Hello everyone, thanks for tuning in. My name is Ignat and today we're going to talk about sandboxing your code on Linux and Seccom. Just to let you know, this session is prerecorded because my home broadband is not that great to give live presentation, but I'm hopefully online when this presentation is being streamed, so I'm happy to answer all your questions during the presentation or after the presentation. Thanks for tuning in and let's go. First, a little bit about myself. I work at Cloudfer, I do mostly performance and security. I'm from London. I'm also passionate about cryptography and enjoy low-level programming, Linux kernel, bootloaders and other low-level scary C stuff. Okay, to understand sandboxing, let's talk about Linux system code and Seccom first. Well, on modern computers, we don't run our code directly on the hardware, right? So we on modern computers, we use operating systems and like with Linux, Windows and Mac OS being one of the prominent examples. And so we run our operating system from on top of our hardware and then we run our application on top of the operating system, which kind of separates the whole computing into two environments. It's like application run in user space and the operating system kernel runs in kernel space. And it's like a middle layer between application and the hardware, which provides useful obstruction and services. So system calls then. So if you run and your application on some kind of operating system, at some point, you need to communicate with that. You need to request some services from the operating system or request access to some hardware from the operating system. And for that purpose, the operating system kernel provides an interface to do that. So system call is basically this interface. It's a set of functions you can call from your application to request services on behalf of the application. So yeah, system calls is just a well defined interface between user space application and the operating system kernel provides many features like for example, hardware independent obstructions, your application does not need to care if it runs on a like an old spinning disk or on a modern SSD. Also, it doesn't need to know the details of your network implementation. So yeah, the operating system provides your basic high level services like file IO network access and also like time sound and something out some other services. This architecture also allows operating system to enforce different security models like access control list permissions and privileges between application. And because we also run multiple application on the same hardware, the operating system kernel is responsible for some resource management to ensure that hardware resources are shared fairly between all the application. So what is second then second is is just yet another system call. It's a operating system interface. And it provides a way for an application to notify the kernel which other system calls the application intends to use and sometimes which system call the application will definitely not use. And then the kernel enforces the system call policy provided by the application. So basically second is just a tool for an application to confine on sandbox itself. And remember second is just a tool. The documentation says it's not a full sandbox solution. It's a tool to create sandbox. So let's go back to our example. So in this case, the application can use second system call to provide its system call policy to the kernel. Think of it like as a contract between the application and the kernel where the application promises to the kernel to use only a subset of system calls and probably never to use some other system call. And because it's the contract, if the application later breaks the contract, the kernel is free to take action. So it usually penalizes the application by terminating it. So why would applications actually do that? So if they don't provide any policy, the second the Linux kernel will never penalize the application. But why would the application would take the risk to providing that policy if they can suddenly, for example, violate it in the future and be abruptly terminated? Let's consider an example. So imagine you're writing a simple clock application and you're writing it on Linux to be able to use second. So what does the clock application actually need? It only needs to know the current time. So you can actually define a second policy for your application and pass it to the kernel and your policy would be, hey, I'm just a clock application. And I will only use the get time of day system call because the clock only needs to know time. And when your application is executing at some point, it needs to know the time. So it uses get time of day system calls to get the time from the kernel. And because it's within the allowed policy, the kernel will allow that system call to happen and return the time. But imagine at some point later, because you wrote your clock application in a low level unsafe language like C or assembly, someone hacks your application and that achieves arbitrary code execution. Then the attacker will probably use that application to collect some sensitive information from your system. And they will try to send it to themselves over the network to steal it. So they will direct the application to send the data over the network. So the application will most likely use the send system call. But because the send system call was not part of the original policy, of the original promise by the application, the kernel will not allow it to happen and immediately terminating the application thus like terminating the hijacked application and preventing the data leak. So that's why SACOMP is very useful. SACOMP is not very important for normal behaving application, but it's very effective if the application is somewhat exploited mostly from a good way to protect from arbitrary code execution attacks. So sandbox your applications. Okay, how to actually do that, right? Let's consider, let's jump into code now. So let's write a simple common line application. If you're familiar with UNAME, a common line tool, it will be something similar. So our application will use the similarly named UNAME system call to get some static information from your local operating system kernel and print it to the user. Let's see how it works now. If we compile this code and run it, we will see that our operating system is Linux, which is great because we can now experiment with SACOMP further because SACOMP is the Linux only feature. Now let's try to sandbox our application. So we will modify the code and add just one function, additional function before the main logic, which we'll call sandbox. And here is the function implementation. So let's define our policy here. So actually to illustrate that SACOMP is working, we will define, we will actually prohibit our own application to use the UNAME system call, but we will allow any other system calls. So to do that, we will need to write this scary listing. Unfortunately, SACOMP rules are a quite low level feature and they are written in the BPF programming language. So if you, the operating system provides some useful macros for that, but the whole rule still looks very like assembly. So yeah. But the gist of this scary listing is this part. So in this case, what our rule says is that we allow every system call within our process, except the UNAME system call. And if the application tries to use the UNAME system call, we will block it. And instead of terminating the application, we will instruct the kernel to return an error code in that down. And finally, in our sandbox function, we need to actually apply that policy or enforce that policy by using the SACOMP system call and sending our SACOMP filter program to the kernel. So let's see how it works now. If we recompile our modify source code and try to run it, we will see this. We see that UNAME system call failed and that network is down. And we know that SACOMP is working because of two reasons here. First of all, there is no way the UNAME system call can return network is down error because basically on itself UNAME system call doesn't, is just reading some static data from your local operating system kernel. It doesn't need any network access. But because our application receives that error code, we know that we hit our SACOMP rule. And secondly, what we're hitting with the error code is the error pass in the application. So the application has an error pass defined where it just prints the error to the user. And we see the output. And to actually to print something to the user, the application has to use other set of system calls, notably the right system call. So we know that other system calls are allowed because the application was able to actually print the error code to us. So yeah, it's quite simple, but it's definitely not simple to write SACOMP rules by hand. So it's quite low level assembly like language. It's hard to write. It's hard to review. It's hard to debug and update. So even our small example contained a quite large and rather unreadable code, whereas consider if you need to define a more complex policy for a very complex real world application. If you write it by hand, you also need to be aware of some low level details. So SACOMP rules, BPF rules do not operate on SACOMP system call names. They rather operate on system call numbers, which is internal representation in the kernel. And to deal with SACOMP system call numbers, you also need to be aware of the architecture because the same system calls may have different numbers on different architectures. And there is also some other quirks like setting the no new privileges bid for the process you want to send box. And the description of this is buried very deep in the SACOMP main page. Luckily for many complex things, there is a high level abstraction library and the SACOMP is not an exception. So we can actually rewrite similar policy using the high level leap SACOMP library, which is actually even recommended on the SACOMP main page. We will modify our policy a bit. So usually just returning an error code if the process violates its SACOMP policy is not great because you still give the chance to malicious code to recover from the error and try to bypass or do an evil thing any other way. So it's usually better to just terminate the application, which we will do here. So instead of returning error code, we will modify, we'll still prohibit the uname system call, but we'll tell the kernel to immediately terminate the application. And actually that huge manual BPF listing can be boiled down to three small statements with the high level library. So first we define the default action. So by default, we tell the kernel to allow every system call. Then we add our specific rule with a small statement. We say, but we prohibit the uname system call here. And if the application tries to use it, we just terminate it. And notice here, we can reference the uname system call by name. And we don't have to deal with numbers. So leap SACOMP will resolve it for us. And finally, again, we pass the compiled policy to the Linux kernel using the wrapper around the SACOMP system call. Let's see how it works now. So we will recompile again our modified source code, but this time we need to also link with the SACOMP library because we used it in our code. And if we execute the system call, we see the bad system call message. Notice here that the application did not have the chance to print the error now because it was immediately terminated when it tried to use the uname system call. So that's why we don't see the uname file message anymore because our policy is more strict. Okay, this is all well and good. But the problem is two previous examples. We actually had to modify the source code for the application to add sandboxing support. But it's not always possible. So imagine, like, if it would be a live presentation, this would be a show of hands question. But think of, if you're a developer of, you know, the developer think of the following.  