It's going on everybody forces Donnie here. We're up in 2022 23 Chrome Bundesliga six box number three random teams. I'm gonna show you the results Now find them anytime a late sports cards.com. There's a link in chat Also reaching over here isn't the most fun We get the camera Yeah, we don't need it We don't need the camera. No Whoa, I'm already I'm already knocking sleeves everywhere. I'm moving sleeves everywhere You Just breaking Matt better than the other one Oh, yeah, breaking Matt's nice Hang on I'm gonna put this behind me aqua bubble is a Lorraine Ulrich rookie for Stuttgart That's out of 275. Let's do all numbered Ah That's the noise I just that's the frustration There's gonna be so many packs on the ground I can't really scoot over so yeah, I could probably scoot over some refractor of Uzkan for Dortmunds I'm so used to also. I've been doing fanatics live the past like two days and They had that vertical camera like crops like this much of our like view so I'm like way out here now I need to get closer wait for like a camera like it has only like that vertical view It's like a bone for right now. Yeah. Yeah for right now Stark airborne gonna have Kyle shooting percentage Which is why it's not great Refractor is maximum light I'd say it's about like 30 33 we need to get the The pack vacuum that's what we need to invent refractor Makoko for Dortmunds The pack vacuum sounds like be very noisy. Yeah, I mean that's how it goes sometimes You miss some dunks. That's all right flash your genius Ruther for often. I'm Ready to be slumber slam today I Would watch it, but the TV is over there Refractor read suit dawn That's the biggest thing I was like, oh, no, how do I watch sports blue wave rookie for a day? I'll do for Frankfurt's It's out of 180 We have the 180 is one Just sold the card in eBay. I don't even know what it was Luca nets refractor auto going to Munch and Gladbach. I Got new lighting. I got a it's like a making a brand new place because now I have that there's new lighting I don't know where my glare hits refractor rookie Ulrich for Stuttgart again All right bright futures of Yeah, they're coming back up right now airborne is to tough ronfort I'm assuming this because That and I think the national and there's a flagship just came out rookie refractor is Krause for Shalke 2023 Star Wars flagship and new galaxies coming out soon. So I don't know this like Or just Sanchez Flash of genius Muziala Byron Galaxy Fractor up a chinovich for Wolfsburg 21 galaxy is like still pretty high 22 is gone down a little bit It's not cheap man. Oh, I know our Gucci pink wave number to 75 for Stuttgart. Nice. Hargucci Yeah, I'm like, oh, I bid on things here and there and try to find things It's it's some of the people some of the asking prices for like base refractors is ridiculous We need more people to sell I think is what it is. Yeah, people need to sell it. All right box to SP authentic. I'm ready for that too refractor of Viper for mines rookie I don't know how much SP authentic will have we'll get at least some but usually we don't get a ton of hockey unfortunately Fractor of confidant the all for Leipzig by no get ins Pram of Rasslin top 11. That's two per case as alias skiri for comb cologne You go top 11 to per case on the short print bright futures so the aliyah for Freiburg bright futures Sanchez or mungengladbach Now, what's your favorite up when is legal player? The one guy the one guy man Yeah, I think nothing gets past Donnie. No Legendary to card Luke and that's Luke and that's wow big long-time fan Ricky refractor Schmid. That's super good for Verter He's like the top goal goalie guy golf ball whacker guy Airborne is Waldemar Anton refractor out of yummy Dortmund German teams Refractor it's a Kura What's the question Someone's that someone's wondering Howard Gucci flash of genius for Stuttgart. Yeah, that's the that's the fun of it Bright futures Shalva's lie Leipzig X Fractor is rookie Tim Lampereley for comb cologne to 250 and Mayena on the refractor rookie out of her cologne Linton Mayena Verts and Martell Yeah, I'm ready for galaxy refractor of Ruben Vargas Hopefully soon hopefully soon Now they had they had it up for pre-sale and they'd they cancel the pre-sale got a Zalazar rookie flash of genius for Shalke Cancel pre-sale Yeah, yes Fractor John Joe Kenny was it docking Bay vintage Vader Vader unplugged That one's got it's pretty cool. Yeah blue wave out of yummy to 180 nice one Dortmund Blue wave out of yummy. I like that. They're on one one I was like a portrait The best one is definitely vintage Value I feel like we pulled a red redemption of one of those at some point for someone That that thing raw is probably like 1500 like with how they're selling or somewhere You could probably ask that and get the lower. Yeah factor of Viper. I'd see at least mine's four figures I think so. Yeah the red Prism refractor show was live for Leipzig and numbered to 230 The numbering in this set is what gets me give our the all refractor for life sake Yeah, like the blue is the true blue is Somewhere on top 11 again super case. We got them both is al-has Bebu for hoppin. I'm bright futures of Aladu Jake. What are you doing? Okay Times it Well, it's early. I'm just kidding You don't know your work until Jake you're taking over Donnie in a second. Yeah Got refractor of Schmid for a vertebra Bremen everybody stop chatting Got a La Croix for airborne Wolfsburg Kyle says you just said Jake exclamation or Jake is exclamation point. He's yelling at a yummy You see all Kyle's name though. Kyle bestie in your best. Oh, no I've been played I've been turned on by any any gaming consoles in like over two weeks now Refractor it's a quora Flash of genius out of Gucci's to court Martell is cologne Purple refractor Marcus Tiram for Munchin Gladbach out of 299 Marco Richter to 99 on the flash of genius insert auto Here's the Berlin Marco Richter Guy must know a lot about earthquakes refractor Ruben Vargas is a Richter Flash of genius Alizar for Schalke Shane Did Sean not do the trash those things it looks like it's untouched. No, it's just a trash on Kyle What happens refractor John Joe Kenny for here at the Berlin? What happens? Blue refractor Nelson viper for mines out of 180 at true blue to 180 That's what gets me right there purple to 299 also throws me off Right future Ulster hog well, I guess he's a bad workspace manager then Hockwell bubble, sure. Although Becker onion Berlin 275 Rockhammon was like nope. I ain't doing that Refractor Danny Almo for Leipzig Their trash that's what happens. I believe it Shane Leanheart airborne Yeah, there's a sticker on top of the pace so we forget we're big dum-dums refractor Grifo for Freiburg If we forget that It's gonna be bad fractor is so hecky for onion Berlin Like you're both told and there's a tag on it. How how Confusion it gets me every time Celia it's something they put into the air vents here Sean it is like so many times a metal bar on the table. Yeah, I bet Voldemort Anton It sounds like Sean needs to tighten up Refractor is Ulster hog for Bochum. That's what it sounds like to me We need a thin trash can Fractor Florian new house for Munchen Gladbach Clash of genius mark our Richter at the Berlin refractor is Cassie for mines Come on. You're a big car super fractor time Gold refractor Angela still are Huffinheim One is 37 to 50 Gold is still 50 at least Hasebe on the refractor auto Frankfurt Makoto Hasebe Frankfurt bright future showbiz lie Flash of genius is in boom buff or Stuttgart Refractor as UK for after Berlin. That's a waste of a spot. He is he is the trash man Purple refractor Mario Golds suffer Frankfurt 299 two boxes left two boxes left how many spots in the next break Ready go over here now 12 to go in Don Russ team all full case 20 boxes. How do I get the chat? Oh, it's up here We tweet that out. I wonder if Sam knows that we did this Rearranged everything That's gonna be dude. He's not gonna pay attention. He's gonna come in here Tuesday and be like what that's for sure What's gonna happen? Like maybe watch the stream for once This is birthday or something Fracture a big shot for Huffinheim just commanders left on one Just the commanders aqua bubble Ruben Vargas Augsburg 275 The rim is it? What's what do you mean the rim? Evandro Borges Sanchez for Munchen Gladbach Three soccer breaks in a row Kyle let you down All uh scold Kyle next time I see him Chrome dust knees fracter goat suffer Frankfurt Don't know. What's the best kind of cheese you think Pretty soft for everyone's versatile. That's a rose really good. That's rose. Nice. Yeah, so deal you a Freiburg on the bright futures Well, hey that run was better than the downside of it. I'm guessing Georgina Router flash of genius Huffinheim Fracters subbers lie Leipzig Orange refractor finnol a becker for Huffinheim the rookie numbered 12 of 25 Pepperjack is good like Parmesan refractor of Hoffman for Boschum No, but like the sharpness of it makes spaghetti so freakin good, especially if it's good parm rookie refractor is zenter Augsburg So I've Jonathan. How you doing man? La Croix. Yeah, I don't I don't buy like the stuff that's on the shelf It's like Craft on the shelf. No, I can't get that.  That's awesome. Thank you. Howard Gucci I'm buried 66 of 99 Taking the new view. Yeah, you get to see who you get so someone who's sitting next to us now We're top-loading they're helping out they get there on camera. They get to talk. Yeah Everybody knows him now Flash of genius moves yalla. Yeah, if anybody asks now then unless you don't know who that person is Great future share hunts Just get real close in here purple feel mon and lean back Purple feel mon out of two ninety nine like Sean. This is breaking like Sean would He like a little like yeah, I got I got a lower the chair as far as it goes down This is the dustiest product of the year so far Gonna have to I bet he's hoppers now. What do you stand about Donnie? What got by no getting's bright futures for Dortmunds? So sad Yeah, we're gonna have to fire all of them at prison. I'm gonna have to get fired to a maximum Arnold 230 for Wolfsburg We're gonna hire We get Brad Pitt breaks.  I would do okay Brown paper bag it refractor griffo for Fryberg Yes, Jonathan How many breakers in the industry would have to like?  I'm glad I can see the door with this door open right now though. I do like that flash of genius a new house Then I can prepare for for attack quicker Refractor is Cassie for mines. So someone walks in the door and they're their trash. I'll just know right away purple refractor is osa tutu Purple rookie bosch of the 299 Fractor do a key Daniela do a key. Do we have a third studio coming? Paul voner bright futures, maybe a third studio in the works It's gonna be fun So fun some muck on airborne Just like this just like this just just in the shop or to your factor Osterhoek promotion I think it's only for like Wednesday like like very rarely is that gonna happen? I think honestly It's 199 angela or 165 excuse me Angelo stiller prism refractor auto for Hoffenheim That's part of it that's part of it that's part of the charm You're in the shop Tom Bishop Offenheim bright futures Flash of genius Holtman Fractor as UK for her to Berlin. Hey, if you're lucky enough, maybe you'll just what do you do Wednesday's channel to it night or regular night Blue refractor Kevin shop for Frankfurt's to what? On its on top of things guys. Oh, yeah, we're both a hundred percent today.  Oh say to to Maximilien Arnold's Yon Theelman orange becker rookie for Hoffenheim Ruben Vargas Mario Godse Angelo stiller shireldo becker Viper Toram showbiz lie out of yemi blue wave got extractor limb Parley Our Gucci pink wave. It's a 75. I'll adieu blue wave all rick on the aqua autos of Angelo stiller That's prism the 165 That Howard Gucci to 99 flash of genius for Stuttgart's Frankfurt's a Hasebe refractor auto flash of genius Marco Richter auto for her to Berlin to 99 a Even extra auto I didn't realize that when did we get the extra auto? I didn't realize we had a my Hina refractor rookie auto for cologne and a lucanets refractor auto for mungin lava Yeah, we had seven others. Oh, that's cool. Yeah, we go six. Was I was that wrong? Okay, no extra.  Thanks everybody


