Tom here from Orange Systems, and let's talk about some challenges with 10 gig. So the simple solution is I take a DAC cable, plug it into my micro-tick, which happens to be the CR305 1G. I've reviewed this one before. And then I plug it over into my device that hopefully isn't further away than the distance. Well, then you can get a bigger one of these. They go a little further. But then you're like, okay, but I have RG45 on my computer, but I also have this micro-tick here. So I go ahead and pop one of these devices in, and now I can go the full spec. Or did you not realize that these don't go the full spec? And that's what I wanted to talk about was using CAT6 and CAT6A seems like a great solution in terms of you'll be able to go the distance, but then when you throw these in the mix, they don't necessarily work. Now this Unify XG6 PoE has standard 10 gig RG45 ports. No problem. Does the distance. But when you start getting into using the adapters, the SFP plus RG45 adapters, that isn't the case. And I want to talk about the comparison between the three different models I have here and the distances we're able to get with them before we dive into the details. Let's first. If you'd like to learn more about me and my company, head over to laurancesystem.com. If you'd like to hire a short project, there's a hires button right at the top. If you'd like to help keep this channel sponsor-free and thank you to everyone who already has, there is a join button here for YouTube and a Patreon page. Your support is greatly appreciated. If you're looking for deals or discounts on products and services we offer on this channel, check out the affiliate links down below. They're in the description of all of our videos, including a link to our shirt store. We have a wide variety of shirts that we sell and new designs come out. Well, randomly, so check back frequently. And finally, our forums. Forums.LauranceSystems.com is where you can have a more in-depth discussion about this video and other tech topics you've seen on this channel. Now, back to our content. Now, the first thing we need to be very clear on is where the cabling standard is. It's going to be different than where these devices are. And the cabling standard is, despite what many commenters on YouTube say otherwise, CAT 6 cable should not exceed 55 meters. And the CAT 6A cable should not exceed 100 meters. These are just the certified specs. And if you want to deep dive into how those specs are made, this is an interview I did with Dan Barrera, which I'll leave a link to, which is great. It's all about cabling standards. And why talk to Dan? Well, he sits on the board that helps certify cabling standards. So I learned a lot during this interview. So I'll leave a link to this if you're interested. I'll also leave a link to the article over on FS.com talking about 10 gig over CAT 6, CAT 6A, and CAT 7. So you guys can then debate and argue and leave comments. Now let's get to the fun part. And that's this. So when we're looking at these devices, we're going to start here with this one. And the fact that it says 30 meters right here, this is the thing that people often overlook where it says up to 30 meters. And let's look at the meager tick one. Now the meager tick one, it says right here, 30 meters in the description. It doesn't say it over here. And over on their website, it says distance of up to 200 meters, which has to be certainly a typo. And that's where some of the confusion come in. Now the FS.com one that we ordered goes up to 80 meters. And they have models that do 30, and they have models that do this 80 meters. And that's where we wanted to start with the testing as I ordered one of these. And I wanted to compare it to the other devices that we have. Now we take a close look at the FS.com ones. They look pretty much the same. Maybe there's a little bit more metal on this end of it. But for the most part, other than being ever so slightly longer, they all look the same here. So we have the QSFP tech, we have the FS.com and we have the meager tick RJ10. Now it was pointed out to me by Serve the Home, and I'll leave a link. They have some articles and they reviewed these as well, that there may be different revisions because I bought these a little while ago. So these are the ones I'm testing with that I bought early on this year. So mileage may vary. I don't know if there's different stock if you bought one today. But what I did find was both the QSFP tech and the meager tick one performed identically. They both only go 30 meters, and I mean 30 meters. Whether you use cat 6, whether you use cat 6a, it didn't seem to matter. Once you exceed that 30 meters, they have a hard time connecting. They just pause and wait. And when you go quite a bit over the 30 meters, if they connect at all, they claim to be connected at 10 gig, but won't even transfer at 1 gig and with a ton of retries and errors doing eye perf tests. So these pretty much are very limited to exactly the spec they set. And that was pretty clear. We tried them in both this meager tick right here, which is a pretty great little device. I'm really happy with it. It's really popular, I know, for among people putting together home labs, but putting them in here or putting them in this Unify made absolutely no difference. The distance and the link up times were still, well, slow and painful once you exceeded the distance listed of 30 meters. Then we move over to the FS.com that claims 80 meters. And that was interesting. We had no problems with 80 meters. 80 meters linked up right away. Then we went to 90 meters. And we were doing 90 meters instead of just 90 meters with your standard CAT 6A, which is spec we use this CAT 6. Now, I know this is 555 megahertz, I wanted to point that out, and there happened to be 90 meters in this box. And it worked great. I had no problem. The exact numbers 92 meters was in this. We snapped some ends on here. And this is just CAT 6 here, not CAT 6A. And it minimal, an absolute minimal amount of errors. And we moved quite a few terabytes of data. I had to re-sync some free NAS servers. So I stuck this cable in between them. I popped them in the maker tick switch. And wow, I'm impressed with how well these worked. These, not so much, just it constantly aired. It would eventually transfer using these when they're a little over spec, but eventually with really slow speeds, constant retries and errors, and, you know, drop packets and et cetera, et cetera. But the FS.com even using cable that is not specced for this, so out of spec was working shockingly well. So I gotta really say that these FS.com ones I'm really happy with. I only had them running for about a week, so this is not a long-term test review. We don't put a lot of these in production. Most of the time when a client is speccing something out, the servers are all connected either via DAC or fiber optic cable, and we don't use RJ45 for long 10 gig runs unless you're connecting them to PCs. Now, as far as that same 10 gig cable, I did do one other test. I got a few errors on the FS.com, but when I used this same box of cable and plugged it into the RJ45s on like this switch here, no errors at all and the transfers went perfectly fine. Now, a couple other notes though. Someone said that these will potentially cause problems because they pull them more wattage. The watts are limited by whatever the manufacturer designed and spec'd. So I don't think that'll be an issue, but as I said, this was not a long-term test. Also of note, if you pop in a handful of these adapters to convert this to be RJ45 with SFP pluses, there's even, I believe, a warning somewhere from Mikrotik or a forum post I'd seen. This will definitely get hot. If you put a few of these in here, set a small fan or something on there. The long-term effects of the heat, yeah, maybe a problem on here. Now, one other test we did do just to make sure it wasn't anything with the Mikrotik box. As I pop these in like the Unify here and the other Unify I have back there, the 30 meter limit is the 30 meter limit. Didn't seem to matter at all which device I used. There was absolutely no noticeable difference between them. And the same thing with this. This had no problem doing 80 meters or that little bit over spec with 90 meters using just Cat 6, which surprisingly worked very, very well. We did one more test with Cat 5. It won't go quite as far, but yeah, you can get out of spec even with Cat 5 and still have very few retries. Now, that was my test and my experiment. This is not something I'm recommending, but I realized people building a home lab, they may have more limited resources or already ran cable.  So if you are looking to get one of these adapters, do take a look at the distance that they support. I know more than just FS.com supports these, but that's the one I decided to go with test, because a lot of people recommended these. We've bought some other DAC cables and a few other random things from them. They've always seemed good. The reviews generally are good on the FS.com stuff.  And they definitely work great. I didn't notice also any difference in heat between these or these. They all seem to get up to the same temperature, even running them over time and moving all the data. Once they reached a peak temperature, they didn't seem to exceed that, even running no data. Matter of fact, they seem to get to that temperature barely doing anything. They kind of just hover around that temperature, which they were reporting on the Mikrotik. I believe it was about 45C. So 45 centigrade on there is what they hover. Sometimes they go up a little bit higher, but not much. And of course, this is going to vary greatly with whether or not you have a fan in this and how you're dissipating the heat and whether or not you haven't actively or passively cooled the fights, et cetera, et cetera. But my overall, if you're looking for something to go that little bit of distance and maybe you overlooked and purchased one of these that then realized you couldn't figure out why you were having so many problems or you couldn't get the full 10 gig, it's probably because a lot of them you may have not noticed that despite Mikrotik, Mikrotik for having a 200 meter list on their website, they will only do 30 meters, much like the Amazon link says on there. But I'll leave a link to this particular one at FS.com if you're interested in it. But these ones also seem to work perfectly fine if you have the shorter distances. If you're doing your home lab all in the same room, well, you're probably not that far away and you should be able to get away with it perfectly fine. All right, and thanks. And thank you for making it to the end of the video. If you like this video, please give it a thumbs up. If you'd like to see more content from the channel, hit the subscribe button and hit the bell icon if you'd like YouTube to notify you when new videos come out. If you'd like to hire us, head over to LawrenceSystems.com fill out our contact page and let us know what we can help you with and what projects you'd like us to work together on. If you want to carry on the discussion, head over to forums.laurancesystems.com where we can carry on the discussion about this video, other videos, or other tech topics in general, even suggestions for new videos, they're accepted right there on our forums, which are free. Also, if you'd like to help the channel in other ways, head over to our affiliate page. We have a lot of great tech offers for you. And once again, thanks for watching and see you next time.


