Hi, everyone. Thanks for joining today. So today we are going to talk about the FIR in container, and how we can do the FIR in the container world. So let's start introducing ourselves. I'm Stefano, and I'm a threat research lead manager at CISDIG. As you can see from the picture, I'm from Milano, Italy. Here is Alberto Pelliteri. He's a security researcher at CISDIG. And he comes from Turin, Italy as well. And he works at CISDIG as well. So for who doesn't know CISDIG, CISDIG is a container and cloud security company. CISDIG donated FICO, a runtime security project to the SCNCF back in 2016. And it's now the sandbox runtime security project at the incubation level. And this is in the process to became a graduated process. Talking about FICO, we are both FICO contributors and are also active in FICO community. And I'm also a FICO reviewer for FICO rules. Here is the agenda for today. So we're going to talk about DFIR, especially we are going to see incident response and digital forensic. And then we are going to cover and refer to NIST incident response lifecycle. And then Alberto will go through some DFIR container methodology, techniques, and also tools, specific tools for DFIR in containers with some demos. And then we will wrap up the session with some main takeaways. So let's start. Let's start talking about DFIR. As we know, DFIR puts together two different areas, digital forensics and incident response. As we know, digital forensics focus more on collecting and analyzing data, user activities, and other piece of digital evidence to understand what happened on a machine or who may be behind specific threats or the specific attack or whatever we recorded in our environment. All these activities need to be done following best practice and specific methodology to maintain the chain of custody so that the evidence are legitimate and can be used and presented to the court in case of legal proceedings. Incident responses that are focused on preparing, detecting, containing, and recovering from a data breach or a security incident. In early years and early days, as we know, these two processes were completely different and separated. However, of course, because they have different goals. But tools, processes, methodologies are pretty similar. And now with tools like EDR, XDR that are evolved, of course, they empower the incident responder to do further actions like proceeding with investigation and also performing other actions. So it makes sense now to put them together under the same hat and referring directly to DFIR. And when we talk about DFIR, we use to refer to the NIST incident response lifecycle step. And here are the four main steps that are pretty well known. Of course, today we are not covering all the technical and non-technical aspects from NIST. I leave the link behind in the slide so that you can check out the official NIST documentation if you are interested and you want to know more about it. And of course, today we are going to cover the technical aspect on how we can do DFIR in containers, which are the techniques, the specific techniques that we need to know in order to do that in container worlds. And so this is the time of the presentation where we start saying the best practices. And yeah, sure, you need to follow the best practice and you need to check for misconfiguration, right? So I know it's kind of boring, but we need to do that. So jokes apart, when we talk about incident response plan, it's always important to mention that these need to be prepared in advance. His fundamental attacker aren't going to ask you if you are ready to receive the attack or, I don't know, we are in, so are you aware that we are already in your environment? So we need to be prepared of that. And we need also to keep in mind that most of the or part of the incident response plan are non-technical. So there are some aspects like contacts, people contacts, people that need to be involved, needs to be defined in advance, and people from different teams, they specifically need to know which people they need to contact and exactly what they need to do in specific and which action they need to do. So all these aspects are not, are more processes and is not technically related, but is something that it needs to be set. And of course, if we talk about technical aspect, as we said, there are specific tools that we need to run and the list of the tool required might be set in advance and also all the knowledge about how to use the tool or specific flag that you need to use, they need to be, all the knowledge should be prepared and to be there before the attack. Because of course we can spend time on understanding how this tool work or, oh yeah, I need this tool to do, I don't know, an image, a forensic image of something and we need to understand how the tool works and all these kind of activities. So timing is fundamental and we need to be prepared. And of course, even if you have an incident response plan set, we need to make sure and you need to make sure that this is up to date. I mean, people changing companies, tools change pretty quickly, as we know. So all the list of tools that need to be used should be updated frequently and also the people that need to be involved need to be updated frequently as well. Okay, that's fine, so we covered what we need to say and of course, the FIR is a pretty well-known practice and well-known methodologies and today we are not going to cover the well-known tools that of course are still valid for containers. So we are not saying they're not useful anymore. Of course they are, but they are pretty well-known and we are just one to cover and we're just to focus on specific tools that can be used on containers. So to do the FIR activities in containers. This happens also in other technologies like IoT or ICS, if you think about it. There are specific tools that need to be known and need to be used in order to perform some activities on the FIR. So let's start talking about the FIR in containers. So we all know containers and we are pretty familiar with them and we like a lot. It's super easy to deploy code, it's super easy to ship code that we want in our environment and deploy it. So of course we know all the advantages that container can bring, but of course we also know that there are some challenging that we need to face. And especially for the FIR, we know that containers are dynamic and are ephemeral. So doing activities like the FIR in such a dynamic environment could be pretty challenging and of course we need to respond as quickly as possible because some activities that Alberto will show now needs to be done when the container is live and need to be there. Then we know containers are ephemeral and super quick to destroy and remind me some information. So it's really important to gather this information and then perform all other activities. So I let Alberto deep dive into the FIR and all the techniques and tools to use. Thank you, Stefano, I'm the lower one. So for this presentation, we want also to adopt a practical approach covering the previous steps that we have seen about NIST incident response plan. And to do so, we are going to cover all of those steps outlining the main aspects that may be useful in the containerization words and along with tools, techniques, and so on and so forth. And so for this reason, let's begin from preparation. So preparation is maybe one of the main aspects of incident response methodologies because a good preparation allows you not only prevent the incidents, but by hardening your environment, but also to enforce the right capabilities so that an organization is ready to respond quickly. We can talk about facilities, communications, hardware, software, whatever you want, but we're going to skip all the organizational and traditional steps like set a world room or plan on site codes and so on and so forth. But we're going to focus our attention on open source tools that can help incident response team to detect red flags, facilitate attacks, investigations, and response. So the first tool, I mean, the first kind of tool that I want to stress is container runtime security tool. Falco is maybe the first CNTF runtime security tool that allows you to spot threats at runtime. See whenever there are some kind of threats that are running in your Linux environment, in your containers, and also to spot audit logs and some kind of resources and requests that are made to the Kubernetes API server. So you may want to spot this kind of threats at runtime. You may also want to adopt other kind of open source tools and CNTF graduated projects like Prometheus in order to monitor your resources and see if there are some pick of loads, network changes that may be relevant for your investigations or also some other solutions like logging solutions because one of the main best practices and that you need to enforce during the preparation step is also to log, I mean, as much as you can from your applications. So that you can, I mean, try to have all the kind of information that are needed. And then with tools like Fluentbit and Fluentd, you can try to forward these logs in just them, parse them so that you can have all of them with, for example, Falco Alerts in one single logging management platform like the ArcStack that is another open source project like OpenSearch and so on and so forth. So in order to address the failure in containers in a realistic way, we're going to adopt Kubernetes because I think that most of you are familiar with it and also because this is one of the main orchestration tools used by the open source community. And as I mean, as many of you already know in Kubernetes, we can run the, we can run pods that embeds containers in there and so we can also perform the failure in this kind of container. So let's start from the demo that we have set for this presentation. Here we have in this case, these Kubernetes clusters where we have few nodes, where we have demons that like Falco, Fluentbit and Prometheus in order to monitor our resources, we are going to forward this kind of alerts to the single logging management platform like ArcStack. But as you can imagine, in order to perform the failure in a container we need a workload that can be exploited and later analyzed. So let's teleport to the past and let's imagine that we are in 2021. I know that you're thinking that I'm going to talk about log4j because I'm not, I'm bored about it. So let's talk about another vulnerabilities that was disclosed in 2021 as well that is the Apache HTTP server that was a path traversal vulnerability that under some circumstances allowed also to perform remote command executions. And so in our cluster, we