Let's get into the big topic of open source, something that we actually have in front of us. This is so awesome. We are an open culture that is actually in place. It's that process that a developer or, let's say... As the Kubernetes ecosystem really brings...  I am your host, Andrew Sullivan, technical marketing manager with the OpenShift business units. And I am joined, as always, by my co-host, Mr. Johnny Ricard. Good morning, sir. Hey, how are you? It is a beautiful Red Hat day. As I was saying just before we started, right? Every day is a feast. Excuse me, every meal is a feast. Yeah, I'll get this right someday. You got it right when nobody was watching. Yeah, it's my first time. So yeah, welcome everybody. This is one of our office hours series of live streams here on Red Hat Live Streaming, which means that we are here to answer your questions. So anything OpenShift related that is top of your mind, anything that you would like to ask us about, we're here to help answer those questions. Whether or not those are related to today's topic, which happens to be security and OpenShift. And I am very happy to welcome someone who I have been wanting to have as a guest for a long time, Kirsten Newcomer, to talk about closed-loop security with Red Hat and with OpenShift. Kirsten, if you don't mind introducing yourself. Sure, hi folks. Great to be here. Kirsten Newcomer, I'm director of security product management for the OpenShift team. So that includes Container and Cube security. Of course, Red Hat advanced cluster security, which we'll chat about more as we keep going. But all things security for cloud-native applications. Yeah, you know, it's just a small topic. It's just a little thing. No big deal. It's just automatic, right? We don't have to do anything. So yeah, this is one that, you know, we're with 64 episodes in. I got to look at the little banner at the top of our screen here. And we've touched upon and flirted with security as a topic. But as a specific focus, we haven't. And it's something that I think has been long overdue. And I'm looking forward to today's topic. And looking at our outline, there's lots of really cool stuff that we're going to be talking about. So as always here at the start of the show, we have our top of mind topics. And I'm actually, I was not expecting. I think we've got like, what, five, six of these, Johnny? Every week, every month, or Wednesday morning at like 9 a.m. my time, which is 8 a.m. Johnny's time. And he's kind enough to reply. I always send him a message and like, hey, what are we got any topics for top of mind? And so this week, we definitely came with a few, although I think they're pretty, most of them are pretty short here. So a couple of kind of logistic things or upcoming red hat centric things. So one red hat summit is coming up about five weeks now, May 11 or 10th and 11th. It will be a hybrid event. So there will be some folks on site in Boston, as well as online. So I believe that that is a Wednesday, Thursday, Monday, Tuesday or a Tuesday, Wednesday. I don't know, I'd have to look at a calendar, but we won't be streaming that week. So just mark your calendars. Please go attend summit. See all the cool stuff that they got going on there instead of coming and listening to Johnny and I prattle on. The other thing that I wanted to talk about that are kind of logistics things is next week. So next week on the 14th, we have the what's next or roadmap session for open shift. So that's Thursday at, I believe, 10 a.m. Eastern time. We'll have the product management team on to talk about the open shift roadmap and all the things that you can expect to see over the next few releases. So always a good time. Johnny and I will be here to help answer questions. I think Christian is planning on being on along with a handful of others. Usually Mr. Mike Foster is the one who manages that behind the scenes, which coincidentally he is the ACS TMM. Let's see, moving on here. Oh, a follow up from last week. So last week, remember we talked about two topics. So one was how to replace a failed control plane node when using assisted installer or really any non IPI deployment. And the other one was how to create a customized Grafana instance. So for that first one, for that replacing control plane node, you remember when I was going through the demo and we got to the point where I was joining the node back in and like, why did it get this random IP address? I created a DHCP reservation and I just kind of ignored it and pushed on and surprisingly it still worked. So it turned out as I was, you know, troubleshooting and kind of looking into what happened there. Peter Latterbach and I were chatting and he was like, maybe you have a second DHCP server.  It was, yeah, that's exactly what happened. I had my normal DHCP server for whatever reason, wasn't doing DNS updates for DHCP clients. So I had temporarily turned it off and moved to the router DHCP server and never actually fixed that or did anything when it. So when my helper node rebooted and DHCP restarted, I now had two DHCP servers. So awesome. Yeah. So yeah, if, if you were paying attention last week, you know, if you saw that fiasco, which again, surprisingly, it still worked. That was why I had two DHCP servers since they were competing with each other. Yeah. Alosa Doug, it was not DNS surprisingly. And actually I just, I swapped out, I used the, I use a coffee cup with a lid when I'm streaming. So I don't make a mess of myself. I had my coffee cup, my DNS coffee cup this morning. It has says if DNS had a face, I would punch it. It always makes me think of Christian Hernandez. Let's see. 4.8 to 4.9 upgrades are still blocked. Let me, let me share my screen here. Cause I happen to have a, nope, not that one. There we go. So I happen to have the security advisory here or the bug fix advisory rather. So just a reminder to anybody and everybody who happens to be listening to us. Anytime we block an upgrade path, we will release an errata that announces that. So this is the errata 22 colon 10, 86 notification of delayed upgrade path to 4.9. So this one is relating to the at CD issue that we talked about last week. So just a reminder that this one is still ongoing. If you're trying to do upgrades from 4.8 to 4.9, you'll still see those blocked. And of course I always recommend the folks that you subscribe to errata. Unfortunately, I don't know of a way to filter these so that you only get specific ones. But if you go to access.redhead.com slash errata, and then you click, so I am logged in here. You won't see this if you're not logged in, click this notification preferences.  You see, I have mine disabled because I, this is my developer account, not my normal account, but normally you would want to get those. I always recommend to folks to use client side filtering and search for like that string that I showed you a minute ago. All right, come on. There we go. So you should be able to search for like delayed upgrade or upgrade path, something like that in the subject. And that should filter just the ones that are affecting any upgrade or blocked upgrade paths. Moving on. So I strangely, and the questions seem to come in waves. I don't know if you've noticed that, Johnny. Oh, yeah. There was, I don't know, like three or four or five folks who asked some internals red hat, some external red hat, like, Hey, how do I install a specific version of OpenShift? So the way to do that is with the OpenShift install version that you use. So if I go to access.redhead.com, and products and services, cloud computing, red hat, OpenShift. And then I scroll down here and find the, oh, why can I never find this? That was not what I wanted. I want to come on. I want to download it. There we go. So if I click this download latest here, this takes me to the standards, you know, download interface that we've all seen for rel and for every other red hat product for ages. But if I click the down the, this button here, the dropdown, it shows me all of the versions that are available and you'll notice that there's for rel eight and for rel seven. So the reason why I suggest people go to this interface is because you'll notice, for example, there's no <IP_ADDRESS> or one or zero or anything like that. This only shows you versions that are GA. So versions that's never made it out of candidates or anything like that are pre-release versions. They don't show up in this interface. So if I wanted to, for example, install 4.9.13, I simply click here and then I can come down and download the client that I need, which is just OpenShift install. Sorry, client is OC installer is OpenShift install. So I download my client and my installer. And then when I install the cluster, when I go and do OpenShift install, you know, create cluster or whatever, it'll install that specific version. So it is possible. You can, of course, go to the mirror. So mirror.openshift.com and OpenShift E4 and then what is it? Dependencies, clients. Clients, yep. I do the same thing every single time. OCP. So if I go in here, you'll notice that all versions are inside of here. So like here's 4.10 and you see I have zero, one, two, three, four, five, six, seven, eight. So 4.10. I didn't want to click on you. I wanted to highlight you. So remember these three were never GA. This was the first GA version. And then I believe that these two are candidate releases. If I remember correctly, they're not the current GA release. So I guess we can check that. Just going to console.redhead.com. OpenShift slash releases. So 4.10. Yeah. So 4.8 is in candidate. It's not a GA release yet. And 4.10.7, it looks like it's going to get skipped because it's not in fast. So it looks like it was, you know, dropped from being promoted. So it's one of those like, yes, you can go to the mirror, but you just have to be conscious and careful of which version you're downloading because you couldn't have been in a situation where you accidentally deploy an unsupported version. And if you're pulling the core OS image, I understand the core OS version doesn't necessarily correlate to the OC or OpenShift install version. Like they don't necessarily release at the same cadence. Yeah, that's a good point. So if I come back here to the mirror and go to dependencies and core OS and 4.10, you'll see that there is only one 4.10 core OS release. This is perfectly normal. And in fact, if we go back to like 4.9, something that's been out for a while, you'll notice that there's still only one for 4.9. They only release a new core OS image if there's something that affects the image. Normally when the install, what happens is we, you know, it deploys with 4.9.0 in the instance. And then the first thing machine config