I'm going to talk to you about identity management. Yes, we do have a full room. So yeah, are there any seats left? No, OK. Everyone can give it up for Fraser Tweedle. Yeah, it's nice to have a packed room. And yeah, I'm Fraser. And I'm going to tell you about FreeIPA, which is an open source identity management solution. So I'm a developer at Red Hat, where I work on FreeIPA. And in particular, on the DogTag certificate system, which provides all the public key infrastructure needs for FreeIPA. And I have a development blog. The link is up there. And my Twitter handle is hack-by-door. So I'm going to introduce identity management. And in particular, FreeIPA as a solution for enterprise scale identity management, an open source solution, of course. So we'll have a look at the features of FreeIPA a little bit about how to deploy it. We'll have a look at the overall architecture of FreeIPA and the client components. And we'll conclude with a look ahead to what's on the roadmap. So identity management, what is identity management? Well, Wikipedia defines it as, and I'll just read this out because it's quite a mouthful, identity management, or IDM, describes the management of identity principles, sorry, individual principles, their authentication, authorization, and privileges within or across system and enterprise boundaries with the goal of increasing security and productivity while decreasing cost, downtime, and repetitive tasks. So there's a lot in that. Let's break it down a bit. Identities are entities like users, hosts, and services within an organization. Authentication are your concerns where you need to gain a degree of assurance that someone is or something is what it says it is. So these are passwords for authenticating users, two-factor authentication systems, certificates, single sign-on, and so on. Authorizations are the policies concerning identities and what they are or are not allowed to do within a system. And that concern only becomes relevant after you have authenticated an entity. And finally, the management concern is about how to manage these policies and identities in an efficient and scalable way.  You scale up to a large organization with thousands of users, thousands of machines or services. That is not a situation where you're going to want to have to scale the number of sysadmins. You have looking after these things linearly. That's a waste of money and there's a lot of duplication of effort. So some of the technologies in this space include LDAP, which is the Lightweight Directory Access Protocol or Directory Service. Kerberos, which is an authentication protocol where there's a shared secret on a key distribution center or KDC. And hosts and users can authenticate to that system. X509 is the public key infrastructure you're probably familiar with for securing the web and also email services and many other network protocols. So it describes a system of digital certificates where you can have chains of certificates, each verifying other certificates below it. So when you get a certificate chain, you can verify it right back up to a root certificate. DNS is the domain name system for binding names to network addresses. And NFS is the network file system for mounting user home directories on different machines they log into, for example. So that's identity management. What's free IPA? Free IPA stands for identity, policy, and audit. We do do identity and policy. We don't do the audit thing. So when the project was started, audit was intended to be part of it. At this point, it's been realized that it's better handled by other software, but it's still there in the name. It's a centralized identity management suite. So by centralized, we're not talking about a single server. When you deploy free IPA, there are a variety of topologies with replication agreements between different servers. So you have the ability to scale out and have redundancy in the system. Centralized really means that one deployment of free IPA is going to manage identities and policies for one system, and outside systems aren't really going to be consulting a different free IPA system for information. So it's not a federated system. Typically, one organization will have one deployment or one set of deployments of free IPA, specifically for that organization. It has a simple web UI and a simple command line interface. So we want to make it easy for people to manage the identities and the policies. Got to hide the complexity and also provide users self-service for some facilities where an organization might decide, well, we can let individual users manage, for example, their SSH public keys. Simple deployment is a priority of the project. How simple? It's one command to install or to deploy rather the server, free IPA server. And it's one command to install a client and enroll it in a domain when you've already established a server. And finally, we have Active Directory integration. So that is quite important because many organizations already have a lot of their identity data in Active Directory. They're probably not going to change wholesale across the industry anytime soon. So for free IPA to be successful, we need ways to integrate with Active Directory, but allow organizations to avoid a duplication of effort and avoid having separate identity silos. So if you have a largely Windows organization, but they need a Unix group or individual people using Unix hosts or providing Unix services, we want ways for people who are clients of the Active Directory realm to be able to get tickets for accessing the Unix services and vice versa. OK, so that's just a screenshot of the web UI. So it's, well, I've seen worse UIs than that one. So just to prove to you that it doesn't look horrible. Well, I don't think it looks horrible. UX people might disagree. So the components of free IPA are the 389 directory server, the MIT Kerberos KDC, the dog tag certificate system. And that's the component that I mainly work on. Although we do support other CAs, the Apache HTTPD is used to serve up the web UI and the APIs. And we also have bind for the DNS component. So onto the features now. In authentication, we have password policies, so things like patterns that, you know, that old thing, you've got to have so many special characters in uppercase and wellcase, and also password expiry policies. Kerberos ticket policy, so how long is the ticket issued for? Kerberos over HTTP. So for users who might be outside the corporate firewall or on a mobile device where only port 80 and 443 are accessible, you can actually have a Kerberos proxy running on one of those widely accessible ports. And they can do Kerberos over that port. One-time password, so we have native hash-based and time-based OTP, or external OTP systems like your, what's the company with the tokens, RSA Secure IDs and that sort of thing. And we also have the free OTP app for Android and iOS, and this is a free replacement for Google Authenticator. We also have some special commands for writing keys into UB keys if you want to use a UB key-based OTP system. We also do authorized keys management for SSH. So for a server where users will be logging in with SSH, if they provide their public key, then on those servers, instead of the regular authorized keys file containing the keys of people that are authorized to log in there, it can consult a database and look it up in the free IPA system to decide whether that key is known. And this is also subject to authorization checks. So we can authenticate a user, so yeah, we recognize that key. Now let's do some checks using PAM to determine whether they actually are allowed to access this host. For users and groups, we have automatic group membership rules, sudo integration, so you can bind particular commands and command groups to the user groups or the users that are allowed to execute those programs via sudo, SE Linux user roles, the auto mount capabilities, and role-based access control, which is more of a free IPA specific concern, so who is an admin for free IPA itself. Hosts, host groups, and net groups, so similar to user groups. We have automatic host group membership rules, one command host enrollment, so again this is this ease of deployment and ease of enrollment. The IPA client install command is used to, once you've yum installed or apt get installed, the free IPA client, just issue that command, enter a few, answer a few questions like where's the host or whatever, or via DNS auto discovery without prompting. It will install the client and enroll it in the domain. Host-based access control rules and SSH known hosts management, so similar to the authorized keys. There's a facility in open SSH where instead of just checking a flat file, it can go and look it up in a database and this can avoid the first time a user connects to a server. There's always that prompt, here's the key fingerprint and everyone just says yes and never checks it. So with the known hosts management, no one gets prompted. It's already known within the system. Services are first class identities in free IPA. We provide Kerberos key tab management and certificate provisioning via the certmonger tool, which also has the very nice feature of automatic renewal. So as the expiry date of a certificate approaches, certmonger can go and perform a new certificate request to get a newer certificate. So users don't encounter warnings about expired certificates when they're accessing servers that are authenticated with the X509 key infrastructure. So on the client side, we have SSSD, which is the system security services daemon. This connects a Unix client to one or more central identity stores. It's available on most Linux distributions and also on FreeBSD. And it supports free IPA. It also has special knowledge of Active Directory and some of Active Directory's features, but it can also talk to a bare ALBAP server. So this is something we use when you install free IPA clients. SSSD is configured, but you can use SSSD independently of FreeIPA, and it is a useful program. It provides credential caching and offline support. So if someone goes offline or if your KDC goes down, they can still log into systems and get work done. It works by providing PAM and NSS responders that know how to talk to the identity store and can look up names, can perform authentications, and so on. And there's also a D-Bus API, but that's not a stable API. And it's not very well fleshed out yet, but if you have use cases for that, we definitely want to hear about it. And we'd like to see what people can do with a D-Bus API for SSSD. So Active Directory integration, as I mentioned earlier, is an important part of what will make FreeIPA successful. The main feature for FreeIPA and Active Directory integration is the cross realm trust. So we used to do synchronization, but that is actively discouraged in the recent versions since cross realm trust arrived. So this allows you to manage your users, for example, in Active Directory and manage hosts and services on Unix systems and Active Directory users. So users of systems that are enrolled in the Active Directory domain can access the resources in the FreeIPA domain. POSIX attributes can be stored in Active Directory, or you can use