basically exposed our workload, our Apache HTTP server with a Kubernetes log balancers that could be exposed by attackers, that could be exploited by attackers. So let's now where the incident response team had. An incident response team is always monitoring alerts based on fault code detection, I mean alerts like the ones based on fault code detection that we said, to be alerted as soon as possible and to promptly respond to incident. Let's jump into ArcStack. And in this case here, we have some logs that are related to one of our Apache HTTP pod where we can find something related to launch ingress remote file copy tools in container that is kind of suspicious. I don't think that it happens every day that there are cool on that we get executions that are run at runtime in your container. So this is a red flag. If we go ahead, we can also see some other kind of alerts like a shell was spawned by the Apache HTTP process that is kind of suspicious as well. And also attempt to steal sensitive credentials. But focusing on our attention to the launch ingress remote file copy tools in containers, we can see that it was executed a cool W get that tried to reach an endpoint that is related to the IP address that you can see here, one, nine, four and blah, blah, blah, blah. Where you were basically, that was basically used in order to download a malicious payload that we will see later. So let's now go ahead and let's see also the logs that were forwarded by Fluent Petey in our log management platform that are related to the impacted pod. If we see the logs, we can see that for example, there were a bunch of get requests on top of these slide. And then there are also some commands that were not performed successfully. There are also some other kind of, I mean, operations that were not permitted. And at the end, if we go ahead, we can also see a post request that is kind of suspicious because it basically tried to, it exploited DCGI being in order to spawn a shell. Other suggestions, by the way, may also come from Prometheus, as I said before. Because Prometheus allows you to basically, for example, query your pod that you have in the specific namespace, for example. And you can see, for example, from the memory used, that at the beginning, there was this normal amount of memory that was used by those pods in that namespace and at a certain point in time, there was this pick of load. I mean, this is just an example, also because this also means that I'm a bad programmer because I didn't set resource quotes or resource limits in my workload. But there are other kind of indicators like network bytes that may be explanatory for your investigation purpose. So, let's now continue. Okay, yeah, I love the office. Now, this is one of the main interesting part because, I mean, instant response team should always be prepared to such kind of events and should be able to respond as soon as possible to the alert that happened. Also because in your orchestration environments or whenever you have a container that has been impacted, you need to respond as soon as possible because, as Stefano said before, they are ephemeral. And these kind of containers can disappear and you may lose the kind of informations about the attack that happened in your environment. So, let's now go ahead and let's talk about the real response that is engaged by the response team. So, you may want to contain to evaluate your education and also to recover your infrastructure. So, contain basically means isolate the attack because you will want to avoid that the affected pods or container may impact other resources. If you are, for example, in a Kubernetes cluster, the pod that was impacted may have access to service account. Those service account may grant you access to some requests to the Kubernetes API server and so, for example, the attack can generate a mess. And of course, you need also to insert availability and continuity to your resources, to your services that you provide. And you must also assess which resources have been impacted. For example, your containers may cause pod escaping, container escaping, grant to the attackers, direct access to the nodes. And these, of course, can create some other problems. And what is also important for the forensics step is to collection all the evidences about the attack. So, as always, the first and the main step is to always not shut the worker node volume because these grants some forensics analysis that can be done later during the post-mortem phase. But you can also enforce, for example, some other commands like commit and push in order to store the container image that was impacted and also check point the container that we're going to see later. And at the end, of course, last but not least, you should also fix at the end of this step of this containment eradication recovery, fix the entry point that was exploited by attackers. So if it is a misconfiguration or a vulnerability, you need to fix it, otherwise you have to mitigate if, for example, the patch is not available. So before jumping into the crime investigation scene, I will like only to stress that there are some kind of useful tools and techniques that you may want to engage whenever there are breaches in your containers. But I want also to stress that many of these tools continuously evolve because there are some kind of tools that, for example, you could use few years ago in Docker, but this, for example, cannot be used anymore in some kind, I mean, up-to-date Kubernetes cluster due to the Docker sheen being deprecated. So there are, of course, you can interact, as always, with the container engine or with the Kubernetes API server to do some operations that you're going to see in a while, but you may also want to adopt tools like container diff in order to check the differences among two different images, or Docker Explorer and Container Explorer in order to check any kind of differences. I mean, in order to recover the state of our previously snapshot to the worker node volume so that you can see which were the previously running containers. By the way, let's start now from the isolation step. So in this example, as we said, we are in a Kubernetes cluster and we know which is the pod that was impacted and the first kind of thing that we want to do is, for example, to label the pod and then apply some network policy in order to isolate the pod. In this way, if there was an attacker that, for example, exploited a river shell, it will be cut off the pod itself because the network policy doesn't allow any kind of ingress or egress traffic. Later, you may want also to code on the node where the pod was scheduled. So in this way, all the new kind of workloads that will be deployed in your cluster will be scheduled elsewhere, so in other nodes. And doing so, you are now able to start some other forensics processes, like, for example, snapshot the worker node volume or restrict the network access to the worker node itself. You will want to, for example, remove the IP, the external IP that can be used in order to reach that kind of worker node and create an intermediate VM. But all these kind of steps are mainly related to traditional step and our focus is right now to dig deeper into the investigation of the container itself. So let's now assume that we haven't forced some of these steps that I've just mentioned and that I'm going into the machine, into the worker node that was scheduled, that has scheduled the impacted pod. So we are now into the worker node itself and one of the first things that we want to do is, for example, to interact with the container in time. Of course, you must be sure that, for example, there was no pod escaping or container escaping, but we are going to see the eradication, the eradication step later. But one of the main things that you may want to do, for example, without interacting directly with the Kubernetes API server, for example, is to interact directly with the container engine, see which are the logs that we are already seeing with Fluentbit, see which are the running processes. And in this example, you can see at the bottom, the Kinsing malware. You can also see that there is, we used also the CTR snapshot diff that basically allows you to check which are the changes in the file system. So if, for example, the attackers were able to download some files in the file system and if there were some changes in the file system itself, you can spot them from there. And you can see that in this case, we're engaged the TMP path where they downloaded some suspicious file. You can, of course, commit the impacted container so that you can push the image in a remote registry or store it as an archive. This kind of, of course, committed and stored image can also be restored later from a sandboxed machine, from an analyzer machine that is isolated from your code environment. And for example, in some, I mean, some strange other cases, you may also want to use a few more containers that became stable in version 1.25 and that basically allows you to mainly debug the container state or some attacks evidences. They can be useful because they are simply some kind of strange containers that you can attach to an already existing code, accessing directly the same process namespace of the impacted container. And you can see, for example, which are the running processes. Of course, there are some disadvantages because if there are some threats, they can understand that you jumped into this kind of process namespace, container namespace. And so they may be dangerous sometimes, but useful if, for example, you have some distressed image that don't have any kind of shell or tools, utilities. And in a post-mortem analysis, you may also want to, for example, pull or extract the images that you previously committed and pushed in order to download it into an analyzer machine. You can so, in this way, you can see, for example, which were the changes in the file system. Or, and this is one of the best practices, of course, using this snapshot volume of the worker node that you have previously created, you can use that snapshot volume so that you can mount it into an analyzer machine. And from the analyzer machine, you can use tools like container explorer or Docker Explorer if you're using, if you have previously used Docker in order to check which were the previously running containers. And I have here also this kind of video where I'm showing how to use container explorer. It basically allows you to check which were the previously running containers in the previously is not shot to the volume. And from that, you can understand, for example, that there was the Apache impacted container. You can