Today we're going to talk to you about how to secure your infrastructure as a service environment in one minute. Obviously our talk is not one minute, but we'll try to secure it in one minute. Obviously you'll see it after it will be secured already. So a short introduction before we get into the details. My name is Nir and I'm a public speaker as well as managing the security for the retail division within NCR. Here I'm speaking about something that is my passion and just one thing that you should know about me. I like sport, but just not sweating sport. That's about me. I'll let Moses introduce himself. Hi all, thank you for coming. My name is Moshe and actually I don't like sports, but it's pretty much the same as not liking non-sweating sports. I have been working with the innovation scene in Israel for the last couple of years working with startups. We have a lot of startups in this neck of the woods as you probably know. And I've been examining their challenges in the last couple of years, how they adapt cloud, how they handle cloud security and this is where the stock is coming from. This is from our experience regarding the new adoption of cloud services. Now cloud and cloud security is such a lot of large words. I'll try to emphasize exactly what we mean. I try to focus the talk. First of all, we're going to talk about IS, infrastructure as a service, which I'm pretty sure you're familiar with this term. Infrastructure as a service, Amazon Web Services, AWS, Google Compute Engine, Azure Rackspace. Those are basically the providers that we talk about. Inside infrastructure as a service, there is a layer. It's a relatively new layer been introduced in the last, I don't know, five to six years. It's the orchestration layer. It's basically the layer that enables the automation, the allocating the resources between the different cloud services. It's the layer that will spin up your virtual machine, connect the instances, connect IP addresses, and then the storage, basically a very important layer. And it's also the one that needs to be addressed when we talk about security. So if we want to focus what we are talking about, we are talking about how to use orchestration in order to increase the security in IS environments. And why do we need this talk? I mean, why has changed? What is the, basically the attack vectors that we're talking about? What you see here is basically the attack vectors that are either unique to cloud or most of them are simply amplified by the different cloud characteristics. We're not gonna talk about all of them. We're gonna focus on free. But I'm gonna give you a quick briefing just for the background. We have the provider administration. Again, somebody is managing our data. We have the management console, which basically allows you to access to the infrastructure as a service. And it's a very wide dashboard. You can do so many things with it. You can access almost every aspect of your organization. Very scary attack vector. We got the multi-tenancy virtualization, right? Everything on infrastructure as a service runs on multi-tenant environment using virtualized software and hardware. So basically it's also an attack vector. I'm not gonna talk about this one. There's a lot of talk about hypervisor security, sidechannels attack and stuff like this. Different talk. Automation and API. Everything is the cloud is API based. I mean, everything you do on the dashboard you can do without the dashboard. And this is what usually most cloud programmers do. And it's also about automation, right? You move to the cloud in order to automate stuff. Also an attack vector we're gonna talk about. Supply of chain attack. You buy a software from a software as a service vendor. He builds the software on top of platform as a service or infrastructure as a service so you have to secure the entire chain. Not gonna talk about this one either. Sidechannel attacks. Again, the things that come from the virtual environment. Insecure instances. In the cloud it is very easy to launch instances, spin up instances. Sometimes because it's so easy we launch them and we forget about them. We forget to harden. We forget to do all those important things we used to do in the traditional environment. And of course this is another thing that we are going to talk about. So we're gonna focus on those free attack vectors, the management console, insecure instances and automation API. Now let's take a look how those attack vectors are being used in the real world attacks. Let's take the story of browser stack for instance. Couple of months ago, browser stack company, it's a software as a service company installed on top of Amazon web services which is basically the highest provider for them. They were hacked and this is what happens. This is how it went. An attacker found his way in through an insecure instance. Basically an instance they spin up couple of years ago, forgot about him. It was standing there with a shell shock vulnerability. This is the exit, sorry, this is the starting point. He managed to go in. He found an API access key. API access key is basically, if you give somebody an API access key which has full permissions, it's like giving him the keys to your data center. This is basically about the same thing. So he found an access key. With this access key, he managed to whitelist his, sorry, he managed to spin up a new instance and whitelist this instance in the firewalls. Once he has an instance running, with firewall rules opened, he attached a backup disk. Inside the backup disk, he found a database connection string and basically from there on, it's very simple how you move on to the organization data. So again, attack vectors, insecure instances, forgot to lock them down. Automation and API. All of those cool stuff you can do like connect a backup disk. Whitelist an IP address in the firewalls. Those are the automation and APIs and of course the white dashboard that allows you to do so many things like connecting backup disk and changing firewall rules for instance from the same dashboard. So those are the new attack vectors that we want to cope with. And I say that we don't have the good enough tools to do so. We simply don't, we haven't adopted the security to be good enough for those environments, for those new infrastructure and also new software development methodologies that are coming. A lot of software development and also infrastructure services have been changed because of infrastructure as a service. We now have auto scaling. Once your server hits 80% CPU load, it will replicate itself. Automatically we have entire environments that are spinning up, processing like 200 servers spinning up at once, processing and terminating after 10, 20 minutes or even one hour. It's not something we used to on the traditional network. So it's accelerated life cycle. We can see a lot of environments that are instead of upgrading them to new versions, they are simply being terminated, oops, sorry, and being launched with new instances, with the new software. And what is the one one thing? The infrastructure, the way you charge the infrastructure is changing because the proud provider have started their billing cycle every one hour, they're reducing it. So you can bill your servers for one minute or 10 minutes. So it gives the organization more incentive to lower the time that the servers are up. And why is that a problem? Because so many of our corrective controls in security are based on maintenance windows, right? We do patch management, vulnerability scanning, penetration testing, all of this is done in periodic maintenance testing, right? Patching Tuesday, sometimes it's once a week, sometimes it's once in a month, sometimes it's never. But you have a maintenance cycle and how can you do maintenance windows if your server are only alive for one hour or two or three hours? Security has not been adapted to those environments. And what happens? Companies are moving to the cloud because security, sorry, companies moving to the cloud in order that infrastructure will not slow them down. And what happens next? Security slows them down. And you know what happens if security slows you down. You see companies will simply give up on it. So this is the problem we think that we need to solve. Us in the security community need to adapt new tools, new methodologies, right? It's not even about tools, it's a new way of thinking. How we automate security, it's the next challenge. Developers learn how to automate software deployment, software testing, we are still way behind. This is how we started CloudFigo. CloudFigo is an open source. You can download from the link, the link is here, it's on GitHub. Everybody can download and take a look at it. By the way, it's based on the work from Rich Mogul from Securosis, I don't know if he's on the audience, but if he is, the entire credit goes to him. So CloudFigo is a tool about automating the processes that were mentioned. By the way, we understood the importance of creating a tool. So we decided to invest in it. So basically, we're an investor in that. We invested the whole $5 in the logo. I hope you appreciate it. Okay, so this is the tool that we started. It's called CloudFigo. In the end, we give the details about everybody who wants to contribute. But first of all, let's talk about what does it do? So it's basically automate instance lifecycle, the instance operations in the cloud. I mean, we're talking about how to launch a servers, low security configuration, encrypt disk and volumes, scan for vulnerabilities, right? All of those stuff that usually require maintenance windows and then move into production. What we're gonna do next is basically show you a couple of those steps and what we do in those steps. But first of all, let's talk about the components that we used in order to do this lifecycle. You can change any of those components to the components that you use. We simply chose those usually because either they're free open sourced or because our environment was on Amazon web services. But you can definitely with little changes migrate it to other vendors. So what is the lifecycle? What is this accelerated, sorry, what is the component inside this accelerated lifecycle? We use object storage. In this case, we use Amazon S3, but you can use any other object storage coming from other vendors. We use vulnerability scanning in order to make sure that the instance is ready to go to production. In this case, we use Nestos. You can either use other scanners. Today there are scanners that are IWS aware, connect automatically to IWS APIs, can give you some benefits. We use Cloud Init. Cloud Init is a perfect tool for automation. If you're not familiar with it, invest five minutes reading about it. Cloud Init allows you to run scripts at root permissions when the server is launching. So it's a great place to put in your basically granular, adapted scripts for your environment. For configuration management, we are loading Chef. You can use either, you can use any other software configuration management. We just use Chef because for our purposes it's very convenient and free. We use IAM roles, which is basically Amazon name for permissions for servers. Okay, you give permission to different servers because servers interact with the console, right? Usually when we talk about permissions and roles, we talk about user to dashboard. Amazon IAM roles can give permissions to instances, to servers. What they can do with the Amazon APIs, what they can do inside the Amazon environment. A lot of the research we did, a lot of the development we did was in order to make sure that we have the right configuration and basically access controls. And we will elaborate a little bit more later. And we do volume encryption. Cloud goes into encryption by default, right? The only question is how you do the encryption. We demonstrate a way how to automate both encryption creation and also keeping the keys. I'm not talking about, basically what I'm talking about is volume encryption, right? Not encryption in the database. I'm talking about OS level encryption that I am encrypting basically the volume. What will be in the volume? Usually you install your database into that encrypted volume.  