is going to do is push the current version or the version that matches the cluster install to that host. So thank you for that reminder, Johnny. Yep, no problem. And then the last one that I'll mention here is stack rocks. So Kirsten, this is one that is near and dear to your hearts. And I know that you have been participating in for quite a while. And that is stack rocks, which is now known as Red Hat Advanced Cluster Security for Kubernetes, I think. You got it. Yep, is now open sourced. So congratulations to you. Congratulations to the team. I know there's a lot of work that went into this. I've been keeping up with Michael Foster on the back end. And this is a big one. So yeah, I don't know if there's anything that you want to say about that. No, it just we're really excited. Stack rocks with the upstream community is still called stack rocks. And stack rocks.io is as is being shown there is the home page. Mike Foster is our community manager. So, so, you know, great thanks to Mike for doing that. We're super excited about, you know, working with the broader community. Also, there are some contributions we'll be making back to, to other communities such as Falco. So really looking forward to this, to this collaboration and the opportunity to, to be on the team. And the feedback we'll expect to get from that. So excited about it. Awesome. Yeah. Yeah, I saw a post recently on red on a Reddit where somebody was asking if it was, if it had been open sourced yet. And my response was no, but keep it a close eye. Maybe tomorrow. I also noticed that in the chat, there is a question about if I haven't seen it, if I scroll past it. I believe there was a question about stack rocks requirements, hardware requirements for installation. So they're basically the same as red had ACS kind of the, I'm just posting a link, which I hope in one of my colleagues will put into chat to the ACS installation doc. So really it's, it's, you know, the same. If there's not enough information in that doc for you, we can follow up afterwards. We do have a separate operationalizing ACS doc. But in the near term, I think that'll get you started. So. Yeah. Yeah. That was a rock out. That was asking. All right. Regarding the new security stack rock solution. What would you rate as hardware requirements? With cores, Ram, et cetera, to run. So thank you. And Stephanie, our, our producer in the back end who does amazing work. She is depending on what platform you're, you're watching us on. She's either red hat open shift or I think it's open shift on YouTube or red hat on the red hat YouTube channel. So if you see her, or if you see that, that account posting, that's her. And thank you for all of your help in the background stuff. Yeah. Something else I might say about if you're, if you're going to install ACS or stack rocks on open shift and, and for rock count for your home lab. Right. So there are the UI is installed as central. You could install that on an info node. If you actually have an info node for open shift, you could have, if you are playing around with ACM, you could probably install ACM on the same info node with ACS. There are other components of ACS, one of which needs to be installed on every node that you want to monitor. And that's in particular the collector. So the collector is an EBPF or kernel module. It's going to be monitoring Linux processes and feeding that data to ACS.  And then the other components, there's a sensor, which you, which is used to actually kind of all the data that's collected from secured clusters or fed through sensor. There's also the scanner. If it's a local open shift cluster and your images are being stored in the internal open shift registry, rather than an external registry, the scanner will also be deployed on your cluster so that it can access images that are stored in that internal registry. Just to be clear, that's, that's different than something like Claire. So the ACS scanner is actually, so this happens in our world, right? Remember that stack rocks is an acquisition. The ACS scanner is actually a fork of Claire v2. Red Hat quay ships with Claire v4. And one of our projects, one of our roadmap activities this year is to get to a single clear based scanner that will be available from Red Hat. So it'll be, you'll see that we will be the ACS stack rocks team will be contributing code into Claire v4 because that divergence happened. There's a fair amount of refactoring that's going to have to happen. Today ACS can cover more language level vulnerabilities than Claire v4 does. So we're really looking forward to getting to one place where we can, you know, one scanner where no matter where you're accessing the Red Hat scanner, you get the Red Hat version of Claire, you get this coverage. And if we circle back to spring for shell for a minute, I know one of the links that was shared was a mention we're working to get updates into the ACS scanner database for discovery for spring for shell. Internally, we've had a few glitches in our release pipeline. Otherwise, this would have been out already, but we're still working to do that. And I don't know if you intentionally segued into spring for shell, but we do have a question from Kumar about OpenShift was listed as affected, but now it's been removed with only serverless being affected. Correct. So that is the latest update. And in fact, so I did notice the questions and we've shared a couple of links about those. So one of them is to the Red Hat security bulletin, which is always updated as we figure out new things. So it was an initial mistake when they thought full OpenShift core was impacted. They realized absolutely not. Our product security team digs in, but serverless functions, the tech preview version of serverless functions for spring cloud is affected, as is also Red Hat decision manager, process automation manager, enterprise virtualization for AMQ, 6.3, 7 fuse, 6 and fuse 7. And again, Red Hat ACS. We are working to add the data to allow you to discover any other any vulnerable images that you might have on your cluster or in your registry using the Red Hat ACS scanner. Very cool. And just to make sure I understand. So Claire, which is a part of Quay and multiple other registry instances, I think harborships with Claire as well. It's an upstream project. Yep. So it scans any images that are put into that registry, whereas ACS's image scanner can scan kind of any image, including and some of the really cool demos that I've seen lately are, like I have a pipeline and I'm building an image. Before I even push it into the registry, I can use ACS to scan that image. Well, so actually what ACS is doing when you're scanning in a pipeline, so absolutely you can scan using the Red Hat ACS scanner in a pipeline. However, what it's going to do is it's going to connect to the registry where you're storing that image in the pipeline. That said, we have on our roadmap the ability and we're shooting for it. It'll probably be, might land late 2022, might be early 2023, the ability to use the ACS scanner to scan an image on a developer's local desktop. We really want to shift security even further left. So when people think DevSecOps, one of the first things they do for the DevSec part of that closed loop is they add vulnerability scanning into the CI CD pipeline. That pipeline does include a registry. You need a place to store the container image that you're building. We want to shift that further left so that even if you're just doing a build on your desktop or your laptop, you can run that ACS scanner there, get that early information, and use that vulnerability. Ideally you're able to fix the vulnerability right then before you push it to the registry. But even if not, what you learn can inform choices out whether or not the image is production ready. Very cool. Yeah, that was something that was always, I didn't know that it was still using the local or the internal registry for that, but even still, that's a super cool. ACS can connect to, you have to give ACS the credentials to connect to whatever registry you're using with your cluster. That could be an external registry. It could be Artifactory. It could be Nexus. It could be Red Hat Quay. ACS, it could be Amazon ECR. ACS doesn't care which registry. You just need to give it the access so that the metadata, the content can be pulled manifest. That's the word I wanted. The manifest can be pulled and we can collect the data needed to map to vulnerabilities. And I'm sorry. You can ask me another question if you want, but I love this theme of security and obscurity. So at some point, I want to address that. It's shown up twice now. Yeah. John and I both used to work for the government. So yeah, it's a concept we know and love. Oh, yes. So our hope nine asks, does the scanner work with a distributionless image or one that has the from scratch? That is a great question. So right now we aren't great with scratch images or distro-less images. The scanner needs, there is work that needs to be done there. And again, that is something that is on the roadmap. We don't encounter it a lot, but we do encounter customers using scratch or distro-less images. Like many scanners in this space right now, we're kind of leveraging package related data as part of our mapping to known phones. So to do the distro-less, we need to add some additional analysis to pull, you know, to pull from binaries where there's no package data available. So. Yeah, that makes sense. And I'm sure it slows down the process because you don't have this, you know, with a from known base image. You already have this catalog because you scanned it once and now you can check against that. All right. So we've kind of already launched into today's topic, but in our hope nine, I see your question there. We'll get to that in a moment. But I want to officially launch into today's topic, which is again that closed loop security with OpenShift and Red Hat. And this is the first time that I've heard that phrase coming from you and from your team.  