And you know, sandboxing is the most efficient way to protect your code from potential security vulnerabilities introducing in your code. So how many developers think like this? So most likely I will write bugs and security vulnerabilities. I should sandbox my call. Of course, not many, right? Like, if you're a developer starting a new project, you have so many other priorities. And it's usually like, oh, we have to deliver the primary functionality first, we have to deliver the MVP, we have to do something else, else, else, and we'll think about the security later, which is a typical case. Also, there are some proud developers out there, which will probably even never admit they will write bugs or security vulnerabilities in the first place. So, yeah, this is not an option, right? So here is an inherent problem with second that second applies the defined rules of policy to the current process. And it's basically the model is that it is expected that developers themselves will add sandboxing support support into their code. And there is actually no external interface to apply second rules to running process. But on the other hand, you have these other people like operators, sysadmins, or SRE who run that code in production, and they would really like to sandbox that code to have better security, but they have almost no control over the second policy, because they have no access to the source code, or even if they do, they're not very familiar with the code base, et cetera, et cetera. There is also this small side of application everyone runs, which are like closed source proprietary tools, where source code is completely unavailable, or there are just some kind of third party applications, which should be sandboxed by default because you cannot even audit the code, but you don't have any means to do that. So with second, there is a gap, right? So on one side, you have the developers of the code who have the ability to sandbox their code, but they are most of the time they are not incentivized to do that. On the other hand, you have the operators, sysadmins, and SREs who are incentivized to sandbox their code, but they don't have the ability to do that because they don't have access to the source, for example. So this is where no code sec comps comes into play. So it would be nice that you could can apply second policy to any process on the Linux kernel, even without having to have having to have to recompile it, or even like some having to have access to the source code. And turns out there is a solution. So you can do that with system D. So if you run your code through system D, you use system D as a service manager, if you dive deep into the system D documents, you can define so-called system call filter directive. So you can supply a list of permitted system calls to system D, and system D will inject, convert them to a second policy and inject that policy before actually starting your service. And if the process later, violates the policy, it will be terminated with sys signal. You can read about this more in the system D documentation. So let's see how it works. Let's go back to our original non sandbox version of our tool, which is just basically calling your name and print the result. So now let's try to run this tool from system D. So we can actually use system D run to simulate the to running our tool as a like fmrl system D service. And we see it runs fine. So we still see our output and system D also prints that the application or the service exit it was successfully with exit style zero. So all is fine. Now we can try to sandbox our code. So we can actually add our system call filter property and supplied denialist to deny your name system call to the to our application. If we run it, we see that it's not printing any results anymore. And we see that system did tells us that the application was actually terminated with the signal, which is what we expected. And now to apply our custom second policy, we didn't need to modify the source code for the myos tool. And we didn't even have to have access to the source code. We just operate on the same vanilla binary. We can actually simulate our first policy where instead of terminating the application, we tell the kernel to return on custom error code. We can also simulate this with system D. We have to add yet another property system call error number in and down. And now we see similar behavior as our very first example with second that the tool is actually able to print the result. We expect that you name system call failed with network is down error code. And but the process itself is not being terminated is just exits with an error code, which is the way how we program from the start. So great. This is all well and good. Why don't we just use system D to sandbox any code on our system? It's possible, but there is always a but, right? And there is a small print. If you read further down the system D documentation, you will notice this line that some system calls notably exact V exit and some others are implicitly allowed. They're always allowed and they don't have to be listed explicitly. And even though you tell system D to prohibit the system call, they will be still allowed because the system D, sorry, the system call, the system calls are needed for system D to actually function problem. Most of these system calls are okay, except exact V. So exact V is a quite dangerous system call. Let's consider why, like why blocking exact V is good and why you should try to do it. If your application logic doesn't need this call. Most application don't, for example, if you're not writing a shell. So let's remember our clock application example. So we remember that the second is the most effective measure to protect our code from arbitrary code execution attack. So what does an arbitrary code execution attack look like? So for example, if you're an attacker is able to exploit your code and make your application malicious, they will try to expand their capabilities of execution by directing your application to actually use exact V system call to run some other application. And most of the time it's a shell. So the attacker just needed shell access to your system. And then the attacker can issue arbitrary commands and do whatever they want. So this is the most common pass for arbitrary code execution exploit. So exploit the application and make it run exact V system call and replace the application code with the shell. So blocking exact V is quite handy to protecting from these kind of attack. That's why we develop our own sandboxing solution, which is we call it just a sandbox tool. It's a toolkit to inject custom second rules into almost any process without any access to any source code. And the toolkit considers of two pieces. It actually follows a system D approach to allow to sandbox any code on your system with no code changes, but takes it one step further. So the toolkit contains two pieces. One piece is a shared library, which is designed for dynamically linked executables. And the other part is a launcher for static link applications. And the advantage is that toolkit can block any system full, including exact V. And it works on binaries written in any, any programming language and it works even on proprietary binaries. And the tool is open source. So you can check out the source on GitHub. At this point, you may be like, what shared library, you said, we are talking about zero code, a second support, doesn't a shared library implies we need to add some code to use it in our application? Well, no, because it's a bit special. So let's go back to our toy, you name like tool, which prints the currently running operating system, and which is non sandbox version. So it's like vanilla tool. To sandbox our, our common line application with our new cloud for sandbox toolkit, all you have to do is run it like so. So we do two things here. So we preload our send our library from our cloud for sandbox toolkit into the application process space using LD preload. And then we configure the desired second policy using an environment variable. So in this case, we configure a denialist policy with only one system call you name. And when we run it, we see it behaves as expected. So when trying to do trying to call the you name system call, our application is being terminated immediately by the currently, and we know that because it even doesn't have a chance to print the error message to the console. So yeah, it is a dynamic library, but it's magic that you don't have to use it in your code. All you have to do is to somehow link it into your process address space. So some people don't like the LD preload approach. And sometimes actually LD preload approach is not usable because it has an exceptions in Linux. So to work around the LD preload thing, we can actually patch the compiled executable and add our sandboxing library as a permanent runtime dependency. So if we do that, we don't need LD preload anymore, and we can run our application anytime just as is. And what we need to do is just to define the environment variable with a desired second policy. And notice here, we patched the executable, compiled executable with no access to the source code, and we still get our result. Okay. But what about static binaries? So if we recompile our original application as a static binary, we will see that the LD preload approach does not work anymore. That's because for static binaries, there is no runtime linker. That means linking dynamic libraries into the process address space does not work anymore. For this specific use case, we have the other part of our sandbox toolkit called sandboxify common line tool. It has the same configuration interface with environment variables, and all you have to do is to run your application through the sandboxify launch. It was the same way probably as we would run our application using the system D service manager. And this way we can enforce custom second policy on static on processes spawned by static executable. So in this case, we see that again, the application was terminated immediately after it tried to use the name system call and wasn't able to print anything to the console. So yeah, all you have to do is to replace the LD preload directive with our custom sandboxify launcher, which is part of our toolkit. So in a nutshell, Cloud for Sandbox tool is quite easy to use, and it has a very simple configuration interfaces configured by environment variables. The default in preferred mode is to actually supply your policy as an allow list. So anything, everything in the list is allowed, but everything is not in the list is denied and the application will be terminated immediately if it tries to use any system called not in the allow list. The more flexible, but probably less secure approach is the denial list, which we saw earlier is that every system called is allowed by default, except the ones in the list, which might be some kind of dangerous schools or whatnot. Also, there is a certain environment variable called default action. So by default, if your application violates the configured second policy, it will be terminated, but you can instruct the kernel not to kill the application and actually allow the system call to happen, but just log that the attempt has been made. This is very useful for like early discovery stage where you're working with some kind of new executable and you're not exactly sure even which system calls are being used. So you can run your application in so called permissive sandbox where you just monitor which system calls the application uses, or you can actually use this mode to verify if your defined second policy is not too tight and you're blocking some legitimate syscalls. And yeah, and the toolkit itself, as I mentioned before, considers of two parts. The first part is Leap Sandbox SO, which is a shared library. It's useful for sandboxing dynamically linked executables only, and you actually just need to preload that library into the process adverse space either using the LD preload or actually patching the executable directly. And the other part is the sandboxify common line tool, which can be used on both statically and dynamically linked