Well, hey everyone welcome to Tuesday tea so glad that you could join us today I have been patiently waiting for today's tea because I'm joined Once again by one of my favorite people in the world. Have their reading with plan or protect I approached Heather a few months ago about doing this tea and I'm so glad she agreed to do this Heather Thank you so much for joining us today and welcome to the Tuesday tea Thank you so much. I Thrilled to be well first of all just thrilled to spend any time with you and it has to be virtual unfortunately But I'll take it whenever and in whatever shape I can get it But really actually excited about what we're going to chat about today, too It's kind of a topic that I Struggle with so looking forward to talking it out. Well, and do you remember the Preface to this. Do you remember why I reached out to you about this particular topic? I Remember some of it. I so fill me in but I know that you and I had had a discussion I had just taken a little workshop on imposter syndrome because I truly do feel like I struggle with it and We are talking about one of the Methods or solutions that this particular Moderator had had suggested we use and I had shown you I the picture of what? was the outcome of that workshop and Yeah, but I'm remembering what was the context though that we got even on it Well, you had just started posting a video on my video and you were very very authentic and Vulnerable in that process. So it was a it was a culmination of things in your videos You were talking about Vulnerability and imposter syndrome while being vulnerable and probably going through the syndrome Anyways, it created a visceral reaction in me.  I was on video for the first time and I knew all of the emotions and the The physical feelings of doing something brand new for the first time. So anyways, that Is what made me reach out to you. I mean, I love talking to you same thing I love talking to you in any way shape or form But yeah, reaching out to you about that is really what I wanted to encourage Everyone else to try and do Because here you were trying something that was so foreign to you and you did a fantastic And I'm so glad you reminded me that because I Set out to do videos every Friday and I got four out No problem at all. And then I really so the imposter syndrome crept in and then I had My husband ended up going into a merge and spending a week in the hospital and then my daughter got Covid so so I missed a Friday. So I thought okay. I've missed one I have a really good reason and then the second Friday came that I didn't do a post and Well, I still have a good reason my daughter sick now, right? Then it just you know For me, I think it was I still could have I We've got us a whether my husband was in the hospital or my daughter was sick I still could have put out a video because it's not hours and hours of my life for those four weeks That I did manage to put out a post It was you know, 15 20 minutes I would think about what I wanted to say and then fire it off and I had made myself a promise I was doing one take I wasn't going to do it over and over and over again Whatever it was going to be was going to be in the one take But it did creep in in a very serious way Of why am I doing this? I am not qualified to be talking about this. Who am I to be talking about this? You know, why do I want to talk about this in such a public way? and and it really did it allowed me to take Some excuses some reasons that weren't huge And they became huge in my mind to the point where I haven't done the video since The third week of february and I had made it a commitment That I was going to do them every friday for the rest of the year. I wanted to look at Redefining success was actually the topic that I wanted to because I really struggled with that topic for myself internally is You know, I I had very large expectations for myself as a early 20 year old And I've had to really kind of unwrap and unpack What I was thinking at that point in my life and where I am now and how drastically different it looks um, and so that's what I started out to look at was you know That topic of of redefining success, but then that whole postured stuff came in and it really played with my head And actually the other piece of it why I stopped was I had asked someone for some feedback And it wasn't positive and I really took and it was let me say it was positioned as Constructive and it was absolutely came from a really good place From that person, but I took it so personally like and again the questions kept well. Why am I doing this? I'm not good at it. You know, I'm not you know Just all sorts of things that then just crept in so it's interesting That because I've been called out on that Just in the last Two days about you know, like why am I not getting back to those? What's my excuse now? What what is stopping you? This is something that you wanted to do um, and I have to say that it is because negativity and A lack of confidence crept in and I allowed excuses to take over so you know, so The research I've done on imposter syndrome and I want to ask you this question now before it leaves me Imposter syndrome and receiving constructive feedback. That's kind of two things that are almost battling We were looking for positive feed or we're looking for feedback And and helpful ways that we can improve But that lends itself to imposter syndrome and I heard this advice once That if the feedback you're soliciting comes from someone who's a couple steps ahead of you You can learn from it, right? And you take that feedback and you can learn from it and imposter syndrome doesn't creep in So I'm curious to ask if the person who gave you criticism if they are also showing up live on video They do in their professional life. Yes, and very much two steps ahead of me But you know, it was it It just I thought I was really proud of those videos and I was I was really engaged with what The comments were afterwards and but the other part of it was was I've exhausted what my thinking is And so then it became not so much, you know, I I had ideas about what I wanted to talk about But it was then I was going to have to start doing some work about What do I want to talk about this week kind of thing? And so it was just a combination but so powerful Uh to know that that's how quickly things can become derailed What I really want but yet that whole fear of being Found out and I don't know what found out is because in my mind it's big but in reality, it's not a real thing um, and so Yeah, very very interesting So when you were going through that, um, what Tactics did you use to kind of pull yourself out of it and remind yourself that You are worthy of a place on video. You are worthy of of sharing your voice What did you do to kind of pull yourself out of the imposter syndrome? Well, I haven't done my magic on that one yet because uh, I haven't recommitted to the video But I have gone. I mean this has been a cycle for me for decades Um, and I know um, I actually read a really powerful book The secret thoughts of successful women and it's by valeri young. Um, I believe she's phd Um, and I know valeri actually I met her in a master-minding group great lady. Um and she wrote this book and it was very much Talking about how women experience this how it differs from men it does show up in men for sure um And just about some of the solutions and so one of the things that I'm talking to other people so just like this like even just realizing that it's not just me right really there are so many amazing women and men who uh, I who have this struggle of not feeling adequate or competent or Have enough achievements that sort of thing uh to realize that you're not alone now She did say and I thought it was brilliant that you can't share your way out of imposter syndrome So, you know, you can talk all about it. You can't share your way out of it. So just talking is not enough. You've got to do some actual uh physical kinds of things and so um for me, I'm just constantly coming back and just claiming My abilities and my expertise and saying no, I am good at this. I am Extremely good at this I'm not so good at this and why am I beating myself up for not being so good at this, right? Like no one is competent and brilliant in all respects So why am I beating myself up for not being stellar in one area? um And and I think that's an important Check and balance to realize that, you know, I don't need to be the be all and end all on everything I have my areas of strengths um and The rest good enough, you know, it doesn't have to be the perfect. Um I think there's also just that perfect that notion of perfection is that um for me, it's interesting. I I've struggled with Really wanting to I don't think I want to come across as perfect, but I want to come across as smart intelligent um, you know, um accomplished um and It also relates to me physically Um, I tried it where I feel I am deficient physically. I try to make up for in other areas So it it does. I really constantly struggle with there is no one on the planet perfect Why do I think I need to be? Um, why why do I struggle with that? So, um, but you know, it's yeah How do you how do you handle it? Like do you struggle with it? Do you? Are you kidding me?  Um in this particular season for sure for me. Um So it's it's funny because I um, I so my blog post that just went out last week Which is why we're doing tea today. Heather is about imposter syndrome and I wrote that blog post about a month ago Okay And I wrote it before I launched Um, it was my second launch of my linkedin course. Yeah, so I was feeling okay because I was getting ready to launch my course um, I set a small goal, um, I was I just set a very relatable achievable goal Uh, because I didn't want to set myself up for failure. Yeah, and now fast forward. I've gone through the launch I fell short of my goal so I'm in this massive season of Imposter syndrome and now I'm trying to build another course and I'm and just it's just it's ripping me apart However, and you know, I I wonder if your um friend's book talks about this I'm also going through menopause and so I was talking to a couple of my friends the other day and A lot of my imposter syndrome is being compounded by the hormonal changes I'm going through Um, so when I have imposter syndrome, I am like Down I am so down. I like I don't even know if I can get any further down And for the first time in my life I've had to and this has happened Three times over the past six months where I've been so incredibly low That I've had to go hold on this is not me like I am a positive person I bounce back from I love failure, you know, even my launch when it failed. It was like, okay That sucked, but here are the things that I can fix for next time Um, but then I fell fall into these depressions and imposter syndrome. It attacks me so hard when I'm down there Um that it's it's been sometimes like days before I can pull myself out in the fall It was about 10 days this past season. It was about three days where Like there was there was nothing good about me, you know, and you've been there. We've all been there I know I'm not alone, but there was nothing I have zero skill. I have