks in your system in clear or every cloud provider nowadays has something like that and unfortunately it wasn't better in 2018 and I would not give a coin or give a send on that it's better now so be aware check your images you have to set it up your own the next thing is the cluster set up setting up a cluster is easy but maintaining it under production level is hard so keep the cluster up to date you need five people for this we only see two in the projects you have to manage service accounts and users please automate everything in your system add for the version and try to deploy on the latest version of kubernetes always because kubernetes is lowering the security so it might be that you have an application which is not running on a future version because the security has increased put security add put security to your system definitely limits liveness when it extracts our best practices especially don't switch off se linux or app armor use the host file isolation I show you something like this if you want to check for privileges this is a cube ctl command which is quite easy here can you check for the kubernetes security context especially in it containers and this is a go template version and here you see the red things are there is no such thing like security context the greens have good ones typical mini cube run so it's quick and easy to check it check your run time so docker is still the default but it will change this here that kriu is in ud4 rocket is completely outdated you can now at least in the google cloud have a one click solution at gvisor gvisor isolates the files on top you see what you do on a typical system without gvisor and with run time equals run as c you see gvisor is blocking most of the critical access in your system so you can add it and in the future the good news is the run time class will make it configurable gvisor here this is a restrictive port security policy please apply something like this this excludes everything allows only some important and secure volumes and blocks the host network host IPC and things like that completely so the good thing is on the other side you also can add audit logs to your system for example if you want to do step sec ops in health care environment well the game was you build it and we have all kubernetes yaml files in git secrets in a special secret branch you can add the audits to things audits means you can see every time and somebody access in a container or changes something it's noticed and it's written to a logging system in the google version it's stack driver then you can export it to big query then an auditor can only use sql queries and to inspect what's happening in big query if you don't like google you can also do it with elastic search elastic search has a raw base access model on its own you can use it and simply do it this way okay next thing is the network network policy is a must see here is you can add calico which is add network policy in the google kubernetes engine by d4 and here you have the picture every time something changes in the network configuration of a port the cni the container network interface is called and then it changes the network layout which means changing the routes border gateway protocol ip tables the entire physical fabric is actually very fast but it looks complex network policies are like ip tables rules on labels namespaces and ports so this is a typical network policy rule matching roles like the database should also only be accessible by the front end things like this so if you know ip tables this is something you'll really get into the next hot thing are service mesh so buzzword is istio again it's one click solution in google kubernetes engine it allows private public mix clouds so like gke on premises it's also necessary for k natives so the serverless application on top of kubernetes it will be part of open shift 4 it has developed mainly by google ibm and wetted so looks important big names impressive architecture should be secure let's look deeper into it this is a picture from istio shows secure defense in depth 0 trust network all the buzzwords and what they are using effectively are sidecars so here is the layout of the port where you have the istio envoy container which does a proxy work and what they don't mention very public is they running an init container changes the ip tables rules and it's in user space effectively so it has a net admin capability net admin capability is some people say it's nearly like net sysadmin and on the side they also have a ca and citadel and all this stuff so let's look into it this is a picture of a service mesh so from right here you can configure everything you are running sidecars sidecars control the network your microservice application is not is not able to escape the rules of the sidecar really here is how you can escape from the rules so sidecars are used in user space so you can revert it but simply running this ip tables rules from a different container and it takes the istio proxy container itself to remove these rules again and here you see how we classically remove ip tables rules and then all your network security is voided and this is really a problem for the cloud so you have added network security but you have lost multi tenancy because if everybody who can deploy something like this can remove the network security you have a problem so it should be added at least the pot security policies that you are not allowed to do this so I found this file the bug in January included this exploit disclosure limit of six weeks I forgot the issue then I received an answer in March so eight weeks okay seven weeks from Tau Lee Google Florida and I was not the first who invented this bug but I think this is a script curly approach it has been confirmed and they told me that in istio one dot two the container network interface will take over the thing so the same thing which is more or less not in user space is done now and the container network interface can be used and cannot be controlled from from a user port so istio one dot two is ready now but it's not rolled out out everywhere so it's still a side car so be aware that you have to fix something not many people are running istio at the moment fortunately but in the future we will see more of our customers doing this implementations with istio so the conclusion it's lengthy but actually it's a lot of fun working with Kubernetes and for me it feels like working with unix and linux in the early 90s so you see a lot of low hanging fruits and security if you know the good old system engineering and you question the marketing slides you can find a lot of flaws I think and I did not even look into the go code DevSecOps in general is a good idea we see it in our customers projects but don't forget the sec if you dive deeper in a system like this you will find flaws it's inevitable the flaws are presented here the docker flaws are parts of docker and not part of Kubernetes and part of the weird capability system of linux which simply should be cleaned up you will see a lot of buzzwords and you will see the typical thing you focus on one security aspect and then somebody has a back door and does something completely weird behind your back trust nothing for me it's a buzzword you always have to trust somebody you have to trust the code you have to trust your cluster you have to trust your users if they are doing but okay you can trust no network cluster now you can support it if you look deeper into it by writing and responsibly disclosing a plot the community is really friendly and supportive so you can get back some things and that's everything what I wanted to tell you so start using it use it responsibly and just have a way of looking into the security so if you have questions try to stay above all these clouds giving a workshop on this in the sea base area at 3pm so let's go for it okay thank you very much questions has anybody a question please raise your hand is there any questions from the internet no questions from the internet okay go right away what's the security issue with that is your sidecar in particular actually you can switch it off by deploying this net admin container additionally so it's just in user space you have trust your containers if they would have done it right they would have written an admission controller which does not allow a net admin capability on its own would refuse this kind of container and then add the sidecar container it's just an internal attack so you think you are secure but you can simply remove all the security so it's not so the proxy container is not controlling your connections but it can show you the exploit working if you come to the workshop the actual application itself is the actual application itself is still running unprivileged yeah it's unprivileged but for example it can telephone to the home base so it definitely can circumvent all the egress and ingress network restrictions if you got project level permissions me you don't need project level permissions you need simply setting up this cluster and then you do the Istio injection and then you this container is running after Istio has injected the security rules and then it's removed again thank you welcome hi there thank you much that was a great talk I'm a CNI maintainer by the way so hi have you seen cube let me in so anyway we can talk about afterwards but there are some well known vulnerabilities in most Kubernetes providers and if the project cube let me in is script kitties for Kubernetes and it can exploit like GKE OpenShift those things like that I believe that it's possible if you collect all the things together you have a nice collection of this kind of stuff any more exploits you find we can put it together yeah great thank you thank you please go on but please talk a little slower it's hard to hear on the stage thank you for the talk it was very interesting I was wondering if there is any way to make helm the package manager more secure or you don't recommend using it at all what I would recommend is to limit to a certain namespace so you have a very well known option minus minus tiller namespace and then you can inject this tiller application which is really not necessary in the future it will be removed in helm 3.0 and then you have it in the namespace only and then you can the damage is limited to this namespace so normally now it has full system access and you can remove everything and this is a problem any more questions from the internet ok thank you very much I close this talk now big applause for Thomas Fricke


