Okay we're back we're live we're protecting the Pacific today with the Pacific Tsunami Warning Center Gerard Fryer senior geophysicists there and we're going to learn today about tsunamis and tectonic plates and subductions and why it all happens and what happens to us when there's a tsunami. Welcome to the show Gerard. Thank you Jay. Great to have you here. You have to be here.  Well that hypothetical situation would mean that we have failed at the warning center because we would know already and we would have a warning out. But the tsunami coming in a tsunami is a it's a long-term phenomenon people think it's just one big wave but it's not very often the first wave of a tsunami coming from a distant location such as Japan it may be fairly modest it may the water level may just rise a few feet and stay there for a couple of minutes and then drain away and you can see the beach and you can see yeah the water will drain away and you can you can see the sea bottom and there might be fish flopping around and then it'll come back and so you may get several waves like that in fact in 1946 both in 1946 and in 1960 the two big tsunamis in our recent history the first wave to kill anybody was wave number three in both cases in 1946 the waves were 15 minutes from one wave to the next in 1960 they were half an hour from one wave to the next so you know if ever the ocean does anything strange you should take heed and you know the ocean's strange yeah that's a warning yeah what no what do you do I remember uh what was that big one in southeast Asia not too long ago I mean in 2004 in the in there was a big earthquake off the coast of Sumatra yeah and it produced a tsunami across the Indian Ocean now tsunamis in the Indian Ocean are very rare there was no warning system in effect there and and so there was no warning issued and a quarter of a million people died in 17 different countries yeah wow so um they were at that the water's edge when this happened happened by surprise and those waves whatever the sequence was just inundated and drowned them how did they die um well the ones in the ones in indonesia the town of of Bandache a big city of of nearly a million people um there they felt the earthquake they you know very very severe shaking and um so so severe that you could um in video you see people sitting down on the ground because they can't stand and uh and then they got up and went back to their business they did not have a it was over yeah and now these are people who were a mile from the water but it's very very flat there and about 25 30 minutes later a big wave comes in and um um the way people die in a tsunami uh to start off on a more more big note mostly they drown but the reason they drown uh i've i've talked to um to some people doing autopsies and they they say it appears that mostly they drown because they have suffered some kind of trauma they have been hit by something debris by debris or something like that they've been knocked out or um so yeah i mean it's not nasty if you're in the water you're not alone you're in the water with with washing machines with pieces of coconut tree and building something will hit you and yes there's a lot in there and something will hit you yeah so um what now the tsunami comes and it races across this town this city um what's the next step the water recedes just as quick the water the water drains away uh maybe is quick or maybe a little slower but and it drags everything with it and uh and that and everything that's been dragged out that's just armament for the next wave so you know the first wave may not be carrying very much but the second wave is carrying all the stuff that was swept out from the first wave so and and so this can happen um and and in hawaii what tends to happen is the tsunami on the open ocean has has swept past us it's gone it's it's gone but the waves are still bouncing backwards and forwards between the islands and make and that can last for for hours for a frequency would you expect in this circumstance how how often would those waves come they're typically once every every five ten minutes once they start bouncing around certain certain bays um they will pick up uh a higher resonance uh one of our favorites is keiho bay on the big island that seems to oscillate at at about five minutes it's you have water level going up and down about once every five minutes so if you if you see one wave if you are experiencing or observe one wave coming in you can assume that's not the only way there's going to be other ways for sure that that's right and and the other important thing if we if we're down at the beach um in a in a region of hazard uh the other important thing to remember is that these waves are separated by a considerable distance no as i said 15 minutes typically from one wave to the next what that means is that that when the front of the wave the very edge of the wave is at your feet the crest of the wave is out over the horizon so so there's there's no way that you can just look at the ocean and figure out how high this water is going to get it's very very deceptive and i think that's a large part of the reason why people die this there's this phenomenon going on but the scale of it is so contrary to to a common understanding and huge this yeah yeah so when i look if i am standing unfortunately in wikiki beach seeing a wave in is is the is the crest of the wave going to be like a big surfing wave like one of those 25 foot surfing waves or is it going to be relatively small but a big under under bottom uh most of the time um it's just a big surge you know the water level just rises and the water just flows over the land like a river um in in some places and this happens in helo a lot you get so much water in on the land and then it then then it floods off and uh and then the next wave coming there's there's water flowing out as as the next wave is coming in and then sometimes the the the incoming wave then we'll we'll rear up into a vertical wall and so you'll have this vertical wall of white water coming at you um that's after that you can see the fish on the bottom yes open bottom yes that's pretty scary it's pretty scary but we have a warning system that that is pretty darn good and it gets better all the time so before we get to exactly how that works if there is a warning uh i don't know if this is siren or uh use you know public media like radio and tv both both everything everything we pump that word out yeah um what what do i do i mean if standing there watching or to get my surfboard for a quick uh surfing experience wouldn't be a good idea what do i do well um typically what's going to happen is this earthquake is somewhere on the nice thing about hawaii is that hawaii is isolated so we do have locally generated tsunamis but but they're um a fairly modest extent we can talk about them later if you like but by far the biggest danger for us is tsunamis coming from an earthquake across the ocean because they're bigger or because they're further um because that's where the big earthquakes are that's where the big tsunamis come from and hawaii is so so isolated that um the fastest tsunami from a from a big subduction earthquake the fastest it can get to us is four and a half hours and that would be for an earthquake in the allusions directly north of us so um so your first indication that something's up might be the siren going off you haven't felt anything then suddenly out of the blue the siren goes off what do you do what what we want you to do what all the emergency managers in the state wants you to do if the siren goes off you know we have the same sign for hurricanes for um for bomb threats they want you to find out what's going on so turn on the radio um and if it's a tsunami warning it'll say and uh and of course if you've if you've signed up for nixle uh you'll get a page on your phone um what's it called