zero talent I I'm no one is going to hire me ever like those are the thoughts that Invaded me And when I figure it out other than the hormonal imbalances, I'll let you know um My blog post I I took a different I guess angle on the blog post is I Outlined it with things that we actually say to ourselves And one of the quotes that um Is in the post is about, you know, I don't feel like anyone's going to care about my story um, and I know the truth is You're right Probably not everyone is going to care about my story But my story might help one person and that's reason enough to share the story Um, so I think people who are suffering from imposter syndrome to your point They have to be perfect and they have to please everyone and they have to be everything to all people But if you're just somebody's Inspiration for the day for one person That's enough. That's that's your service. And so I I'm really trying to come back to that that no matter how Clumsily I go through things even these live videos and yeah Video, but I keep doing it because I know at least one person will get something of value out of that That will help them with their day their career their journey whatever it is that they're on Um, that's a hard thing to remember When you step up to the microphone like you do on fridays, you know, you have those thoughts Well, who's going to listen to this? Who's going to care? Trust me? I care. I care so deeply about what you say in your videos ironically because I'm also redefining success in my life after 25 30 years Divergent paths like our paths are actually leading away from one another in our because we're both in the same industry But now we're both kind of going this way But yet we're so parallel in how we're Approaching the next season of our life. It's quite fascinating Well, I think a lot of people in our industry, which is the meetings and events industry We're drawn to because we are a certain personality type, right? I think we are the the orchestrators of so much and the creatives and the you know the brilliant minds behind events and You know, you don't get to create these Experiences and magic if you have a laissez-faire kind of attitude, right? We are a certain level and personality type that we are the type base. We are the overachievers We are the the dreamers. We are the visionaries that that pull this stuff together and you know We don't aim for Good enough in our professional life You know for events it needs to be as close to perfection as you can get and that lends itself I think to people that are drawn to our industry And so it's it's interesting you say that I mean we are going like you're going into the marketing and branding and And I don't know where quite I'm going. I hope to stay in the industry but I am actively working on a plan b if I if you know if there isn't the capacity for me to stay but And I think that's also part of this, you know overachiever kind of thing that you know I grasped the the concept of going back to school full-time At my lowest point was it the smartest decision? Maybe maybe not right But it was made in a in a Hail Mary like oh, I've got to get out of this instead of just being able to sit there and And and be content with that it was well. What can I do? What can I do? What can I fix?  So You know, I think yeah But I I think we're also very much women that like to achieve and like to be of service and And constantly doing is part of of part of that so but yeah, I think the I think imposter syndrome for me I Actually that so I'll share with you the the methodology that this gal shared which has been very powerful for me She she related it to imposter syndrome kind of shows up as that person that Kind of always was your nag, right?    No, this is not true What I am thinking what I am feel like I'm inadequate for what I feel like I am You know, I don't measure up where I feel like I you know, fall short. That's not real Those are just feet, you know Ideas that are in your head that you need to get rid of so I named mine Actually the I wasn't very creative because the instructor Used the example of Ursula from the little mermaid and I mean you if you can picture Ursula She's like this large is an octopus. I don't know what she is You can see the bright led lipstick. You can see the spiky kind of blondish gray hair You can see the kind of the chubby fan. I'm like, oh my god and and it was The image that she gave was she chose Ursula because those long eight legs kind of wrapped itself around her And kind of took hold of her right and not in a good way That it really just kind of gets a hold of you and doesn't want to let you go unless you are physically doing something to release it And so I thought well, I'm not going to look any further. I can identify with Ursula And so I I'm going to tell you I'm going to show you I have Ursula that shows up And I have her printed out Um, and it's right up above my screen Because every time I try to like go down that path. I think no no no no no hold on I am good enough. I do know my stuff I do know where I'm strong and I'm learning where I'm weak and it's okay to say I'm weak in some area Um, and so at the I call her my inner critic And when I start to feel it's like no Ursula. This is not true. This is not true. I can do this Um, so anyways kind of uh, I thought it was just I was meant to take that workshop that morning it was like an 8am workshop and uh, you know, but it was so powerful for me to Just start to rename it and to say no That doesn't need to take over. It'll probably always be there for me Um, like I I agree with Valerie. This is you can't really talk it out. You can't share it out Um, but you can learn to identify it and then mitigate it. So But anyways, it's kind of an interesting, uh Um, very visual and I am like when I see something I know it right and I I'm not a Um I don't see things in my mind. I need to see things physically and so for me It's just right up on the wall. Um, and I look at it and go, okay. Yeah, it's not it's not me You showed me Ursula before and you're right I think I was getting so hung up because I was going to find my Ursula. Yeah, Ursula is so perfect I don't think I'm gonna be able to find another Ursula. I'm just gonna put Ursula as well Um, so I move on to the next step and actually now Talk to Ursula rather than talking to the nameless faceless That's sitting out there. Um You you said something interesting that it has to be visual and Um, I think I think that's what I need to do as well because when I'm down There's nothing that's gonna pull me out of it But if I had a visual and I could identify in that moment that this isn't of me This is The imposter syndrome setting in maybe I can find myself rebounding a little bit quicker with those visual cues I found myself leaning on my vision board during On myself leaning on my vision board a lot Um, and it did help.  So, um, but I love the Ursula image So I'm gonna incorporate Ursula with my vision board and See if that helps. Um So I'd like to revisit when you got that criticism or you got that negative comments because And we both have kids And so I'm going somewhere with this we both have kids in a world where People are posting things online and and posting negative things online. You can call them trolls. You can call them whatever Um, you want but what advice would you have not only I guess for your kids who might be facing that online criticism But for people like me who like yourself You get maybe 10 15 20 100 positive comments But it's that one negative just one It's all it's and you fix you fixate on it.  You wake up thinking about it It's all you do. I mean I need advice. How do I get myself? Focusing back on the positive comments I don't know how you do it. I uh, but I do know I can completely and utterly relate Um, so as you know, uh, so in the events industry I speak about contracts, right? So the least sexiest, you know area of expertise to have in our industry. However I'm very passionate about it and I love to speak I absolutely feel no more alive anywhere else in the world than when I'm on a stage and I I love that and I I want that But I completely agree with you that when the feedback comes in I can look at all of the positive But I am like a laser to the negative And it is the negative that I dwell on over and over again And I constantly think well, what you know, what could I have done differently or why did they? You know, why did they feel that way and everybody else didn't like I don't say well, they're the outlier I look at them and then say okay. Well are all the rest of them lying, right? I don't look at it as the proof or the pudding is in all of the positive and the negative must be the outlier, right? And and I I I don't know I reached out many many times when I first started speaking and and to coaches and mentors people that that speak for a living and They'd say you just have to learn to disregard them You can't you can read them and let them go like you just have to let it's like well, okay that's easier said than done I must be a learned skill because I still I I actually think I find myself purposely looking for those negative. Oh, well, okay. Yeah It validates that I wasn't as good as I you know, I had hoped to be I didn't deliver and and that's a Bad spot to be because I think there are a lot of people that are gifted with They they see the positive and that's where they they live. They don't dwell on that negativity and I Yeah, I don't have an answer Lee Ann other than you know, maybe it is a matter of just becoming You know, it's interesting because I I've spoken now. I think 2015 16 was one of the first time I spoke it'd be interesting to know Now if you know if a negative comment came in be interesting for me to just sit back and see if I actually really do Dwell on it as long as I used to right I I think I still do I still will and I still do But I don't think it affects me as much or for as long And because I I think I also have a list of things where so for for me Um, I have a friend that reached out to me and asked if I wanted to be kind of accountability mastermind Well, I think of her as like an amazing guru in our industry I think of her is just you know way up and as a just on a pedestal I've put her up there and it took me a long time to really feel worthy of being Accountable masterminding with her Um, and she brought the idea up a couple of times and I would just kind of sluff it off and say Oh, yeah, that'd be great But it wasn't until she actually made the deliberate effort to reach out and explain to her to me Why she wanted to do this that I kind of sat back and went. Oh, wow. You see that in me I think of her as way way up here and I'm not worthy And yet she sees me completely different and and so Yeah, I think when there's examples like that like Being in masterminds where you realize that other people are struggling with the same thing But you're on the same par as them, you know When you when you hold your own ground, I think that's But it shows up in a lot of places for me I'm working on a on a set of contract reviews for a client right now And it's a planner that intimidates me. I guess going to put it out there And can I tell you