Today on the breakfast, more than 100 Chibo girls are still missing after being adopted by Boko Haram in 2014 and many parents are concerned that the Nigerian government has lost interest in their plight. Also on the breakfast, Christians and Nigerians join the rest of the world to make a Good Friday to commemorate the death of Jesus Christ on the cross. We also will bring you the latest update in the exciting world of sports. We'll be reviewing the biggest stories making headlines across major dailies. Good morning to you, this is the Breakfast on Plus TV Africa this Good Friday morning. My name is Justin Akadone. And I am Messi Boko, good morning and thanks for joining us. Good Friday to you, Messi. Good Friday to you. Have I ever gritted like that before? Don't be comical. No, today is Good Friday, it's actually a Friday and it's a good one. It is the holy weekend and Messi, have you been very holy this week? It depends on what holiness is. Holiness not doing bad things in quotes. So what is bad things? Things that you might not be proud of. I don't know what that means. It's not about messes, not about us but it's Good Friday and Good Friday is the day that Jesus Christ died on the cross of Calvary. It is a very, very important day in the Christian Dam. But also it's been eight years since the Chibo girls were abducted and after that over a hundred girls are still in captivity. Remember the sign bring back our girls, the hashtag that trended that eventually became a national movement, an international movement and yet these girls are still in captivity. Some of them that these are, though some have been reunited with their parents. Being in captivity for just one day, it's like very, very hellish not to talk of being in captivity for eight years. It is a complete trauma and these girls, they might have been married up, they might even have kids as it is. Messi has been eight years since the Chibo girls were abducted and the parents actually had a protest just yesterday and they say that the government similarly don't care about the agony. It's really a very sad, unfortunate incident that's happened and the fact that government has constantly said they're making efforts to ensure the return of these girls. But the question is eight years after, what is the fate of these girls? So it's really very, very sad situation. I mean eight years is a long time. Now the question you want to ask is are these children still alive? At this point in time, they probably would have become adults, depending, I mean if you look at the age bracket at the time where they were kidnapped, but moving forward you also want to look at the issue of the kids and children that have been kidnapped afterwards. The figures seem to be on the high, the statistics is on the high. If you look at the data that's been made available and it just shows that we haven't really paid attention to what has happened over time and it doesn't really seem that there's a willpower from the side of government. I will always say this, once upon a time we talked about the safe school initiative. The idea was to ensure that you have perimeter fencing. And yes, and several, I mean we're talking about millions and billions of naira that's been spent on that particular adult, it's been approved. And so how do you even juxtapose that, you know, with the reality that schools have actually been shortened down? So it calls for a lot of concern, worry, reset. It is really a very sad one because I can only imagine, you know, the trauma that the parents, the families, their relatives, friends of them, these young girls would be going through, you know, ATS. They might be looking for some sort of, you know, some sort of relief and not knowing what's going on with their children being girls. It is something very alarming. But let's go talk to what's trending in Nigeria, in the world, and across some social media spaces. Funke Akindele is in the news. But before we get into her, a Twitter user raises false alarm. And just how far can people go, you know, about them chasing clout? She posted a video or she posted some Twitter saying that she was kidnapped, that she, you know, was raped. She even posted, you know, the number of her so-called alleged kid in an apartment. Over time, she now said it was all a hoax. She was doing that to, you know, chase clouds. But while we're here, from what we understand, she is in police custody. Massey, just how far, what people go about chasing clouds? So first of all, people, we need to understand that the issue of rape, I always say this, I remember a time where it was on radio and then my colleagues would probably want to make, I think it was about this time, the issue of Fatou Ibo. Oh yeah, I remember, yes. Top on the trend. This issue is a very sensitive issue. Very, very sensitive. Very careful when you talk about rape, when you talk about religion. This issue is a really very sensitive. And because you have a lot of persons who have actually been abused and a lot spent going on, you just need to be careful how you do all of this. But it's a good one. A lot of persons are saying, we hope that the Nigerian police will be very swift in all the situation because, you know, the swiftness in responding to this is up. But I think that it's very okay. People need to learn a lesson. So this might just serve as a deterrent. How do you go ahead, whatever the case might be? And you understand the fact that we're in a very sensitive period, a period where there's so much insecurity. So, so, so much. A period where we're talking about the issue of rape, we're talking about kidnapping. It's on the house and you can't actually just wake up and put that out. Even as some people saying, at the end of the day, it was more like I needed to put this out as a way to escape whatever it was. But really, it was actually a deliberate and conscious decision. Maybe you would have actually put a course, some course across to support system that you have. It would include your family, friends, or members of your church, if you attended church or mocks or whatever it is, rather than putting that out. Now, these will constantly make nonsense of the efforts of people who are... You remember the time where the train attack happened, right? And there was the doctor that died. She tweeted saying, we have been attacked. Yeah, the attack, yeah. I've been shot. Please pray for me. Some people thought that this is a joke. There's some sort of a hoax, yes. People thought it was a joke. How can you be short and then you're still tweeting and typing? It doesn't make any sense. And looking at the comments that was being generated from the particular tweets that she put out, you would also see some persons who were laughing at it because some people say, OK, how are you saying you're being raped and you're being kidnapped at the same time and you have access to your phone? Your phone. And you're tweeting about it. We need to understand that we're in critical times and these times we need to be very sensitive with the things that we do. Because you know what this would mean? So at a time where you say the truth, it would be difficult for people to... Because you're making nonsense of it. So if another person not tweeted it or have been kidnapped, how many persons will respond? Some people will think that this is another joke. I want you all to be rescued because you might think that might just be another joke. I just think that and if Twitter, it's now the medium where we can get across because Twitter is very powerful. I'm saying social media is very powerful, right? But that microblogging platform is very, very powerful and that's why you have Elon Musk's on the particular one that's going on. But we need to be very careful. So we don't even make nonsense of everything that's going on. You could see the response time. You could see the chat. That's because Nigerians are on top of the issue. People are very alert. The issue of security and all that. And you cannot joke with a thing like that. I wonder why she would even do that. It's a very serious thing. Yes, that process is crazy fast. The fact that the men of the Nigerian police force, I mean, she would be the police's invited, how she's been arrested, the issue of false information, false alarm, it's okay. It's very okay. On the other hand, the person she visited at that certain address also would also be a pre-handed or would have a sacrificial for restraining because one of the issues that she raised is the fact that she's been restrained to leave. So there would also have to answer issues. Like I would say, yesterday we talked about some certain sensitive issues and I would say that we need to do better as a people.  We need to come to the point of humanity and that's the most important thing for me and that's what I think. Well, it is very important. If we all remember very vividly what happened with some popular actor, one of them, the cast members of the empire when he raised a forced alarm, when he talked about being a victim of hate crime, how he orchestrated the crime and everything and the police went searching and went digging. Time was wasting resources. I mean, how can someone just do that? For his case, he won't tell you, it was not comfortable with his space but this case of a motor or sea, she actually was chasing Cloud. Well, things people would do for the last... No, it wasn't that he was chasing Cloud. Then who would he contact? What was said was that she visited there and her visitors or persons she actually visited didn't want her to leave at the time. So it was more like I would have to make this tweet so I can get out. Why lie? We can't necessarily see. But I think that there are other options. She would have called, maybe screamed or something if she was not comfortable with her. Not necessarily even screaming.  