Dude if he popped out of here, that would be turf. Oh No one's here Dude if he popped out of here that would be turf Dude that is so funny Dude that is so funny, dude That's better. Hey, Jack look at me No, no, I just want to I don't want to get wasted I'm gonna use it Shoot to me Don't shoot me Wait on I was there any two hands ready you guys look the body instead Frick. It's so annoying. I was I do I had it Do I had anything bad? Yes, they did they look at you instead of me. I hated that. Oh my god I'm so excited chat. We found this cool game. Well, I found this cool game chat I found this cool game by myself game all by myself I was live at one point in my life, and I found this cool game Literally this game is like a horror game. It's really scary, but it's like the Simpsons or Muppets and it's supposed to be scary. I found this game by myself. Yeah, it's like it's like Sesame Street, but it's a horror game MFN MFNBZ Ring me, okay Bring it. He's got a lot of hair on his arms. That literally is your hand. No, it was me. Hold your hand up Wait something's happening To cook it's a cookie. It's a cookie block Raise the curtain bring up the lights. The neighborhood is coming to town Hello, I'm here to disconnect the antenna television's heartbeat has returned a spirit of cheer brightens every child's eye the cry goes round the kindergarten class the neighborhood the Okay I'm here to disconnect the end. I am Ricky the sock your television will never be the same We hold on. Did you say disconnect the antenna? Yes. Oh my no no no no no no you mustn't do that That would be a catastrophe It's broadcasting over the news the news no trust me the antenna is just fine as it is doesn't need any Disconnecting tell you what you ain't here And I'll have test test test test test Ricky the woodpecker Yeah voice acting is pretty good actually by candy there's no candy in there. It's empty That's depressing. What's this medallion? Oh medallion if it's some kind of slot. We try to find the other medallion Norman Looks like something could be placed here All the sounds have so much reverb. Oh Never mind.    You've never heard. Oh Let me introduce you to it all. All right. We saved. I don't want to resets itself Yeah, but I need to go. Okay. I think there's a heel Why do they keep saying that? Heals are here.  Hey, what's going on here? Your puppet friends are attacking me. Oh, are they how? Embarrassing by the way, what's your name?  It's Gordon Gordon What a beautiful name. I could say it all day Gordon Gun in the puppet justice system as a husband and his crimes against figurines are considered especially heinous.  Okay, let's do this you so much ammo, but if you don't take them they come back to life that sucks There's a bee on the floor Bonnie. Yeah, D. D. No Svand Trash, wait, why is it eat? Well, why is but why why why is beaver Bonnie here? Why is it eat for Svand in the trash?  I know we have to use the wrench My what's that up to us and well for now and thriving We're in he's dead. He's dead in the pool. That's Tom's dad Drain. Oh, he's hand moved his hand moves. Do you see that? Oh? Dude grab the letter. I bet he's gonna wake up Anymore it's the first of the month. It's not letting me move. All right. Well What do you mean? That's fun. What are you good? That's fun. It's not the move We broke the game Okay, wait, can you feel is that possible?  We're gonna lose all this progress Where was the safe safe point? I can't remember I don't in there Here, right What was it upstairs? You have to heal bottle. I just don't want to use it yet. I thought we had a safe point No, I think we we just leave no nothing we just say I think Watching her beach in Hawaii Aloha thought we're playing together. Yeah, but we don't want to see what on a hill first because because the We can't heal and save it.  Who's that you want? You want us to not be able to save That's fun. We're alone. We don't need to it's a way No I was actually an accident. I'm measuring load. That was an accident actually wasted a tape I didn't do that Give me a kiss Because some locks a different part of the studio It's all free There's a crank. Yes, the crank. Oh, how do I get out of here Ricky? Oh having a clue never come down here myself Why what's got your overalls in a knot? I'm trying to get to the roof the Interesting about the roof down here is much more intriguingly musty Unrelated how do you feel about what force head trauma? What is it this time? Well, Ray, of course He's the best sort of monster janitor thing But he's a little obsessed with the boys. That is so good.  That's why they moved him down here The only way out is by elevator and he can't figure out how to use the buttons Got oh silly me. I forgot about the elevators really Gordon I wouldn't bother the cables are probably rusted. I don't think they even run anymore. Is it you too? Wow, you're so courageous and stuff. Look, I gotta go Wash my hair. The demo is after this or separate Whoa, you see that's not bad engine. She's that gave me a stick got sucked into the hole. What's that? Oh Dude if he popped out of here that would be turf. Oh No one's here dude if he popped out of here that would be turf No one's here dude. That is so funny Perfect timing. That's actually great It's late now. That's a good game. I just wish it was a not so spin like running around in a circle Yeah, no, it's been this game. This game was pretty good. Maybe we'll continue this I really like this game. I hope you guys enjoyed the stream the game was very fun and goofy Make sure to go follow Bonnie if you guys haven't followed Bonnie yet Everything else is s-fan TV YouTube Instagram discord reddit twitch Twitter everything is s-fan TV my friendly neighborhood, so Yeah, I was it was basically like Sesame Street on crack, so I hope you guys enjoyed I hope you guys had fun and everything is s-fan TV. We'll see you guys later. Do you have pink eye? No, you have to say we'll see you guys later again. Oh, we'll see you guys later. Oh Wait, do it one more time. We'll see you guys later. Wait, do it again We'll see we'll see you guys later


Everybody forced here big 2023 leaf ultimate hockey ten box case number three random hit style We've got 30 hits in the case 30 spots of the break. We'll type him in as we go and we'll random off at the very end Good luck everybody. Let's get started With the whole taking on the trash. Yeah, that is that is the Hulk Dying dying strong screen True I Kind of forgot, but we will see exactly 30 hockey hits from ours 30 of them exactly I need a top-out dude. It's all the Celtics jokes and the Notre Dame stuff like there's never been like an eagle thing They said nope The Kelly Green is pretty sweet though All right mountain Rushmore quad relic number to 25 one of 25 got cam ward rod brynda more Eric stall and Ron Francis Do you want type of names or I type of Mount Rushmore quad jersey one of 25? What are you gonna do? Here we go? Just try to keep track of like The next if we have another one of those is a different ring or something at least We've got an auto here number Larry Robinson three of four Yeah, slow down for Donnie guys He's getting he's getting back into the hang this Larry Robinson auto three of four that was easy Larry Robinson three of four Robinson Larry next one's not next one's actually probably just make this one easier on yourself Check this out one of two eight ways signatures Frank Mahovich Daryl Sittler Doug Gilmore Borges Salming Matt Sondine Dick Duff Felix Paul van and Lanny McDonald's So eight ways signature one of two Good luck on that one everybody leaves Leafs royalty right there, right? I Would just have an a way out of one of two. Okay, Mahovich Sittler Gilmore Salming Sondine Duff pot Vanna McDonald pretty sweet pretty sweet Legends right there Alright when I had one of those on a personal I didn't read the card name Yeah Yeah, what I do all right next up is Mount Rushmore Quad Jersey four of ten Pavel Bore Roberto Luongo Daniel Siddine and Marcus Nazlant Quaward patch feel like goofy Gorsh Mount Rush Quad Jersey four of ten, that's what I put on this one Bore Luongo Siddine and Nazlant Nux legends there Autograph is gonna be Gary Roberts five of nine Gary Roberts out of five of nine Column Larry Bird Now we've got a Steven Stamco's book nine of fifteen This is sealed I will not open it Unless the person wants to see it if they get a hit they're in here and they want to confirm the order number all that We can open it after the break, but Steven Stamco's book nine of fifteen This one begins Wow, it's like it's bad beats so they show like If you barely missed over under or whatever Dual relic that's pretty sick Nathan McKinnon and Peter Forsberg Number to seven of eight Dual relic McKinnon Forsberg seven of eight. Yeah, now he was good tonight. They beat the Bruins in overtime That's cool quad jersey auto number 13 to 25 at balfour at balfour quad jersey out of 13 to 25 and Ultimate hockey signatures three you got Ron Ellis norm omen and Paul Henderson five of 12 Ellis omen Henderson triple auto to 12 Donnie's boy, Mariela Mew quad jersey three of 25 Mariela Mew quad jersey three of 25 Get some water guys Nothing like hearing a name and still not be able to pronounce it right I drank coffee, and I forgot to drink enough water Start to feel it start to feel it Gary Sheever's book six of 15 This is sealed not gonna open that unless I won't see it after the break Gary Sheever's book six of 15 You tap in this Geez for so you trust your top loader and a 25 is a Frank Malovich auto with a six-time cup champ inscription That's pretty sick Malovich auto to 25 Yeah, I did put Vasilev skin the thumbnail to 12th one right that's what you think that's what adds up so Whoa, you know math No, they don't teach that in for the public schools.  