that I am over What's I am trying to over achieve Like I don't in a lot of other cases Impress and I think okay, Heather get your head around this That planner came to me seeking what I know Why am I so worried about impressing that planner? You know because I'm constantly questioning What I do what I know How good I am at it, right so Yeah, it's it's an interesting beast It isn't it though like And we have story after story after story about how it presents itself You know your mastermind it presented itself there and then this meeting planner it presented itself there Like that's just in the past two or three months and it keeps showing up again and again But to your point and you said this at the beginning of the show You know what your strengths are and where you and what you're really really good at and those are the things you're really really good at Like can you imagine Like if If it was a skill that you were still working on and and the feelings of doubt that we would have Yeah, it would just like it would derail you for Days and weeks so I'm hoping that you're coming out of it Especially as you do these contracts and as you connect in this mastermind I think I think we still do right like it hasn't stopped me It's just that I need to constantly have this conversation with myself that You know because it is stuff that I love and I I As soon as I'm done one I want to start the next one and and But it's still just that internal dialogue where I have to just say no I know it and I you know I can put it out there and and this is good enough and um, I think the sad thing would be is if I shut down because of it if I stopped doing it, right? I think it's okay to deal with the with the thoughts But when they take over and you stop then that's when it's one It uh To me, I haven't stopped and I don't intend to It just makes it a little bit more of a struggle to do for me. I don't know about you But for me, I think the way that shows up the greatest is through procrastination um I truly struggle with procrastination I had someone say, you know Well, when you say it that way you're you know, you're invoking procrastination. It's like no, I I think my the procrastination in me is very much from I want to put off Not feeling inadequate or smart enough or whatever. I want to put it off until you know I possibly can't put it off any longer and then something becomes good enough, right? So it's it's that I I don't want to do it because I if I was to start a project early I would be so worried about perfection Um, that if I just put it off put it off put it off Then if it comes to the 11th hour and it has to be done It's done. Yeah, I'm I'm pretty much always proud of what I do, but it's good enough, right? It doesn't have to be perfect because it's just got to get done. Um, so I find that procrastination for me is is the way it shows up the most consistently Is that I just put stuff off? So I I'm not in a season of procrastination being my biggest enemy. I've been there in the past for sure Um, I'm in a different kind of season with a different kind of challenge. I think for my own imposter syndrome episodes But you said something super interesting that I think Everyone needs to hear we need to hear it on a daily basis is When we're creating something it never has to be perfect It it just needs to be good enough or we or we would never ship it ship the work And there's uh, the there's a book about shipping creative work that I just finished a few months ago Seth Godin is called the practice He's a marketing guy, of course. So I I've gobble up all his stuff um And he talks a lot about procrastination and imposter syndrome holding us back from shipping the work And and perfectionism from shipping our work But that's again what sets people like you and I may be apart from someone whose Stone cold fear will never ship a piece of work Because it has to be perfect. It has to be this it has to be that My best friend is actually like that. We have this discussion all the time because she's a perfectionist And when I say to her done is better than perfect. She's like, uh, there's no way that that is right So we have this interesting debate about Done and being done and being perfect Because I think it presents itself and holds people back from shipping their creative work And that's imposter syndrome, right Yeah, what what the story we're telling us then is You aren't good enough. You need to be perfect in order for this to resonate with anybody So unless it's perfect, don't even bother. That's just their narrative. We're telling ourselves Um, and that's that's paralyzing. There's people who you know so much Value in in what they have to share And they're just holding it back because it's just it's just too scary to put it out there So and that's what imposter syndrome does to us Yeah creative is so subjective too. If you if if you're in that creative field, it's so subjective what what is You know perfection to you may be, you know dastardly to another person But yet, you know, if it's if it's science if it's math if it's, you know Grammar whatever it might be There there is right and wrong with those whereas creative is very much your own kind of Interpretation of something and I can see where that would be Very in you know intimidating to put yourself out there To show a side of yourself that is open for interpretation that is not a black and white kind of You know, we know it to be right or we know it to be wrong Wow, that's uh, what does that person do for income? Hopefully it's not her job that is her cream Well, but but it is interesting because those types of people are very happy In their roles at an organization. They're not entrepreneurs, but they're at an organization Where there's a paycheck and there's certain hours that they have to meet in certain criteria laid out by Their boss, but there's no room in their role for themselves. They've carved out zero room in their role to try something new So meeting planners are not in that boat, especially this past year as they jump one virtual platform to another to another to another They're constantly creating. They're constantly learning. They're constantly trying new things. They're putting it out there They're seeing what sticks they're changing it up for the next time Like those are people that are continually having to fight imposter syndrome to get to the point where I'm Launching this virtual event and I'm using this platform that I've never used before but We're gonna do it. Anyway, and I love those people But there aren't a lot of people in our industry who don't have that creative freedom Um, and so they're they're kind of stuck um And I and I AV people again, I think are not in that. These are the people that um, so let's take this for example. I used to use zoom for uh, my lives And didn't like the experience. Uh, it just was just a bit clunky Um, couldn't really get comments back. And so now I'm trying stream yard. Well the first time I tried stream yard It was terrible like I I was like is am I live am I live? like it was um I even still kind of do that. I was wondering if you were live today, but now that I've tried it and like it wasn't perfect but now Now it's a better user experience, but there's a lot of people who Won't get off of zoom Nothing more to learn here. So we're just gonna keep using zoom and I think that's holding them back from Exploring all the other technologies that are out there. That's just one very small example of fear and imposter syndrome holding us back from Creating something new or exploring something new. We're adding a new skill, right? And you've been doing that all Long It's adding new skills and compounding on your strengths and that's That's why it made it saddens me to hear that imposter syndrome holds you back because you were such a role model for people Who who want to step out of their comfort zone and try something new and it's just fear holding them back And I hope they hear your story and see okay. Yeah, you know what? Heather's struggling with I did it. She's still like in full-time school at 56. Yes Yeah, like what the heck am I thinking at But yeah, you know, I think if the first step is the worst step or maybe the first step is sometimes the best step I don't know which way you want to look at it It's probably the best step if it, you know, when you when you go on It's the worst step because it's the hardest one to take But it yeah for me like Part of the evolution was I don't want to sit still. I don't do well You know just kind of not having I think we're drawn to this industry if we love pressure If we love a high threshold for work if we, you know I want to be firing on all cylinders all of that kind of thing and And the longer that we got into 2020 the more I found myself just literally Just kind of going. What am I doing? I can't keep going.  So in hindsight, it was, you know, uh, it was a really really good step And it just keeps growing like I my brain keeps growing and and So yeah, I think it's uh, uh, it's been it's been a bold move. Hi my I'm the oldest in the class, but uh, You know, I also look at it and I it's interesting because some of them are 18 So it's a college program. So some of them have come straight out of out of high school And I I look and I go, oh wow That's just not going to be relevant in life, dear Right. And so, you know part of me says going back you just have a completely different perspective when you've been through seasons of life And you think okay, really this is so petty so small and yet she's this gal's entitled to it because that's the stage at which they're at You just have a different lens and and you know, I let stuff go that some of them dwell on and I'm sure I kind of Fester about things that they think are irrelevant to so who knows but it's been an interesting thing to your point Taking taking going back to school at this season of your life You're so much ahead of the game because you've had that life experience and that's what someone had to remind me of the other day Um, because I'm at a certain age now and I'm trying to start a new career And so when a foster syndrome strikes a lot the the the talking head is that you're way too old to do that Especially in an industry That's dominated by millennials right now, you know branding and marketing is not where 48 year old gray haired woman should be hanging her hat So that's ageism is really what what tackles me but at the same point The lens I have about how to create a personal brand after doing it for 20 years in my former Career or my secondary career. Yep my lens on how on what works what doesn't work What things you should keep testing is different from the 25 year old instagram influencer, right? Completely different lens. I'm talking to a completely different audience But I have to remind myself every day that that 25 year old instagram influencer. She's not my competition She is not someone who's competing for the same audience. She's got a completely different Um audience with her material and with you it's the same thing that the types of jobs and the types of um industry Appointments that you'll get after this are going to be different than that 18 year old who's in the