Sultanshi yeni woudie vii diyo, kai, innewe, hudi anokte, mi intentsis el sendi la video blogon de mjj voyagjó al malburno, sed mi anskar al ne, amtute fin redaktis jin, kay muntis jin, do ansta taue, mi dedsidis ke mi volas montiri al vii, kjell mi fadas video blogon pormjé kanalo, char komporeneble estas mute da aferoi kjell mi devas farei malenta la kuliso, mi suposas. So, in the first place, there's everything you see, but this place is only part of it, so now I want to show you. So, here's my movie, there I have my book, which includes all my Esperanto books and some movies. Of course there's a lamp there, a lamp there, my computer, the microphone, the pizza and banana, because I want to be a healthy person.  So, now I have to prepare the place for the movie, because every night after I film, I have to form everything, because it takes a lot of space in my room, as you can see. So, prepare the space, I have to always choose a topic for the video blog. And during the day, I often just write notes in my post-telephone about different ideas for my video blog. So, for example, here are a few ideas that I really liked at the time. I just wrote that during the day and now I just have to choose one of these topics to do. And of course, at that time, I have to film and record myself, and at the same time, I have to record my voice for the microphone that you saw earlier. And now, you can see my computer, I use this program, which is called Action. And it basically records the whole screen, and afterwards, I have to, when I finally film everything, and you can imagine that that will depend on the topic.  One moment. And that often happens. My cat suddenly sees that I want to film, and then he comes to me and just whines a lot. So, I don't know how many times I have to recommend a video blog about my cat. So, again, I want to show you the screen. That, of course, is the YouTube editor, I suppose. I use these programs. I use Premiere and also Photoshop. And as you can see, this is the unfinished sketch of the next film. I hope. It's about my trip to Melbourne. And you can see here that I have to edit a lot. I have to put some different levels of the film and sound, because sometimes the sound doesn't work. Sometimes the film isn't good, and I have to watch all the films. And that can take a lot of space. And in fact, I want to show you that now. I'm just going to my file. As you can see, there are all the video blogs that I've already done. There are a lot of video blogs. And there are all different files. I have, of course, the file file, the thumbnail for the film, and also a few other things. And after doing that, I can upload it to YouTube. So I'm just going to the upload button here. And I'm just going to select the film that I've done. And that's why I live in Australia. It depends on the length of the film. Sometimes it takes a few hours to upload the film. So usually I upload the film to YouTube, and I just upload it, because I don't have time. And when I upload the film to YouTube, almost all other computers at home can't use the internet. You can't use the internet, because the internet is actually very slow. I have to upload it, and then the next morning, I just go to the comment. And I see all your comments. And I just respond to the comments. And then everything is finished. And after that, I just have to start the process again. So that's all. I just want to show that to you. Because now I haven't finished the film where I edit it last night. And also I think that it might be something interesting for you. And yes, that's all. If you like this film, like it, share it, subscribe to my channel if you haven't subscribed yet. And I'll see you all in the next film. And if you're not there, I'll find you. And I'll film you from outside your window. And I'll help you with one of the pornography networks. And as always, I want to thank you all on my donation page. And this is the beautiful Sarah S. Slavish Galay and Robert Nielsen, Alexander Tolthes, in Col d'Anton in L'Intellige Champagne Loupe, Jason Knuckles, and Jao Figueria. And if you want to donate to my channel, because I can do that more professionally, you can ask the law below in my description.


Okay, so we're on we're on slide six. I think the agenda speaks for itself Again, we have proposals. We have sponsor requests and we have a backlog Today we'll be hearing from TIKB But as somebody associated with poor sex, I feel no shame in requesting a second sponsor I believe that Ken has offered to be a sponsor for the project having spoken to the team and I don't know if Brian Cantrilla's on it was able to speak to them, but I think he may Be able to act on their behalf Otherwise, I'll have to tell the team to go find someone else. Hey Alexis. Yeah, I intend to do that That their availability is limited by time zone So in my availability is really bad in the morning right now. So we're trying to find a time to talk. Okay. Thank you, Brian I appreciate that cool and open metrics and Honour but we're okay. So that means that we can go straight into the TIKB presentation Do we have Ed and Kevin Available. Hey Alexis, this is Kevin. How are you? I'm very well. Thank you as I was saying on Twitter, you know Open source is a global phenomenon. I saw you talking about that. So indeed. We hopefully represent a part of that globe With this presentation Well, good luck. All right, so I guess I'll share my screen and launch this slide For everyone and go for it. Yeah, make sure everyone can see me share screen. All right, hopefully everyone can see this slide Yeah, looks great. Awesome. Awesome. Okay, great. So once again, my name is Kevin I am from the company pink cap. I'm their general manager here in North America and I along with Our co-founder and CTO Ed Huang will be presenting TIKB to everyone. Thank you again for the opportunity Thank you for not watching the World Cup and listening to us at this very moment Very excited to be presenting this open source distributed transactional key value store for everyone to consider for CNCF and quick Here, let me see. All right So a quick agenda for today's presentation I will go through a history and a community update for TIKB a Fairly detailed walkthrough of the technical and architectural aspect of TIKB a use case with Ulama, which is one of the largest food delivery platform in China right now Serving more than 260 million users and they're using TIKB right now to serve about 80 percent of their Improduction traffic if you have time I will also do a quick demo on my laptop to give you a little bit of a feel of how to spin up a TIKB cluster on Your laptop and when we have time happy to take any questions from everyone on the call So a quick history about pink cap It was founded in April of 2015 by three infrastructure engineers We're working in some of the largest internet companies in China like net ease and JD calm and was of course one of them And we set out to build the TIDB platform tie for your curiosity just stands for titanium There are several components to the TIDB platform One is TIDB itself, which is actually a stateless sequel layer that is my sequel compatible The focus of today's presentation is TIKB, which is a distributed transactional key value storage layer We also built something called ties spark recently That is a spark plug-in that also talks directly to TIKB to help a lot of our users Process more complex analytical queries last but not least We also have a project called placement driver, which is a cluster that does the metadata storage layer That communicates with TIKB to do scheduling Auto-balancing and also timestamp allocation TIKB the project was open source a little over two years ago on April 2016 Its current version is 2.0 its license is patchy 2.0 and here is the link for you to check out the repo In terms of the community progress so TIDB as a whole is actually one of probably the most popular active Open source database project out there. It has more than 13,500 stars TIKB itself has more than 3,300 stars with 70 plus contributors and roughly around 3,000 commits right now We also have the benefit of enjoying contribution from a lot of outside Institutional contributors from other companies like Samsung like MoBike, which is one of the largest bike sharing platforms out there as well as Folks like totiao.com, which is one of the largest tech companies in China with a super popular news Aggregator app the whole company is valued around 20 billion dollars right now as well as two public cloud vendors like Tencent cloud and UCloud and The big pain point that we wanted to address to build TIKB is to have a open source Distributed storage layer that can unify a lot of the desperate data that has been stored right now in multiple different kinds of database solutions But have a layer that supports strong consistency that really supports distributed transaction with asset compliance That can be easily scaled horizontally in either direction and of course has a cloud native architecture That was of course a lot of what drew people's interest with the Google Spanner project That is also where we got our original inspiration from for TIKB as well But unfortunately Spanner is an open source and isn't so Accessible and our vision for TIKB is to build a building block for other cool Amazing powerful systems to be built on top of it. So far we built TIDB and Tyspark ourselves Totiao has built their own metadata service on top of their S3 Implementation and the ULMA which I will go into in more detail actually build their own Redis proxy on top of TIKB So now I will do a dive into the technical architecture of TIKB as I mentioned TIKB currently lives within the whole TIDB platform among many a few different other components But the focus of today's presentation will be in this middle red part Where all the TIKB clusters are where all the data is actually stored and persisted and Communicates with the placement driver cluster Here is a layout of the TIKB Architecture so TIKB the component uses GRPC to communicate with the placement driver as well as any clients That can be built on top of it. It exposes two kinds of API one as a raw Key-value API one is a co-processor API that facilitates a push-down computation It uses the RAV consensus protocol to provide data replication and high availability and Underneath each TIKB instance, and you can essentially imagine each instance as one single machine We also have a RocksDB instance where we leverage that community For this as our storage engine for TIKB and Here are some of the technical highlights of TIKB as I mentioned it does scheduling and auto balancing We also have a multi raft implementation because each TIKB node has Several of actually Oftentimes many different raft groups that are replicated across different TIKB nodes So each TIKB node has multiple raft groups that it has to facilitate the communication between Different TIKB nodes. We also have a dynamic range-based partitioning Feature that allows these raft group to be split merged or the leaders can be automatically Transferred in order to remove and resolve hotspots the way we implement asset transaction is through a two-phase commit with optimistic lock and TIKB is written entirely in Rust which is a relatively new systems level language that is getting a lot of traction and adoption and The nice thing about Rust as many of you may know is that it does not have GC stop time or a lot of run-time cost In fact, I think TIKB is one of the largest Rust Improduction project out there aside from of course FireFox Here is one example where SQL can be realized on top