He will not be able to snapshot your backups, right? He will not be able to use the data inside of it. So this is the life cycle that we're talking about. We're talking about how to launch an instance, updating it, controlling it, scanning it, moving it to production and then terminate it. Basically the life cycle of every average cloud servers. What we do now is basically overview those steps, those phases, and then give you a quick demo on each one of them. So when you launch an instance, every machine handles its own encryption keys. It started by a remediation, when a machine is launched, it started in a remediation group. Only when it's ready it will be moved to a production group. Basically it's a methodology we know from network access controls, right? You, network access control prevents workstations from connecting to your corporate line, right? How they do it? They make sure you're okay. When you're okay, they move you to production villain or users villain. Management of those attributes usually required permissions. So we start, and usually those permissions are higher when you're talking about the launching phase and when you move to production, you want as little as permissions possible. So if we created something that is called dynamic IAM role. Nir, can you explain a little bit what you did over there? Yeah, so basically since we wrote the API calls to Amazon, we know which API calls we have in the code. So therefore we created a list of the permissions that we need during launching the instance. But actually we created the concept, the new concept that at least we call it dynamic IAM role. So basically when we launch an instance, we can assign only one role or very specific role to this instance on Amazon and we won't be able to change the role. That's how Amazon works. So that's the reason why we decided to just edit the role when we're moving it to production. On production, we won't need permission such as, I don't know, move instance from remediation to production or put encryption key on the storage. We won't need it. And that's the reason why we're reducing the permissions later. I will demonstrate it. This is how the role looks like. This is how the role looks like at the launch phase. A lot of different ACLs. It gives you a wide permissions. Later on we'll show you how, when the server is moving to the production, it is much reduced. Another thing we do at launch, again cloud in it, as I said, a great thing to automate. When the instance is launched, we simply inject all the scripts we want into the launching phase. Sometimes people ask you why we didn't use a predefined image. Predefined image basically is contradict the idea of DevOps, it contradict the idea of automation because each time there's a new patch, you need to prepare again a new image. So we prefer to use the latest images and do the initialization script when the server is launching. At this point, let's show us how it works. So before I'm starting, well, you know that all people at DEF CON not connecting to the Wi-Fi. So all the AT&T Verizon networks basically flooded. So we hope that our online demo will work. If not, we'll have a backup, but that's fine. So as for demo, basically, I wanna start with explaining what do we have with the Cloudifigo tool. So, wow, that's big. So basically, we developed the tool in Python. Since we wanna have API calls, it's basically exposed by Django and now we're just starting the server. On this server, we have our own API call to, let's say, just launch an instance. So we'll just go and launch an instance. So when we're launching this instance, it takes time. We'll see the Django. We'll see that we're actually creating a new role on Amazon IAM, but then we need to launch an instance with this role since Amazon have a pretty wide infrastructure. It takes time to synchronize between the IAM role that just created a moment ago with the instance we tried to create. So basically, that's the reason why we have timeouts. It's pretty common when you get into developments with Amazon. You'll see that you put a few timers here and there just to make sure that that works. And eventually, we see that we have here 200, so we should be good to go. So now I connected to the Amazon web services. I'll just like, okay. And we can see that we have here a new instance called Secured Instance. This is the instance that eventually gonna start and be the Secure Instance down the road. So when now we're starting the whole process, we can see that when it starts, we have remediation service group, which is where we're starting. And we also have a role that we created. You see, it's a pretty long name here. So I'll just click it. And I wanna see the list of what I am allowed to access. So basically, when I'll go to the policy, you can see that it's a pretty long list of what I'm allowed to do, but later, we will reduce it. So I'll let Mose continue with our explanation. Okay, by the way, we're sorry about the fact that the screen resolution is low, so you don't see the entire screens, but those of you are familiar with Amazon, probably understand where we are. Those of you who are not, we're basically looking at the EC2 instances launching and the IAM roles screen. Okay, two different models. Okay, moving on, the instances launch. As we speak, it's basically initializing himself. What happens next is we update the OS. Again, we don't have maintenance, we do to do patch management, we do it on spot, we do an upgrade to all packages. Basically, it is done through the cloud init script. We install all the prerequisites, everything we need for this cloud figure to move on. You want to explain what kind of things do you have over there? Yeah, so again, since we're using Python, we have basic packages, we have the Python peep wheel. Basically, we want to have pretty quick installations. We also have the Amazon SDK, which is Boto, Chef Client, because we already mentioned in the components, we have a management component. And we also have our scripts on S3 that only all of these instances allow access to the scripts and download them because we may have some configurations that may be kind of secret or you can define what you want to have there. So that's the reason we also remediated the access, the access control there. Okay, so, oh, it jumped. Okay, okay. The next phase, the update phase, there's nothing to show in demo, right? So we skip the net to simply install things and upgrade it, no point of showing you that those packages are installed. The next phase is the phase that I take this new instance and I harness it. I put it under my control system. Again, usually when it happens in the real world on on-premise network, the IT guys finish to install the servers, then they move it to the security guys, they wait a couple of weeks, the security guys do the hardening, do the configuration, install their antivirus software, IPS software, all of those happens, those are stuff are really slowing down the progress. We want to do them really fast, including all those tasks that security guys need to do. So what we did, we basically at this point, we, the cloud init installs the Chef client. Chef again is a configuration management. In Chef what you do, you build a recipe, sorry, a recipe is basically a list of packages and commands that you want to run. We attach the recipe to the servers and then it downloads everything we need from the security point of view. There's a lot of Chef recipes in GitHub or everywhere else. You can use them to automate almost every aspect of your operations. So once the client is registered, the policy is downloading and then we, what we do is generate an encryption keys. As I said, the goal of encryption is basically to protect the disk. Inside the disk, probably you will have your application files or database, doesn't really matter. We use Demcrypt, it's basically a utility for Linux. Very common, you can use any other utilities out there for Windows or Linux. But the idea here is where you store the keys. Usually when you're working for infrastructure as a service you have a couple of options. You can save it with the cloud provider, right? Some of the cloud provider will even give you HSMs or places that you can store keys. It's okay but it's still vulnerable to some attacks like malicious insider inside the cloud provider or basically subpoena from government or other court orders for stuff like this. It's basically good enough for configuration for some organization, might not be good enough for other organizations. You can save it on premise, right? You control the keys. Then you can control who has access to it, you put it on an HSM. But then you have to think how you transfer the keys in and out of the cloud, therefore you expose it again. Every method has its pros and cons, right? So we need, probably if you're a bank you want to keep the encryption keys in your hands and transfer it somehow to the cloud, transfer a temporary key to the cloud. You can also use a third party. Third party can be a key escrow service. They have key, today we have companies that provide you an HSM as a service to put the keys. This way it can protect you also from government weight at some point, yeah? Because government warrant has to come to both cloud providers, which complicates it. But again, you need to move the keys between the different providers. So again, every method has its pros and cons. It's basically depended on your threat analysis. What we did here in Cloud Defigo is we built a system that allows you to be very flexible. In what we show here, we keep the key in a special place inside S3, the object storage. You can very easily, if you're working on Amazon, you can very easily migrate the application to keep the keys in a different cloud provider, object storage like Azure or a Google compute engine and then do a third parties or in your premises in order to make sure that the keys are, I would say, good enough security with them. I mean, it's not bulletproof, but they're quite protected. We invented basically a system that NIR will explain how do we access those keys on the object storage? So I will just translate good enough. Good enough equals annoying, okay? So we wanna make it annoying enough for anyone to access the keys. So basically, we put our keys on S3 on the object storage on Amazon. What we're actually doing is, during the launch of the instance, we're generating a key and we're not storing the key anywhere on the instance. Basically, we're creating a key NID and using the ID, which is basically combination of few parameters that we get from the instance like MAC address, instance ID and few things that are not changed on the instance, we created actually a bucket with this name. So it's a hash. It's pretty hard to guess that. You can reverse the code. Again, it's annoying, but you can do that. But eventually, when you'll get into the object storage and when you'll get the name of the object storage that stores the key, you will also need to face with two things. One, you'll have to access the storage with the same account that running this instance. This is one thing. And the second thing is actually a referrer header that we added to each request when it goes to the storage. And this referrer is basically 512 of additional data that we generated. So basically, if you'll try to get access to this object storage, it will be annoying, really. Okay, so basically what we did is creation of a dynamic policy on S32. So we have also dynamic policy with the account name and the Shafi 512. And let's just do the demo. So I'll just move to my shaft. Okay, so here, first of all, it's just a proof. We succeeded to connect the server to Shafi. To Shafi, it's not difficult. Basically here, we can see the run list. So our run list contains volume encryption. You can have a patch installation, database installation, whatever you need with this script. And that's kind of the first part of it. And the second part, as I mentioned, we already encrypted volume, but we need to know where is the encryption key. So therefore, I will need to connect to the server because I have no other way to know which volume I should connect to. So let's go to the security instance. Let's connect to it. So I'm getting into the Cloudy Figo Log. It's just for demonstration purposes. A couple of ventors. Oh yeah. Is it better? Okay. So, and still I'm writing below. Anyway. Yeah, but I have the log here. So probably you will see in the log that I have a bucket name like this. It's a pretty unknown bucket, but we'll need to look for this bucket on S3. So let's go to S3 and