How'd you know? what I learned before to schools is gator and done gator and gun Quad relic man in rayo may three 13 to 25 rayo may right rayo may Raya may 13 to 25 man and rayo may it's not how it sounds On the quad relic next is an autograph of Dennis Hull 23 of 25 Dennis a lot of hulls a Lot of hulls like a shipyard out here And that's sick patch on a Mario Lemieux seven of eight There we go patch on a seven of eight Mario Lemieux see every time man and realms name Like you say I say it like Rome I've been corrected like 35 times no matter which way I say it. I'm just gonna give up I'm just gonna call just gonna call her man and That's it Lemieux all patch out of seven of eight There's names that when I whenever I say it any single way I'll get corrected So I just stopped saying her last names. That's fair. I think I probably do the same I that's why I'm not see I think I think sticky is right, but See when you're not a breaker you don't got to worry about it got quad Jersey Gordy how a seven of 25 Gordy how a seven of 25 Felix pop van quad relic auto 12 of 25 and Eric Lindross Instructions auto big E 12 of 25 Yeah, I was young I was young I didn't really watch hockey when uh when she played I don't watch hockey till like oh 9 2010 or so nice Lindross big Ian scribe. That's a cool one big E a wrestler now Well Was that noise That was odd late and ghost yeah, oh there he goes late and goes here No big E. I think got like a career ending injury. That's right though. Yeah, but he was it was roster. Yeah Eight-way relic ultimate memorabilia Paul Korea Brendan Shanahan Mike Modano Pat Lafontaine Steve Iserman Adam Oates Pierre Turgeon and Mark reckey. Yeah, I mean a little bit sticky But a lot of it's it's not it's not I don't you don't ever have to deal with it true Ultimate memorabilia Korea Shanahan Modano Lafontaine Iserman Oates, Turgeon and reckey two of nine Gary Sheevers quad pad relic auto to 25. That's pretty sick 25 quad pad relic auto there and The finished flash a tamu salami auto six of six Nice tamu salami. That was the other guy. I was gonna put on thumbnail and then I put fast left He's Jake told me to the NHL won't let there be a rivalry like that Like what wings abs back in the day? 90s red wings abs There's just they played in a lot of big games in each other like finals appearances and there was always fights Always fights. There was the Valentine's Day massacre pretty much This is just everybody got a jacket pretty much Just a bunch of fights. Just the goalies against each other bunch of fights Yeah, back with the goalies fight I'm out Rushmore quad jersey number to seven is Maurice Richard Gila Fleur Larry Robinson and Jacques Plunt. That's pretty sick Yep, and all and great players too Richard the Fleur Robinson and Plunt Three of seven quadra, that's pretty cool one Montreal royalty there Jersey auto Mike Richter four of 25 This guy's got a lot of cup cup victories between them there the Montreal guys and Altered hockey triple auto Richter pot-vanted Hextal one of one of five goalie legends right there Mike Richter Felix pot-vanted Ron Hextal Hextal still a pens GM you help me answer some questions. That's for sure. Wasn't that one though? I don't want no questions. Yeah, the NHL doesn't want that anymore. I get it Like I totally get it, but yeah, they don't want that sort of thing going down anymore They have made that clear for sure. They want their brand to be more I guess Easier to digest for more people I guess an eight-way relic you've got Patrick Kane John Tavares of Kenny Malkin Claude Giroux Sydney Crosby Alexander Ovechkin Stevens Tampkos and Jonathan Taves to 25 some Legends of the past decade plus here That's pretty cool 25 Kane Tavares Gino Giroux Crosby Ovee Stampkos and Taves Yeah, the same as NBA. Yeah, they cut down on like fights to give out tentacles easier things like that, you know Yeah, wholesome is the word for it. Yeah, yeah, they got beat balls and OT It's our third loss of the season man. He only still only have one regulation loss is crazy Got a Frank Malovich auto to 25. I'm just used to the Bruins just letting me down So I I don't care how many games they win how many points to score regular season I'm just ready for the playoff let down Malovich 5 to 25 on the auto And dual auto is Dion and Taylor Marcel Dion and Dave Taylor to 15 Be cool right there both Kings, right? I Know Dion has that old purple yellow purple gold Kings. He's back in the 90s are sick The on and Taylor do a lot of I can remember those Those are fire The King jurors are cool as is the black and white pretty simple, but Solid design, but those purple and gold were over something else Yeah, like I don't hate I don't I don't see it as better or it's just very different I enjoyed both both styles like 90s 80s 90s NBA Played hard got hit a lot, but today the skill is so insane. It's a blast to watch. So I love that too Dual relic number two eight is going to be Madonna and Lindros. It's a crazy Madonna patch three color Three oh three of six rather three of six Madonna and Lindros dual relic a pad relic auto Kirk McLean to 25 Kirk McLean so fresh and McLean Ah, you know outcast. Yeah, no clean. Yeah, so fresh and McLean. I don't live under a rock. Oh Man you bolts fans. There's like thousands of you in chat right now. I'm gonna freak out over this one Triple auto Steven Stamco's Vinnie Le Calvier and Martin St. Louis four of 12 There you go both fans They're all crying and shivering at the at the site of this card Four of tell the triple that is actually pretty sick not gonna lie Not gonna lie a lot of cups between them few cups there first goal ever for the lightning, right? There we go Good luck on that one in the random That's all talking trash to me tonight. All right Donnie's finished now and up. We'll get the random going right now They go. All right. Here we go y'all Good luck. That's pretty good case. I like a lot of those that the had another one was eight-way Maple Leafs autos Patch on his neck 11 that's an 11. Oh boy. It's a lot of times time to sweat it out y'all here. We go Go to our names first center hits match them up after do it 11 times each one two three four five six seven eight nine ten and 11 Chris s a down to Theodore and the hits best of luck y'all here. We go 11 times one Two three four five Six seven eight nine ten and eleven the triple Bolts auto down to the Mount Rushmore quad patch number four of ten. So some of those will be typed in like that Let's just have to remember or go back and check which one it specifically was there's a couple of Mount Rushmore's It's only two this time though. Okay, so Chris s a with this Stanley Calvier and Saint Louis triple auto Alexander the Gary Sheevers Book Joseph s the eight-way auto to two very nice one Joseph Brian B the finished flash out of Tama Salani Jamie with the Sheevers quad patch out of the 25 the quad pads there Chris s I layer Robinson out of four Daniel D Manon Ray home on the quad relic to 25 Bradley with the Richter pod van Hextal triple auto Gregory M Malovich auto to 25 William Q Madonna Lindross dual relic Gregory M Balfour quad patch auto Brian B Malovich auto inscription Jonathan L eight-way relic two of nine Daniel D the Rushmore quad patch three of seven Brandon W Deon and Taylor dual auto Scott at the Mount Rushmore quad patch to 25 one of 25 Brian B eight-way relic one of 25 Gregory M Gary Roberts auto to nine Scott M Mike Richter patch auto Allen M Kirk McLean patch auto Jonathan B McKinnon Forsberg dual patch Edward E. Gordy how quad relic Nick B with the hull auto to 25 Dennis Hall Allen M the Stamco's book David D with the Ellis Olman Henderson triple auto to 12 Terry D the Lemieux quad patch auto to 25 Richard H with the um Lindross inscription auto Daniel D the pod van quad relic auto Paul H with the Lemieux patch auto and Theodore with the Mount Rushmore quad patch four of ten We're gonna get these results posted to the site and then yeah moving on to the last two definitive of the night


OK, I think we'll get started. So this talk is on spicing up containers of image security with Salsa and Guac. My name's Ian Lewis. I'm a developer advocate at Google Cloud. I focus mostly on container and supply chain security. And I am currently on loan to the Google open source security team or the ghost team, as it's colloquially only known, working on Salsa tooling. So I said that this talk is about spicing up container image security, but I'll be pretty mild. No hot takes or anything like that. I want to start by, I guess, kind of level setting a little bit and give a little bit of context for why some of the things I'm going to be talking about are important, like why we're doing these things in the first place. So hopefully this kind of gives you an idea of why some of these things or how some of these things are actually solving problems in the real world. And because it's really easy to get lost in the details. But essentially, software supply chain security has been a hot topic, I guess, in security space for the last couple of years. And this is basically because attackers have shifted their focus towards the software supply chain. And part of the root causes of some of these are that development and CI systems are essentially not treated like production or are not given the same level of love in terms of security hardening as production systems are. And so there's been a culture of, essentially, development CBI systems are essentially YOLO. And production is where we actually harden things. And that's not actually the case because there's channels to get software or malicious software into production through these CI and development systems. Another aspect of this, why it's a good target for attackers is that there's lots of places that attackers can insert themselves. Apologies for the slide. It's a little bit harder to read. But essentially, attackers can slot themselves in, essentially, anywhere in the development life cycle. So from source to source code, the developer's development environment, through to the build systems, through to the package managers and distribution systems you use for deployment, as well as all the dependencies that go into the software that you're building. Today we'll be pretty much primarily focusing on the build aspect of this, so your CI systems and the build systems, and having traceability from there into your production systems. But it's good to know that there's a little bit of context here for why we're talking about these things. And another overarching theme is that there's a lack of information about the software that we consume. So as we develop these things and we