of TIKB using TIDB, which is what we built Internally well with the community as well So the way it works with TIDB is that TIDB actually has several layers That we built ourselves with a MySQL compatible layer a parser a cost-based optimizer and a co-processor distributed executor API that talks directly to TIKB nodes and each of these little color blocks are Basically a raft groups that are in the same group and they are evenly distributed across multiple TIKB nodes and replicated for a high availability and The way we map a relational table to a key value pair is Essentially, we have a encoding system that maps the key and the value or actually the the IDs and the indexes of each row of data into key value storage pairs that can be essentially imagined or Visualized as a giant sorted map that are broken down again into multiple smaller chunks that are replicated using a raft and All the keys here are sorted according to their byte array order and we did that intentionally in order to support useful operations like scan and this is a pretty important difference Comparing TIKB to say some of the other other similar projects that you go by for example which I believe uses hash to generate these keys and therefore cannot support things like scan and Sorry about the mix-up with the graphic, but here is a visual representation of how the co-processor works So what essentially happens is that when TIDB receives a SQL query it will go through the parser to break down each of the query into different physical plans and partial and each of the The plan the partial aspect of the plan are actually pushed down into multiple TIKB nodes Simultaneously where all the computation is actually done inside TIKB nodes at the same time to compute partial results for a particular query these partial results are again returned back to TIDB and TIDB does the final reassembling of all the partial results that can be sent back to the client and This is an implementation that we worked on a lot to be able to take advantage of the distributed nature of TIKB and all the computing power that it has Access to in order to speed up more and more queries and in one of our future roadmap plans We actually plan to support more built-in functions that we can push down into TIKB nodes as well Here's another example of how TIKB is being used so far. I alluded to this a little earlier, which is how totiao com uses TIKB They have their own S3 implementation They have a bunch of S3 buckets with a lot of blob storage and they are also using TIKB as their meta data storage Right now for their in production mode And here is the latest benchmark the YCSB benchmark that we did just last month And here is the environment and the hardware that we use to do this benchmark And you can see the insert TPS results as well as the read QPS result here One thing to note is that this is a standard default three TIKB node deployment and You know, of course in a actual in production environment Most of our users deploy way more than three TIKB nodes to store more data to increase their capacity So, you know, this kind of this result will be much better And I think the throughput will be much higher in even in production environment But this is the the benchmark that we did last month for TIKB Oops Here is a quick overview comparison between TIKB and some of the other Popular no-SQL databases out there. Of course every single database Tries to solve different problems in different ways using different technology So not everything can be compared in a completely Apple to Apple sort of a way, but TIKB is original and still the current goal is to first and foremost support this stupid transaction that has strong consistency and that is Sort of the first goal and the first level priority that TIKB looks to support Which is different from some of the other no-SQL databases out there Here is a visual overview of one of the features that I mentioned before which is dynamic splitting and merging As many of you know, RAF groups and RAF regions can get quite big and as a RAF region gets big It could form a lot of hotspots and provide and produce performance issues And one thing that TIKB can do on its own is that if a region say here in region A Gets too big and by big currently we are defaulted to mean 96 megabytes Of course that can be configured depending on your usage But if it gets larger than 96 megabyte we will automatically split that region into two regions and put them in different TIKB nodes and The reverse is true as well if a region is too small and that is currently defined as 10 megabyte then we will look for the closest adjacent region and then merge those two together Into one larger region to you know improve the performance of that region And here is another visual illustration of a core feature which is automatic hotspot removal One of the best use cases for TIKB and TIDB as a whole is if your access mode Doesn't have hotspots or wants to avoid hotspots TIKB is a great solution for that and the way that's being done is if You know several regions where the leader here denoted in blue Is in one particular machine then all the workload is going to all the leaders while the followers are not You know doing a whole lot and if this is starting to form a hot spot Then the system will facilitate an automatic RAF leader transfer where we will do a logical leader transfer Here in region B to move the leader from the first machine to the second machine And there's no actual data movement here It's just a transfer of leader within the RAF consensus protocol Then we will have the workload split onto two different machines and thus the hotspot is removed And to go a little bit over our cloud native integration and progress like I mentioned We've always imagined and built TIKB to be having a cloud native architecture that works closely with Kubernetes To be integrated in all kinds of cloud deployment Scenarios currently TIKB is integrated with Tencent cloud and you cloud and most recently We are also got on JD comms cloud provider or cloud a solution And of course in the future we look to integrate with all the major cloud vendors you know all over the world and As far as cloud native synergy is concerned with other Components currently we have a Docker compose deployment for testing and development on local machine Which will be part of my demo We have a tool called tidy be operators that works closely with Kubernetes to help deploy tidy be in all different public or private cloud scenarios and we will actually soon be open sourcing this tidy be operator tool as Well, we of course use Prometheus and gRPC in our standard deployment we our team is actually one of the largest maintainer of the rust implementation for both Prometheus and gRPC and we also use a lot of Etcd and is a active contributor to Etcd Because we have really been leveraging Etcd since they won when we started building TIKB Because it had a very mature raft implementation and also very rigorous testing regimen that we really leveraged and We didn't fork it completely because we wrote TIKB and rust so we kind of have our own rust implementation of Etcd We are active contributors of the Etcd community We do a lot of bug fixes and we are also leading the charge in Forming features new features like the raft learner a quick overview of TIKB usage Currently, there's about 200 companies Give or take that are using TIKB in production right now. A lot of them are using TIKB in Combination with other components like tidy be anti-spark, but quite a few companies are using TIKB by itself and one of those companies that I want to talk about is Ollama, which like I mentioned is a food delivery platform with 260 million users So it's bigger than a lot of the perhaps more well-known food delivery platforms that we hear here in North America and Europe are combined it was recently acquired by Alibaba for 9.5 billion US dollars and The problem or the pain point that they were facing is they had a lot of data in key value formats And they were using a hodgepodge of different solutions like Mongo, Cassandra and Redis And they were looking for a solution that can really unify all these different data sources into one and They found the TIKB and deployed TIKB as this unifying storage layer Which currently is a serving and affecting about 80% of the entire platform's traffic TIKB is currently holding more than 25 terabytes of data spread across four different data centers for Ollama and What's really interesting is that Ollama built their own Redis a layer on top of TIKB because they wanted to continue using Redis A lot of the application developers love using Redis So that's what they did to make TIKB work for them And if you're interested in digging deeper into how they use TIKB We recently published a use case story written by Ollama's engineers that you can look at via this link All right, so I've done a lot of talking blah blah blah and If we have time I would do a quick demo of how to spin up TIDB cluster on your laptop and the context of this demo is to show you number one how easy it is to deploy TIDB right now I already downloaded or get cloned a TIDB cluster repo on my laptop So I'm deploying it right now using Docker compose and as you can see Prometheus is installed by default and So our three standard TIKB nodes right here and what I will do now is Spin up a mySQL cluster as well as a spark cluster So that you can see how TIKB can be the underneath storage layer to facilitate both components talking to each other and reading from the same data source But before I do that, I want to show you real quick Monitoring mechanisms so each of these Deployment has a Grafana implementation defaulted to port 3000 and if you log in using just admin admin again This is just for testing and development purposes. You can monitor your entire clusters You know metrics and current status if you go into TIDB cluster TIKB You can look at the store size the available size And things like that. So there's a bunch of stuff that you can play with inside the Grafana implementation And one more tool which we built in-house is something called TIDB vision and This is defaulted to port 80 10 and Here you have a cool little data visualization tool That as is a ring and each of the partial ring is basically one TIKB node If you look a little bit deeper in there, you see a bunch of empty blocks These are just empty store spaces the dark green are Raft leaders and the dark gray are raft followers And you can essentially visualize raft as it goes through the entire TIDB or TIKB deployment So this is how that works Now back to terminal the demo What I would do is launch a mysql Instance so in the interest of time, I would just do a lot of copy and pasting of commands So launch mysql and as you can see this is TIDB compatible with mysql and I will also launch a spark instance This will take a little while so I will let this run Let's go back to mysql and I'll show you what is in here. So show this So we have a few databases and we'll actually use this one called TPC H-01 for the demo. It just has a bunch of Sample data in there. So TPC H-01 And Let's see what's in this database. So it just has a bunch of different tables in here One of them is called nation orders things like that. So let's see what is in nation All right, just a list of countries with some random information in here and Right now we have our spark plug-in ready So I am going to input a couple of commands to Launch Thai spark which like I mentioned is a spark plug-in that works directly on top of Thai KV as well so these are the two standard Thai spark commands and Last one we will tie this instance to the same database called TPC H-01 So they should be talking to the same data source and Let's just see if that is the case We'll use SQL again spark SQL select star from nation show 30 We'll have the exact same table of country information as the one that we saw on