Ah Reactions You could follow us on Instagram. Yep, which are yep from more juicy content. Yep. Thank you to everybody Follow us on official Twitter counts. It's true like and button for those of you who liked The the after thoughts and behind the scenes I used to do on my channel. No one did There's five of them. Ah, nice. I'm doing stuff like that along with other stuff is naked every Sunday on my Instagram from nine No, 10 30 a.m. Pacific which is 11 p.m. India time for an hour on Instagram live every Sunday And I answer questions that you guys put in the comments, especially ones that pertain to the kind of sex that Corbin and my mom have I'm not there. I'm crying about football That is very true at least in the fall in the winter. Yes. Yeah, and then then the spring I'm hopeful was yesterday was yesterday as painful as it looked I saw the snow Were you weren't you expecting to do better against the two and three team? Well, he turned her ball over three times That's that's why we lost. Yeah, we're talking about the Atlanta Falcons when you turn the ball over three times You're probably not gonna win. Yeah but Overall, it wasn't terrible, but there was some awful things. Yeah, unfortunately Anyway, it's today. We got it's a guts and does a lot I think the largest Hindu temple outside of India is now in America really built It's a new Jersey apparently really I have I have friends in New Jersey So this is apparently a grand new Hindu temple cool Largest, I guess in the world outside of India now. Wow You've been to New Jersey never been to New Jersey. I have friends.  What are you talking about? You've never stepped foot in New Jersey Think about what you just said Is New York a New Jersey? No New Yorkers look down on New Jersey. Yeah, but you did you never drove through there ever What would I go to New Jersey? I don't know. I've never been to eat They're like right next to each other though. They are but that's like saying you in San Antonio. I've never been to you know Stone oak. It's like right there. Well stone oak is in San Antonio Yeah, but it's like five feet away from it But you'd have to have a reason to go you have to go across the new restaurant the New Jersey turnpike They're compared to being just where you are right there in Manhattan.  I've just never been but I will be soon because our friends Michael and Mary live there. We are absolutely gonna go spend time with them and visit So it'll be our first time in New Jersey, which my wife is very excited for because after watching the Sopranos That's all she wants to do is now go to the place where Tony Sopranos was new joys. Yeah Yeah, never and we had lunch They were in town recently Michael and Mary and they said to her exactly what I said to her because she was so excited to go And they both looked at her. These are New Jersey residents and they said You realize New Jersey is not that exciting It's like going to Orange County. Yeah Anyway, so this is a video about the new large Hindu temple the biggest in America We have one we haven't been but there's an interesting one. I know in the Santa Monica Mountains in the mountains I've driven by the entrance to it. Yeah, I've been intrigued to go in very pretty Yeah, but I've never been anyways, here we go Largest Hindu temple outside of India now stands in central New Jersey a grand dedication was held today for the awe-inspiring place of worship CBS 2's Marcella Bayetto reports. Well, not a lot of information weird coverage by at toe reports It's a moment. Whoa 12 years for the completion of the second largest Hindu temple in the world opened on Sunday Celebrating the monumental day during the grand dedication. There's no way that's handcrafted, right? This is meant for everyone. It's universal in the midst of 185 acres this space of worship is adorned with intricately handmade statues and carvings of stone from all over the world and man is called the Muhammad there and To devotees, it's a place of worship to many other individuals. It's a place of learning center to other individuals It's a architectural piece and my Goodness of their home the attention to detail was also seen inside Captured the images during one of the few times cameras will be allowed in the temple Each piece of stone was assembled by more than 12,000 volunteers like Shruti Bhatt The extra time was the vision of Ramakaswamy Maharaj who was our who's our late spiritual leader of BAPS and he lived by the credo that in the joy of others lies our own Volunteers a great statement. Look at that building location for this campus was because of its close proximity to different places like Washington, DC Philadelphia and New York City allowing people to visit more easily Strategically, it's placed in a way where pilgrims from all over the world can get here easily But also it serves the 35% of the Hindu American population in America Bridging the gap for generations to come between Hindu Americans and other communities by showing that there are little differences between us all You walk around the one there you see Extraordinary Dr. Martin Luther King President Abraham Lincoln Lucius Socrates. They may look different, but your neighbors aren't all that different in Robbinsville Marcella by Edo CBS News Philadelphia damn That is a gorgeous building. Take me to Robbinsville, New Jersey So where it is? Take me to Robbinsville, New Jersey Is that where it is? Yeah, and if you just saw me typing a second ago, I was typing that quote. Which one? Um, I would love to know. I don't think it'll be able to I'm gonna pull out from here And go back across come down and I want to see how far into Jersey. This is okay Yeah, it's it's it's it's Deep in the heart of New Jersey.  Well from Long Island, it's gonna take a while. It would probably take from Manhattan Going in I said I I bet it would take the better part of a 90 minutes not bad 90 minutes to an hour. Yeah, 90 minutes to an hour. There's traffic out of Manhattan through the turnpike and then through Yeah, I could check that distance but the quote that I wrote down was in the joy of others lies our own that that is a That is a Incredibly profound and beautiful statement. Look at that. Look at that. Okay. Yeah. I'm I am also did it flabbergast How long did it take them to to construct this especially?  Yeah, and I like these buildings a lot more than like Nothing he gets Mormons, but like Mormon temples where they just make massive buildings Not really like that pretty or anything. They're just really really tall Like just to see from everywhere Like these like this is like well the guy said he's like some people it's place of worship Some people it's a cultural center some people it's like just an architecture Architectural wonder. Yeah, and this looks like a lot of the temples we've seen in India like the old school Yeah, that's what was so that's what was so astonishing to me as I didn't expect to see something in America that looks as ornate and intricate and old as It looks like it was just taken out of India and plopped down here and I love the inclusion of So many different quotes and quotes that just have universal truth attached to them man I I Absolutely will remember because at some point in the next year We really do want to get back east and especially go visit our friends in New Jersey. I would love to go visit this Did you ever go to like temples like these? Back there to my knowledge. There's nothing this size in in Kolkata. There would be things that she could go to But I don't know what she had had gone to the biggest thing for her Was Durgapuja and and and the panels for her. Yeah for sure that those were the most important places for her spiritually I would love to just go to See the architecture of this thing all my stars It's it's jaw-dropping. I can in person. It's got to be even more spectacular. Yeah, I can just on video It looks great. Thank you stupid babies for Teaching us about this and letting us know that this exists Yeah, and though the one that we have at least the one that I know I'm sure we have multiple in Los Angeles because yeah There's a there's a bunch of them. They're in but no, we're near the size They're small And if the audio sucks something happened to our microphone in the midst of yeah, so sorry It might have terrible audio, but we'll finish up here, but that was a absolutely gorgeous Beautiful if you've been here let us know about it obviously and anything else other information that we need to know


Mar-Ville and DC got a fair share of their superheroes into 16 bit games. Marvel got Spiderman and the X-Men into multiple games, DC got Superman and Batman into a few. Into 1995, Image Comics joined the party and got their first superhero game with Todd McFarlane spawned the video game. Yes, that is the game's full title, and yes, I will be referring to this game simply as spawn, as any sensible person would.  So, is there anything that makes Spawn stand out from its contemporaries? Actually yes there is. Spawn is kind of a beat em up fighting game hybrid, incorporating street fighter style commands into regular combat, so Spawn can do stuff like throw fireballs and teleport. That's pretty badass. The only problem with this is, well, the game doesn't exactly tell you that you have all these capabilities.  One solution to this could have been to treat it like how Mega Man X earned his abilities, by finding them one at a time in hidden areas where Dr. Light would helpfully describe what you can do now. I'm not asking for my hand to be held, just let me know in whatever way that I can do all this cool stuff. Because there are quite a few of these moves, there's a full screen attack, there's a multiple fireball attack, an attack that freezes enemies, and each move costs a certain amount of life points. That's what that counter up there at the top corner is.  Take sections like this here, where everything is moving so slowly, and you've got all this stuff attacking you, you're pretty much just trapped.  Anyway, another aspect that makes spawn a little different is that there's no three-dimensional plane here, or no y-axis in other words, this is a pure side-scroller, similar to how Ninja Warriors is laid out, I mean it pretty much has to be that way for the fighting game moves to be able to be implemented. Despite my nitpicking though the combat here is well done, take for example another game that tried to do something similar, like Batman Forever, that game is a complete disaster. spawn is light years ahead, and much more polished. Another major factor that makes spawn stand out is the visual design. Not only are the graphics and sprite work great, but the whole presentation here featuring still shots with some fantastic artwork here, it goes a long way toward making it feel like you're playing through a spawn comic. The spawn sprite in particular is really nicely done, the cape is super detailed and the combat looks really cool. I was impressed by the music here too, which fits the game nicely. In terms of a total package of visuals and sounds, spawn seriously might be one of the very best on the Super Nintendo, I mean just look at these backgrounds, that's badass. There's 17 levels here, and that can be seen as both a good or a bad thing. On one hand if you love spawn and you love this game, there's plenty here for you to enjoy, but on the other hand it's still just to beat them up at its core, so the gameplay can really drag. On the bright side there's at least a password system here, so you don't have to beat the game in one sitting, and there's unlimited continues as well. So yeah, is spawn worth playing today? I do think the game should be commended because it does try to do something a bit different in a genre that has all sorts of boring and generic button mashing gameplay. Not only that, they get a little creative with the level design here and there as well, like spawn needing to carefully float down to the bottom here without taking too much damage, that's a little different. So yeah, while spawn may not be on the level of something like Batman Returns, I do think it's on the same level as something like Death Return of Superman or Captain Commando. If you like the beat them up genre but are looking for a slight twist on the gameplay, it's worth checking out.