consume software, we download it, we run it, there's a lack of understanding about where that software came from, how it was built, who built it, and being able to verify that and make sure that it was actually built by the people we think it was built by. So this comes out in a lot of ways. So you have something like, how do you know essentially where your software came from? We can download artifacts, and we can download them for example, from a GitHub repo or something like that. But how do you know that that artifact was actually built from the source code in that repo? There's no real guarantees for that. And similarly, this is even worse in the cases of where the software is being distributed on a totally different platform. For example, Docker Hub on GCR or on other container registries. So for example, you'd say, is Ian Lewis on Docker Hub the same Ian Lewis as the Ian Lewis on GitHub? There's no real linkage there that you can be sure is something you can verify. We won't actually solve that particular problem, but that's kind of one of the root problems for this. But also, is the actual image, say like Ian Lewis Foo that's on Docker Hub, the same or built from the source code that's in the Ian Lewis Foo repository on GitHub, for example? And how do you know that? How can you verify that that's actually the case? So essentially, how do you know how the sausage is made? How what goes into the food that you're eating? How do you maintain some of that hygiene? That's a pretty difficult thing. So for example, let's say that we have a software repository. We have a GitHub repository. We have the Salsa and Guac demo repository here. And we want to be able to run this as a container. But we're going to first take a look at the source code. We've kind of found this thing out there that looks like it does what we want it to do. We'll look at the source code here. We'll say, OK, this is going to print out some version information. It'll print out the Git version and what tag it was built from and things like that. That's cool. That's what I want. And we can even kind of look on Docker Hub and see that we found an image there that's built by a guy named Ian Lewis. And it looks like it's the same name. It's got a link to the Git repository in the readme. We can look at the tags. The tags seem to match up. We've got the same sorts of tags as we have on the releases over here. We can actually click on this tag and see some of the image layers right. If we look at our Docker file, we can see, OK, this is a two-step build. So we can only see the second half of this. But we can see that these steps here line up with the steps that are present in the Docker image. This pretty much looks good. This is something that looks like it's linked to this repository. It was built from this repository and all that. But if we actually go and try to run this, and this is just a Docker run command to run it, this is essentially building and running code that's completely different from the code we just looked at. And this is because we have no linkage between the source code repository and the actual image that we're downloading and running. So for example, the Ian Lewis on Docker Hub could be a completely different person. If we don't verify that. Also, the names don't necessarily match up. Somebody could just make up their own account on Docker Hub. Or for example, the account credentials could have been leaked or gotten out on Docker Hub, for example. So you could have a personal access token that was expoltrated or was compromised, and that allowed an attacker to upload an image. So this is an issue that is fairly pervasive. You're not able to trace back to the source code. So how do we solve this problem? So one of the ways that we solve this problem is by doing something called the software attestation. So what we're going to do in plain English when we say something like is an attestation or we attest to something, we're basically asserting that this is true. If I say something like my name is Ian Lewis, I'm attesting to the fact that my name is Ian Lewis. And then ideally, I would have something that verifies or that somebody else could use to verify that I am actually Ian Lewis or that the statement that I said is correct, like my passport or some statement that I've actually signed with my own signature. So in the case of software, what we're going to do is we're going to actually use some metadata, which we'll call provenance, that describes information about how the software was built and where it was built. And we're going to combine that with cryptographic signing and identity in order to create a software attestation. So essentially, the identity is going to be either a person or some kind of workload. For example, a machine identity, what people call machine identity, but essentially, this is an abstract identity. And then you combine that. The identity then signs this metadata to say that it's asserting that it's true. And then that attestation can then be verified by the consumer when they're actually consuming the software. So one of the big things is that people say, kind of throw these terms around a lot. But I like to think of attestation as being something that you can actually verify in a strong way. So it needs to be signed by somebody and it needs to make sense. If you don't have an identity that says, hey, this is the thing that signed it, who's a testing to what? That becomes kind of an issue if you're just providing metadata, for example. And you're not signing it, or you're just signing stuff, but you have no understanding of what the identity was or where that came from. So as kind of a building on that topic, we have the idea of software attestations. But who's kind of like in the context of building software and deploying software, who's actually kind of attesting to what? And what are you actually going to be attesting to? So basically, what happens is when you're going to do a build, the build system will essentially attest to the fact that that build was run, that it built that or ran that build. So the build system is essentially some sort of machine identity or has some sort of machine identity. And then that is used to essentially make the attestation, which says that I ran this build, I used this source code, I got this artifact out. And so when you consume the artifact, you can verify that, OK, this is the same artifact that was built by this and is described by this attestation. So you can verify that that artifact was actually built by that build system at a particular time using particular source code. And we make sure that we are cryptographically signing this so that we can verify this in a very strong way, that we actually know we don't have to do human level signature comparisons or anything like that. It's a very objective rather than subjective process. Another issue here is that we need to make sure that the build system, since the build system itself is attesting to running the build, that the build itself isn't actually doing the attestation. So in the sense that we need to have the build system needs to have some level of separation or isolation from the build itself, because effectively you get a softer equivalent of a conflict of interest if the build itself is attesting to the fact that it was run. It could essentially make up whatever it wants to at that point. So the build system needs to be trustworthy. We need to make sure that we trust the build system itself. And so if the build itself could be running any kind of software, we need to make sure that the build system that we trust is actually the thing that's making attestation. And then we're going to combine the different ideas right together along with Sigstore. And you've heard a lot about Sigstore, I'm sure, during the conference. I'm not going to go too detailed into it. But effectively, Sigstore is a set of tools that we're going to use for keyless signing. So what we do basically here is instead of using a key that we have to manage and that is long lived and that we have to store somewhere and maintain access to, we're going to use quote unquote keyless signing. And what that allows us to do is take essentially an identity, the machine identity from the build system, and use that identity to mint a new cert or to use the certificate authority, in this case Folkio, which is the Sigstore service, to create a new certificate that is short lived and is only going to be used by the build system one time in order to sign our provenance. So that basically allows us to take the key, sign the provenance, and then throw away the private key. We don't need it anymore because we're only going to use it one time. And then the public key, what we can do is upload that to another service, Sigstore service called Rekker, that we can then allow, create a log of when the key was created and then allow us to also retrieve that certificate later when we need to verify. So effectively, we don't have to really keep the key around, the private key around, we can keep the public key. We can put that in a log service that we can then use to pull down and verify it. And so we don't actually need to store the keys anywhere in our actual build system. We can essentially be keyless in that sense. So there's a lot, there's been a lot of talks but like one talk by a colleague on the ghost team, Hayden, was really good. And so if you are really interested in much more of a deep dive into the Sigstore ecosystem and the services, I recommend you look at the recording for his talk. So OK, so now that we've kind of got some of the concepts out of the way, let's talk a little bit more about the concrete way that we're going to implement some of these ideas. And so what we're going to do is apply some of these ideas or one application of these ideas is in the supply chain levels of software architects. This is the Salsa framework. And the Salsa framework is essentially a framework that is used to define a set of requirements or levels that define an increasing set of security requirements. So right now it has levels defined one through four, which are progressively more secure or more hardened levels of security for a build system. And