So because we also... There was an audio that was put out, some response from the brother. As soon as that went viral, you need to understand that the social media is very powerful. And very wide and very fast. It travels so quickly. So a lot of people, including members of her family, got that particular tweet and they reacted. They started making calls, putting calls across the please. I think it would really be wrong. It is really wrong that you put out false information and give false... You just make up some story for whatever it is and then get people to that panic. I mean, you also need to see a video. I don't know if you saw that. The mother of... The mother was kind. Everyone, you know what you've got a lot of expenses? Making people worry over her. I mean, it's not... Sometimes people should realize that whatever they do, whatever they say, some decisions they make, it's not just about them. It hovers around them, their family members, their friends and people who are associated with them. So sometimes before you take any decision, before you say anything, all this being conscious of the people that would be affected by the things that you are doing. Let's go ahead. So apart from that, you also need to understand how this microblogging, like I said, we're in a very sensitive time. It's very sensitive for us as a country. We're grappling with a lot of issues. So you talk about the issue of insecurity. It's on the high. We talk about kidnapping. It's something that happened almost on a daily basis across the country. And for someone to put that out on Twitter, it costs a lot of consent. So what you have actually done is you have raised a false alarm. You have actually made people to believe that this is it. And families, you know, got into action. The family started making calls. The mother was destabilized. Imagine that the mother collapsed. You don't even know the health condition of the woman. And she collapses because of all of that. If you think that you've been restrained, we just need to do better. For me, I think that as human beings, as a people, we need to do better with ourselves. We need to just be responsible for our actions. How do you even get into a company of people who would not even let you, when you say you're about to take a leave and they say you can't take a leave? So I mean, we need to do better and not even do that. It makes, it doesn't make sense. Now, what would happen if you have someone who is genuinely in trouble or is distressed and puts out another tweet again and say, I have been kidnapped. Someone help me.  And no one will really pay attention. So, but at the end of the day, what we're saying is, please, let's be very careful. I mean, careful. Let's also be very cautious. Let's be, you know, very conscious as well with our actions and in our actions. Because at the end of the day, it trickles down to everyone around us. And we're the time we were trying to save our country from all of the things that we're experiencing at the time. And it would not be good. But I'm really proud, I would say, whatever it is she has to face, she has to face it. It's a good thing that the Lagos State Police has actually said, okay, we're going to hold down the account of false information. All right. We're just hoping that, you know, judgment would actually be fair. Whatever punishment will be meted out, will be fair. All right, let's move on. Funke Akindeli, or Funke Akindeli, the husband, the family is under these JJ skills. X, Y for alleged ex-wife posted a video warning the actor's family that if you, in quote, mess with me, I'll also mess with you. She actually posted a video, a picture rather, of the family of Afouken Akindeli with the twins. You know, for a while, she has not revealed the identity or the faces of her children. But someone went ahead to post a picture. She had come out on social media, not so long ago, in an interview, to explain why she, you know, is actually keeping the identity of her children private. She says she is in the news, and a whole lot is seen and known about her. But her children are just children, and they are entitled to their privacy. And when they eventually grow up, and would want to say or show or reveal themselves, it is left for them. But after that interview, from what we've seen so far, the husband's an ex posted a picture of the family, she, the husband, and the twins. After what happened between the son, who lived with them for about two years, claiming that what we see on social media is not exactly what is happening with the family, he went on to alleged that the marriage is about heating the rock. So there's a lot, some people will say, why are we having this particular trend? If you notice right now, there's a lot to spin bought to the fore. So you have a family, I mean, there may just be someone anywhere, random peasants or individuals, you just have people anywhere. But at the end of the day, boom, you'll have information that you are not supposed to have. Apparently this time, nobody knows about anybody's story, and anybody's struggle, because we understand that life is not perfect. I understand that life is not perfect, and you can't have perfection. There's no perfect government, there's no perfect system, there's no perfect marriage, there's no perfect workplace, imperfections surrounds everything, and so perfection will just be an illusion. But however, I think the social media has actually made it very prominent for a lot of people to bring their cases out. So you just have people taking advantage of that, oh, there's social media. It's as though almost everybody has something to be talked about. So you bring out your issues, because you cannot say that people, the family's steps on, once upon a time there's a man and a woman, there's a man who left his former wife, and he gets married to another woman, and then he has step-children, and something happens, step-children are really pissed about step-mother, and drama all around. But social media has become very powerful. We're in that particular era where technology, and you have a lot of developments coming, and people are taking advantage of this to put out issues. It boils down to a lot of people will say, what is the culture for us? What has become our principle? What do we even believe in? It's really difficult to say what it is, but when we expect it to be a family, a family is very strong. I mean, it's not just something different. That whatever differences that we have, we're able to sort it out without having to bring it to the public. But however, it's in the public, and now people think that the best way to put out issues is to put it out in the public. And you know, when you put it out in the public, you have it out. It's as a social media quote to sort out all of it. No, even if it doesn't necessarily solve that out, but I think that constantly the human nature is wired to get all of that validation, and get all of that. Right. Yes. That's how we're wired. We get all of that. Oh, okay. So this was really bad. How could she have done this? The validation that we constantly have been wired to want to receive is what we're pushing us. So because you probably may not have people support you, maybe members of your family support the action and different spaces. And then we think that we have a space where we can express ourselves and then we get people who would say, oh, this was really wrong.  And that's it. That's just a human element. But we need to find the way, you know, to control it. It's quite unfortunate these days we're getting information of things that we necessarily did not subscribe to. Things are not the dream thing of our business. Have you done what to say? So at this point, what do you even now say? It's quite sad because you understand that Funkie recently had talked about the fact that she doesn't want to put out, she talked about the reason why she doesn't want to put out the pictures of her children. So she doesn't want to reveal their identity. Now on the other hand, you have someone who's put out the picture.  Why has she been keeping them away from all of them? It's the fact that this just means that they're kids and they're kids. And if you're sorting out all the issues that you have, baby, mama, drama, issues within the family, step children and all of that, don't bring children into the conversation because they are just kids. If you want to sort out your issues, sort it out amongst yourselves and don't, because at the end of the day, you're staying with them for the rest of their lives. So it would necessarily not be, so I'm not there. I really don't understand what happened. As much as we will probably get stories from different parties, but you also need to understand that when people are hot, people are hot and then we want to go to any extent to get back to you. And these are the children, that's what, some sort of vengeance? We need to get revenge. And she understands the fact that Fouquet has been very, very particular about putting the identity of her children out there. Recently, I'm not mistaken, I think just recently, there's also that report and post where she talked about the fact that I can't put out my, the reason why I constantly have to let my kids not be out there. And so they understand all of this and put it out and you know, boom, it's what it is. But like I say, we need to be better humans. We need to do better as a people. We also need to understand that as long as we exist as human beings, there'll always be conflicts. We just need to find a way to resolve all of this. But that's the much we can take this morning on top trending on a good Friday, by the way. I hope these issues have been very good, but we'll definitely return on Monday with more interesting conversation, topping the charts across different parts of the country. Now we'll take a break when we return the show continues right here with our paper reviews. Stay with us.