If you spend any amount of time reading scientific papers, it's likely that you'll quickly notice there are two different strategies to writing the captions that accompany a scientific figure. In the first approach, the scientist will merely state what the figure is. It's very passive, it doesn't tell you much. In the second approach, the scientist is much more active in telling you what you should see in that figure. Which do you prefer? Well, today we're going to use that second approach where we're going to tell our reader what they see in the figure as well as giving a description of what they need to know about the data. Hey folks, I'm Patch Loss and this is Code Club. In each episode of Code Club, we apply principles of reproducible research to a biological question. Again, the biological question really isn't that relevant to the overall issue of learning these strategies to improve the reproducibility of our research. Today, we're at the point of our analysis where we're working on the manuscript and we're ready to put in some captions, some figure legends for our manuscripts to describe the figure that we're presenting. We also need to do some other modifications along the way so that we have our figures in the right place and in the right format.  And I am now going to go to my manuscript.rmd and down here at the bottom I've got my figure captions. And again, what I put in here were really just a rough start because no one likes watching another person type. I've already gone in and pounded out some text to make some figure legends for these two figures. Let me go ahead and grab each of these two figures. So the first figure is esv-rate.pdf. And you can see this the figure here. And again, what we see is the number of genomes on the x-axis. Each dot represents a different species. The y-axis represents the number of ASVs that were observed per copy of the RN operon. And then we've got the four different regions depicted with the four different panels. So what did I say about this? The ratio of the number of distinct ASVs per copy of the RN operon increases for a species as the number of genomes sampled increases, okay? So this is what I want you to see in the figure, right? That as we sample more genomes, we see more ASVs per copy of the RN. It's not like as we sample more, we're plateauing. It continues to increase. And so then that's the declarative statement. That's what I want you to see. Now, the other information that the reader might need is also here in the figure legend. Sometimes people write entire paragraphs as figure legends. I'm not such a fan of that because a lot of that information is also over in the methods section. And I don't know that it really needs to be here and written out so verbosely. I guess there's a bit of a trade-off between like how independent should each figure legend be, each figure be. So if I pulled out that figure and looked at it on its own, should I be able to interpret that without having to read the rest of the paper? I mean, I think there is a trade off there, but I don't think you need to embed your method section in the figure legend. So what did I say? Each point represents a different species and is shaded to be 80% transparent. So that was the alpha equals 0.2. So that when points overlap, they become darker. The blue line represents a smooth fit through the data, okay? Very good. And again, the declarative sentence, the initial part of the figure caption will be bolded. And if you look at papers published in M-Sphere, which is where I plan on submitting this, you'll see this is the general format that people are using. For figure two then, as the distance threshold used to define an OTU increases, the fraction of genome split into separate OTUs decreases while the fraction of species that are merged into the same OTU increases. Let's look at that figure so we know what we're talking about. That was the lump split PDF. So again, as we increase the threshold as we go across the x-axis, the fraction of genomes that are split apart decreases. And the fraction of genomes of species that are merged together increases, right? So what else do we say here? These data represent the median fractions for both measurements, the fraction split, the fraction lumped, across 100 randomizations. I don't think it likes, I think it likes randomization but not randomizations maybe. I don't know, I have that red thing underneath it. In each randomization, one genome was sampled from each species, okay? So again, looking at this figure, I think that, I think that's a pretty good caption. Again, it's declarative what I want you to see for this. And again, I don't know that the variation between the four regions is really all that big of a deal. But anyway, so I think that works pretty well. For figure S1, the supplementary figure, this is the rock curve. If I go ahead and open up rock curve PDF, I'll make this bigger for you all to see. Distance thresholds larger than 3% provide better sensitivity and specificity when assigning ASVs to OTUs when trying to represent species level classifications, okay? So again, what this goes back to something that's stated in the methods and in the results section of how we define sensitivity and specificity, and that we have a 3% threshold here on our rock curve. And that if we look at close to optimal classification, that's again close to this point, perfect specificity, perfect sensitivity. And then this is equal sensitivity and specificity, what threshold gives us that. So again, this is a supplemental figure, because I don't know that the sensitivity and specificity values themselves are so critical, as much as the threshold that gets you there. And those thresholds are in the results section paragraph. This is a supplemental figure, again, showing people what the rock curve looks like. So what else do I say? The sensitive reason specificities for ASVs were blah, blah, blah, blah, for the V1, V3, V3, V4, V4, V4, V5 regions respectively. And I say that because that's way down off the screen, because if we zoomed out, then we wouldn't see as much separation up here. And all we would see was that ASVs are kind of crappy at depicting species. So we need to plug in these values. And so I feel okay about zooming in as long as in my legend here, my caption, I indicate those sensitivity specificity values. So we'll have to come back and get those. The gray diagonal line represents the position where the sensitivity and specificity were equal. Again, that's this gray line. These data represent the median fractions for both measurements. For both sensitivity and specificity, I think I copied and pasted from the previous one across 100 randomizations. In each randomization, one genome was sampled from each species. Okay. Good. So again, we can then make the submission manuscript PDF. I can open up my manuscript. And if I scroll through the bottom here, I now see these expanded figure legends, figure captions, whatever you want to call them, that go with each of my plots. And I think they look pretty good. This one goes on two lines. It's not the end of the world. I suppose I could make this one a little bit smaller, but whatever, it doesn't matter for the figure caption. Although that kind of annoys me. So maybe maybe I will go back and modify that here. I think ultimately, you know what, no, I'm going to let it go, because what's important here is that this is the figure size that's going to be published. And there's no need to shrink it down any further. I think that will be, I think that'll be okay. All right. So I won't worry about that. So what I do need to worry about though, is plugging in these values where I currently have X values. And we've already read in the rock curve data up ahead. And if I come back way up here, the sensitivity specificity, I'm going to go ahead and run all the code chunks to this point. And then I will run this code chunk so I can get the sensitivity specificity data frame to then work with further down in that specific in that supplemental figure caption. So I'll run this.  