So I'm very interested and curious to hear about that. Yeah, so, so the reason I like the phrase closed loop security is again, DevSecOps popular topic, something we hear about a lot. And I, in many of the conversations that I have with folks, again, as I said earlier, it's kind of like, I hear many people think of DevSecOps as what I've started calling DevSec. That is shifting security left, adding some security gates to the CI CD pipeline, but that's only part of that infinity loop that is DevOps or DevSecOps. So what you really want to do is you've collected data in the development environment and with ACS or StackRocks, not only can you do vulnerability scanning, but you can do app config analysis as well. You can look for access privs in your deployment data. You can catch issues early and you can guess what you find in the CI CD process to set security policies that are applied at deployment time with admission controllers and other security policies that may be relevant at runtime. And so that SecOps part, that second part of the loop is also important. So you can inform your policy creation with what you learn at runtime and what you, I'm sorry, with what you learn in the CI CD process and what you learn at runtime absolutely should inform back to the development team. An example of that with ACS today is that ACS will do an analysis of the network communications of your running pods and it can auto suggest ways to tighten those policies and it can also help you apply those policies. It can simulate what the communication path would look like with that auto suggested policy and then help you apply those if you wish. So that's also a place where depending on how the policies are defined and who in your organization is given permissions to do those definitions, again what you see in runtime can inform back to the developer loop. We also have on our roadmap working with some of our IBM research colleagues looking to shift the generation of network policies left as well. Do some analysis of your app config and your app data early on to define, to propose a network policy that would work well in runtime. And I see this mention of zero trust. For me, zero trust is an even deeper level conversation, right? There are so many layers but maybe we can use that, Andrew, to circle back to what you said about the layers of security and OpenShift because when we think about it, there are a lot of different layers that need to be considered, right? So you mentioned Desi Linux, right? So Relcore OS container optimized operating system only has the content needed to run OpenShift. Therefore, it reduces your attack surface. It's SELinux on by default. SELinux has demonstrated the ability to protect against or mitigate the known container escapes to the file system. Security context constraints in OpenShift which allow the administrator to control the privs a workload can run with. By default, a regular user cannot deploy the privileged workload to OpenShift. Of course, a privileged user is a little bit different, right? That's another scenario that has to be looked at carefully. Built-in audit logging, both for the host layer and the API server layer. Kube network policies for micro segmentation. You can implement zero trust at the network policy layer by starting with a deny all policy for Kube. For your Kube network policies now, is that really where you want to start? I'm not sure. Most people are more likely to start with I'm going to allow communication between all pods in the same namespace or OpenShift project. That's a more common pattern, right? I think you're touching on, you know, going with that, like a default deny all, right? To me, that's touching on, I think, one of the biggest frustrations that many people have coming from another Kubernetes into OpenShift. And that's things like no root in the containers, right? And no privileged containers. And like there's an awful lot of things that quote-unquote just work in other Kubernetes because they're insecure. And I don't know if there's any tools or any recommendations that you have for bringing those types of applications in. Yeah, that's a really great question. So, as you say, by and large, there are a combination of things that lead to what you just described. And certainly it's absolutely true. OpenShift out of the box is more hardened than the majority of the Kube distros that are out there. I'm not sure I'm aware of one that is more hardened than OpenShift. Doesn't mean there isn't one. So, and it's largely security context constraints, but also the SE Linux piece and the way that they work together. So, the challenges that often workloads request privileges or that maybe they do or don't actually need, but they're just used to requesting them. Sometimes the workloads are used to, especially if somebody's containerized a legacy workload. There may be some requirements or some interactions where they expect to run with a particular user ID. And you can't do that by default on OpenShift. If you're a regular user, you have to kind of have a special SCC to do that. So, one of the things that we're working on, so really best recommendation, use something like KubeLinter or ACS to analyze your deployment configs to look for what privileges are being requested by the workload, what Linux capabilities, user identification, anything like that, right? It's in that config data. Security context, a whole range of places to find it. Use one of those tools so that you can analyze in advance whether or not your workload is going to be accepted to be run with the restricted SCC on OpenShift. There's also some additional work that we have kind of handed. There's an upstream project called the security profiles operator. That will help you if you know you need privileges. The SBO can help you define SC Linux profiles that will further contain any concerns that you might have related to the fact that workload is running privileged. That is awesome. Yeah, and Johnny, I know you have many war stories as a consultant around, especially the specific UID, right? OpenShift designs, right? There's a range of randomly assigned UIDs for each namespace. I came from the storage realm and especially NFS. With NFS, now I have random UIDs. I used to get a lot of frustration from folks because it doesn't work the way it should just work. I just wanted to work out of the box. I don't have to think about it. Where's Christian? Is Christian still listening? Yeah, he is. He has stopped disabling SC Linux t-shirts. It's one of those things. A lot of people, step one after I finish my deployment is turn off SC Linux. Every time you disable SC Linux, you make Dan Walsh cry. I know I've seen that one. But there is such a t-shirt or a statement. In fact, the truth is, we actually don't support OpenShift with SC Linux disabled. Your workaround, if your workload isn't going to work with SC Linux on, there are, I think, nine different SCCs that we ship out of the box. The most privileged one will allow you to work without an SC Linux context.  Exactly. You just don't want to do that. There are other options. And it's interesting. Some of the other workloads that can be challenging are workloads in the telco space where they need to talk with hosts. There may be secondary network interfaces that they need to interact with. And that's a whole different level of privilege. Again, but you can still limit it. That's one of the values of Linux capabilities. The challenge, though, is that not every developer thinks about or works with Linux capabilities at that level. And they also may not know what system calls their app needs to make, which is one of the reasons we're investing in the security profile operator. How can we help provide some automation that informs, provides additional security to those more privileged workloads? I would definitely say that in my experience, it's been that part of the conversation. What does it mean if I do any UID or if I allow a host networking or whatever? Just going back, it's the possible. It's what could happen. It may not be what's happening right now, but it's what could potentially happen if something gets compromised. Then you expose everything. It's that lateral movement. What can you do to, how do you mitigate that best? Again, contain it from getting, keep it from getting to the host file system, which is the key role, a key role of SE Linux. Then if it bypasses, if you've bypassed or it has the privs and it gets to the host file system to the node, then you're in a position where you can have node to node. You get lateral movement on the cluster. That's something you really want to avoid. What's that? I think Microsoft calls it warmable. I can't spread like that. I do appreciate that. You have multiple times you've said hardened. It was something that I learned from Mike Foster that I think Mike learned from you. There is no such thing as a secure system. This is true. There is hardened systems that are, that make it difficult or a much smaller opportunity to compromise. It's always a determined adversary can almost always find a way. As we've been seeing with log for shell and now spring for shell, new vulnerabilities are discovered regularly. Oftentimes these are just, or even if we think all the way back to meltdown inspector, these are sometimes vulnerabilities that have been around for a long time, but were never noticed, weren't exploited, suddenly become exploitable. And as an industry, we scramble to respond. So we absolutely want to think about how do we harden and how do we provide protection that can mitigate in the case of escapes. So certainly there are environments as is being kind of mentioned in the chat, right? There are environments that are truly, not just disconnected from the internet, but you just can't, you know, anybody, somebody said locked at the vault, right? Air gap, that's the phrase. Thank you, Andrew. And at the same time, you still have to update those systems. That's typically done by something like sneaker net, right? I'm actually wearing slippers at the moment, not sneakers. I was going to show my feet, but... Slipper net. Exactly, slipper net. But I still have to get that update from somewhere. I have to analyze that update before I apply it to my air gap system. And I have to be sure that there's no tampering on whatever device I'm using to carry it from that analyzed environment to my air gap system. That's no... Yeah, and it's funny you mentioned that. So many moons ago, I worked for a Department of Energy site. And as we were going through, as I was going through my onboarding training, they were talking about, you know, computer security. And they brought up the instance of, I think it was, I ran, where they just dropped somebody who was just dropping USB keys in the parking lot.  