Yeah, good morning everybody. Appreciate everyone showing up for this session. We're going to talk today about how, at least from the AT&T perspective, how workloads, where they came from, and what are we seeing today in terms of change, and what are we seeing in the future in terms of what we're planning for. My name is Toby Ford. I'm an architect within the AT&T's transformation effort called Domain 2, working on NFV and SDN. I'm also a board member of OpenStack and of OpenFV and an advisory group of Open Daylight. Hey, everyone. Morning. Welcome. My name is Amit Tank. I lead the architecture efforts for Cloud and SDN for AT&T Entertainment Group, also focusing on open source and containerization. Thanks again for joining. Let's get started. So where we came from? I'll give you a little story to start. It was about 1996 when I got a job as a consultant as a Unix system administrator to go and work on a system and hosting a little ISP in Eindhoven and other ones. And they asked me to fix this server that was having problems. So I logged in and I started to get to work. And I was looking at what they were doing and what the kind of problem they were having. On this box, a single X86 server running FreeBSD, they were running 2,000 web servers, distinct NCSA, HTTP, the processes running, each one representing another customer. So 2,000 customers on an X86 box of 1996. I thought, wow, that's really pressing it. What happens if one customer gets loud or gets popular and then what's the impact on the others? And that was, in essence, what the problem was. But it gives us kind of the beginning, at least my view of the story, and many of the workloads that we're moving to the cloud. So you just take the most simplest form of that. There's a web server. It's serving up static HTML and a few GIFs and such. And then it advertises a customer, advertises a company's first presence on the web. Over time, one server wasn't enough. I needed to split the load. Load balancers appeared. Or I needed more dynamic content, have databases. From the internet era and the cloud era, that was kind of the standard, a lamp stack. And as it progressed, more and more things happened around it. So the workload has expanded to include other aspects. So a fully loaded e-commerce website of 1992 had many, many web servers and an application layer and databases. And then for it to be at all scalable across a lot of users, you ended up having to use some type of caching system, a Nakamai of some kind. You had caching nodes out there. And I think of the caching nodes as an integral part of that whole story. So this footprint, when you actually look at what was happening, in many cases, the workload itself was processes, their configuration, and some kind of state. Some kind of state that sometimes was persisted to disks. Sometimes it was transitory in memory. But when you look at the root level of what a Oracle database or MySQL databases or some kind of J2E platform and or web server, these were just processes with config and state. Now, as we've gone from then, these things were running on monolithic servers, just single boxes running these processes. Over time, we've realized that the way that this hosting company was able to do 2,000 servers is because most people are delusional about how popular their website is or how much workload it takes. So in the end, we started to take and move things onto virtual machines and start to bin pack workloads and such. And then this has evolved lately to things like containers and LexD. And then the question is, in the future, is that going to look like unicernals as we get more into single process containers and microservices? Is it going to be unicernals? Or are we going to take another direction, a tangent into serverless land? But really, this move to containers, it really hasn't changed the workload itself, even though there's a lot of talk about it being microservices and such. It may change the topology a bit, but in the end, it's always processes, config, and some kind of state. Very interesting. And I like how you laid it out in a very simple manner, that really, what do we define as our workload? It's a combination of processes, configuration, and those database. So moving on, I think if we extend that idea, a lot of models of consumptions of your applications have evolved and come full circle. They started with that kind of a mode where a lot of your services were meant to run in its own environment, in kind of like a singleton environment. As we went along, this is how our workload architecture looks today. And we are taking an example of something that is very, very pervasive, whether it's a media workload, we call it like media virtual functionalization, or it's virtual network function VNFs that are being deployed on a cloud native platform. You're looking at an OpenStack control plane, which has all of these services laid out running as microservice. So I think one interesting thing that has evolved as people who have attended some past two summits is there is a trend to treat your cloud infrastructure itself as a CI-CD capable infrastructure. In order to do that, you are better off deploying each of these services on some kind of a container or a VM, but on its own running in conjunction with the rest of the services. Now once you have your OpenStack control plane up and running, typically the way our data plane are structured, they are essentially massive stream computing farms. Any time the processes that we learned earlier, any time these kind of processing has to be done on, say, for a firewall as a service product or an IPS IDS as a service VNF, there is a 10 gigabit plus traffic incoming, your function, it could be spread across servers, which are being chained. And then those threat database could be fetched from the cloud. Once those threat signatures are fetched, essentially what really these servers are doing is simply peeking into every single packet and detecting whether something has triggered those alarms or not, and then it moves all the traffic to egress. So really this is like a workload that characterizes video workload, or it could characterize any kind of VNF. Just let me add to this slide a bit. The concept, too, is the workloads, when you drive down into them, even if you look at an IPS and IDS system, or if you look at a web server, web server is a listening. Listening for HTTP gets posts and such, and then responding with some content or some response code. This sort of listening, and then responding with information, or listening, going out and getting information, and then responding. This pattern is very similar, whether it's a web server, a database server, I'm taking in requests for SQL, and then giving out data, or if I'm doing threat response where I see a packet, I go and make a search against a signature database, and then I respond and change the packet or deny the packet or reroute the packet, or add some type of information about where to point it. This is this general pattern to overlay on the processes. It will become important in our story later. Yes. So that's one dimension of it, is the topology of the workloads and how they're changing and what they're doing. But then another aspect of it is how we lay them out. As it starts, if you just had a single web server, and this is very similar to other things that we've done like SIP gateways, or voice platforms, or elements of our mobility platform, these elements, if we just put them into a single building, you know, as a telco, we're very proud of our central offices, and we try to push as hard as possible to make those central offices have five nines of availability, but it's very difficult to get them to six nines of availability. It's almost impossible without a lot of extra cost, adding 16-foot concrete walls and a lot of extra overhead for eating and cooling, empowering this facility. Now, and then adding in not two links, three, four links to make it possible to get beyond that. Very expensive and not likely. So you have this building that at most can be five nines with a web server or some other function in it, that, you know, best case. Sure, there's times when in the building I can spread it out and have multiple web servers, and that can get close to four or five nines of availability, but the reality is if I have a service that needs six, I need to have two sites. So the workload has to be in two sites to get to six nines of availability, and so that's a typical SLA that we have in our environment. So if you have six nines of availability, even on top of five nines buildings, I could have actually had 10 nines of availability with two setups of five nines. And the beauty is if I only need six, I can actually reduce the reliability of the facilities down to three nines. And this presents a possibility that we have taken advantage of and others have taken advantage of where you can make perfect services or things that appear perfect at six plus nines, but on less reliable facilities or less reliable underlying resource. So this is important in the workload because you have to consider the geographic distribution of the workload to create, to meet the expectations. Now, that's just with regard to reliability. As we get into durability and keeping data secure and not losing data, if you wanna have, for the longest time we've used tapes to put our data onto a tape and then we put it into a truck from Iron Mountain and Iron Mountain takes it off into a building that has 16 foot wall, so great. But still this tape does not have an enormous amount of, it has pretty good durability, gets a nine, 10 nines of durability, but it's still an enormous risk to flooding or some kind of issue with the truck running into something, blah, blah, blah. So one of the innovations that Amazon did about long ago was realize that if you wanna have really durable data, that you have to have it in multiple sites and really if you wanna have it to get beyond tapes, you have to actually put it into three centers. And so this starts to bring into another dimension of the workloads is understanding the latency between aspects of that workload. And that