these make it so that it's incrementally adoptable. So each level has a set of requirements and those get more stringent as you go up the levels. This also sets some things like common terminology. So when we talk about problem, we kind of know what we're talking about. When we talk about signing and keyless, we kind of know what we're talking about. I guess keyless isn't really necessarily defined by Salsa, but it defines a bunch of common terminology that can be used for build systems and for supply chain security. It also, as part of the framework, defines a provenance format, which is essentially just the JSON format that you can use to define metadata that describes the build and how the build occurred. OK, so those are a lot of kind of like abstract concepts and frameworks. Now let's kind of get down into actual implementation of some of these ideas. And so what we've done is we've started a project called the Salsa GitHub Generator Project. And what this is doing is utilizing some of these concepts like keyless signing, Salsa provenance, and some of the features of GitHub actions in order to achieve isolation for our build between the build system and the build itself. And so we have a number of different workflows that we've implemented. And this is using GitHub actions reusable workflows. And the reason why we did that is because this gives us a level of isolation from the actual build part of the system. So when you build something, you can separate the build process and the generation and signing of provenance into separate build jobs that are effectively isolated from each other, the run in different VMs. And so what we have as part of this, we have a number of reasonable workflows. One is the language agnostic kind of generic generator. We call the generic generator. This is like a workflow that you can use to generate provenance mostly for file-based artifacts. So things like binaries, things like S-bombs, maybe that type of thing. We have another workflow called the container generator, which we have just essentially GAID. And so we are basically saying that this is stable. And this is also used for container artifacts. And this is partly to make it so that it's easier to integrate with all of the other six-store tooling around containers, as well as have support for things like uploading the attestations to the container registry alongside of the containers themselves so that you can easily get the provenance.  We also have a project called the Salsa Verifier Project, which is used to verify the provenance that's generated by these builders. So this Verifier Project is essentially a command line tool, which will verify the provenance for trusted builders that we essentially have identified as being well built. And so some of those are the ones that we've built ourselves and have a full kind of like threat model, so like the workflows that we built, as well as Google Cloud Build. And we're looking to support other CI systems as we have more ways of generating provenance safely. And this also allows us to do things like verify the source code is the source code we expect and that it was built with the tags that we expect and with the builder that we expect, et cetera, et cetera. So let's take a little bit of a look at what that looks like. So let me blow this up a little bit. Also one thing that we can do as well with containers as we upload them or when we generate provenance, we can actually look at some of the, like inspect the provenance and take a look at what it looks like using some of the six-door-based tools. So as a way of just kind of looking at this, like let's look at the provenance and the attestations for the container that I just built or that I just ran that was like a malicious container, right? So if we look, we can use the cosine tree command to actually check the container registry and look for attestations. So we can actually notice that the kind of malicious container that was here like actually has an attestation itself, right? So this is a malicious container even though it had, and but it has like an attestation. It's just when we actually look at what the attestation contains, so in this command we're going to see, use the cosine download attestation command in order to download from this image. And then we'll look at the internal payload or the internal JSON for the provenance that was generated. And so this is the actual JSON that was generated. And so we can look at some things like the subject. This is a what's called an intodo statement. And this defines somewhat of like subject object verb kind of a thing where, but in this case, the object is actually the subject. But like what we have here is this subject is the thing we're talking about. So in this case, the container image and here's the digest for that. And then we can look down and see more inside this thing called the predicate. We can see the builder that was used to build it as well as information about what source code was used and which workflows were used in GitHub. And so we can see here that if we look at the actual source code that it just came from, this is actually not the source code repository that we expected it to be coming from. It's actually a different source code repository. And so we can use things like the Salsa GitHub generator or the Salsa Verifier in order to run the Verifier to verify this. And so we'll look and we'll say, okay, let's verify this particular image and we'll expect that the source code came from my Salsa and Guac demo repository at this particular version. And so if we run that, this is duplicated a little bit, but we can see that when it tries to verify it that the generated artifact does not have the expected source, right? So the expected source is Salsa Guac demo, but we got the Fulda repository. So in this case, the verification failed because we were expecting a different repository than the one that was actually present in the provenance. So if you want to actually see what it looks like to verify one that actually does verify, effectively this is going to check the provenance, like check the signatures on the provenance and check the fields in the provenance for the source code and the tags in order to verify those are correct. And if those are correct, then the verification will pass and then we can go on to use the container as we normally would. So it's also kind of worth noting that as part of SigStore, using the SigStore tooling and Salsa provenance, we're able to integrate really well with a lot of other tooling that supports SigStore and Salsa provenance. So tools like Kiverno and the SigStore policy controller are two tools that are used in Kubernetes to verify provenance before you actually deploy containers into Kubernetes. So these are used as what's called an admissions controller so that at admissions time, when you try to create a pod, it will actually verify the provenance for that image against the policy that you've defined inside of the cluster. And in our Salsa GitHub repo, we have a number of examples about how to use those and example policies that you can use to verify containers. So effectively what the admissions controller does is it verifies the provenance and it will reject the pod outright if the verification doesn't pass. And these can be used with Salsa GitHub generator because our workflows use the same formats that are accepted by Kiverno and SigStore policy controller. Okay, so now that we've gone over how you can generate provenance and how you can verify that before you actually run your containers. There's also, there's still like, we haven't totally solved the problem of understanding, getting information about the artifacts that we're consuming. So not just like how it was built, but like what's inside of it. Do these things have access stations? Don't they? Which artifacts do we have? How do they relate to each other? Things like that. So one of the tools that we're also developing is a tool called guac, which is a kind of graph based tool that is used to kind of ingest metadata and information about artifacts and then allow for a querying and understanding and visualization of the relationships between those different types of artifacts. So this is really useful in a number of contexts. Essentially like you have artifacts that are node, artifacts and metadata that are nodes and then you have like relationships between those nodes as they're linked. So in the graph you would have like nodes that are artifacts and metadata and the edges are these relationships that go between these. So in our case like, so guac can really apply to a lot of different areas of discoverability and auditing and so kind of across the life cycle, I guess of a vulnerability. Like so from the kind of being reactive, how are you affected by something that actually happened to trying to implement safeguards into your system? So like adding policies based on this information and then also on the proactive side of like trying to understand the wider set of security implications of like different artifacts like which areas or which artifacts or have higher risk profiles which need more attention or need to be prioritized in terms of like improving their supply chain security, that sort of thing. So I'm gonna take like a little bit of a, and I'll say also say that one of the folks that is working on the ghost team working on guac did a keynote earlier, talking a little bit more about guac. So I definitely recommend checking out the recording of that as well. But effectively like guac is a system that will ingest artifacts and give you a graph kind of representation of those artifacts which you can use to kind of visualize and understand the tools. Right now it's effectively like, it's a little bit of an early, early it's an in its development life cycle. So right now it's mostly just ingestion and then you can do queries on the database directly. So in this case I'm using Neo4j to directly query and visualize in the database but in the future there'll be much more targeted type of APIs for developing policies and things like that. But we can see here, here's a set of metadata that I've ingested for the images that I was using earlier. So we have the image that I built that is good.  