I'm going to bring that back down here. And I will make a code chunk. And now I want to work up these values. Okay. And again, what I will do will be to say filter threshold equals equals zero. And I misspelled threshold, of course, because that's how I roll. So these are the four values. I want to make sure that my sensitivity and specificity are rounded to three digits to the right of the decimal point. Sometimes this value gets output and it's really like 0.995 or four or something. I doubt it's actually one, but we want to see what it is to three significant digits to the right of the decimal. So as we've seen before, we can do format, or we can do mutate. And I will call this sensitivity. And we will then say format, sensitivity digits equals three, and small equals three. And so if we look at that, we see that these values that this has now turned to a character column. We also want, we'll copy this down to make specificity. Right. And so we run that. And now we see that we do get three digits to the right of the decimal. And it's 1.000. Sure, it's not perfect, but close enough. We're not going to represent all the decimals out there. So the way I've described this would be that we have the sensitivity and specificity. And so with a diagonal or a forward slash between them, so I will now make this a pretty column where I do paste. And again, I said sensitivity specificity. So sensitivity and specificity. I'll do sep equals that forward slash. And so I now I see I have this pretty column. And that looks great. And I will call this ASV son spec is that and now I need to build out individual variables that I can put into here. And I will do v19 is ASV sends a spec.  So I'll do filter region equals v19. And then pull pretty. And so then if I look at v19, it should be the sensitivity and specificity for v19. Okay, so v19 34445. 34445. That looks great. And again, if I build those, I can now come back down here. And because I've already done the formatting with the forward slash, all I really need to do is our forward slash v19. And it will then plop that value in there. And here. And of course, I need to put in the actual value. So this will be 34. And I want to make sure I get the order right, corresponding with the listing of the regions at the end of the sentence. Okay. So I think that's good. And let's go ahead and build that. And we'll see if our figure legend is complete. And again, zooming in on this, we see that sure enough, we have those values in there. And again, they're bolded for now, just so we know where the output of the inline code is being inserted. Okay, great. So we I feel pretty good about these figure captions. And and I think that's that's pretty great. The other thing we need to do, of course, is we need to call to these figures in the body of the manuscript. So if I come back up to this, remember, there's three paragraphs to the results section. So this was the first here, and we already have a call to figure. And so I'm going to call this figure one, right, so that described as the number of copies of the operon genome increase, the number of variants of the ASV and genome also increased figure one, right? Actually, that's not there. That's describing this next sentence. Down here actually is the figure, right, although a species tended to have a consistent number of six and s copies per genome, the total number of variants increase with the number of genomes that were sampled figure one. Okay, good. So we've got that. The other thing that's important to keep in mind is that the figures need to be presented in order. So we don't say figure two and then figure one, we do figure one and then figure two. I know that's obvious, but you'd be surprised how many people slip up on that. All right. So down here, then we have a method to avoid splitting is to cluster sequences together that are similar. All right. All However, this also increased the risk of lumping genes together from different species that were similar to each other. And so we can then say figure two, right? And I'll put this in bold, like so. And I think that's good, that sets up the rest of the paragraph. And then hopefully you can see that the rest of the paragraph describes some of what's going on in the rest of the manuscript. And I think actually I'd need this further down like that sentence is kind of describing something that I think is a little obvious. So now we need to put place figure two. And I think figure two will come down. Let's see. So at thresholds of blah, blah, blah, blah, blah, blah, that's where we then saw one O2u for genomes that had seven copies. However, at these higher thresholds, multiple species could be represented by the same O2. At the highest level of resolution, shared a sequence variant with another species blah, blah, blah. At the commonly used 3% threshold of the species shared an O2 when considering full length sequences and blah, blah, blah. Okay. All right. And so what we can do is I'm here I'm going to put figure two with my double star to make it bold. And at the high level of resolution, yeah, so that's good. Now we need to insert the call out to supplemental figure one. And let's see, talk about the confusion matrix, all that kind of our methods. And so we talked about the receiver operative characteristic curve. So here then we can put in figure s one. Okay, and we'll save that. And so now we've got the call outs to all of our figures. And we are then ready to build that and take a look at the manuscript. And if we come back up to our results section here, we'll see that we have the call out to figure one where so figure one is here. Figure two. And then supplemental figure s one figure s one. So again, besides getting the numbers in the right order. The other thing is to make sure that all of your figures are actually included. There are some more fancy things you can do within the tech that's kind of frankly beyond me, so that you don't have to really worry about the numbering of your figures. And so that that's all done automatically, so to speak. I don't know how to do that with three figures. It's not that big of a deal. This is a pretty simple paper. I'm not so concerned about making those links. But know that if you do a little bit of digging, you can figure out how to make a link between the figure number in the text and the figure at the end of the paper. So the next thing that I want to do is return to our make file. And we had some problems with our files with our tiff files just being gigantic, like close to 10 megabytes. And that for whatever reason, it wasn't compressing the file in gg save. And what I'd like to do is I'm going to I also need to to kind of port over those files. So I'll do some to the manuscript directory. So I'll do or to the submission directory. So the submission figure one dot tiff. And I'm going to say that is dependent on figures. And I will then say ESV rate dot tiff. And I'm going to use something from a package called image magic called convert.  