And they plugged it into an air gap system. Yeah, stuck net. Yeah, stuck net. So it's one of those like, even an air gap system is not, thank you, rock count as well, is not secure, you know, necessarily. Revol USB guard for those scenarios. Yeah, they're handing those USBs out at conferences. And the same thing dropping it in parking lots and just kind of like, just a huge net casting to see who would actually do something. And got lucky. Yeah, so we do have a couple of questions. So Alosa dog apologies for anybody to anybody for mispronouncing names, user names, et cetera. Is ACS capable of analyzing user created SECs? So at the moment the analysis is that I mentioned earlier that config analysis that's focused on the deployment configs, helm charts, those sorts of things rather than SECs. So it's really looking. So if you, you know, SECs, OpenShift thing, security context constraint comparable to Kube, pod security policies, pod security policies have been deprecated, pod security admission is the new thing. We'll still support SECs. So SECs are cluster objects. And yes, an application has to have the privs to access one of those SECs, but SECs are managed by the administrator. Even if the app, you know, the app developer provides that custom SEC, the administrator still has to get it onto the system into the namespace, the app is going to be deployed and has to, has to be configured so that the app can actually have the privs to use that SEC. So ACS today is not looking at those objects. However, I think that's an interesting idea. It's something that we could consider. The question though around that is that those really are not directly tied to applications. They're indirectly tied, whereas deployment configs and helm charts are directly tied and will ask for certain privs. And so analyzing an SEC will tell you, you know, what I have on, you know, what kinds of privileges a workload might be given on a cluster, but until you make that connection between the SEC and the workload that is allowed to use that SEC, you don't have the direct connection. So it's, I'm not sure that analyzing the SECs themselves is going to get you what you're looking for. But it's an interesting idea. Yeah. Yeah. And it brings up a, I think a tangential question for me, which is if we have the OpenShift Security Guide and all of that other stuff, do we have a, for lack of a better term, a set of best practices or recommendations around security practices for things like that and things like, you know, I think the anecdotal recommendation has been, you know, don't create custom SECs just out of convenience, right? Going back to the whole, you know, my application must run as this user. So I'm going to create an SEC that allows that so that I can enable that maybe bad behavior by the application, right? Instead, let's fix the bad behavior so that it's, you know, can run within the correct constraint. So I feel like there were two questions there. And I'm not sure I caught the first one. So regarding SECs, again, they have to be, you have to have the right level of, of privs on the cluster to create an SEC that could either be cluster admin or project admin, as we call it, right? If it's, if the SEC is, is going to be associated with a project, but, and in terms of, sort of if we circle back to your example about storage, Andrew. Oh, thanks for, thanks for whoever shared the, yeah, Andrew shared the security guide. That was the first part of the question, right? What advice do we have? So it ranges. And the thing is that it doesn't always get to the level of detail that you're just talking about. The best place that, that red hat, although again, that's something that we could look at doing is where can we add this into documentation? So there is detailed documentation on the SECs. There's information available about the privs required to create new ones. The reason we recommend that you create a custom one, if one that's out of the box doesn't work for you, is because an update is going to replace a modified default SEC. Frankly, I wish that we had not allowed our defaults to ever be modified, but by the time we realized that we should have prevented that, we were so far down the road that we couldn't do it without potentially breaking people. So, so we haven't drawn that hard line. Recommendations on SECs can be really complicated. I actually, as Red Hat, myself and a number of our colleagues, we've done some of those investigations. It's come up for SECs for storage more than once. It's come up with some of our other, some other complicated workloads. I, there are blogs. There's a great blog. I'll try and find the link that talks about the NEUID issue and the interaction with SE Linux. I'll try and find that link for you all. If not, while we're talking, we can share it later. But I think it's, maybe we should have a white paper that, that kind of digs into that. There, there are other types of guidance available, but the SEC question is so tied to application needs. But nonetheless, I think we've been doing enough around that in recent years that we could probably do a white paper on it. Interesting. I just linked a blog. I think that's the one. Okay. Is it Alexander Menendez that looks like the one? No, it's William. William Caban. Yeah, there are, but they're actually in a couple of different blogs. So, yeah. And, but it does say OpenShift and UIDs. So that might be one of them. Yep. And I think this also flows into a question that our hope nine had asked earlier, which is, you know, can ACS or any of the OpenShift tooling identify, and the core of his question is effectively identify bad practices, right? So his specific question was, can it flag lazy builds or those that should really be a multi-stage build? But I think that there's other things encompassing that as well. So lazy builds, no, I don't think ACS is going to, is going to flag lazy builds per se, but ACS does have out of the box policies that will notice crypto mining, that will notice an alert on exec in a running container. It will check for package managers in running containers, right? In many ways, you know, some base images include package managers. And so they just kind of wind up in your app because they were in the base image. But you, it's really better if you don't have a package manager in your running image because that's a, that's an exploit path, right? And so there are a whole series of known bad behaviors that ACS will analyze for an alert on. And some of those it's not. So again, if you think vulnerability scans, generally I'm looking at a static set of data. It's an image, a manifest file, known set of vulnerabilities. ACS, the known set of volumes changes regularly, but that's still kind of not within context. ACS runtime analysis can go beyond that and add context that includes the kinds of things I just described, crypto, you know, crypto mining, package manager present, exec in the container. And also we'll do a runtime baseline analysis of your deployment. If there is a significant change in behavior, it will be flagged as anomalous behavior and an alert will be sent. So there's kind of this initial collection of data that says, okay, we've looked at this for an hour. We think this is the expected behavior for the running container. And if that changes, we're going to tell you about it. So there's a lot more. And also if you're looking at bone data for an image that's deployed to the cluster, we can tell you also whether a package that has that vulnerability is actively used by the application, based on that observation or not, if it's not used, take it out, right? Interesting. See what you can, you know, get rid of it.  It's funny when you mentioned package manager and why that's a bad thing, you know, it's a path for exploitation, of course. The first thing that came to my mind was Andrew doing a lazy administrator and, oh, this isn't working. I'm just going to, you know, connect into the, into the running container and install the package. And then I'll fix it later in the image build. Tomorrow's problem. Yeah. And of course, you know, that's never best practice because as soon as that pod goes down for some reason, it's going to be deployed from the image without the fix that you just made.  Yeah. So I want to take a moment. I want to talk about the compliance operator and the profiles that are there. Because I think that, you know, we've talked about it in bits and pieces and other places and stuff like that. And I think it's important to highlight that, you know, well, thus far we've been talking a lot about application layer and kind of platform, you know, things running inside of OpenShift. There's still like CoreOS and all of the stuff that's happening there. So I wanted to get your side of things with regard to the compliance operator. Sure. So one of the things that Red Hat has done for some time for RHEL is delivered automation that helps customers configure a RHEL server to meet the technical controls that are applicable from a regulatory framework to RHEL. And we do that with a scanner called OpenScap. That's a NIST certified scanner. And we've applied the same principle in technology to OpenShift. So the OpenShift compliance operator runs the OpenScap scanner under the covers. And it also, it's going to evaluate the Kubernetes layers of OpenShift, the control plane, the core components. And it's going to evaluate RHEL CoreOS as well. It does both layers against policies or profiles that we ship that can be run by the compliance operator. So today, we have profiles that allow you to analyze against the CIS OpenShift benchmark. CIS is now doing per distro benchmarks for CUBE. There's no longer just one CUBE benchmark. So there's the CIS OpenShift benchmark. There is the set of controls from NIST 853 that apply to FISMA or FedRAMP moderate. There's profiles for that. NERC, we were talking about electric utilities earlier, right? So NERC is a regulation for electric organizations. We have a profile for PCI DSS for those in the financial industry. I always, oh, a central eight for anybody who's in Australia and needs to conform with the Australia central eight. And so generally the profiles have two named parts. One is checking the node level and the other is checking that Kubernetes layer. You can run these scans out of the box. The majority OpenShift is configured to meet the majority of the CIS benchmark recommendations. There are some we think it's important that a customer choose. You can do encryption at many layers. Do you do it if you're running on a cloud provider? Do you do it on the S3 bucket? Do you do it on the rail CoroS disk? Do you do it at SED? Do you do all three? What's the performance impact? How you manage that is really something a customer needs to decide.  