views, which I don't know a lot about, but I think it basically does some transformation of Active Directory data or attributes into something that's understood in the POSIX domain. There's simple configuration, so there's no Active Directory specific host or service configuration. It can all be configured just by issuing commands on the Unix system. There's no data synchronization, and there's no additional software needed on the Active Directory machine. For all clients that don't have SSSD, or maybe an older version of SSSD, without the Active Directory support, we also provide what we call the legacy compliant, the legacy client compatibility tree. So this basically provides a tree with, I can't remember the name of the schema, but there's an RFC that defines the appropriate schema. With that tree, we can intercept binds and look up whether that user is an Active Directory user or a FreeIPA user. If they're a FreeIPA user, we then perform the bind against the FreeIPA directory tree. But if they're an Active Directory user, we authenticate them to Active Directory via the local that is running on the server, so local to the FreeIPA server, SSSD instance. For server deployment, we support Fedora, Rallon, CentOS. It's quite recently, I think, about October last year, available on Debian and Ubuntu. But this is less supported. So there are a few people working on that, but most of the developers on FreeIPA working on Red Hat systems, and indeed, many are working for Red Hat. So Fedora, Rallon, CentOS, these are our main focus. So there's one command to install the server, IPA server install, and you answer the questions it asks you and wait a few minutes as it sets it all up and you're done. All your infrastructure will be up and running, and you can begin enrolling clients in that domain or hitting the web interface and adding users, adding groups, adding pseudo rules, whatever it is you need to do. It is slightly more work to set up a replica. That's two commands. For client enrollment, again, a single command. You can answer some questions, wait a few minutes, and you're done. There's also auto discovery by DNS, which means you have to answer fewer questions. There's options for unattended install, and what IPA client install does is it configures SSSD, configures PAM, NSS, SSHD, all of these services that are working together to provide this nice experience for users of the domain, gets set up when you run IPA client install. There's also some integration with provisioning systems, including satellite or spacewalk, which is the upstream of satellite. Roundy with the open LMI, which I think is open Linux management infrastructure, and the form and smart proxy. I actually don't know a lot about these technologies, but maybe some of you do, and people on the mailing list do, so if you have questions, ask and you shall find. So the architecture, at a high level, we have the free IPA server with the LDAP directory, and the certificate authority, KDC, DNS, the HTTP server, all of these services talk to the one LDAP directory. You have an administrator that can administrate the domain using the web UI or the command line tool or the APIs. And we have hosts that enroll in the domain, typically using IPA client install, which will configure SSSD and related services, but possibly using the LDAP compatibility tree in an old client, so without SSSD. SolarisBox can be configured as a client of a free IPA realm, free VSD, open VSD, most unique systems you can set up. We have a Active Directory domain with Active Directory hosts and users, yeah, question. Specifically, you are trying to avoid siloed, effectively that doc. You mentioned before you were trying to avoid siloed user stores, but effectively you have got to because you've got AD and you've got the LDAP store on your free IPA, so I'm kind of confused by that. Yeah, so that's a great question. So what we want to avoid is duplication of identity data. And so we want to avoid silos with the same identity data existing in them. So if you have a situation where you have your users in Active Directory, you might have services running in the free IPA realm and only the only user identities you might have over there are administrators for the unique service and that sort of thing. But your main organizational identity data would, well, it's common, very, very common, to have an Active Directory domain with most of your organization's users in there. But you might have a Unix group with just a few Unix admins and servers there, but everyone needs access to those servers. In that situation, you'd set up a cross realm trust. Yes. You mentioned there's a better duplication of data between free IPA and Active Directory. Thus free IPA has the mechanism to detect if the, let's say, the user has already been existing on the Active Directory and also there's an instance like the PKI as well. If there's already an existing PKI record for that user, does pre-IPA check it or does it have the mechanism to do so? Okay. So if I understand correctly, your question is, is there any facility for detecting whether a user exists in both Active Directory and free IPA? As far as I know, there isn't, but it wouldn't be hard to write a script to go through and check for that sort of thing. Okay. For SSSD, the architecture, so we have a free IPA server over here which includes the identity data and also the authentication services. This here, by the way, is one host, so the clients are programs on the same host that SSSD is running. SSSD provides the NSS responder for name lookup and PAM for authentication and authorization, so clients talk to NSS and PAM according to their needs. These go through the cache, which provides the offline and credential caching and then these talk to the domain provider and the domain provider routes requests for general identity data or for authorization or authentication services accordingly. And yeah, there's just way too much detail in that diagram to explain, but if you want, you can snap a picture of that now, but the slides will be available online anyway. Okay, so the roadmap. Short-term efforts, so these are things that are efforts that are well and truly underway. In many cases, these have already been released in free IPA 4.1, which is available on Fedora 21 and there's also a copper to use free IPA 4.1 on Fedora 20. So DNSSEC support, CA certificate renewal, so automatically renewal, not just of the service certificates, but actually the CA certificate and pushing the new CA certificate out to clients. Back up and restore scripts for your free IPA domain data. The updated web UI, so the screenshot I showed earlier is actually the updated UI. If you use free IPA 3.0, something, then the UI is a little bit, well, it doesn't quite look as nice as what you saw. Improved permissions and fine-grained read access is a big improvement that landed in free IPA 4.0. Integration with the Red Hat support portal for rail subscribers and these features are available in SSSD 1.12 and free IPA 4.1 and this is being considered for release in rail 7.1. Longer-term efforts, so these are efforts that are just starting or we're laying the groundwork for these, enforcing stronger authentication for select services. So if you imagine a situation where you have some services that maybe are not particularly sensitive, so you say anyone who has a ticket-grinding ticket from the KDC, anyone who's authenticated, can get a ticket to access those services. But you may have more sensitive services and you might want to enforce a policy that says, well, if anyone wants to talk to this service, we want to make sure that they've authenticated using two-factor authentication. Currently, there's no way to make those policy decisions. The Kerberos KAMAC facility, which I think stands for container, something multiple-max, one of which can be the authentication-indicated data, will be used to implement the ability to define and make these policy decisions. The Kerberos authentication for mobile devices, so we had some people looking at actually getting the Kerberos client running on Android devices. I'm not quite sure where that work is at, but there was definitely some work in that area. DNSSEC improvements, so our DNSSEC support is fairly basic at this point. DNSSEC is gonna allow key rotation and revocation and that sort of thing. Smart card login for SSSD, so instead of authenticating with a password, you can insert a smart card to your computer and use that for authentication. Customizable X509 certificate profiles. At the moment, we only deal with server certificates. This will allow people to define new profiles for servers and also down the track lead to user certificates. So we'll be able to provision certificates for users to, for example, access a VPN server or whatever it is you may wish to do. These can be short-lived certificates as well. So you can say, well, we want a certificate for them to authenticate to a VPN service rather than having to have them do it manually using an OTP or a passphrase. So we can provision a short-lived certificate, maybe an expiry of one hour. They can use that to connect to the VPN. One hour passes, that certificate will never accept it again. And finally, the password vault, which is a user-accessible, secure key and password store. So this is something that will allow free IPA administrators to provide to their users as a self-service. And it's basically a free IPA front-end to what we call the dog tag key recovery manager. So a secure secret store. We have efforts to integrate with CloudForms. We also are playing with Docker, which is so hot right now. So we're looking at SSSD running in containers. So free IPA client in a container for other services in that container to use, and also running the free IPA server in a container. We have some methods in OpenStack, particularly with Keystone for authorization. BarberCan, which is the OpenStack secret store. We're looking at a back-end for BarberCan using free IPA. It would dog tag and the designate DNS component. Also, with OpenShift v3 coming up soon, which I'm sure some of you will have seen in Katie's talk yesterday, we're gonna do another round of integration. So we have free IPA support there for people who want to deploy OpenShift within their enterprises. Calamari, which is a self-management platform. And yeah, insert your project here. Maybe your project is one that could benefit from integrating with free IPA. If so, let's start the conversation. So adopting free IPA. The GNOME infrastructure team recently adopted free IPA for all of their identity infrastructure. There's a really good blog post. It's actually a series of blog posts, but start here. And you can learn about what their requirements were, why they decided on free IPA, and then in subsequent posts what was their journey of adopting and migrating to free IPA. You might have knowledge of or be involved in an open source project or community that is currently suffering from a proliferation of identity silos containing the same identities over and over again. If that's so, then you might also benefit from migrating to free IPA and we would love to talk to you and find out what your requirements are and work out how