class beside you Yeah, that's that's very truly in and I think probably your life is like you can do the learning But they can't do the living like you you can make right like they can't make up for 30 years of living Yet they will but right now they can't they can't fake the living experience that you bring to it You you are all getting the same education um or the same, you know training or or whatever but you can't replace the life experience and and uh I think that's Yeah, and I see that play out in school and and and even just you know the wisdom to to be able to pull back or think about things and um, you know Sort out what's valid and what's you know, just the chafe. There's all those sorts of things that uh Come with with being older Well, and I find that presents itself with books Well nonfiction books at least for me is I don't think there's a few titles that I have that I have reread and different things in the books have Spoken to me in the different seasons of reading them and I'm finding that right now I'm rereading or I just finished rereading rework Um, it's jason freed and someone else. They have a website 37 something. It doesn't matter But it's very much about marketing and new business very much about the entrepreneurial journey and when I read it three years ago, um I was still in my role You know the my role at conference direct and I pulled different things out of it Based on where I was um at at that time That's what it was is I was in between going from helms brisco to conference direct and reading that book about entrepreneurship And now two and a half years later It's about this new journey and just different things are speaking to me in that book And so that's kind of that life experience or that season of life that we're in that different things are gonna Going to speak to us and resonate with us Um, I would like to talk if you have time About the video series itself and redefining success um because I'm in a space in my life where With this massive pivot of mine. I feel I have to redefine Uh success like from top to bottom Um, and I'm struggling with it heather.  I'm really struggling with my worth Because for the past 20 years, it's a bit all about my job all about Growing my business and I had a great business And then when covet hit not only did the business disappear But I spent more time with my family and more time in my garden and Really started to enjoy those things And so this whole perfect storm of how I redefine success has been top of mind Because prior to covet my success meter was solely work. It had nothing to do with my family my home Nothing and now it's my meters on the opposite end And I'm trying to find that happy medium and so I would love to know where you are at today with that whole redefining success and and and your questions and your challenges That is such a loaded question It really is and it's though I've so last year was really I was in a speaking program and coaching speaking coaching program and I really did a lot of soul searching. I'm trying to figure out what I think I've always felt that I could Actually, you know what and I'm going to say this and I'm going to say it publicly I wrote in a book. I was in a High-level mastermind group with three gentlemen in the states and they are all well well known people um And I wrote in the book one day in in one of the sessions that my greatest fear is dying with greatness inside of me Now that sounds arrogant as I'll get out when you when I look at it. I just I am I am So afraid of dying with not fulfilling everything that I could be I have had a feeling since as long as I could remember that I Was meant to do something great and part of me what I thought it was going to be Get out of university get out of grad school and I was going to go straight up the corporate ladder to the ceo office and honestly, I didn't even get I a year and a half in a corporate environment, but then I We moved and so It's just circumstances No blame anywhere, but we moved we moved out of Toronto into London I went back and forth for a year. I took the train down on a Tuesday came home on a Thursday It was ruining our marriage. And so I made the decision and quit and life never felt um I don't even want to the word is But I never felt like I well, I never got to a ceo I I never got to where I thought I was going to be And for years and I I'm going to say decades I felt like I hadn't measured up to my potential um And and so it's taken a long time a lot of work For me to realize that my little planning company that I started as a default. I was an accidental planner my You know, I'm staying at home with two kids and raising them and you know um Taking the good and the bad of that, right? We we often tease that we've saved for their therapy not for their education, right? It uh, You know doing, you know, I I did whatever was needed to contribute But I never felt like I lived up to the potential of who I thought I could be professionally Um, and it wasn't until actually my husband got really kind of angry with me and said You have done You've raised two kids that are very successful and great human beings You have had Employees for years that you helped pay their mortgages That allowed them to have the life still that they wanted for their families You have contributed professionally to the lives of 30 000 people Based on the number of named I always thought as well. I make name badges for a living He said no, you've contributed to the professional development of those 30 000 people Um that we made name badges for you know, I could I just always saw the short coming side of it rather than What it really meant to the other to the people on the other side of it Um, and it's taken me a long time to realize and take ownership and claim Yeah, you know what I did do amazing things It just wasn't the path that I thought I would take where I saw myself and so for me I got success in a in a dictionary or court is defined as wealth and favor and eminence And so I've had to I focused on the wealth and and I think you know, I've never had a big business Well, no, but I put my kids through school. They both have post-secondary education because of the business that I had I paid employee salaries I you know, I was able to go out one day and buy a kick-ass motorcycle for my husband You know, like it just because of the work that I'd done And it wasn't just about the paycheck or the the bottom line of my business and Um, I just felt less than for many many many many years that I it just wasn't I wasn't measuring up Um, and so for me this whole concept of success. I think I needed to do the work to say I I didn't have the success that I thought I would have in my 20s But I need to let go of that crap because I do have success I am successful and I will continue to be successful Because it's on the terms that are meaningful for me My my marriage my family and those that I love it doesn't have to be by anyone else's standards Um, and so that is the premise by which I was starting to unpack Why have I felt so? um Like I have so many shortcomings when really um, when I look at What I have done that those are great things and you don't have to do a lot If that's what you're content with then that should be success It's not what your neighbor does. It's not what your colleague does It's if you go to bed at night feeling good about what you've done um, you know that that should be enough and and I just felt into the trap of not feeling like I measured up and that I've been able to shift around so Well, please I cannot wait for you to get posting again on live Well, okay You were meant to be today because I just actually had that discussion saying, you know, I'm I with it with the speaking program. I I was kind of like, uh, you know I have so much on my plate and I again was giving myself the excuse um, so you've inspired me leon Because it's like, okay. No, I do need to keep because that's it brought me joy It brought me and I I want to be able to shed light on maybe somebody else won't take 30 years to get to the position that What I'm doing. I'm successful at or it's enough for me or you know It's maybe not where I want to be but I can learn to be content where I am because I am going somewhere else So you've you've done me a huge favor today Well, and I'll give you the piece of advice. I heard once About creating content because it sounds like that was holding you back. Yeah, absolutely Remember that repetition is the mother of all skill So leaning back on the content you've already created or the message you've already delivered We still need to hear it nine times before it actually makes A fingerprint on on our lives. So don't be afraid to repeat stories And don't be afraid to repurpose messages that you already have Because we never got it the first time sadly In the same way that you were still working on imposter syndrome 25 years later it take it's a process and so you are now part of that process for me In redefining success and I'm excited to hear your next message. So I cannot thank you enough I made notes while we were doing this so many what I call proof bombs This this is an episode that people need to hear You are such an inspiration to me.  You just let me know Uh, you you just you know, you and I met late in the industry I wish I'd met you 10 years ago because I when we actually did physically just sit down and have a conversation It really clicked. Um, so I I held you in such high esteem And it's been a privilege. I I hope you know when you said about the vulnerable I I've learned I think when you have a certain amount of experience in your life And if there's trauma involved, I think we learn to be vulnerable because that's where the healing is And I think if if we can continue if I can continue to be vulnerable and say the hard things That in itself helps me as much as it might help someone else. So thanks for the opportunity to be vulnerable and to share and to Yeah, let's just book a tea time in six months from now I agree. I agree. Oh, thank you to the point We could probably revisit this topic in six months and it would be a brand new episode with brand new tips things that we've learned over the past six months So maybe that's what we do And we just keep this conversation going because you and I are not alone and a lot of people need This message they need this inspiration and they need to know that they are enough as well. So Thank you Yes Thank you everyone for joining us for Tuesday tea in the show notes I'm going to put some of the resources that heather mentioned so you can find that in the Put yours too because I want to find yours too. You you mentioned several books Yes, I will I will I'm going to write it down right now re-work in the practice re-work practice right down now. All right Thanks for everybody. Thanks everyone for watching heather. Thank you again. I will be in touch very soon. Love you lots Thanks everyone. Bye for now