becomes important and one of the really integral theorems around the cloud is this cap theorem is saying, how far apart can the data be to make it so that it stays consistent and when you make changes to it. This concept is important because you have to have the actual redundancy close in terms of latency to keep it consistent, but not too close so that one nuclear attack or one flood or all in the same power grid cause it to fail. So this is an important part of the topology of the application as it's evolved over time as the nines have increased. Alongside of that though, when it comes to latency and speed of light limitations, we also have realized that the workload has to be closer to the user. As I was saying, a typical workload of the early 2000s had to have Akamai to make it truly available and have the user experience be positive. And so you started to see caching nodes extend closer and closer to the user. One of the dynamics that we'd like to point out is that at some point the possibility exists where the caching of a workload and this sort of geographic distribution has to start to look like as close as to you as possible. So ideally if I'm watching Man of Steel or some other movie, it's actually here instead of in Los Angeles. And so this part is a dynamic where we're seeing the caching starting to show up closer and closer to the user, even perhaps on the device itself on your DVR or on a residential kind of head end of our video centers. So the workload is really, the way I look at it is expanding to be out toward the access or the edge part of our networks. Exactly, I think the point about proximity is right on. Yeah, and then part of the story is for us is, okay, when you look at the edge and what's happening there, there's a lot of functions for an operator like ourselves. So there are the routers and the access, the VOLT, the taking the fiber out to the home, all that's one part of our infrastructure. But then as we've like required direct TV, we have other things, satellite, we have residential gateways, we have DVRs, and then as IoT happens, these things are everywhere. And one of the issues that we have in OpenStack today is the view that OpenStack can only really manage the virtual machines and processes, the configs, the state that are near it. Nova was designed to assume that the servers that it administers are all real nearby. But does it make sense to put OpenStack in every RG or every DVR? Probably not. And so we have an option, we feel like it's essential to start to think of having maybe Nova talk to things to have more latency between it and what it manages so that we're able to actually take advantage of maybe unused parts of a DVR or an aspect of the access network. Very appropriate. And I kind of see a lot of potential for something like OpenStack to be used in what we call as our RG evolution. And I think I would totally agree with Toby's assessment that you have that ability to leverage certain edge locations and leverage OpenStack which can do a very good job at serving those edge use cases where you have devices that absolutely depend on proximity. So in this diagram, we're showing something that we're working on together right now is this concept where the actual, what runs on the RG is actually a stack of a container stack. And then how we actually make it work and one of my beliefs is that the workload is very much impacted by the developer process it takes to evolve that workload. And as we've seen, if you start from the web server example before, I worked on my HTML, I FTP'd it up to the site and it showed up. Over time that evolved to things like Capistrano and other mechanisms like that or what I thought was a beautiful example of integration into a developer's workflow is like Heroku where instead of using version control as part of my process, I actually just inserted Heroku and used it as not only the version control but also the way I deploy new content. And so that workflow becomes part of the developer workflow becomes part of the application topology. And then in this example we have with RG is we're wanting to enable the developer to work on RG and all of its functions on your laptop and then be able to take it and test it and emulate it in the cloud and verify that it works and get it's all the regression testing and add all the cool agile test driven parts of it to it and then eventually push it out to maybe embedded hardware. So this flow is another part of the workloads and how they're changing over time and making it's a cool convergence of the agile methods with what the cloud is able to do and then hopefully what we're suggesting is making the cloud be able to extend to devices out at the edge. Very cool. And I totally agree that this has potential to actually create a lot of value for our developers as well as for our customers because you can decouple, you can move your software innovation cycle at a much faster rate without having to depend on the hardware cycle. So moving on. This is a very interesting layout of some of our workloads and how they're transforming. Toby, you want to take this one? No, you can. Okay. So I think some of these workloads that we basically learned about today, many of these workloads when they originated they were very, very monolithic apps. Video apps, very monolithic app. You, let's say you have an authentication app or you have a mobility infra app or some kind of video encoder. Typically all these VMs as they evolved over a period of time, they had lots and lots of dependencies packed tightly into one monolithic blob which would then having had so many dependencies would create bottlenecks for a person to then upgrade, downgrade, troubleshoot once it's in a live environment. And I think as AT&T, there is a big emphasis put on empowering our engineers, our QA people, our architects, our designers to actually uncheck all ourselves from that mindset that a software has to only look like this or an appliance, a particular function can only be done by appliances. So what we did was we leveraged OpenStack, we moved to common off the shelf hardware which essentially could be very well, be any kind of open compute device and we started treating everything as a very generic set of compute capacity VMs coming from AIC or any other cloud. And on top of that, we essentially build a tenant-level CICD framework that leverages Docker containers to deliver your applications. Docker containers themselves needs to be orchestrated. So whether it's a video application or it could be a VNF, those orchestrators like Kubernetes play a vital role there. Someday when OpenStack control plane itself is containerized, you could find yourself in a situation where Kubernetes is actually also orchestrating your OpenStack infrastructure. But otherwise overall, we see a lot of value in going this model because it is quite extensible and it has a lot of potential to build upon. So I'm gonna go give you another story from, I'll tell you about early 90s. There was an episode where there was a big hacking a tank up against the network and then there was this fellow at AT&T, his name was Bill Chestwick and then one of the ways that he was using to deal with this attack was to create this honeypot. And then he did this using a function in Unix at the time, charoute. And then in that process, this is how it came up with or helped participate in the creation of some of the first firewalls. But essentially that first firewall was a charouted jail and a PF packet filter. And then this evolved over time to be a lot of other things. But essentially at the very beginning, it was essentially a container. So what I think school is kind of a comfortable circle is there was a period of time where you take Unix Box, you put IP tables or the kind of free BSD version of a PF and onto the system, work up what it takes to essentially make a firewall and then you strap a label on it and then have some fancy GUI website that configures it. And you put the label on it and say, this is in a firewall. So it becomes a thing, an appliance. And now in the mid 2000s, we took that appliance and made it virtual. Oh great, we put it into a VM. And now we're taking it to the next step and then making firewalls as a service. So you can easily spin up more of these firewall or VMs or really configuring just IP tables to manage packets over here. Or even in our case, taking that firewall and making it a part of the SDN. So this flow, if you look at it, what we're coming back to is essentially the topology of a firewall of that particular BNF is just a process with config, with state that is taking in information, looking at databases for what to do with this, maybe dropping packets and then stopping it or sending it on. This pattern, the same pattern, doesn't matter if it's firewalls or you can look at load balancers or session border gateways within a voice system within our environment or P gateways or any of the things that we're working on, they share the same pattern. Interesting part of this dynamic, as I was saying, is, and this is actually well described in the Adromeda paper from Google, is, look, we started to wake up to this idea that, hey, I had all these firewalls and load balancers and IPS devices and session border gateways, whatever. If you look at what they do, they open up a packet, they do stuff and they close the packet and send it on. And they open up a packet, do stuff, close the packet, send it on. Open up a packet, do stuff, send it on. That's a lot of overhead in opening and closing packets and that limits the amount of throughput that you can get. What we've seen is a consolidation down to, hey, maybe we can do that all in one place. And even better, can we do it in a way that's very programmatic? And that's where the concept of service function chaining comes from and then being able to do all of those functions inside of the SDN itself. And then this proposes a kind of a question as an architect, what is the balance between, do we put it in the SDN? Do we put aspects of session border gateway in the SDN? Or do we split it out and make it a separate thing that gets run as if it's a web