And so like say for example in a reactive context where we figure out that this one malicious container is in there, how did that get in there and what happened? We can actually see that this container has was built by the same builder as our good container and that it has a software attestation. So this orange node is an attestation node. So we actually built it was actually built with the same builder and generated an attestation in order to try to fool us but it was built from a different repository. So that's one key knowledge point here is that we even though we could verify the key signature and that it had an attestation we really still need to check the repository information the provenance metadata itself in order to make sure that that's what we expect it was. So we can see here a little bit about the relationships here and how this artifact was built. These red nodes over here are part of a information that was ingested from an S-bomb. So this was built from an image, a container image and we use the SIFT tool to generate an S-bomb which tells us the different goaling packages. These are not quite as relevant for our in this reactive use case but we can see that they have at least one kind of common dependency within the two containers. So there you can kind of see like an overall set of relationships between the different types of metadata about our artifact. So we just use like kind of more reactive context for guac but in reality what we wanna be doing is like quote unquote shifting left. I'll maybe take a second or two to let you guys like check off your bingo cards but really what we wanna be doing is using this in a much more proactive context. Be able to like look at the metadata in a much more proactive way and better understanding overall our the situation of our supply chain and our the artifacts that we're building and using. So with that I'll end and I think I have a couple of just a couple of minutes for questions if there are any but we have a blog post that we released I think today on the GA in the container workflow. If you wanna find out more about Salsa you can check that out at salsa.dev. Our GitHub generator and Salsa Verifier reposer on GitHub under the Salsa Framework Organization and guac is under the guac sec organization on GitHub as well. I'm Ian Lewis on GitHub and on Ian Lewis on Twitter so if you're inclined you can hit me up later as well. So thank you all. I have about three minutes for questions so maybe one or two if there are any. Yes. Yeah so the question was like there's a lot of GitHub on the slides is there an equivalent project for GitLab? The there is we are working with GitLab to to implement some of these things like right now some of the issues around on GitHub are around isolation. So like we are kind of lucky in a sense on GitHub that we are able to create these generators using features of GitHub actions that allow us to isolate that from the actual build but with GitLab there's not really a way to do that quite yet and so we're working with them to actually be able to generate the prominence safely and then be able to do essentially the same thing as we're doing on GitHub as well. So yes we are thinking about that and working with them on that. Yeah any other questions? Yes right so the question is as a user of a CI system or a smaller CI system is this something that we have to rely on the CI system itself to implement or is this something that we can build ourselves? This is really something that usually the build system itself would have to kind of implement or that ideally it would implement but in the case of GitHub we're like kind of using a feature of the system in order to like build it ourselves but we are kind of essentially working with other like build tools like build kite in order to be able to implement these things but there's still a lot of that is still a work in progress on other CI systems particularly with regard to the isolation that we mentioned about GitLab and also about around the identity portion so being able to have an identity provider so an OIDC provider for example for providers like build kite and GitLab in order to provide the identity piece that allows us to sign and do keyless signing. One more the red shirt here. Okay so the question was like did the salsa verifier like walk a tree of like dependencies in order to verify the dependencies as well. In our case like what we're doing is essentially just verifying the provenance that was generated for that image instead of doing any sort of dependency walking. That's something that we can explore in the future if we have if the artifact itself has a way of like defining or if we have a way of figuring out what those dependencies are. Right now like you know the only way we do that is like if we were explicitly provided an S-bomb or we like tried to generate one ourselves but we don't really necessarily want to trust the artifact itself. Should you provide us with those dependencies? We'd like to be able to get those like kind of out of band but yeah that's something that's an area that we kind of like want to think about and explore. Well thanks everybody for coming. I'll be sticking around so if you have other questions and you want to talk to me in person then I'll be available. Thanks a lot.


Now, wait, wait, wait, wait. I know he always asks me tough questions, and he always has an edge to them, but I like him anyway. So go ahead and ask the question. Thank you, Mr. President. So you just said that you think within three weeks or so we'll be at the point where there are a million vaccines per day, but it seems like... No, I think we'll get there before that. I said I misspoke. I hope we'll be able to increase as we go on until we get to the million five a day. That's my hope. And then, Mike, the follow-up to that would be, now that you're a president and you're saying there is nothing we can do to change the trajectory of the pandemic in the next several months, what happened to two months ago when you were talking declaratively about I am going to shut down the virus? Well, I'm going to shut down the virus, but I never said I'd do it in two months. I said it took a long time to get here. It's going to take a long time to beat it.  We're just for the first day, I think, correct me if I'm wrong, I've been doing other things this morning, speaking with foreign leaders. But one of the things I think this is one of the first days that the numbers actually come down the number of deaths and the number on a daily basis and the number of hospitalizations, et cetera. It's going to take time. It's going to take a heck of a lot of time. And we still have, as Dr. Fauci constantly points out, it's one thing when we have mass, how can I say it politely? Mass disregard of the warnings about not wearing mask and wearing mask and social distancing and failure to social distance and people getting together on holidays and ways that weren't recommended, et cetera.  And so we're in this for a while. I mean, what are we now at about 410,000 deaths? And there's going to be more. The prediction, as I said, from the very beginning to getting here, as after being sworn in, was the predictions were, we're going to see somewhere between a total of 600,000 and 660,000 deaths before we begin to turn the corner in a major way. So, and again, remember, the vaccine, most of the people taking the vaccine, our vast significant number, require two shots and they are an average of three weeks apart. And it takes time for it to be sure that you're at, you get to that 95 percent assurance rate. And so it's beginning to move, but I'm confident we will beat this. We will beat this. But we're still going to be talking about this in the summer. We're still going to be dealing with this issue in the early fall. And last point I'll make, and I know you're tired of hearing me saying it, particularly, you may be tired of hearing me saying it. And that is that if we wear masks between now and the end of April, the experts tell us we can save 50,000 lives, 50,000 people otherwise we die. Thank you so very much.


Welcome to NTN Nightly, I am General Norvel, this edition's top stories. The chief medical officer renews calls for the public to vaccinate as more cases of the Delta variant are recorded in country. Preparations for the 14th annual St Lucia Taiwan partnership trade show are being finalized. And the Minister for Youth Development engages the National Youth Council. The Ministry of Health, Wellness and Elderly Affairs received notification from the Caribbean Public Health Agency of nine new cases of the Delta variant. Chief Medical Officer Dr. Sharon Burma-George has informed that all of the cases are nationals, the majority from castries and grossly. Five of them are female, four males and the ages range from 18 to 60 years. Based on contact tracing data, the majority of the cases that we are seeing right now are acquired from non-adherents to the recommended protocols. We note excessive social activity, especially on weekends, even during the curfew hours. The contact tracing team has informed of the positive cases providing false contact information with holding their place of employment and contacts. This prevents us from tracing and testing in a timely manner. The respiratory hospital also reports that many persons remain at home with respiratory signs and symptoms for extended periods and only access care at the critical stage which leads to poor outcomes. Dr. Burma-George is advising the public to access care at the respiratory clinics or respiratory hospital if and while. Signs and symptoms of concern include shortness of breath, difficulty breathing, tightness or pain to the chest, feeling weak, pale or blue colored skin, lips or nail beds. If you have chronic conditions, please get reviewed by a healthcare practitioner if you suspect that you may have COVID-19. The positive cases in home care are reminded that they are not to leave their place of isolation. They contact the home monitoring team or healthcare provider via telephone with any concerns that they may have. Family members and friends advise to deliver groceries and needs