Today I'm going to be taking a look at the recent release of Sparky Linux. Sparky Linux just released a minor point release, version 7.2, and this is for their stable ISOs. Now Sparky Linux is based off of Debian, and Sparky Linux offers stable versions of their distribution as well as a semi-rolling version of their distribution. 7.2 is an update to the stable version, and Sparky Linux offers several different desktop editions. They offer XFCE, LXQ, which I'm pretty sure I've taken a look at LXQ in the past, and they also offer a KDE Plasma edition, which I'm kind of curious about. So today I'm going to go ahead and take a quick first look of Sparky Linux 7.2 KDE. So I've spun up a virtual machine here, and I've went ahead and ran through the installations for Sparky 7.2. It's a very simple installation, and it uses the Calamari's installer, so I didn't feel like I needed to capture that on camera. If you guys have seen a Linux installation with the Calamari's installer, if you've seen one, you've seen them all. The one thing I will say during the Calamari's installer for Sparky Linux, they do have log in without a password ticked on by default. I would suggest ticking that off by default just for privacy reasons.  I think that can be kind of dangerous. So first impressions of Sparky 7.2 is it's a very clean look. It's a very nice wallpaper, very minimal, a little bit of abstract art, you know, some geometric shapes with the Sparky branding. So I really like that the plasma theme is a standard light theme. Now, because this is based off of Debian 12, you know, the addition of KDE Plasma they're running is not going to be the latest and greatest. So actually let me go into the menu system and I'm going to go into the system category. Let's go to the info center. Let's see what version of KDE Plasma this is actually running. So this is KDE Plasma 5.27.5 using frameworks 5.103, Qt version 5.15.8. And the kernel is 6.1. By the way, it is using X11 as the display server by default. That's just some of the specs here as far as the software. Let me go through the menu system and actually see what kind of programs they ship out of the box. So they do have a development category. They have the icon browser as well as the Kate text editor. Kate is a plain text editor. Actually Kate is not really a plain text editor these days. It's become a lot more full, fully featured. It's much more of an IDE these days. So actually let me open a document. So if I open, let's see, can I show hidden files? What is it? Control H to show hidden files in the file picker? Yes, it is. And I'll open the Bash RC. You can see you even get some syntax highlighting out of the box, which is something many just plain text editors of course will not do.  So again, Kate has really evolved over the years to really becoming something quite special. Kate is, you know, honestly, if you want an IDE and you don't need the kind of customization and the flexibility and the power that things like NeoVim and Emacs and things like that give you, if you just want something rather simple, but still with some really nice features out of the box, Kate is a good choice. I get back into the menu system. There is a graphics category. We have Gwynvue, which is the image viewer for KDE Plasma. Let me go in here and see if it will tell me what version we are on. If I go to help and about Gwynvue, this is Gwynvue version 22.12.3. Close that out and get back into the graphics category. We have LibreOfficeDraw installed. We have Ocular. Ocular is the PDF viewer. It's your document viewers, what they call it. But, you know, it's typically for viewing PDFs. This is, again, Ocular version 22.12.3 as well. And finally, in the graphics category, we have ScanLite, which is a scan utility. If you still have a printer scanner combo, ScanLite allows you to scan documents. Under the internet category, the web browser they have chosen to go with is Firefox ESR. So ESR means it's the extended support release of Firefox. If I go to help about Firefox, this is Firefox 115.5.0 ESR. Also under the internet category, we have our instant messenger contacts. We have KDE Connect. And this is for connecting your mobile devices and seeking them. We have KDE IM log viewer. So a lot of instant messaging stuff here. We also have KGet for a download manager. We have Conqueror. That's interesting. Conqueror with a K is a old school web browser. It was KDE Plasma's web browser. They had their own browser. Not too many people use Conqueror these days, but it is. I mean, they installed Firefox for a much more modern, fully featured browser. But Conqueror is here. This is version 22.12.3. I probably wouldn't use that myself, but it is there. Conversation with a K. That is your IRC chat client. And by default, it is going to try to connect to the Debian server. So that's interesting. So I don't know if Sparky Linux has its own IRC channel. But I guess if you're being based off of Debian, they I guess are connecting you to a Debian support channel out of the box. We have KTorrent for a BitTorrent client. We have quite RSS, which is a RSS reader. Let me go ahead and open it. Of course, I haven't added any feeds, but you'd add your RSS feeds and you get, you know, your previews here in the main windows. Pretty neat little RSS reader. They also have RiseUp VPN. That's interesting that they include a VPN service. I'm not familiar with this particular VPN RiseUp VPN. Let me click on it. Might take a minute to load. Of course, I'm not going to sign up for anything. And obviously, it's going to ask you to sign up and everything. We're going to skip all of that. And the only other thing under the internet category is Mozilla Thunderbird for the email client. Under multimedia, we have Alisa for our audio player. Go ahead and click on Alisa. This is one of the standard KDE applications as well. I click the menu here and go to About Alisa. This is Alisa 22.12.3, a simple music player made with love by the KDE community. I like the little blurb there in the About screen. Under multimedia, we also have K3B, which is a disc burning utility. Now, kind of like I mentioned, you know, not too many people have scanners, not too many people burn discs these days. I actually still occasionally burn discs. And the best disc burning programs for free and open source software available on Linux, K3B is the best disc burning program. It can burn your CDs, DVDs, Blu-rays.  Maybe you use Blu-ray storage as archiving discs. And sometimes I do that.  Also under multimedia, we have Komoso, which is your webcam program. VLC is your video player. Of course, VLC can also play audio. So you can use it for both. If you want VLC 3.0.20, VLC is one of the most popular pieces of free and open source software on the planet. Probably hundreds of millions of people use VLC every day on Windows, Mac, and Linux. It is a cross-platform program. We also have VocoScreenNG. I'm assuming that is a screen recorder office. We have our LibreOffice Suite. The entire suite is here. Let me go ahead and open LibreOffice Writer, which is the word processing program. If I go to help and about LibreOffice, they are on version <IP_ADDRESS>. So not the latest release of LibreOffice, but again, it's a stable distribution based off of the latest version of Debian Stable, again, based off of Debian Bookworm. We have a science and math category. The only thing in here is LibreOffice math. And then the settings categories, your standard stuff that you would see. So you have printer settings and system settings. You have the Synaptic Package Manager, which is a GUI package manager. But it's really nice because it's not all gaudy with a bunch of graphics and things. It's actually probably the best graphical package manager available on Linux. Now Synaptic Package Manager is for Debian-based distributions, Debian and Debian-based distributions. So if you're running Debian or a Debian-based distribution like Ubuntu or Linux Mint, I strongly suggest giving Synaptic Package Manager a try. Now I'm going to search for a package. I'm going to click the search here. I'm going to search for Htop, which Htop might be installed out of the box on Sparky. I'm not sure, but I'm going to do a search for it just in case. And here is Htop. And it is not highlighted a different color. So Htop is actually not installed. Well, I want to install Htop. So I will click it, mark for installation. Now there's a checkbox. And then what I'm going to go ahead and do is go up here and hit the apply button. And all the changes that I've made will be applied. So if I've had multiple programs ticked on to install and maybe some other programs ticked off to remove or whatever it happens to be, it will go ahead and apply all of those changes. And of course, you could always open a terminal and just do a sudo apt install Htop, right? Which is typically what I do. But if you want a graphical package manager, maybe you're not sure of the name of the program you want to install. You know, sometimes when you're searching for new programs, something like Synaptic Package Manager, it's a little easier to navigate than searching for programs at the command line. So now that we have Htop installed, let me see. Can I do a control alt T to bring up a terminal? Yeah, not every distribution of Linux uses that key binding, but most of them do. Now I'm going to zoom in and let me do it Htop. And let's see what kind of system resource usage we are using. I'm using about one gig of the six gigs of RAM I gave this VM. That's a little high for KDE Plasma, but I have opened a ton of things on camera here in the last few minutes. And some of them are probably still running. Yeah, rise up VPN. Let's quit that.  KDE Plasma is usually a pretty lightweight desktop environment. Typically it's going to use about 600 or maybe 700 megs of six gigs of RAM that I give these VMs. This again is a little high, but again, I've probably got a lot of things running in the background. Let me go ahead and close that window. Now let's talk about some of the Sparky Linux specific programs. If I go into their system category, one of the programs that you will immediately be welcomed with as soon as you log in for the first time is the welcome application. So this is a YAD program yet another dialogue. It's a very simple way to create these graphical programs. But again, it's got various links to some of the documentation for Sparky Linux. You can get a link to their Git repo, their Wiki, you get a link for how to donate to the project. You can also go ahead and install software upgrade software from this welcome screen because you click on app center and you will get some kind of graphical software center. I'm assuming it's going to take a minute to load. So it is using the Aptis app center, which is another YAD dialogue kind of graphical program. It's very similar to the welcome screen. And so if you prefer this rather than synaptic, now I prefer synaptic because this is a little clunky. But I mean, if you wanted to use this, for example, let's go ahead and install something small. Maybe I want to search for, let me search for something like VIM. VIM may already be installed, but I'm going to search for it. And it says search result for the word VIM is more than one. Okay, well, we have a search result in games, text media others and office text. I'm going to assume office text is probably the VIM that I wanted. So let's go there and see if VIM is here. There it is.  