executables. And to make use of it, you need to launch the executable through our custom launcher. And at this point, what many people ask, so why do we even need to leave the first piece, the dynamically linked, the shared library Leap Sandbox SO? If the launcher can be used on both statically and dynamically linked executables, why not just leave the launcher and never use the shared library approach? And the answer is they're different. And to understand the difference, let's from like 1000 feet view review the process startup stages. So when you start any process, when you launch any executables, what usually happens there are two major stages. The first stage is some kind of runtime in it. So every code has some kind of runtime. If you write in C, you have the C runtime. If you write in Go, you have the Go runtime. If you're writing some scripts using interpreted language, you have some interpreted runtime. And then you have the actual main logic, right? So in this case, if you use the sandboxify approach to inject custom second rules, the rules are injected before the run, usually before the runtime in each stage happens. But if you use the Leap Sandbox approach, the rules are injected after the runtime in each stage. But why it's different? So what is this runtime in it? So runtime in it, regardless of the language we use is basically a set of system calls which are never used afterwards. So that's why it's in it. So this runtime sets up some resources, process memory, map, et cetera, et cetera. And it uses a lot of obscure system calls to do that. But most of these system calls are never needed in the main application logic. And here we have the advantage of Leap Sandbox because it's usually the second rules are inserted after the runtime in each stage. If you're using the preferred allow list approach, all you have to allow is all the system calls from your main application logic. But if you use the sandboxify approach, because it happens before, because the enforcement happens before the runtime in each stage, you actually need to allow all the system calls, both from your main logic and from the runtime in each stage, which is usually a lot more. So you're basically you're allowing some system calls, which your main logic doesn't need. And if you don't do that, you cannot start your application because the runtime in each stage will just crash. So let's see a concrete example here. Let's go back to our toy. You name like tool. So if we now, we will change the policy now for previously in our examples, we use the denialist approach where to prove that Sec Comp is working. But this time, what is the minimal allow list we have to allow for our toy application to function properly? And if you use the Leap Sandbox approach, turns out you only have to allow for system calls for application to function properly. So you have a very tight sandbox here. If you run the same application using the sandboxify launcher, because of the runtime in each stage, C runtime in each stage for the specific application, you need to now to allow certain system calls to run your application. So it's four system calls versus certain system calls and they allow this. So yeah, with a dynamic library, a Leap Sandbox approach, if you have a dynamically binary, you can end up having very smaller allow list thus greatly reducing your potential attack surface by disallowing many other system calls your main logic doesn't use. And that's basically it. What I had for today, here are some useful links. The first link is linked to the Sec Comp man page has a lot of low level details and quirks I've been briefly mentioning in my presentation. The second link is the official repository of the Leap Sec Comp library we discussed today. And also Leap Sec Comp library is actually used under the hood in the Cloud for a Sandbox toolkit. The third link is the link to the SystemD documentation which describes how to inject Sec Comp rules into any code with SystemD. And finally, again, we repeat the link to the our Cloud for a Sandbox toolkit. We hope that you find this toolkit useful. You will apply it to your application and provide some feedback to us and even better some pull requests and more functionality. Thank you very much. That's it for today. Now I'm happy to take any questions you have in the chat. See you and stay safe. Hello everyone. Thank you for joining my presentation. I try to answer all the questions in line, but there are still some building up. So I'll try to attack them one by one. Let me just publish the first one. Yeah. So Al asks that it's not unusual and unusual for complex applications to read, byte, and or receive system call. How do you protect against those? So the general idea around Sec Comp is you try to come up with a minimal allow list of all the system call your application need and to prohibit all other system calls. In most case, like blocking exactly is probably even good enough because exactly plug dangerous and is the main tool the attackers will use to get arbitrary code execution if they will be able to exploit a code. So even if you just block the exact V and your application module does not need it and it doesn't need it unless you're writing some kind of a shell. So it's a good idea to have it in place. Like consider a very famous code execution exploit in image tragic image processing library. So let's say if you were executing this code in like a second environment, most likely you will be less vulnerable to the kind of attack and like probably an image processing library doesn't need to execute any other binders, I hope. Okay, to the next one. So Rustam asks, is lib sandbox being distributed by distro? No, because I just pushed the code today on our public GitHub repository. So I hope that will change in the future. But if I know like some distros are very open to new maintainers taking new packages, if you want to take it on yourself, if you feel free, you will get my full support. So the next question Wayne asks, can we use both approaches which would allow a longer system called reviewing runtime and then more restricted list during the main code? This is a good idea actually, I haven't thought about that maybe. In its current implementation probably no because both tools are like reading the same environment variable. So if you like define a probably to define different second policies, you probably need to define different environment variables. So maybe future releases, we will consider to changing the environment variable. And like if lib sandbox will use one set of environment variables, but sandboxified to use a different set of environment variables, maybe that would be possible. Although keep in mind that if you like have a sandbox policy, a second policy force, the only thing you can do it is you can tighten it more. So and you also have to remember to allow the second system call itself in your initial policy. Okay, so next one. Thomas asks, how to include in things like go and rock to use dynamic libraries probably. So again, because you're linking the library and the code at some time, it doesn't matter. So I definitely know go has by default has a quite sophisticated system determining like whether when you compile your code, whether the output binary will be dynamically or statically linked. Most of the time, if you use some operating system services, especially within networking or domain resolution, you will get a dynamic binary. If you don't use them, you might get a static binary. Also, if you compile a go application will see go disabled, you will most likely to get a static binary. I know Rust by default uses dynamic link binary. So just you can check it with LBD common. If you have a dynamic or static link binary on your output, you can just decide which approach to use. Okay, I'm sorry if I didn't pronounce your name properly asks if can we filter a system code based on parameter value? Yes, the general second system code, because basically all the rules go down to BPF programs. It's technically possible to write BPF programs, which basically filters, provides decision based not only on the system calls themselves, but also the past and parameter values, although the current library and the system D thing doesn't support it. So if you want that approach, you probably would have to write your own code yourself, your own BPF specific to your specific application. So Emily asks, probably how are you collecting a list of system calls for common programs to run on your sandboxify? So there is better like two approaches. The simpler approach is if you just have access to the system, and you have a common line tool, you want the sandbox, you can run it under a trace, and it has a flag, we just like count all the system calls the application users, and then it will form a basis for your policy for more complex application from our experience. Because you don't exercise the whole execution path of a complex application, you will probably get an incomplete list. So for productions, that's the reason we included this permissive mode, where a variable which allows you to instruct the kernel not to terminate the application, but just log the system calls. So for production services, we put the service, the new service into like the so-called permissive mode first, and then our log and metrics collecting system collects these logs within like days, and then we analyze these logs and compile the initial list of all the system calls we need to allow. That's basically why the discovery mode or the permissive mode is in the code the first place. Yeah, I think we have another list of questions. Sorry. Okay, so Jason asks, how does sandboxify limit exactly while it needs to use it to execute the subject binary? I urge you to look into the code. So basically in the newer kernels, you can run the child process under ptrace and temporarily suspend the second soldering. So this is our main difference from system D. So system D just spawns the child process, sets up the second policy and does the exact V. So we spawn the child process temporarily under ptrace, then set up the second policy and suspend the second rule processing before doing the exact V, and we also put a breakpoint on the exit of the exact V system call. So we basically continue the child execution of the child process, then hit the breakpoint when the process executed the exact V, but we return to the main code yet, and then we review the second rules processing and just continue running the application. So it's just basically one step forward from the system D approach. So this is how we're able to actually block any system call including the exact V. Okay, Renato asks, is it possible to change allow the block system call during the run time? Yes, but you can only tighten policy and you also have to remember to allow the stack comp system call in the first place in your initial policy, because if you block it, you cannot do any further stack comp system call. But if you don't block it, you can then add more rules to the system and the resulting sandbox will be combined, a combination of previous policies plus your new rules. So you cannot loosen it, you can only tighten it. Vasily asks, what is the license? I have to double check on that and thanks for pointing this out. Emily asks, what happens when you try to use the sandbox and executable that declare the second sandbox? This is the same what I mentioned before. So basically, if your initial policy will allow the second system call itself, the code will able to further sandbox itself, if and the resulting sandbox will be a tighter combination of the both, if you prohibit the second system call from the beginning, the application will be just terminated when it tries to sandbox itself. Okay, I think we're out of questions here. We can continue the chat in the Q&A room. So we can chat in the Q&A in the Slack room, which is called number two track Linux system. So I'm waiting for you there. Thank you very much for listening to my presentation and basically that's it. See you online and waiting for your contributions and feedback on the sandbox tool. Thank you.