look for that. We're on S3. As you can see, we had a lot of demos. And here, we will look for the bucket and we'll go to the properties. So if you look at the properties, we'll see that here in the permissions, we have edit bucket policy. And you can see here that we actually created access only to the specific bucket, only with a specific refer header. Can you put it up? Oh yeah, I need to put it up, but I can't. Yeah. Anyway, Moshe? Okay, moving on. So now we got an access that is, we have an instance that is controlled. We have all the software we want. We have launched the encryption. We got the keys. What do we do next? Is this instance ready to move to production? The basic question would be, is it hard enough? And is it, doesn't have any vulnerabilities? So this is where we do an automatic scan to launch for the instance. The nice thing about cloud is it enables you to automate the scan and then move the item to production immediately, change the firewall rules, move it to different security groups, all of those games that can be done automatically. So what we do here is launch an ESO scan. We analyze automatically the results. I think we say that everything over medium, if something is over medium, if we get a finding in the scan that is over medium, we don't move it to production. It will stay on remediation. Anything lower, medium or lower, it will move into production sending us the result. Here, can you show how it works? No. Okay. So we'll go to the Nessus. I'll just need to exit the deck. Okay. So basically we'll go to our Nessus. Yeah. Oops. And please don't record the IP address. Don't access it. No, it's not secure. Believe me. Just very long, it's going. A moment of relief. It's so hard to do live demos. So we have here the scan. Basically we can see here that we have one low, one informational finding. So that means that the server should be on production now. Let's look at it. Low resolutions. So we'll just refresh it. And we'll see what's going on with our server. So I'm going down. And we can see that the server is in production. Okay. Excellent. Yeah. It's working. Okay. So we got a server, it's moving to production. From now on basically we finish the launching phase. I don't know the initialization phase, I wanna call it. We move to production. And couple of things we need to remember in production environments. Permissions are lower. Okay. The server has now done everything he needs in the automation part. We need to reduce permissions. This is the IAM role after cloud figure finish configuring it, right? If you remember the IAM role permissions in the beginning were really that big. Now it's turns down only to very specific couple of things, basically access to the S3 bucket where you can find his encryption keys. So it's done dynamically. We will reduce it dynamically. And then we put the ongoing management, right? What kind of ongoing management? Usually in cloud you use compensating controls. Basically what it means is we are checking to see if we haven't launched, if somebody haven't launched any instances that is not managed by the infrastructure that we've created, right? We want to identify if there are servers that have somehow popped up somewhere and we are not managing them, right? And we want to use an alarms if somebody has managed access on server and now is trying to do something, right? How do we do those? Basically for the first thing, for checking out if there are servers that are managed or not, we're pulling out from Amazon the list of servers and we compare it to the list of servers that are in the chef. Bottom line, if we see a server on Amazon which is not in the chef directory, it's probably not a good server. Somebody launched it either by mistake or a malicious server. The second thing we do is we monitor Amazon cloud trail. Cloud trail is basically a logging mechanism for every activity you do on the dashboard or API, right? So basically what we do is we look for those things in the logs. Those of you who have been trying and playing with Amazon cloud trail, it's not well documented. Again, it's new, nothing better to say about Amazon, it's new, not so much experience. Here is what we found out. If you try to use the access keys, sorry, if you try to do something on Amazon servers and you get an access denied because you don't have permissions, it could come up as two different logs. One of them is access denied, one of them could be client authorization operations. Usually if you try to do something in S3, you get a client on authorized operation on other places, you get the access denied. So we are looking for those two in the logs. This is pretty much, this will be very useful for you if you'll be playing with cloud trail. Again, it's a great tool. Just needs some more, we need some more experience with it, ask the community that is. So basically, let's take a look on the roles and the alarms. Okay, so we'll get into the production role and we'll see what exactly we have there. So we'll go back to this role, this long role, we'll refresh it and we'll see what's going on here. We can see that the policy allows us only to access very specific object on S3. So this machine cannot do anything anymore. So let's do a test, let's see what happens. I'll go back to the instance and I'll try to, you can't see the text but I'm promising you that you'll see it in a moment. So I'm just trying to access with AWS SDK to a specific instance or just IEM resource. So I'll just try to list access keys which is pretty much something that as a hacker I wanna do. And as you can see here, I'll do, yeah. As you can see here, I'm not authorized to do anything but as Moshe mentioned, we're gonna have an alert to present it. The thing is that, as I mentioned at the start, it takes time to synchronize and get the alert so we have two options. Either you will wait 15 minutes or I have recorded that, so probably we'll go with option two. So on option two, basically when we'll go to the alert. Just to emphasize, it takes Amazon 15 minutes from the moment you do something until it's popular, it's basically to the logs, okay? So we don't want you to wait the 15 minutes so we got a recording. So just the short demo, basically, when we go to the cloud watch, we'll see our alert which is the same as what I did now. I just tried to access to the keys and eventually I should see the alarm here. In the same moment Moshe can choose if you want to get an email or other way to get everything, to get the keys. Yeah. Well. Thank you guys, it's a methodical break. We have a little tradition here. You know what it is. How do I get shout outs from the crowd? I can't do it anymore. Break! Welcome to DEF CON. It's good that I'm already past the demos. Okay, so let's go and just continue. It's a small, small port. You didn't see me last night. So anyway, we also decided to validate exactly what happens with machines that are not managed by the CloudFigo because basically you can launch instances but it won't be controlled. So in this scenario, we basically took the list from Chef and the list that we have on Amazon compared it and provided the output of what is not managed. So if we'll see here, where's the browser? I'm fine, believe me. So basically we have another API call in CloudFigo. We have one server, we can translate it to the name but basically this is our necessary server that is not managed. Just wanted to show an input of something that we have in the list. Your turn. Yeah, okay. I think we are wrapping things up now. The next phase, yeah, cool. The next phase will be basically termination, right? Server is launching, working, processing. Last thing would be termination. Basically you need to terminate the server with the attached volume unless you do some kind of backup and moving it to different servers. You need to kill the iron roller, right? We're building a role specific for servers and the most important thing, some of the attacks on the cloud are basically on data that's thought to be deleted and it stays somewhere, right? Cloud provider don't like to really delete stuff, right? They put it on a shelf somewhere and waiting for you to say, okay, can you restore that for me? And they say, yeah, we can do that for a nice amount of money, right? But the problem is your data is basically being replicated to all of those places. How can you do? How can you make sure that you're really deleted? There are a couple of ways to do it. What we did here is basically what is called crypto shredding. The idea here is that data is encrypted so we need to terminate the key. Once you terminate the key, the data is useless. Again, it's dependent on your scenario where you keep the keys. Over here we deleted from S3. You could say that S3 is backup also and you are correct. But again, according to your threat, you keep it in the physical location, you can also destroy physically the key and then your data is basically protected. It could be kept somewhere, but it's useless. So don't forget about this crypto shredding, the shredding of the keys in order to make sure that your data is safe. So this was the last phase and we're also pretty much closing in, wrapping things up. So what we want you to take out of this, new software development methodologies and new infrastructure services are basically changing the way that we treat applications. On on-premise, a production server was like holy grail, you don't touch it, right? Periodic maintenance once every six months, pizza nights, people treat it like a holy things. You don't really want to mess with it. In the cloud, we can see entire production environment change five times a day. Deleted, launched again, right? This is DevOps, this is continuous integration. It's changing and security needs to change with it. So you need to learn how to automate your security.  They are in the IT department, right? So we need a new thinking and think about how to automate security. This is the new challenge for software development companies. So hopefully we are demonstrated enough how to do automation. What are the different phrases? You can take it into different areas. You can use Cloud of Figo or build your own. You have the right steps to do it. And I think we have a couple of minutes for question, Kevin. Two minutes for questions. If you have any, be happy to take ones. If not, come and take us later. We'll be around. You get our Twitter handles and any other way to access it. And before the questions, we're also going to post the updated link if you want. First of all, you can follow us. We're going to post about the Cloud of Figo and you can also get into the website. We're looking for contributors. We need to improve our documentation, our features. So you're welcome to join. Thank you. Thank you for the question. One of the things you talk about is instances that appear that you aren't expecting. What about instances and such that don't die when they should have died? Instances that died that shouldn't have died. Instances that didn't die when they should have died. In other words, you're looking at all these instances. You've got lots of instances, lots of roles and you're expecting, say, these particular servers to only be around for, say, 24 hours, but this particular instance has been around for eight months and you just aren't aware of it. Yeah, I agree. We thought about handling this. I mean, this was one of the phases that we thought about doing. But then we took a look at, I think it's called security janitor from Netflix. And it's a pretty awesome tool. It's a janitor, basically. I don't remember if it's a monkey janitor or a gorilla janitor or a security janitor, something like that. And what it does, it overviews the configuration and it terminates all the unnecessary instances, roles, and all of those garbage that is left behind. So basically we said, okay, there are good enough tools so we won't go into that. But I agree that this is definitely a challenge and needs to be addressed because there's a lot of junk that is piling in. Well, because I mean, as an attacker, using this tool, if I can just jam your shutdown procedure, that's almost good enough. Yeah. I agree. It's a problem, but we're not solving every world's problems here. Thanks a lot for the comments. Any other question, guys? No more, you can come. Sorry, no more questions, Kevin? Unfortunately, no. Sorry, come over to talk to us. Okay. Thanks a lot again.