use the mount functionality so that you can mount the previously impacted container into the analyzer machine container. And from the analyzer machine container, you can run all the forensics processes that you want, all the forensics steps that you want. So at the end of all this video, you can see that I was able to successfully mount the previously impacted container file system and then see, for example, the TMP file system that was impacted by the affected container. But, okay, let's go ahead. And another interesting functionality that works mostly in Podman, but not in all the other container engine is container checkpoint. Container checkpoint allows you to freeze the container state. So this also means container processes, container executions. So the file descriptors open by the processes themselves. Also the TCP connections, for example, stored them into an archive. And then you can later restore the container execution in a separated environment. So this is quite useful if you want to understand also from time, which kind of execution were previously launched into the container that was impacted. By the way, this kind of feature, as I said, works mostly in Podman, but there are container engine that are trying to integrate it as well. I think that there is also the Kubernetes checkpoint feature that is a beta, a beta feature right now and allows you to checkpoint a container calling the kubelet request. It's still a work in progress, by the way. So at the end of this containment collection phases, of course you can do all the forensics processes that you want, but it is also important to understand if the attack spread elsewhere. So containers, as you know, maybe run with privileged permissions, with sensitive mounts, and so this may allow attackers to escape from the container, from the pod to the host. You should always take care about the security settings, the security context that you create in your workloads. Here I posted, for example, two kinds of security context and their analysis that was done by Cubescore, that is another open source project. Of course, if you are talking about pods, by default, are bound to a service account token, but I mean, most of the times, these service accounts token are pretty generic and doesn't allow you to do that much, but if you create custom service account, you can communicate with the Kubernetes API server, create some new, make some requests to the Kubernetes API server, create new resources, and technically also do some lateral movement to the Kubernetes cluster. And of course, if you're talking about, for example, Kubernetes clusters, I mean, most of the time, whenever we create a Kubernetes cluster, its worker nodes are bound to IAM roles that have some privileges. And if you modify those privileges, assigning a restricted access to some cloud resources, these may grant attackers to attack your cloud resources as well. And yeah, of course, the recovery, that I think it is one of the most implicit kind of thing to do at the end of an incident. So you have, of course, to fix the vulnerability if possible, sometimes it is not always possible and you want to enforce some mitigation, like for example, work load, like for example, delete the workload, if of course it's possible, according to the services that you are providing or the workload that you have, or also restore the container, hand up that the attack doesn't happen again in the future, or enforce some playbook of actions whenever there is a kind of rule that is detected by, for example, FALCO, you can enforce some specific playbook of action in order to say, hey, whenever there is this kind of rule that is triggered, kill my container. So in order to wrap up this session, I'm now leaving the floor to Stefan again. So thanks, Alberto, for all the information shared. And of course, the last step that required in the incident response plan is post-incident activities. So we took all the action needed to contain and eradicate the threat and we restored and recovered the environment. And this is now back to normal and it's all working great. So that's fine. And it's now time to do some retrospective to get lesson learned from the incident. There are some things that probably worked, other stuff that probably didn't work. So it's important to understand why they didn't work and what didn't work, and perhaps understanding how we can do better. So the output of this phase is literally a kind of checklist of points and a list point of what we need to improve. And this is basically the input for the update of the incident response that we have. So based on the feedback, based on what we discover during the incident, we can update our incident response plan, make it better and be sure to avoid the same incident in the future. So of course what happened, we can do much, but we should take these as a good opportunity to do a better work in the future. So just to wrap up what we said and just get some main takeaways from this talk. So as I said, don't be caught unprepared. Prepare your incident plan as soon as possible. As we said, this is fundamental. You need to be prepared if something happened. Of course, we need to respond as soon as possible. As we said, container are ephemeral. Container may not be there. Some activities needs to be done when the container is still alive. So be prepared and act as soon as possible. The other point, as Alberto said, container aren't isolated by default, right, as we know. So there might happen like container escaping and the attacks move to the host or to the node or in other part of your infrastructure. So don't just focus on the container that was exploited during your investigation, but go farther and there might be more to investigate. So be prepared of not just looking at the container, but also check all the rest of the infrastructure. See the lateral movement if there was something and be prepared to go farther in the investigation. And also it's important to have fully monitoring your infrastructure. So be sure to have all the visibility that you need in order to perform all the activities that we saw before. As we said, there are, and as we have seen, there are specific tools that we need to use and we need to know how they works and which tool we need to use. As we said, there are a bunch of different tools, but we need to stay update and we need to know how to use them before the incident happens. Also it's actually important is actually the best practice to simulate breaches to see the response of the plan, of the people that are involved to see if it's working or if you need to involve different people perhaps or update contacts or whatever. So check your plans. It's not enough just create the plan and say, okay, we have done it. We need to check it, see if it's working. If not, update it and make sure that this is working great as you expected and then be ready for the real incident. And last but not least, as we have seen in order to do this kind of activities or especially in the FIR for containers but same for other technologies, we need people that knows and have background on Kubernetes containers but also instant response knowledge. Sometimes of course we don't have the knowledge inside our organization or inside our team. So it's important to hire or engage someone else that has this kind of knowledge and can be and can do all these activities in a good way. As we said, also in digital forensic, we need to maintain the chain of custody. So it's important to do some specific activities in following best practice in good way so that we can use this data in court or wherever it was. So it's not, we need to have this knowledge and we need to do the old activity in a proper way. So I guess that's it from us. Thanks for joining. And I think we are actually run out of time but if you have any question we are here, we can answer offline if you have any question. Thank you very much.


Live from San Francisco, it's theCUBE. Covering Google Cloud Next 2018. Brought to you by Google Cloud and its ecosystem partners. Welcome back everyone. This is theCUBE live coverage of Google Cloud Next 18 in San Francisco. I'm John Furrier, Jeff Frick. We're at day three of three days of wall-to-wall coverage. Go to siliconangle.com and the cube.net to check out the on-demand videos and the cloud series special journalism report that we have out there. Tons of articles, tons of coverage of Google Next with the news analysis and opinion, of course, SiliconANGLE. Our next guest is Ingrid Hill, Chuck Roborty, Product Manager for IoT, Google Cloud. Certainly IoT, part of the network part of the cloud. One of the hottest areas in cloud is IoT. We've been seeing that. Welcome to theCUBE. Thank you. Thanks for joining us. IoT is certainly the intersection of a lot of things. Cloud, data center, AI, soon-to-be, cryptocurrency and blockchain coming down, not for you guys, but in general, those are the big hottest areas. IoT is not like, you can't say it's an IoT category. So IoT has to kind of sit in the intersection of a lot of different markets that are kind of pure playing. So I first want you to explain to the folks out there watching what is the Google IoT philosophy? What is the product's trying to do? And what are you guys announcing here? Absolutely. Thanks for having me here. It's really great to be here. And if you think about IoT and if you think about what we have on Google Cloud, we already have a great set of service for data storage, processing and machine intelligence. So we have cloud machine learning engine. We have announced AutoML. So most of those data processing and intelligent services is already there. What we announced last year was Cloud IoT Core, which is our fully managed service for customers and partners who easily and securely connect their IoT devices to Google Cloud so they can start transmitting data and then ingest and store and use our downstream services for analysis and machine intelligence. I mean, IoT is a great use case of cloud because one, cloud shows that you can be incented to collect data. Because now you have lower cost storage and you have machine learning, all these things that are going on, it's great. But IoT is now the edge of the network. You've got sensors, you've got cars like Teslas where people can relate to. And so everything's coming online that has not just an IP connection, anything that's a sensor, the IoT's been just evolving. What is the edge to you guys? What does that mean when I say IoT edge? What is Google view of the edge? Yeah, absolutely, it's a great question. And we identified early on the emergent trend of moving compute and intelligence to the edge and close to