nixle nixle.com this is a service provided by the city and county honolulu free um you get all the emergency messages oh thank you for that nixle nixle.com right and it will also tell you about um about traffic jams and uh and flash floods and uh yeah it's sort of good good helpful might help you um so so that's what we want we want you to find out what's going on and uh and if it is a tsunami warning and if and if you are in the evacuation zone then you should leave and how do you know you're in the evacuation zone well what I would prefer is that you know you know that wherever you go wherever you work or live that you've looked in the phone book or you've looked online and you've found out whether or not you're in the evacuation zone but uh most people you know when the siren goes off that's when they look uh well okay we do have several hours but uh realize that everyone else is going through this same mental gymnastics and uh and so very quickly the roads are going to get jammed yeah I remember there was a tsunami warning oh I don't know us 10 15 years ago you you probably know exactly when but uh so you know we were in office building downtown and in that case we were in the eighth floor of the office building uh no actually it was the forget it was the 15th floor but um so at that time you could see everybody getting in his car and getting on alakaya street and winding up in one huge traffic jam going nowhere for hours yep that was probably 1986 uh 1986 was a very good lesson that was an earthquake we would not issue a warning for that that earthquake now um that that earthquake wasn't quite large enough to um well it's it generated a tsunami but it didn't really send it in our direction and we would know that now but it was a very good lesson because uh what happened was there was this earthquake and then there was a tsunami warning and uh and the state and the counties and many many businesses just let people off and so everyone just went home or tried to at the same moment all at the same moment and so while you were up you know looking down on alakaya at that same instant i at the time when the tsunami was actually meant to hit us uh i was on the summit of diamond head looking down into waikiki and every street in every direction was solid with cars it was absolute gridlock nobody could move yeah and so if there was a tsunami that in that case um the tsunami was like two inches tall or something it was really small it was actually it was uh it was about a foot actually foot yeah not going to do much that's right so uh if in that case if there was a real tsunami i mean a major tsunami from asia or the illusions would have you uh and you were stuck in traffic in your car you would be a really bad shape wouldn't you uh that's right i mean we don't ever want that situation to arise again um and how do you prevent it well uh here we're in a big tall building and there are big tall buildings in waikiki uh we don't even attempt now to evacuate waikiki just say move everybody move up how high do you have to move they want them to move up to the fourth floor or higher of a of a 10-story building we were on the 15th floor so i guess we were safe yeah and we we knew that i mean somebody told us that so um you know we felt we made the right decision even if they've been a real tsunami it would have been safe but you know one one question before we go to the break and that is uh you're relying on the structural integrity of this building as we know uh not every building has the kind of structural integrity you'd like to have and it could be the tsunami is going to push the building right down isn't that possible uh that is possible that's why we say a 10-story building because a 10-story building it's designed a 10-story building is a hefty building um and and if it's if it can handle the load just just the vertical load it's going to be built strong enough that it will also handle the tsunami um but if it's lower than that maybe not so much but um the only the only buildings i know of sure in in waikiki that that are real questionable the uh the original building of the moana hotel which is wood framed yeah um that that is not well it's not even 10 stories i don't know um but uh that that is one building that might suffer damage and then the original building of the uh of the royal hawaiian but most of the other hotels in waikiki they're actually they would actually perform pretty well and and when you think about it a hotel you know facing the water you've got these big plate glass windows and stuff you know because people get the view so the tsunami is going to come in and crash right through that but the bearing walls are on the side and and so they would cut the wave so yeah the wave is is um and and uh there actually is a study uh that the city is is is um promoting that it's trying to get funded um to uh to come up with um criteria for a building manager to check out his building and decide whether it truly is a safe site for refuge during the tsunami but current codes would be would be okay following the you don't have to change the code on this the building code uh there actually is a building code revision that will be coming up that will reflect tsunami loading for those buildings large enough to be deemed refuges you know what else is coming up to right our break oh thank you hello and aloha my name is raya salter and i am your host for power of hawaii where hawaii comes together to talk about a clean and renewable energy future i'm so excited to be here with you to talk about some of the most important energy issues of our day and most importantly who can we bring together energy engineers artists musicians accountants advocates young people who can we bring together to talk about how we can make this path together by walking and reach 100 renewable energy please join me tuesdays at 1 p.m for power up hawaii aloha i'm kawi lucas host of hawaii is my mainland every friday here on think tech hawaii i also have a blog of the same day at kawi lucas.com where you can see all of my past shows join me this friday and every friday at three p.m aloha we're back we're live we've had our break now we're back for more revitalized and we're going to talk about one other thing over the you know the physical properties of a tsunami and that is uh gerard fryer what happens to the ocean bottom is there a permanent effect you know we're worried about losing sand and losing beaches you know a tourist uh you know destination uh where we were worried about climate change in general and how it affects our our topography um what does a tsunami do to that uh that that might be permanent um well it's going to cause a lot of erosion it uh and and it's going to redistribute sediment um so so one of one of the fears uh if we have a big tsunami um you know will the channels in and out of hondledo harbour for example be clear will or in and out of pearl harbour that you might have sand that has been redeposited it couldn't happen very quickly uh yes if the tsunami pushes the sand say from the open beach or you know the initial beach it hits into say the alloy canal the alloy canal is going to be topped off well there's another thing that happens and that is you know a tsunami uh it's moving water all the way from the sea surface all the way down to the ocean bottom so it can actually mobilize stuff from some significant depth from from say a hundred feet or 150 feet down and it can mobilize sand from down there and transport it um but the other thing that happens is erosion and where it floods onto the land there can be erosion uh and actually it's nice that it picks up the sand because then it carries it in and leaves it um on the beach or on the plane that has been flooded save us the trouble well then we well we can come along a couple of thousand years later and and dig a dig a trench there and we see