You've been cute. Good job. I've got my bee working within Viratex as huge. I want to try some other stuff too. I think I'm going to order some pro marine because I keep hearing a lot of good things. Measuring it out because it's super important that it's even Steven because this is a one-to-one ratio resin. I can't believe I got that out in one try. Maybe it'll be a good wording day for me. We'll see. Do you want to have the blame on e-science? I know. It'll be like the first one in a long time that's not getting chalked up to e-science. For those of you that don't know what e-science is, it's basically being blonde. That would make it e-science which is completely different than e-science. E-science is officially in your brain. No, it's the study of... Internet science? No! That starts with an eye and nobody uses Internet Explorer. E-science is the study of everything awesome as is seen through my eyes. That's the Cliff Notes version. If you look up the class in an itinerary for college under all the class descriptions, that's the short version of what I would say. It's a very interesting subject. I'm surprised that you're not fluent at this point. Then again the curriculum changes daily. I've done no schedule. Mooper, what are you doing? You been cute? Nailed it. The floor is so dirty. It's a studio floor. You guys can see we have this black top down. Floors are already like this. They're already like that when we moved in. Because this was a distribution center. It's definitely an artist's place but that has nothing to do with it. That was like a hundred years ago. That's why it's a concrete floor though because it was a distribution center for Sears and Roebuck like a hundred and ten years ago. It's a paint, different color. Did you see the peace sign? Did I ever show you that? There's a peace sign on our floor from when we moved in. It's right here. I'm going to finish that one, then that one, then that one all this week. Sorry, I forgot this table rolls. So what colors are you doing these to? No. They're out so I was just wondering. So are those? But these were closer so they came through my face first. You're just being nervous talk. No. You're just being regular talk. Oh my God. Sorry. So you had these colors originally set for the red canvas, right? But you decided. Yeah. I was going to do these colors on the red canvas over there. Just because of the contrast but then I thought, No, I don't want to do that. So outside of camera frame before we started filming, we prepped our canvases as usual according to this video. We're basically we just sew it and sand it. But we use house paint because cheaper and more economical.  So much thinner. I don't understand why people would use gesso. I mean, it preps the canvas, but it gives us such a thin layer. That I guess me just being an airbrush artist, I prepped it so so that it's super smooth.  So I've always found that it's better just to use white. White. That's paint. Latex, right? Latex, acrylic? I don't know. It's just interior house paint. Yeah, interior. Flat interior. People have asked us why we don't do acrylic pours. There's there's one reason why we did that one and scraped it off. It just turns to mud and mush. It's horrible. Horrible. One day we'll do another one and we'll post it no matter what the outcome. All right. So Jeff poured out a not too thin. We usually do thinner but a good coat of resin over the base that we just spray painted black after we prepped it according to our previous video. Well, it's such a bigger space that when you separate them, it's only a little bit. You could I could have poured that whole thing over it just would have covered the entire thing twice. But when you separate them, it gives you just a little bit less because I'm not pouring it all at once. You know what I mean. So then after he poured it out on the canvas, he separated it according to how much he wants of each color. You'll probably notice bubbles in your resin.  I did it a little bit more than that last time. But we're going to get rid of these bubbles with you can use a heat gun or torch. Someone commented one time that they prefer a heat gun because it's safer than a torch, which I would usually agree with just because open flame. But exhibit a of the dangers of heat guns. Yes, that is the front of a heat gun. It matches this. That was fun time. I heard a little bit. What are you going to do? Looks pretty from here. You should be wearing a respirator. All in your face. We have a trash can down there. You should probably do this outside. We have a lot of draft in our building. The windows are open. The fans are on. This is a separate cup for people that always ask. Look how much it is though. Not a lot. Not a lot. If it's any grittier than this, you haven't shaken it up enough. It should be just oily looking. It doesn't take that much.  I want to start with white. I don't have a plan for this. It's going to go with a puddle pour but a long puddle pour. This will be the first time. I've never done this before. You did a long puddle. On your long ocean skate? You did long lines but they weren't puddle. They were just next to each other. Those are the colors that I'm excited about right there. Is this from what you saw on Nat Geo today? No, but that would be badass though. Those are some scary colors right there. Those have to get next to and try not to combine them. The colors that you saw on Nat Geo? Yeah, for those hot springs. It was the hot springs at the Grand Canyon and it was the most awesome coral sand and teal water.  I think I'm going to do that tomorrow. It looks a different color going down when you come back up. It's weird on camera. This is just an 8x24 canvas. Also, all of the artwork that you guys see made on our channel is available. It's always for sale. We don't get too attached to our artwork. Anything that doesn't sell before April 6th will go into the Deep L.M. Arts Festival that you guys should come to if you're in and around or close to or want to make a road trip to Dallas, Texas. All the way that I'm doing this, I've never done. I've outlined stuff, but I've never did it outline then go the inside of it outline. There should be something interesting. It's dark in there. I would save some of it for after the fact that there's going to be areas you want to touch up. I'm clear on yours. Which way are you going to tilt so I can be prepared? This should be pretty interesting. That cover is so orange. It will get it too hot. Did you heat your resin before you poured it? I didn't. It's a pretty day out. Which way? I'm going to tilt it towards me. That's what I wanted to do. I wanted to put tape on these sides. It looks like it almost looks like a wave. I thought it was going to do. What did you think it was going to do? That gold isn't doing anything. It just blows online. What is it that's emitting all of this? Is it because of the black?  I don't know since they're all like opaque colors. I guess I shouldn't have done it. Such a long pour. That's going to end up sealing up really nicely. That looks really good. Give me the hair dryer. Do you want the attachment on it? That's going to look really good. That part that you're on right now is going to do some awesome cells. It's just not what I think that it is. The gold is just completely 100% not. Do you want a pointed pic? I'll link all of this stuff in the description box below that we use. I'm digging this part. I can't even tell you how beautiful that is. That looks great. I'm supposed to make you laugh. How are you supposed to make me laugh? You have to be funny. I am funny. Then maybe laugh. That's just rude. You know good and well that I'm basically a stand-up comedian. Saturday Night Live and I are in negotiations right now. So you know. That looks good. You guys use a heat or heat gun. Make sure you don't leave in one area for too long because you will bake your resin. You'll know. This is not a good time. I'm going to say let that white heat up and push it. What? I'm going to say let that white heat up and push it around because that's where all the pretty cells come from. I'm going to leave it and title this one. What was it? Don't work it too much? Or no one to stop? Yeah.  Just stop. And you know everybody else is guilty of doing it. What if I just add this or what if I do this? It's so easy to do it but it's the hardest to just stop to leave it. I think you should leave it. Alright. Let's get just a long shot of what she looks like while she's still wet. She'll move and adjust and alter itself while it. Do you want to? You already heated it up. Very smooth surface. Alright you guys. Thank you so much for watching. For checking in to see how Moose doing. Oh. And in like 12 hours we'll come back and see how it's doing. That's our dust free zone. Say bye. Bye.


I want you to grab me now.  Let me find out you on a more freer than this. Don't touch me, slit my nipple first.


The study investigated risk factors associated with psychological impacts on healthcare workers during the COVID-19 pandemic in Korea, finding that nursing professionals had significantly higher levels of depression, general anxiety, and virus-related anxiety symptoms. Logistic regression revealed that hospital, nursing professionals, single workers, higher stress and anxiety to the viral infection, and past psychiatric history were positively associated with depression. Psychological support and interventions should be considered for these groups. This article was authored by Myeonghyeon, Yongwook Shin, Suyun Soo, and others.


This recruit, coming into boot camp, a little bit scared, not going to lie, very irresponsible this recruit believes, didn't know much about being a leadership, so he got put as a squad leader. I feel like I'm more responsible, it makes you, coming to boot camp makes you really look upon yourself and who you were before and what you could do to make yourself better as a person. I think boot camp is something that really everyone should go through just because it gives you that outlook of on life and what you could do better about yourself. The challenge you've heard about the Christmas so far for this recruit is probably just keep going, like it's a lot, you just keep going so far, I made it this far, I'm not going to give up now, that's really what's keeping me going.