As we move through coding and data science and specifically the applications that can be used, there's one that stands out for me more than almost anything else. And that's Tableau and Tableau Public. Now, if you're not familiar with these, these are visualization programs. The idea here is that when you have data, the most important thing you can do is to first look and see what you have and work with it from there. And in fact, I'm convinced that for many organizations, Tableau might be all that they really need. It will give them the level of insight that they need to work constructively with data. So let's take a quick look by going to Tableau.com. Now, there are a few different versions of Tableau. Right here, we have Tableau Desktop and Tableau Server. And these are the paid versions of Tableau. They actually cost a lot of money, unless you work for a nonprofit organization, in which case you can get them for free, which is a beautiful thing. What we're usually looking for, however, is not this paid version, but we're looking for something called Tableau Public.  When we click on that, it brings us to this page, it's public.tableau.com. And this is the one that has what we want. It's a free version of Tableau with one major caveat. You don't save files locally to your computer, which is why I didn't give you a file to open. Instead, it saves them to the web in a public form. So if you're willing to trade privacy, you can get an immensely powerful application for data visualization. That's a catch for a lot of people, which is why people are willing to pay a lot of money for the desktop version. And again, if you work for a nonprofit, you can get the desktop version for free. But I'm going to show you how things work in Tableau Public. So that's something that you can work with personally. The first thing you want to do is you want to download it. And so you put in your email address, you download, it's going to know what you're on to pretty big download. And once it's downloaded, you can install and open up the application. And here I am in Tableau Public right here. This is the blank version. By the way, you also need to create an account with Tableau in order to save your stuff online and to see it. We'll show you what that looks like. But you're presented with a blank thing right here. And the first thing you need to do is you need to bring in some data. I'm going to bring in an Excel file. Now, if you've downloaded the files for the course, you'll see that there's this one right here, DS0322TableauPublic.xlsx. It's a Excel file. And in fact, it's the one that I used in talking about spreadsheets in the first video on this course. I'm going to select that one and I'm going to open it. And a lot of programs don't like bringing in Excel because it's got all the worksheets and all the weirdness in it. This one works better with it. But what I'm going to do is I'm going to take the tidy data. By the way, you see that it put them in alphabetical order here. And I'm going to take tiny data and I'm just going to drag it over to let it know that it's the one that I want. And now what it does is it shows me a version of the data set along with things that you can do here. You can rename it. I like you can create bin groups. There's a lot of things that you can do here. I'm going to do something very, very quick with this particular one. Now I've got the data set right here. What I'm going to do now is I'm going to go to a worksheet. That's where you actually create stuff. Cancel that and go to worksheet one. Okay, this is a drag and drop interface. And so what we're going to do is we're going to pull the bits and pieces of information we want to make graphics. There's immense flexibility here. I'm going to show you two very basic ones. I'm going to look at the sales of my fictional ballpark items. So I'm going to grab sales right here. And I'm going to put that as the field that we're going to measure. Okay, and you see it put it down right here. And this is our total sales. We're going to break it down by item and by time. So let me take item right here and you can drag it over here or I can put it right up here into rows. Those will be my rows. And that's how many we've sold total of each of the items. Fine, that's really easy. And then let's take date and we'll put that here in columns to spread it across. Now by default this unit by year, I don't want to do that. I only have three months of data. And so what I can do is I can click right here and I can choose a different time frame. I can go to quarter, but that's not going to help because I only have one quarter is worth of data. That's three months. I'm going to come down to week. Actually, let me go to day.  So that's no good. So I'm going to back up to week. And I've got a lot of numbers there, but what I want is a graph. And so to get that I'm going to come over here and click on this and tell it that I want a graph. And so we're seeing the information except it lost item. So I'm going to bring item and I'm going to put it back up into this graph to say this is a row for the data. And now I've got rows for sales by week for each of my items. That's great. I want to break it down one more by putting in the site, the place that it sold. And so I'm going to grab that. And I'm going to put it right over here. And now you see I've got it broken down by the item that is sold and the different sites. And I'm going to color the sites and all I got to do to that is I'm going to grab site and drag it onto color. Now I've got two different colors for my sites. And this makes it a lot easier to tell what's going on. And in fact, there's some other cool stuff you can do.  And I can tell it for instance to put an average line through everything. So I'll just drag this over here and say now we have the average for each line. That's good. And I can even do forecasting. Let me get a little bit of a forecast right here. I'll drag this on. And if you go over here, I can get this out of the way for a second. Now I have a forecast for the next few weeks. And that's a really convenient quick and easy thing. And again, for some organizations, that might be all that they really need. And so what I'm showing you here is the absolute basic operation of Tableau which allows you to do an incredible range of visualizations and manipulate the data and create interactive dashboards. There's so much to it and we'll show that in another course. But for right now, I want to show you one last thing about Tableau Public and that is saving the files. So now when I come here and save it, it's going to ask me to sign into Tableau Public. Now I sign in and ask me how I want to save this same name as the video. There we go. And I'm going to hit save. And then that opens up a web browser. And since I'm already logged into my account, see, here's my account, my profile. Here's the page that I created. And it's got everything I need there. I'm going to edit just a few details. I'm going to say, for instance, I'm going to leave its name like that. I could put more of a description in there if I wanted. I can allow people to download the workbook and its data. I'm going to leave that there so you can download it if you need to. If I had more than one tab, I would do this thing that says show the different sheets as tabs. Hit save. And there's my data set. And also it's published online and people can now find it. And so what you have here is an incredible tool for creating interactive visualizations. You can create them with dropdown menus and you can rearrange things and you can make an entire dashboard. It's a fabulous way of presenting information. And as I said before, I think that for some organizations this may be as much as they need to get really good useful information out of their data. And so I strongly recommend that you take some time to explore with Tableau either the paid desktop version or the public version and see what you can do to get some really compelling and insightful visualizations out of your work in data science.