to those persons who are positive in a safe manner. By supporting each other, we'll get out of this. We continue to ask the public to work with us and exhibit responsible behavior to manage this fourth wave. Let us all take personal responsibility to keep ourselves and the family safe. On July 25, 2021 to September 26, 2021, there have been 5,703 cases at an average of 91 cases per day. During that period, 94 COVID-19 deaths were recorded with a case fatality rate of 1.6%. Females account for 53% of the deaths. The average age of the deaths is 66 years. Meanwhile, the public is being encouraged to get vaccinated against the SARS-CoV-2, the virus that causes COVID-19. The available vaccines have been proven to be safe and effective in protecting persons from developing COVID-19 in severe forms, complications, hospitalizations and death. It is against that backdrop that the OECS Commission pulled resources for a regional drive. COVID-19 vaccines are a dose of the facts, a production or a medical professional throughout members of the organization of the Eastern Caribbean states OECS speak to their country's COVID-19 situations, the effectiveness of vaccines, among other things. OECS's program director of health Dr. Avian Bamadou indicated that OECS member states have been battling waves of infections and these waves have translated into waves of severe illness, hospitalizations and deaths. Dr. Bamadou noted, however, where vaccine uptakes are high, the negative impacts of the virus are reduced. Where vaccine rates are high, severe illness, hospitalization and deaths remain relatively low even during a COVID-spiking transmission. Since the COVID-19 vaccines became available, countries are in a race to vaccinate their populations. The more developed countries have greater access to vaccines with the levels of vaccine and higher levels of vaccine acceptance. Our world in data provides interactive customized graphics which tracks the vaccination rates by country relative to population over time. Within the OECS, Anguilla is the most vaccinated of the OECS countries with approximately 60% of its population fully vaccinated. This is followed by British Virgin Islands with approximately 45% of its population fully vaccinated, next St. Kitts and Nevis with 41% of its population fully vaccinated, next Antigone-Babuda with 37%, Dominica with 29%, Montserrat 28%, Grenada 18%, St. Lucia 16% and the Grenadines 12% of their population fully vaccinated. Family physician in St Lucia, Dr. Tania de Stang-Bobre provided an insight into her experience dealing with COVID-19 positive patients. She noted that symptoms among those who were vaccinated were less severe than those who were vaccinated. The family physician also addressed the issue of breakthrough infections and its impact on the confidence of people on the vaccines. I would like to call it breakthrough infections because it sort of intimates that we didn't expect infections with the vaccine. At no point in time did anybody say that vaccines would prevent infection. No vaccine does that.  You know, we've had children immunized with chicken pox who come against chicken pox, so we know that there are chances of infections even if you're vaccinated. However, what we know is that the vaccines, because of how they work by priming the immune system, the infections are milder, fewer complications, and the duration is usually shorter. So we are aware that the COVID vaccine will not work as well as people thought they would, but we're also seeing that the benefits are one, they are less likely to get infected, and if they do get infected, they are less likely to transmit the infection. And if they do come down with the infection, their disease progress is milder and shorter. Head of Health Promotions in Dominica, Mignan Rool Schillingford explained that Dominica has been managing a surge in cases. However, the vaccines have aided in that individuals who have been vaccinated have less severe symptoms if at all. The Head of Health Promotions in Dominica noting that some vaccination hesitancy is due to the belief that the vaccine may not have gone through the normal procedures due to the short period in which it was produced, provided some insight into the development of the vaccines. I want to continue to assure, to reassure the public, you know, of Dominica and also the other Caribbean OECS countries, is that all of the vaccines that have been given emergency approval or approval, as in the case of Pfizer, have gone through the stages of development. And what are the stages of development? One, there's a computer algorithm that is used to model how the vaccine will interact with the immune system. So it first is a computer algorithm. Then it is tested in cells in a culture and that is in a test tube. Okay, so I remember you, I know you remember when you did science at school, there were different things that you would do in a test tube. So that's what happened. From there, when they are satisfied with the information they get, they move to testing on animals. After animal testing, that's when they move to human testing. Now this human testing is done in three stages where they check the efficacy, they check to see how it works, what's the possible impact on humans and all of that. And these are done by many different and gross different countries. This information, when they are satisfied now, is put together and sent and applied through the different licensure agency. In the case of America, is the Food and Drug Administration. And of course, in other countries, all those who are responsible for allowing this to be used and used. So the vaccines that we are receiving now come from WHO, PAHO, you know, and approved by this agency. All of these have gone through these stages of development. As the region continues to fight new cases of the virus, health professionals continue to re-emphasize the benefits of vaccines in combating the COVID-19 pandemic. From the Government Information Service, Helmede Mark reporting. In other news now, the Ministry of Commerce, Manufacturing, Business Development, Cooperatives and Consumer Affairs in partnership with the Embassy of the Republic of China, Taiwan, is gearing up to host the 14th annual St. Lucia Taiwan Partnership Trade Show on November 26 to 27, 2021. The trade show will showcase the unique products and the sales of Taiwanese and St. Lucia MSMEs to both the local and international community, while encouraging the general public and business entities to buy local. Propelling business development through technology is a theme for the 14th annual St. Lucia Taiwan Partnership Trade Show, scheduled for November 26 to 27, 2021. Minister for Commerce, Manufacturing, Business Development, Cooperatives and Consumer Affairs, Hon. Emma Hippolit, alongside her team from the Commerce Ministry, met with Taiwanese Ambassador His Excellency Peter Shen and his delegation to advance planning efforts for this year's trade show. The trade show aims to heighten awareness of ICT business solutions while showcasing unique products and services from Taiwanese and St. Lucia micro, small and medium enterprises to a local and international audience. To increase trade and business is a very important job for my Embassy and also to enhance the relationship between Taiwan and St. Lucia. And as you know, Taiwan is a trade country. We export a lot of our products. So that's also one of our mandate to export, to help our company to export their products. But also we try to increase the awareness of Taiwanese about what good products in St. Lucia and to enhance mutual interaction or exchange between the business between two countries. Hon. Hippolit noted that the Ministry of Commerce will assist all St. Lucia businesses to improve the standard and quality of their products and services to be export ready and to build their competitiveness. We must get businesses going. It is when the business materials and makes profit, we need to employ people and long and short of it is every St. Lucia wants a decent job that it can get an income and that it can feed their families. That is a summary of what all of us want. And we can only do this when we have a Ministry of Commerce supporting the business community, talking to them, removing and helping them remove the challenges that they have and helping them get into new markets. Marketing specialists with the Ministry of Commerce, Cindy Eugene said due to COVID-19, this year's trade show will rely heavily on the use of ICT as the platform to propel business development and to increase awareness of St. Lucia products and services. The trade show here is part of the love St. Lucia campaign because the love St. Lucia campaign is an emphasis to encourage persons to be familiar with what St. Lucia produces, encourage the use of St. Lucia goods, encourages the trade of St. Lucia goods and services. And here we look at goods and services from Taiwan and the partnership here is to get some support from Taiwan, be it that we can trade, be it that we can see some great distribution of goods from Taiwan within the Caribbean, and we can also seek to get some manufacturing tools, some machinery to improve our processes here in St. Lucia to have more efficient products similar to what we see coming out of Taiwan. Ambassador Chen believes that the focused ICT and virtual platforms at the trade show will attract greater interest in Taiwan on other international jurisdictions. I think there's a lot of products and a lot of good resources in St. Lucia and I really encourage more people to come to St. Lucia or more people to do business or invest in St. Lucia. A memorandum of understanding will also be signed at the trade show between the Taiwan External Trade Development Council and the St. Lucia Chamber of Commerce, Industry and Agriculture. We are hoping that by signing the MOU, members of the two bodies would have an opportunity to start doing business to business arrangements with the counterparts in Taiwan. The 14th annual St. Lucia-Taiwan Partnership Trade Show will feature 14 Taiwanese companies, 12 solution businesses, the American Chamber of Commerce in Barbados, and the DigiGolf project from St. Lucia. For the National