my SQL site So let's make some edits to this table Since Belgium has such an epic World Cup match yesterday where it advanced to the next round We should probably add Belgium to this list of countries. So let's insert Belgium into this table and If you see that we have Belgium on the bottom right here a new new member of this country list and If we do the same command you will immediately see the change being made and Visible on the Thai spark side as well so you can easily imagine where multiple updates and changes are being made on the my SQL side and the Thai spark side can immediately do queries and analytical processing on the spark side all being supported and stored inside Thai KV All right, so now I'm gonna go back to my slides and Of course the goal of our presentation is that we will love to have CNC if CF accept Thai KV as either an incubation or a sandbox level project and With this acceptance and to be part of CNCF We're looking to build really not just a bigger community But also something that is more vendor neutral that can help us build this project With better governance with better structure and ultimately more contribution to build a very useful and important components That's really is you know beyond the strength of the current community right now. We will love to see more Language support right now. We only have a go client for Thai DB and a Java client for Thai spark One of our community members has already started building it open source Redis proxy He caught it Titus so you can check out his repo here But of course it's still very much a working progress We wanted to support column family structure as well So there's a lot of things that we will love tidy Thai KV to have and with CNCF support. I'm sure we'll be able to accomplish that so again Thank you for your time we'll love for you to be our TOC sponsor and of course reach out to me and Ed anytime if you have any questions And we will actually preparing for the technical proposals right now and we will share that with everyone Hopefully within the next week. So that's about my presentation. I had one quick question Kevin on The PR it has sandbox slash Incubation which one was it going incubation or sandbox. So that's just depends on the sponsor. I guess or yeah What do you feel like is blocking you from one or the other? I guess I mean, I think I'm sort of leaving this up to the TOC to give us what you think will be the best I guess level of entry for the current status of the project You know given the number of adoption that we've seen so far for Thai KV I think it probably would work for incubation But then again, you know, I'm not too familiar with the different kind of criteria and what goes into these considerations So we're being you know open and receptive to your opinions about which level is most appropriate Hey, Kevin. This is Brian suit One question. Have you done a Jepsen run on tidy V or take a V? I just going around it looks like you've done at least some experimentation That doesn't look like Kyle's at the opportunity to do a full run Yes, we've done our own Jepsen test, but we haven't done it with Kyle going through his process specifically And is yeah, you might have already right. Is that something that you that you're looking to do? That's definitely something that we're looking to do and I guess we just haven't quite got around to it It's definitely a process that you know requires some resources from our side as well But we would definitely love to you know go through that process as well You know since our own process probably gets us somewhere along that way But I think having him do it with us is probably you know, we're definitely open to doing that Yeah, I mean I would really encourage you to do that I know it's it's time-consuming and it's expensive both the terms of resources and potentially monetarily But I do think it's really worth doing because it Jepsen has I mean as you know Jepsen has has become the gold standard for actually Did allowing people to understand the true consistency guarantees are of these various projects But this is honestly very impressive and it looks like you've got a lot of production use So I think it's I mean really exciting project on that. I'm actually a bit embarrassed that I had not heard of Our fault, but we're working on fixing that right now Well, and I think like getting a Jepsen run is a good example of something that would get you more visibility in terms of how it's In terms of what it can go to because this is certainly for us and for a lot of people This is a really interesting. I mean, we've got all the same problems that you're seeing and the that the GC pauses are just a Deal breaker for me for any So the and I'm obviously I may be not in this forum but aside very curious with your experiences with Ross we're having a lot of really good experiences with rust and It's looking like a very interesting trajectory. So I'd love to get your take on that as well But I would be happy to help that to help facilitate you however I can in terms of Sponsoring would have you that would be awesome. Thank you so much, Brian And yeah, consider it done when it comes to Jepsen has would definitely put that higher on our radar with you That's great Really impressive presentation. Thank you. Thank you any other questions that we can help you with in a moment So how tightly coupled are? Ty KV and Ty DV So you're proposing to donate just Ty KV. That's correct That's correct It's as far as being tightly couples concern. So Ty DB itself is just a stateless sequel layer Right and KV is the layer where all the data is stored and persisted and we've always designed it that way So the two part can be Separated and then used in different ways. So right now, of course given that Ty KV hasn't been So much on his own the current usage very much is connected to Ty DB and you know Ty spark depending on what the user is for but it can be easily adapted like what the Olima folks are doing with the Redis proxy to be Used as a building block for really whatever you see fit right on top of it. So what you see is a in ecosystem of Kind of domain specific or use case specific storage layers on top of K Uh, KIDV. Yeah, like the the Redis and sequel and potentially others in the future. Absolutely. Yeah Hey Chris, my apologies. I got a drop No worries. Appreciate you Brian. I should make the last question. Can you repeat that please mr. Brian? Yeah, I was asking about the Whether they see usage as Having an ecosystem of Domain specific storage layers or adapters built on top like Redis sequel And so on as opposed to direct use of the KV store by applications I guess maybe we might see both but it looks like Right now it's more layers on top like spark and in sequel and so on Um, well one can debate about whether spark is a layer or an application itself, but uh Okay, I had a question about the the region Uh Breakup as well. Yeah, when splitting a region that then forces transactions to go to A two-phase commit is that all happen? Is that correct? Um in terms of splitting the region So the one I was talking about was uh more for removing Um kind of a large region for the purpose of performance issue So what things I guess would be put in the same in together in the same region? Um In terms of so this that would just be data that's coming in Or kind of encoded from the relational side To kv store and then they're broken up into different region mostly by their size So kind of like in this situation where you can see Um different tables go into the key value pairs and then broken down into different regions And then these regions, I guess if it gets too big could be split up Just for you know performance purposes or hot spot forming are removable Okay Yeah, I'm sorry. Maybe I should I can follow up with you. Um in terms of specifically Are you talking about the transaction kind of getting disrupted by a region split? Uh, I was just trying to understand what some of the um Automation was doing in terms of how regions were structured and what's in the same raft group versus different raft groups Right And what the some of the performance trade-offs were with two phase commit versus the same raft group Gotcha, gotcha. Yeah. I mean in terms of region splitting I think the main consideration is the size of the region But also the amount of traffic that this region assuming that this region is a leader replica For that particular raft group, uh, then it could get split up into different Machines to remove hot spot. That's that would be like one scenario. I think where that will get automatically facilitated Okay, thanks. I have two questions. Yeah One is I think pretty easy, which is could you just clarify for everybody Exactly what the relationship is with that cd in the past present and future Just to sort of be understand and and two is just for Just for q&a really interested in, you know, if people Have issues with uh, take a view. What is the number one thing they complain about? I see, gotcha. So First question first so for etcd, right? Um, so like I mentioned, uh, we Have been leveraging etcd since day one because of this uh raft implementation And also, you know, we really leverage its testing Rigger to use it to test our own ty kv system We actually use etcd embedded in our placement driver Implementation to the placement driver cluster directly, but for ty kv We because we use wrap we use rust to uh, code it We didn't fork etcd completely but kind of made our own rust implementation of etcd In ty kv. So that's kind of the past and the current and for the future We are very involved in the different kind of etcd Kind of road map that's going forward One of the things that I mentioned is the raft learner feature that we are really looking to implement For the next evolution of ty kv Because one of the I guess drawbacks and this actually goes into your second question is because ty kv is you know by nature a key value store it doesn't quite support Complex analytical queries and the speed and the performance that say a h base potentially would or any other column family database would And that is sort of the inherent Structural limitation that ty kv has in that implementation So there is a limit for example to how fast our type spark implementation could really go If it sits on top of what ty kv is now and you can see that as being one of the Not so much complaints per se, but at least Consideration or limitations that people use ty kv for when it comes to analytical processing But with the raft learner feature being more mature and being implemented We can see that as a really good solution to support Faster analytical queries to be able to process on top of ty kv Awesome presentation. Thank you very much. Thank you Yeah, once again, please reach out to us if you have any other follow-ups And we will circulate our proposal very soon I Kevin just a quick question Which percentage of the maintainers are outside of pink cap right now? Is it is just primarily pink cap driven or Do you have maintainers from from other companies? Right now. I think in terms of maintainers is probably mostly from pink cap In terms of contributors You know our own ty kv team isn't any it's probably like less than 15 people And we are like 70 contributors. So okay, cool. Thanks Just just one request if you go ahead and do the incubation route Probably start sounding out potential Interview ease in your production user base because I think the more we hear from them The better it is for streamlining the dd process Got it. We'll do Okay, I actually got a jump Chris. Could you Shepard the rest of the cold please. I'm really sorry. Yeah. No, we're pretty much Closing out. So any other questions for for kevin before he disappears. All right Thanks. Thank you Cool. Thank you everyone So, uh, not too many updates. Um, you know, if just go to slide 37 as a pointer to the working groups 30 it's the project review 39 it's just a reminder that Uh, we have a few events upcoming for this year at least we have shanghai in seattle if you Are interested in submitting a talk to shanghai Um, the cfp closes at the end of this week. I think it's on the 7th. So please get your, um, toxin You have a little bit more time Uh for seattle Other than that slide 40 our next meeting. Um, we'll be hearing from Uh, the falco project from siss dig on july 17th And that's about it any other questions before we Close it chris it closes at midna on the 6th So this is just the the the last big shout out. Please consider submitting a talk Uh, or multiple talks for kibkan shanghai, which is november 14th and 15th This week is your last time to do it. You can write it out as you're looking at the fireworks tomorrow If you're in the u.s. And um, please encourage the folks in your organization to submit as well Thanks Yeah, cool. Yeah, i linked the cfp in the chat any other questions from folks All right Thanks all and we'll see you in a couple weeks Take care You too. Thanks