Hey Psych2goers, welcome back to our channel.  Here are six habits smart people have Number one read any chance you get Who doesn't love reading? Well, apparently a lot of people but it gets better after the first chapter. I promise If you start to read a book that makes you feel calm and relaxed After reading some of said book your train of thought may become more calm and relaxed Maybe you delve into a novel that is both thrilling and ambitious Then when you shut that book you can't help but have a more ambitious and exciting outlook Reading takes us somewhere new and puts us into someone else's shoes It's not only a good habit to develop because it can help relax you when the real world gets a bit tough But you may also learn a thing or two. You may just become a bit more intelligent with each chapter Number two know what time you are most productive and get working then Are you a night owl or a morning person? If you flinched at the word morning and relate more to a vampire than a rooster Then you should likely schedule some of your work for the evening not midnight, but evening Why well as much as the night owl as you may be it's best to stick to a regular sleep schedule Where you're mostly sleeping when it's dark out if you're a morning person schedule your work or active Hobbies bright and early and if you need a few hours to wake up But get drowsy by the time the sun is down the afternoon might be your best bet While it can be a good idea to change your schedule So you can get your work done earlier if you know you're simply not a morning person It's best to schedule your day around that known part of yourself Ease into your mornings as long as you're productive later three make a schedule and stick to it Now that you know when you're most productive get scheduling Work or go out during the afternoon if that works for you, but make sure you write it down Whether that's in a daily planner your phone or a piece of paper posted on a wall hold yourself Accountable by making a promise likely with a good old pen and paper number four Put away any distractions Do you find yourself distracted often? How often and it's time to put away those distractions Now that you have your productive time slotted you need to make sure it's actually productive by putting away your phone Let's be real here. It's the phone distracting you isn't it? By shutting off your phone or hiding any distractions, especially in a different room. You can get more work done faster Five try something new and go outside your comfort zone Smart people don't simply stay in their comfort zone for the rest of their lives. They try new things They let their curiosity lead them to new hobbies activities opportunities or places Don't tell yourself if a new and exciting opportunity arises Even if it's something new go for it. Try that new hobby even putting off learn that new skill Life is too short to put your passions desires and curiosities on a waiting list Every day challenge yourself to something new big or small Make it a habit to not be afraid to make a new habit Start with this one perhaps and number six value being productive over being busy Smart people are productive people So if you find yourself scheduling time to get work done only to work at the bare minimum during that time It's time to try something new if you're not getting your own work done at a good pace Then maybe there is a better way to approach this new project or study for this new test Value being productive over being busy You can live your whole life being busy and find minimum change years down the line But if you choose to be productive and work at your best self as your best self Then your life can be somewhere entirely different in a few years Go for your goals work hard at what you do or rather find what method works for you And you may not have to work as hard as you thought Things get easy when you know who you are and what's best for you So who are you and how will these habits change you? Let us know in the comments down below We hope you enjoyed this video And if you did don't forget to click the like button and share it with a friend or Someone who could use it Subscribe to Psych2Go and hit the notification bell icon for more content like this and as always Thanks for watching


So how many belt ranks are in karate? This is a very very common question people search for Especially those who have not trained in the martial arts or they're looking to get into one or or maybe they're currently one Martial art, but to see another school do something different and they're like why isn't my belt rank like that? So this seems to be a very common point of curiosity among the martial arts community now In my personal opinion belt ranks are both a good thing and a bad thing the good thing about them is they're a great Motivator it's something they work towards to when the person takes an art It's always good to see an achievement even though that particular belt doesn't represent You know the hard work it shouldn't be the focus of your training It is still a good motivator and psychological tool Additionally it helps instructors kind of keep track where students are in class however belt ranks are also a little bit of a curse because Unfortunately, there's a lot of people who join martial arts just to chase the rank rather than worry about the quality of the training So basically, you know, there's pros and cons to it So as long as you keep in mind that the belt is really nothing more than just a piece of fabric to keep your uniform closed This is just gonna be a fun little exercise just to see how different systems do this differently So we're gonna take a look at how many belts there are in karate Not every martial art uses a belt ranking system In fact the concept of colored belts as rank is a relatively new one in the history of martial arts But we'll get back to that many arts don't have a colored ranking system at all But sometimes especially in commercial American and European schools They will adopt similar ranks such as colored sashes shirts and sometimes chevrons Colored belt ranks are more commonly found with arts that have Okinawan, Japanese and Korean roots But before we get into the different styles, let's point out two primary classifications of belt ranks The Q and Dan ranks Q ranks are all levels before black belt and they count backwards as you progress through the system Dan ranks begin with first-degree black belt and count up as the student progresses Some arts in schools will count white belt as a Q rank others consider white as an unranked beginning level The red belt is an interesting rank in and of itself and it often means different things in different systems In some arts it marks the beginning or novice student while in others It's simply another color level throughout different curriculums However, sometimes red is the color of mastery and it might even hold a high regard even higher than that of black belt So where did the tradition of using colored belt ranks begin? There is a commonly told origin story in which back in older and more traditional days Karate practitioners simply wore white belts and never watched them It was said that as they trained these belts would get dirtier and over time sweat dirt Grass and blood with this color the belt into darker and darker levels This would hold that the darker a practitioner's belt was the more experienced that they were this was very commonly noted as the Origin of the belt system. However, it exists as a legend and is most likely untrue The historically recorded origin of the belt ranking system can be traced back to judo and its founder Jigoro Kano He is also credited for instituting the traditional karate gi as we have today prior to his influence Most students trained in traditional clothing or kimonos Kano founded judo in 1882 and in 1883 he awards two students with a black belt He felt that these students had reached a level of expertise and he wanted to recognize their skill So we turned to the sport of swimming, which was very popular in Japan Swimmers who excelled in their skill were awarded black ribbons So Kano decided to carry this tradition over to judo at this time the ranks were simply black and non-black Judo had six cue rankings and Kano later decided to add other belts to mark the progression his original colored rankings were light blue Two white belt levels and three brown belt levels before reaching black Later as judo spread and more practitioners carried the art around the world These ranks were separated into more distinct colors of white yellow green blue purple brown and then black Sometimes blue and purple swapped places It is also said that Kano took his inspiration for the cue dan designations from a popular 2,500 year old Chinese board game called go in which players are ranked by skill level with beginning cue ranks and expert down ranks And thus the colored belt system was born and was soon adopted by various martial arts systems Now before we take a look at some examples It's important to understand that there isn't always a standard ranking list even within the same art Many arts are divided into organizations that will modify their own independent curriculums and therefore employing different color schemes This can vary from school to school But we're going to take a few minutes to see how some arts utilize this ranking system Many traditional Japanese and okinawan karate systems will use the same colors But the order of those colors will be wildly different from each other shodokan Founded by Gijin Funakoshi is often white yellow Orange blue green two purples and three levels of brown Now not every shodokan school follows this and there is some degree of variation But this is one of the common cue sets dan ranks are often recognized as one through ten However, Funakoshi himself never personally awarded anyone hired in fifth dan Shiitou Ryu commonly has nine cue ranks and ten dan ranks This is an art that often excludes white belt as a cue and considers it no rank What the ranks proceeding as white with a yellow stripe yellow Orange purple blue green three brown belts and then ten dan ranks Now while Shiitou Ryu colors can change from school to school We see far more variation in Watu Ryu and Goju Ryu Watu Ryu usually has ten cue ranks and eight dans But there are many different color schemes employed by different schools Goju Ryu is an art that is governed by many different organizations And each affiliation uses their own schemes as well Typically with ten cue and ten dan ranks Kiyokushin a powerful full contact karate system is a bit more standardized With most curriculums falling under white orange orange with stripe Blue blue with stripe yellow yellow with stripe green green with stripe brown Brown with stripe and then dan levels of black belt Sometimes red will take the place of orange Now my art of American Kempo is one of those arts that has divided into a thousand different directions And is splintered among many different organizations each as different as the next Kempo may perhaps be one of the most politically divided arts However, ironically it seems to have one of the more standard colored ranking systems Most Kempo schools even those with completely different curriculums will follow this belt color system White yellow orange purple blue green three browns and ten degrees of black belt Now even though sometimes you'll see the three levels of brown belt separated into red and red black Kempo is a system that traditionally treats red as a color of mastery And that is evidence in the black belt ranks Each degree of black belt receives a half inch red stripe Half an inch apart to show that we slowly master our art in increments When a student reaches fifth degree the belt receives a five inch red block And then stripes are added until reaching tenth degree marked by two solid blocks Originally, however, the founder of American Kempo Ed Parker used the white brown and black color scheme that Connell used in the beginning Only adding more colored ranks later as the curriculum grew and advanced Now when it comes to jujitsu We are definitely talking about a classification of martial art that is divided into many many different systems And we could spend all day covering each and every one of them like many karate styles Jujitsu will use standard colored belts in different orders However, you'll often see red belt here marking the beginning or early rank in the world jujitsu federation Ranks are typically red white yellow orange green blue with a white center stripe blue purple Brown with a white center stripe brown black with a white center stripe and then black In the art of jujitsu that i am currently training in