the device itself. So this week, as you already know, we've announced two products for Edge. One is Cloud IoT Edge, which is a software stack which can run on your gateway device, cameras or any connected device that has some compute capabilities, which extends that powerful AI and machine learning capabilities of Google Cloud to your Edge device. And we also announced Edge TPU, which is a Google designed, high performing chip for to run machine learning inference on the Edge device itself. And so with the combination of Cloud IoT Edge as a software stack and with our Edge TPU, we think we have an integrated machine learning solution for on Google Cloud Cloud. How does that get rolled out? So the chip, I'm assuming you're doing OEM or deals with manufacturers and same with the software stack as a software stack portable. Explain how you roll those out. Yeah, you know, we are big into working with our ecosystem and we really want to build a robust partner ecosystem. So we're working with semiconductor companies such as NXP and ARM, who will build a system on module using our Google Edge TPU, which can then by used by gateway device makers. So we have partnership with Harding, Nokia, Nexcom who can take those some, add it to their gateway device makers, gateway devices to take it to the market. We're also working with a lot of computing companies such as Adelang, Acton and a couple of others, Olia, so they can build analytic solution using our Cloud IoT Edge software and Edge TPU to combine with the rest of Cloud IoT platform. So we're pretty excited about the problem. But every coin has two sides, right? So the kind of the knock on the edge is now your attack surface on the security side is growing exponentially. So clearly security is an important part of what you guys do. And now this is kind of a different challenge when you're now, your points of presence, not like hard points of presence, but are going to expand exponentially to all these connected autonomous devices. That's a great point. And we take security very seriously. In fact, last year when we announced Cloud IoT Decor, we only reject connection, any connection that doesn't use TLS, number one. And number two, we individually authenticate each and every device using an asymmetric key pair. And in addition to that, we've also announced partnership with Microchip. So Microchip has built this 8BU microcontroller crypto which can have the private key inside the crypto and we use JotToken that can be signed by inside the chip itself. So your private key never lives a chip at all. And so that's one additional reinforcement for security. So we have end to end security. We make sure that your devices are connecting over TLS, but we also have hardware root of trust on the Edge device as well. The token model is interesting. Talk about blockchain, because you know, David Floyer and our analyst team, he and I are constantly riffing on that. IoT actually is an interesting use case for blockchain and potentially token economics. How do you guys view that? I know that's, you just mentioned that this is kind of a thing there. Does it fit in your vision at all? What's your position on how that would work out? You know, we're closely looking at the blockchain technology. As of today, we don't have anything specific to announce in terms of a product perspective. We do use JSON WebToken, which is standard on the web, to use to sign those, using our private keys. So that works beautifully. We're closely monitoring and looking at it. We don't have anything to announce today. Not yet, but I'm going to ensure that the researchers are working on it. Interesting scenario. Okay, so in general, benefits to customers when we're working with IoT, your team, because you have the core, you have the chip, you have the software stack. And there's always an architectural discussion, depending upon the environment. Do you move compute to the data? Do you move the data to the cloud? What's the role of data in all this? Because certainly you've got the processing power. Wow, what's the architectural framework and benefits the customers of working with Google? Yeah, so let's take a specific example. You know, LG CNS, they want to improve their productivity in the factory. And what they've done is they've built a machine learning model to detect defects on their assembly line using cloud machine learning engine. So they've used this one engineer a couple of weeks and they could train the model on cloud. Now, with cloud IoT Edge and the HTPU, they can run that trained model locally on the camera itself so they can do real-time defect analysis at a pretty fast moving assembly line, right? So that's the model which we're working on, where you use cloud for high compute for training, but you use the HTPU and cloud IoT Edge for local inference for real-time detection as well. How do you guys look at the IoT market? Because I mean, depending on how you're looking at, you can look at smart cities, you can look at self-driving cars. There's a huge aperture of different use cases. It could be humans with devices. Obviously, you guys have Android. So I mean, it's kind of a broad scope. You guys got to kind of have that core tech which sounds like you're kind of putting in the center of all this. How do you guys look at that? How do you guys organize around that? Diane Greene mentioned verticals, for instance. Is there different verticals? How do you guys go out that market with a product? Yeah, IoT is a nation market and what we offer as Google Cloud is a horizontal platform. What we call it is a cloud IoT platform, which has got cloud IoT core on the cloud side, cloud Edge, the HTPU. And we really want to work with our partners, our solution integrators and ISVs to help build those vertical applications. And so we're working with partners on the healthcare side, manufacturing. We have Odeon Technologies, one of the partners, to really build those vertical applications. You guys are not going to be dogmatic. Here's how our IoT is going to be led by the Thousand Flowers Bloom kind of philosophy. Put it out there, connect, and then let the innovation happen with the ecosystem. Yeah, we really believe in sort of driving, moving the, having robust ecosystem. So we want to provide a horizontal platform which really makes it easy for partners and customers to build vertical solutions. Another kind of unique IoT challenges, which you didn't have in the past, we've all seen great pictures of the inside of Google data centers. They're beautiful and tight and lots of pretty pictures. Very different than out in a mind field or a lot of these kind of challenging IoT environments where power could be a challenge, the weather could be a challenge, connectivity to the internet can be a challenge. Obviously, and then you need the power when you talk about how much store do you have locally, how much compute do you have locally. So as you look at that landscape, how has that kind of shaped your guys' views? What are some of the unique challenges that you guys have faced and how are you overcoming some of those? Yeah, that's a great question. And this is one of the primary reason why we announced CloudID Edge, which is a software stack and the HGPU, so that for use cases where you have limited connectivity, oil wells or farm fields, windmills, connectivity is limited and you cannot rely on your connectivity for reliable operations. But you can use CloudID Edge with our partner device ecosystem to run some of the compute locally. You can store data locally, you can analyze locally and then push some of the incremental data to the cloud to further update your model in the cloud. And so that's how we were thinking about this, that we have to have some compute locally for the way things are going. Release the hard coupling, if you will. So it's really got to be a dynamic coupling based on the situation, based on the timing, maybe have scheduled updates and these types of things. So it's not just connected. Exactly, it doesn't need to be continuously connected. I mean, as long as there's enough connectivity to download some of the updated model, to download the latest firmware and the software, you can run local compute and local machine learning inference on the Edge itself. That's the model we're looking at. So you can train in cloud, push down the updates to the Edge device, and you can run local compute and intelligence on the device itself. A lot of consciousness we've been having lately has been about how do you manage the Edge, been an area of discussion, why I want to have a multi-threaded computer basically on a device that could be attacked with malware. So putting bounds around certain things, you need the IPK, you want to have as much compute. Obviously, we'd agree, but there's going to be policies you're starting to think about. This is where I think it gets interesting when you look at what's going on at the abstractions up the stack that you guys are doing. How does that kind of thinking impact some rollouts of IoT? Because I'm also going to imagine that you want to have policies. Some might trickle data back, it might not be data intensive, some might want more security, containers, all this kind of tying in. Is that right, am I getting that right? How do you see that happening? Yeah, so when you think about Edge, there are different layers, there are different tiers. They are the gateway class devices which has high compute and all the way to really sensors. Our focus really is on the Edge devices which has some decent compute capabilities and you can scale up to high end devices as well. And when you think about policies, on the cloud side we have IM policies. So you can define roles and you can define policies based on which you can decide which devices should get what software or which users should get access to particular data types as well. So we have the infrastructure already and we're leveraging that for the IoT platform. And automate a lot of those kind of activities as well. Exactly. All right, so I got to ask you about the show. What's some of the cool things you're seeing for the folks that couldn't make it that are watching this video live and on demand? What's happening here at Google? What's the phenomenon on Google Cloud? What are some of the hot stories? What's the vibe? What are the cool things that, cool things you're seeing? Absolutely, so I'm biased. I'm going to start with IoT. We have an IoT showcase where we are, we have a pedestal where we're showing the HTPU and the HTPU board as well. And there is a lot of work which is happening there. There are predictive maintenance demo as well. So I would highly encourage attendees to go and check it out. What are people saying about that, the demos and the sessions? What are some of the feedback? Share some color commentary around reaction. Yeah, we've been getting a lot of positive reaction. In fact, we just had a couple of breakout sessions and a lot of interest from partners across the board to engage with us. So we're pretty excited with our announcement on the edge side. And the whole orchestration of training model in the cloud and the pushing it out and then setting up is, that's what really sort of makes it easy for a lot of the partners. So they're excited about it as well. They're going to make some good money with it too. You guys are making the market, making it, not trying to go too far and play the foundational work, the horizontal scale. Yeah, exactly. And we really focus for the HTPU really focused on performance per dollar and performance per watt. And so that has been, which we're striving to really have high performance for lower cost. That's what we're targeting. In a couple of other things you, the whole serverless capabilities and the fact that cloud functions have become GA is pretty exciting.  