the sand and we say aha this came from the ocean you know this place is subject to tsunamis and in fact uh that is part part of the logic behind our new extreme evacuation maps that we have in Honolulu because we now know that that there have been these events in the past that were a lot bigger than we thought um so what about sea sea life you mentioned the fish you could see fish when the wave recedes how do those fish do do they get crushed and killed in the process well anything left on the beach obviously dies uh coral gets uprooted yeah um uh yeah I mean there's a there can be there can be major changes that out in the ocean things usually recover pretty well one of the big problems uh that tsunamis do um is that if it's really big and and you're a low island um your water supply may be contaminated because because if you know say you damage the lens if it's a coral atoll or something uh you know and you you uh you have a fresh water lens sitting on top and now that's being completely covered by salt water that's happening in the Maldives that's happened in the Maldives uh in in 2004 they basically lost their fresh water and that's that's a long-term loss that's a long-term loss uh they are recovering now slowly um but it was touch and go for a long time they had to have basically had to bring in water from outside if we were to build um climate change type uh uh infrastructure around our island such as Manhattan is doing um would would that help or hinder this effort in other words would would would that be able to stand up against the tsunami probably not uh and would would it exacerbate the result of the tsunami in some way well um that experiment has been tried uh japan uh pours a huge amount of concrete um and they there are many areas in japan where they have where they have these tsunami walls um in most cases they they've made the wall as big as they think the largest tsunami is going to be unfortunately what happened in 2011 was they they underestimated they they didn't nobody thought nobody thought including me uh nobody thought at that time that japan could ever have an earthquake larger than magnitude 8.4 and that that earthquake was actually magnitude nine and the way the tsunami was way way bigger than anything they expected it's a logarithmic scale isn't it uh nine is way bigger than eight that's right yeah nine is actually 32 times bigger than an eight okay putting in a perspective yeah um and and in fact uh we now realize that what they what they had done they they had basically prepared themselves for the hundred year event for the worst event likely to hit them in a hundred years but then they got hit by the thousand year event and uh and the consequences for them of getting that wrong was so severe that you know that the rest of us have to take notice and and so we at that point we go back and look at how hawaii had prepared itself and we realized that we had done exactly the same thing we basically had a hundred year perspective and we ought to have a thousand year perspective and so that's why we now have these new extreme zones on the maps so we now have two zones we have the normal evacuation zone and then if it's truly the big one you evacuate the yellow the yellow area as well so all this is under the auspices of what noah or the city and county or a combination of agencies uh well the warning system is is noah it's actually part of the weather service uh so that's federal um the um that's that's the the science side of things initially initiating the warnings the sirens belong to the counties the evacuation maps the determinations about those are made by the counties um the state uh acts as a as a thoroughfare for federal money uh and uh and distributes it to the counties uh through primarily through the national tsunami hazard mitigation program um but uh we all talk to each other a lot we we all sit down at the same table we all know each other um and and this state actually works really well fed state counties they all get together very well yeah we're really exposed to Idaho doesn't have to worry about this uh that's right yeah yeah you can quote me on that you heard it here on think tech speaking of technology i'd like to talk about you know the most recent events in the tsunami warning system because you know we kind of woke up when we went to the thousand-year way of looking at it right um and we realized as we should that tsunamis are part of earthquakes earthquakes in this in this globe in this planet are always going to happen right and therefore tsunamis are always going to happen um and we just have to live with that so the question is uh how good is our warning system and last time i looked we had we had only these sensors uh out in the oceans uh you said there were seven thousand of we have various sensors uh there are like 700 seismometers so those we use for measuring ground shaking and that's where the initial warning comes from and then we have about 50 tsunami sensors these are these are deep ocean pressure sensors as the tsunami goes across as they measure a slight increase these aren't buoys hanging off buoys or it's actually it's a device sitting on the ocean bottom and then there's a surface buoy and the device on the bottom two talks to the surface buoy acoustically it actually issues a little a ping a chirp uh and the signal is encoded on that and um and and so those measure tsunamis as the tsunamis come across so if the water rises very quickly that buoy is going to know that that device on the bottom is going to know it will know and and and uh and they can measure uh they can measure waves uh you know a quarter of an inch yeah you can measure um and and those are really nice uh the trouble is that um before you know about a tsunami from those things the tsunami has to have got there from where it started and typically that takes about you know 40 minutes or an hour or something like that um so all of our warnings are initially based purely on what we could what we learn about the earthquake because and that's because the shaking from an earthquake travels very fast through the earth so so we know about an earthquake and we can issue a warning within 10 minutes because every earthquake results in a tsunami no no what's what kind of earthquake results in a tsunami and what kind of uh you know seismic event results in the worst kind of tsunami okay um to make a tsunami you basically have to change the shape of the ocean bottom and and um and i the ideal way to do it is to raise or lower the bottom so uh if uh you consider the san andreas you know where which is what we call a transform fault where once the where the pacific is moving in one direction relative to north america all the motion there is horizontal so so if that fault were under underwater and if there was a large earthquake all the motion is horizontal you're not late raising or lowering the water so there's no so there's no tsunami so that movie san andreas you know that's that tsunami no sorry that that that wasn't right you heard that here on think tank also um what happens uh say in the pacific northwest and and along the allusions and in mariana islands there you have a tectonic plate that's diving down underneath the edge of the continent um and so the whole edge of the continent or or the island or the island arc is is caught against this thing that's coming down and it's deformed more and more and more and then it can't take it any more and eventually it breaks uh like snap snap yeah and when the snap actually lasts for about three or four minutes that's the earthquake so so what you're doing is you're raising the seafloor over an area that might be like 70 miles wide and maybe 200 or 300 miles long and you're doing it in only three minutes so what you've done is you've changed the shape of the ocean bottom faster than the water can get out of the way but you