From theCUBE Studios in Palo Alto in Boston, connecting with thought leaders all around the world, this is a CUBE Conversation. Hi, but this is Dave Vellante and welcome to this special CUBE Conversation. As you know, I've been running a CXO series now for several weeks, really trying to understand how leaders are dealing and coping with the COVID-19 crisis. Today, we want to switch gears a little bit and talk not only about how leadership has sort of navigated through this crisis, but also start to imagine what it's going to look like coming out of it. I'm going to introduce you to a company that I've been talking about now for the last, well, six to nine months, company called OCTA. As you know from my previous breaking analysis, this is a company that not only is in the security business, they really kind of made their mark with identification management. But also really there's a data angle. Normally when you think about security, you think about, oh, security, it means less user flexibility. It means less value from the user standpoint. What OCTA has done really successfully is bring together both endpoint security as well as that data angle. And so the company's about $600 million in revenue. They got an $18 billion valuation, which may sound kind of rich at 30X revenue multiple, but as I've reported, the company is growing very rapidly. I've talked about the rule of 40. OCTA is really a rule of 50 type of company by that definition. And with me here to talk about the product side of things is Dya Jolly, who's the Chief Product Officer at OCTA. Dya, thanks so much for coming on theCUBE. I hope you're doing okay. How are things out in California? Things are going well. Good to meet you as well, Dave. I hope you're doing well as well. Yeah, we're hanging in there. The studios are rocking. theCUBE continues our daily reporting. I want to start with your role. You're relatively new to OCTA. You've got a really interesting background, particularly understanding endpoints. You were at Google, Google Home, Google Nest. You spent some time worrying about looking after Xbox. So you have a good understanding of what's going on in the marketplace, but talk about your role and how specifically you're bringing that to enterprise. So I joke about this. I say that I've done every kind of known product management imaginable to man at this point, done both hardware, down software. So dealt a lot with endpoints as you've talked about, dealt a lot with SaaS, dealt with consumer, dealt with enterprise, all over the place, companies of different sizes. So at OCTA, really my role as the Chief Product Officer is to be able to understand what our customers need. What are the challenges they're facing and not just the challenges they're facing today, but also what are the challenges that they'll face tomorrow that they don't even know about and then help build products to be able to overcome that, both with our engineering teams as well as with our sales engineering team so that we can take it to market. Now, my background is unique because I've seen so many identity being used in so many different ways across so many different use cases, whether it's enterprise or its consumer, that given that we covered both sides of the spectrum, I can bring that to bear. Yeah, so what I've reported previously is that you guys kind of made your mark with identification management, but in terms of both workforce but also customer identification management, which has been, I think, allowed you to be very, very successful. I want to bring up a chart and share something that I've shared a lot of data with our audience previously. So guys, if you could bring that up. So this is data from Enterprise Technology Research, our data partner, and for those who follow this program, you know we generally talk in two metrics. NetScore, which is a measure of spending momentum, and also MarketShare, which really isn't real MarketShare, but it's pervasiveness in the survey. And what you can see here is the latest April survey from over 1200 CIOs and IT practitioners and we're isolating on Okta and we brought it back to the July 15 survey. You see a couple of points here I want to make. One is it's up into the right. This is pervasiveness or MarketShare. So Okta in the market is doing very, very well. It's why the valuation is so high. What's driving the growth? And then you can see in the green a 55% NetScore, very, very strong. It's one of the leaders in security. But as I said, it's more than that. So, D, from a product standpoint, what is powering this momentum? Sure. So, as you well know, the world is working from home. What Okta does is it provides identity management that allows you to connect to any technology. And by any technology, it primarily means technology that's not just on-premise, like your applications on-premise, old school applications or infrastructure that's on-premise. But it also means technology that's in the cloud. So SaaS applications. Infrastructure that's in the cloud, et cetera. And on the other hand, it also allows companies to deploy applications where they can connect to their customers online. So as more and more of the world moves to work from home, you need to be able to securely and seamlessly allow your employees, your partners to be able to connect from their home to be able to do their work. And that's the foundation that we provide. Now, if you look at, we've heard a lot in the press about companies like Zoom, Slack, people that provide online collaboration and their usage has gone up. We're seeing similar trends across both Okta as well as the entire security industry in general, right? If you look at information recently, since COVID has started, phishing attacks have increased by 667%. And what we've seen in response is one of our products which is multi-factor authentication. We've experienced an 80% growth in usage. So really as COVID has pushed forward, there was a trend for people to be able to work remotely, for people to be able to access cloud apps. But as COVID has suddenly poured gas in the fire for that, we're seeing our customers reaching out to us a lot more, needing more support, and just the level of awareness and the level of interest rising. Let's talk about some of the trends that you guys see in the marketplace. And I'd like to better understand how that informs your product road map and decisions. Obviously there's cloud. You guys have made a really good mark in the cloud space with both your operating model, your pricing model, the modern static. The other is I referenced it upfront with data. Talk a lot about digital transformation, digital to us data. Of course, the third is security related to trust. We've talked a lot on theCUBE about how the perimeter is, there is no perimeter anymore. The queen has left her castle. And so what are the big trends that you see, the big waves that you're riding and how does that inform your product direction? Sure, so a few different things. I think number one, if you think about the way I phrase this is or the way I think about it as the following. Any big technological trend you see today, right? Whether it's the move to the cloud, whether it's mobile, whether it's artificial intelligence, whether you think about neural nets, et cetera, or it's a personalized consumer experience. All of that fundamentally depends on identity. So the most important, so from being an identity provider, the most important