All of this seems a little slower too than just using the synaptic package manager. But let's go ahead and click the install button. It opens a terminal where you have to confirm that you actually do want to install. Now that's interesting that it asks for a confirmation when you had to kind of click on a button that said install anyway. I'm not sure if I'm crazy about having to confirm that. And then it says the package has been successfully installed exit. And if I exit it just goes back to the main screen. So yeah, so that is their app center. Some of the other things in the system category include the dolphin file manager, of course, being KDE Plasma.  This is probably if you were using Sparky as a live USB stick, you might want to have a partition manager actually available to you. You also have timeshift for those wanting to make backups of snapshots of your system with timeshift. There is a utilities category, which is all of the standard KDE utilities, such as Arc, which is their archive manager, KCalc, which of course is KDE's calculator. Go to about KCalc. This is KCalc version 22.12.3. All the KDE programs it looks like are synced to the same version numbers 22.12.3. So let me go ahead and do control Alt T to bring up the terminal once again. Of course, this is KDE's console, console with a K. And let me do an apt list dash dash installed. Let's get a list of all the packages that were installed via the apt package manager. And it spits this out line by line, right? Each package on its own separate line, which means if I up arrow, I can pipe all of that into WC space dash L. WC is the word count program dash L means give me a line count rather than a word count. 2,232 lines. That's how many lines of output we're in that output from the apt list dash dash installed command, which means there are 2,232 packages installed on Sparky Linux. And if I do a uname dash R, we've already taken a look at it in the settings manager, but the version of the kernel is 6.1.0. If I do a where is pipe wire. Let's talk about the audio server is pipe wire here. It is not. So they are not installing pipe wires. I'm assuming pulse audio, of course, is going to be the audio server. Let me go ahead and close out of the terminal there. Let me right click on the desktop. Let's check out the wallpapers. If I configure desktop and wallpaper, and let's see if we have any cool wallpapers, probably most of them are going to be like your standard Plasma wallpaper pack. This one here says created with GIMP. So this is the default wallpaper, the Sparky Linux branded wallpaper. Other than that, the rest of the wallpapers look like they were probably either default Debian wallpapers, which some of the Debian wallpapers are actually quite nice. Just here's one from several versions of Debian back that I really loved. And it's all Debian branded wallpapers. So nothing else to see here. Let's do space fun, a little space themed Debian branded wallpaper. Yeah, so really nothing exciting about that wallpaper pack. Unfortunately, let's go ahead and apply. Overall, a very minor point release for the Sparky seven series. I really I just wanted to take a look at Sparky Linux again, even though it wasn't a major release. I don't get Sparky Linux as much coverage on this channel as it probably deserves to Sparky Linux has been around a number of years. And to be honest, they do Debian better than most Debian based distributions. Like if you're looking for a really easy way to get into Debian, an easy installer with the Calamari installer, especially if you're going to run one of the four or five desktop environments that they offer out of the box on their ISOs because they do XFCE, LXQ, KDE Plasma, which I just took a look at and I think they do mate actually as one of the other additions as well. So if you're running those desktop environments, you know, Sparky actually gives you a pretty comfortable way to get into Debian if you don't want to run mainline Debian. Now before I go, I need to thank a few special people. I need to thank the producers of this episode. And of course I'm talking about Gabe James, Matt Paul, Steve West, Arkotic, Armor Dragon, Commander, Angry, George Lee, Matthew, Methos, Nate, Erion, Paul, Peace, Archon, Fedora, Realities for Lust, Red Prophet, Roland, Soulastry, Tools of Death, Reward, Jintu, Nibbuntu, and Willie. These guys, they're my highest tiered patrons over on Patreon without these guys. This quick look at Sparky 7.2 would not have been possible. The show's also brought to you by each and every one of these fine ladies and gentlemen. All these names you're seeing on the screen right now. These are all my supporters over on Patreon. I don't have any corporate sponsors. If you guys like my work and want to see more videos about Linux and free and open source software, subscribe to DistroTube over on Patreon. Peace, guys.


Been there, done that, no talk, done chat Came here, one man, three gal, four gal One yard, I love that, twenty-three in one job, man Like my enemies, she won't come back East side, all day, the young Gs ride In North Face, skin blasts, M charge Three-five in that court case, biscuits A witness in my district, I'm on a short of cake I know all the way, then orchestrate On a corner bay, with prostitutes When they watch the news and afford my gift But defaults can result in a torture brain I've had a school of hard-knocked, she-man worse School the same, don't run the emcee, don't walk this way Too many flaws, I cannot anane No water, break chapter one, verse forty-eight Drill work, thrill work Like drill work Blastle, Stratford, Lexham, Hilford Am I East time?  Every girl, I got two on my side But she did herself Ruined the vibe, now with someone else Head over heels are underwhelmed Flow check Ain't out of my zone yet Rate and go again, forgiveness off the homerick I will be there Where it's a crypt in cold steps Drill work Thrill work Sound like drill work Blastle, Stratford, Lexham, Hilford Am I East time? Sound like drill work Sound like drill work Like drill work Gunshots Not about gunshots They're entering beef, no surprise when someone drops Brothers in the field, I only wireless or love box There's no better wraps when it jumps off Gunshots Not about gunshots They're entering beef, no surprise when someone drops Brothers in the field, I only wireless or love box There's no better wraps when it jumps off


Welcome. Our talk is called CNI or service mesh comparing security policies across providers. So there are a couple of different ways you can enforce policy in your clusters. And we're going to talk about how they fit together, since some of the ways they go sideways. This is my colleague Christine, who is in developer relations at Google. And this is Rob. He is an instructor at Super Orbital. So many of the talks that we're going to talk about today, they're our slides, there are a lot of them. And we're going to be going fast, so just go to the PDF afterwards. So don't try to take pictures, really. They will be a nightmare. All right, so a little bit about what we're going to cover today. So we're going to talk about what's a CNI, what's a service mesh, go back to the basics, what and where and how policy is enforced, some security gotchas that you should probably be aware of, mitigations and how the field is evolving in the future, and lastly, what you can do about it. All right, so the concepts that we are discussing today, they broadly apply to a lot of service meshes and CNIs in the CNCF ecosystem, but today we're going to be talking about Cilium and Istio, because they're the big fish in the CNCF pond. They are in the top 10 CNCF projects by commits, contributors, comments, issues. And both of them have announced large changes that are going to drastically change the fundamental ways that policy is enforced.  All right, a quick review. Apologies if this is very remedial for you, but don't worry, like Christine said, we're going to go fast. So the Kubernetes networking model requires that every pod can talk to every other pod directly without NAT, but pods cannot just talk to each other. This needs to be handled by the CNI. CNI is the container network interface, which is basically a thing that lets your container runtime delegate network configuration to some other component. What kind of changes could a CNI perform? Well, in the context of a pod talking to another pod, the most commonly requested changes are those that do the initial set up of networking. So we're not talking about implementing networking on their own. CNI plugins don't do this. They stand on the shoulders of giants and just configure your kernel to do the networking for you. Now CNI is just an interface. You need a plugin to actually do the change. A plugin is just something that implements the interface, and it is what answers the requests when the call comes in to make changes to the network configuration. So some examples. One of the first ones was the bridge plugin. This was reference implementation from the container networking GitHub work. You can go have a look at it. Just gets you basic connectivity between pods using virtual and ethernet devices and a Linux bridge. There's no support for network policy whatsoever. There's another popular plugin called Calico. Also does the virtual interface thing. It doesn't bother with the bridges, but it does add support for network policy, and it does so with IP tables. We're gonna use a lot of wizards in this to keep your eyes out for the wizards. Another big plugin out there is Weave. It relies on the in kernel open V-switch implementation for its data plane. And it also has network policy support, does this with IP tables. And the big one, Silium, as we know, uses eBPF for its connectivity, uses a technology called Express Data Path that lets it short circuit much of the network stat for a huge speed improvement. And that is also where it does its network policy implementation. So network policy is implemented by eBPF programs in Silium. So most of the popular CNI plugins out there are going to set up connectivity between pods. They are going to have some kind of support for some kind of network policy, and you can basically think of them as like a cloud native SDM. Okay, so that's CNI side, the stock service mesh. You have microservices, good job. You want to have some standard features across all of your microservices.  Now you want to add security, so you go write some more code. You have authorization, you have authentication.  You want reliability. So now you go write some more code, you add active health checking, you add automatic retries for failures, you add backups to protect yourself from the thundering hurts. And then one day at stand up, when nobody even asked, somebody starts talking about code duplication. Something, something, let's refactor everything out into a nice standalone client library.  Or a weird one, whatever, I don't judge. So then somebody has a bright idea. Let's move the whole library out of the process entirely and bake it into the infrastructure.  