In a machine, the AI and auto ML, which we announced with NLP and text and speech is pretty exciting as well. And that works very well with some of our IoT use cases as well. So I think those are a couple of announcements which I'm pretty excited about. I think the automation theme too is really resonates well and all that. Because what comes out of that is, humans still got to be more proficient in doing the new stuff, but also they got to run this, right?  So you got the value development with the applications. And then also the operational side, which is like kind of, I won't say becoming generic, but you know, it's not specialized. This used to be network operator. This guy does this, this gal does that. I mean, it used to be very stove piped. Now it's much more of a, how do you run the environment? Exactly. And to your point, even on the IoT space, it's also very relevant, right? I mean, there are a lot of overlaps between what used to be just DevOps and OT and IT. There are a lot of overlaps there. And so we're looking at it closely as well to make sure that we can really simplify and the overall requirement and the tooling which is needed for building an IoT solution. For the people that are not following Google as closely as say we are, for instance, that aren't inside the ropes, inside the baseball, if you will, in the industry, let's see Google Cloud. They know Google as Gmail, search, et cetera. They look at a couple of years ago, Google Cloud, had App Engine, the OG of Google Cloud, it's been called. What would you say to the folks now that are watching? What's different about Google Cloud now? And what should they know about Google Cloud that they may not know about? What would you say to that person? Absolutely. And the first thing is, we are very serious about enterprise. You can see here the number of attendees who have come here and the how we have multiple buildings where we organize the conference. So very serious about enterprise. Second, I think in back in the days, two years or three years back, we were really focused on building products which works for specific use cases. We didn't think about sort of end-to-end solution. But now the focus has changed and we're really thinking about, we always had the technology, we packaged it into products and now we're thinking about providing end-to-end solution, the framework where for a business user, an enterprise user, they can just take the solution and they know it will work. So there's been a lot of focus on that. And you know, our key differentiator is about machine intelligence and AI, right? I mean, that's where Google thrives. We've been spending a lot of time on it and now we are focused on democratizing AI, not just on the cloud, but also on the edge with the announcement of HTPU. And I really think you guys done a good job with the mindset of making it consumable. In an end-to-end framework with the option, we've got Kubernetes and Container's been around for a while, but to work on multiple environments, I think that is a real mindset shift. Exactly. So congratulations. Thank you. Thanks for coming on. Appreciate it. It was great having you back. Google IoT, just plug in the Google Cloud, it'll suck all your data in, give you some compute at the edge, open it up to partners, really focusing on the ecosystem and enabling new types of functionalites to keep bringing you the data. Here on day three at Google Cloud, next 18, we'll be right back with more coverage. Stay with us after this short break.


It is human beings that both create the problem and are the problem. Their pursuit of power and territory will reach out for any weapon at their disposal. There is a desensitization of what it actually means to have a war, to have a battle. When I talk to my colleagues who build quadcopter control systems for a living, they say, you know, if we had a Manhattan-style project within 18 months to two years, we could deploy these in the tens of millions. I believe there's some way to go before anyone would believe we have a fully automated weapon carrier that we could deploy with confidence of no technical risk and reduced moral concern. The conduct of war might be relegated to a machine. It really started with the drones. The drones were used initially only for surveillance. If you have the man through the umbilical cord linked to the machine, then the man is still bound by the conventions of war. There is no anonymity when a person presses the button. We simply cannot build a robot or an AI system that has moral agency. There's an ethical red line going from humans being ultimately responsible for pulling the trigger and robots. Good ideas are not the preserve of good people. If something doesn't happen within the next two years in terms of essentially drawing all the main parties into a serious negotiation, it may be too late.


Alrighty guys, so in this video, this is actually a training that I did last week for my accelerator students And I was answering the question of how has my agency in my business been impacted by the corona virus? And what are some things that I'm doing to adapt and change to the current situation and the current craziness that's going on Okay, so I broke it down into a few different sections here I talked about the mindset the way that you should look or at least the way that I'm looking at this entire situation Some industries and niches that are still moving and shaking They're still working even during this all the craziness that's going on right now What to do or at least what I'm doing currently and things that you can do during this this downtime And what to say if you are talking if you're still going out and reaching out to prospects or you have existing clients We're scared about this I'm gonna give you some ideas on what to say and then also I'm gonna talk about how we've personally been Affected in our agency and some things that we're doing to adapt and change to what's going on So first off let's talk about the mindset right so I'm not like a really fluffy guy I'm not really like that the mindset guru or anything like that But I want to tell you how I'm looking at the situation and how I can keep a positive Mindset and a positive like outlook on life even with everything that's going on right now So the mindset is I look at this as something that's temporary as a huge as the human race Runs into obstacles and problems We always figure out ways to get over it right and if we if we don't we're basically all gonna die and we're all aft right? But I like to stay optimistic I think that we're going to get over this situation this global pandemic will probably develop some kind of vaccine or whatever I'm not a doctor, but I look at this as temporary. It's just some downtime It's just some some craziness going on right now and we're gonna get over it And I look at this as a time of massive Opportunity because more people are online now than ever before and I think I can't remember if it was it was Vodafone or some company that that that serves or sells internet services They said they saw a 30% increase in internet traffic during this entire like quarantine time So that's that's that's crazy right that a 30% increase in internet traffic That is a massive increase and if you have an online business There has never been a bigger opportunity for you right now, right? So you want to think about this everybody is at home.  I can't go to bars I can't go to events. I can't do anything right now and because of that. I'm bored out of my mind I'm looking for things to spend money on And this is the same thing that's going on with people all over the world right now They're stuck at home and if you have a good product or service It doesn't matter what kind of business you run like an agency and e-commerce store and Amazon FBA business Whatever it is if you have a good product or service that actually helps people They are going to be online purchasing it more now than ever before because they have nothing better to do So look at it as a massive opportunity, especially if you own an online business now I get this question every single day Should you put your business on hold and the answer is that depends? Do you have a service or a product that actually helps people at a core level? The answer is yes Then now is the most critical time in recent history to be connecting your product or service with Individuals or business owners or companies who need your help or your product or your service if the answer is no Then now is the time to develop the skills and offer a service or a product that actually helps people at a core level So what do I mean by this? If you have a crappy product or service You are going to struggle in the next few months and for the foreseeable future, right? You're going to be pushed out of the market because businesses are only going businesses and individuals are going to spend their money on Stuff that they need to survive, right? If you can help them with with revenue and sales and leads and growth These are things that directly impact the bottom line and help these businesses stay in business It helps them to survive, right? So if you're offering a product or service that helps these individuals and businesses survive in tough times like this Then you will always be in demand if you don't if you have some kind of crappy product or service That doesn't actually help people that they don't actually need then you are going to struggle Okay, so that's just the harsh reality And you know what kind of services that I