server? Right, very interesting perspective on what kind of design paradigm you take. And some of these design paradigms may work for certain use cases while you may find other companies taking a different route because their use cases demand a more finer control. So in summary, I think what appears very clearly is that OpenStack, it obviously has so much of capability built over a period of time, like something like NOVA, for example, I spent this week, this last four days attending different sessions and realized that NOVA does try to do a lot for a lot of use cases. And at times for use cases which require extremely high performance, things like we just saw earlier, a media function virtualization or a virtual VNF, virtual network function, you may want NOVA to be leaner, not necessarily be fear. You may want NOVA to actually work with some kind of a plug, a pluggable SDN controller. And it dawned upon me that I had educated myself about blue on in Austin, but I think that this summit was really the time when it kind of like became apparent that something like a green light which allows NOVA to extend itself to different distributions, what kind of workload that it's supposed to drive on a target cloud, it becomes absolutely vital. Blue on becomes absolutely vital because essentially now you could make it work with OpenContrail or you could make it work with Plumgrid or you could make it work with Midokura. And your use case may differ even within the same cloud. If your use case was video related, you absolutely, your time to first packet matters a lot. Whereas if your use case was serving web service, it's not probably gonna be that vital. So I think that I would say that my takeaway from this summit, one of the takeaways from this summit was the importance of some kind of framework that allows Neutron to extend itself with different kinds of SDN providers. Yeah, and in addition to that, as this is, so obviously I've been working very much on the GLUON project and I appreciate him selling it for me that way. The other part of it is about NOVA is that I think it's time to think about how do I either use NOVA or do something else that actually extends to be able to take on the edge in the access use cases. And then as well, not only be able to expand out to the edge and access part of our problem, but also deal more with our problem of what services should be centralized and what should be distributed. And find a way to make more of a how do I manage many, many locations. Today at AT&T we're pushing 100 significant open stack deployments and then now we're talking about in the next round, especially with 5G expanding to a far more number this way. And knowing the dynamics of 5G and densification, you have to be in a lot more places. Right, very interesting. So I think that's the main story, but I wanted to add a post script to our thing that's just as we were here. So you know, one of the dynamics that so kind of made the argument along the way that the workloads are changing and the way that we're managing them is changing, but justifying kind of how do I apply the cloud to every area that we work on. More because everything looks the same and then I can use the same patterns to manage things everywhere. Now, one of the benefits of doing this, you know, not coming at it from what I'm about to talk about, it makes it so that as we talked about, the customers get better, more functions faster, we can move functions into RG quickly. That's a cool part of it, but the other part of it that's essential, so that's the benefit to the customers that get real time capabilities, real time access to resources and real time access to change. But for us as a provider, the cool part is that we're able to do, we're able to really look at our assets and use them. So this is more than just, hey, I have a server, I virtualize it, and then now I can have, I can run many tenants on it and I can oversubscribe it and, you know, like many of the enterprise VMware setups, they're like, wow, it's 400% oversubscription. And I told them about the time I saw this box that had pretty much 2000% oversubscription. But anyway, so the concept of utilization is very important in our world and we've taken advantage of it in the past with things like the two lines that connect your house to the phone network and the phone network itself. We created this thing called statistical multiplexing, which allowed us to oversubscribe copper and be able to use more of that asset for more tenants. We're doing the same thing with spectrum, we're doing a lot of creative things to take a frequency and be able to stack lots of traffic on it. We're taking fiber and getting a tremendous amount of usage out of it. And then we're looking at our facilities as Moore's Law continues to press on us, it's continuing to cause like a common commercial data center that used to fill the room be all contained in a one-use server. When you look at a central office today, that's what's happened is this big of a space is basically now available to fit into your mobile device. Exactly. So that Moore's Law is a part of this dynamic, not only in terms of causing it more dense possibilities, but it's also making it so there's less utilization. And so this part of it is really important, and as I was saying in my earlier example, like if you look at the web servers of 1996 that they were having 2000 web servers on, if you go ahead 20 years, Moore's Law basically is two, four, blah, blah, blah, up to 2000 times more capacity is available in that server. So if you think that one server can only run a one web server, something's wrong. Right. Because it can do a lot more than that. And that delusion or that change in dynamic is causing a lot of underutilization. And for us, we have to address that. Very important point. So at this juncture in the presentation, I think it reminds me a very interesting perspective. Now before I go into that, let me give you guys some little bit of opportunity to stretch it up a little bit. By a show of hands, how many of you took a train, a railroad train, to get to this venue? Oh, okay, at least there are several people here. Now if I had asked this question back in Boston, there would be literally zero people who'd have taken this. So a very wise professor, I learned something from a very wise professor a long time ago. Back in its heyday in the earlier 20th century, the railroad in US in America was like a very big thing. It was like the most major entity, most major enterprise that was available. And it had such a bullish and bright future. However, it went extinct. And why exactly did it go extinct? And there was a very interesting study done. Turns out the railroad industry was always in a belief that they thought that they were in the business of running trains, running railroad carts. What they didn't realize was that that was not really the case. They were actually in the business of mobilizing people. And had they realized that, probably they could have been better positioned to make the transition to airline industry or the airline aviation. So it kind of brings me back that electricity, for example, the electric grid, it evolved over a period of time. And now you see a very, very dynamic function in your electric grid that if you have an excess capacity in certain part of your geography, you could have that excess capacity used up somewhere else based on the usage pattern. So you can draw some very interesting parallels between electric grid and computing grid. And I'll let Toby drive that. Yeah, and this comes from a really a book from about 10 years ago that talked about how 100 years ago the electrical companies formed. At first, when electricity started, the factories were building their own generation on site. Where I lived as a kid, there was still a remnant of this where there was a hydroelectric dam attached to the Alcoa reduction plant, the aluminum reduction plant. Now over time, more centralized power showed up. And the way that it was able to disintermediate and localize power was because they were able to take assets like generators and use them all the time. So the story in Big Switch is basically, during the day the manufacturers were using the power grid and then at night they applied it to, in Chicago they applied it to the lighting. And so this allowed them to take non-coincident peaks of workloads, put them together and get higher asset utilization. And the Big Switch story is essentially, this is what Google and Amazon have been doing. And this was 10 years ago, talking about how they take many workloads, take the non-coincident utilization of disparate workloads and pack them together and get higher oversubscription, even more than just sharing a resource, but been packing utilization. So this concept today, I mean you see this, and this is one of the reasons why Amazon's so successful, and something I believe that OpenStack probably should enable at some point, is the ability to auction off unused resource. So the spot instances are genius because it takes workloads maybe in the middle of the, or resources in the middle of the night that don't do anything, and then allows HPC or batching jobs or whatever big data jobs to happen then. So this allows the infrastructure to be fully utilized at all times. Nowadays, a rack gets rolled into an Amazon data center and it's fully utilized instantaneously. For an enterprise, it could take maybe a year before it gets ramped up to full utilization, if ever given Moore's law. So this dynamic is, and then Google lately just announced preemptive instances, so this is an important concept that they're recognizing that drives down the cost of the infrastructure for customers, and it allows us to get to the same kind of centralized utility dynamics that were shown up in the electric grid. Very interesting, very interesting. So that is to go back before I go to this slide. I mean, this is a part of the workloads that have to be managed better, and in one of the areas that I think we could use some more evolution on with regard to not just placement scheduling, but lifecycle scheduling inside of OpenStack is thinking