basically lifted the water is not compressible right it's that's that's right yeah we assume that water is incompressible it actually is a little huge yeah okay um but if it's it's uncompressible it has to go somewhere that's right yeah something's got to give and um and so you raise the ocean surface and and gravity doesn't like that and this lump collapses and and it oscillates and and that's where the waves of the tsunami come from now the technology has changed uh or at least been enhanced by gps can you talk about that uh yeah um with with seismometers you're basically measuring waves and and uh we're interested in measure we we in particular want to be able to measure quickly the size of the largest earthquakes the trouble is that when an earthquake gets really big uh the uh the waves that it generates are determined by the size of the area that was ruptured so that may be very very low frequency like like five minutes from one wave crest to the next and you're measuring that with a seismometer that takes time and um you know you're measuring you're measuring wave amplitudes on a wave that has a period that lasts for five minutes uh so so it you know you basically have to take five minutes to make the measurement and uh you know we want those five minutes um gps is different gps uh the geodetic grade gps which which measure which can measure motions down at the millimeter level um there um it can see the the motion immediately can see it can measure displacement immediately so um um you have a lot of data to work from now you have much more data than you did simply with the sensors as a result right do much more profound calculations on this yeah that's that's yeah and you have it you you get the measurement a lot faster the only gotcha is that you've got to have the sensors very close to where the earthquake is going to be may not always be the case well that is the case in japan it's the case in the pacific northwest it's the case in south america which are risk areas yes all of those areas now have enough we're getting a lot smarter aren't we oh we get yes yes and the and the other wonderful thing is that everybody shares data all of it yeah everybody we realize that we're all in it together yes and and uh we are in it together and we really appreciate you sharing the data gerard fryer senior geophysicist in the pacific tsunami warning center we've only begun in the technology you'll have to come back because i want to may i say drill down on that absolutely sure yeah thank you gerard thank you so much


Hello. Good afternoon, everybody. Thanks for having us again to speak on the main stage at FOSDEM. It's great to be here. My name is Guido. I'm a long-term FOSDEM attendee. I've been developing them spare time. I also work at Google. And we're going to speak today about Linux Desktop on Chrome OS. The code name is Crosstini. Myself, I joined Chrome OS a few months ago. So I couldn't miss an opportunity to come to one of my favorite conferences to speak for the first time in my life about Linux on the desktop. So what will we go through? We'll discuss a bit like this introduction, right? And then we'll go through a bit of getting started with Chrome OS and Crosstini. We'll go through the architecture. And Michael Dylan, who is in the Mountain View team that implemented the backend of Crosstini and the machine management on which it works, will explain the internals. And then we'll go through a small advanced usage demo or failing that miserably, we'll go through slides that shows what the demo should have looked like in case things like go. So this is our plan. You've all probably heard of Chrome OS. This is a Linux-based operating system that is quite widely available but is also geared at the cloud type of work based on Chrome. One of the most exciting things that happened to it was the development of, recently for people like us, was the development of Project Crosstini, which is a Linux Debian container natively running integrated into Chrome OS so that you can run anything that you run normally on Linux in a Chrome OS machine. You can run a Chrome OS machine to other people or you can use it and deploy it in your enterprise with the advantages of a simple and managed operating system while at the same time maintaining the flexibility of a Linux system. Given how widely available Chrome OS is, which is not like amazing in every country, but still in the US you can just go to a shop and buy one, right? Like very easily. I would say that this is probably the closest, most available, Linux desktop just like comes there, right? So it's an interesting development. So starting with Crosstini once you have a Chrome OS machine is very, very easy.  And then this is installing and then you get dropped at the probe, right? And then this is Debian and that's it, right? So this is probably the simplest installation of Linux that I have seen.  Once you install applications, they are integrated in Chrome OS, so here we installed a few development environments, right? And then you can start them just like you click on the clips, it starts as a window, any other development environment, or your terminal and anything in the terminal, any other app, everything works. On top of that, File System and Google Drive sharing were integrated, so you can share a Google Drive folder with Crosstini, or vice versa, you can access Linux files from the file manager inside Chrome OS, and so then you can save from your Linux programs inside, like Drive shared with Linux there, and then see it in Drive, see it on your other Chrome OS computer, all these kind of things, or from Chrome OS you can manage Linux. Clipboard integration works kind of. There are some restrictions related to the fact that we don't want Linux to programmatically access anything that runs on Chrome OS, so you have to manually paste things in. This is to avoid attacks in the Linux container that extract data out of Chrome OS without your wish. So networking works, and once you start something in the container, for example Apache, you can just go to either Pangolinux Test, or for many ports just on localhost, and you'll be redirected to the container where you can test your development results and so on before uploading. Clicker is good. You manage your settings just inside the Chrome OS settings, and there's, like, right now in Dev, a few settings are more coming depending on what we implement. I'll have to do it manually. Sorry. Here. We have some roadmap of things that we're already looking at. USB pass-throughs so that you can share a USB peripheral from your Chrome OS directly to your container, support for audio so you can play your favorite games, but also so you can, like, listen to things anyway. Like audio integration, GPU integration, also for any sort of development with 3D, or anything else, and also Fuse is something that didn't work in the first version, but is coming in the next couple of versions. Working myself in Chrome OS Enterprise, I'm also going to mention about the enterprise and manageability features. So when you buy Chrome OS as a consumer, you won't see any of this, but if you buy a fleet of Chrome OS devices with Enterprise management of them, then you can manage the whole fleet centrally from Google, or you can export your policies in other way, and they will all behave depending on that. So for Crosstini, at the moment, we have only a few policies versus device policy to turn it on and off. So if you don't want any of your people to use Crosstini, you can avoid it. Then if you turn it on, you can decide whether only members of your enterprise can use it and which users can, or whether a user that is logged into the computer in case you allow friends or other people to log into the computer that are not your enterprise users, log in whether they can also use Crosstini or not. This is just really a small step. Of