The great dashboard in ACS with these details, Compliance Operator comes with OpenShift. You can run it, but there's no UI. It's just kind of CLI output and controls that allow you to do a human readable report. You could use the CLI to generate the human readable report. If you want that nice dashboard, that's in ACS. But also once you've decided which controls, if there are some that are out of compliance and you want to turn those on, you can automatically remediate using the Compliance Operator. You can also tailor a profile. It may be that you want to turn on some controls, but not all of them. It's come a long way. I remember when it was first coming out and we did a hackathon on it. I think it just did the scanning and reporting and there was no real remediation at that time. That could be. Yeah, it's awesome. I'm glad that it's come this far. Yeah, and we're working one of our other roadmap things is with ACS, we want to make it easier to... We're going to do kind of reports, trending reports out of the Compliance Operator so you can see changes over time. We'll store data so you can see trends. And then we'll also be able in ACS to do workflow through the ACS UI. That's awesome. You mentioned earlier something about Falco. Is ACS working with Falco or looking at a great Falco at all? The runtime behavioral analysis in ACS, I believe is different from... Falco is a big project. It's got collector libraries and it's got its runtime behavioral analysis. So the ACS team is going to be contributing to the Falco collector libraries. Conversation is already happening. Right now the runtime engines, the behavioral analysis are not the same and so that's an area of conversation and collaboration and we'll see whether over time, maybe we get to a single runtime engine. Yeah, that'd be cool. No, the Falco project, it's a great project, really appreciate our colleagues in the open source community working on that project. Yeah. So I know we're approaching the top of the hour. I don't know if you have a hard stop or not, Kirsten. It's okay. I do have to go do a summit, some summit planning. So I have a little bit more time but only a little. No worries. So for our audience, if you have any questions, anything you haven't asked yet, please go ahead and send those questions into us. So it doesn't matter which platform you're on, they all come in to us here as well as get broadcast across the others. If there is anything that comes to mind after our stream or if you're watching this not live, feel free to reach out. You can reach out to me or to Johnny. I'm easy to get android.sullivan.redhead.com. But yeah, other than that, I've got, I think there's a couple of questions here. I did want to, so while you please, if you could expand on your question there about ODF encryption at rest, I'm not sure I understand your how cluster encryption without KMS statement. I'm not sure I understand what that means. And then I'm enjoying this, our hope nine and Christian and companies. I'm getting the kick out of this.  It's like, yes, secrets are so secret. Oh, so I did. Kirsten, you had mentioned earlier talking about security through obscurity. So I didn't know if you had any comments on that and our hope nine's made 64 here, you know, brought 13. I think that's yet another sort of little joke, right? Similar to the base 64. I mean, yes, people do it. It's of course not preferred. And in fact, oftentimes we talk on my team about you can't secure what you can't see. And so certainly some people do sometimes rely on obscuring something, you know, actually base 64 encryption for coob secrets is a good example of that. But it's really not particularly secure. So with with ODF, I'm wondering whether the question is really, you know, is does ODF, is ODF planning an integration with external key management systems? Is that what's being asked? Well, we just said that the docs are not clear. I know I can I can pick apart that. And one of the questions that I would have is is it capable of doing per PV encryption? Like can I give a using a KMS, can I give each PV its own encryption key so that way one, yeah. Yeah. So you know what? I think there may be some news on that in the what's next deck next week. And I will, but that might be something I need to check with our colleagues. My recollection is that we're not there yet. But but let's double check on that. You know, and and I will say there are partners, certified red hat partners who do that today. Yes, there are multiple and I'm sure there are some uncertified ones as well that can do it. Our hope nine, yeah, it's it's not what you don't know. It's what you know for sure that just isn't actually right. Who was that? security. Rumsfeld, you know, known unknowns, unknown unknowns and known unknowns. Yeah. All right. Well, again, so thank you so much, Kirsten, for joining us today. This conversation has been fantastic and I think our audience has enjoyed it as well. Security is something that is near and dear to everybody's heart. Whether or not we want it to be, it is near and dear to everybody's heart. Yeah. So, yes, Christian, thank you for plugging your show. I do want to highlight that Christian has a new co-host on the Get Ups Guide to the Galaxy. So everybody who's interested in that, please go and join tomorrow. Say hi and welcome. Welcome them to the show for everybody else. So we will be back next week. Johnny, I still think we haven't figured out our topic for next week. So sorry, Stephanie. We'll figure that out. Don't forget on the day after the 14th is the what's next session. And anyways, thank you so much to our audience. Thank you so much Kirsten for joining us. And Johnny, I will leave you with the last words. Just echoing what Andrew said, this has been an awesome topic. You brought a lot of color in context to security and the interaction from the crowd is fun because then we could have fun with it and actually talk about real stuff too. Thank you so much for coming on. And Stephanie, behind the scenes, as always, thank you. You're awesome. Yeah, pleasure everybody.


Early detection is so important in the treatment of breast cancer. The number one risk factor is age. As women get older, some feel they don't need mammograms anymore. They do. Please make an appointment today. It just might save your life. A new national project aimed at bridging the political divide in our nation is kicking off its first round of conversations in Kentucky on October 24th. We're so honored to launch Meeting of America and Central and Eastern Kentucky. And we hope thereby pave the way for the rest of the country to turn down the heat and find a way forward together. This area really made sense as a launch and to send a message to America that this is possible. This works. We've got data to show that already from pilot conversations and then taking it to the rest of the country with Kentucky leading the way as the model. Meeting of America's mission is to dismantle the years of political polarization by offering people the chance to openly communicate their thoughts with one another from the comfort of their home. Their hope is to create a more informed and accepting populace through open conversations. I think the most immediate and I could argue most important impact is right where we are with the people nearest and dearest to us because we are losing some of those relationships by our inability to extend grace to one another to suspend judgment and to treat people as people as opposed to enemies and threats. It's a chance to move forward together and carve the chart the path forward together again with those coming being the ones that can really decide that for our country. Meeting of America will be hosting online conversations from October 24th to October 29th. To get involved simply log on to meetingofamerica.us and select the conversation that you would like to be a part of. We can do this together. Just bring your voice to one conversation for one hour the week of October 24th. For Mountain Top News, I'm Jameson Killen.


What are you doing here? What's that tiktok where it's like Like is it Anastasia? What are you doing here? No? That is gonna bug me out Lala, what are you doing here? No, no, no, no, no, no That is so funny. Where are we now? So we are in this building. We couldn't have done that. And we're in this place called Menophen. Which tries to be Ukrainian. I don't know how we're going to do that but the things that come up in it all. Yeah, so for those of you who don't know, that is half Ukrainian, half German. Um, how cute though. Very nice coffee shop. We've just ordered some breakfast. Um, ham and egg omelettes. What we off like was at 6am, so if we're a bit froggy because of that, but I've got a latte to help me off. And we're going to have lemon and half cheese. It's like a brunch at the moment. Yeah, yeah, yeah. Mix your soul. To be fair, I think when you look to London, it's so cheap, right? Yeah, this is like 15 euros. Yeah, 14 euros. But like, and everything is on the plate. Yeah, like a croissant, eggs, toast, ham, cheese. Yeah. So anyway, we'll show you where the breakfast comes. If it tastes good, then we'll add it to our little Elizabeth recommendation list. Yeah. Guys, this actually looks amazing. Honestly. It really works. Yeah, and they're really nice and accommodating. 15 euros, this is incredible. Like, I couldn't have the fruit because I'm allergic to berries, so they gave me extra ham. Very hot. It's ham. Honestly, look at mine. That was so good. 10 out of 10, guys. Yeah, yeah. So, we first placed, so far, the successful Manifest Cafe in... Wait, where are we? We're doing some sightseeing. Here's one of the sights to see. Great place. We can lie. What? I do think we should do a sightseeing bus tour. Just... no, you've seen it all. But I want to go to that castle. We could go... oh, a sun. The sun, you guys. Give me a time. Guys, we were saying that we left our sunglasses in the hotel because it was raining and now it's sunny. Also, I want to do an advertisement over here. I got this Milly umbrella from AliExpress. It's incredible. I'm glad it actually is really helpful. It's so small. It fits in my bag. It was £3, so AliExpress. AliExpress. Bring us just some more, please. Let's all be asked for. We don't care who it is. AliShmali, who cares? I don't even think they'll take you to St. John's Woodland or St. Mora. He keeps dreaming big.  Do you remember when we spoke about all this and now it's actually true? There you go. We spoke it into existence. The universe is listening. Are you listening, universe? We're listening to you. Exactly. We have high, high hopes and ambitions. And we're trusting you. It's called Browns Avenue Hotel. I feel like in the city centre of Lisbon. It's kind of like Avenue Montana of Paris, right? That's where we're off of. Because all of the main road is like Prada, what else did we say? Louis Vuitton, all those designers, Van Cleef. Yes, I was thinking of it. I had to remember the rest. Don't worry. This is the bathroom. So it's nice. It's very nice, bright, airy. And like all golds and just really aesthetic. And the bedroom is really just aesthetic vibes too. You don't need to run out of the shot, don't worry. No, I want you to see the full. I've already done it. I've done it. So I feel like the bedroom is so aesthetic as well. It's gorgeous. Really pretty vibes. I think we're really happy with this hotel to be on air. Also, I love this book. The sneaker one. I can't lift it, it's so heavy. I just can't lift it. Should I lift this up?  