Because we're going on the Fairy Terror Fireworks Parkourly Dessert Cruise. For the first time ever in our entire lives, we are doing a Fairy Tale Firework Dessert Cruise. And it's Mickey's very merry Christmas party. Which is like a complete bonus because I didn't even know until I was pulling in and she said are you here for the Christmas party? Yep. For the Christmas party. Am I at? No? This is gonna be great. Let's go do this. We're about to check in and you usually check in in the ticket and transportation and then you board the boat to go out 50 minutes before the fireworks go off and they offer all different types of desserts, alcoholic and non-alcoholic drinks. There's also some games that you can play on the cruise ship itself and then also they have Mickey Vision goggles to enhance the firework viewing. This is gonna be amazing. This was always one of our top to do list that we've never done so I'm so happy we get to check this off. I'll check in. Ooh. Yeah, you need your sparkly. What is this? It's a... Oh, those are your Mickey Vision fireworks. My Mickey Vision fireworks. Ah! This is so fun. Oh my goodness. If you look over at these lights right here. Yeah, I see them. No, no. Wait, guys, you want to see this? Can you tell on the left? Yes, you can. Do you see those Mickey's over in the corner there? I'll pull away. See. Isn't that awesome, guys? I'm going towards the boat at 9 o'clock tonight and setting sail at 9.15. There is a restroom on Boyboy's Barricade. It's limited so you do buy it. It's only on the right side, I believe. I was so worried about that. I'm like, one's if you have to go to the bathroom. Yeah, but I didn't know that they have restrooms on board. It's only one. That's why we recommend going before. Okay, make sure you go to the bathroom beforehand. I didn't know. Thank you. Thank you. Look, it's your flashing. Yes, yes, I am. I actually just love... Seeing Mickey's over there. It's backwards. No, but if you look at me... Yeah? You can see them. No, I can't. You can't see? I can't see the Mickey's. I can see the Mickey's on both of you. On me? On both of you. I don't see the Mickey's on you. You don't? Well, you gotta put the thing on you. You see them without that? No, Mickey's. Oh, wait. That's not good. I'm just seeing Mickey's. You're just seeing Mickey's.  And look at this. We got popcorn, butter popcorn, some more butter popcorn, celery carrots, and I'm gonna assume ranch. Ooh, this is cheddar popcorn? That don't look like cheddar popcorn. No, that is cheddar. Maybe it is cheddar popcorn. I don't know. It says cheddar popcorn. Ooh, it's caramel popcorn. Caramel popcorn. That's what I was wondering. Some pretzels and some M&Ms, marshmallows, some pretzels. Very nice. Wait, yes. Fun fact here. Veronica likes hummus. I do eat something else besides mac and cheese on the daily. Yes. I do love hummus for some reason, and then made out of chickpeas. Chickpeas, and also, I didn't point it out, but there is the hummus celery carrots, not only just a ranch. I'm not eating the veggies. I'm licking the hummus on. Oh, wow. They have these things, and I'm pretty sure they're supposed to light up, but I think it's too bright in here. So, ugh. Where are you going? No. It's working. Look at that. It's really just a miracle. It is. It looks very nice. Now, I noticed that it's actually all of them that are working. Come out here and entertain me if I may. I have some odd abilities, and I'd like to share one of them with you. Are you a reader? I do it. Could you pick a book for me? How you doing? I'm good, how are you? I'm doing all right. I'm doing all right. Let's go over here. What's your name, fella? Ready to take a book? Friends got a book? Nothing. Hey, who is lovely lady in here? Hi. Hi, how are you? Just a lovely lady here. How are you? I want you to open that book. What kind of book did you get? The Rod Shephol Market. I don't want you to find the small... Veronica. Rod, it's a beautiful name. Where are you from? Orlando. We're a traveler. Getting out of town. You know what? You take the book. We got on the top. Top of the book. Somewhere in the middle of the book. You open your book anywhere you like. No, you don't take it home. People from Orlando think they can take anything they get. Open the book and go to the bottom of some page. Alright, look at the bottom line for me there. I'm not feeling anything on the bottom line. Go second to the bottom line. Right there, you look at the second to the bottom line. Is there a big word in that? Is there a big long word? Yep.  Okay, this guy is... Yes. Can I have two? One for my wife. Sorry. The next one. Oh, boy, he's writing something down. Good thing to you. One, eight, three, L1. My license plate number. What?  Don't do this to him. Really? No. It's close. The dictionary. Go to page 183. Go to the left column in the first word. 183, left column. What? What was your word? Lumberjack. What's the word? Lumberjack. Wow, that was good. We've got some amazing entertainment happening, but they're also walking around with... I believe this is champagne. We've also been told, once we get on the boat, there is a full service bar. Yeah, there is a full service boat. I got two and poured them together. Where did you get it? They're going around handing them out. And you asked for two? Yes. I got Shane's third of a button. Well, I asked for four. I gave you one, drank one, and then poured two together. Yeah. It's time to board the boats. Yeah. Who are we going on? What boat? I don't know yet. Oh, we've got to find out. Let me put my binoculars up. Look at these balloons they got, too. Yes, Mary Lou's bringing the booze. That's a good one. One's coming in and we're departing on the other. This is really, really, really neat. Wait, I was calling it Fowler. It's Potter. One of the fairy tale fireworks, a sparkling dessert cruise. Are you guys ready to set sail? Talking to us? We have arrived on the boat and we have found the bar. And that is a cool thing. Yep. I'm going to try the firecracker fish. Ooh. They have mixed drinks and also whole beer. A lot of rum. Yeah. The grand finale is one of the drinks and then they have the firecracker fish plus they have yingling, longboard, Heineken, Michelob ultra, and the different wines. Oh, you don't feel this? No. Very fancy. You already paid for it. Yes. Straight up, yeah. For the non-octaholic drinks they do have the firework punch and the liquid firecracker for the kiddos. Right here, all self-service along with coffee and other great stuff. I'm going to guess hot cocoa as well because tonight the cold front is on. I like it. It's a little hard to read but they have sparkling night sky, blue velvet whoopie pies, red white and blue cupcakes, cherry bomb pie tarts, skyrocket sugar cookies, firework cheesecake tarts, Roman candle eclairs and then also mango pina colada paza. I don't know what that means. Oh, well, thank you. But everything looks very good, doesn't it? Look at all these desserts. I'm going to guess this is a cheesecake tart.  Those are the whoopie pies and they also have like a little cheese for it up here. What are you eating? A cheese curd. Oh, very nice. They also have some hot desserts like this brownie barge. Warm s'more brownie skillet with caramel sauce. That looks mighty good. Oh, yes. Is it really, really hot? I can see the steam. We're going to make our way upstairs because there was more offerings on the second level. Isn't that cool? And then we're probably going to try to play a little bit of the scavenger hunt, but I don't want to show off where all the hidden Mickey's are because in case you guys ever plan on doing this, you don't want to spoil the fun. Wow, look at this up here. Oh, good. They have more of this stinky cheese. Oh, yes. Do you like the cheese? I love the stinky cheese. Yeah. Remember the cheese that I got that you made in here? This is going to be good. Oh, yes. Very good. So I haven't tried many desserts, but I have tried the eclairs so far, and I love them, but the only thing is is they look like peanuts. Oh, I know. Don't they? I hope these... These are eclairs, aren't these guys? Eclairs, right? The hot dog. It looks like a peanut. I mean, it's delicious, but wow. It's got a flashing red light. That is pretty talented. Send it out on YouTube. Send it around the world. They'll get all know. Look at that. They do have a scavenger hunt where you have to find hidden Mickey's all throughout the boat, and they have nine of them. And like I said, I'm not going to show you all where the hidden Mickey's are, but I plan on finding them. I do. I will find them. Excellent. Well, looky there. There's one of those hidden Mickey's. Can you see it? Give them a little help. Oh! Hidden Mickey. Hidden Mickey. Now that's very... Oh my lord. Don't do that.  It's showing stuff on your face. Yes. Okay. Show off the bathrooms a little bit.  