Competitiveness and Productivity Council, Glenn Simon reporting. The Ministry of Youth Development and Sports and the National Youth Council have forged a closer partnership following a meeting with Minister Hon. Kenson Kazimir. Julita Peter reports. Minister for Youth Development and Sports Hon. Kenson Kazimir has expressed his commitment to strengthening the relationship between his ministry and the National Youth Council NYC. The Youth Development and Sports Minister, who met with the executive of the NYC earlier this month, stated that he held youth development very close to his heart. He added that St. Lucia's youth needed to have a greater input in the development of their country. For me, it is very important that the youth gets to sit at the table, the youth gets the opportunity to share their perspective on how we develop this land, simply because the way we develop this land will ultimately affect their generation and the generations after. So I've always been one who's part of the youth movement in my community, and so it's something that I treasure and I hold a lot of fond memories from. President of the National Youth Council, Anja Edwin, welcomed the opportunity to meet with the ministry officials. Tree-rehoping that whatever comes out of this meeting will be a very, very beneficial discussion that is going to read down to a lot of action and not just talk for the young people of St. Lucia. Meanwhile, Honourable Kazemi commented on the importance of the youth being given the same concern and regard as shown to other stakeholders and prominent members of society. He urged the NYC to constantly speak out and to ensure that their voice and the voices of the youth of St. Lucia are always heard.  That is how I see youth development, and I don't see youth development coming from the top down, which is why we are meeting here today. I think it has to come bottom up, but it has to be symbiotic. It has to be at a level where there is always conversation and consultation, and so if anybody heard my false contribution to the Parliament, I championed the call for, from St. Cabinet, ensuring that if you're going to be dealing with a scourge like COVID-19 that affects young people a lot, and we're dealing with a dynamic where we have a variant that seems to be affecting persons within the age range of youth that we must have a young person at the seat of the table. Minister Kazame plans to meet more regularly with the NYC to ensure that his ministry's goals for the organization are achieved. Julia Tepita reporting for the Ministry of Youth Development and Sports. The skills and capabilities of law enforcement, customs defense and security forces responsible for border controls to detect firearms trafficking have been significantly enhanced following the detection of firearms trafficking training course. The course which came to a close on Friday 24th September focused on the detection of firearms trafficking through postal and fast parcels at land and maritime borders. Deputy Postmaster General Dennis Inglis expressed gratitude to the United Nations Office on Drugs and Crime UNODC for the well-designed course. And I'm happy that this has not dissuaded agencies from focusing efforts on dealing with other ills that affect our borders. And these ills, for example, I was speaking about the trafficking of illegal firearms. And this has caused an urgent need for training exercises like this to build capacity and also to implement relevant changes. In that regard, I would like to thank or show my appreciation for UNODC impacts, paramount impacts, and the Government of Central Asia for this timely intervention. Rest assured, we at the post office will ensure that our team members are basically employing whatever skills that they learn to train inside the training session. Deputy Comptroller of Customs, Shilman Emmanuel, describing the training as timely, highlighted its significance in keeping St. Lucia's border safe. The Customs Department is pleased that we will not only include it, but we could also collaborate with others in this exercise. We believe, like the Royal St. Lucia Police Force and the Postal Service as well, our mandate has a significant national security implication if it is not carried out as important. So this training is timely. It is timely. And we are happy that we could have had the number of officers benefit from this training. And we do believe that the training will be implemented, will be carried out, and we believe that it is going to be a quality lead about our border security situation. Minister for External Affairs, International Trade, Civil Aviation and Aspiral Affairs, Honourable Alphabaptiste, noted that such trainings are paramount to preventing crime and keeping the relevant agencies one step ahead of the criminal entities. Police reports recently found that some organized criminal groups have been using parcel services to smuggle firearms into countries often by selling their parts and components separately because they are harder to detect. So they sent a weapon not in its totality, not the whole weapon, but they sent different parts. And you see a real component. It will not arouse any suspicion. And therefore, there must be glad nexus between pastimes, police, postal services, and every aspect of that chain that is responsible for ensuring that we are smarter than the criminal networks that are sending firearms to all countries. The one-week training course was facilitated by the United Nations Office on Drugs and Crime UNODC and the Caricum Impacts. This is NTIA Nightly. Primers Hutchinson is up next. Stay with us. Welcome back. We join Primers Hutchinson for the NTIA Nouvelle Aquéole. G.I.S. NTIA Nouvelle Aquéole, Primers Hutchinson. G.I.S. NTIA Nouvelle Aquéole, Primers Hutchinson. F.E.K.O.P.O.N.K.I. This is K.E.B.L.A.M.E. E.P.I. Caricum. A common global satellite of all the Earth to connect to the U.S. to reach a normal relationship between the E.P.I.D. and the E.P.I.K.O.P.A. and to address the economic crisis that has blocked the ability to increase the economy. And this is also an obstacle to be able to realize a complete economic unification. Prime Minister Lucie F.E.K.O.P.O.N.K.I. I am also grateful to the Minister for the support of the E.P.I. Caricum for their service, education, sports, and social development. The E.P.I.K.O.P.O.N.K.I. has the benefit of a normal relationship between the E.P.I.K.O.P.A.M.E. and the E.P.I.K.O.P.A. Prime Minister Pierre Obsovéki, I don't think I'm going to be able to tell you that it's important for young people to accept the great responsibility that we have to do. Any address that observes young people who are doing tourism in the land, Ministers are doing tourism, as said by Dr. Ernest Hiller. It's an appeal to continue doing tourism, to give resilience and durability to the industry of tourism, even if the industry is going to try and act, and the pandemic is going to end. Except for the fact that Ministers Hiller said that not everyone is going to participate in doing tourism. Dr. Hiller said that it's important for young people to continue doing tourism, to give resilience and durability to the industry of tourism, even if the industry is going to try and act, and the pandemic is going to end. Ministers are doing tourism, as said by Dr. Ernest Hiller. In addition to the fact that Ministers are doing tourism, we expect that the industry in the land, to be able to do a very good job of the industry and to maintain a sense of prestige. And Ministers are doing tourism, as said by Dr. Ernest Hiller. It's an appeal to keep the industry going, especially in the land where the industry can come. I'm going to be able to tell you that Ministers are doing tourism, as said by Dr. Ernest Hiller. to work for the tourism industry itself and to build a gym that is for agriculture and for the economy of the youth. Dr. Hilediki learned a lot of things that depend on the industry of tourism. For example, these are just the voyages, the work of the people, the taxis, the companies that bring tourism, tourism, everything. The work of the hotels, the riverbeds, all of which are for the establishment of tourism, all of which are for the development of tourism. The concept of tourism is a voyage to the earth, which is that the first program of the vaccine is to continue and all the restrictions of the travel are reduced. All of the 70 million of the work that we are asking for is to live in a place that is very, very beautiful in 2020. During the corona pandemic, I was called to several educational institutions to do this, but there are many children who have returned to the school. This is because the service of education of the children makes it a reality. Officers who do this for training, that is the favorite of the clerks. It is their collaboration and several agencies that make it possible to work with several government agencies, the health review, to ensure that the children are finally able to work in these institutions to support the development that is going on. Madam February also said that we have to implement a plan and health review to establish all these protocols to ensure that all protections are in place to ensure this. Administrators who do these institutions for the education of children, that is precious jewels early childhood development, that is Dona Sanchez, said that these institutions to ensure that the children are able to assist these children because their children have the benefits to ensure that the children are able to criticise life. If we are to continue to work with all these institutions for the education that is being done, it is because we have established these protocols that make it easier for these officers to follow the education of the children that you are going to work with presently in these institutions. And that is why we are here today. I thank you so much for watching, Madam. I thank you for inviting me to come again to tell you about the life of our new president. Thank you very much. That brings us to the end of NTN Nightly. Join us next time at 7 p.m. with a repeat at 7 a.m. You can also catch up with us anytime on the St. Lucia Government Facebook page or YouTube channel. I am Channel Novel.