like anything directly tied and directly impacting the bottom line That's my recommendation to you if you're asking what you should focus on developing right now So that's the whole mindset piece Industries and niches that are still moving these are industries and niches that are still in business and working even during this downtime So grocery stores, this is obvious, right the toilet paper craze These guys are still in business grocery stills are still operating at least right now at the filming of this video My fiance works in a grocery store type place in the pharmacy department She's a pharmacist and she still goes into work every day, okay? So food restaurants delivery services these guys are still working, right? I just ordered food from down the street and my look at a local restaurant and bar and they still deliver food So they need help with marketing services and getting people Getting eyeballs on their restaurant to have people come in and order food So they are still in business even though people can't dine in at these restaurants right now Financial services accounting its tax season right now and the stock market is all over the place It's volatile right now, right? It's going crazy. So these guys are Definitely working they're in business and they're busier now more than ever. So yeah, they need they still need services They're still moving and shaking and you can reach out to these people and see if you can help them Banks I just went and deposited it a check last week. So these banks are still open They're still serving their customers. You can reach out to them lawyers. These guys are still working as well Online companies. So this is obvious. I just talked about it But entrepreneurs and personal brands info product companies education e-learning companies e-commerce and physical product companies Software as a service and technology companies any kind of agencies right web web design agency graphic design agency media agency Marketing advertising any kind of online agencies or internet businesses. These guys are still working at business as usual Right, you can reach out to them and see if you can offer them a service that can help them during these times tons of B2B industries that are still moving and shaking and I know that this is just a short list I came up with like two to three minutes or so and there's there's a ton more that are still working and still moving along and Even if all these local businesses that are getting put on pause right now. They're getting shut down Yes, I'm not denying that it's a tough time for a lot of different businesses But what I want you to look look at this as when these other industries are going down these local businesses that are going down and They are having a tough time right now There's still industries out there and still niches out there that are seeing more business than ever and they need your help more than ever So I want you to look instead of like complaining Maybe you are working with like some kind of local business in your niche or your industry and they are putting everything on pause right now I want you to look at the opportunity with other industries, right? Which leads me to the next page here on what to do So what should you do if you're like if you have clients in a local in a local niche or a local industry? And they're putting their stuff on pause well You are an entrepreneur if you're watching this video at least I hope so and as an entrepreneur It's time to put your creative hat on so you always need to be thinking of new ways that you can help out the market So what I want you to do is don't I talk about this all the time right niches and niching down But don't worry about niches at this time during all of this craziness that's going on reach out to everyone that you know You can help okay, so this is what we're doing right now We mainly work with technology companies and SaaS companies and agencies agency any kind of agency, right? But we are reaching out to companies that are in financial services right now and people that are lawyers people that are accountants We're reaching out to everyone that we know we can help with our service Now another thing you can do is reach out to your warm network See if anyone that you already know and this is like the easiest place to get clients I'm surprised not more people do this because it's so obvious But reach out to your warm network and just tap shoulders and say hey Do you know anyone who needs this kind of service during the coronavirus time? Like I know it's very uncertain right now and there's a lot of business getting hit hard do you know anyone that needs x y and z service and you'd be surprised at How many people you can get as clients by just reaching out to your warm network and people you already know Okay, so that's it. This is an obvious one I haven't mentioned it before because I thought people were already doing this But I see so many people just going straight for cold traffic before they even went and reached out to their warm network So reach out to people you know see if they know anyone or if they personally need your services and your help And then offer them a discount right offer discounts on your service to help these businesses get ahead of the curve and Help them when things go back to normal be in a place where they're ready to go Okay, so you can offer your services a discount for the first month or two and get people on board so that when things go Back to normal you guys are ready to go both you and your client and you can operate business as usual, right? Another thing you can do is research other services You can offer that your existing clients or the market might need and I'm going to show you an example What we did in the last week and a half or so that we've already secured two clients for on a high ticket service So research other services that you can offer during this time whether it's your existing clients or a new client Research other services that you can offer to the market and your existing clients to help them get to wherever they're trying to go I'm going to show you an example of what we're doing Also very important spend this time sharpening your sword learning and honing new skills So I am spending three four five hours a day reading books Watching I'm in like a few different coaching programs and masterminds watching some material that I didn't watch yet Learning and honing new skills if you didn't watch my previous video on like the seven skills that can make you 10k a month or more Those are some of the skills that I'm focused on honing this year and especially during this downtime So spend this time sharpening your sword, right? Don't spend it watching TV and watching Netflix and watching social media spend this time Investing learning and honing new skills that move you and your business forward and then lastly Be a creator instead of a consumer and I know this is this is easier said than done But create content create social selling posts, right? Put content on on Instagram and LinkedIn and Facebook that get clients to come to you and be interested about what about what you offer Right and also what we've done is we create an email list with daily updates So these are different ideas of how to be a creator rather than a consumer someone who just watches YouTube videos and watches Netflix all day long Okay, be a creator instead of a consumer Now here's what you can say So let's just say you are still reaching out to the market What you should be if you're reaching out to potential potential prospects or maybe existing clients as well who were thinking about pausing What do you say to them? Well first off Be empathetic right understand where they're coming from because a lot of businesses are getting hit hard Some businesses are closing down and others they have no idea what the future holds, right? They're on pause for a god knows how long and Las Vegas is shut down right now I can't even fathom how much money they're losing every single day, but these businesses have no idea when they'll be able to open up again So be empathetic. This is their livelihood at stake, right? So something you can say is hey, Mr. Business owner due to the state of things most businesses have stopped marketing or advertising and aren't getting new customers at the moment We want to help you get ahead of things and we know you're concerned about the coronavirus right now So as a sign of goodwill, we're offering 50 60 75% off our normal service for the first month to make sure that we can help you get ahead Of the curve for when things go back to normal. Okay, so you're showing them. Hey, I understand where you're coming from I understand your situation I want to help you out and I want to help you get in a position where when things do go back to normal You are ahead of everybody else, right? So you're going to the market you're offering something of value, but you're also telling them Hey, I know what kind of rough situation that you're in right now We're getting hit hard as well And I'm willing to work with you to offer a discount to make sure that you are prepared and ready to go when things do get Go back to normal So this is something very simple you can say and this is what we're saying when we're reaching out to people We are offering discounts of 25% off on our normal service and you can decide whatever that discount is. Okay Now how we've been affected Personally in our agency and what we've had to do to adapt and change So the biggest thing is our messaging tone needed to be switched to address the COVID-19 concerns, right? So we are basically growth response. If you don't know, we're basically a copywriting agency We create messaging and outreach for LinkedIn and cold email and we reach out to our clients target market or their niche On their behalf to try and generate leads and appointments for for our clients So we've had to adjust all of our clients messaging tone to address the fact that all this craziness is going on Everything with COVID-19 and all the concerns around that so we've had to change our messaging for all of our clients As well as our own agency to address that that's been the biggest thing we spent like a week and a half doing that Now, yes responsiveness has definitely slowed down, but we're still we're still closing deals and we're still reaching out to people We're still reaching out to other industries that we might not normally work with That can still use our service, right? Like I said financial insurance accounting the law industry We're reaching out to other industries that we don't typically work with to see if we can help them out Now another thing that we did