about, okay, I've watched this workload over time, I've seen how it works, maybe how do I consolidate it and put it together. I still don't think we've really meaningfully addressed the competition of a DRS, Dynamic Resource Scheduling in VMware, make it something that could do something similar. My last slide, just to close out, is my father, we used to work at this facility in Niagara Falls, he was in charge of this dam. And this dam is an extension of the story of using noncoincident peak utilization. So this dam was designed to take advantage of an arbitrage between the cost of power at the middle of the night versus the day. So the middle of the night, the cost of power is less given that people don't use it and then the power companies figure out long ago they wanna make it less so people use things at night as much as possible. So they actually take advantage of it themselves by using a reservoir where they pump the water uphill in the middle of the night and then store the energy at night inside of this lake, this reservoir and then during the day they actually generate power as well as bring water from Niagara Falls. So this concept is not only do they have the manufacturing peak utilization and the people's usage of watching TV but they also are able to take advantage of it at night and then be able to increase revenue during the day. Very cool, very interesting. Another cool story just to leave this is there's kind of like Homer Simpson in the control center of this building they had this panel with a big red button and if you pressed that button you could turn off Niagara Falls. So they did that in order to if they saw people coming down the upstream of the river if they saw them coming in barrels they could press the button and then they ended up building a concrete walkway on one side of the falls so that the policeman could walk out and save the person from themselves. Very interesting. All right, thank you very much. I appreciate you joining us for the session. Hopefully you found some of the content that we discussed today meaningful and something that you could derive insights from. If you have any questions you can stand up to the microphone I believe. Yeah, thank you for the very interesting presentation and you mentioned about transforming the monolithic application workload to the cloud-native like container-native application. It seems that in terms of a telco application there have been a long history of developing monolithic stiff applications. So I think it would be quite difficult to move to a container-based or a cloud-native application. So what do you think is the biggest challenge for the application developers to make that happen? And another question I have is that transition would take some time I believe and there would be a situation where there is a cloud-native application and monolithic legacy application on bare metal, on VM so there would be like hybrid environment. So would there be a new challenge in those circumstances in terms of management in cloud SDNs? Sure, the first two things before we get into the technical part of it I think the first two things are ossified neural networks and then initiative is just really changing your way of thinking of it and then taking the initiative to actually make an open source, whatever, P gateway or MMMC or HSS just going out and making an open source version of that. We've seen a lot of initiative taken for operating systems and compilers and web servers and browsers but not a lot in that area. So those are two kind of people dynamics that are in the way of progress in this regard. I'm glad, so glad you mentioned about the opening the mindset. So the question that was asked here was a two-part question. The first part was you have these legacy applications. What kind of challenges do we normally encounter in turning those into cloud native? I think the single biggest challenge that people encounter, organization encounter is in attempting to decompose in existing legacy applications, many of those assumptions that were horrible assumptions technical debt that were baked into your legacy applications now they basically they arise. They arise from the dead and like you people are not ready to necessarily adopt there are different way of doing certain things if certain applications are expecting a persistent database. I think to move those components from using a persistent database to a purely no-sequel key value pair that is accessible through REST API and the persistence is achieved somewhere far away. Those kind of decomposition challenges are I think are the major challenges. In terms of time, I would say it's definitely not not an overnight job or not even like a one month or one quarter job. I think your success of your OpenStack Endeavor is gonna depend upon how smoothly can you take some of your greenfield application and build them around OpenStack and then gradually turn your ground field application one by one into decomposable microservices. Yeah, and one additional point is the technical level is the VNFs, many of them were built into hardware. So if you take just a firewall or a switch router many times the functions were offloaded in the past to hardware to A6 to FPGAs or GPUs were really purpose built hardware. And so part of the tricky thing that we're dealing with is finding the right balance of what happens in software and what may happen in the hardware. And so now we have options available to us and then it's getting better all the time where we're able to have more easy to program hardware acceleration with FPGA and GPUs. So this part of it too is related to paradigm shift is realizing, okay, I could take something that's custom built and find general purpose ways of solving it and then finding that right balance of what happens in hardware and software. It won't very likely not all entirely be solved with software. We just have to find that right balance. Exactly. Thank you. Sure, next question. Hi, what do you see as the challenge is coming from 5G and 5G with respect to the cloud? Yeah, I mean, number one is that with 5G and any amount of increase in bandwidth the reality is that you can't use the cell towers we have now to deliver that you can but only close to that antenna. The thing is as you increase bandwidth you have to increase power and then it limits the how far it is that you can transmit data. And so this causes what is known as densification where we actually have to have a far more distributed set of antennas. That's why you see other players showing up is an enormous amount of opportunity for disintermediation in the space because of this concept. So now Wi-Fi providers or cable companies can get into this space because they know we may end up having to have an antenna inside of your house or really near your house or inside of your buildings and such. So this is, I think, probably the biggest challenge. Not the rest of it we have down solid of how to actually make it work. But the real problem is this issue that we were getting at before is how do I push out antennas far more in a more dense way? Thank you. Sure. You're welcome. Thank you very much. Thank you very much.


Ok, možnáte mít? Jsou můžete mít? Tak, co? Ok, budeme mít jedna prostě zvukování. A zvukování je, že lidí zvukování sekuritého? Když jsi zvukování? Jsou můžete mít? Ok. To bude zvukování, že lidí zvukování sekuritého a my zvukování se o to příjde. Můžete mít? Můžete mít? Můžete mít? Můžete mít? Takže, co jste si bude. Svukování jsme zvořili pro zvukování seci lináxu i jeho z Redheada. Ok. Taky, možete mít? My zvukování seci lináxu. A točíte, že lidí seci lináxu před svojí seci lináxu. A točíte, že lidí seci lináxu přijde příjde. A točíte, že lidí seci lináxu. A točíte, že lidí seci lináxu. A točíte, že lidí seci lináxu. A toto předpustí bude návodní analizy zvukování. A můžeme se to zvukovánit, když se nám zvukovánit? Co myslíte? Tak, když je to zvukovánit. A můžeme se to zvukovánit, když se zvukovánit, když se zvukovánit? Tak je to můžeme se to zvukovánit. Ali můžeme se to zvukovánit, když se zvukovánit? Ali můžeme se to zvukovánit, když se zvukovánit? some private data on our devices. So this is the issues affecting all of us. Okay, where the security issues come from. It comes from us, from the developers. Thank you. Okay, and how are they fixed? So answer for this question is that we have some kind of reactive security model, oh cool. Tady je tímto. Je to tímto, když se návává software. A můžete se vlunovat, a to je zvukovat, a můžete se vlunovat, můžete mít vlunovat, můžete mít vlunovat, a můžete mít vlunovat. Díky tady máme něco, který máme vlunovat, a díky tady můžete se vlunovat, který máme vlunovat, a tady máme něco, který máme vlunovat, a tady máme vlunovat, které je umelnout vlunovat. A to je v워ta, abych se zavirovat addition security mechanism which brings practice security to your system. It's implementation of mandatory access control and we will talk about it right now. OK, what are the latest known exploits? No exploits has you know logos and names, so do you know any? OK, OK, cool. So I'll start with something different. I will talk about VINOM, it's old one, but it's related to virtualization. Then Daniel Walsh write a nice blog about the latest Docker CVE from 2016. It's a nice blog on round.blog. And the last one is Shellshock. We will look at Shellshock more deeper. But as you said, the dirty cow. So every security mechanism has something, which we call the root of trust. And from a slinnx point of view, the root of trust is the kernel. So we cannot mitigate any damage comes from kernels. So please don't ask me any question if we can deny some consequences from dirty cow. OK, some hacking time, so we will talk about the Shellshock. The point of the Shellshock is pretty easy. We have here the environment variable and in the older version of Bash, you can add semicolon and add any arbitrary code.  