sanyama bushiro The belt orders are white orange yellow green three browns and then 10 levels of black This brings us to brazilian jujitsu one of the more popular and widespread arts today When it comes to belt ranking brazilian jujitsu holds one of the stricter standards of belt rankings across different schools Each belt takes a significant amount of time and practice to achieve And practitioners take each rank and the respect that comes with it very very seriously In most bjj schools you will find ranks set as white blue purple brown and then black belt This is pretty standard and interchangeable between schools However, once in a while you'll come across a school that might add a green belt rank Usually as a novice or a youth rank there are 10 don levels and the belts are marked distinctively with belts that are black And then they go into coral patterns and ultimately to red belt Which signifies a grandmaster title of ninth or tenth don the red belt is a highly respected rank And it takes a lifetime to achieve and it is held by few As i mentioned earlier not every art utilizes colored belts for ranks aikido is typically one of those arts While some schools may support colored belts many only allow students to wear white or black belts In many aikido schools don students will wear a hakama when they have achieved that level Swinging now over to the korean arts. We see much more variation again Hapkido may have different versions of their colored ranks But generally you can expect to see white yellow green blue red and 10 don levels or at least some close variation of this Hapkido is also one of the arts that reserves the rank of tenth don for their grandmaster Taekwondo is split into a couple of different organizations But you will also see very different color gradings from school to school with nine don ranks available for living students The standard belt ranking for the international taekwondo federation is white white with yellow tip yellow Yellow with green tip green green with blue tip blue blue with red tip red red with black tip and in black belt Tongsudo is similarly split between different organizations and like most of the other arts You'll find a myriad of different color schemes Hwang Ki the founder of mudukwan originally established white green and red as the colored belt ranks before going into the don levels However, what is really interesting about mudukwan is a custom that is followed by select schools Traditionally don ranks are not represented by black belts But rather belts that sport a midnight blue color This falls into the philosophy of black representing perfection and no one can be perfect It is commonly said that Ki believed that black is a color to which nothing else can be added So the don holder wears midnight blue to show that he has always learned And finally we're going to take a look at ninjutsu or specifically bujinkan ninjutsu That is an international organization that incorporates various ninjutsu lineages They have a little bit of a different approach to the colored belt rankings In bujinkan there are nine cues, but they don't traditionally follow the same belt color ranking Beginning students are unranked and they wear a white belt upon achieving your ninth cue They will then wear a green belt if they are male or a red belt if they are female These students will wear these same belts from ninth to first cue and when they achieve their first don They will wear a black belt Sometimes schools will use stars or other insignias to denote which rank they are at Additionally, there are 10 don ranks, but 10th don has five sub-level ranks to it These additional five ranks are certifications that signify a master has learned everything there is to learn about that particular lineage Very few achieve these ranks and they're typically more discreet So that was just a fun look to see how bujinkan offers a bit of unique spin on the colored belt ranking system In any case belt color is just a measuring system and a syllabus guide and in no way Actually determines your skill in any art. The belt should not be the goal But rather you should focus on the skills that the system teaches you So there we go That's just a brief look at all the different belt ranks and the different karate and martial arts systems In the end it really doesn't matter what color you are It's just a piece of fabric. It doesn't represent your actual skill or the hard work you put into it It's just a milestone. It's a tool of measurement whether you use it for a psychological encouragement Or you're one of those people who want to just chase belt levels So in the end all that's really important is the quality of training you're getting regardless of whatever belt rank you are Here's to keeping your pants up Thank you so much for watching this video. As always, I like to hear feedback from our viewers I'm actually curious for those of you who train and maybe some kung fu systems or other systems that don't have belts What do you how do you guys rank do you have rank just kind of what are some of the ways you differentiate your different levels? I would love to hear from you. Please subscribe and share. Thank you so much for watching


Richard, in the lane, stuck there, how is it? Can he be the man? No whistle. David Tillman with a game winner for the Celtics. Never a doubt, 101 to 100. They get the win over the Sacramento Kings, go to 61 and 16 on the season. Tom Jalsch, Chris Forsberg, it's Celtics post game live. There you go. X going to give it to you. Celtics scored three points in the first six minutes of this game. They scored three points in the last six minutes of this game, and they got the win over. Kings are embarrassed. The Kings really needed this one. They waited a little too long to make their run. Look, if you're sitting here obsessing about the fact that the Celtics gave up that 18-point, 19-point lead over the final few minutes and made this interesting, just forget it. The Kings needed this game. They were a desperate team. They gave everything they had trying to get in on the second night of a back-to-back to find a way to win as they started sliding into the play-in in the West. And the Celtics throughout a young, inexperienced lineup and pretty much challenged those guys, figured it out, and they did. Even they weren't perfect, far from it, but in the big moment, Sam Hauser stays with it, keeps that play alive, even after a terrible shooting night where he could have checked out completely, and X hits the little runner to give you the win. And so I love that he's putting guys in this situation. Will they be in this moment in a playoff game? Probably not. But what happens if someone has to be in that moment? Then this is a great learning experience for everybody on that roster. And I feel like the fact that they were able to find a way is the bottom line to make. Yeah, find a way to get the win. And again, you saw the Kings take the lead there on a bank three by Deere and Fox. So all of a sudden, the Celtics are behind in this game, which seems unfathomable, being up by 19 in the fourth quarter. But Xavier Tillman, right place, right time, makes the shot, and that's what matters most. Meanwhile, let's go back to, and again, the starters really not playing a factor here for most of the fourth quarter. But Chris Sops for Zingas in his limited minutes, 24 minutes to be exact, 20 points, 11 rebounds for KP tonight, Chris. Yeah, and so look, there was that little stretch coming back from the calf injury that it didn't look like himself or as impactful as he was maybe at the start of the year. But my goodness, the last few games, I would say, maybe the last week, he's just kind of starting to turn it up a little bit. And you're just starting to remember, oh yeah, like if there's a little bit of a lull or you need to get yourself going like tonight where he has the steal early to go in and gets in transition, find them on the blocks, you get the threes, you see the energy on both sides of the court. Man, like this guy is gonna be so vital to whatever they do, mid-April to hopefully mid-June. And you can just, it's a reminder right here that, and we're only seeing it in small doses. And even for whatever reason, he didn't start the second half there. They brought him in after like two plays. But I do think these are just like sort of the instances where, oh yeah, he's gonna be vital, he's going to be really important. And just a reminder of what he can do. Now imagine when he's up at 35, 38 minutes per game and how that stat line is gonna be off the charts. Yeah, I also love the fact that he plays the game with joy. And he saw that a few times today. Well, we'll actually look at some of that video coming up later on. But right now we wanted to head back out to the garden where we have Abby standing by with Peyton Pritchard, who had 21. Peyton, Sacramento is fighting for their playoff lives. How did you guys close this one out? Take me through those last few possessions. Shoot, they made a big push right there. They started hitting, we missed a couple of times, but we took care of it. Then the business X hit a big shot. So put us over the hump. How valuable can those experiences be? We saw Jordan on the floor as well. These moments for you guys. It's definitely, it's good for us. I mean, we just keep growing, learning from experiences like this and keep growing our game. So when the time comes, we can help the team. Do you now hold the franchise record for five plus threes coming off the bench? What kind of flow did you find here? I feel like I was in good rhythm. You know, my middle finger is a little bit better. It's been jammed up a lot the last couple of games. So today it felt a little bit better. We talked at halftime about working on things. What are you working on personally, these last handful of games, knowing you're going to get some extended run? Just figuring out how to win games and, you know, controlling the tempo, the pace, finding ways to, you know, affect the game and obviously lead our team to win. So got win number 61 tonight. Peyton, thanks. Congrats. Thank you. I was bringing in Scowl now back at the garden. Scowl, obviously we got to start with late game execution here for the Celtics. And the fact that they were able to get that game went from Xavier Tillman out at all seriousness though. He's clearly getting it. He's having a great time. How does this feel though, for those guys that are on the floor, for them to be able to make the plays on the stretch, Xavier Tillman in particular, to get that game winning shot for those guys to have that opportunity? Yeah, because you're going to sleep better at night than him making that shot. Remember, let's be real. You were touting our late game execution. They went on a 16 to one run, Tom Giles. So, but it's finding a way. And when that happens and you lose, the next morning you wake up and you know something's wrong. When that happens and you win, you move past it and you get back and you get back to work. So, yeah, I think it was a big play. And I think more than anything, give Sam Houser credit for knocking that ball free. A lot of guys who have a rough night, can't knock down a shot, get blocked at the rim and all of a sudden give up on a play. He stuck with it, knocked the ball free and Tillman had a really nice move into a soft touch. Yeah, and like, look, since Tillman's come back from the injury, same deal, I think he's been a little bit up and down, maybe not as crisp as he was when he first got here.  Feels better about himself is that those things can snowball for a guy who should probably find his way into the playoff rotation. Scal, more importantly, like, we were talking about Chris Thops, how good he was out there. What did you notice from him out there? Yeah, he really is unguardable with this team. And if you put him in a situation where he sets a flare screen, people are gonna go to Jason Tatum, he takes advantage of it. It is like, it's almost as if the coaches are just saying, you know what, we have to stop Tatum, we have to stop Brown, we have to stop the Celtics three-point shooting. We can't get blitzed on those plays. So what's happening is Porzingis is taking advantage of it. And I don't think they've made adjustments to it. They're not double-teaming Porzingis. They're keeping them one-on-one and they're leaving smaller guys on him. So unless something different happens, like I think the coaches are probably gonna say, if anybody can beat it, it's gonna be Porzingis. And I like the way the Celtics are force-feeding him the ball and making that happen. It doesn't seem like that's gonna go away. And I don't think that coaches will make different adjustments if they haven't already.