I did it on purpose. I did it on purpose so now we can see it. Oh my god, this is like hip-hop jewelry history. How cool is that? That is very cool. See, it's just the little details that I think. I think also having books in your hotel room is such a cute idea. Books we will never read. Part of one. I mean, the sneaker one might just be pictures. Probably is. Us tonight in bed with a glass of red wine. Yeah, we love it. Look at those. It's just all the little details. We had such a nice morning so far. We went to that manifest cafe which was lovely. We walked around town a bit and then we went to the shopping centre and did some shopping. Do you want to show the vlog what you got? Okay. Do a little haul. Okay, which one is which? Okay. Give us a guess. I wanted to buy more but like... You actually have done really well. Next time. So I was like, I want colourful sets. Whether they end up with a navy top. I guess it's a colour. It's not black, is it? No but it's got the white detailing which is really in right now. I thought this is really cute. It looked really nice on as well. Thank you. And the cup was good. Yeah, that's it. Yeah, we love this guys. This one is like a BBL jacket. Guys, this is the dupe for... Put it on so everyone can see this. It's literally the dupe for the Lululemon jacket and it's 22 euros. I have it in white and I was telling Nat, like it's the whole reason why I wanted to go to Osho is to get one of these because I'm obsessed. And I've also picked up that same jacket as Nat. Look at that. Look how nice it is. Really, wow. The body is budding. It's so nice. I love it. Okay, your turn. Let's say I hit a bargain with this one. This puffer jacket was on sale and it was 1999. I love how we've got to say that. Nat used her Monzo card so we got like really good exchange rate other than unlike me who don't get good exchange rates on her bank. But wait, how do I close this? It's a double zippy one. Look at that. I just feel like it kind of sits in the right place. Yeah. Love it. Give it a 12. So cute. So nice. You can tell why we've ended up shopping because we just sat here complimenting each other. That's the one, babes. That's the one. You have perfect taste. Get it in every color. And then I got these Pilates socks. Oh, you've got to get these or did you decide not to? I've got to get my from Amazon. Yeah. But they are really nice. 799. And then I got the same jacket as Nat. And then lastly, these are definitely a dupe for the Lululemon flares because Saina has the Lululemon flares and she lives in them. And they were so nice. These are the Osho ones. They're really cute and they were let's see 25, 99 euros. So much for the Lululemon ones. Literally a fourth. The Lululemon are nearly 100 pounds. And guys, Osho for me is tried and tested quality. I bought a bunch of stuff in Milwaukee. If you guys have watched my Milwaukee blog, you would have seen. And they are so soft. They really don't get ruined in the wash and really nice material. So if you guys have an Osho in your city, there's one in London in Stratfield. Stratfield Westfield. You should check it out. But anyway, we're going to shower. We're going to nap a little bit and then we're going to wake up and we will pick you guys back up. For dinner. Dinner and drinks. Dinner and drinks. Guys, I'm wearing my new puffer jacket. I love it. We tried eight different restaurants but Italian because we're craving it. It's awful dark. Let's go for dinner. Oh wait, this is the thing that we like. The mirror that my coat and titty is. We'll do it when I come back. But vlog, you kind of get the vibe. My top is really cool. I can't, I can't. I mean it's not like that Uber's outside waiting but look at that guys. It's very cute. Who is she? And that's giving. She's giving. Look at that booty. Oh yeah. It's got to do a little snappy snap. She's our content between them. Very nice. Don't forget to work out afterwards. We don't want to be home. If she sees mine.  What's it called? An Almond Mom.  Oh wow. She doesn't eat, she doesn't sleep and she doesn't drink. Seven days a month. Oh wow. She's cranky. Like this right now will turn into a cry mom.  Right I'm just going to Instagram. The food does look great. The starters were incredible weren't they? Lovely. Yeah, it's so nice. What? Good morning. Today is Saturday so it's the next day. Nat and I had a lie-in so we woke up at around 10.30 well 10, 10.30 and now it's around midday. We're about to leave now. I think we were obviously really tired because we had such an early flight yesterday and we did kind of soldier through and went out the whole day and stayed out till around midnight so yeah we just needed to lay in bed, rest and recuperate and fully be relaxed and recharge to enjoy today. But nonetheless we're good to go now we're about to leave. We're going to go and maybe grab a coffee and then start walking around. I think we're going to ride the tram. We want to see Bellec. I want to see Pink Street. I'm sure Nat does too. There was also a square that I went to last time I came to Portugal which is really pretty and it's got some shops around it so we can go there and the high street that's here as well would be nice to see. We might leave that for tomorrow if it's too much to do in one day but yeah we're excited for another exploratory day. I feel like my colour scheme for this trip has just been like almost browns and news but I'm going to wear this brown it's like semi sheer but not fully sheer top long sleeve really comfortable material and jeans, old Zara jeans some of you have asked me for Instagram my sunglasses are the specs and I'm just going to pair it with my Nike Jordan trainers for a cute little street style look. Show us your outfit of the day giving it's giving it's giving You look really nice I'm wearing the specs I'm wearing naps jacket Wooo You know I actually have my actual camera I probably should put that up There we are Let's go Oh I can wear it I was like Nat I've been to this Starbucks No thank you I was like Nat I've been to this Starbucks It's the biggest one in Europe It's incredible I've got a whole bit in the middle how they roast the beans and everything and Nat's like Nessa she's like going along with it and everything yeah I walk in and it's a station Starbucks and she goes to me are you sure you're not talking about the one in Milan and I was like sorry guys my camera cut off but yeah long so short I made her walk into just a normal station Starbucks you know yeah this is so nice gorgeous this is like I've been to this square before have you guys watched my Portugal vlog from like 5-6 years ago I came here with my aunt okay it starts raining again we should get your little pics that's what I'd say we have 2 minutes take some nice pics and it's raining again it's raining it's crazy look at the way you're holding this I'm gonna be a good mother I just realised I'm wearing your scarf here you go I'm wearing you some glasses here we obviously guys we did a little Swaparoo but this man is looking at you I've got my double chin right now it's not in full effect okay Swaparoo back and that's how we've got some variation in our yeah that's what we're doing we've got a Swaparando accessory change of bar we're going to get on tram 28 first of all the route to get there went through a quiet edgy area it went through a really like like creepy area not a fan and then the queue was like maybe a 2 hour long queue to get on this tram and we're just like okay it was first of all just not worth it but second of all it didn't feel safe that area did it and what's funny is it's just one road behind the main bit but it was a completely different road weird people approaching you they were approaching you to the same things it was just not as nice we came back to the main square which was lovely we've hopped on a yellow tour bus and it's going to take us to Belek Tower and then after that there's like a cathedral so we'll do a little of these stops and then we will get lunch and then maybe we'll go to a little shopping tour then go back to the hotel and get a change for dinner and stuff we've got to try some local cuisine she's saying she wants to have peri peri chicken whereas I was thinking more like seafood I want octopus I love octopus obviously that doesn't like seafood and you would not like octopus if you don't like seafood you would not like octopus but the octopus in Portugal is incredible and the food with the seafood cuisine is so good so we're going to find someone that has a bit of both maybe with a tapasí paste I saw on tiktok there's one by the port where the Belem Tower is and it's under by the water I don't know if I'll go over there we can check that but the weather's been really bad today suddenly it's raining suddenly it's raining so I'm kind of glad we're inside the bus and the worst thing is it's not raining we're standing in a traditional rain it's clearly not it's clearly raining dark trance apple especially with italian obica that's true that sounds Spanish don't it yeah a bunch again good morning I look like I'm in the matrix resin shine it is 10 26 this is the earliest we've left the hotel since the day we checked in we're going to grab some breakfast well I want a coffee now and we're going to the place next door to where we had dinner yesterday exploring hashtag variety yeah at least it's an italian breakfast honestly considering honestly we did not plan on having italian last night we really wanted portuguese we really thought the restaurant was portuguese the name was just solid really it sounded portuguese oh spanish at least it wasn't hopefully today for lunch we'll manage to find some yes we will obviously guys Nats ordered herself pancakes and she don't want to feed me she don't want to feed me girls are eating I ate all of your food last night and my own so maybe that's why I'm not that hungry right now yeah yeah yeah we asked what the jam was and it was pear and orange orange and peanut juice orange and peanut jam green that content girl girl get that content I mean there's definitely no ginger and chia seeds here jesus there's no chia seeds here no we imagined it is literally this long I don't know if you guys can tell but it looks really pretty but it's not a whole street is it it's pink alley it's like an alley yeah I think it's meant to be faked for the background no it is really cute it's cute though I'm happy we went I'm happy we've seen it not doing it again when they're done okay wait let's get an Uber we'll do this with all the hands until you're listening to another day take care goodbye