Indiana which is the from 2005 so almost 20 years ago, but it's we've seen a lot of songs from it and A scene from okay. This is the split personality victory This was we saw this scene four years ago probably yeah in a half So I think that's more towards the probably end of the film But if you would like to see our original act of to that scene the split personality is this the same director as I Yes, yeah, so the same director's eye music is by Harris and it's Vikram And Vikram he has split personality right order, right? I think he he's also a lawyer He has split personality disorder cool, and he is a lawyer That is basically all I know of this film outside of what we've seen in all the songs and they've all been great because they're Harris I'm excited to see more of Vikram. Yeah, we actually have not seen a ton of Vikram Three-hour movie this will be obviously on YouTube cut into probably three or four parts. Yeah, I don't know yet But if it'll be cut have heavily cut up God do that for copyright reasons So if you'd like to see the full uncut versions, you can head over to patreon and see the full uncut versions Let's just get into this Much better than singing happy birthday Why the speed up I said, I think there's gonna be some dated things in this Love speed Like a forwarding message you've ever gotten one of those back in the day. Yeah back in the day They don't do it anymore, but I've gotten I got several of those now. They're Facebook posts that said if you don't share this, right?  You take your suitcase and keep it in your house. He won't get money, he won't get fees. Rolls, let's go. All of you are bullshits. What happened? Someone is hitting me. All right. Be careful. Don't go. Accident case. Let the police come. You have to be careful till then. Why are you here? How much blood has gone? I'm wondering if his split personalities are going to take the vengeance. I hope so. That's what I'm hoping for. Doctor, he's dead. If we take him away, we can save him.  What did you do without taking him away?  He's dead. He's dead. I like the old computer. This is the end of the story. Indiana Jones would not like that. The Punisher. They're going to fight. I've been working for over a hundred years. This is a big mistake. He's dead.  Surprise, sir. You're under my hand. Take him to the office. They're going to take him to the office. They've given him a chance to escape. He's a dangerous man. We have to catch him. What's inside? Nothing. Why are you sitting on a chair? Personal. What's personal? Crime branch is the reason we're here. Get out of here. Get out of here. Let's see what's inside. You did that nowadays. It's been really creepy. Yeah. Did you open your mouth and tell him? It's a mistake if I tell him. It's a mistake if I tell him. It's a mistake if I tell him. It's a mistake if I tell him. Any time you talk about the love interest, there's always the song. I don't have eyes. Just one eye. Cuter thingy. I think Ranveer was supposed to be redoing this with the same director. Remember that? I think that got scrapped with, I think, nobody wanting remakes. Did you redo it? What was that? That's a weird wingman action. I wish I could complain about airline food. How many hours will it take? 1 hour. How many times have you told him to buy a movie in the company? There's one thing to have a compass of justice. He's been a lot of the comedy in this film. What? Sir, the child has gone away. Look, he's not even a water. We're a bandit. We're a bandit. There's a lot of things to worry about. Whatever you do, I must rightfully attack this. Just do as I say. Dude, if you tell him your love interest, I think that he'll get angry and come. That'd be the end of part one reaction. If you'd like to see the full uncut versions, you can have her to Patreon to see the full uncut, full Monty there. And on to part two!


Hello and welcome everybody to the CNCF Tough Maintainers panel today. I am joined by four fantastic Tough Maintainers here today and we're going to go through and introduce them here very shortly. We've got a lot of surface area to cover in this panel you're in for for quite a ride. So let's just go ahead and start with Marina and Marina the rules are when you introduce yourself you've got to hand it off to the next person who's going to introduce themselves. Hi everyone I'm Marina I'm a PhD student at NYU. I've been working on Tough for the past almost four years now doing research and development especially on kind of the academic specification and new features side of the project. And a fun fact about me is that I also like to dance and actually have a dance minor from when I was in college and I'll hand it on to Ustra. All right hi everyone my name is Ustra Ali and I'm a software engineer at Google on the Google open source security team. And I work on supply chain security and I've previously worked on cryptography and privacy preserving technologies.  And I will hand it off to Trishonk. Oh my god it might mean not to mess with you. So I'm Trishonk, I think you'll tell me sorry camera off but kind of midnight here I hope you'll forgive me. Yeah I've been on and off involved with Tough you know the Tough project several years now. I'm a security engineer at Datalog by the way. You see what did you go next? Sure I'm Ustra open source engineer VMware I've got a pretty long career in open source and now lately in supply chain security. I've got two border colleagues here with me and all of us are waiting for spring to finally arrive and helping get to at least the time of recording it's not happened yet. And I am Andrew Krug I'm a the lead security evangelist at Datalog. I work with Trishonk of course and happy to be here and moderating this panel today. So for the folks whose first time it is hearing about Tough I think it would just be great to cover like what what is Tough and like what are the goals of the project what problem does it seek to kind of solve here? Yes I can start with a little bit of background. So Tough started off as a an academic project at the University of Washington where my advisor Justin Capos was working with Justin Samuel and some folks from the tour project to kind of solve this problem of package manager security and they've been done some previous research on attacks on software update systems and so Tough was an attempt to address these attacks and create a compromise resilient software update framework that allows security even in the event that one or more signing keys or even the repository itself is compromised and I'll let let us go into more detail. Yeah so I'll just kind of go a little bit more into detail coming from my side of things so I got introduced to Tough as I started working on the six-door project which is a project under the open SSF that regards like software signing and we were building a service that required a lot of infrastructure components that you needed to trust and Tough was the like way that we started thinking about how do we keep that ecosystem of trust like compromise resilient like Marina mentioned and also like to be able to sort of like think about secure updates in the future so we really started integrating with Tough and adopting some of that framework methodology really from the start because we knew that we would eventually have to deal with things like having a trusted route having to update keys having to update parts of our ecosystem and having a sort of central repository where we were managing with Tough was the way to go. Yeah yeah I guess I guess that pretty much some said that basically signatures alone just they aren't very useful right like nobody is going to have hundreds of artifacts or something where you're going to somehow figure out which signature should be or who should be signing this you need to be able to you know somehow delegate the trust that that you can just check one or two things and then that kind of just flows from there and I think that like everyone who starts looking at this problem kind of ends up at this same-ish solution and you know doesn't have to be Tough but it's going to look quite a lot like it I think. I think one of the interesting things about Tough right is that it's actually a toolbox of tools and also it's a it's a framework on top of that and one of the problems that it seeks to solve is really being really really usable right it's it's not just like crypto for crypto folks one of my favorite quotes from Rob Fuller is you can't spell crypto without cry and I think that we can we can all use that to attribute why we haven't seen teams put more of these controls inside of their CI CD pipelines or or their software release process is that the the tools just really aren't understandable and accessible so does anybody have any thoughts on like how much time this project spends on on UX and usability oh what's the start boy that's that's a good question look so I think I think I think there's one thing that the OpenSSF Foundation has done well especially with Sixthorn right especially with Azra and friends is try to make this technology more accessible to the wall previously you pretty much had to have a PhD okay or close okay as Marina knows so yeah the technology wasn't very usable but look something like tough is actually much more useful not if you're an not if you're an individual contributor but something on the level of programming programming language uh yeah yeah exactly something like a programming language community repository like pipi or npm or you know github and so on and how do I put this initiative just wasn't there before but it's changing now you want to use stuff to to give you guarantees like okay look this is indeed the latest stuff that I'm getting I'm not being mixed and matched this is actually the Kubernetes projects key for example Nasra I can talk a lot more about this you know she been working about this so that's something that's been missing before before how do I put it before some reason uh what's the word for it high profile attacks people didn't really care about signing software right I think we're gonna all agree to this and you know with the Biden administration this has changed obviously but we still don't have good standardized tools and I think tough actually belongs in one of these tools but just wasn't too usable before but we're trying to change that sorry someone else should jump in here yeah I think a lot of the tough implementations were originally they came out of academia right so they were used as prusive concept to show how these things can work in code and I think we've done a lot of work in the past few years to kind of transition those from more kind of academic code bases to things that are a little bit easier to use in industry in practice and I know you see you can talk a lot about the work we've done specifically on Python tough our reference implementation to try and make it a lot more