It's heated in here. Hey! Don't lock me in here. Regular bathroom. Regular bathroom. It is heated in here, though. Why does she keep locking me in the bathrooms? Wow. Look at this view. This is where we're going to be watching the fireworks from. I am so excited. Oh boy, I see a monorail coming too. We went back up for more drinks. And these drinks are endless, right? Oh, yes. Oh wow, fantastic. But Veronica's favorite is the firecracker fix. We got a captain topper. Oh, a captain topper. Thanks, captain. Haha. This is the s'more. So for our fireworks viewing we chose the second level and all the way up front near the captain because look at this view. Yeah, I get the stars. Yeah, I kind of know. I mean, they do pick up the stars but you can't beat this right here. I mean, this is amazing. Right in the Titanic. Yes, what a view. Well guys, this is the spot. Let's put our little uh, Mickey vision on to see what we can see. You guys ready? Hold on, here it comes. I don't see nothing. I think fire. Yes. Oh. Oh, it's starting. It's actually centered above the castle. What can you say about it? And the view was, I was a little I was a little hesitant with the view actually until we got to see like what it was. And then I was just like, oh this makes so much sense. The Mickey vision. Yes, I love the Mickey vision. I don't know how it turned out on film. I did try putting it up to the lens but we'll have to see when we edit it and I guess that'll tell how much you guys see. I had a great time. I'll take the whole stack. Have a wonderful night. Oh wait. Oh, look at this. And look at that. A fairytale fireworks. It's so pretty. It's a crispy treat. I'm running back to the boat because we accidentally took the fairytale cruise flashlight that you get for the hidden Mickey scavenger hunt and I'm not about that life. Well, I think that's it. That was wonderful. Very magical. I absolutely loved it. It was amazing. Thank you Helene for inviting us out. Yes, we had such a great time. Probably one of the better fireworks views I've ever had. It's our first like dessert party cruise anything. We never did anything like this. So it was pretty amazing. Make sure you check it out if you want to see about reservations. It's on the phone number. It's out on the My Disney Experience app. And level like you live. What do you have to say? I really recommend it for like a birthday or an anniversary or something like that. Yeah, it's special. It's really cute. Yes, and try to do it on a special night. Because there's no additional cost. It's always one flat rate whether it's happily ever after, holiday wishes, Mickey's not so scary Halloween party. It doesn't matter. It's always one flat rate. I loved it. I had a great time. Live the life you love. So love the life you live. So live the life you love. Toodaloo! I don't want to sit with you. I didn't want you to sit in my room anyway. Oh, thank you. No more red light. No more red light. He's looking like what? Nah.


One of the basic needs of woodworking is to drill holes. In my previous shorts, I recreated some earlier forms of drills. The punk drill and the wood auger. Lastly, the hand brace. They started to appear in the 15th century. First ones started out as mostly wood, then were later reinforced with metal, and then, even later, eventually made entirely out of metal. They include a built-in crank makes it easier to use. Adding the simple crank mechanism takes a drill to the next level. For both the punk drill and auger head to stop periodically, either to rewind or to adjust your grip, the brace allows a continuous single motion, which helps prevent the bit from ever getting stuck, allowing you to continuously drill. This small change of design easily makes this drill one of the most efficient. But how much better are they? Next up, I'll put all three to the test and see which is going to drill a hole faster and easiest.


Live from San Francisco, it's theCUBE. Covering Google Cloud Next 2018. Brought to you by Google Cloud and its ecosystem partners. Okay, welcome back everyone. This is theCUBE live in San Francisco, coverage of Google Cloud Next 18. I'm John Furrier with Jeff Frick. Day three of three days of coverage, kind of getting day three going here. Our next guest this year has to be Director of Product Management, Google Cloud has the luxury and great job of managing big table, big query, I'm sorry, big query.  Welcome back to theCUBE, good to see you. Thank you. So you guys had a great demo yesterday. I want to get your thoughts on that. I want to explore some of the machine learning things that you guys announced. But first I want to get perspective of the show for you guys. What's going on with you guys at the show here? What are some of the big announcements? What's happening? A lot of different announcements across the board. So I'm responsible for data analytics on the Google Cloud. One of our key products is Google BigQuery. Large scale, cloud scale data warehouse. A lot of customers using it for bringing all their enterprise data into the data warehouse, analyzing it at scale. You can do petabyte scale queries in seconds. So that's the kind of scale we provide. So a lot of momentum on that. We announced a lot of things, a lot of enhancements within that. For example, one of the things we announced was we have a new experience, new UI for BigQuery. Now you can literally do the query, as I was saying, a petabyte scale query or some, any queries that you want. And with one click, you can go into Data Studio, which is our BI tool that's available. Or you can go in Sheets and then from there, quickly go ahead and fire up a connector, connect to BigQuery, get the data in Sheets, and do analysis. So ease of use is a focus? Ease of ease is a major focus for us. As we are growing, we want to make sure everybody in the organization can get access to their data, analyze it. That was one, one of the things which is pretty unique to BigQuery, which is there is a real-time collection of information. So you can, there are customers that are actually collecting real-time data from Clickstream, for example, on their websites or other places and moving it directly into BigQuery and analyzing it. Example, in-game analytics. If in-game you're actually playing games and you're going to collect those events and do real-time analysis, you can literally put it into BigQuery at scale and do that. So a lot of customers using BigQuery at different levels. We also announced clustering that allows you to reduce the cost, improve efficiency, and make queries almost 2x faster for us. So a lot of announcements other than the machine learning. Well, the one thing I saw in demo I thought was, I mean, it was machine learning, so that's the hot topic here, obviously, is you don't have to move the data. And this is something that we've been covering. Go back to the Hadoop days back when we first started doing theCUBE. Data pipeline, all the complexities involved in moving the data. And at the scale of the size of the data, all this wrangling was going on just to get some machine learning in. So talk about that new feature where you guys are doing it inside BigQuery. So I think that's important. Take a minute to explain that. Yeah, so when we were talking to our customers, one of the biggest challenges they were facing with machine learning in general, or a couple of them were, one, every time you want to do machine learning, you have to take data from your core data warehouse. Like in BigQuery, you have petabytes of scale data sets, terabytes of data sets. Now, if you want to do machine learning on any portion of it, you take it out of BigQuery, move into some machine learning engine, ML engine, auto-ML, anything, then you realize, oh, I missed some of the data that I needed. I go back, then again take the data, move it, and you had to go back and forth through much time. There are analysis, I think, that different organizations have done, 80% of the time, as the data scientists say, they spend into moving of data, wrangling data, and all of them. So that was one big problem. The second big challenge we were hearing was skill set gap. There are just not that many PhD data scientists in the industry. How do we solve that problem? So what we said is, first problem, how do we solve it? Why do people have to move data to the machine learning engines? Why can't I take the machine learning capability, move it inside where the data is, so bring machine learning closer to data rather than data closer to machine learning? So that's what BigQuery ML is. It's an ability to run regression-like models inside the data warehouse itself in BigQuery so that you can do that. The second we said, the interface can't be complex. Our audience has already no SQL, they're already analyzing data. These folks, business analysts that are using BigQuery are the experts in the data. So what we said is, use your standard SQL, write two lines of code, create model, type of the model you want to run, give us the data, we will just run the machine learning model on the back end, and you can do predictions pretty easily. So that's what we are doing with that. So Sidir, I'd love to hear that, you were driven by that by your customers, because one of the things we talk about all the time is democratization. If you want innovation, you got to democratize access to the data, and then you got to democratize access to the tools to actually do stuff with the data, that goes way beyond just the hardcore data scientists in the organization. And that's really what you're trying to enable the customers to be able to do. Absolutely, if you look at it, if you just go on LinkedIn and search for data analysts versus data scientists, there is 100x more analysts in the industry. And our thing was how do we empower these analysts that understand the data, they're familiar with SQL, to go ahead and do data science. Now we realize they're not going to be expert machine learning folks who understand all the intricacies of how the gradient descent works, all that, that's not their skill set. So our thing was reduce the complexity, make it very simple for them to use the framework, like just use SQL, and we take care of the internal hyper tuning, the complexity of it, model selection. We try to do that internally within the technology, and they just get a simple interface for that. So it's really empowering the SQL analysts within organizations to do machine learning with very little to no knowledge