But this is image magic. You can get through this through homebrew on a Mac. I think if you do brew install image magic, you'll get it. The command we're going to use is called convert. And it allows us to compress our data, compress our image file. So we can do convert, compress, and we will then say LZW and the input to the output. Right. So I could use the the match the automatic variables for make but I bother. And so we will do this for our other two figures. And so figure two and figure s one. And so this is lump split dot tiff. And then this is rock curve dot tiff. And I'm then going to make this submission figure one, figure two, and figure s one. And and that's going to be tiff. So I'd like to see if we can get rid of having those PDF versions of the files. And let's go ahead and make one of these first just to make sure it works. And we will do make submission figure one dot tiff. That ran so if I do LS LTH submission figure one dot tiff, and then figures ESV tiff. I see that yeah, the compressed version is like 500k versus close to 10 megs. And if I open those, we'll see that the figures are the same, right? So there's no distinction between those. So that worked nicely. And I can again do make that and figure two dot tiff. No, not one, two. And submission figure s one dot tiff. And so that'll build all those. And again, if we look at submission star tiff, we can see, I think I forgot to do something. It all worked. Ah, I should have used the automatic variable. Maybe I'll go ahead and do that. So I'll do the dollar sign at because basically, I copied and pasted, but didn't update it all the way down. So again, to get the target, it's dollar sign at. And to get the dependency, the prerequisite, we can do dollar sign less than. And that should work. And so if we make all those things, that builds those out. And now if I look at my tips, I see they're all quite small. And what I'd like to do is again, if I come back to my figures, I want to see if I can put in figures, or let's do submission. Actually, I don't need to do submission because I'm in submission. So I should be able to figure s one dot tiff. And then this will be figure two dot tiff. And then this will be figure one dot tiff. And let's give this a go. Hopefully the tips can be embedded into that file. We can do make submission manuscript PDF. So it balked at the tip. So anyway, it's not happy with that. I'll go ahead and I'll go ahead and put those PDFs back in there. That's fine. Again, this is only for the initial submission that we can include the figure, the figure inside of that inside the our markdown document. And yeah, so I will also what? I'll go ahead and add those targets to this for now. So we'll do figures. What was it? ESV rate dot PDF figures lump split dot PDF, and then rock curve PDF. Okay, so now when we build it should hopefully work. So that worked. And again, if we look at our manuscript and zoom in a bit. So it's easier for you all to see. You can see that the figures are embedded in here. And they look they look good. Okay, so again, this this all should work. I don't know why gg save didn't work with the compression that still is a little bit frustrating to me. But that's fine. It's awesome. I'm sure there's a way also to embed tips inside of a PDF. I just don't know it. But again, this is good enough. This works. I don't want to shut that. But again, if we look at our manuscript, we're getting there, we're getting pretty close. Everything is here, except for the abstract, the important section, and the references. So we need to insert references, we need to abstract the importance, and we need to do a fair amount of editing before we're ready to submit the manuscript. But that's what we're going to do next. I'm not sure what I'll do next, whether I'll insert the references or I'll write the abstract and important section. And needless to say, when we insert the references, it's probably going to be a bit different than you're familiar with inserting references into a manuscript. But it will work well with our markdown. And it will. It'll be it'll be pretty slick. You'll see. Anyway, I hope you found this useful in thinking about again, how we write figure legends, the different strategies you can take. I know people are of two minds of whether or not to be passive or more active in how they describe their figures. Again, I prefer active. People think data speak for themselves, but the data do not speak for themselves. We give voice to the data. And so that's why I think it's important to give a more active presentation of the figure in those figure captions. Anyway, let me know your thoughts down below. Are you passive or active? Do you write a whole paragraph of text for each of your figures? What what do you think and what's what's your philosophy?  But anyway, hopefully you found this discussion demonstration useful. Keep practicing. Please be sure that you've liked this video so that I know what you find interesting versus what you all find boring. I don't really have a lot to go off of if you don't give me some interaction here. Anyway, please tell your friends about Code Club and we'll see you next time for another episode.


Man born from dust was strong wise and resourceful, but he was born into an unforgiving world So you may prepare your guardians, but take heed There will be no victory in strength But perhaps victory is in the simpler things that you've long forgotten things that require a smaller more honest soul Ruby Rose, where did you learn to do this? Signal Academy and what is an adorable girl such as yourself doing at a school designed to train warriors? I want to be a huntress want to slay monsters. Yeah Well, okay, oh I can't believe my baby sister is going to beacons with me. She's stop. So, what's your name? I'm wise like Yang, John, Kira, Rin, Nora Nora! Great, the gang's all here. Now we could die together. You've traveled here today in search of knowledge To hold your craft and acquire new skills, but your time at this school will prove that knowledge can only carry you so far It is up to you to take the first step. The scythe? It's also a customizable high-impact sniper rifle. What? It's also a gun


Are we ready? Play! We are inside this yellow area, up to that white line, trying to keep the ball away from Reggie. You understand that? Reggie, have you in it? You stop it on any line. It can be that line, that line, or that line. You've got that. You've got to try and win the ball off us. Are you ready, Reggie? Play. Yes, Ollie. Oh, he's won it. Can you stop it on the line? Stop it on any line? Good lad. Well done. And relax there. Right then, keepers. What are you going to do? So, they're going to come in. Now, the keepers are involved in this bit. If they see a loose ball, OK, so if that ball's travelling here, all here, all here. What are you going to do? Good man. He's going to go and get it, and he's going to play it to the defender. Ready? Play. Don't just stay with the same one, Batch. There's the loose ball, and he wins it. Good Jack. Well done. Can you get it to the defender, Jack? Are you ready if I'm playing? Are you watching me? Are you ready? Letting Ollie is it. So I need to stop this one first of all, don't I? Are you ready? Now I might get it because I've got him trapped. So there we go. Do you see that? So you've got to try and work it. So you might show him which way. You might show him there. There you go. Good boy, Reggie. Well done. Excellent. Ah, relax there. Right then. Who wants to show us? Ooh. We'll have a Louise group. Who's with Louise group? Everyone else? Just pop out for me a second. Are you ready? Play. Can he win it? OK, OK. Good. Oh, there we go. Has he won it? Good boy. Ah, relax there. Why do you think he pressed there? Yeah, not much space for Sam to move in. So that was why you pressed. Is that correct? Good man. Well done. What does he need to think about now in this as well, though? If you're a defender, what do you need to think about? Cutting off the pass. Yeah, cutting off the pass to the other player. Good man. Well done. OK, change over. Let someone else in your group be the defender tonight. Play. Bash. Keepers are doing the same thing again. At some point you might have to press the ball, Remy. Well done, Jack. Good lad, Jack. Throw it to Remy.