we can help you do that. There's a demo where you can go and play with the web UI. You can enroll clients to see what that experience is like and to use some of these features. Information about how to use the demo is at that link. It's sandboxed and it gets blown away every 24 hours and started afresh. You could put some really cool stickers on your laptop. If you think free IPA is a cool and an interesting project. We've also got Dog Tag and SSSD and OpenShift, which I didn't talk about really, and Docker, which is so hot right now. I've got stickers. There's stickers out on the Rego Desk and I've got spares if they run out there. So in conclusion, free IPA is an advanced open source enterprise identity management solution with a focus on ease of use and deployment. So the goals of the ease of use and deployment, of course, to reduce the cost of managing your identity infrastructure. The Active Directory integration helps avoid duplication of effort and duplication of data for enterprises who are already using Active Directory but have a need to run Unix services as well. So you might have a project or know of a project that can benefit from integrating with free IPA or benefit by adopting free IPA for your identity infrastructure. We'd love to talk to you if that's the case. Resources is a free IPA website. There's a page on how to adapt your web applications to use the authentication and the authorization facilities provided by free IPA. It's a number of mailing lists including the below traffic interest list which is used primarily for release announcements. The user's list which is general discussion and questions and of course the deval list which is where we make the design decisions and do patch review and so on. FreeNode, free IPA channel, and there's also a blog, what do you call this, a blog role, blog planet? I don't really know. But Planet Free IPA, that's a blog aggregator. Also SSSD, if you're just interested in that, we have Fedora hosted slash SSSD which is the main website and mailing lists of course and IRC and whatnot. Thanks to Demetri and Martin who made the diagrams because I really suck at that. And now we have time for questions. Yes. Thank you. One thing that I wonder about is how to secure the Kerberos server. Like, if it sort of holds the crown jewels, how do you actually, you need to make it available for configuration management and so on. And it needs its own management. And I have wondered about how this, you prevent people from just say, well, I'll just go and get all the everyone's accounts from here. Yeah, that's a good question. I'm not nor have I ever been a systems administrator. So I don't have any firm answers for you there. If you were just in Olivier's talk, and maybe he would have some good advice for you in terms of securing UNIX servers. I mean, the Kerberos server. It's a play-go, just tell me. Yeah. That's nice that you have that one. Sure, I mean, same with the certificate authority. You know, you need to secure the private keys. So even though credentials aren't typically traveling across, across the wire in an X509 public key infrastructure, or in network services that are using X509 to secure their communications, you still have those high-value targets. My understanding is SSSD will also talk directly to Active Directory, is that right? That's correct, yep. And in fact, you can configure it to have knowledge of multiple identity stores and authentication services at the same time. Know that IPA client install will specifically configure SSSD as a client of a free IPA domain, as well as configuring the other related services. Hi, just wanted to ask quickly about in the current IPA setup, you can't avoid the kind of domain admin problem you have in AD, where you have to have someone that has the rights to do absolutely anything with the directory that they like. And you kind of can't avoid that. However, is there any intention on the roadmap to provide a bit of segregation in those lower levels of administration about what they can mess with? So for example, you may have two vendors that you're using to run Linux infrastructure. You don't wanna have to duplicate multiple free IPA stacks for each of those vendors, but you wanna be able to limit their ability to add SUDU rules for each other's hosts or provision users in a way that would allow them to leverage the fact that they're using a shared directory. Yeah, great question. I'm not entirely sure on that. I know that you can delegate administration responsibilities, but I don't know if you can delegate them in a way whereby the responsibilities are branched into separate branches where people with the same responsibility or the same level of authority in terms of what they can do. But that's authority only applies to a particular sub-branch of the organization. I'm not quite sure. The mailing list would be a great place to find more about that. So this is kind of a bit of a two-part question. If you can get, oh, can you get Windows clients to auth to the free IPA server, even though the user account sits on the Windows AD box? Or does that require basically setting up the, like Windows machine to basically instead of being trust by the Windows AD, the Ignite should go to free IPA. But this is leading to the question of can you use free IPA to phase out AD in the one seen was hit? Yes, I believe you can configure Windows clients as clients of free IPA domain. That's not a particularly common use case, or at least it's not something that I'm aware of people doing very much. What was the first part of your question? Can you... What was that one? Basically, can you put in free IPA to be able to phase out a Windows AD server? So if you've got Windows clients as well as like units clients as well, can you...? You're right. Well... You're going to be able to answer the question. Yes. It looks like he wants to answer. Cool. Again, I've never been an active directory administrator. I don't know a whole lot about that side of the system. It's usually what people want to find out about those. So I'm sorry, I can't give you a direct answer to your question, but... Yeah, Andrew Bartlett would be great to speak to and the mailing list as well. Yeah, I work for a software development company. A lot of the developers run Macs. Has any of this been tested with OSX? I don't know if it has been tested with OSX, but given that OSX is Unix and you could definitely compile and run this software on it, maybe not as is, but it wouldn't be hard to patch it, I think. So if not today, then... Yeah, I'm sure with a small amount of effort it would be doable. Okay? Great. So I might hit you up for that information and then send it to the chat list or something afterwards. Yeah. It's about the Windows group policy on an AD. I know it's quite hard on the Linux or Unix side to implement group policy. Is there any future plans to populate the group policy on the Windows domain that's used by the Windows clients to pre-IPA because you've mentioned that the pseudo commands for the clients of pre-IPA can be controlled as well. So instead of doing it manually, I know, like for example, installing application and shared printer on the Windows AD through group policy is easy. But with Linux Unix, we can do that through infrastructure management, puppet ship, so exporting the existing or populating the existing group policy on the Windows AD domain to be used by pre-IPA would be great. Yeah. So I think that that is what the views feature is intended to be used for. So where you take group attributes or other attributes of users on the Active Directory side and then kind of creating on the fly the corresponding policy on the free IPA side that the service will then reference the Unix service. Is that what you were meaning? No. The AD group policy file is a separate module in Windows AD that you could export that into some one file format and I don't know how you could convert that or use it on pre-IPA if there is any future plans to do it or to support that. Okay. Yeah. I'm going to have to punt on that one. I'm afraid as well. It's not an area I know much about. Yeah. The mailing list will be, so the user's list would be a great place to ask these sorts of questions. And I promise you there are people there who will understand much better than I do what your question is and be able to give you a firm answer. Yeah. We can have Linux clients directly as clients for AD. So what's the benefit of putting free IPA into the mix? Why should we authenticate against free IPA instead of going directly to AD? Yeah. Again, it comes to the situation of you're an organization with your identity infrastructure in Active Directory, but maybe you have a need for a Unix group or you have a Unix group, they're going to want to manage their servers and their administrator accounts in the Unix way. So they can deploy a free IPA server and enroll clients in that domain. And you set up a cross realm trust. And so it's more about the situation where you have separate groups that want to manage the identities that they're responsible for in the ways that make sense for those platforms and being able to interoperate between those two different domains without duplicating identity data. I suppose not. All right. So we have run out of time now. If you do have more questions, I'm sure you can go and ask questions outside and take your questions out there.  It's a huge round of applause. Thank you.


Parts of speech in English grammar. The parts of speech explain how a word is used in a sentence. There are 8 parts of speech also known as word classes, nouns, pronouns, adjectives, verbs, adverbs, prepositions, conjunctions, and interjections. Let's take a look at them below. 8 parts of speech in English. Noun, a noun names a person, place, things or idea. Examples, dog, cat, mouse, student, cucumber, apple, Lucy and etc. Adverb, an adverb tells how often, how, when, where. It can describe a verb, an adjective, or an adverb. Examples, loudly, always, never, late, soon, etc. Verb, a verb is a word or group of words that describes an action, experience. Examples, realize, walk, see, look, sing, sit, listen and etc. Adjective, an adjective describes a noun or pronoun. Examples, blue, tall, thin, long, short, red, beautiful, sour, sweet and etc. Preposition, a preposition is used before a noun, pronoun, or gerund to show place, time, direction and a sentence. Examples, at, in, on, about, to, for, from and etc. Conjunction, conjunctions join words or groups of words in a sentence. Examples, and, because, yet, therefore, moreover, since, or, so, until, but and etc. Pronoun, pronouns replace the name of a person, place, thing, or idea in a sentence. Examples, he, she, it, we, they, him, her, this, that and etc. Interjection, interjections express strong emotion, and are often followed by an exclamation point. Examples, bravo, well, aha, hooray, yeah, oops. Phew. Thanks so much for watching! We are I-T-T-T, the leading provider for Tefal and TESOL training courses. If you like this video, please subscribe by clicking that button down here, and click on any of the videos here on the left for more interesting teaching tips for getting certified to teach English abroad and online.