Do you want to hear a story? This is Brand new so I don't know if it's any good or not, but it's called it has a very Stephen King title. It's called afterlife William Andrews an investment banker with Goldman Sachs dies on the afternoon of September 23rd 2012 it is an expected death his wife and adult children are at his bedside That evening when she finally allows herself some time alone away from the steady stream of family and condolence visitors Lynn Andrews calls her oldest friend who still lives in Milwaukee It was Sally Freeman who introduced her to bill and if anyone deserves to know about the last 60 seconds of their marriage. It's Sally He was out of it for most of the last week the drugs but conscious at the end His eyes were open and he saw me he smiled I took his hand and he squeezed it a little I bent over and kissed his cheek when I straightened up again He was gone She has been waiting for hours to say this and with it said she bursts into tears Her assumption that the smile was for her is natural enough, but mistaken as he is looking up at his wife and three Grown children they seem impossibly tall creatures of angelic good health in happening a world. He is now departing Bill feels the pain he has lived with for the past 18 months leave his body It pours out like slop from a bucket. So we smiles With the pain gone as little left his body feels as light as a fluff of milkweed His wife takes his hand reaching down from her tall and healthy world He has reserved a little bit of strength, which he now expands by squeezing her fingers.  It spreads Obliterating the only world. He's known since 1956 when he was born in the small Hemingford County Hospital in Nebraska During the last year Bill has read a great deal about the passage from life to death on His computer always careful to obliterate the history so as not to upset Lynn who is constantly and Unrealistically upbeat and while most of it struck him as bullshit the so-called white light Phenomenon seemed quite plausible For one thing it has been reported in all cultures for another it has a smidgen of scientific credibility One theory he's read suggests the white light comes as a result of the sudden cessation of blood flow to the brain Another more elegant posits that the brain is performing a final global scan in an effort to find an experience comparable to dying or It may just be a final firework Whatever the cause Bill Andrews is now experiencing it the white light obliterates his family and the airy room From which the mortuary assistance will soon remove his sheeted breathless body In his researches, he became familiar with the acronym NDE standing for near-death experience in many of these experiences The white light becomes a tunnel at the end of which stand beckoning family members who have already died or friends or angels or Jesus or some other beneficent deity Bill expects no welcoming committee what he expects is for the final firework to fade to the blackness of oblivion But that doesn't happen when the brilliance dims. He's not in heaven or hell He's in a hallway He supposes it could be purgatory a hallway painted industrial green and floored and scuffed and dirty tile Could very well serve as purgatory But only if it went on forever this one ends 20 feet down at a door with a sign on it reading Isaac Harris manager Bill stands Bill stands where he is for a few moments inventorying himself He's wearing the pajamas he died in least he assumes he died and he's barefooted But there's no sign of the cancer that first tasted his body then gobbled it But that down to nothing but skin and skeleton He looks to be back at about 190 which was his fighting weight slightly soft belly granted before the cancer struck He feels his buttocks in the small of his back. The bed sores are gone Nice He takes a deep breath and exhales without coughing even nicer He walks a little way down the hall on his left is a fire extinguisher with a peculiar Graffito above it better late than never On his right is a bulletin board on this a number of photographs have been pinned the old-fashioned kind with Decal edges above them is a hand-printed banner reading company picnic 1956 what fun we had Bill examines the photographs which show executives secretaries office personnel and a gaggle of romping kids There's a there are guys tending a barbecue one wearing the obligatory joke toke Guys and gals tossing horseshoes guys and gals playing bally ball Guys and gals swimming in a lake the guys are wearing bathing suits that look almost obscenely short and tight To his 21st century eye, but very few are carrying big guts They have 50s physiques bill thinks the gals are wearing those old-fashioned Esther Williams tank suits the kind that make women look as if not as if they have buttocks But only a kind of cleftness bulge above the backs of their thighs Hot dogs are being consumed Beer is being drunk. Everyone appears to be having a wail of a good time In one of the pictures he sees Richie Blankmore's father handing Ann-Marie Winkler a toasted marshmallow This is ridiculous because Richie's dad was a truck driver and never went to a company picnic in his life Ann-Marie was a girl. He dated in college in another photo He sees Bobby Tisdale a college classmate from the early 70s Bobby who referred to himself as Tis the whiz died of a heart attack while still in his 30s He was probably on earth in 1956 But would have been in kindergarten or the first grade not drinking beer on the shore of Lake whatever In this picture the whiz looks about 20, which would have been his age when Bill knew him In a third picture Eddie Scarpone's mom is baffing a volleyball Eddie was Bill's best friend when the family moved from Nebraska to Paramus, New Jersey and Gina Scarpone once glimpsed sunning herself on the patio and filming white panties and nothing else Was one of Bill's favorite fantasies when he was still on his masturbation learners permit The guy in the joke toke is Ronald Reagan Bill looks closely his nose almost pressing against the black-and-white photo and there can be no doubt The 40th president of the United States is flipping burgers at a company picnic. What company though? Where exactly is he? His euphoria at being whole again and pain-free is fading what replaces it as a growing sense of dislocation and unease Seeing these familiar people in photographs doesn't make sense and the fact that he doesn't know the majority of them offers Marginal comfort at best He looks behind him and see stairs leading up to another door printed on this one in large block red letters is locked That leaves only mr. Harris's office Bill walks down there hesitates knocks. It's open Bill walks in Beside a cluttered desk stands a fellow in baggy high-waisted suit pants held up by Suspenders his brown hair is plastered to his skull and parted in the middle He wears rimless glasses the walls are covered with invoices and corning leg art cheesecake picks That make Bill think of the trucking company Richie Blankmore's dad worked for he went there a few times with Richie And the dispatch office looked like this According to the calendar on one wall. It's March of 1911, which makes no more sense than 1956 To Bill's right as he enters there's a door to his left is another There are no windows, but a glass tube comes out of the ceiling and dangles over a Dan Ducks laundry basket The basket is filled with a heap of yellow sheets that look like more like invoices or maybe their memos Files are piled two feet high on the chair in front of the desk Bill Anderson isn't it the man goes behind the desk and sits down. There's no offer to shake hands Andrews right and I'm Harris Here you are again Andrews Given all Bill's research on dying this comment actually makes sense And it's a relief as long as he doesn't have to come back as a dung beetle or something So it's reincarnation. Is that the deal? Isaac Harris sighs you always ask the same thing and I always give the same answer Not really I'm dead aren't I do you feel dead? No, but I saw the white light. Ah, yes The famous white light there you were and here you are Wait a minute. Just hold the phone Harris breezes through the papers on his desk doesn't find what he wants and starts opening drawers From one of them he takes a few more folders and selects one. He opens it flips a page or two and nods Just refreshing myself a bit investment banker, aren't you? Yes wife three kids two sons one daughter correct Apologies, I have hundreds of pilgrims and it's hard to keep them straight I keep meaning to put these folders in some sort of order, but that's really a secretarial job Since they've never provided me with one Who is they? No idea all communications come via the tube He taps it the tube sways then stills runs on compressed air latest thing Bill picks up the folders on the client's chair and looks at the man behind the desk eyebrows raised Just put him on the floor Harris says that'll do for now one of these days. I really am going to get organized If there are days Probably are nights too, but who can say for sure no windows in here as you will have noticed also no clocks Bill sits down. Why call me a pilgrim if it's not reincarnation Harris leans back and laces his hands behind his neck He looks up at the pneumatic tube, which probably was the latest thing at some time or other say around 1911 Although bill supposes such things might still have been in use around 1956 Harris shakes his head and chuckles although not in an amused way If you only knew how weary some you guys become According to the files, this is our 15th visit I've never been here in my life bill says he considers this except it's Not my life.  