usable and just easy to plug it into new systems yeah yeah that's what we've been working on in Python tough especially but I think the same process is going on and go tough as well where we know we have something that that works for specific use cases but it maybe wasn't engineered with the with the sort of point of view that that maybe is it's good for security solutions but I will also say that well well it is true that this is like we're providing a framework or a set of tools it's I think we're also seeing the limits of that that when we're trying to look at the kind of generic problem that tough solves it's it's not quite easy enough especially for the for the repository case to kind of for someone to just take that and implement but if we talk about ease of use I think it's really useful to notice that what tough does for the client side is pretty magical and the fact that you get well you basically get no user experience because it just works and that is really something and it you know it it does make it worth it to have to work quite a bit more on the on the repository side yeah I don't know if there are a lot of differences in the the different implementations I guess we've all kind of approach this in similar ways so it's maybe some fairly low level libraries that aren't like full solutions and then command line tools no but you see you actually raise a good point which is that tough isn't just this framework this tool that you use but you kind of need to know how to use it right for your own use case that's the problem really I mean it's a strength and a weakness yeah yeah I think we start we've seen that from the six-door side as well where like we really do approach it like a toolbox which means that we do need to have some like context and understanding of how we're using it like you see said like the client side is fairly easy you know it just kind of works out of the box but when you're looking at the repo management side or when you're looking at okay what do I actually want to protect with tough then you start thinking of the context and you know I want to protect an ecosystem of infrastructure like six-door or I want to protect you know developer packages so there's all these different sort of use cases that when you apply to tough you realize that your management and your repo workflows end up different and I think that's part of the challenge that we're seeing when we look at like adoptions and integrations is that you really do have to sort of specify your use of tough within your integration or adoption or ecosystem yeah I think that's one of the challenges right with with creating a tool like this that we want to be flexible enough that it can apply to different languages and different use cases and I know that there's some really unconventional success stories of tough in the wild right like things that we would never think of but on the other side of that curve it's it's always a question of how do we make it flexible enough but also prescriptive enough that it's it's easily applicable yeah speaking of success stories like I would love for like marina to kind of jump in with the uptain story here like that's a really cool story of also seeing the whole feedback cycle of you know getting more taps and more enhancements into tough and having that life cycle complete yeah so uptain is the automotive variant of tough and it has its own name because it kind of uses pieces of tough that has kind of a tough inside of it but it also has a lot of other pieces built on top of that in order to work like directly in the automotive space which has a lot of unique challenges having to do with very small computers in vehicles and also a whole network of computers that only have one internet connection with which to to receive updates and so uptain I think was a really great project for the tough specification because we learned a lot about you know we got taps three and four so we got like a bunch of new features from this work with uptain that are now merged back into the tough specification and are kind of part of that toolbox for other projects if they have similar problems that they they'd like to address there and uptain has been very successful it's been standardized I think under IEEE ISTO and it's been you know we work a lot with the automotive community and we have integrations in various automobiles so that's been a very successful project any other particular questions about that well I think this demonstrates like the flexibility right we have everything from the obvious the the work that has happened on Pi Pi right maybe we want to talk just a little bit about more about that Python work as well after this but then just thinking of this inside of an automobile actually went to a presentation once where somebody was talking about running K3S inside of a car and it was you know this moment where I didn't know if I should be inspired or terrified but knowing that there's something like tough that we could put in that supply chain makes me more inspired than terrified exactly it's so important that we're able to update the software in car in cars especially because they're so safety critical that if there's any kinds of bugs you want to fix those right away and securely so it's kind of it's an exciting project to get to work on so is there something that we could bring back from from uptain or is it like the tweaks that they did is it really specific to that use case where where you want the manufacturer to control everything yeah so I think one of the big differences between uptain and these community repository like Pi Pi implementations is that everything is very much controlled by the automotive OEMs like the car makers they they can they decide per vehicle actually they the vehicle basically asks which updates should I install instead of in the typical software workflow where the computer says I want this package it's a little bit more directed in uptain and it goes very top down I think one of the big pieces from the uptain model that we can take back to tough is kind of improvements to compromise resilience one of the big things that we did for uptain was support multiple repositories so it allows updates I'm actually uptain actually downloads metadata from two different independent repositories and then compares those to each other before actually installing the update and this has to do with ensuring that you can have that kind of customizability with online keys in one repository and also use offline keys for greater security in another but this is a pretty flexible mechanism that can be used for just downloading from different packages from different repositories or just gaining that extra compromised resilience from multiple repository consensus on these different updates. If I could after that Marina I think in the future actually something like uptain is going to be important everywhere not just in the automotive context here's what I mean if you think about it it's uptain what it tries to solve is try to make as secure as possible cloud package dependency resolution right you have this robot sitting in the cloud being able to choose what software you get to install in your Tesla or whatever you like right okay and do it safely it can't just make stuff you know it can't just make up firmer images on its own it can choose firmer images but it's firmer images would basically develop by human beings and I think this is going to be a big problem in what we call community repositories know Marina yeah that makes sense I definitely think there are lessons from uptain that can that are more broadly applicable I think especially to the iot space but even just to yeah to community repositories yeah like jumping in on that whole like multi repository support um that's like exactly kind of what we have been thinking with this the six-door model so um like if you haven't kind of heard the six-door like you know mission statement I suppose it's to to sort of be like the let's encrypt of software signing and make it easier for developers to like create signing keys and uh you know improve their security posture through that um so one thing that we currently have like I mentioned before is like a six-door tough route that you know holds on to our six-door public infrastructure components um but alongside that like we also want to like extend that six-door route to be able to endorse you know your own public um tough routes so let's say you want to go endorse like you know your enterprise's recourse signing key or let's say you want to endorse some signing keys from like you know a large uh OSS project um what you can do is you can start you know creating multiple repositories and have uh like clients be able to say okay I want to pull from six-door route here and I also want to go reference um verification keys or other material in other repositories um so the six-door model of like you know we have a central repository but we also want to sort of distribute um signing capabilities to other people really falls into this whole multi repository situation. Six-door sounds like one of those things that like really really helps people get started right which I think is one of the challenges here but uh before we kind of go on to a variety of challenges with implementation here what I'd like to hear maybe from each of you what do you think is is challenging adoption of these technologies because I've heard it's in cars it's in pi pi why don't I just see this ubiquitously like npm uh for example if it's in pi pi it feels like it should be an npm not to not to pick on npm or anything but uh why do I just not see this everywhere yeah that is a really good question and I think you know speaking about this this software repository it's like npm I probably have um the most experience with uh looking at those problems with tough and I think the core issue was that um we like the the tough community maybe underestimated the the implementation complexity of a repository you know much like Azra has been talking about earlier um like just as an example like the repository only version of the python like pi pi repository which is um like this is a system where we would have tough running on pi pi where just the repository signs things on its own and developers don't have any kind of keys um just that proposal I think turns nine years this year so we've been looking at or people have been looking at this problem for nine years and it's still not running it's not pretty close there is a PR I couldn't stop laughing at that one yeah it's so true yeah yeah you I think you started it um so so obviously we underestimated the complexity of the of the community and you know lately I've been looking at the the real holy grail there which would be the developer signing which would kind of give us the situation where we have this um protected part from the developers that even like a repository uh compromise wouldn't you know that wouldn't compromise users machines which would be quite something so I've been looking at that and what it would mean for those um repositories and it is a far more complex thing so I think we need to rethink our approach here um yeah what you're really saying is that at a at any you know repository scale this really starts with like a threat model for the the workflow of the software itself like we've got to think at like a to b to c before we start to put the technology in yeah exactly like the workflows are going to be specific to the use cases we can't you know we can't go in well we've kind of tried that we've we've told them that this is the tough workflow and expected them to just implement it but that's not how it works um so yeah yeah I think you mentioned earlier it really does it makes the client workflow like once it's implemented the client doesn't even see it right and so the flip side of that is that there's a lot of work that happens on the repository to make