So we're in Deuteronomy 8 and I just thought about this text because that's where that title comes from. We're not to live by bread alone, but by every word that proceeds from the mouth of God. And so in looking at Deuteronomy 8, as we've been working through the Gospel of John on Sunday mornings, we've been spending some time in the Old Testament, especially with respect to the Feast of Tabernacles and once before on the Feast of Passover and a lot of those pictures that the Old Testament provides. And so we see a picture of that in Deuteronomy 8. And as a preacher, I know Pastor Rick, Pastor Marcos, as well, you know, we've heard at one time or another, and it's true, we've heard it often said that every great season of reformation in the history of the church, every great hour of spiritual awakening has always been at a time ushered in by a recovery of the biblical preaching of the Word of God. Everybody think about it. Every great period, great awakening, great revival in history has always been ushered in by a recovery of biblical preaching. Every great revival has been ushered in by a recovery of biblical preaching of the Word of God. And I'd like to add to that statement tonight that what is true for the church, what is true for the bride, is true for the individual people of God that make up the church, that make up the bride. In of a life, restoration of the soul to spiritual health and vitality always comes upon a refreshed commitment to the means that God has appointed to that end, namely to the reading, to the study, to the meditation of God's Word. So to the Christian now, we know that the Bible are the words of God are the Christians delight. Jeremiah said in chapter 15, verse 16, your word to me, Lord, was the joy and rejoicing of my heart for I am called by your name, O Lord God of hosts. The psalmist says in Psalm chapter one, verse two, but his delight is in the law of the Lord. And in his law, he meditates day and night, Job said in chapter 23, verse 12. I have not departed from the commandment of his lips and I have treasured the words of his mouth more than my necessary food. I love that one. In Psalm 119, verse 162 says, I rejoice at your word as one who finds great treasure. Do you feel that way about the Word of God? Is that evident in your life as a believer? Do we cling to the Word of God that way? There's a story of an old Scottish Presbyterian pastor from the 1700s named Walter Scott. And Walter Scott traveled through his lifetime over 90,000 miles, which back then mostly on foot and by boat, a lot of traveling and preached over 9,000 sermons during that time. Near the end of his life, he said to his secretary, bring me the book, he said. So his secretary looked at the library outside where he was and he saw, and she saw thousands of books and she came back in and said to him, Dr. Scott, which book are you talking about? He said, the book, the Bible, the only book for a dying man. Now that's true. And as much as we know that the Bible is a book for dying men, it's also a book for living men because it tells us our hope gives great hope to the living. So we are to be a people of the book. Christians are to be a people of the book primarily because God has made us and because we are his people. That truth can often be lost on people when you get into the busyness of life with work intruding on your time with family needs and requirements with kids and with the other pressures of life. It can often be missed, but we belong, we belong to God. We are his people, the sheep of his pasture. Genesis 126 says, and God said, let us make man in our image according to our likeness. Let them have dominion over the fish of the sea, over the birds of the air, and over the cattle, over all the earth, and over every creeping thing that creeps on the earth. So God created man in his own image, the image of God. He created him, male and female. He created them. God is our maker. We belong to him. And then, because God's word is said in Psalm 19.7, to be perfect, converting the soul, God of his own will brought us forth by the word of his truth. Once fallen and depraved, fallen away from God, separated by God because of our sin, to be his people, God redeemed us to himself through his word, which is perfect and holy, converting the soul. He brought us forth by the word of his truth, James chapter 1, verse 18. And now, as those who are God's people, bought with a price, having been brought forth by the word of his truth, having placed their faith in Christ, we are, as Colossians 3.16 says, we're to let the word of Christ dwell on us richly. In all wisdom, teaching, and admonishing one another in psalms and hymns and spiritual songs, singing with grace in our hearts to the Lord. Our God who designed us and created us is the one and the only one with the right to determine and impose his rule and reign upon our life, our belief, and on our conduct. And he does that through the administration of his word and the power of the Spirit within us. He does that through the administration of his holy word. And I was thinking about this, it was a reminder of an illustration that, it's a silly illustration, but it helps make the point, and it's often the silly illustrations that help us remember these truths more clearly. But the illustration goes like this. If you go out in the parking lot and you see a car, and the car has been flipped over on its side, and its wheels are spinning, the engine is revving, you see the lights flashing and the horn is just blinking. The radio is going, it's got old 70s tunes on the radio, because that's the only kind of music it'll play. And let's say for the sake of our illustration that you go out in the parking lot and the car can talk. So the car says to you talking, he says, listen to me, I can make noise, honk, you know, it's over on its side and spinning its wheels, and I can spin my wheels, it says, no one ever who owned the car would allow the car to do that, turn itself over on its side and make that kind of racket and do that kind of thing, put itself in that situation, and why? Because the car was never rolled off the production line to function in that way. It was never intended to function like that. Does it have the capacity to function like that? Yes, it can be flipped over on its side, can spin its wheels and it can honk its horn. Some today are even designed to talk to you, but that's not the reason of the purpose for which the car was made or manufactured. It wasn't designed by the manufacturer to operate in that way. I once saw a bad accident, it was in claims for a period of time, and I saw a terrible accident where the car had been wrecked on the interstate, had run head on into another car, completely wrecked, and the horn was jammed, the horn was stuck, and so the horn wouldn't go off, it was just constant steady stream. It wasn't manufactured to be that way, but it was a beat-up wreck. It was doing nothing but making noise, could do nothing but make noise. How do we know what the car was made for? We know what the car was made for because the manufacturer tells us. And the manufacturer gives us an owner's manual. The owner's manual tells us how the car is to function and the ultimate purpose for which the car was manufactured. Now, think about it, again, who is our manufacturer? God, and do we have an owner's manual? Yes, we do.  He as the manufacturer gives us an owner's manual that tells us those things. Those who rebel, who go off on their side, spinning their wheels, tuning their own horn, they can do that. They weren't designed by God to function in that way. We were designed by God, created by God, to function in the way that God has designed us to function. God never made us to have a heart and a mind depraved and fallen by sin. He never made us to have a heart and a mind separated from Him in any way, separated from Him by our sin. We're not to go off spinning our own wheels and tuning our own horn. As we come to Deuteronomy 8, we see God in Deuteronomy 8 now, with His people again administering His will for His people in the wilderness through His word. And I want to make some specific applications from this passage for us in our church today. So in Deuteronomy 8, verse 1, the first thing we read is that every commandment God says, every commandment which I command you today, you must be careful to observe, that you may live and multiply and go in and possess the land of which the Lord swore to your fathers. We think of ourselves, and we've done this going through the book of John, in a second Exodus so to speak. We too wander in a wilderness, the wilderness of this world, and we too are serving the Lord, obeying the Lord, trying to, faithfully, in the wilderness, awaiting our inheritance in the same way that the children of Israel were at this point in time. But here God gave them in the Old Testament basically the same charge that He gives us in our context today. He says, every commandment which I command you today, you must be careful to observe. Now there's two things about that statement that the Lord makes. One, the charge that He gives to them is to keep my commandments. How many of them? All of them, every one of them. Every it's a universal command, keep all of my commandments. Now to keep all of them, you have to know them. You have to know them. You have to read your Bible. You have to know what God expects of you, and then you need to approach the Word of God with the intent of the heart, with the power of the Spirit indwelling you to obey every commandment. And like I said this morning in John chapter 8, that's where the battle begins. The battle begins. We want to obey the Lord while pleasing His sight, and so we have to fight the sin which so easily ensnares us. We're to obey every commandment. Then He says something else very interesting, that you must be careful in their observance. As we seek to obey God's Word, we have to be watchful. We have to be careful. We're to be careful to observe it, that we may live and multiply and go in and possess the land of which the Lord swore to your fathers. Now we can think of many examples in Scripture, can't we? The book of Hebrews being one primary example so many times where the Lord reminds us to be careful to observe the things we've heard, lest we what? Remember the letter to the Hebrews. Be careful, be diligent to observe all those things that the Lord has taught us because in our hearts, these hearts