That's my afterlife Sound exciting Bill who has encountered all the theological ins and outs during his final research project decides he had the right idea While he was still in the hall You're talking about purgatory Oh, no doubt the only question I have is how long I'll be staying I'd like to tell you I'll eventually go mad if I can't move on But I don't think I can do that anymore than I can take a shitter at app I know my name means nothing to you But we've discussed this before not every time you show up but on several occasions He waves an arm with enough force to cause some of the invoices tacked on the wall to flutter this is Or was I'm not sure which is actually correct my earthly office In 1911 just so I'd ask you if you know what a shirt waste is bill But since I know you don't I'll tell you a woman's blouse At the turn of the century I and my partner max blank owned a business called the triangle shirt waste company Profitable business, but the women who worked there were a large pain in the hindering All was sneaking out to smoke and this was worse Stealing stuff which they would put in their purses or tuck up under their skirts So We locked the doors to keep them in during their shifts and searched them on their way out Long story short the damn place caught on fire one day Max and I escaped by going up to the roof and down the fire escape Many of the women were not so lucky Although let's be honest and admit It was a lot of blame to go around Smoking was strictly verboten, but plenty of them did it anyway, and it was a cigarette that started the blaze Fire marshal said so max and I were tried for manslaughter and acquitted Bill recalls the fire extinguisher in the hall with better late than never printed above it He thinks you were found guilty in the retrial mr. Harris, or you wouldn't be here How many women died? 146 harris says and I regret everyone mr. Anderson Bill doesn't bother correcting him on the name 20 minutes ago. He was dying in his bed Now he is fascinated by this old story, which he has never heard before that he remembers anyway Not long after max and I got down the fire escape the women crammed onto it the damn thing couldn't take the weight It collapsed and spilled two dozen of them a hundred feet to the cobblestones. They all died 40 more jumped from the ninth and tenth floor windows. Some were on fire.  Anderson terrible others jumped down the elevator shafts, but most just burned Like 9-11 with fewer casualties So you always say And you're here Yes, indeedy I sometimes wonder how many men are sitting in offices just like this women too I'm sure there are women. I've always been forward looking and see no reason why women can't fill low level executive positions and admirably All of us answering the same questions and sending on the same pilgrims You'd think that the load would lighten a little each time one of you decides to use the right hand door Instead of that one. He points to the left, but no no A fresh canister comes down the tube Zoop and I get two new bozos to replace the one old one sometimes three He leans forward and speaks with great emphasis this Is a shitty job mr. Anderson It's andrews bill says and look I'm sorry you feel that way, but jesus take a little responsibility for your actions, man 146 women and you did lock the doors Harris hammers his desk. They were stealing us blind He picks up the folder and shakes it at bill. You should talk Pot calling the kettle black Goldman Sachs security fraud Profits in the billions taxes in the millions the low millions does the phrase housing bubble ring a bell How many clients trust did you abuse? How many people lost their life savings? Thanks to your greed and short-sightedness Uh bill knows what harris is talking about, but all that chicanery Well, most of it went on far above his pay grade He was as surprised as anyone when the excrement hit the cooling device The proof of his essential innocence it seems to him is that he is the pilgrim and harris is stuck in this office He's tempted to say there's a big difference between being beggared and burned alive, but why rub salt into the wound Let's drop it. He says if you have information. I need why not give it to me fill me in on the deal And I'll get out of your hair I wasn't the one smoking harris says at a low and brooding tone. I wasn't the one dropped the match Mr. Harris bill can feel the walls closing in if I had to be here forever I'd shoot myself. He thinks Only if what mr. Harris is saying is true, he wouldn't want to anymore than he would want to go to the toilet Okay, all right harris makes a lip-flapping sound not quite a raspberry So the deal is this Leave through the left door and you get to live your life over again A to z start to finish take the right one and you wink out poof candle in the wind type of thing At first bill says nothing to this He's incapable of speech and not sure he can trust his ears It's too good to be true His mind turns to his brother mike and the accident that happened when mike was eight Next to the stupid shoplifting thing when bill was 17 Just a lark, but it could have put a hole in his college plans if his father hadn't stepped in and talked to the right person The thing with ann marie and the fraternity house that still haunts him at odd moments even after all these years and of course the big one Harris is smiling and the smile isn't a bit pleasant Okay So his ears did deceive him Or maybe harris was just getting back at him for suggesting that harris deserved to be here in this limbo of bureaucracy I know what you're thinking because i've heard it all from you before About how you and your brother were playing flashlight tag Where you were when you were kids and you slammed the bedroom door to keep them out and accidentally cut off the tip of his pinky finger The impulse shoplifting thing the watch and how your dad pulls strings to get you out of it That's right. No record except with him. He never let me forget it and then There's the girl in the frat house Harris lifts the file her names in here somewhere I imagine I do my best to keep the files current when I can find them But why don't you refresh me? Ann marie winkler bill can feel his cheeks heating up. It wasn't date rape So don't get that idea. She put her legs around me when I got on top of her and if that doesn't say consent I don't know what does Did she also put her legs around the two fellows who came next? No bill was tempted to say but at least we didn't light her on fire smartass But still He'd be teeing off on the seventh or working in his wood shop or talking to his daughter Now a college student herself about her senior thesis and he would wonder where ann marie is now What she's doing what she remembers about that night Harris's job widens to a locker room smirk. It may be a shitty job, but it's clear. There are parts of it He enjoys I can see that's a question you don't want to answer. So why don't we move along? You're thinking of all the things you'll change during your next ride on the cosmic carousel This time you won't slam the door on your kid brother's finger or try to shoplift or watch at the paramus mall It was the mall of new jersey.  I've never had the courage But given the chance you'd fix it Of course given the chance wouldn't you unlock those factory doors? Indeed I would but there are no second chances. Sorry to disappoint you. He doesn't look sorry Harris looks tired. Harris looks bored. Harris also looks meanly triumphant He points to the door on bill's left Use that one as you have on every other occasion And you begin all over again as a five pound baby boy sliding from your mother's womb into the doctor's hands You'll be taken home wrapped in bunting to a farm in central nebraska When your father sells the farm in 1964, you'll move to new jersey There you will cut off the tip of your brother's little finger while playing tag You'll go to the same high school. You'll take the same courses.  You'll have the same friends You'll have the same deep disquiet about some of your firm's business practices And you'll keep the same silence The same doctor will urge you to get a colonoscopy when you turn 50 and you will promise as you always do That you will take care of that little matter You won't and as a result you'll die of the same cancer Harris's smile as he drops the folder back on his cluttered desk is now so wide It almost creases the lobes of his ears Then you'll come here and we'll have the same Discussion my advice would be to use the other door and have done with it. But of course that is your decision Bill has listened to this sermon at with increasing dismay I'll remember nothing Nothing Not quite nothing Harris says You may have noticed some photos in the hall The company picnic Yes Every client who visits me sees pictures from the year of his or her birth And recognizes a few familiar faces among all the strange ones When you live your life over again, mr. Anders presuming you decide to You will have a sense of deja vu when you first see these people A sense that you have lived it all before which of course you have You will have a fleeting sense almost assurating that there is more Shall we say more depth to your life and to existence in general than you previously believed But then it will pass If it's all the same with no possibility of improvement Why are we even here? Harris makes the fists and knocks with the end on the end of the pneumatic tube Hanging above the laundry basket making it swing client wants to know why we're here wants to know what it's all about Alfie He waits nothing happens. He folds his hand on his desk When jove wanted to know that mr. Anders god asked if jove was there when he god made the universe I guess you don't even rate that much of a reply. So let's consider the matter close. What do you want to do? pick a door Bill is thinking about the cancer the pain of the cancer To go through all that again Except he wouldn't remember he'd gone through it already. There's that Assuming Isaac Harris is telling the truth No memories at all No changes at all Are you sure? How can you be? Because it's always the same conversation mr. Anderson each time and with all of you It's andrews. He bellows it surprising both of them in a lower voice.  How about that? Harris says There's a folk tale that before birth every human soul knows all the secrets of life and death in the universe But then just before birth an angel leans down And puts his fingers to the new baby's lips and whispers Harris touches his filth room According to the story. This is the mark left by the angel's finger Every human being has one Have you ever seen an angel mr. Harris? No But I once saw a camel it was in the bronx zoo Choose a door As he considers As he considers bill remembers a story they had read in junior high the lady or the tiger This decision is nowhere near as difficult I must hold on to just one thing he tells himself as he opens the door that leads back into life Just one thing Then the white light envelops him The doctor who will bolt the republican party and vote for anlai stevensson in the fall something his wife must never know bends forward from the waist like a waiter presenting a tray and comes up holding a naked baby by the heels He gives it a sharp smack and the squaling begins You have a healthy baby boy mrs. Andrews. He says congratulations She takes the baby She kisses his damp cheeks and brow They will name him william after her paternal grandfather When the 21st century comes he'll still be in his 40s The idea is dizzying in her arms. She holds not just a new life, but a universe of possibilities Nothing she thinks could be more wonderful Thanks Thank you. Thank you. Oh god, that's great. Thank you. Okay, I will read it again Great, man Thanks, we're gonna take some questions. Yeah. Yes. You got some time. Thank you