Hey everyone, this is Dan. Let's talk about the recent bank failures and what the federal reserve banks have been doing to prevent 2023 from turning into another global financial crisis. As you probably know already, Silicon Valley Bank with more than $200 billion of assets was posed by regulators on March 8, 2023 because some of the depositors of the bank were withdrawing vast amounts of money causing the bank to incur huge losses as the bank sold off their long-term treasuries. On March 12, 2023, Signature Bank with more than $100 billion of assets also failed because of similar problems. You might say that these two banks were probably not managed as well as some of the other banks, but the fact that the federal reserve banks increased the Fed funds rate by more than 4% in the last year was also a major reason why the two banks got into trouble. On December 2022, FACSET published a list of 20 banks which had high levels of unrealized losses compared to their total equity capitals. Signature Bank was among the list of 20. Another bank, Silvergate, was on that list also. Silvergate did not get shut down by regulators, but Silvergate's holding company recently decided to shut down the bank also because of losses due to long-term securities and their business dealings with the problem Cryptocurrency Exchange FTX. Many people feel that the rest of the banks on this list and maybe some other banks are also failing because of the systemic issues related to the Fed rate hikes. Some people started to compare 2023 to 2008 when there were many bank failures. Let's look at what happened in 2008. According to FDIC, 25 banks failed in 2008. The situation got worse in 2009 with 140 bank failures. In 2010, there were even more, 157 banks failed. So far, we have only two banks that failed in 2023. The bank failures in 2008 to 2010 brought on what we know as a global financial crisis, which caused S&P 500 to drop more than 50% and the unemployment rate in the U.S. to go up to 10%. Are we going to have another global financial crisis in 2023? To answer that question, I looked into the data from 2008 and compared the data to today. I found something very interesting, especially related to the reactions of the Fed to these bank failures. I got a list of all the bank failures from 2008 to 2010 from the FDIC website. I also added into this list the failures of Bear Stearns and Lehman Brothers. Bear Stearns and Lehman Brothers were investment banks. They were not supported by the FDIC. That's why they are not on the FDIC list of bank failures. However, we absolutely need to include Bear Stearns and Lehman in our analysis because of their share sizes and their spectacular failures back in 2008. As the Fed has proven during the 2008 market crash and the 2020 pandemic market crash, one of the most effective ways to save the economy is for the Fed to increase its total assets. Generally speaking, the bigger the economic problem, the more the Fed total assets would need to be increased in order to stimulate the economy. When the Fed increases its total asset, it buys Treasury's mortgage back securities and other debt instruments from the banks. In exchange, the Fed transmits money to the banks electronically. The more assets the Fed owns on its balance sheet, the more money will be created by the Fed. As the Fed pumps the newly created money into the banks and into the economy, the economy and the stock market start to recover. To measure how bad the situation was with bank failures back in 2008 to 2010, I use the assets of the failed banks as an indicator. Now, when a bank fails, its assets do not completely vaporize. There will be asset destruction when a bank fails, but some of the assets are also preserved as the bank is bought out or absorbed into another healthier bank. It is however still meaningful to use the assets of the failed banks as an indicator to measure how big the problem was during the global financial crisis. If you look at the cumulative assets of the failed banks, represented by the black line here, it started out as zero in the beginning of 2008, then went up and up as we went from 2008 to 2009 and 2010. I've also plotted on the same chart the change in Fed total assets as indicated by the green line. As you can see, the Fed total assets also increased during this time. In other words, the Fed was pumping money into the economy to try to reverse the market crash. In the beginning, the failed assets were piling up much faster than the Fed was printing money. The black line was way above the green line. In 2009 and 2010, the Fed started to print money at a much faster pace and the distance between the two lines got narrower. To simplify this chart, I would just plot the difference between these two lines with this chart. The higher the red line here means the problem was bigger back during the time between 2008 and 2010. On this chart, I will add S&P 500 index. As you can see, when the Fed allowed the failed bank assets to get much greater than the freshly printed money, S&P went down and after the Fed started to pump a lot more money into the system to catch up with the failed bank assets, S&P finally started to recover. Tomorrow of the sorry is, therefore, when in trouble, print money. And you have to print money very quickly. Did the Fed apply that lesson learned to what happened in the last couple of weeks? Let's look at 2023. Since March 8th of this year, the two failed banks have total assets of about $319 billion. Also, since March 8th, 2023, the Fed has increased its total assets by $391 billion. The Fed is ahead of the failed assets by $72 billion, which places today here on this chart. We can see that in 2023, the Fed has increased total assets much faster than what it did back in the beginning of 2008. If the Fed continues to do so to stimulate the economy in face of these bank failures, it might just prevent the economy and the stock market from crashing much further. The added liquidity due to Fed money printing will, of course, also prevent some of the banks from actually failing. In the March 22 FOMC press conference, Fed Chair Jerome Powell set the following. Our view is that the banking system is sound and it's resilient. It's got strong capital liquidity. We took powerful actions with Treasury and the FDIC, which demonstrate that all depositors' savings are safe and that the banking system is safe. Deposit flows in the banking system have stabilized over the last week. Chair Powell also mentioned an internal review that the Fed is conducting to identify the cause of the recent bank failures and to develop a plan to prevent more bank failures from happening. He did not mention the details that the Fed had already gotten into the firefighting mode by pumping $299 billion into the system since March 8th of 2023. My opinion is that it's good for the economy and for the stock market in the near future if the Fed continues to be so proactive or accommodating. Some might argue that the Fed has already printed too much money since 2008. Besides printing more and more money will continue to cause high inflation. As you know, the Fed has been trying to bring inflation down from the high PCE inflation index of 5.4% in February to 2%, which is the Fed target inflation rate. The Fed will have to balance the need to curb inflation with the need of maintaining stability in the banking system. From the Fed actions we saw in the last couple of weeks, the Fed seems to have chosen to stabilize the banking system first. Hopefully after the Fed has stabilized the banking system, it'll get back to the task of controlling inflation. I'm sure in the next few weeks the Fed will share more information with the public about what they plan to do after their internal review of the bank failures. So far I can see that the Fed is already on the right track with preventing another global financial crisis from happening. So what are my investment strategies in light of all these? First of all, I have not dumped my stocks and ETFs at this point. In fact, if there's no more bank failure in the next two to three weeks, I might be buying more long positions in anticipation of the market recovery. I've been swing trading ETFs such as SPXL, SPXS, TQQQ and SQQQ, and I'll continue to monitor the technical indicators of SPY such as RSI, Bollinger Bands, and DMI to identify swing trading opportunities. And I'll share some of my trades with my subscribers on Twitter. If you like what you have seen in this video, please click the like, subscribe and notification buttons. I'd also like to suggest that you subscribe to my Twitter account, which is DanMarketL, so that you can see some of my stock trades and get my latest news updates. If you have any questions, comments or suggestions, please send them to me on YouTube or by way of Twitter. I'd like to remind you that I'm not a financial advisor. I share my stock trading strategies and analyses for educational and entertainment purposes only. If you want to buy or sell stocks, you should make your own decisions and you should definitely consult the financial advisors before you do so. This wraps up my video for now. I will chat with you again in the next few days. In the meanwhile, I'd like to wish you the very best of luck with your financial investments.


building confidence in speaking English in a non-native-speaking country. I have been teaching English to local and foreign students, and for the most part I noticed that no matter how much the learners would like to polish their English, some things hinder them to accomplish their goal in speaking the language. Studying a foreign language in a non-native-speaking country requires more discipline and motivation. Learning a foreign language is not acquired overnight. It has to undergo a specific type of training in the amount of time to learn. For this reason I came up with a list of why students find it hard to learn a foreign language, and what they must do. Hindrances in learning, fear of committing a mistake. Students who feel afraid to commit a mistake never learn. It's easy to understand the fear that might envelop the learner, while communicating in the target language. It's not easy talking to someone who speaks the target language so well, more so talking to a native speaker. Anxiety creeps in as you are made aware of your limitations with the language, as you the learner will be so conscious of the grammar and how you sound while trying to speak, rather than enjoying the experience of being able to speak the language. Learning a foreign language should be fun and exciting. Not knowing where and with whom to practice. It is important to have a usual place where the learner can practice the target language, and with whom to practice. Some students are forced to pay online or have a face-to-face class to learn. The difficulty here is finding the right program suited for the learner, paying a significant amount of money, and the continuity of learning. It's one thing to find a good mentor but it's another thing, to discover an appropriate media to continuously learn the language. Lack of motivation. Students who don't have a particular goal as to why they need to learn a foreign language, will quit even before they have started learning. During the beginning of learning around the first two weeks, adrenaline may still be high while attending classes. And this excitement will dissipate along the way due to a lack of reason to keep studying the language. For those who didn't know why they were in the language class in the first place, will never find meaning in what they do and eventually cease to continue. A close mind for learning. Not all languages work the same. Each one has its structure to follow. To convey a message in a foreign language, learners need to understand the correct way of using it concerning accent, grammar, and how words are put together. Learners should always keep an open mind to understand rules in the arrangement of words of the language, and how it is spoken. What to do to learn a foreign