is we rolled out a new service last week And we've actually secured two clients for this now But all we did was we reached out to our existing clients and said hey, I know it's Crazy right now. There's like mayhem going on the global pandemic all this stuff Uh, I know that you have an email list because most of our clients do have email lists They're already established businesses for our agency. So we asked them Hey, would you like us to nurture your list and generate sales from your existing email list because we noticed Most of them are not even emailing once a week So we we rolled out a new package within like a couple days. I just created a new package Of daily emails. So Monday through Friday We are sending out daily emails for clients to try and nurture their list and get sales from their existing list And all we did we slapped the price on a $3,500 per month for 20 emails, right every weekday And we're just we're all all I'm doing is creating a google doc just like this And I'm creating 20 different emails that help to generate sales And I give this google doc to my client and they pay us $3,500 a month and they send these emails That's really it right. It's a low touch low effort at least for me Low effort type of service for us to roll out that gets massive value during difficult times like this So that's what I mean when I said always be thinking of new services and offers that can help your market and help your clients This is what we've done. Okay. Now sharpening the sword and implementing daily These are four things that I'm doing daily, right? So outflow This is any kind of outreach, right cold email, linkedin, facebook, instagram I'm still doing outreach every single day or my team is doing outreach every single day and prospecting for new business Content creation. So I'm creating an email every single day. Actually seven days a week right now I'm creating two youtube videos every week and I'm creating five facebook group posts every single week So I'm creating content. I'm sharpening the sword and practicing my copywriting skills and my closing skills and my sales funnel skills, right? I'm also creating a new book for growth response my agency, right? So I'm creating a book on email marketing and outbound email and inbound email and how you can increase your sales Using email marketing. I'm also doing one-on-one and group coaching calls though every single week, right? Almost every other day. I'm doing these so I'm always sharpening the sword. I'm always implementing daily I'm moving myself in my business forward and yes, I've been affected our responsiveness has slowed down Our messaging tone needed to be changed across all of our clients as well as our agency Which was a pain in the in the ass, right? But we're not stopping we're sharpening the sword We're implementing daily and we're continuing to move and move and move We rolled out a new service at $3,500 a month for a starting price We asked some existing clients if they would like it and two of them signed up for so far I have some calls the rest of the week with three or four other of our existing clients to see if they want to sign up for this And uh, this is how we're moving along during tough times like this, right? If you're an entrepreneur get your creative hat on and look at ways to adapt and look at this as opportunity And look at more ways that you can add value to your market and to your clients Okay, so that's it for this video guys. I just wanted to answer the question How has my business been impacted by everything that's going on right now? What are some things that i've done to adapt and change? What are some things that you can do to adapt and change to what's currently going on? And I really hope this was helpful to give you some ideas and insights on what not only what i'm doing But what you can do in your own business. Okay, so that's it for this video guys If you guys liked it give me a like and comment below with any questions you have If not, I will see you guys in the next video


Can you hear me now? Let me know if you can hear me now. I don't know if you can or not. Hopefully you can. Soon as somebody is here, I don't hear anything. So that's not good. Oh, I have my, but I have my thing turned off. Holy cow. I have my thing turned off. Holy cow. Yay! I have sound! Yay! We have sound! Woohoo! Oh, yeah, yeah, yeah. As I was saying, when you couldn't hear me, I'm just off a little bit this week, if you know what I mean, and technical difficulties aren't helpful. They're just not helpful. All right. So we've got some exciting things to try today, and if we can, we're going to squeeze in three brands this morning. Grumbacher was gracious enough to send some colors for us to try, and they sent these big, huge tubes, which are just, I mean, these are ginormous. They are almost half an ounce, 0.47 it looks like, and Grumbacher is one of the brands that I like because their tubes have a nice big, fat lid, so they're easy to get off, at least on this side. Now, full disclosure, I did, I do already own some Grumbacher paints. Just a few. I also have a few generics in this bag, and they have these little Academy, Grumbacher makes the Academy watercolors with these little tiny lids. These, I think, are the student grade, and the ones they sent me are the artist grade, so they do have a couple different grades of paint. There's another generic one. So when I do my, I do have more generics in here. Hang on, let's get the generics out of the way. All right, so when I do my, see now, now you're going to wish you didn't have sound with all that crinkly noise. Okay, so when I do my little inventory swatch page later off camera, I'll be including these Academy acrylics, which is the student grade, and I'll mark, I'll put some kind of like asterisk or something about which ones are which. Oh, there's another, that wasn't Grumbacher. This is kind of my like leftover's bag, it's mostly Grumbacher. So I do have quite a few of the Academy acrylics. They are affordable, and although they're student grade, they're pretty well pigmented, and they're, I think if I got these at Hobby Lobby, I don't think they're, I don't think they're super hard to find. And then I own a few of the artist acrylics because they were on clearance at an art supply store that I like to go to when I'm in that area of the Bay Area, Lens Art in Santa Cruz, and they have these three particular colors of the Grumbacher artist acrylics, I mean artist watercolors. So I do own these three, Indigo, Davies Gray, and Alizarin Crimson. Oh, burnt Alizarin, sorry. I even have my reading glasses on and I can't see. See, I'm all thrown off now. Doesn't take much today to throw me off. All right. So they sent me Bismuth Yellow. Hello. Hey, everybody. How are you? A little creative. Yosna, Michelle, Theresa. Good morning. Okay, so Bismuth Yellow, Cadmium Orange, True Red, Sap Green, Prussian Blue, and Dioxazine Purple. So, and here are our other, I pulled the pages out of the book. It's a little easier to work with. Oh, you're welcome, Emma. That's what this whole thing is about. And as we started doing the few watercolor brands that I own, and I'm a watercolor like Hoarder, a collector, I should use collector. It's a nicer word. You know, but I can't afford to buy any more paints.  So I started writing to different companies to see if they would send me more paint. And I'm, you know, happy to do that. And, you know, we'll keep doing this. And some of you some of you are, Michelle, can you PM on Facebook, Nancy Dale, and ask her tell her I'm live right now that I'm not having any more technical issues so she can come over and watch. So I don't have to do it. I'd appreciate that. I'm happy to write these companies and see how many brands we can get so we can do this because I want you all to make an educated decision that what brand you decided to go with is going to be different for everybody depending on your budget and what you're doing with them.  You still are going to want to know which ones are better pigmented than the others. Maybe you're going to want to end up with a palette like honestly, I love Daniel Smith paints and it's my number one favorite brand, but this is a palette I use a lot and this palette has six different brands in it. So, and we're going to be, I only own three Sennelier paints. They sent me three samples. So I have the three colors. So we're going to be working with those but this is a great, this is one of my favorite palettes to work with. And Michelle, I might be bringing this to Las Vegas just FYI. I haven't decided yet. I do have my little one too. We're going to be, it's my normal travel palette, but all right, let's get started. So we're going to do our yellows, orange, red, green, blue, and purple. All right. And then this, this is Grumbacher and this is the artist. Hey Nancy, you made it. Yay. I'm going to market Grumbacher artist watercolors. Since I do own the other ones, I don't think that we're going to go swatch them today. In fact, I know we're not going to. I don't have the right, anything close to the right colors, but at some future point, if we decide to put them then. No, actually my husband is really great about it and I usually do it when I'm with family. I do it early in the morning while they're all still sleeping. Hey Sharon, or in the evening when we get back while they're all, you know, putting their feet up and relaxing from, you know, all the walking around and touristy things we've done. I work it in around, you know, what they want to do. So I'm actually going to Las Vegas with a couple of art friends, no husbands. We're just, we're going to art and sightsee. That's what we're going for. And we're going to do film, do some filming and we're going to do some classes, little lessons while we're there and that sort of thing. All right. So now we want to put in the squares with this brand. We want to put the color names that we're using. Even though you're on vacation, everybody, you know, is entitled to sort of their own time. I don't know about you guys, but I kind of need a few minutes during the day or in the evening or morning or something just to myself to sort of unwind and relax. And that's usually the time that I use when I'm on vacation to do art. Yeah, mine too, Michelle. Okay, so I'm going to put some of these Grumbacher paints in this small palette that I have. And mine uses that time to, you know, watch some car show on the TV or sports or, you know, whatever when we're on vacation that I don't like to do. Yeah, I can't stand the craziness. If I don't get a few minutes to myself, I love these caps. They're so easy to take on and off. I should probably leave