course, as you can see, there is more enterprise features coming to make the container controllable centrally, but we're going to talk about them when we have them and when we have designed them. This is what is coming relatively soon. I'm now going to pass on the microphone to my colleague Dylan, who's going to speak about the internals of the architecture of Crosstini and how it came to be and what is inside. Thank you very much, and see you later for the next one. Thank you. Alright, so Chrome OS is already kind of a desktop Linux. We've run on a Linux kernel. We have a user space that's built from Gen2's portage build system. We run a slightly modified version of Chrome for Linux as our main UI. A lot of times people look at me kind of crooked and say, you spent a whole lot of time making Linux apps run on Linux. At their core, they're kind of right. There was a lot of complications in doing this in a way that preserved Chrome's core driving principles, speed, simplicity, and security. Security being the big one that we really didn't want to mess up. Chrome OS has been at the forefront of desktop security since it launched. We didn't want to take any steps backward on that front to add this new feature. One of the key principles we have is that we don't let any unsigned native code access to our kernel. There's too much kernel attack surface to expose to random code. So the only code that we run that isn't signed by us that we're sure is safe runs in a Chrome renderer process and is very well jailed. So to preserve that kernel protection layer, we decided that instead of trying to make these Linux apps happy running in a jail, we would just give them their own kernel and put them in a VM. The solution we ended up with actually ends up with two Linux kernels and three complete Linux user spaces. So if you look at the overall architecture layout, it looks like that. But actually, a little bit more like this. You can see we've got our two kernels. There's three user spaces. The main Chrome OS user space. There's a user space inside the VM, which basically is there to bootstrap up an unprivileged Linux container, which is our third user space that the users actually interact with. We're using stock upstream LXD to start the containers, which is nice. It gives us a lot of flexibility. We've got a lot of pre-manufactured containers that we can run. And with that, we start a Debian stretch installation up top. We've got our installation, which jails the Debian installation. And then there's an extra boundary, the VM boundary, which is the boundary between red and blue in the picture. And that boundary is the most important boundary. And to make sure that was as secure as possible, we went and really evaluated how to make a virtual machine boundary that was as safe as Chrome's current security principles. And we looked at the available technologies, and we decided we were going to use KVM in the Linux kernel, but that we weren't super happy with the user space options that we had. So we started from scratch and wrote a new virtual machine monitor in memory safe language. We wrote it in Rust, just to give the maximum amount of protection we could from guests trying to escape into the host. We called this new VMM Cross VM because we were not creative that day. So the principle of this was that it was really focused on security first. Performance is important, boot up time is important, but nothing trumps security. You have to make sure everything is as safe as possible. So the good thing about this is whenever the guest needs to request anything from the host, the normal path is it pokes an event FD, something on the host side wakes up, and we have memory safe code written in Rust that does the parsing of all the untrusted buffers from the guest, et cetera. So we don't have memory overflows or weird exploits going on. To take that a little further, we also decided to run each emulated device in its own Linux process. So when Cross VM starts up, it's got one main process.  They run in independent sets of Linux namespaces with different views of the mount tree and with different access to different system resources. So the main benefit here is that our, like, Verdeo random device, if it was to get exploited, wouldn't have access to the networking stack. Only the Verdeo network device has access to that. And if you exploited the block device, it couldn't get to the data in Verdeo random. So all of that combines to keep the guest away from the host. And that's great. That's really what we wanted. But in a perfect world, you would never need your guest to access your host. You could just keep that hard line there. But we really wanted to integrate things. We wanted to integrate the UI. Sharing and network. So we had to punch a few holes. And to do that, we added some host-side demons to Chrome OS to help share things with the VM that we're running. The biggest one of those is there's a Wayland compositor built into Chrome now. And we share that Wayland interface into the guest. We've got a custom Verdeo device that lets us have a zero-copy display pipe from apps running in the container in the VM out to Chrome. So you can get really good frame rates if you're doing video decode or playing a game. We added something to manage the VM's life cycles. So Chrome by itself doesn't have privilege to start a VM. Again, just added a security boundary there. There's a separate process there which manages bringing up and taking down VMs as the user needs them. We added... Cicerone here is really interesting because it's the part that integrates the UI bits. So if you install an app in your VM, it notices that there's a new app in your VM and says, hey, maybe I should put this icon in your launcher. So now you can click on that icon and it just launches your app. And that communicates over... GRPC over VSOC into the VM. Finally, we had file sharing access. So you can selectively, as Guido showed, select files you want to share with the VM. So, hey, I've got this thing in an email in Chrome OS. I'm going to download it. It's in my downloads folder. And now I want to edit it because it's a C file or something and I don't have a good web editor for that. So I can click on it, share it in. It gets shared over 9P into the guest and then the guest can open it up and edit it in Vim or whatever they want. All these host-side demons also need endpoints inside the guest, so they need somebody to talk to. So on top of our default Debian installation that runs inside the guest, we've added a few... I'll do this one first. We've added a few demons that talk to the host and they're aware they're running in a Crosstine EVM. The main one's called Somalia and it's used to help X11 apps run against our Weyland compositor and to kind of bridge standard Weyland into something that works over VertiO Weyland. We actually have to run three of these. One for standard Weyland apps and then one for a low DPI and one for a high DPI because most X11 apps are awful at running at high-res screens like we have on some Chromebooks. And in addition to that, we added Garcon, which is the guy that talks to the UI component outside of the VM. So this is the thing that notices when an application is installed and shuffles its icon out to Chrome OS or gets poked by Chrome OS and says, hey, please launch this application or please install this application. So the VM we run, we called Termina, this is the thing that starts inside the VM, so it contains the init for the VM. And we wrote a custom init that was, again, super stripped down, knows it's running on a Chrome OS machine, knows that its only job in life is to get LXD up and running and start a container and do some lifecycle management things. Once it starts, it brings up LXD. We've got one more daemon we wrote which is there to kind of bridge the standard LXC container commands out of the container