language. Find someone to practice with. Look for someone who you can practice with, it could be online with a partner or with a group. It's good to learn to speak with a native speaker but if it's not possible, you may find someone or a group who can help you speak the language. Just make sure that this person or group will enable you to get to your goal. Enforce discipline. Manage your time and find various ways on how to learn the language at the same time of the day, every day. Choose which time of the day is good for you to study. You can use various media like videos, books, or online lectures. The good thing with studying at the same time of the day is, it is habit forming. Habits are good at establishing discipline while studying. Find your balance. Everybody needs a break after a stressful work. Finding time to relax after hard work keeps your mind clear, and ready to absorb knowledge. You may listen to your favorite music, go out for a walk, eat or just close your eyes for five minutes after studying. This will make you excited again for the next round of learning. Keep an open mind for learning. Each language has its structure. So forget about your native language for a moment while learning a new one. It's better if you can communicate on how your target language is spoken and written, without diluting it with your native tongue. Never translate the target language to your own language in your mind while communicating. Direct translating is not advisable as this will create more language structure error. Are you ready to take a Tefal T-Soul course? Remember that learning a language requires motivation, discipline, patience, and vision. If you don't see where you are going with your target language early on, then you are just wasting your time. It's not a good practice to stop in the middle of something, because you suddenly realize that it's not worth it. Know your goal, set your mind to it so you will never get lost along the way. Learn more at www.TefalT-Soul.com


Most people complain that Apple Vision Pro is too expensive. What is the truth? But not really. In reality, Apple is not making money off its devices. It actually has a hidden agenda to make money out of consumers. And it has a hidden agenda that 99% of the YouTubers do not talk about. Maybe because they don't have the in-depth combination of product and engineering knowledge and also maybe simply because they're afraid of piecing off Apple. In this video, I'm going to investigate Apple's true motivation but how it's really making money off consumers. But not through devices but through its five hidden opportunities. And I'm also going to investigate what's on his strategic roadmap and what's most needed to not talk about. Stay until the end of this video where I reveal the last hidden resources that Apple might use to change its business model forever. Hey guys, this is Dr. Nancy Lee, a director of product and featured in FORCE. I help 100 people land their dream PM job offer in fan companies and unicorn startups and continue to get promoted as a product leader. In this channel, I cover the latest tech trends and product management knowledge. Like and subscribe to the channel to be notified every time I turn on a new video every Tuesday. When we talk about Apple Vision Pro is really expensive or not, let's look into Apple Vision Pro's value proposition. In the past, if you compare Apple Vision Pro with any other like VR goggle on the market such as Meta Quest is only $500 but Apple Vision Pro is $3,500 so seven times more expensive. But if you don't see it as VR or AR headset, it's going to change the perspective of the value proposition. For example, in my last video, a top of top five use cases of Apple Vision Pro, some of the industries such as robotics integration and the Apple Vision Pro is being perceived as content delivery platform instead of just a headset. Now, from Apple's perspective, let me show you what's inside a Tim Cook's mind. In Tim Cook's brilliant mind, his seeing Apple Vision Pro not as a VR AR headset, it's actually the computer that giving access between human and the internet. So what it looks like is it's actually an iPhone that stick to your face but with a very beautiful design and is able to integrate with all your work apps and integrate with different kind of content outside and maybe become the new browser to the internet. One of my followers, Tom says something very insightful. He said, I don't understand the obsession with the price. A base mini M2 Pro with a base studio display will run just a little under the $3,500. The Apple Vision Pro is not just a headset. It is a full-blown M2 computing device with a state-of-the-art VR AR display. I totally agree with his statement and I believe Tim Cook is seeing his device as it's a new computer as well. In reality, Apple is not making money off the Apple Vision Pro right now because it's the first generation and lots of R&D to make it. And even the manufacturing cost of such device is over $1,500. But it's a bridge over my new opportunities for Apple to make money through different aspects. How do I know it? Let's look up in the history of the Apple revenue product breakdown. Since 2022, Apple's number one selling product is actually iPhone which has a total revenue breakdown of 57.8% followed by services is 15.8% and then followed by different kind of accessories that's already almost 12% and then followed by Mac and iPad. So this trend of Apple actually invent some new devices such as a Mac, a computing company and gradually upgrade itself integrating computing into different kind of devices such as iPhone, iPad, iWatch and start to generate revenues through different aspects. Apple is no longer a computing company, it is a device, it is a phone company. So therefore it's likely in a long-term 10-year strategy roadmap they're trying to play something very similar for Apple Vision Pro as well. So how is Apple really making money off the consumers? Let me introduce you to the second revenue generation model for Apple which is selling data set. Think about it, right now if you're able to wear Apple Vision Pro seeing everything around you inside a house, everything you do and filming your kids playing with others is turned into a huge amount of data set that in the past no company is able to capture in the past. Now if you wear Apple Vision Pro inside a house you can use machine vision technology to detect any kind of object around you and understand your day-to-day behaviors. Oh it is really really scary and creepy and then Apple can sell the data set to the government, to third parties or they can use the data set to create a new product and put back on us again and they can also sell the memory of people. For example if a grandpa and your grandson said hey what does it look like when you grew up? Grandpa can bring down the Apple Vision Pro recorded from 50 years ago of his childhood and put it back on the little grandson. So the memory also has a lot of value to people as well because a lot of emotional attachment to it. This just reminds me of one of the very scary TV shows such as Black Mirror and I think some of the episode is going to become a reality from there as well. Do you agree with me? Like, comment and subscribe. The survey Apple is able to generate tremendous amount of revenue through us is actually by selling ads and it's actually by eliminating its competition which is Google and Meta. Think about this, if Apple is able to collect way more data about us compared with Instagram, Facebook, by the way nobody use Facebook anymore or through Google search because you don't need to search anymore you use Apple Vision Pro and directly communicate with Siri to pull information out of your Mac and in that way Apple Vision Pro can actually cut off Google directly pull information from Safari instead. In the past Apple has done something very similar. iPhone had many privacy updates that eliminated several ads playing methodology that made many ad companies win all the business because it actually give less data to Google and Meta and think about if they do this again to Apple Vision Pro's data and Google Meta is going to get killed quickly. And then Apple become even more valuable because currently the market capital Apple is even bigger than a combination of Google, Meta and Amazon. You never know what's gonna happen in the future. Number four, create developer platform. Did you pay close attention to the announcement video of Apple? They had a call to action to developers to create Apple Vision Pro specific application running on top of the platform. If they became the true platform they will become very powerful. Give you some specific example. When Apple started its own computer they started inventing iOS systems they had their own computing platform to compute with Microsoft. Why Microsoft this company still exists today was because when Bill Gates started Microsoft years ago it became a platform. Instead of building a computer Bill Gates said yes let's create a Windows platform because the operating system is a foundation of all the computer software to run in so that makes Microsoft still be relevant today even in most Microsoft products it's not that impressive compared with Apple's product today. Building any kind of platform is always very difficult to create but once it's created it cannot be easily destroyed. Number five is about selling content. Apple Vision Pro might potentially become the new Netflix. Can you imagine this? And especially if they become a new trend for everyone just to access content videos or many new ways or is their virtual girlfriend boyfriend living inside Apple Vision Pro is able to become the new Netflix. And in my last video regarding top five use cases I talked about the use case number five which is the adult industry. Lots of my loyal followers actually agree that adult industry might be the first one is going to take off through the integration of AI and Apple Vision Pro. So in that case Apple can just start to sell adult content or any other content through Apple Vision Pro and cut off any third parties. And Apple actually have done something similar in the past. When they launched iPod they started to introduce Apple Music and they disrupted the entire music industry. Not only buy a device they can only buy one dollar song from Apple and then Apple started to make money off those musicians. So Apple soon might start to make money off those content creators and become its own content creator which is the future of Netflix. Scary. As the end of the day it might be free because Apple can make so much more revenue through the five different ways I just described earlier and increase the access to Apple Vision Pro so they can build a new empire. Everything I just described can actually change the business model and also can change everything we're going to perceive in the future but this is what happened in the upcoming two years five years even ten year roadmap. Do you agree with what I said? Comment, like and subscribe. I love to hear from you guys. Check out more tech trends of AI and Apple Vision Pro in my playlist right here. This is Dark Training City from PMX. I'll see you in my next video right here.