those out. Okay, in green. Yeah, my husband will go, you know, down to the bar and have a drink or go to the pool or he'll sit like I said and watch, you know, some TV or he'll read one of his books on Freemasonry or something like that or plan the next day. All right, so now we've got a paints and we're going to be using, I need a red, don't I? I told you guys I'm just off today. I feel like I need an extra cup of coffee. Okay. So we're going to be using our brushes today, Royal and Langnickel, if I don't think I don't know if it's aired yet or not. But they sent me a box of watercolor paints that we'll be working with and swatching in the future. They also sent me a bunch of their Zen watercolor brushes, which I already owned one, a big flat one. And I loved it. And I got it on clearance or something somewhere. I didn't, but I didn't buy any more because I don't, you know, I'm a watercolor and art supply hoarder. So I'm trying not to buy any more stuff. But I do like the brush a lot and they sent me more. So I'm anxious to use them. So we're going to use them today. So these are by Royal and Langnickel. They're not super expensive. This is their Zen line for watercolor. And this is the round number eight. And I already have the flat and I love the flat. Okay, so here we go. These are the Grumbacher artist grade paints. Nice yellow. Now that is because of the color of yellow that it is. It's a nice bright yellow. But it's a little bit, it's not super, it doesn't seem to be super transparent. It seems like it's a little bit chalky. But with any of these colors, even with a gouache, if you add more watercolor water to it, it'll be more transparent. Hey Eileen, how are you? Yeah, when I'm on vacation, in regards to the earlier conversation, I actually do less of watching of YouTube videos. And like in the morning, when I'm home, I watch your guys's videos. And then I come art. But when I'm on vacation, I spend that time working in my journals and doing art instead of watching videos while I'm having my coffee. I love that sap green. This is Prussian Blue, which is a blue that I usually love across all brands. It's more of a turquoisey blue. See, look at that. It's a great ocean color. And then Dioxazine Purple is one of my favorite purples. Again, across all brands, it seems like nice purple. Okay, so that's the Grumbacher. Now let's do the Sennelier. It's going to be easy because I only have three colors. Sennelier is a French watercolor. It's definitely artist quality. A lot of their colors are really bright and vibrant and they're all, most of them are light fast. I will be updating the Watercolor Wednesday page this afternoon with pictures of these tests and also links to the manufacturer websites and stuff like that later today. So look for that. So we have Senneras Blue. Yeah, they are. The Sennelier A paints, though, are made with, oh, I wrote the blue in the yellow column. Holy cow. I told you guys I'm off today. Let's write the blue down here. I almost did it wrong again. Gotta get the white out. Um, the Sennelier A paints are made with honey as a binder instead of, hey, Lori, instead of like gum Arabic. So they never, when you're squeezing them out into a palette, they never really completely dry out. They stay sticky. Like I heard, uh, what's M. Graham does that to? Yeah, technical difficulties, YouTube issues. You haven't missed much. Okay, so and then I have yellow light. So I only have the three colors, but we'll swatch what I have. And this is my, I'm not blaming anybody. You know, I have a technical black thumb, Lori. So it's probably my fault. Okay, so I only have the three colors and they come in these little sample packets that actually hold quite a bit of paint. It filled a whole full and full pan and then another half. So this is the yellow and this is their yellow light. And you can see from comparing it to the Grumbacher one. This is not because of the different brands. This is because of the different colors. How this one's really light and kind of like chalky, like it has a lot of white in it. Some people prefer a natural binder like honey to gum Arabic. I'm not super picky about it. The thing that bothers me about honey is that they stay sticky and I'm not a big fan of that. I like to carry my paints around in a in a palette like the one that you see. So therefore I like them to dry out, especially because I do take them around with me like on vacation. Some people prefer the honey as a binder. I think it's a matter of opinion. Sennelier are also pretty expensive. So you have to factor that into what your budget. Look at those pretty colors. Aren't they gorgeous? What about the Grumbacher, Michelle? Can we get that? Yeah, exactly. So I would worry about things like that. It stays sticky. It is a honey product. So it's going to attract bugs and bees and that sort of thing. That's not a great thing. Okay, now this is my actual travel palette. This is the one I take when I go out of town. I took the inside insert out so that I could get more paints in it and the pans have magnets on the bottom. This is again a mixed palette and it has, this has 21 colors, 21 of my favorite colors across some different brands, including Koi. I can't get the color key out. Okay, and it's mostly Koi and Daniel Smith because I had the Koi paints. I don't mind the Koi paints. They are definitely a student grade, but they're pretty well pigmented and they're affordable. And I had some pans. I gave some away, but I had some pans and I wanted to use them up. So let's see what colors we have here that'll work. Yellow. Let's see. No worries, Teresa. The recording will be on YouTube later. Let's do lemon yellow. I'm glad it's just not me that's having YouTube issues this morning because it's just, I'm not sure, it's making me crazy. I'm picking, trying to pick similar colors. Let's see, to what I have. So the two Grumbacher and Sennelier are about the same. Koi, of course, are very inexpensive. One of my issues with Koi, a couple issues with Koi, one of my biggest issues with them is, I don't have, let's see, let's do cobalt glue. Hold on, let me write, I can't, you know, I just can't multitask this morning. The older I get, the less likely that is to happen. I'm going to, hang on, I'm going to turn off, I don't think it's going to make any difference, but I'm going to turn off the Wi-Fi on my telephone. Okay, and we're shutting down the printer. I don't think it's me. It's probably, it's probably the internet connection or, yeah, I don't know, because we're not even on Wi-Fi. We're hardwired into my PC, so I have no idea. It could be Google Plus. All right, so one of my issues with Koi is that the little cake pans are not refillable. They have their tube sets, but their tube sets do not carry all of the same colors in it, as are in the cakes. So that, unless they, I know they're coming out with some new stuff this year. Maybe they've changed that, but I don't know. Thank you. Michelle, by the way, is my technical guru person when Bob is not here. Let's see. Okay, I can only check one, and if I unclip it, you guys are going to, I'm going to go black for a minute. The other one's like behind the PC. If you guys can deal with it, we'll leave it. All right, so one of my issues with Koi is that you can't refill the pans, and I don't like that. All right, so lemon yellow. This is going to be similar to the bismuth yellow, in that it looks like it has like white gouache in it. It's a little bit chalky. All right, and then we have the permanent orange. I do have to say, with the problems aside with refilling the cakes, I like the Koi paints. They're a student grade, and, you know, that means they're not as light fast as the artist grade, and, but they're pretty well pigmented, and they're super affordable. I just don't like that they're not refillable. I've done a lot of paintings with them, though, and this is the kit that actually always goes on vacation with me. This little, this is supposed to be a 12 pan kit, but like I said, I took it apart, took the insert part of it out, and I put magnets on the bottom of all my little pans so I could get more colors in it, in a smaller, in a still, stay in a small space, and then I filled in the the gap with a piece of sponge, but as you can see, they're a little bit chalky. All of the colors are a little bit chalky, kind of opaque, more than being transparent, but they're nice, and, you know, add more water to it. That'll, you know, lighten up the color and also give you more transparency. So there's our three colors comparatively. I should write Koi on there. I'm telling you guys, the technical difficulties just throw my brain into it, Tizzy. Okay. And I know it's not my, I should say, Michelle, I know it's not my camera because before I go live on the air, I always check the view with the camera software on the PC to make sure everything's lined up, and the tripod's okay, and I didn't get these lines, so it's got to be a Google Plus and YouTube thing. All right, so those are, that's our, that's our first test, and here are our other colors that we've done already, our other brands. You see what I mean about, I love this purple. It's very like the Maymary blue-purple, so those are nice. I will be scanning this later for you all. All right, now let's do some little test paintings, and this time I'll try to just do the paint in one instead of, I don't know if you guys all watched last week, I screwed up and I went to go paint all the little houses with the same brand of paint. I'm going to take a deep breath. Okay, so we've marked which one is which, so now first we will do the ground blocker. Now again, just like before, you're going to start with your lightest color, and you're going to put that down first where the sun would be hitting your image that you're painting, and you could definitely do this, you know, when you get together with your friends maybe to do some arty parties and, and create your own swatch book, you definitely could do this with a stamped image, you don't have to draw it, you could just get one stamp and stamp it with Stazon or some other brand of permanent ink, waterproof ink, and do it there, getting some nice like blending and kind of blooming on the paper in the water with these paints. Now of course our Sennelier one is going to look quite a bit different because I don't have, I only have three colors, but we'll make it work. Royal and Langnickel had one of these sponges in the case they sent. If the video for that hasn't aired yet, it will be soon. They sent me this big box full of stuff, so it was really cool. All right, keep going. If anybody has any questions, you guys can ask them. Hello, how are you?