Thank you so much for having me here. This is one of the most kind and welcoming groups that I've gotten to be a part of, and I feel incredibly grateful. So thank you for having me.  But before I tell that story, I want to talk about autism for a moment. And the reason I want to talk about autism for a moment is because I am autistic. Did you hear that? I don't have autism. I am autistic. And that difference is really important to me because autism is a neuro type, not a disease. Autistic people, or at least the majority of autistic people, and let me stop right there and be clear that I can only speak for this one unique human being in my experience. But the vast majority of autistic people are not looking to be cured of something. They're looking to be accepted. They're looking to be understood. They're looking to be accommodated. They're looking to be relieved. Autistic people experience a wide spectrum of disorders. Often disorders dealing with integration issues like sensory integration or spatial integration or social integration. And autistic people are rarely disabled by autism itself, right? Autistic people are most often disabled by the environment around them, right? Just like how most people are disabled, not by themselves, but by the impact the world has on them, right? Let me give a quick example of this. In my house, we have one of those robot vacuum cleaners. You know, you press a button and in the middle of the night it goes off and cleans all the floors perfectly through some algorithm that helps it reach every floor on the first floor, every room on the first floor, and it's amazing. But the first robot vacuum cleaner that we got operated at such a frequency that the moment you turned it on, it instantly sent like a laser straight to my brain and it instantly sucked 100% of my attention. You would turn that vacuum cleaner on and somehow the frequency it operated at took me completely. Took me in such a way that it rendered me incapable of having any other thought at that moment. Incapable of understanding anything anybody else is trying to communicate to me at that moment and certainly incapable of communicating anything else because the frequency of that robot vacuum cleaner had my brain until it was turned off. And then it released me and I was slowly able to recover. That frequency of that robot vacuum disabled me, right? But worse, the real truth is, and this is real, the vast majority of vacuum cleaners actually have a speaker inside of them that amplifies artificial noise. Did you all know this? Right? And the neurotypical people like the sound of their vacuum cleaners working so much that they hear the sound on the floor.  So there's a speaker in there literally that turns the volume up. So that frequency not only disables me, but that frequency is made extra loud to like extra disabled me, right? Now in my case, I happen to be married to this like amazing Brainiac woman who like went on to Reddit and read long enough to figure out that all you have to do is remove 17 little screws and in the way back left hand corner, there's a little red wire and if you just clip it, 66% of the volume goes down. And the robot vacuum cleaner is no longer disabling, right? Now, vacuum cleaner disabling is not a very big deal. I acknowledge it's not so horrible. It's not really awfully disabling the vacuum cleaner. I get that vacuum cleaner is small. But what's big for me is panic attacks. Panic attacks are really big for me and they're the worst. They're the worst thing for me. I know a lot of people experience panic attacks, people of all sorts experience panic attacks. We know that feeling right of like your heart starting to racing up and your breath goes into like panic mode and you start to feel overwhelmed, right? Your body heats up. We all know this feeling. For me, this feeling is really, really bad. For me, this feeling is if I'm like dropping down into the sea, like into the ocean and it's getting deeper and deeper and it's getting like darker and darker, it's really awful. As it gets darker and darker, it's like the water gets thicker and I get deeper until I'm all the way finally at the bottom, but when I'm at the bottom I'm surrounded by like seaweed that's taller than my head and it's dark and it's thick and it's all around me and I would do anything in the world to not have to return to that place again. It's horrible. I've been going there my whole life. For autistic people, panic attacks are often more severe and the reason they say this is because many autistic people lack interoception, right? So interoception is when our body has that like sixth sense, right? Like our body is talking back to us. Our body tells us really important things like, hey Murphy, you're kind of have to pee soon so you might want to start to make your way towards a bathroom so like in 20 minutes or so you can take care of that, right? Or like, hey Murphy, you're starting to get really hot.  You might want to like regulate yourself a little bit but I don't hear my body tell me any of these things. I don't really have a great ability to listen to my body in order to a lot of autistic people which means that you don't feel the buildup of the panic attack. You don't feel it coming. You don't do the things you need to do in order to avoid it coming because it just comes and then all of a sudden you're in the middle of the ocean underneath all of that seaweed and it's just absolutely awful. But I noticed something about floating which is the more that I floated the more distance there was between my panic attacks and the more that I floated the less severe my panic attacks were and I think I know why and that's because of what happens when I slip into that float tank, right? When I'm inside there and it's silent and it's dark, it's just me, right? It's just me. There's nobody else there. It's just me. There's no context for anybody else. I'm not seeing myself in the context of any other person. I'm not comparing myself to anybody else. I'm lying there. It's just me and it's dark and it's silent. All my muscles are at ease, hear my heartbeat, right? And I hear that heartbeat and it might seem so obvious but when I hear that heartbeat I have the epiphany, that's my heartbeat. I control it. How fast it goes, how slow it goes, I actually control that. It's mine. I own it. My breath in that float tank, I can feel it. I own it and your eyelashes, right? Sometimes you can hear them opening and closing and I had the thought that my eyelashes make sound when they open and close even when I'm not in the float tank. Maybe just maybe someday like the idea that I could be walking down the street through like the loudest of construction and my eyelashes are like making noise as they open and close and maybe someday I could be able to hear them. Maybe because I'm so in touch with my body and what it's saying to me. So I floated more. My panic attacks became less often, right? And then COVID, right? COVID happened and because of COVID so many things changed, so many businesses changed, the float center was changed dramatically. I had my panic increased dramatically and up until COVID I had the most perfect floating situation. You see I had found this hair salon on the northwest side of Chicago that had two Samadhi tanks installed in their basement by Lee and Glenn Perry themselves in the 80s. And these two Samadhi tanks are still being ran and operating are still in great shape and upstairs are 10 women who rent chairs in this salon who have absolutely no idea what this weird thing happening in the basement is. And the tanks weren't used very often so I was able to let them let me float untimed. And so now I had these amazing Samadhi tanks and I could float untimed and I was floating way more than once a week and floating for way more than an hour at a time and it was perfect. But about three months into COVID those Samadhi tanks got sold in order to pay the rent on the salon upstairs and so I started going to Elemental Float and Cryo which was an amazing place owned by a friend of mine which was also closed to COVID. It was just about this time that I found myself in Boston visiting a really good friend and I was staying in my friend's coach house and the first day I got there I realized that Float Boston was literally two blocks away. And so I booked floats not just one but seven I booked seven floats in a row while I was there for that week because I could and I had the time and why not. And I floated every day for seven days at Float Boston which by the way perfect. While I was there it just became perfectly clear that I needed my own tank. I had to float untimed I had to float more often it was the thing making the biggest difference in my life. And so I began the journey to my own Float tank. Took me about 60 days and $3,200 all in I rented a minivan I drove to Cleveland I bought a used inflatable Zen tank from a retired firefighter that tank had helped his wife fight gout and now he was selling it in order to fix up his Harley. And that tank and I went back to Chicago and through lots of work and experimenting and rows of thermal curtains and electric heaters set up to Alexa timers that go off perfectly at 4.30 in the morning so the temperature is just so outside the tank for me to just slip in every single morning. And it makes all of the difference because I'm learning to listen to my body.  My body tells me to get out of the sun and I get out of the sun I'm learning to listen and I'm learning to respond. The float tank is helping me understand my own body and take care of myself. And when we can take care of ourselves that means that we can take care of other people because none of that is actually the real story. The real story is that about a month ago now two months ago really my amazing father died and when my father died I was immediately overcome with like grief and an immense feeling of responsibility that my siblings and I would now have to figure out how to care for my mother who has Parkinson's who my father had been caring for who I loved so deeply and that sense of responsibility was overwhelming. But what I'm really here to report is for about two months now I have been at my mom's side nearly every day helping her, listening to her needs, responding to what she needs and getting both of us through it together because I've been floating every day I've been listening to my own body taking care of myself and now in a position to take care of others and for this I am incredibly grateful.  Thank you all.