presents Irene Dunn. From Hollywood the mutual network in cooperation with Family Theatre presents the ninth floor of the Plaza and now here is your hostess Irene Dunn. I hope all of our listeners are familiar with Family Theatre's purpose. It's to spread the practice of family prayer throughout all the homes of the world. A big job but don't underestimate the power of prayer. And now to our transcribed drama the ninth floor of the Plaza featuring Vic Peron as Will. She's getting to where I can't write a simple read. Yeah? Yeah, Mr. Johnson. No, no, leave the front page the way it is. If I haven't brought this thing on the flower show over by five, put back the two last paragraphs in the story about the Schwartz Boys appointment to Annapolis. Yeah, we'll run the flower show next week with pictures of the winners. They're threatening skies nor the enforced absence of their president, Mrs. Willis Strickland, prevented members of the Hillside Garden Club from staging their eighth annual... Yeah? Excuse me, are you Mr. Strickland? That's right. Editor and publisher of the Hillside Weekly Citizen? Yes. I am Hitilo Minlook Kran, alternate member of the Burmese delegation to the United Nations. Well, well, come in, please. Please have a seat. Thank you. Hillside is somewhat off the beaten track, so we don't get many visitors of your caliber, Mr. Kran. Kran. I hope you'll excuse the shambles I call my office. Oh, no apologies are necessary, Mr. Strickland. Well, this is the day the citizen goes to press and it gets pretty hectic. I understand, perfect. On top of everything else, my wife has been up in the assembly all this week. She's supposed to be back this afternoon, but I don't know... Is this Strickland? Yes, the state assembly. It's the first time a woman's been elected from this district. You must be very proud of her. Oh, I am, but well, it's left me a little short-handed. Quite naturally.  I beg pardon? Well, just what you've seen so far. I'll wrap out half a column or so for today's edition and then use the rest of the stuff for a follow-up next week. Say, I better have Johnson hold the front page. Mr. Strickland, I did not come here to give you an interview. No? Didn't you receive my letter? Letter? Last week, from New York. I addressed it to the paper. Oh, my gosh, wait a minute. Letter to the editor? Well, you are the editor? It's probably somewhere in this pile. I don't know how to apologize, Mr. Kran. If you will listen to me for a moment, please. It is not as a newspaper man that you interest me. It isn't. I am looking for the Willis L. Strickland who served in India during World War II with the 403rd Provisional Unit. Yeah. Are you that man? Yes, I was with the 403rd. In the letter that I wrote to you... Oh, if you can wait just a minute, I know it's got to be here somewhere. I can tell you just as easily. It concerns an incident that occurred in the spring of 1944 in a place then called Alang Payah. It was a sort of autonomous principality that lay along the border of my country and the province of Assam. Is the name familiar to you? Yes. Do you also remember someone named Shinsobu? I sure do. Then you are the lieutenant who made the sortie into Alang Payah. Myself and a Sergeant Finley. That was the entire party. Unless you count Caruso. Caruso? Our mule. And we sure counted him. He was the indispensable member of the group. He carried our transmitter, the hand generator, and enough sea rations to feed two men for eight days. The way Finley and I had it figured the job wouldn't take much longer. Eh, what do they call this stuff? Good night, Gus. Oh, brother. Oh, this isn't so bad. I understand it can get up to 10 feet high. Never mind. This'll do. Thanks. Starting to get light. Hold it. Hold it, Caruso. Yeah, yeah, yeah. You're in fine voice.  Take the other end of this map, will you? Yeah. Yeah, I better break out of poncho. We'll need the light to read by. I'll get it. Hold still, Caruso. Hold still. Okay, grab the other corner. All right. Got it. Let's get down as low as we can. Yeah. Yeah. You got the light? Yeah. See any cracks? No, we're okay. Hmm. The lines on this you would think we're following the pumpkin turnpike. They make it look easy on paper. Yeah. Well, we've covered a little better than eight miles. Caruso's beginning to feel a pinch. Maybe. Most of last night was uphill. Let's see. We ought to hit this ridge here sometime early tomorrow morning. About then. Well, let's get some sack time. Okay. You want some chow? No. We'll wait till the sun's up and make a fire. Good enough. You know, I still don't get it. Huh? That's job. If there is a Nip radar station here, why don't we just send in some Mustangs and blow the whole place up? Because they're not sure it's here. It's got to be somewhere pretty close. The way they've been intercepting the air support for Merrill's outfit. Yeah. Well, the way G2 explained it to me, close doesn't come. Technically, we're on neutral soil. How long pie is not at war? Yeah. Well, then I can believe. Huh? Who'd start a fight over this swamp? The Ellen Pines might if our Air Force started skip bombing their palace for nothing. They're, they got a palace? They got a king. I don't think he's living at the Y. Well, I still say they can't be neutral and have a Japanese radar station at the same time. They're either one or the other. That's why we're making this hike. Hmm? To find out which. The plan was simple enough. Finley and I were to get as close to the main village as possible, a place called Dumiga, and try to spot the Japanese radar installation. When we had it pinpointed, Finley would radio the map coordinates to headquarters. They'd give us 24 hours to start back, and then they'd send in the Mustangs. Well, that's it. 24 hours from now, they'll hit this place. Okay. Let's pack up and put it on the road. Yeah. How do you like the nerve of these gooks? Hmm? Neutral. With the antenna right on top of the palace. Pretty well concealed too. You'd never see it from the air. Yeah. Say, how's about we bring Caruso downhill to carry this stuff back, huh? Sun's almost gone. I guess it's okay. Probably thinks we deserted him. I'm looking forward to the day we can. Hey, you know something? What? I thought you were giving me the business when you said this place had a palace. It isn't the Waldor. That ain't no packing craic neither. I'll bet it's got 10, 12 rooms. Hey, how? And all that marble and glass windows. How do you suppose they ever got it through the jungle? They tell me labor's pretty cheaper in here. Well, that's nice because there'll be lots of repair jobs opening up the day after tomorrow. Hey. Hmm? Isn't this the tree where you had Caruso tied? No, it couldn't have been. Well, it was. Look, his Holder. Chewed right through.  Feel it. It's dry. He's been gone quite a while. Oh, brother, with the food and the ponchos. That isn't the worst of it. What if he wanders down into the village and somebody spots him? Who'd miss him? Well, that's what I mean. Well, Lieutenant, we better be getting going. Wait a minute. Wait a minute. We still got the job to think about. We've done the job. Not if they find Caruso we haven't. They'll come nosing around and find the transmitter and put two and two together. Well, we can bury him. No. No, I got a better idea. We'll radio back and tell them to send the Mustangs in right now. But there isn't time. They'll have another 10 or 15 minutes of daylight. It's the only chance we've got. Come on. We went back down the hill to the clump of trees where the transmitter was hidden. A mile or so up the valley, I could see the last of the sun glinting on the spired roof of the palace. Finley put on his earphones and opened the key and I started to crank the generator. I still say they won't have enough light to pinpoint the target. Okay, so they'll bracket it. They dump enough stuff. They're bound to hit something.  Huh? Better do it. He's got us. Stand up, both of you. You are surrounded. Is either of you an officer? I am. Lieutenant Willis Strickland. Major Hegeshi Okuto. I guess we're prisoners, Major. We are your military escort. What? This is foreign soil, neutral territory. Yeah, yeah.  In fact, the ruler knows only slightly of its existence. Then how come he let you put your radar unit right in his palace? Oh, you mean our weather station? Pretty good. It seems you were about to disclose that little secret to your friends. Uh, just about. Stand away from a transmitter, please. Major. If you please. Now, may we accompany you to the palace? I've got the feeling we don't have much choice. And uh, if I may correct you on the one point, the ruler of Arangpaya is Nathahi. King Yasura died over a year ago. The throne is now occupied by his daughter, Princess Shinzobu. Major Okuto and his squad of Japanese infantrymen marched us down the trail that led to the village of Dumiga. Then along a narrow dirt road that served as the main street and up the steps to the palace. Although it seemed to be the tallest building in town, it consisted of only one story. Its roof was studded with gables and minarets covered with gold leaf. Okuto ushered us past two smiling guards at the front door, then down a wide hallway and into a kind of old fashioned sun porch over looking a garden. I trust you will be comfortable here, Lieutenant. I'm sure I will.  Oh, you will both be quartered here, Sergeant. Through that door is your bedroom and through that the bath. You seem to know your way around pretty well. I have been interned here for the past seven months. Oh, is that what we are, interned? I believe it is the customary status ascribed to those apprehended entering a country illegally. Major, you on the payroll or something? I beg pardon?  Where do you get off taking us in? Oh, just being cooperative. You will find the place to be cooperative here. Mr. Anarata, do come in please. These are the Americans. Oh, greetings. Greetings. How do you do? Mr. Anarata is a prime minister. A storm birds major. Storm birds on the weather picture. Oh, really? Are you sure? I have just seen. You are waiting immediate. Thank you very much, Mr. Prime Minister. I feel gentlemen will excuse me. I must get down to the bed. Major, just a minute. Sorry. Storm birds. You mean airplanes. I think I should tell you, Lieutenant. We have never heard the word airplane in Arangpaya. Good evening. I bring a message, gentlemen, Lieutenant. Her Highness will welcome now. You mean the princess? Shinsobu herself immediate. Well, could I have just a minute to clean up, Mr. Prime Minister? A minute. I will tell herself. Step out when you are clean. One guard will show the door. Thanks. Thanks very much. Hey, Lieutenant. What kind of a chop suey parlor we get ourselves into? Uh, see if there's any running water in there, will you? You haven't got any time to shame. I got to scrape a little of this mud off me. Yeah, there's some here in the picture. They got a basin too. Well, fill it up. You got any clean fatigues? No, Caruso is carrying them. Listen, we got ourselves a problem. And the storm birds? Yeah, it's probably the air support for Meryl. Well, this'll be the last time anybody picks them up on the, on the weather picture. That's exactly what I mean. Yeah, but I'm aren't like this. Holy cats, wait a minute. Exactly. We got a room and bath right on target. I wondered when it was going to hit you. And no transmitter to call them off with. Plus, which if that prime minister's as thick as he sounds, he and the princess don't have any idea what the major's got set up in their basin. Weather station. I've never even heard the word airplane. You know, I'm not so sure I don't believe that. And me totally just look at this place. Early diamond Jim Brady. And I've got a strange feeling I've seen it all somewhere before. Yeah, fast asleep at three in the morning following a late snack of pigs knuckle. No, no, I mean really seen it or a picture of it. You got a comb? Well, half the teeth are gone. It's all right. So it's half my hair. What are you going to say to the princess? I don't even know if she speaks English. Well, that prime minister must have picked it up somewhere. Yeah, well, if she learned English from him, we're really in trouble. Wish me luck, buddy. The throne room was at the west end of the palace. I was admitted by two heavy set guards who accompanied me to a raised dais set along the far wall. The only light in the room came from two flaming braziers which stood on either side of the throne. Princess Shinsabu was dressed in a robe of heavy gold brocade and her face looked as white as wax. I guessed her age to be about 20. You are owner of the American mule. I would like to buy it. Well, I'm not exactly the owner, your highness. My grandfather was once in America and rode such a mule. He spoke often of it. I have a picture of him as tried the mule. See, it's quite a souvenir. Have you ever been to America? No, I have never. Do you know the plaza? I beg The plaza in America. Uh, you mean any special plaza? In the New York City. Hotel Plaza. Oh, that plaza. The plaza. Of course, of course. That is, I know of it. I have never stayed there. This is the plaza. Floor number nine. This? The palace. My grandfather bought plans of it. That was where he stayed in America. Is it not beautiful? Yes, it's very beautiful. I thought there was something familiar about it. Does it not make you homesick? Yes, in a way. And you cannot sell the mule. I would be pleased to buy the mule. Well, I'm afraid I don't have the authority to do that. The mule belongs to the United States Army. Ah. Well, in fact, I too, and my friends, Sergeant Finley, belong to the United States Army. We're soldiers. Like Major Okuto. Well, not exactly like Major Okuto. You see, he's on one side and we're on the other. Ah. You are having a war. Yes. Yes, that's what we're having. Anarata has spoken of it, my prime minister. We do not have war in Alangpaya. So I understand. Father forbade it. He said it was noisy and everyone lost their tempers. Uh huh. Also, that in any case, Alangpaya would lose. So we do not have war. Who is winning? Winning. You or Major Okuto? Oh, well, at the moment, I'd say the major is a little ahead. You will catch up. Your Highness, that brings me to a rather delicate point concerning the plaza here. Is it not beautiful? Yes, and I hate to see anything happen to it. But you see, Major Okuto has something in the basement. The weather station? No. No, that's what I want to tell you. It's not a weather station. No? No, it's a radar station. Ah. Well, you know what that is? No.  