so prone to wander, so prone to wander. So we have to obey every commandment and I would submit to you that takes a resolve of your will and a dependence upon God to be committed to obey every commandment. So when the Lord says the Bible is to be your delight, the Word of God is to be your delight. Interesting to think about delight as a duty, but delight as a duty. And performing that duty is our delight, so we're to delight in that, we're to delight in the Word of God. It is to be our daily meditation when the Lord commands us to pray and to pray without ceasing, that's our delight. And it's not burdensome to perform that duty to the Lord, it's our joy, it's our rejoicing to do that. When the Lord commands us to evangelize, what do you do with that commandment? Do you obey the Lord? It's the resolve of our heart to obey every command and we've got to be careful in their observance with a fear of God to obey him rightly, the way that he's worthy to be obeyed. Now notice they're careful in their observance and they're to keep every commandment. Obedience to the Lord is both watchful, careful, it's meticulous, so to speak, and it's universal, all commands. Whatever you do that, you must know them. Proverbs chapter 2 beginning in verse 3, the Bible says this, yes, if you cry out for discernment and lift up your voice for understanding, where does discernment and understanding come from? Comes from the Word of God, every word that proceeds from the mouth of God. If you seek her as silver and search for her as for hidden treasures, then you will understand the fear of the Lord and find the knowledge of God. That's what we want, isn't it? We're to fear the Lord. We want to be like our brother was praying earlier, full of the knowledge of his will, full of the knowledge of God. But if you keep going in Deuteronomy chapter 8, look at verse 2, and you shall remember that the Lord your God led you all the way these 40 years in the wilderness to humble you and test you to know what was in your heart, whether you would keep his commandments or not. They here in verse 2 reminded specifically of the discipline that they had come under in the wilderness, and remember the context here. They had not gone into the promised land as God had commanded them to, and so they came under the chastening of God, the discipline of God. He says you're going to wander in this wilderness for 40 years. So they went to the school, so to speak, of hard knocks. This is tough love on the part of God, and it's love intended to teach them a lesson now that God commands them to remember. The Lord your God led you in the way all those 40 years in the wilderness to humble you, to test you, to know what was in your heart, whether you would keep his commandments or not. So 40 years of boot camp in the wilderness, so that God would bring this to remembrance. They would remember these things. The time itself had been memorable, all that had happened to them. You can think of those wilderness wanderings, and all that the Bible describes there, all of the chastening, the fiery serpents, right? The raising up of the bronze serpent. Moses striking the rock rather than speaking to the rock. God at Mount Sinai, and all those things in the wilderness that they would have remembered, the time had been very memorable. And that memory was useful to them. It was helpful to them. It was profitable for them to remember. And I want to give you an example of why. It was as if their history in the wilderness was piling up for them evidence for obedience. Why do you obey the Lord? Because look at all these difficulties that you encountered, and look at how God provided for you.  You're still here. You've persevered, and God has preserved you. Look at these terrible and awful predicaments that you once found yourself in, and look at how the Lord graciously and mercifully saved you. We remember them, don't we, when we're going through the Gospel of John. And we look at the Feast of Passover, which is to remember God's deliverance of His people out of bondage in Egypt. We look at the Feast of Tabernacles. Remember God's deliverance of them and providing for them in the wilderness. These things designed to make them remember so that they have evidence then for obedience. And look at verse 3. They were to remember the difficulty, remember God's provision. Why? Verse 3, for the sake that He humbled them, He allowed you to hunger and fed you with manna, which you did not know nor your fathers know, that He might make you know that a man shall not live by bread alone, but man lives by every word that proceeds from the mouth of the Lord. And I think about it for a moment and apply this truth to yourself, to us today. They were to remember trials. They were to remember difficulty. They were so often brought to and brought through. One, because of pride, was meant to humble them. They remembered, and they remembered for the sake that otherwise their hearts might be lifted up against God. They might forget God, neglect God. They were to remember the trials because of pride.  If you go on down further in Deuteronomy chapter 8, it's so that their hearts weren't lifted up and they forget the Lord their God. They were to remember so that they weren't prideful and weren't neglectful. I remember not long ago thinking of this issue of apathy and indifference. And just thinking through the causes of apathy and indifference. And there are many today who would like to say that apathy or indifference in the Christian life is because of what Atoly and Chevidian would say is performanceism. People just work too hard. They try too hard. And so they get tired serving the Lord. With a vast majority of evangelicalism today, or that which calls itself Christianity, is that really the problem? No, no. The root of apathy, the root of indifference, the root of coolness toward God is self-righteousness, is pride, it's self-reliance.  You go plowing through God's word, right? You go to the Lord in prayer, you're on your knees, shedding tears, crying out to the Lord for the righteousness that you desire to be walking, pleasing in his sight. You go to his word to know what he says, to know of Christ, to know of God, to live for him. Coolness toward God, apathy, indifference in the Christian life is self-righteousness, it's pride. Where do we go to humble ourselves? Every word that proceeds from the mouth of God. Remembering the depths that God has drug us out of, remembering our own bondage in Egypt that the Lord saved us from, right?  Here they went to humble, to be humbled, God humbled them. Then it says something very interesting. He allowed them to hunger, fed them with manna, which they didn't know, or their fathers know, that he might make them know that a man shall not live by bread alone, that God might make them know. He made them know his provision for them. In the wilderness, God provided manna, bread from heaven, that we know from our study in John that Jesus Christ is the bread of life. God provided for them in the wilderness by providing water out of the rock, that we know that Jesus Christ is the fountain of living water, right? So if we want to know that God shall not live by bread alone, where does God send us today? He sends us to his word, to learn of Christ, to humble us, to make us know. I thought about this many times in many of you have counseled brothers, counseled sisters that have come with difficulties in the Christian life.  I've talked to many, often times, a brand new Christian, you know, fresh out of the oven, just as maybe, and they're just on the mountaintop, right? The Christian life is awesome. I just love the Lord.   And then a year later, a Puritans often call it the dark night of the soul, those emotions that may have once sustained a fire, so to speak, or those feelings, maybe that once sustained a motivation to serve the Lord faithfully, they wax and they wane. It's as if the Lord pulls back, as if to say, your Christian life is not gonna be based on emotion, not gonna be based on feeling, not gonna be based on fleeting sentiments, but it'll be based on every word that proceeds out of the mouth of God, to show us our dependence upon Him, to show us that in our sin, how desperate we are for His provision, and to drive us back to the Word of God, which is more precious to us than our daily food, to humble us, and again, to teach us that we're not to live by bread alone, but by every word that proceeds from the mouth of God. Here in Deuteronomy chapter eight, God provided for them, He took care of their food, their clothing, their health, most importantly, He preserved them in the wilderness, and He does that by His Word. God will often bring His people low that He might raise them up. If you find in your Christian life that the emotional or sentimental high that you once were on has been waxing or waning, you are to drive yourself back to the steadfast and sure Word of God for your daily nourishment, for your soul's health, for your soul's vitality. It's not in emotion, it's not in feeling, it's there that you'll find relief. It's there that you'll find help. It's there you're gonna find your joy restored. It's there you're gonna find your hope. It's there you're gonna find Christ. You have to drive yourself back to the Word of God. Through all this, He taught them, man shall not live by bread alone, but man lives by every word that proceeds from the mouth of the Lord. The good things that God gave them is provision for their most pressing needs. The good things that God gave them, God used to humble them and to show them His provision for better things, spiritual things. The bread He provided points to the bread of life, points to the bread of God's Word. The water that He provided for them points to the righteousness that they're the thirst for, points to Christ who provides fountains of living water. All of those things designed to point them to spiritual truth for their spiritual health for the salvation of their souls. The ultimate satisfaction of man does not consist in being clothed with purple and fine living and faring sumptuously every day. But our being in covenant and communion with God and learning and obeying His Word. You'll look with me quickly at Matthew chapter six. For that very example, Matthew chapter six, beginning at verse 25, I'll just read the text to you. Listen, this applies directly to us in our context. Now think about how that applies, verse 25. Therefore