and out of the VM and into Chrome OS so that we can poke it with GRPC and it can talk to LXD over its native interface. The main advantage here is that all this VM side code is completely read-only, signed and trustworthy, so you can always get and start up to this point. No matter how corrupt you blow up your container or anything, all this is all unmodifiable and all signed by Google as well so that you can trust it as much as you trust any code on your Chromebook. Okay, so that gets you to the point where you can run our default installation. Our default installation is Debian Stretch. It's pretty basic. It suits my needs fine. It suits a lot of users' needs fine. Although I imagine there's a few people who want to do something different or want to explore more what they can do in this room. Some people like different distros. And all this other stuff. And we've allowed you to do a fair amount of playing inside the VM. So we're going to try to do a demo of one of these more advanced usages now. Thank you very much. I'll try now to do a quick demo of this. If it doesn't work, I do have some slides. I'm going to publish then the slides with basically screenshots of the demo, but now I'm going to try to do it live. Do you have an idea how I can just replicate the screen? Because it's going to be very... Do you want to hear it? Yeah, I want to hear it. Okay, so we've already seen on the screenshots how to just install it and do it normally, but if you want to interact a bit with Chrome OS, you can just press CTRL-ALT and this Chrome OS shell will pop up. Is it big enough? Should I maybe increase the bit? I'll increase the bit. Should be better. So once you have this shell, you can type a lot of different commands to, like, see and interact with your Chrome OS system. Right? I'm going to just type VMC and this tells you how to interact with these virtual machines. VMC list should show that there is one terminal virtual machine. You can create more. There is not a lot of need because then inside each terminal they all look the same and you can create different containers. So right now, I'm just going to type VSH and this allows you to join either a VM or a container inside a VM. If I type VSH terminal, this just connects me to the Chrome OS user inside terminal and this Chrome OS user basically can run LXC, right? So if I do LXC list, it shows my virtual machines. On a normal installation, you will just see Penguin, which is the default container which runs Debian and it's IP address, right? From this, you can also see, for example, the network site and you can just use LXC in various ways to study your situation, like as you would normally and as you can check in the man page. One thing we're going to try to do is list our remotes and this shows you basically these are the default remotes that are published in Chrome OS. You can add more. Images is like images on Linux containers. So if we use that, we should have a good amount of random Linux distributions. I'm going to list AMD64 images that are available there. There's... Yeah, good luck with the Wi-Fi. If it doesn't work, it's okay. I remember a few... I don't know if we had a network connection here or something. Okay, we're giving up on that step on a good Wi-Fi, like when not everybody is downloading their updated apps at the same time, it works. From there, you can copy an image. So for example, LXC image copy, Alpine Linux, which is very small on local. You can copy it, so it should work very fast just checking. If it doesn't, I'll just move on. Okay, so it's completed successfully. It didn't have to download it because it already had it. Then I can go and see Image List. And I have some, like, versions that I had already copied from before, but you can copy anything that you see in that images, where Subuntu, where it's made. There's a lot of various distributions, and otherwise you can find your own container images and just put them there, right? Just adding another remote. Then from there, I can just launch a new container, right? So now I'm going to launch it for real. So I'm launching an Alpine 3.8 container still because it's small, and they're going to call it Alpine 1. I have a few that were already running, but this one is new. So it's creating it, and it started it. If I list now, I used to have Alpine 0, Alpine 7, and Penguin, where Alpine 0 and Alpine 7 I was just experimenting on, and now I have Alpine 1, and I can just connect to a console, and route on my new container, and of course I need a bit of network, but hopefully. Otherwise I have a container that is already configured. You know. What am I to do? This morning it worked, but everybody was sleeping after the party yesterday. Unfortunately, everybody's awake and I touched something. We have a bit of time. That's where it's in. So I now have my packages available. Then I can go apk.add apache2. Not too bad. Also open SSH. Maybe we'll just use apache2. Give it. Okay. Then I can start them. I'll start apache2. I'll just add a user. Of course, of course. It's a very demo. I would use a real password, I promise. I could also have changed, you know, to allow a direct route to log in without... Don't do that, right? Okay. Cool. And now that we have that, I can go in my normal container, right, and then I can just go SSH on my new container, and that's where they work. Of course, we trust it. And... I'm in there. Or, since I installed apache2, I should be able to just open Chrome. I don't know... It shouldn't really work at alpine1.linux.net first. I haven't managed... Exactly. So... I'll just go AlexeyList. Alpine1.1 was this just going Chrome to my IP address, and it should just show me my default installation of apache. This... Thank you, thank you. Amazing. And of course, this is mostly meant for developers, so you can publish your dev things and then try them in Chrome directly. You can use it really for anything. You can run your little services, experiment, perform. At that point, you are free both on the distribution side, deploy your containers, pretty much anything except the things that we're still working on that I listed in the roadmap. This concludes our talk. There is some time for the Q&A, and we're going also to leave you our contacts and our list, so that... So this is just what we've just done in the... network now. So thank you very much if you have questions. Can I say... Hi. I have a little question. Okay, round to the question directly. Thank you. Before Christine was released, I was using something else called Crouton, I think. It was like a community where someone who made it in his leisure time, did you collaborate with him or did you use a totally different approach than what he did? Thank you. From what I know, Christine was inspired by Crouton, but the approach was different to allow it to run in a non-modified, non-dev version of Chrome OS. Maybe Dylan can speak more about that, but we have several of the Crouton maintainer types are actually on our team and had done that, so they contributed a lot of ideas and we're excited to see us basically make a verified mode Crouton, which is what we started calling this and hence the cross-dini name. Hey, I've played around a bit with it and as far as I understand the port porting stuff is only between the container and user space and it's on. Okay. Okay. So I've played around with the cross-dini and as far as I understand the port forwarding is just between the Chrome OS user space and the container user space inside the VM, so there's no way for me to SSH in and out of my container to another device. Is that right or is there a way to do this? Yeah, that's right. That's on purpose, at least for now, we haven't come up with a way we're happy with to expose ports from inside the VM to the outside world yet. It makes us feel a little creepy, we don't have any open ports now and adding them is