So concept of our hack will be that we have two machines, one is victim. On the victim we have a web server and on the web server we have a CGI script. I try to send the HTTP request to victim. And in the HTTP request, there will be exploit and I try to connect to attacker machine. And on the attacker machine, I will be listen on one TCP port. OK, so demo time, let's do it. OK, guys, can you see it? OK, cool. So here I will start listening. On TCP port 99, 99. OK, and here is the HTTP request. And, you know, here is our redirection to attacker machine. So let's try it. And I send the HTTP request and you see here that I have a terminal. I can type any commands, for example, get at C, no, SVD. OK, so I'm here. I forgot to say that on the victim's side, we run SLNX in permissive mode. So the policy is not enforced. We can check it, get enforced. OK, permissive. Let's switch it to enforcing mode. OK, and repeat the attack. Ops, sorry. OK, so once again, and you see that I don't have any terminal here. It's, I cannot write. OK, so as you can see, that is enforcing mode. OK, and what's the conclusion of this? The conclusion is that if you run your Linux system with Celenux disabled or in permissive mode, you're going to get a bad time. OK, let's talk more about the SLNX and about the SLNX security policy. So basically, SLNX security policy defining rules for processes contentment. For example, what processes have access to what resources by defining something which we call labels to processes and resources. Resource can be file directory or link file socket, basically everything on the system. And we are describing interaction between these labels. So let's look on it, on the example. So here we have a patchy script, which is our CGI script. And you see the the blue frame, you know. And the and here we have our resources or objects. And one of the objects is is a web page web pages and the user secrets. User secrets, we can imagine as, for example, the user's home. And here you can see the the interaction that the CGI script can read the web pages. And there is no interaction that CGI script can read the user secrets. Yeah. The interaction, which I described, we call it the SLNX policy rule. For example, a patchy script can read web pages. If there is no slinnx rule, which means there's no interaction, a slinnx will deny it. OK, another example, a patchy script cannot read user secrets. And some technical background. So we can compare the slinnx and traditional UNIX security. In in traditional UNIX security, we have the three categories, the user group and the all or others. As you can see on the example on slash var slash vvv slash html. That user user can read write and execute. The group can read and execute and others can also read or execute. What about labels in a slinnx? So we have four categories. We have also the user, just a small note that a slinnx user is something different than a slinnx user on your system. Then we have a role type type is the most important part of the of the slinnx context or label. And the last one is category. So as you can see on the example, again, here we have a slinnx user, a slinnx role and a slinnx type. And the last one is a slinnx category. In 99% you will take, you will care about the types, this mode and a slinnx we call type enforcement. And with types, we are creating a slinnx rules. OK, let's merge it together. Here you can see the file permissions and here is the slinnx label. OK, what about processes? Here you can see effective user and effective group. What about the patchy label on the system? It's similar as you can see. Here is the slinnx user role and type. So as I said, the slinnx is just something additional to your system. It's additional security mechanism. So at first during providing the syscall, the AC is first and then we have a slinnx policy. OK, you need to keep on mind that if you are doing something with a slinnx that everything is about labels. So please keep it in mind. Slinnx has three modes. As I said during the demo, the most important is enforcing when the slinnx policy is enforced. The second one is permissive mode, which means that the policy is not enforced, but the actions are just locked. Where you can find these locks, you can find it in slash var slash lock slash audit slash audit lock or a pretty solution is just type out search minus m a v c and you will see a v c's. OK, the last one is disabled. I have nothing to say about this mode, so just don't use it, please. OK, if you want to pronounce and change your mode on your system, you find it in slash hc slash slinnx slash config and here is a argument slinnx, you just type it to enforcement. OK, so that's everything and it's yours. Right. Thank you, Lukash. In the following part of the presentation, I'm going to show you what you yourselves can do to improve not only your security by improving the slinnx policy. I'm going to show two short demos of our new tool and I'm going to explain how you can use it, how you can apply those two cases to your case. Since we don't have any fancy name, we're just calling it a slinnx policy analysis tool. The main purpose of the tool is to search through the whole policy and find combinations of permissions that in real life would translate to potentially harm flections. So, for example, we can search for pathways to permission escalation, no. Yeah, that's the one, sorry. Yeah, so we can search for such pathways. The use case I'm going to show now is when you do a change to a policy. You can cause some unwanted consequences, like it can have unwanted consequences and you don't really have to be aware of them. So, the tool is going to help you with that. So, since I need to compare two states before and after a change, I'm going to make two snapshots of the policy. OK, so, there we go. So, the first snapshot. I'm only selecting classes, file and process, since I want to save some time and I'm not going to change any other, so there is no, really no need to. This is the resulting file and I've selected filter bools, which means that it will disregard any rules that are not enabled at the moment due to boolean settings in the system. So, now let's say that I have a patchy server running and I have my super custom config, but it's not working due to Salinux and I'm too lazy to actually search for what was disabled. So, I'm going to enable it to write and read to all non-secretary related files. So, I have this module with one allow rule. As I said, it allows read and write and, of course, get attribute and open to HTTP daemon to all non-secretary related files. I'm going to mount it to the system and then create the other snapshot. So, let's call it graph two, whatever. I didn't provide any policy file. That means that the tool uses the policy loaded in the system, but, of course, you can get a policy file from your server or whatever machine you are using, which doesn't have the tool on it and create the snapshot from there. Now, we have the two snapshots and now I'm going to run a query on the two graphs, comparing them. I'm only running one function, one comparison function, transition write. That's going to search for escalation attacks, like if we're privileged escalation, that's the one, privileged escalation attacks. So, we got a lot of results. Let's see what they mean. So, let's focus on, for example, on this line. This is a label for executable of some daemon, which will run in this domain. The fact that the line is here means that the tool is saying that HTTP daemon can write to the executable of the daemon and then execute it, which means that if someone was to a successful attack, you're a patchy daemon, and then he would be able to grant access to all the privileges of all the daemons that are in this column. The reason why there's so many results at this point is that I've used an attribute. I've allowed read and write to all non-security file types. So, I'm going to explain real quick what an attribute is. Don't mind the labels at this point. This is an actual policy or part of an actual policy for PCP service. The three bullets at the top are the three daemons that are a part of the service, and those bullets at the bottom are resources that need to be accessible to those daemons. So, instead of typing rules that would allow each of those daemons to access the individual resources, we're going to create an attribute, PCP domain, and then assign the attribute to all three types. And then type rules that will be from the PCP domain to all the resources. So, an attribute is an alternate means to describe several types at once. This mechanism is really useful for us because it not only simplifies writing the policy, but also reading, which we will see in the moment, because the other use case of the tool I'm going to show now is that it can take part of the policy that, let's say, we want to know what policy we have for certain service. So, we extract it from the whole policy and then visualize it in some graph visualization tool. So, I've used kefi. The command to extract the actual policy is described on the GitHub, so I'm not going to show it, it's just a simple command. But what I have here is a policy for a keyboard demon. Yeah, it looks really messy. Because if we disregard attributes, there's actually a lot of rules that touch the two tiny parts. We have here the two green bullets, which are the keyboard service. But kefi here is going to help us somehow sort it out, make it look reasonable. So, now we can actually see that there is one really crazy attribute, file type. We need a lot of system services to access all of the files in the system, so that's why we use this attribute. But since I want to know what the keyboard demon can do, I don't really need to know this, so I'm going to delete this and filter out all the nodes that don't have any connection. Other than file type, we have domain, which is an attribute that's given to all processes or to labels that need to be assigned to processes. So, I'm going to delete that one as well, that's obviously assigned to keyboard D, that's the label for the demon itself. This, by the way, is the label for the demon executable. I haven't really explained it in the first slide, but the blue dots are normal types. The orange dots are attributes and the orange lines mean assignment of the attribute to a type. So, keyboard exec t now has assigned those four attributes, which means that all the lines that go from them, they apply to the executable itself. Okay, let's continue. Non-security file type, that's the attribute I've used just a second ago. The same as file type, it just excludes the security-related files, like in the kernel and stuff. So, I don't really need that exact type, that allows or that sets up everything necessary for a file to be executable or for SCLinux to allow execution of the file. And then demon, obviously. So, let's have Gefi sort it out even more. Now, we can pretty much go through the policy now and have a look what's actually going on. I'm gonna show the actual access that's out there. And you can see that you can easily go through it.  