I say to you, do not worry about your life, what you'll eat or what you'll drink or about your body, what you'll put on. Is life not more than food and the body more than clothing? Look at the birds of the air. For they neither sown or reap nor gather into barns, yet your heavenly Father feeds them. Are you not of more value than they? Which of you by worrying can add one cubit to his stature? Now it's interesting that we see this in the wilderness in Deuteronomy chapter eight, God teaching them that you can't live by bread alone. And when the Lord, if you look at the parallels between the Lord's temptation by Satan and this passage in Deuteronomy eight, how similar or how many parallels there are in the two passages, the Lord, Matthew four quotes this passage in Deuteronomy chapter eight. When Satan tempts him to turn the stones into bread, basically the Lord is saying, God can provide for me. And it may not even be through the means of genuine food. The Lord fasted for 40 days in the wilderness and God provided for him and kept him alive. Here we don't have to worry about those things. God provides. Are you of much more value than they? Which of you by worrying can add one cubit to his stature? So why do you worry about clothing verse 28? Consider the lilies of the field, how they grow. They neither toil nor spin. And yet I say to you that even Solomon and all his glory was not arrayed like one of these. Now, if God so closed the grass of the field which today is and tomorrow is thrown into the oven, will he not much more clothe you? Oh, you of little faith. Therefore do not worry saying, what shall we eat? And what shall we drink? What shall we wear? For after all these things, the Gentiles seek for your heavenly father knows that you need all these things. But seek first the kingdom of God and his righteousness and all these things shall be added to you. Therefore do not worry about tomorrow. For tomorrow will worry about its own things, sufficient for the day is its own trouble. You know, I've thought about this in reference to priorities in the Christian life. And oftentimes you'll talk to someone who's having difficulty, having adversity, facing trouble. Maybe he doesn't know where the next check is gonna come from. You know, doesn't know where the food is, is gonna be for the family. Maybe just concerned about getting the next step up in the job because at some point in time he may be fired or they may transition. And the company may be reorganized and he's out of there. All of those things and yet in the midst of anxiety, in the midst of worry, in the midst of that difficulty, they neglect God's word. They neglect the bread that they're to live by. I remember seeing a documentary a while back about a cab driver in London, a cab driver in London.  And this cab driver wanting to keep his job, you know, wanting to be able to be a cab driver in London, make money to support his family, had to memorize every nook and cranny of the city, had to memorize a map.  Someone got in this cab, he needed to be able to go without a moment's notice and know exactly where he was going. And so they required cabbies to memorize the entire map, every street name. When you think about that for a moment, the effort that that would take. And that was for his job. And many of us, when we come to the word of God, find barely enough time in the day to read it. And you neglect the word of God. You neglect your daily spiritual food and so you become malnourished. We don't memorize the word of God to allow ourselves to meditate on it, to take it into our heart, to cleanse our way, to keep our way pure. JC Ryall, in his book, Practical Religion, identifies five categories of professing Christians. And our time is short, I wanna give these to you quickly. Five categories of professing Christians and their approach to God's word. One, those who can read but do not read the word of God. If you're in that position, you can read but you don't read the word of God, then as a professing Christian, there's simply no comfort for you. There can be no encouragement to you. As JC Ryall said, it would be mockery and deceit to do so. You are in danger. You're in danger. A neglected Bible is evidence that you do not love God. Be sure that if you don't love the Scripture, you don't love God, you're not a believer. You're not a Christian. It's like the cancer patient, the cancer patient who knows the cure and yet will not pursue it, will not take it.   That which has been given is taken away. Even what they have will be taken away from them and they can't understand it any longer and it's too late. Second category, those who are willing to read but need to know how. Here's how, listen, start right now. Start today. Start today and read it every day. Make it your daily meditation. Read with an earnest desire to understand it. Read it with a diligent desire to obey it, to apply it to your life. Seek the Lord in prayer while you read it, asking the Lord for help and understanding and wisdom that the Lord promises to give you liberally without reproach when you ask without doubting and faith. So read it with childlike faith, with humility, with the intention that you will pursue Christ in it and that you will obey what you see there. Read with a time, have a plan. It is called a spiritual discipline for a reason. Much of the Christian life is self-control, is spiritual discipline. Much of the Christian life is denying yourself, taking up your cross and following him. And what that means is following him in self-control and self-discipline, having a time, having a plan, doing that which is necessary for your own spiritual good. God has appointed an end for the Christian, appointed a purpose for the Christian. He is going to conform you into the image of his son, but God has also appointed the means to that end and the means that he has given, the twin towers of the means of which God has given is reading, studying, meditating on his word in prayer. So put those disciplines into your life. Read with a time, read with a plan, spiritual discipline. The third category, those who say they love and believe the Bible, but read it very little. Most of these people in this category are just like those in the first category. They say they love God, but it's not evidenced in their life, not evidenced in their disciplined intake of the word of God. The busyness of life, work, family, all cut short or intrude into our devotion to the word of God. Have to build your life on the rock. If you're in that position, then you can have no assurance. You can have no comfort. You can have no encouragement. And you consider to yourself, I'm just not as fervent as I once was, not as faithful as I once was. Well, if you're not availing yourself of that means that God has appointed to give you assurance, then you're not entitled to it. You know, invest yourself in the means that God has appointed. You're gonna have very little help in times of need when the trial comes to sift you, when the affliction comes and strips you bare, you're gonna have very little help because you're not in God's word. And again, coolness toward God or a neglect of God's word is an indication of spiritual pride, self-righteousness. Cannot base your spiritual life on feeling, on emotion. It's on the bedrock of God's word, the spiritual disciplines, the means of grace that God has appointed. Fourth, there are those that read the Bible much but think they're no better off for its reading. Maybe you don't see it, but often the progress is there. JC Ryle equates it to imperceptible growth that grass makes. You can't see it grow, but it grows. Think in Florida it's more appropriate to say weeds. I think you can sit and actually watch weeds grow, right? So you may grow like a weed, you may grow like grass, but oftentimes our growth can be imperceptible but it's there. You look over the last six months, over the last year, you can see is sin becoming more hateful to you? Is Christ becoming more precious to you? Do you see a work of grace in your heart along those lines? But if you feel as though you're not making progress, consider your method. Do you read the Bible faithfully but you read it mechanically? Do something different? If you read the Bible and you get done with your reading and you can't remember what it said, then take a smaller passage and meditate on that passage. Memorize it, get it into your heart, get it into your mind so that you remember what you read. Some folks read but they don't meditate. It's gonna be difficult to make progress if you don't know God's word and you don't apply God's word in your everyday circumstances. So you may need to change your method. Consider your obedience to it. Many read and yet they don't obey it. They are hearers of the word only but not doers of the word. Consider where you may be disobeying God's word and don't make excuses about that. Continue to cleanse your way by his word and understand if you're reading your labor in the Lord is not in vain and don't allow any discouragement to keep you from his word. Sin is gonna keep you from his word or his word is gonna keep you from sin, that old statement, right? So stick with it, your labor in the word is not in vain. Fifth category and last category, those who love the Bible live the Bible and read it much. As J.C. Ryle says, we need to resolve ourselves to be more watchful, more observant as time goes by. We need to resolve ourselves to apply it more faithfully to ourselves. We need to teach it to our families, teach it to our kids, just continue to invest ourselves in the word of God to resolve to meditate on it more faithfully and resolve to obey it more fully and resolve to worship Christ in it as we find him there on every page of scripture. Amen, amen, let's pray. Father in heaven, thank you for your word. What a blessing to the believer.  Thank you, Lord, that you've revealed yourself, that you have revealed your redemptive plan to save sinners. Thank you, Lord, for revealing there Christ, our Lord, our Savior. God, we praise you and worship you and thank you for your word. I pray, God, that your word by your spirit would be efficacious, God, to save sinners here who don't know you, but also, Lord, to edify your children, to build up your people, to grow us, to mature us in Christ, to fill us with knowledge of your will that we might live for you as testimonies of your grace for your glory, God, in Jesus' name. Amen.