kind of scary from a security standpoint. Thank you for that. On the other hand, you can for sure connect from inside the container outside, you could do some SSH forwarding or other things if you need to. This is mostly meant again in this case. If you want to run an onion service on Crescent, you could and it would work, I guess but the idea there is you connect from there from your own machine or among all the containers everything also works right so you can SSH between different containers on your machine and so on you cannot create a network of Chrome OS devices unless you have some other layer there but that's not by default one is how strong is isolation between containers they are running in the same VM or it's possible to have separate VMs for each container and the second question about GUI integration, is it possible to extract single windows or from application running inside those Linux containers or it's only just some full desktop something. You can start multiple VMs and have end containers in each VM didn't quite catch the second part of that question any of them can display windows if you'd like so they all get the connection to Chrome's Wayland socket but you need to if you're going to run a non standard container you need to go do the plumbing that has the special demons I talked about running inside your non standard thing so it can talk to a slightly modified Wayland protocol or of course you can port all of your tools for your favorite distribution I have a little question about security you said that you're trying to keep your software as secure as possible however when you buy a Chromebook the security update stops after seven years between five and seven years so how can you say secure and is there a dependency between what you're proposing and also the Chrome OS you have on your computer. Yeah eventually they stop updating but if you really want to keep using this ancient Chromebook you can keep pulling builds and updating it yourself if you'd really like and you can sign it yourself obviously we're a big believer that the hardware is yours you can go pull the right protect screw on your seven year old Chromebook and start signing your own things if you don't trust Google's signature either so how secure it is is really up to you if you want it to be or you can do the easy thing and let Google worry about it and you can do it too does this work on a Chromebook that isn't in developer mode sorry could you say it one more time does this work also on Chromebooks that aren't in developer mode yes it works in developer mode everything that works in regular mode works in developer mode it works in normal mode by default yes you don't need to be in developer mode if you want to be in developer mode you can be in developer mode feel free so half my question was answered by the FAQ it's not supported on the ChromeOS machine I have so I'm wondering why and if I did like try and build do my own builds like what would be stopping me from what makes it difficult to support like a 2013 pixel a first gen pixel which has like all the horsepower you would need to do VMs but Google has stopped updating our goal is to get it to as many Chromebooks as we possibly can we really do want to bring it to as many Chromebooks as possible there are some challenges on some of the older ones some of them don't run the newest kernels and don't have some features that we need and updating their kernels is rather expensive because there's too many bugs in new kernels and the combination of the old kernel with the recent Intel speculative execution issues has made it very hard for us to update some of those older big core devices in particular so it's something we want to do we're just trying to figure out how could you say a bit about your approach about GPU acceleration inside the VM we're working on it it's a big chunk of work to get the GPU exposed into the VM in a way that we're happy with from a security standpoint but we do have people exploring that now so hopefully someday soon it's about as non-committal as I can be with the schedule I have a question about just about distribution of apps I mean if we have a Linux app that we want to make available to Chromebook users but we don't want them to have to bring up shells and go through that whole interface is there a plan to have an app store type of mechanism for installing apps our initial pass here has been very focused on enabling developer use cases and not so much on app use cases so today that's not really super smooth so if I just want to go click on an install package it won't automatically get me through this whole setup flow if I've gone through this setup flow and then I can double click on a .deb package and it will just install but you still need to go through this initial setup which is kind of a barrier as this has still got a beta tag on it for some good reasons and it's really only tested for these development use cases we wanted to enable people to develop webpages, develop progressive web apps these types of things on a Chromebook first and then we're looking to expand those use cases in the future I'd like to encourage that thanks have you looked at the performance overhead do you have anything virtualized do you have any numbers about it there is a there is somewhat of a performance aid it depends on your workload the biggest things are normally IO heavy operations that do a lot of VM exits so if you're looking for like the absolute utmost performance from the hardware it's not quite not quite native but it's really close to native and it's been fine I've been using it as my only development device for months and months and I've been okay with it for things like building kernels, building cross VM building audio servers things like building Android I still go to my big beefy desktop okay thank you so in your Apache test it was connected via HDP and IP addresses and you can't open ports you can't open ports so let's encrypt isn't really an option for HDPS I'm wondering if there are any thoughts to making like a local let's encrypt kind of style certificate authority that maybe Chrome would trust and some sort of way to create like local domain names that could then be used in that scenario yeah so for development we trust the container like we trust localhost so we're cheating a little bit on that and that's probably good enough for the use cases where someone is developing a web page or a PWA it lets you install PWAs and that was our main goal and we don't have a lot of plans to enable this as something you'd actually run a production service on because it's still just a laptop right we're not looking to take over the server space here great okay thanks a lot everybody