that happen and the repository maintainers of these of like PyPI and others they're already very busy people and so it's tricky to figure out how to make this as simple as possible for them while still getting these the security properties of tough that that are really valuable so that's kind of that's what we've been trying to solve yeah and in addition the repositories really really do not want to experiment for good reasons I mean they're serving a hundred million packages per day or something they don't want you know new things to you know try something out they want something that's been proven to work and maybe we haven't quite quite offered that yeah it seems to be like the more complex like your repository management situation is like the exponentially harder the tough situation gets um with like our six-store case it's like it was fairly easy to kind of bootstrap a minimal uh tough roots uh key signing ceremony and really kick off our tough route but the the reason why is really because we have a very minimal tough route we're only fetching it like clients are only fetching a minimal number of targets and we only have really five or six signers involved in the whole process so we're looking at like a really nicely well-scoped area but even then we had in outage maybe like two weeks ago and that that's very stressful because like if your tough you know system goes down then like you know your entire client workflow becomes everything yeah um and so like little problems like that end up happening in repo management things like race conditions started coming up like when you actually pushed your repository do you need to think about race condition so um you know it it's turned out that like trying to expand the tough route in six-store to cover things like you know multi repositories and delegations and things like that that's becoming a a more difficult problem because the repo management side is is fairly complex yeah i think that's a that's a good way to put it a lot of these issues are shared but they just become so much more pressing if you have a hundred thousand people signing things really interesting engineering problems right because i think as a community we can all agree that we need this at the repository level but it's more of a question of how do we get how do we get there and it's it's about risk management to some degree not just security risk management but operational risk management so this will be a great story to tell in a couple of years i'm sure about how we made this map the way that we think about software in these repositories so just just kind of moving right along here um how how do you handle cvs between implementations or or like plug bounty type scenarios in the tough framework yeah this has been a really interesting problem because the tough project is made up of a couple of different components there's a specification and then various implementations in different languages um so far we have um not have any cvs in the specification itself imagine that follows a similar process but we have had cvs in various implementations and most notably we've had a few in the python reference implementation which kind of by the name right it's the reference implementation and so a lot of the other implementations have like been inspired by this first implementation and so even if it's not a specification bug specifically it is a bug that has you know spidered its way through the ecosystem and so we wouldn't want to just really you know release a patch in one project without communicating properly with everybody else and so that's definitely been a a challenging thing to handle and just you know i have this like list of email addresses for like you know i think it's six or seven different open source projects that have to be communicated with before we actually really cvs just to make sure that we're all on the same page and nobody's um code can be exploited in the meantime i think i think usually though is it is it fair to say that the bugs have been fairly specific to implementations and not the framework in general yes that's definitely true um they they they yeah they're implementation specific and usually it's not everyone that's affected but it's a couple implementations that made the same mistake which usually means we should clarify something which we have definitely done but it's not they're not technically specification bugs right so so maybe here's the lesson right which is that look security is hard enough to get it right so i don't want to okay look let me let me just say it don't reinvent off okay you could try to do it you're gonna mess it up because believe me we have okay so yeah yeah i heard i heard a couple of things there that i just want to kind of unpack a little bit i heard disclosure is really hard like in in an open ecosystem like this and of course like patching is really hard in open ecosystem so i would just kind of ask the question to all of you like when you thought about this like the cve process for tough or how you're going to handle issues like this do you take any learnings from anything like the the kubernetes project which which also like kind of has the exact same problem right when they get a critical vulnerability they have to kind of secretly work a patch in before they make the public release and there's all these stakeholders that need to be notified so what was your kind of process there yeah i think it's a pretty standard process based on the idea of we have you know it's still an open source project but we have a temporary little closed section of it that we make to handle these vulnerabilities and invite in maintainers of any projects that you don't need to see it or you know are relevant for the for the disclosure um but obviously like drawing the line there like who needs to see it is always a tricky question so i know marina has done in previous bugs you've done good work on trying to figure out like which projects we really need to get in the same room yeah i think one thing that we've started to also realize is the importance of like cross compatibility and like interoperability like that's one learning i think as we see like more adoptions the really nice upshot of like having people use things is that like you realize you need more robust and hardened like procedures in your underlying libraries and so we've seen like proposals now to like think about interoperability and that's also where a lot of the bugs have been coming from in some of the implementation so especially like from my side six store is like go base so we use a go top implementation um that's on the update frameworks um organization on github and we've realized that there's um interoperability bugs between like rust clients and python clients which is like especially pertinent in a global ecosystem like six store um so we've realized that like yes we kind of need to start investing some effort into making sure that all these implementations are not only like bug free but also like on the same page which would help with uh things like you know CVEs in reference implementations trickling down um so that that's one thing that like I think one learning in the past like year so that we've realized that this really needs to be like a p1 p0 yeah I think um you might be like the first first implementation running into actual problems with this so far possibly everyone's been kind of working on a language specific thing and maybe even thinking that it's not important like this is just an implementations for you know pipey eyes so obviously it's everyone's running the same client that's implemented in python and that's it but you've shown that of course it's not true yeah that's a really good point like a lot of clients are sort of siloed into their own ecosystem so it like really interoperability really maybe hasn't been relevant but like as we've seen like in this you know people wanting to adopt six store tools in a variety of different ecosystems means that six stores tools which means toughs tools have to be interoperable um so it's kind of this trickle down um requirement I think it's very obviously it's go ahead oh I was just going to say I think it's very cool that you're thinking about interoperability at the outset right and I think that that is a great highlight for just how far we've come as an industry that we're not kind of like backing our way into interoperability it's like a design tenant at the outset and and that's very cool and I don't know that we see that a hundred percent of the time yeah it's an especially tough problem just because of uh how many people need to be on the same page with these sorts of things like with um you know like coordinating sub-disclosures it's like trying to get all the projects especially open source projects like in the in the same like you know synced up uh version of things is very difficult um I think we all know that from experience I uh I'll just pause here and just acknowledge that you said it was a tough problem I know I know I was just gonna point it out too like it's brilliant I make this joke all the time in your in your sync meetings yeah so I think the upshots here is that there there really is like a lot of continuous improvement in the project and really kind of incorporating learnings and trying to to engineer ahead of of the problems that you're anticipating which is it's a massive change in the way that we think about and build software you know as a as an industry so what if if if I could add to that um Andrew I think I think the genius behind a project like six-door is to try to make this accessible to everybody previously before this you really needed to um now you can use stuff in a way you don't even really to understand how it works right someone like Kubernetes can come along and use the keys and don't worry about all that stuff behind the scenes right thanks to um all this great work by by asra and brina and uc and friends and so on but before this you really needed to do a lot of the work on your own and that's I think is what's the word for it a bit of a bit of a feeling of the project right we could have done this better yeah I think we're starting to see as well that like um the more adoptions we have the more you know we by force have to improve those those like you know APIs and uh some man-line tools that we're exporting so I think I think one really nice thing is that uh especially the more use cases you have the more you're kind of informed on like what the best and most scalable um solutions are uh and yeah it's it's it's really interesting to sort of see the evolvement of projects even in like the past year um with python top and go tough and rust clients like they're all really improving the more usage we have yeah great so what's uh what's next for the project like what's the the number one thing that you're all focused on right now that's unsolved I don't know if we're all focused on it but I think for me personally it's definitely the the repository side that we've already you know touched on several times that implementing a specific repository is just way too complex there is a like a like a level missing we've got a good good base and in the tough implementation and then we've got the the user project somewhere high above and there is just things missing here in between um that's that's definitely something that where I kind of feel that like in the tough specification the client workflow is quite well defined and it's it's easy to read and kind of grasp what it does and we kind of need good repository workflows for you know in the same way you know described and this is going to happen in this situation um but the problem there is that these different repository types that we've been talking about they they have different workflows it's it's very clear and different needs and I'm sure that's the reason reason why by the specification doesn't really talk about any of