good morning everybody from center point Iowa right diesel didn't know you returned your camera on me man what you ready what you ready so good morning you beautiful person you we're headed from Iowa to Mississippi today where we're gonna stay for a reset so I'm gonna stay there for my full 36 hours which is two hours longer than the American reset I understand that and I know you know that but I have to say that otherwise I get all the comments saying resets are only 34 hours trucker Josh where I'm from we have to stop for 36 hours so I just stop for the 36 so we're gonna go down there we're gonna find a good safe place to park I'm gonna get through st. Louis today a little iffy about we'll see what happens I'll keep my eye and my ear on the news and stuff see what's going on there and if we have to avoid the city we have to avoid the city but I really can't afford the time I need to go right through so hopefully no highways are blocked or anything let's let's find out what I let's see what happens all right all of you me and our windshield bug gut buddies so it's right now hoping not to looks like traffic is moving pretty freely so far today's been a good day it's hot outside it's about 30 to 32 degrees Celsius it's around 90 Fahrenheit got a few hours ago okay buddy you only get in front of me you got a giver because there's someone right beside me you need to speed up and get in front of me okay or you can just wait till that guy pass me there you go see I don't get that you have this huge on ramp that on ramp is designed for you to get up to highway speed before you hit the highway so that you can merge with traffic already on the highway at 45 mile an hour down traffic and getting mad when traffic won't completely slow down to let you in speed up right diesel universal thing both countries people do not know how to use on ramps by the time you hit the highway you should be doing the same speed as the traffic you want to merge with but you know this anyways here we are st. Louis can't really tell because it's apparently buried in a forest we're going through the city right now keeping our head down well fantastic I don't want to jump to conclusions but traffic's at a stand still on the south side of st. Louis here I don't know why I mean I have my guesses but that could be wrong I don't want to jump to conclusions like I said oh boy I hope this isn't what I think it is well I wasn't waiting for that mess to figure out what that was so I took the first exit and I'm taking a little bit of a well it's not a shortcut I'm taking an alternate route a detour as they say a detour diesel so what was this this was Missouri wrote 21 and we're taking it down to Missouri 141 and that's gonna take us over to I-55 south so we can miss whatever's going on in the freeway there in st. Louis I know you were hoping that I'd show you I have no idea what it was maybe it was just an accident very well could have been a whole group of people standing in the middle of the road throwing stuff at vehicles so I don't want to get my truck all broken and damaged I just got my window fixed I don't want to get it smashed out again so we'll just go around whatever's causing the causing the traffic jam how about that we'll just play it safe 300 meters turn left on 101 41 hi hi Karen I double-checked your work before we went here so otherwise I'd be questioning you a little more she did try to lead me down some residential streets she got all mad that I wasn't taking the original route she wanted me to take I mean I'm the boss she's got to get that through her head but is what it is right diesel diesel you sleeping through all this this is exciting man this is exciting st. Louis st. Louis never taking this route through town before actually I don't go through st. Louis that often so it's always a little exciting when I go through towns and cities that that I haven't been to in a while what are you doing parking here what's this all about I gotta go all the way around you all the way back in here you know how inconvenient it is to change lanes I'm just kidding I'm just kidding but it is sure inconvenient for some people because oh some people make a big stink about it how dare you make me change lanes I know moving your finger half an inch over here is very hard as well to signals man kilometers 300 miles left not as far as I wanted to be say that much dodge that one annually so I can get a little bit more momentum here if I let this automatic transmission shift for itself it really doesn't know what momentum and physics are it's just faster if I shift them myself the guy's nice enough he's letting me in here nice of him after going that way now to let's get some momentum down the hill it's all about momentum right momentum momentum momentum signal device activated there you go there you go you see you see there you go I left you three more lanes to use and kick her back into automatic there you go that's all I had that was full power zero to sixty in what five minutes we're not even that heavy I'm probably sitting out with sixty five thousand seventy thousand pounds gross I mean that's heavy compared to these little three thousand pound cars but St. Louis we can stop stressing out about that city everything's fine now we got go all the way we've got to go down the rest of Missouri down the eastern side of Missouri here we're gonna enter into Western Tennessee or is that Kentucky no that's Tennessee slip through Tennessee and into Mississippi who's there diesel wow what do you mean who's there somebody there I was about to lay down don't panic me like that man serious business who's there these who's it who's there you better not be crying wolf man I'm telling you do it every day pretty soon you're gonna say who's there I'm gonna be like no I go with me thank you for protecting me diesel diesel actually gets really vicious I had a guy walk past my truck here and I don't know what he was doing back there but he's walking I guess he went for a walk when right past my truck and like I'm right on the edge here right so diesel just starts freaking out freaking out hair standing up on his back he's just fangs or berries just drooling off his fangs what is going on and there's a guy sitting out there looking at him smiling obviously a dog lover he had a dog with him as well but diesel didn't know that all he knew that this guy was getting way too close to the truck right diesel you're such a good boy good boy so I had to go there and give him a good give him a good pat on the head that's what he's supposed to do he's my protection on the road I could leave these doors unlocked and no one would ever get inside I can leave the windows down and just leave for like an hour or two and diesel would just sit there at his post and never let anybody close I'm a shy guy man but you always got to be scared of the quiet guy right I think you got a message was that mom no it wasn't mom but yeah it was gonna be scared of the quiet guy right don't mess with your truck man see my truck my home stay away he's just on guard he's got his ears bent back now to listen to me because I'm talking to you guys he's on alert mode right now diesel who's that who is it who's that who's that you gonna guard the truck who's that I don't know who you're talking about man I don't see anybody you're a good boy good boy I'll stop messing with you now but thank you for protecting the truck I appreciate it but you're a good boy not everybody had to guard weasel man you're lucky all joking aside though he is a pretty fierce protector of this truck I'm not joking I have to do is just walk up to the truck especially if I'm not in the truck he will freak out that's what he was trained to do right diesel good boy man's best friend right here we go into some pretty sketchy areas and you know these days the sketchy areas are becoming more common so as we roll roll through the world roll across the continent I really like having them with me even if you don't mean any harm he will never let you get past the truck without at least letting me know that there's somebody near the truck you're actually pretty scary when you're angry good boy thanks for watching today we made it down to Corinth Mississippi or right nearby anyways I'm on my reset right now this is the next day just editing up some videos trying to play some farm simulator here but apparently my I haven't played this in about a month and it has to update so it's taking forever to update by the time it's finished updating I'm probably not even gonna want to play it but anyway I haven't haven't played for a while so I figured I'd catch up a little bit thanks for watching today's video the last weeks of videos have been sort of all blended together I don't know what to tell you we'll see you tomorrow


Dear students, in this topic we shall discuss the corticosteroid hormones produced by adenyl cortex. The adenyl cortex produces and secretes a family of steroid hormones which are collectively called as corticosteroids. These corticosteroids belong to three functional categories. Glucocorticoids, mineralocorticoids and reproductive hormones. First we shall discuss glucocorticoids. The glucocorticoids include cortisol, cartisone and corticosterone. These hormones have primary effect on glucose metabolism. They are involved in gluconeogenesis in the liver during stress, starvation and disease. Dear students, we shall discuss the role of these hormones in gluconeogenesis in detail. Glucocorticoids act on liver and increase the synthesis of those enzymes which are involved in the conversion of glucose from amino acids and fatty acids. In this way, glucose is synthesized from the resources which are present in the body and raise blood glucose level. These glucocorticoids also reduce the uptake of glucose by these skeletal muscles and other peripheral tissues. Glucocorticoids increase the blood glucose level by using body care resources. This means that these glucocorticoids have peripheral tissues which are involved in stress, starvation and disease. Glucocorticoids are essential tissues to provide glucose. These hormones also reduce the uptake of amino acids by the muscles. In this way, they increase the probability or availability of amino acids to be converted into glucose through gluconeogenesis. In addition, they also mobilize fatty acids from adipose tissues and put them in the blood where they go to the liver and then convert them into glucose through gluconeogenesis. All these mechanisms of gluconeogenesis are important in starvation and stress because they make quick energy available for the critical tissues such as brain. The end result of this process is the degradation of proteins and stored fat deposits. These students also play other roles of glucocorticoids in addition to gluconeogenesis which stimulate gastric secretions. In addition to this, they work as an anti-inflammatory agent which suppresses some components of the immune system or immune response and works as anti-inflammatory or anti-allergy substance. Dear students, now we shall discuss the mode of action of glucocorticoids. Like other steroid hormones, these glucocorticoids bind to specific receptors in the cytosol of the target cell forming hormone receptor complex which enters into the nucleus and results in the regulation and transcription of certain genes. Dear students, now we shall discuss the mode of secretion of glucocorticoids. Glucocorticoid secretion is stimulated by the hypothalamic corticotropic releasing hormone and ACTH from pituitary gland. These secretions occur in response to stress and starvation. In addition, the secretion of these hormones occurs in the form of diurnal rhythms, i.e. daily rhythms. As a result, these hormones are maximum released in the late night before the wake of the morning. At that time, the purpose of encouraging them is to mobilize the energy resources of the body which are required once they come out of sleep. Dear students, these factors help in the secretion of glucocorticoids. Now, we shall discuss how to regulate the secretion of glucocorticoids. When the secretion of glucocorticoids increases, it provides negative feedback. Negative feedback is provided to the corticotropic releasing hormone from the hypothalamus and ACTH producing cells of the pituitary. As a result, the secretion of CRH and ACTH decreases. This way, a negative feedback mechanism regulates the secretion of corticosteroids. Dear students, now we shall discuss mineralocorticoids in detail. The mineralocorticoids have an effect on mineral metabolism. They act in maintaining the concentration of salts and water in balance in the body. The primary mineralocorticoid hormone is the aldosterone. Aldosterone hormone is secreted under the stimulation of ACTH and angiotensin II. This angiotensin II is secreted in the conditions of low blood pressure and low blood volume. This high potassium concentration also stimulates aldosterone production. Dear students, we shall discuss the effects of aldosterone. Aldosterone functions in iron and water homeostasis. It enhances the reabsorption of sodium and chloride ions from the filtrate in the kidneys. The result is the raising of blood pressure and volume. The mineralocorticoid aldosterone also functions in the body's response to stress. Dear students, adrenal cortex also produces a third group of steroids that is the male and female sex hormones. These include androgens, astrogens and progesterone. The androgens secreted by adrenal cortex include testosterone, dihydro, testosterone, androesthenydeone, and dihydro, epi-andro, stiron or dia.