of machine learning. Right. Talk about the history of BigQuery. Where did it come from? I mean, Google has this DNA of they do it internally for themselves. It's a tough customer. In Cloud Spanner, we had the product manager run for Cloud Spanner, Dipty, she was like amazing. Like, okay, and it baked internally. Did that have the same BigQuery? Take a minute to talk about that because you're now making consumable for enterprise customers. It's not a just here's BigQuery. Talk about the origination, how it started, why and how you guys use it internally. So BigQuery internally is called Dremel. There's a paper on Dremel available, I think in 2012 or something we published it. Dremel has been used internally for analytics across Google. So if you think about Spanner being used for transaction management in the company across all areas, BigQuery or Dremel internally is what we use for all large scale data analytics within Google. So the whole company runs on, analyzes data with it. So our thing was how do we take this capability that we're driving, and imagine like when you have seven products that are more than billion active users, the amount of data that gets generated, the insights that we're giving in maps and all the different places, none of those things are first analyzed in Dremel internally, and we're making it available. So our thing was how do we take that capability that's there internally, and make it available to all enterprises? As Sundar was saying yesterday, our goal is to empower all our customers to go ahead and do more. So this is a way of taking the piece of technology that's powered Google for a while and also make it available to enterprise. Hardened and tested, it's not like it's vaporware. Yeah, it's not. I mean this is what I think is important about this show this year, if you look at it, you guys have done a really good job of taking the big guns of Google, the big stuff, and not try to just say, we're Google, you could be like Google. You've taken it and you've kind of made it consumable. This has been a big focus. Explain the mindset behind the product management. Absolutely, there's actually, one of the key things Google is good at doing is taking what's there internally used, but also the research part of it. Actually, Corina Cortez, who is head of our AI side, who does a lot of research and SQL-based machine learning. So again, the BigQuery ML is nothing new. Like, we internally have a research team that has been developing it for a few years. We have been using it internally for running all these models and all. And so what we were able to do is bring product management from our side, was like, hey, this is really a problem that we're facing, moving data, skill set gap, and then we were like, research team was already enabling it, and then we had an engineering team which was pretty strong. We were like, okay, let's bring all three triads together and go ahead and make sure we provide a real value to our customers with all of that we are doing. So that's how it came to light. So, get your take. Early days, like when there was the early Google search appliance, I just picked that up and that was ancient, ancient ago. But one of the digs was, right, it didn't work as well in the enterprise per se because you just didn't have the same amount of data when you applied that type of technique to a Google flow of data and a Google flow of queries. So how's that evolved over time? Because you guys, like you said, seven applications with a billion users, most enterprises don't have that. So how do they get the same type of performance if they don't have the same kind of throughput to build the models and to get that data? How's that kind of evolved? So this is why I think thinking about, when we think about scale, we think about scaling up and scaling down, right? We have customers who are using BigQuery with few terabytes of data. Not every customer has petabyte scale, but what we are also noticing is these same customers, when they see value in data, they collect more. I will give you a real example. Zuleli, one of our customers, I used to be there before. So when they started doing real-time data collection for doing real-time analytics, they were collecting like 50 million events a day. Within 18 months, they started collecting 5 billion a day, 100x improvement. And the reason is they started seeing value. They could take this real-time data, analyze it, make some real-time experiences possible on their website and all. With all of that, they were able to go ahead and get real value for their customers, drive growth. So when customers see that kind of a value, they collect more data. So what I would say is, yes, a lot of customers start small, but they all have an aspiration to have lots of data, leverage that to create operational efficiency as well as growth. And so as they start doing that, I think they will need infrastructure that can scale down and up all the way. And I think that's what we are focusing on, providing that. You guys look at the possibility, and I've seen some examples where customers are just like, they're shell-shocked. And you're almost too good, right? I mean, it's like, we've been doing generally a large scale, I put this data warehouse like 10 years ago, like, what are you talking about? I mean, there's a reality of, we've been buying IT, Enterprise has been buying IT, and in comes Google, the gunslinger, saying, hey man, you can do all this stuff. There's a little bit of a shell-shock factor for some IT people. Some engineering organizations get it right away. How are you guys dealing with this as you make it consumable? There's probably a lot of education as a product manager. Do you see, is that something that you think about? Is that something you guys talk about? So I think I actually see a difference in how customers, what customers need, enterprise customers versus cloud-native companies. As you said, cloud-native companies starting new, starting fresh, so it's a very different set of requirement. Enterprise customers thinking about scale, thinking about security, and how do you do that? So BigQuery is a highly secure data warehouse. The other thing BigQuery has is, it's a completely serverless platform. So we take care of the security, which we encrypt all the data at rest and when it's moving. The key thing is, when we share what is possible and how easy it is to manage and how fast people can start analyzing, you can bring the data. You can actually get started with BigQuery in minutes. Like you just bring your data in and start analyzing it. You don't have to worry about how many machines do I need? How do I provision it? How many servers do I need? So enterprises, when they look at the- So cloud-native ready. Yeah. All right, so take a minute to explain big table versus, I mean big table versus big query. Yes. What's the difference between the two? One's a data warehouse and the other one is a system for managing data. What's the difference between- So it's a no-sequel system. So I will, the simple example, I will give you a real example how customers use it, right? BigQuery is great for large scale analytics, people who want to take like petabyte scale data or terabyte scale data and analyze historical patterns, all of that and do complex analysis. You want to do machine learning model creation, you can do that. What big table is great at is, once you have pre-aggregated data, you want to go ahead and really fast serving. If you have a website, I don't expect you to run a website and back it with the BigQuery. It's not built for that. Versus big table is exactly for that scenario. So for example, you have millions of people coming on the website. They want to see some key metrics that have been pre-created, ready to go. You go to big table and that can actually do high performance, high throughput. I have last I read on that was like almost 10,000 requests per second on per node and you can just create as many as you want. So you can really create- Auto scale and all kinds of stuff there. Exactly. And that's good for unstructured data as well. Yes, exactly. Okay, so structured data, SQL, basically large scale, big table for real time, new kinds of data, different data types. What else do you have in the bag of goodies in there that you're working on? The one big thing that we also announced with this week was GIS capability within BigQuery. GIS has geographical information. Like everything today is location based. Latitude, latitude. Our customers were telling us really difficult to analyze it, right? Like, I want to know example would be, we are here, I want to know how many food restaurants are in two mile radius of air, which ones are those? How many should we create the next one here or not? Those kind of analysis, really difficult. So we partnered with Earth Engine, Earth Engine team within Google with Maps. And then what we are launching is ability to do geospatial analysis within BigQuery. Additionally, along with that, we also have a visualization tool that we launched this week. So folks who haven't seen that should go check that out. One great example I will give you is GeoTab. Their CEO is here, Neil. He was showing a demo in one of the sessions and he was talking about how he was able to transform his business. So I will give you an example. GeoTab is basically into vehicle tracking. So they have these sensors that track different things with vehicles. And then with, and they store everything in BigQuery, collect all of that and all. And his thing was with BigQuery ML and our GIS capability, what he is now able to do is create models that can predict what intersections in a city when