Good morning, everyone. My name is Yin Xiong. I'm the chief architect of Path Platform at Huawei. As Sam just mentioned, that yesterday we officially joined the foundation as a Go member. There's no better time. Thank you. So there's no better time for me to stand here to talk about Huawei, to talk about Huawei's Path Platform, what are we doing there, and talk about our experience with Cloud Foundries. Get my slides here. Yeah. So our Path Platform actually supports multiple scenarios. One of the scenarios is a cache, communication as a service, which I will focus a little bit on for today, just morning. Now, first of all, about Huawei. How many of you heard or know about Huawei before? Not today? Not yesterday? That's good. It's more than I expected. That's great. But anyway, Huawei was founded in 1987 in Shenzhen, China as a telecom equipment maker. So traditionally, we were hardware companies. But we still make a lot of hardware. But last 28 years, the company has grown to a leading global ICT company. By ICT, I mean the information and communication technologies. So Huawei provides wireless, wireline, and network services, network product, and network solution. But also, we provide enterprise IT technology, such as storage. We have our own database, and storage services, computer server, and end-to-end data center management solutions. So as you see from this slide, last year, year 2014, we have our revenue reached $46 billion. We're really growing fast. By the end of last year, we have about 117,000 employees. We are one of the big companies in China. Of course, we are one of the big companies in India globally. So today, the company is in the middle of transformation. We started a couple of years ago. As many of you know already, the cloud computing, the big data, the IoT has significantly impacted telecom industries. Our customer, telecom service provider, they want SDN, software-defined network. They want to watch and analyze their network functions. They want to use the cloud computing model to manage the network, to control the network, which they have built over the years. They want to open up existing network capability quickly to the users to reach more developers. They want to quickly develop new apps, new network function apps, where they can expose to the users, to developers. Now, we want to need innovations. We want to help our customer to realize the SDN and their vision. Now, we have a strategy called Softcom. Now, Softcom is an open network architecture. We are abstract the network function from the hardware. So we're talking about software-defined switches. So we're talking about software-defined routers. We're talking about software-defined firewalls. Software-defined everything. So those software network functions as a software, as an application, they're going to run the cloud infrastructures and they're managed by the platform. That's the Softcom vision. They want to help our customer to realize the SDN and NFV visions. Now, how are all this related to Cloud Foundry? And after all, this is the Cloud Foundry Summit, right? And we've got to talk about Cloud Foundry. I need to experience a history with Cloud Foundry. Although we joined the Cloud Foundry as a government board yesterday officially, our experience with Cloud Foundry actually started back in 2013, where we have a group of people, about 50 people, working on the Cloud Foundry. And we played one with Cloud Foundry. The last year, we released an internal version of our past platform. We call it Mushroom Cloud. That's based on Cloud Foundry. What you see in this slide is a home page of the Mushroom Cloud. If you can read the world, if you can read the home page, let me know. Besides the number, so far, we have more than 4,800 applications deployed. We have more than 35 users that has registered that they go to Mushroom Cloud to deploy the applications, the managed applications, the monitor applications. Although those applications are not production applications yet, but we really see a tremendous interest in our platform. We really see a tremendous interest in the Cloud Foundry technologies. People want to know, what's Cloud Foundry? What's the architecture? How do they work together? Can they scale? How do they monitor the applications? So we see a tremendous interest in the Cloud Foundry within our companies. Now, back to our scenarios. I mentioned earlier that we support many scenarios. Now, each scenario brings us a different set of challenges. Of course, there are different scenarios. Now, today, I want to share some of the challenges with you. And hopefully, in the future, we'll work through the communities that we can resolve or address some of the challenges that we are facing today. Now, in the NFA scenario, where the past managed the lifecycle of NFA applications. Now, in this scenario, the NFA application is very sensitive to the network status, because there are network applications. So where to deploy these applications? How many systems will deploy? And where to deploy? How to deploy? It's actually governed by a model. And that's different than as unique. And it's different than traditional IT web applications. And that's a challenge for us, too. Additionally, most of NFA applications, they are distributed complicated applications with multiple components. If we deploy each component as a container, then those kind of need to communicate each other, right? They need to communicate each other directly without HTTP protocol, because there are network functions. Another one big challenge to us is the monitoring systems. For if NFA application die from this detection all the way to full recover, it needs to have in seconds, if not million seconds, because there are network applications. So we cannot just monitor the resource, like CPU, memory, and IEO. We need to monitor the performance, the application performance indicator, like a response time, in order to respond to achieve that monitoring goals. Second scenarios, communication and service, which I will skip or talk about later on this. Like in many other big IT, enterprise IT, internally we have thousands of applications. Every day we have hundreds of applications in the queue to be deployed to be upgraded. So in the IT scenarios, the large-scale deployment, the deployment speed, how fast they can deploy, is the key to our IT scenarios. Can we deploy 300 or 400 containers per minute? Can we do that? Can we have hundreds of deployment requests at the same time for different applications? Can we do that? Those are challenging to us and to our customers too. Last but not least is Huawei Public Cloud. As some of you that, Huawei will launch public cloud services later this year. Our past platform actually will power and support the public cloud, which we're really excited. But at the same time, we face many challenges. As I have public cloud experience personally, the manager public cloud is a huge undertaking to us. So we want to make sure the past platform, the platform we build, the every component has to be secure independently. And every component has reliable under stress. And every component has an HAA design. Without this, you cannot manage public cloud. It's critical, it's important. Now let's focus on a little real scenario, the simple scenario is CAS, communication and service. CAS is not new. There are quite a few cloud-based CAS services out there. Now we want to share our CAS experience, how our platform and the Cloud Foundry play a role in the CAS overall solutions. So what's the problem we try to solve? I mentioned earlier, the cloud computing, the internet has significant impact to the economy in the industry. Traditionally, for enterprise, to build a voice, a video-enabled application, it's a long process. So how quickly can we get these capabilities out there for app to use to build a communication-enabled application? That's the problem that we try to solve. And this scenario we try to solve. And our past platform can be part of the solutions. So what's the solution? Now we start with the simple but effective solutions. You can review the solution two layers. One is the CAS API layer, which is hosted on the platform in the cloud. The second layer is CAS backend, where it resides in telecom network and on-premise. So it's kind of a hybrid cloud. But with the CAS API, the users, the developers, can discover this API, can subscribe it, and can just use it as a developer other applications. So how exactly we're using it? So we have built a CAS API surface broker, using Cloud Foundry's surface broker mechanism. With CAS API surface broker, we have a catalog API that developer can go there to browse the catalog, browse the API, to subscribe the API they need to. And they don't have to subscribe all API. And our past platform will create an API instance, surface instance, and monitor the API for them after they subscribe the API. Of course, we will scale it if you need to. Now, another part of the solution is we have integrated API management solution, which is based on open source. They integrate into the CAS API layer so that we can secure, throttle the API. We can monitor the API's SLA. This is very important. If you open up your API in the cloud, the security, the throttling, and the managed SLA is so important. Now, I want to show you a few use cases in these scenarios, in CAS. And the use case solution is very simple. The point here is you can build a voice-enabled application in hours, if not in minutes. Just call the CAS API through the URL. And the CAS backend will take care of the call, put the number you put there in your applications. And you can schedule the call anytime. And then the CAS backend will make a call by the sequences you put in your applications. And they will connect the voice with two parties together. Just so easy and simple. Now, this use case should be a little bit more complicated, but it's really cool. In this use case, a camera is registered to the CAS platform through the CAS SDK. And you can put a camera to monitor your family room, your living room, or your bedroom if you want to. And then once the camera detects a motion, you make a call to your cell phone. And your cell phone can answer the call and can view the videos from your cell phone. Really cool. And you can monitor your room. What happened in the bedroom? You can monitor that. Additionally, your cell phone can call the CAS API to actually control your cameras, control your cameras, how the angles, where you want to monitor. This is really cool. By the way, we have this real demo in our booth, booth 108. So if you are interested and want to learn about the CAS and then want to see the demo, please stop by booth 108. Another simple scenario. Just to show you how simple it is that you can develop communication-enabled applications, do it test, develop, and deploy on the same platform within minutes. As many as it is, it's simple with your API there. So as a summary, and also conclude my speech, I would like to see with open technology, there are a lot of opportunities in the tunnel coming that's where that we can innovate to help our customer in the cloud-based transformations. And we are committed to work with the community to build a robust quality advanced past platform to help our customer for them to innovate in these areas. End of the day, you make your customer happy, right? For that, I thank you very much for your time. I hope you enjoy your rest of the summit.


Hello, this is Professor Steven Ashben. I'm here to show you how to get a Born-Oppenheimer energy profile for a diatomic Molecule and what I'm going to do here is I've started off in the inorganic menu and chosen hydrogen So that's what we're going to start with and for starters What you want to do is get a sense of how far apart your reference point is and that's about 0.724 and so we'll want to start a little bit tighter than that and go out a little bit farther than that So the next step is to go to this this icon here, which is constrained distance You can also get that from that pop-down menu, but I set up an icon once you are in constrained distance you need to once again Select the atoms that you want to do something with and then I'm going to click on this I want to I want a profile so for starters I'm going to start off with something smaller than that and you know It looks like point three might be a good value for h2 and maybe I want to go all the way out to 10 There and the number of steps. Well, I could just let's get a hundred steps and And at this point we would say I just want to do not an equilibrium geometry But an energy profile everything else seems good. I'm going to go ahead and submit that and and that's I'm just gonna say that is something now while it's running you can monitor the progress with this little monitor icon, which is Tells you how far along it's got in this case. It's only on step one and You know, it might take five or ten minutes perhaps on your on your computer However, I've already got the the answer on this from a Precalculated it and so I'm gonna go to this and Let's see The There's that there's there's this what will what will show up for you is this icon here And you can just play that and it will tell you what what range it's it's gone over and and what's interesting to do for example is to say I want to look at the homo and And you'll have to choose that every step of the way that you want to look at it, which I've done here and So that does that and so that's kind of interesting The other thing that you'll want to do is go to this calculations page The spreadsheet page and go to add and what you want is energy You know, I've chosen kilojoules per mole So you choose that and now that fills that in and then you go to this graphics icon and say well I want to see what that looks like. So I'm gonna select that and create it and in this case, this is the graph that it's created for me and and You can see that as a function of that distance The boron oppenheimer potential at a great distance doesn't change very much then it comes and reaches a minimum and Then goes back up probably due to the nuclear nuclear positive positive repulsion this of course you can you can you can save you can print you can take a screen capture and And what one thing that you will want to do when you start this off though is if you remember this Write down where you started it off, which in my case was about I think 0.3 angstroms And then I think I went out to 10 and that would have been the equilibrium value about 0.74