You can inspire yourself by policies for other services or maybe just if you make any change, you can compare the two graphs and, you know, see if there's some huge change that you really didn't want to have. Right. So, that's enough for the demo. And so, by now, I hope that I've shown that SCLinux or me and Lukash, we have shown that SCLinux is a valuable technology to have running on your system. Even if you have some super special config for your system, it's pretty easy to set up a SCLinux to accommodate your changes. We have cool tools to help you do that. If those tools won't help, we're here to help as well. I have a shameful block. Lukash will have a workshop tomorrow, where he will show how to write your own policy and some more ways how you can use our tools. So, definitely go check it out. Do you have any questions? No? Really? OK. Hold on a second. Lukash, turn on the microphone. There's a red button. Lukash? Yes, I am. Yeah. OK.  Right, yeah, I call it graph because I actually used a network X graph representation to store that. Yeah, but could I open those graphs with the same program that you used at the last part? Or those are just somehow binary files? Well, yeah, those would actually be... You could visualize them by Gefi, but you wouldn't have those fancy colors and you wouldn't have the actual access permissions, like the text I have there. For that, there is different commands. Let me check. Yeah, visual query. So, let me check if I have some... Yeah. Right, so this is how you could create the graph for Gefi. In here, I select a type of the demon I want to see, or I can actually specify a name of a service, like without the T. For example, the keyboard demon I just typed in keyboard D. And then I select what class is I want to see in the graph. And then that's it. I get the file, I get the... Sorry, I killed it by, you can see it. But because it would take some time, but... Yeah, it's okay, thank you. That's it. Thank you for the question. Another question? Yeah, here. My question is how we can create the new policies based on which languages, OpenSCAP or something like that? Well, we have a special high-level language for policies. There is also a sill language, which is like lower level. But if you're interested in that, go check out the workshop tomorrow. So, yes, as we'd say, tomorrow we will write our own policy for one demon. So, you can see it, okay? Any other questions? Okay. Lot of running today. Thank you. About the tool you have just presented here, is there any plan to package it or to include it in SCD in hooks? And what is the timings about it? Right, so... We are waiting for SC tools for, since I'm using them in the tool. And as you probably know, Fedora doesn't have them in the SC tools yet. So, as soon as that comes out, I'm planning on releasing a package with the tool Fedora26. That's it. Any other questions? Thanks. What is the relationship between the Selinix and the standard Unix file permissions? When I run Selinix, can I forget about the Unix file permission and it magically did it for me? So, the standard permissions are still applied and they're actually evaluated before a Selinix permission. So, if something is disabled due to the system permissions, a Selinix won't even get a chance to look at that. So, but if it's allowed by the system permissions, then a Selinix evaluates it and, you know, so it's an additional layer of protection. A Selinix brings kind of granularity, you know, just to system. OK, so... OK, thanks. What would be the best way to harden a system that has disabled Selinix to set it from disabled to enforcing? What would be the best steps? So, if I understand it correctly, that you have a system with a Selinix disabled and you want to enable it, yeah? So, at first you need to enable it as I shown on that config file slash at C slash a Selinix slash config and then run RestoreCon, which restores the context of your files on the system. OK? Sorry? OK, that's another possibility. Well, it should do it automatically, actually. When you're switching from disabled to permissive or enable, the author's label will go by itself. Yeah. Well, he's starting at disabled at this point, so... Yeah. Ended, yeah. If you have a Selinix in enforcing mode, is there a possibility to exclude certain processes from having any, like, you have a very complex application that you even don't know what in the production system, what file systems it will even touch because the customer can modify it. So, can you just say, OK, I won't have a Selinix, but I don't want to have it for, like, this application running? Yes. There's a concept of permissive domains. So, you can just switch the domain in which the service runs to permissive and then a Selinix will still log the disables that would be there normally, but it won't enforce them. So, like this, you can finish developing the service, then look at the log and allow everything that you actually need and then remove the attribute permissive domain. Yes, and if you don't have a Selinix policy for your service, so then the Selinix is not in the game, no, for that service. Just for that service, yeah. OK, cool. Is there any plan for the future that, as you told now, if there is no policy, that in the future it will change, that if there is no policy, then the service wouldn't be allowed? So... We don't support it. You can run any service on a Selinix-enabled system and, as I said, Selinix is not in the game. You need to write the policy. For services that are widely used, we would write the policy at some point. So, like... Yeah, we have around 500, more than 500 modules on the Fedora systems. So, you don't plan to enforce that every service has to have a policy?  We could potentially do that in some special scenario where you would need extra tight security. You can, but Selinix is enabled by default on Fedora, so we don't want to break everyone's system. Just... So, the question... Sorry, I don't... OK, I don't hear it, sorry. Yes. Yes, we have a... It's not a special mode, it's a kind of a Selinix mode called MLS, and it's going to be possible. Right, so here you have a Selinix-type targeted. That's the default configuration, but there is MLS. That's a different type of policy that has a way stricter definition. So, I'd want to check it out. OK, any other questions? OK, so... OK, Paul, OK. So, I kind of know there's no real answer to this, but I'm just kind of teasing this as something so that maybe you can talk about it, and I think perhaps one of the earlier questions was asking about this. So, the graph that you showed us was really cool, and that was nice. It allows us to see how policy works and how policy interacts, but have you done any work or have you thought about basically going the opposite way, starting with a graph, using any sort of tool and saying, OK, I've got this type and I want it to be able to interact with this domain, I want this domain to have this attribute assigned to it, and then taking that visual representation and generating a Selinix policy from that. Well, yeah, I've thought about it, but well, it is definitely possible. At this point, the biggest hurdle on the way is that the policy uses a lot of macros and four macros, and it would be quite difficult to use them when recreating the policy from the graph. So, if we decided to write all the policies this way, then, yeah, that would be pretty cool, but editing them afterwards in the code would be probably a pretty bad experience, I guess, yeah. So, in Sel, it would have a hard time writing even now, so that's why we have a higher-level language to describe the policy. So, yeah, I've been thinking about it, and maybe at some point we'll get to it. OK, so if you don't have any questions, thank you very much. Test one, two.


Now, just a quick recap on when the bank reconciliations will be easier or more difficult. Remember that if I go back to the flowchart and we look on the customer cycle here, if you are constructing your books from the bank statement, then the bank reconciliation will be quite easy. But only some industries can do that. So you might say, if I just turn on the bank feeds and I make my accounting books from the bank feeds, then the bank recs are going to be easy. But remember that on the revenue side, for example, if you're in a gig work or something like that, you're getting paid by YouTube or something like that. Then, yeah, you can wait till it clears the bank and then record the income with a deposit form. And because you're recording your information directly from the bank, you're not really doing a full service accounting system, but it's fine. If that works in that type of industry, you're relying on the bank to record your books. But most, a lot of industries, if you're at a cash register, you can't do that, right? Because now you've got to record the sales on your side, most likely make the deposit and then possibly match with the bank feeds. You're going to need to reconcile. There's going to be possibly some timing differences there. And if you're doing an accrual system, now you have a whole kind of component that's non-cash related. So once again, you can't just record your books from the bank statement. And on the vendor side, oftentimes small companies are more likely to be able to record their books on from the bank statement. But if you're writing checks, you're going to certainly have some timing differences that you're going to have to deal with.