The most popular service meshes offer observability, they'll set up identity, encryption, access control, they're balancing a bunch of other cool features. So for a concrete example of how this works, we'll use our same two pods who want to communicate with each other. And all that common logic that we just talked about lives inside a container in the pod, it's the sidebar proxy. So when this pod wants to talk to this other pod, the mesh will have already used IP tables to redirect transparently all the traffic through the sidebar proxy, so it can do all the things that we just talked about. Now, because service mesh is not a CNI plugin, it has nothing to do with giving pods interfaces or configuring connectivity. It assumes you have already done that and it just uses whatever connectivity is already built. So we recall the bridge plugin example, we try to mix that in a visualization with a service mesh, it would look a little more like this, so this is a very busy diagram. So for simplicity, from here on out, the rest of our diagrams are going to just assume that container networking and IP tables redirection are already configured, so we're gonna show you a whole bunch more stuff. So in this setup, our CNI could be using EVPF to enforce network policy, or it could be using IP tables to enforce network policy, but whatever it's using, the CNI plugin policy enforcement happens here in the kernel, while service mesh policy enforcement happens here at the sidecar. So this brings us to a place where we now have two different policy enforcement points in the network, where we have one wizard living in the sidecar, one wizard living in the kernel. Now I am compelled by CNCF bylaw to inform you that no large language models were harmed in the creation of this image. Okay, wizard number one, the CNI, what can you actually enforce? Now Calico, Silium, other big CNIs, they often offer their own network policy but better CRDs that have fancier stuff in them. I'm gonna talk about just the vanilla network policy that comes with all Kubernetes, just to keep things simple, but basically you can apply policy to a broad range of traffic types, and then you can make a block or permit decision on that traffic based on some of the characteristics of the traffic itself. So kind of things like don't allow things going to the cider and so forth. So we look at our basic setup. Let's say the pod on the left is in a namespace called frontend, and the pod on the right is in a namespace called api. Let's just say we have a network policy here that says that pods in the frontend namespace are permitted to connect to the pods in the api namespace. Well, IP tables and EVPF don't know anything about Kubernetes namespaces. So instead, what's happening is that the CNI plugin has implemented something called a network policy controller, and that component is going to be querying the Kubernetes API and keeping tabs on all the pods and all the namespaces so that it can keep track of those IP addresses. So once it has those IP addresses, it's then going to be either updating IP tables rules or it's gonna be updating an EVPF map that will implement that same logic. So if the connection comes out of this pod in the frontend namespace, it can be checked against that table and dropped or permitted accordingly. So hopefully not too tricky, but I have good news for you. We have a contrived scenario because don't we all love contrived scenario when we're talking about the way people get into your clusters. So let's say an attacker has popped a shell in a vulnerable pod in some other namespace that does not have access to your API. Now we know that our CNI plugin is keeping tabs on pod IP addresses to update those IP tables rules or those EVPF maps or whatever it's using. Now let's say this pod is in a permitted namespace and it goes away for some reason. And then it will get recreated with a new IP address. This kind of thing happens all the time. That's why we run Kubernetes. So now the clock starts. If there is enough churn in the compromised deployment, this leaves a narrow window of opportunity for a connection from a compromised pod to make it past the check before our cloud native SDN catches up and cuts the cord. Now this is not a new idea. This type of race condition has been around as long as software defined networks have been around. The only thing that's changed is that now it's in Kubernetes and so we need to consider this when we're thinking about our clusters. If you want details, there's a blog post here that will show you the specifics. I will talk about mitigation but not yet because I'm going to switch gears and compare to service mesh. So what can you enforce with service mesh? Wizard number two. Again, you can apply policy on a whole range of network traffic and you can conditionally block or permit that traffic based on characteristics of the traffic itself but because service mesh lives at layer seven, the range of characteristics that you can use to make a block or permit decision is broader because it can inspect the traffic, look inside at the HTTP headers and so forth so you can say don't allow gets but you can allow posts or something like that. I'm going to focus on these two conditions for the moment because the way these two conditions are implemented leads to an interesting situation. So how are the namespace or service account conditions enforced? Well, we look back at our diagram here. We know service mesh enforcement happens at the side card. So we have the same scenario. We've got a pod in the front end namespace. We have a pod in the API namespace and we have a policy which permits pods in the front end to talk to pods in the API namespace. Great. Now, just like IP tables, just like EVPF, side card proxies also know nothing about Kubernetes namespaces. Instead, our service mesh is going to rely on MTLS to enforce policy on source namespace or service account. So when a side car knows it's going to talk to another side car in the mesh, it wraps the outbound connection in mutual TLS regardless of what it is. And the namespace that the request is coming from is encoded in the signed certificate that is used to establish that MTLS connection. So when the request arrives at the destination side, the receiving side car does not need to have a list of IP addresses in order to verify that the request is coming from a permitted namespace. It just needs to look at the contents of the certificate and verify that the certificate was signed with the key that it trusts and then it will believe that that connection came from where it said it came from. So two key takeaways. Unlike CNI land in the service mesh, a policy like this does not prevent TCP connections between pods. And anyone who can present this client certificate will be trusted as though they're coming from a namespace and service account that are in the certificate regardless of where they actually come from. Okay, I see eyebrows being raised. Y'all see where I'm going with this. That's good. The good news is those client certificates are well protected. They live in memory in the sidecar proxy and never get ridden anywhere. Even if somebody popped a shell in your pod, they have their work cut out for them to try to extract it from the process memory. So if we assume that that is safe, great. Where do these certificates come from? Well, all service meshes implement a controller component and one of the controller components jobs is to mint new certificates. So when a pod with a sidecar starts up, it contacts that controller and says, can I please have a certificate? And to identify itself to the controller, it is going to offer up a Kubernetes service account token. So this is how identity is bootstrapped in this environment. Now that token is gonna contain some claims and those claims are the service account and the namespace that the pod is running it. And the controller is gonna use those claims when it mints the certificate. Good news, everyone. I have another contrived scenario for you. Let's say an attacker has popped a shell in a vulnerable pod that does not have access to your API again. If they can find a vulnerability in this pod, which gives them a way to steal the service account token from this sidecar, maybe through directory traversal vulnerability, maybe through server site request forging, maybe they just, bat their eyelashes and say, pretty please. However it's done, they could then use that stolen token to talk to the service mesh controller and request a client certificate and then use that client certificate to make a fully encrypted and verified connection to the pod that you thought was unreachable. There's a repo right here that shows how to do this. You can check it out for step-by-step details. So there are two ways to deal with this problem. Solution number one is to follow the unit's philosophy. A tool should do one thing and do it well and you should be able to use your tools together. Joe, right tool, right job. Use your service mesh to enforce layer seven policy at the sidecar. Use your CNI to enforce layer four policy in the kernel. And then, if an attacker with a stolen client cert, sorry, an attacker with a stolen client cert will be stopped by your CNI plugin because they're coming from the wrong IP address. While an attacker with a stolen IP address will be blocked by the sidecar proxy because they haven't got the right MTLS client cert. And this is not a hot take. This, in fact, is exactly what Istio has recommended doing for years. Defense and death is not a new idea. Now, that is one way to approach this problem, but there is a more interesting approach to problems like this and that is what Christine is going to tell you about. All right, so the second approach is the evolution of the projects itself within the ecosystem. So we're kind of going back full circle. So we all know that the CNCF landscape is continually changing.  And you know what, they're being supported by brilliant folks in the open source community. So some of these projects have decided to expand their capabilities to provide options for better use of projects.  