that so sorry go ahead yeah yeah just that that's what we need a good solution for or more likely we need multiple different solutions for these different use cases do you know you think yeah oh sorry it's just somewhat similar I um I think what I've been really focusing on is figuring out from these conversations with the doctors and with different implementations um which of these problems are new features that we should be adding to tough and which of these new features should be prioritizing to really help people make this process easier and and um and make that move along and then coming from my side too that repo management is is again the biggest key here um so we're trying to get basically like smaller projects and developers more interested and able to create their own uh tough um repository so again this comes down to how do we give them the tools and like package them the six store away um for them to be able to do some of this um and so like I'm in particular kind of looking at uh ways to leverage github workflows um since most OSS developers are probably familiar with github um and I know Joshua Locke as well has been looking at that sort of thing of how do you do repo management on github workflows um so I think honestly that that's like the the next easy step to do um to get developers like you know more quickly on board with that yeah so so I know I know what my next obsession in life is right it's um look um so I really like this new open ssf project it's called oh I think yeah what it's called exactly something like protecting the you know open source software repositories okay marina and I like to call it um community repositories so my mission in life is to see something like pipi sometimes npm and github ruby gems you name it protect it on the dock invisibly and you don't even know it right and we've had ideas we know how uh securing software repositories okay thanks marina yeah exactly that's why so so that's my mission in life is to try to help this project coming along they're using excellent technologies like poolgear okay so here's what I want to see in the future right okay is developers open source developers using throw away uh poolgear keys which is uh this technology that you have in sickstore um and you use stuff to securely distribute that it is you who's supposed to be using this key right now we don't quite have the technology just yet so we're not living in a world yet where we can download of you know pip install jango for example and get all the dependencies securely we just don't live in that world yet um I would like to get us to a stage you know everyone here in the room of course um get to a world where we use stuff to securely um get your dependencies the latest version of them make sure you've not been mixed in it's a particular attack that I don't really want to go and do right now but also more importantly how do you know that you're the one who's supposed to sign for this project how do I know that you're the jango developer right this is a big problem that the world is not solving right now we can we can we can sign things like you see is saying just because it's a signature why should I trust you so so we are just about out of time uh for today's panel um but I just want to make sure and recap you know tough is a it's a toolbox and a framework right and I put the url for a tough project on screen but I know that uh you all have a little bit more advice on on how folks might get involved with these projects we can throw some of those URLs up on screen as well if you have like just a couple of pieces uh that that you want to recommend for for kind of getting started


It was 7.59 in the afternoon slash evening. Me and my brother were getting ready to watch another SpongeBob episode that Nick was releasing. I believe it was called, SpongeBob in Random Land. Anyway, once it reached 8pm, the episode began. The intro started, which seemed very normal. However, at the part where SpongeBob was supposed to play his nose as a flute, he started to cry, stopping the theme song. We were very confused why SpongeBob was sad. Well, we were about to find out. The title card appeared, but it didn't say SpongeBob in Random Land. Instead, it was Dead Squidward. The words were red and was in front of a dark reddish background. My brother was kinda creeped out. I was just confused. No music played during the title card, which made it more weird. Anyway, after that, the bubbles transitioned to in front of Squidward's house. The background was more grayish than usual. In front of Squidward's house was SpongeBob, and he seemed sad. He was sitting on the ground, and after a few seconds, he said, Why did he have to go away? He? He who? What was SpongeBob talking about? A time card then appeared, saying, Before the incident. Me and my brother were getting more confused. Did this incident involve Squidward? I mean, the title card said Dead Squidward, so it has to make sense. It then showed Squidward inside his house, and the background turned to normal. He said, I'm not gonna go to the Krusty Krab this time. I'm getting sick of that SpongeBob, and don't get me started with Mr. Krabs. He's such a... I bet he never pays his bills. Ouch, Squidward. That is kinda true though. He then said, I'm just gonna sit back, relax, and watch TV. He sits on the couch and watches TV. Classic Squidward. The bubbles then transition to inside the Krusty Krab, and here's what happened. SpongeBob! Glad you made it. Now it's time to work. Wait! Where's Squidward? Huh? I don't know. He's supposed to be here today. Squidward! Squidward! He's definitely not here, Mr. Krabs. Why is Squidward doing this to me? Doesn't he know I need me money? Where are you doing? Bubbles then transition to SpongeBob searching for Squidward. He said, Squidward! Where are you? Come on, buddy. We have to go to work. It then cuts to Squidward watching his TV. He definitely looks like he's enjoying it. He then hears SpongeBob calling for him. Squidward then said, Oh no! SpongeBob is here! I gotta hide! He then ran upstairs. He sighs in relief, saying, See, now he won't be able to see me. And it's a good thing he won't be able to open the door. Unfortunately, SpongeBob was able to open the door. He went on saying, Squidward! Squidward! This is what happened next. Oh no, he's inside. I gotta do something. Uh-huh. Ha ha ha! Get me! So long, SpongeBob! Ah! Ho! Mr. Krabs! You weren't in big trouble, Mr. Squidward! When do you gotta go to the Krusty Krab to make me more money? Oh yeah. Waaaa! Ha ha ha! Freedom! He then crashes onto a lamppost. Squidward then said, Ah! Oh come on! Ho! He then looks up, and the lamppost he crashed into fell down on his face. When it did, the screen cut to black with Squidward yelling. It echoes. Me and my brother were kinda disturbed by that. After that, a time card appears, saying, And now, It cut back to SpongeBob crying in front of Squidward's house with the gray background. After a few seconds it cuts to inside of Squidward's house, and inside was Squidward. We became more disturbed when we saw him. His eyes were all red, cuts were all over his head, and he was more gray than before. My brother was shivering. I was just shocked. After seeing this for a few seconds, it then cuts to the credits, but instead of the usual song it usually played in SpongeBob credits, it was just wind. I immediately turned off the TV. Me and my brother both agreed to pretend we never saw that episode. He's been getting nightmares from that episode for three days. But I still wonder to myself, What was that episode?


Happy New Year everybody. Welcome back to Investor and Tell. I'm Peter Clausi. Today we're talking to my old friend Thomas Smink from Hemostemics, HEM on the Venture Exchange. Hi, Tom. Happy New Year, Peter. Good to see you. Nice to see you again. You were absent for a little while and your absence was noted on a variety of bulletin boards. Welcome back. What happened? Thank you very much. We've been head down busy working on bringing Hemostemics back into commercial form. The main target of Hemostemics is to prevent the loss of limbs. And the treatment of your heart following a heart attack. I know you've got all the technical details. You've been loading up the board and the advisory board with very qualified medical personnel. To the one hand, what's the goal of all of that? Yes. So we added two physicians, Dr. Ciccieri and Dr. Gianetti at McGill University. We added Dr. Von Schwartz at UCLA, Dr. Galleri at the Boltzmann Institute. These are stem cell scientists who have done due diligence on Hemostemics and agree that this is going to be a first to patient approved therapeutic to treat heart disease and to treat critical limb ischemia amongst other diseases of ischemia. They're joining the board and the advisory board is a form of validation for you because Hemostemics passed their due diligence. Exactly right. So let's talk about the market for a bit. 75 million shares trading around, you know, you bounce between like 15 and 20 cents. Yes. Why? Yes. Well, there's a legacy issue there, Peter, which is one that you're well familiar with. We, you know, we did a rescue of this company. And the legacy issue is really the stocks trading on a legacy value. It hasn't really caught the imagination yet of the investing public. And what will make that happen? The I think the the announcements through 2023 are really milestone announcements that, you know, we've alluded to in the appointment of Dr. Gianetti and Ciccieri at McGill in the November announcement where we discussed, you know, they're coming on board to help us with financing introductions with due diligence responses with design of the fourth heart study with reestablishment of production at and so those are significant milestones and reaching any one of those it should be a should have a significant impact. You mentioned production. I find that interesting. Apart from proving up the technology, you want to get into your own production and be your own vertical supply chain. Exactly. So, you know, it's what the the stem cell industry, the reason it's gone to a donor stem cell focus in my view, just to keep it simple, is that you can take a donor cell and you can multiply it a thousand times and thereby theoretically have a product that can be used to treat a thousand people. In team of stemming case, we take your blood, we process your stem cells from your blood and we create a therapeutic that regenerates your heart or saves your limb. And that is viewed as a service business. We've figured out and patented and are working with suppliers to scale that so we can take that to 4,000 or more batches a month. And, you know, the numbers are very significant at $25,000 of treatment, $30,000 of treatment, you know, obviously the numbers get very large, very fast. And so but you have to prove to the world you can do it and we've got the Peter Pavlin has been our lead engineer on this, he's been working on this first in 2008 and now for over a year where we've gone out and looked at the whole industry and benchmarked our technology against the industry and we're very confident that we have a, you know, not only a very interesting technology in terms of ACP, a technology that works, which we think we've proven, but we're able to scale it. So with any forward-looking information, there's a disclosure of risks and interferences that could get in the way of that happening, but your goal is to be in production this year, it sounds like. That's right. We'll be in back in production this year and that for clinical trials and for compassionate care. Lots of news coming. Lots of news coming in 2023.  Well, you know, I'm a shareholder and a cheerleader, so I'll be watching closely. Let's do this again in a couple of months. That sounds like a great plan, Peter. Thank you. Hemostamix, HEM on the Venture Exchange. I'm Peter Clossey for Investor and Tell. Have a great day.