it's snowing are going to be dangerous. And for small, for smart cities, he can now recommend to cities where and how to invest in these kind of scenarios. Completely transformating his business because his business was not smart cities. His business was vehicle tracking and all. He's like, but with these capabilities, they're transforming what they were doing. And new discoveries. New discoveries, solving new problems. It's amazing. Just dig it a little bit too. You know, the fact that you've got these seven billion active user apps that you can leverage, you know, specific functionality or goals or objectives or priorities in those groups and now apply those, pull that data, pull that knowledge, pull those use cases into a completely different application on the enterprise. I mean, is that an active process to people query? But how does that happen? No, we don't, as a customer come, as a customer, they're completely different, right? Our focus in Google Cloud is primarily enabling enterprises to collect their data, process their data, innovate on their data. We don't bring in like the Google side of it at all. Like that's that completely different area that way. So we basically, enterprises, all their data stays within their environment. They basically, we don't touch it, we don't get to access it at all. And they don't know. I didn't mean that. I meant, you know, like say maps, for instance. It's interesting to see how maps has evolved over all these years. Every time you open it up in its directions, oh, now it's better directions. Oh, now it's got gas stations. Oh, now it's where the, and it triggered because you said the restaurants that are close by. So it's kind of adding value to the core app on that side. And as you just said, now geolocation can be used on the enterprise side and lots of different things. So that's where I meant where that kind of connection in terms of the value of what can I do with geolocation? Exactly. So like, that's exactly what we did. With Earth Engine, we had a lot of learnings on geospatial analysis. And our thing was, how do you make it easy for our enterprise customers to do that? We've partnered with them closely and we said, okay, here are the core pieces of things we can add in BigQuery that will allow you to do better geospatial analysis, visualize it. One of the big challenges is lat-longs. I don't think they're that friendly with analysts, like, oh, numbers and all that. So we actually built into a UI visualization tool that allows you to just fire a query and see visually on a map where things are, what the points look like. So just simplifying what analysts can do with all these. Thanks for coming on, really appreciate it. And congratulations on your success. Got a lot of great, big products there, hardened internally now, making consumable. It's clear here at Google Cloud, you guys are recognized that you were making it consumable, pre-existing proven technologies. So I want to give you guys props for that. Congratulations. Thank you, thanks a lot. Thanks for coming on this year. Thanks for coming on. It's theCUBE coverage here at Google Cloud, covered Google Next 2018. I'm John Furrier, Jeff Frick. Stay with us. All day, more coverage for day three. Stay with us after this short break.


BCSO Sunday service Mount Hope Free will Baptist Church eat the devil's corn. You'll True True a hundred percent Me the devil's corn. He'll choke on his cab. I like that. I'm gonna steal that I'm gonna say that it's corn, but at some point at some point I'm gonna use I'm gonna use this one Yeah, I'll use this one at some point captain corn finding crime in North Carolina I need you know what it corn what you do corn what should lead Sunday church service Pastor cornwood captain corn finding crime in North Carolina tractor driver helps end police chase See I'm telling you BCSO task force. That's what we need Finishing what I didn't finish yesterday Palmer says he was just out tilling his garden yesterday when this police chase came Roaring down his gravel drive you can handle the cross that right came by the fence We had a problem that many police cars aren't getting a donut truck, and they're not getting a ticket violator While most people would have run home to hunker down this retired law enforcement diver says that was never an option There's a guy with a tractor right there in the driveway. Yep. That's Palmer going after the driver on his tractor I was on t-bone put it in high gear and put it in high gear Pms up and This no mask where he wouldn't come in through watch us the driver veers right in a way and Palmer maneuvers to Police one police to tractor she passed here. He was trapped. There's no other way out There's nothing he could do to go back out, and I knew they were all behind me I just had that rodeo rodeo Emeritus you know going in without anywhere else to go the driver plowed into this pond and Deputy swarmed in the Kraken as far as his part Palmer says it was just the right thing to do Did you think I'm putting my life in danger not at all? And if everybody stood up what they had to do life would be a lot easier you sometimes you just That's right son. That's what I like to see Absolutely absolutely that's what I've been saying this whole damn time as man in this new house unbelievable. I Like that. That was awesome Dude, okay Everybody has told me this those glasses are so stylish. They're in style. Oh, where can I get glasses like that? What brand is this? These are 80s dad boomer glasses that I got from just at the Walmart eye doctor Okay, I don't know what has happened recently. I got these cuz they're funny. I Don't know what has happened in the last year or two not even that like it's like the last five years Everything goes in cycles.  Oh, that's lit people said that in the 90s, dude Like this is like actual like it's all old like if you look at go go look at a picture of your dad From the 80s and he probably looks like me except less handsome. I knew my dad was a Persian god nice Hi dad. Yo, okay public petition for BCSO rural task force police tractors No pixel BCSO rural task force Police tractors. We got to keep the farmers market safe. Okay There we go. Svintv mayor attempts to assassinate Cornwood I'm standing here. Oh This is what I see every time he does this original content Pogu chat everybody type Pogu original content This is a good game mortal combat was a good game the new one That was more combat, right? Yeah, Johnny cage. Okay Play it is good as fan with his glasses Hacker man full time This is so funny. I love this movie Hey, it's been I want to suggest a game for a one-off stream because you mentioned about doing one I think Far Cry 3 blood dragon would be a great playing a blood dragon. Thanks a good times. That's Mandel Peggy AT is this a game that I can beat in one night I'm thinking about doing some one-offs Some some games that I can beat in one night Excuse me Backwood, thank you for the prime, dude. It's DLC for Far Cry.  Huh An evil presence seeks to enslave what's left of humanity. I love this already actually it's standalone thing that can stop it Nobody threatens my planet Sergeant Rex power cold wait. This is something I would totally play. This is hilarious Who's part man? part machine and all American What I love this forever He's got the science.  I know you will Fire Janitors those are the real heroes I love everything about this Dude, I love it. I probably will play this how long is it 2013 two to four hours? Okay, so like eight hours That's good. I can do that in one night someday. I'll play this. I'll play this someday so never Finally got the boys framehunt protected only cost me 3k nice Nice there it is there Nice Apollo Yeah, this is from the charity stream that Maya did that is super cool, man That is super super cool Apollo. That's MTV spikes Spikes, okay Look at the lag and it's I think they delay a But from the other perspective this is gotta look so funny dude Spikes There's a delay love the world Oh also Here's another thing. I got stuck on this that kind of sucked, but I I I pressed this And it takes like I think a full second before it actually goes out I actually screwed this up there's a lot of times I do things like I screwed things up on purpose. I actually screwed this up But I told them like ten times I'm gonna spike a force just stumbles across the private meeting Wait, there's got 17 K views in just a moment. Okay. Sorry. This area is closed. You must step outside Okay, regular just just right there. It's good. Okay.  I'm having a private conversation PD is going through a new phase right now. We just got a calm down on the you know Running into the banks hopping trunks like doing the you know the stuff that can really get us in trouble because PD is going through a new phase right now and You know, there's obviously limitations and we can't go to SPS Dining back down a little bit same with me and then McLean and everyone and What did we come what did McLean do?


On Business News, the domestic burst against a standard 8 positive trading as the Allshare Index advanced by 61.0 or 0.1 percent to close at 46.965.48 against 46.904.48 recorded on Wednesday. The market capitalization also increased higher by 32.87 billion or 0.1 percent to close at 25.311 trillion from 25.279 trillion nara on Wednesday, which consequently means the month-to-date loss moderated to 0.09 percent while the year-to-date gain increased by 10 percent. The market gain was driven by price appreciation in large and medium-capitalized stock amongst which are MTN Nigeria, the first bank of Nigeria who owns FBNH, Okuma Oil and the Fidelity Bank. So you get notified about fresh news updates.