So what is Ambient Mesh? There are more detailed talks around the specifics and there are blog posts online, but a rough overview of the security aspect of what we care about is that now we have a L4 secure overlay layer to layer on MTLS between your applications and they include denial in service to service connectivity authorization policies. And this is done with the Zed tunnel. Pardon my thick Canadian accent. So what does this look like? If we recall, the sidecar model is sitting right next to your application pod, so literally two peas in a pod. And then feedback from the community has shown that maybe this was a bit intrusive in some scenarios and then some people just wanted to layer on MTLS before trying out more service mesh capabilities. So instead of having to wait for a two out of two for your containers and your pods to be ready or restarting your deployment to inject the sidecar, you now have the Zed tunnel per node, which will intercept the traffic before it leaves or enters the node. It layers on MTLS to your cluster's traffic so you know that it's encrypted and I do wanna address that even though the slides here say IP tables, there are investigations being done to use EBPF instead of IP tables to redirect traffic. So you can see that full request at the bottom there. And for example, we have a CNCF sandbox project, I think as of December called Merbridge which implements EBPF with Istio and LinkerD. And also if you want to have richer L7 authorization policies, then you can do that at the L7 layer with the processing layer, which is done with the waypoint proxy and is configurable with the gateway API. So the waypoint proxies are like regular pods that can be auto-scaled like any other Kubernetes deployment. And AmbientMesh also uses HBone, HTTP based overlay network environment, say that five times fast. Connection is established with MTLS and it's based on the ID of the workloads that are communicating with each other. And there was a much more thorough talk around this that was presented earlier and surprisingly the CNCF is so on top of it that they've already uploaded YouTube videos. So please check that out if you want more in depth with security. And on the flip side, Cillium has also announced Cillium Service Mesh pushing upwards toward the L7 world. So Cillium Service Mesh is a sidecarless service mesh still leveraging EBPF to bypass the network stack. So it's really great for performance. But if for some reason EBPF can't handle the request that's coming in, it will fall back to using the Cillium agent that is running as a daemon set on your node. The Cillium agent runs in Envoy proxy by default and will intercept the traffic on your behalf. There are certain L7 traffic management tasks that can't be handled within the kernel but again that goes beyond the only care about security here. So there is also a lot of work being done on the Cillium Service Mesh side of things, one of them being the MTLS investigation. I was talking to Nick yesterday who was saying that even though there is, I think they're still looking for some feedback, so some TLC and get into the discussion, I have linked the issue there. So I want to be clear that there's still a lot of work being done for both projects. Ambient Mesh is still experimental and the design for MTLS is open for feedback. Kudos to both projects for being so receptive to the open source community and actively looking for that feedback, that's so healthy. And this brings us all to the L7 policy support. Istio has been saying to you C&I and L7 service meshes for a long time and Cillium has the ability to do this and now you can see that they're kind of pushing up against each other. But both projects are still involving. So rather the projects are on this path to converging with all that being said, what are some of the takeaways? So now we're gonna have a large array of options to choose from in the future. I'm not here to tell you what your engineering needs are or what the future is gonna hold for your teams. You might still want a sidecar model for more isolation and it's still needed in some scenarios and then sometimes you're gonna want something more generic like a proxy for node. I don't think the sidecar model will go away instead of companies will have to choose from the cells based on their needs. And there is a link at the bottom by a talk by Liz Rice about the trade-offs of the sidecars versus sidecar lists debate. So it's still a topic to be discussed. And there's also something to note. It's a complex cost for your engineering teams. Those are people. There's the engineering cost on-boarding of maintaining some of the risk, the maintenance and blaster radius. And again, this all depends on your specific use case at your team's use. Okay, so let's take a small tangent to EBPF because we mentioned it on our CFP and we're like, oh, we gotta talk about it. So there are a few slides here. EBPF, if you're not familiar again, it's a program that runs in your kernel. It's constrained for safety. It has tight guard rails so you can't go off and just do anything that you want. And it's checked by a verifier before it is uploaded to your kernel. So at the CNI level, you can see that it's a very beneficial tool. It provides L3 observability, routing and network policy. And there is a good talk or a good slideshow that goes more into detail. I am by no means an EBPF expert. I wish I was, but I think that is some big brain energy beyond my scope of knowledge. But the main benefit is mostly around performance from what I've understand.  I mean, it's no S-bomb, but it's still pretty exciting. And it's a cool technology, but it's not a silver bullet. Don't you ever notice that there's actually never a silver bullet, but every vendor wants to sell you a single pane of glass? So takeaways, use defense in depth and know your tools. There was a good talk yesterday, again uploaded onto YouTube already. And it has this diagram of the cheese model, which I love because I love cheese. And you can see that, you know, might as well have as much layers and you have as much safety padded on everywhere. So what can you do about it? You know, get involved. Given Istio's ambient mode is still experimental, try it out, give some feedback. Check out the Cilium MTLS design proposal and all the links are at the bottom there. And I hope you're ready to get involved with all your favorite CNCF projects. All of them, right? So again, show some TLC and some support to these projects. They need security enthusiasts like yourselves in the crowd to make them stronger and more resilient in the future. Again, my name is Christine. And I'm Rob and I am a big fan of a Python teacher named Ray Hettinger, who at the end of all of his talks polls the audience by asking the question, could I see by show of hands anyone who did not learn something new today? For everyone playing at home, I am the only hand up. Excellent work. That means you all picked the right room to be in. So at this point, I will suggest that my company Super Orbital offers Kubernetes training. We teach service mesh. We teach advanced Kubernetes controller development. And we are pretty chill about it. So if you have juniors on your team, if you have folks who need to get skilled up fast, send them to me. I train wizards. Thank you. Leave feedback or not, no peer pressure, it's fine. We have a couple of moments for questions. If anyone has questions, if there aren't questions, I could show a demo of stealing an MTLS client certificate if you wanna see that.  Yeah? All right. Oh, this will be tricky. I gotta switch back to mirroring. This was us goofing around doing a, okay. So, just quickly reset my environment. So this cluster has been running for a while. I've been working on this test for a while. I have long thought that this was possible, but I had never actually figured out a way to do it until just this last week. So hopefully the Wi-Fi gods will be appeased and I will actually be able to get access to my cluster. It's not looking good. Cannot reach my cluster. No, that's the last handshake. Oh, there we go. Okay, great, great, great, great. It's just real slow. Everybody stop tweeting. So here goes. So what I have are two namespaces. I have a namespace called secure and a namespace called attack. In the secure namespace, I have a service and I have some pods. In this namespace, the legit client pod is using a service count that is allowed to talk to the victim service. In the attack namespace, there is a pod that does not even have a sidecar. Notice there are only one of one containers in this pod. So I'm going to run this exercise. What's happening is it is now generating a new RSA key pair and it is stealing the service count token from the legit client pod. Just cut a copy to that over there. I then verify that the key in the... Oh, sorry, then I make a GRPC call to IstioD using the certificate sounding request that I just generated and using the stolen service count token from the legit client. IstioD returns an MTLS client certificate to me. I then look inside the MTLS client certificate to check that the key is the same as the one that I asked for it is. I then copy the private key and the client certificate into the attack pod and the attack pod is now ready to spoof that request. So I'm going to exec into that pod. Okay, so from in here, if I curl the victim service, it is in this victim in the namespace secure. I expect to see connection reset by peer. I am sending a clear text request to a pod that is demanding MTLS. So it does just hangs up. However, here I have my client certificate and my key. So if I do a curl, pass in the cert, pass in the key, remind curl to use HTTPS, despite the fact that I am actually going to communicate on port 80 and the service that's running inside of that victim pod is just an HTTP bin binary. So I'm going to hit the headers endpoint. And what you see is a 200 response back from that pod I should not be able to talk to. And what is happening here is the onboard sidecar by default when it unpacks the MTLS connection, it examines the certificate, gets the identity out and puts it into a response header so that you as a service mesh user can verify who made the request. That is this is the requester here and who received the request. This is the identity of the receiver here. So you can see that even though this request came from pod called attack in a namespace called attack, it appears to be coming from the secure namespace using this legit client service account. It worked. The demo guns are happy. Cool. Thanks. Yes. Yes. They already did. So yeah. So what's happening, what he's talking about is you can use the service account. There's like a token API where you can ask for what's called a bounded token. So it's a JWT that has an audience claim inside of there. And what the audience claim means is you can say this token should only be received by services who are in the audience. This token is only meant for, for example, IstioD or this token is only meant to be given to, for example, the Kubernetes API. So IstioD actually does have bounded service account tokens turned on by default. And so the token that lives in the sidecar proxy is bounded to only be allowed to talk to Citadel, Citadel is the component inside of IstioD that signs certificates. However, I have stolen that token. So it doesn't matter that it's bounded. Oh, okay. Oh, okay, okay, okay. This is something I'm not aware of. So how does that work? Oh, cool. That's very cool. So for, yeah. Yeah, I'm gonna just repeat that for people who are watching on YouTube later. There's work being done to allow projection of an MTLS certificate into the pod so that it doesn't have to use a token. In fact, I think there's a talk, I saw that somebody had to talk about that today, I think. Yeah, somebody did do a talk about that today? Okay, so I was busy working on this talk so I didn't get to see it. But I do wanna check that out. And to be clear, the fact that service account tokens are sensitive, not a hot take. Everybody knows this. I just think that this is an abuse of a stolen service account token that is not commonly done. That's a good point. I actually, I haven't looked with that. Oh no, actually because not this token because it's bounded, yeah, yeah. Yes, yeah, that's right, yeah. That's very cool, thank you. I have to pick up my hand down now. I learned a new thing today. Cool, thanks everybody.