This is your friend Tim and I've come to tell you another chapter of my exciting Christmas adventure with the little elf who is only nobby three and who jumps. He jumps up and down backwards, forwards, and sideways. No wonder he's called Jump Jump of Holiday House. No sooner had we escaped from the Iced Forest and something else happened to stop us from approaching the Ice Queen's Palace. We were on our way there to save Santa's reindeer. This time it was a great big crack that suddenly appeared in the ice right across our silver path. He went down, down, down. So far you couldn't even see the bottom of it. It was so deep and it was much too wide to jump across. Merry holiday, sleepy Slim the lion, Archie Poggy the clown, and the poet Jump Jump and I just stood there looking down and feeling thankful that we hadn't fallen over the edge of that deep crack in the ice. I'll tell you all about what happened next in just a minute. Hi Tim. I don't know how to get across. Yes Tim. Oh I'm sure it is. She's laughing because she has succeeded in stopping us from reaching the ice palace. Merry holiday, we're not stopped yet I say. We'll surely find a way. But how, poet? How can we possibly get across this gap in the ice? I can jump, I promise. Oh no, Jump Jump. You stay snug in my pocket. Not even you could jump that far. Merry holiday is right, Jump Jump. It's much too far to jump across. I think indeed a bridge we need. Yes, poet. What do you think, sleepy Slim? Oh he's fallen asleep again. Really, sleepy Slim can take a nap no matter what happens. Archie Pogley, have you any ideas? Archie Pogley's shaking his head merry holiday. He looks too discouraged to say anything. I know, I have an idea. What Tim? Oh no. At first I thought we might try to throw a rope across the gap. But of course we left the dog team back at the ice forest cabin. We couldn't have any ropes with us now. What we need is more Christmas spirit Tim. Oh I wish the Christmas fairy were here to advise us. That's very true. I agree with you. Oh fairy dear, we hope you're near. Jump Jump is right. How strange it looks. Our words are freezing in the air. So they do jump jump. They're little tiny words, but they freeze all right. It must be so cold that even our words are turning to ice. If it weren't for the Christmas fairy's protection we couldn't stay alive in such cold. Oh I wish she would come to advise us. That's all wish together shall we? Yes, everybody wish hard. Please Christmas fairy come and help us. He's coming merry holiday. She's coming. Yes. There she is. See floating above our heads. Oh we're so glad to see you Christmas fairy. An angel fair with golden hair and face a light with love so bright. We're sure glad to hear your call again Christmas fairy. We want your help. You see we don't know how to get across this gap in the ice Christmas fairy. What shall we do? Yes Christmas fairy. Yes. What's she saying merry holiday? We're all aglow and long to know. Well I'm not sure I understood what she meant but she said build a bridge of words. Well that can't be right or can it? Oh look she's gone from site already. I know what she meant. What? Jump jump? It comes to me I think I see. Well I wish you'd tell me then. I already don't understand it all. Don't you remember a little while ago we noticed how the poet's words frozen the air merry holiday? Oh yes yes I remember. When I recite in the air I write with words of ice it's very nice. Now I understand but how can we build a bridge of even frozen words? Christmas fairy suggested it so I should think it would work. Oh me oh my now we can try. Of course we can try and right now we've got to get across the gap and be on our way. Let's recite one of the poet's verses. Well my latest is nice it will look well in ice. These are written down on paper so that we can all read it poet. Oh I hope I've not lost it. I'd love so to frost it. Is it on that bit of paper sticking out of your pocket poet? Yes yes yes I really do confess your eyes are sharp today Miss Merry Holiday. May I have the poem poet? I'll hold it up so we can all read it aloud together. I think the stronger the voices the larger the word will be don't you? Let's try it anyway. Of course you can jump jump. Can you see all of it? It isn't a very long poem poet. That doesn't make any difference to him. We can say it over twice. We'll say it twice. Oh that would be nice. Let's go. I call it snow. Snow! Oh look it works the words have turned to big solid blocks of ice and they're hanging in the air right above the gap. It's wonderful. It looks strong enough to hold us up all right Merry Holiday but we need lots more ice words to reach the other side of the crack in the ice. Well all right let's finish the poem. Snow, snow, snow. Everywhere I go I really like to know if anything would blow in such a mess of snow. It certainly isn't your best poem poet but how useful. Yes there's a solid bridge of frozen words reaching from one side of the gap to the other. Oh boy we can go across now. Hooray, hooray. I'm glad to say we're on our way. Well the bridge is as wide as a street. Come along everybody. Let's hurry across before the ice queen happens to notice what we have done. Take care Merry Holiday. The bridge is solid but it's made of ice and it might be very slippery. It's jump jump all right. Oh take my arm and then no harm can come to you Ms. Mary do. Oh you all take such a good care of me. Thank you poet. Coming Tim. Merry Holiday just take a look down will you? I can't even see the bottom of that crack below us. Come sleepy slim and little Tim and my friend the clown. Oh don't look down. Twill dizzy make you. No mistake you. Well here we are all safe on the other side of the gap. Yeah. Now we must hurry to make up the lost time. How far do you think we are from the ice queen's palace now Merry Holiday? Surely only a few miles Tim. No wonder she wanted to make us turn back but we'll never do that. Will we Merry Holiday? Not until we've rescued the reindeer and taken them safely home to Santa Claus Tim. Let's all watch out if the ice queen's about she'll try a trick because she's quick. That's right poet. Let's all stay close together now and keep your eyes open and listen carefully for any unusual sound. Well Merry Holiday we will. Now that we were getting so close to the ice queen's palace my heart began to beat so fast that at first I thought it was the sound of an army marching towards us but no I couldn't see a thing. Then suddenly Archie Pogley shouted. Look out! Where? What Archie Pogley? Oh yes to our left. Whatever can that be? Oh. Oh. What is it Merry Holiday? I hear from you. Yes Chub Chub. I hear the sound of running feet too but I can't see anything except a whirling cloud against the white snow. The ground the snow makes it hard to see very far. I thought that sound was my heart beating. Oh Merry Holiday Archie Pogley what's coming now? Oh goodness. There's that ice queen's left again. What is it? Let's stay close together. Can you make out what it is poet? It seems to me that it must be a danger great and if we wait we'll be run over and glad no more. I can make out something now Merry Holiday. I can see a whole crowd of animals rushing toward us. Yes there are polar bears Chub Chub. I can see a lot of seals and plenty of black and white birds flapping their wings. Those are penguins Tim. The ice queen must have imported those from the south pole. We'd better run this won't be fun. Oh we can't outrun that herd of animals poet. Oh Archie Pogley's leopie's limb can't you think of something we can do? Listen to the noise they make it sounds like a herd of wild horses. Maybe we had better run for it Merry Holiday. No that's just what the ice queen wants us to do Tim. Oh Tim catch Chub Chub he's jumped out of my pocket and is taking big jumps toward the stampede of bears. Chub Chub come back here the bears are coming very near. Oh it's worse than trying to catch a grasshopper he jumped so fast. Chub Chub you can't fight wild animals.  Oh I can't catch him either. He's so angry he's talking at Elf Pog again. Oh Chub Chub you'll be hurt. Archie Pogley can't you do something help us. It looked pretty desperate for Chub Chub right then because he was jumping right toward the crunching crowd of polar bears and wouldn't stop no matter how Merry Holiday called to me. He laughed again. He heard it echoing all over the sky. I gave you the shivers. I didn't know what was going to happen next. It was Archie Pogley who was going to think something we do so be sure and listen tomorrow and see what it was. Goodbye.


I'm saying sorry. She thinks it's cute that her driver almost hit my kids. And she thinks she needs to take a video of it. Instead of apologizing like a saint... So stomping in the middle of a row is going to help?  I'm saying... I don't know, calm down. Calm down. And you know what? And that didn't upset me.  Sorry. That told me to calm down.   She'll send an example. I'm sorry.  Your window's open. They can't hear me because they're listening to kids talk. Yeah.