A radio. Your grandfather didn't tell you anything about radios or airplanes when he got back from America? Only of the mule and the plaza, and that was years later when he had grown old and no one else would listen to him. Well, when did he make the trip? It was his honeymoon. Well, let me see.  You talk into it and your voice can be heard by people hundreds of miles away, thousands of miles away. Do you know them? Who? The people who are thousands of miles away. No, you don't have to know them at all. Then what is there to say? Well, well, you can know them. Let's say you do know them and you have something very important to say to them. Some news. Exactly. Some news. Now, with radio you can tell them this news over thousands of miles in a matter of seconds. Ah. You see? Yes. Well, that's radio. Like shouting from hill to hill. In a way, yes. I have not heard the major shouting in the basement. Well, that's different. He's not shouting, he's listening or rather watching. For the stormbirds. Well, that's what he calls them, but they're really American airplanes. Belonging also to the United States Army. Now you're beginning to get the picture. What would the United States Army say if you told them you lost the mule? Your highness. In a way, that is true. I realized that. Grandfather said that in America it is finders, keepers, losers, weepers. Princess, I am trying to tell you something very important about this war. Oh, the audience is over. What? It is time to feed my fish. They sulk at the bottom of the pool when I am late. Your highness. You and Major Okudo may tell me of the war tonight at dinner.  And of course I couldn't say anything that night at dinner, not with Okudo right across the table from me. Though I sat up until daylight, I couldn't think of a plan to get the princess out of the palace the next afternoon without giving the game away. So that morning after breakfast, I put the problem up to Finley. As far as I can see, it's just tough luck. There's no way we can get a hold of headquarters and tell them not to send those planes in. I know. As far as that goes, we're going to have trouble enough getting out of here ourselves. All we got to do is stroll up the main street about quarter of five and when we get to the edge of town make a run for it. Yeah, well, I just hope it's that easy. If it were just some way we could con her into coming along with us. No soap. Now that prime minister told me she never walks anywhere outside the palace. She always gets carried in a C. Dan chair or something. I don't think we'd get very far trying to cut her out of town that way. Wait a minute. I just got a wild idea. Very wild. About what? Getting the princess out of the palace without having to make her walk. What? Stick around. I won't be long. Hey, where are you going? To request a special audience with her highness. It took some doing, but by mid-afternoon all the arrangements were complete. The prime minister had been doubtful at first, but Princess Shinsaubu finally won him over and permission was granted. At exactly four forty seven, Sergeant Finley led Caruso, our mule, up to the front of the palace. A brightly colored blanket had been thrown over him and two red pom-poms stuck out from behind his ears. Princess Shinsaubu's eyes were shining as I helped her under Caruso's back. Mr. Anuratha and I took up flanking positions on either side of the princess. Sergeant Finley tugged gently at Caruso's yellow halter and the strange procession started up the street. Is it beautiful, mule, lieutenant? I'm glad you like it, your highness. Do you not agree, Mr. Anuratha? Oh, immediate. It is one thing of joy. How you doing, your highness? I do what grandfather called the greatest pleasure in America, mule back riding. It's just too bad Major Okuto wasn't able to come along. He seeks for storm gods on the weather picture. Incidentally, lieutenant, do you have the time? Yeah, three minutes.  Has your highness ever viewed her kingdom from that ridge up there? No, I have never. Oh, it's a wonderful sight. At this time of day you can see the sun shining on the roof of the palace. And that trail up ahead leads right to the spot. Oh, I would wish to see it. Your highness, I must caution of the steepness of the ascetic. Please, Mr. Anuratha. Also, within the forest are beasts and insects. You have said the mule is a thing of joy. Caruso won't lose his footing if that's what you're worried about. He's never stumbled in his whole life. It is but a short way, please. Oh, the beautiful mule continues despite me. Unnecessary is my permission. Oh, thank you, Mr. Anuratha. We don't have far to go. I hear a strange buzzing. Hmm. Do you hear anything, Sergeant? Uh, probably one of those insects. Uh, I'll be on the lookout. We'll hear that. It comes close. Reverse the mule. I'm afraid we can't do that, Mr. Anuratha. What is wrong? Back to the palace. Plaza. I order. Keep going, Sarge. Come on, Caruso. Those sounds you hear are storm birds. Oh, the major will see on the way the picture. Not for long, he won't. They're American storm birds, airplanes. And here they come in over the treetop.  I never walk outside the palace. Come on. It's important.  Oh, they swoop in beauty toward the plaza. Hit the dirt, everybody. What is happening? What are they doing? Keep down, princess. Keep down. I'll tell you as soon as we get out of here. The attack came in five separate waves and by the time the last one had passed over, the palace was a heap of flaming rubble. The princess was broken hearted and Mr. Anuratha wanted to go back to the village, but we knew it would only be a matter of hours before the Japanese moved in to occupy Alangpaya, so we forced both of them to come along with us. It took three days to walk out. The princess rode, of course, on Caruso. Then she escaped alive after the bombing. That's right. Sorry, the prime minister. This is something that was not known until now. You see, since the granting of independence to my country and other of the Mele States, we have been endeavoring to reconstitute the old principalities on our borders. I see. To reinstate the rightful monarchs, or their heirs, in the interests of political stability. Well, now, I don't think you'll have much luck reinstating the princess. Come in. Terrible day. How are you, darling? Fine, fine, honey. The ridiculous man from the Radford district, Calhoun, I think his name is, everyone was pressing for adjournment and he simply would not yield until he delivered some senseless serang about crop rotini. Honey, I'd like to present this gentleman. Oh, I'm sorry. How do you do, sir? Mrs. Strickland? Mr. Tillerminlow Cran from Burma with a U.N. It's a pleasure, Mr. Cran. Of course, you know exactly how I feel having to listen, as I'm sure you must do so many absolutely inane speeches. Honey. When all you want to do is to get on with the work. I was just telling Mr. Cran how we met. Oh, how nice. Darling, did you cover the flower show and did they miss me? They were devastated. Mr. Cran has come down here, especially from New York, to talk to you about Alangpaya. How charming. You see, your Highness.  Not anymore. I'm an American citizen now. Oh, of course. Well, in that case. That's what I was going to tell you, Mr. Cran. Honey, they're thinking about putting Alangpaya back in business. That's what? Well, the feeling was, Mrs. Strickland. Don't waste your time, Mr. Cran. Take it from a native. Even at its peak, when I was in charge. Darling, did you call Uncle Annie about my collision with the milk truck? Oh, I forgot. Uncle Annie? He may still be in his office. Excuse me, Mr. Cran.  You'd think he'd learned how to drive in a jungle. Hello, Annie. Oh, well, this is Mrs. Strickland. Will you have Mr. Anuratha call me as soon as he comes in? Thank you. Mr. Anuratha is Uncle Annie? The ex-prime minister. He's practicing law in Boston now. Well, I really must be going. It's been delight for Mr. Cran. Good luck. Thank you, Mrs. Strickland. And if you ever get down to New York, I am at the UN. Oh, we'll be in New York next month, the weekend of the fourth. To celebrate our twelfth anniversary. We like to call it our eleventh second honeymoon. How sentimental. Then we will have lunch together. Where will you be staying? Where else? The ninth floor of the plaza. Don't you love a charming conversationalist? I do. I mean the sort of person who has a knack of making the small talk of life sparkle with wit and personality. This art of conversation is not a trick learned from books. Rather, I think it springs ready-born from a generous spirit. Good conversation is one of the true luxuries of life. Close as it is to us, on the tip of our tongue so to speak, there never seems to be enough of it. And that brings me to the point I want to make. Prayer is nothing more than good conversation with God. Children in their trusting way sense the truth of this. They always think they are confiding directly into the ear of God. It's a pity we sometimes lose that trust when we grow up. It is we who change, not God. He is changeless. So family theater again reminds us the family that prays together stays together.  From Hollywood Family Theater has brought you transcribe the ninth floor of the plaza. Irene Dunn was your hostess. Featured in our cast were Vic Perrin, Richard Peele, Virginia Greg, Herb Vigran, Marvin Miller and Jay Novello. The script was written and directed for Family Theater by John T. Kelly with music composed and conducted by Henry Mancini. This series of Family Theater broadcasts is made possible by the thousands of you who feel the need for this type of program. By the mutual network which has responded to this need. And by the hundreds of stars of state screen and radio who give so unselfish leave their time and talent to appear on our Family Theater stage. To them and to you our humble thanks. This is Tony Lofrano expressing the wish of Family Theater that the blessing of God may be upon you and your home and inviting you to join us next week when Family Theater will present. All brides are beautiful starring Ruth Hussie. Ray Bolger will be your host. Join us won't you? Family Theater is broadcast throughout the world and originates in the Hollywood studios of the world's largest network. This is Mutual, the radio network for all America.