thing for us is to be able to build something that is flexible enough, that is broad enough that it is able to span multiple use cases, right? So we've taken from a product perspective that means we can follow two philosophies. We can either be trying to go solve each of these pain points one by one, or we can actually try to build a platform that is more open, that's more extensible and that's more flexible so that we can solve many of these use cases, right? And not only can we solve it because it's extensible, our customers can customize it, they can build on top of it, our partners can build on top of it. So that's one thing, that's one product philosophy that we hold dear. And so we have the Octite Identity Cloud which is a platform that provides both workforce identity as well as customer identity using the same underlying components, the same multi-factor authentication we use for workforce, we package up as an SDK so that our customer identity customers can use it. So that's number one. The second thing as you rightfully mention is data, you can't really secure identity without data. So we have a lot of data across our customers. We know when the user's logging in, we know what device they're logging in from, we know the security posture of the device, we know where they're logging in from, we know their different behaviors, what apps they go into or during what time of the day, et cetera. So being able to harness all this data to say, hey, and apply ML model script to say, hey, is the user secure or not is a very, very core foundation of our product. So for example, we have what we call risk-based authentication. You can not only do things like, hey, this user seems to be logging on from a location they've never logged on from, but you could even do things like, well, you may not want to stop the user, they may be traveling. So instead of just asking them for a password, you ask them for a multi-factor, right? So that's the other piece of it. And in many ways, data and security and usability are three legs of a triangle. The more data you have, the more you can allow a user, the more security you can provide a user without creating more friction. So it's sometimes helpful for the audience to understand a company in a competitive context and the landscape. So the obvious platform out there is Active Directory, now Microsoft with Azure Active Directory, really trying to, and that's really been on their platforms, but with APIs, Microsoft has got thumbs in every pie. How does Okta differentiate from some of the other traditional platforms that are out there? And what gives you confidence that it can continue to do so going forward post COVID? That's a fantastic question, Dave. So I think we divide, if you think about our competitors, on the workforce side, we've got Microsoft and a couple of other competitors. And on the customer identity side, really it's a bill versus buy story, right? Most companies build customer identity internally. So let's take workforce first. Microsoft is the dominant player there. They've got Active Directory, they've now got Azure Active Directory. From a Microsoft perspective, I think Microsoft is always been great at building products or building technology that interconnected product. The world is going to more, there's more and more technology proliferation in the world. And the way we differentiate is by becoming a neutral and independent platform.  We connect just as well with O365 as we connect with Salesforce as we connect with AWS, right? And that has been our core philosophy. And not only is that a philosophy for other vendors, it's a philosophy for ourselves as well. We have multi-factor authentication. So do many other providers like Duo. If you want to use ours, great. If you don't want to use ours with our platform, go use the one that's best for your technology. And I think what we've always believed in from a product perspective is this independence, this neutrality, this ability to plug and play any technology you want into a platform to be able to do what you want and the technology that's best for your business's needs. So what's interesting, what you said about the sort of make versus buy, that's particularly relevant for the customer identification management because let's say I'm buying from Amazon, I've got Amazon, they know who I am. But if I understand it correctly, your customers now are able to look across brands, maybe cohort selling, maybe make specific offers, analyze the data, that's an advantage that you bring that maybe do it yourself doesn't bring. Maybe talk about that a little bit. Sure. So really if you think about a bill versus buy, even 10 years ago, life used to be relatively simple.  You weren't really using, you didn't have multiple channels, you didn't have multiple devices as prevalent, you didn't have multiple apps in a lot of cases connected to each other, right? And in that day and age, password was fairly secure, you weren't doing a lot of personalization with the user data or had a lot of sensitive user data. So building a customer identity solution, having your customer, managing your customer's identity yourself was fairly easy. Now it's becoming more and more hard. Number one, I just talked about the phishing attacks, they're equal number of attacks on the customer identity side, right? So how do you actually secure this identity? How do you actually use things like multi-factor authentication? How do you keep up with all the latest in multi-factor authentication, touch ID, face ID, et cetera? That's one. The second thing we provide a scale for a number of companies, we also provide the ability to scale dramatically, which scaling identity and being able to authenticate someone and keep someone authenticated in real time is actually a very big challenge as you get to more and more scale. And then the last thing that you mentioned is this ability, we provide a single view of the user, which is super, super powerful, because now if you think about one of our customers, Albertsons, they have multiple different apps, they have multiple different digital experiences. They don't have a siloed view of their customer across all these experiences. You have one identity for your customer, that customer user, that one identity to log on to all your digital experiences across all channels and we're able to bring that data back together.  That's, so that makes a lot of sense. I went into the ETR platform to get our data partner and I looked at which industries are really showing momentum. Remember this survey folks was run right in the heart of the COVID-19 pandemic from mid-March to mid-April. So it's a good current data point and there were four that stood out, large companies, healthcare and pharma, Telco, which of course is this work from home thing and then consumer. The example that you just gave from Albertsons is really sort of around that consumer. There are a lot of industries that obviously been hit, airlines, restaurants, hospitality, but these four really stood out as growth areas despite the COVID-19 pandemic. I want to ask you about Octane.  Anything product specific that came out of that that our audience should know about? I mean, I'm interested in Access Gateway. I know that wasn't necessarily a new announcement, Cloud Gateway, what were the highlights of some of those things from a product stand? Yeah, of course. So we made a very difficult decision to pivot Octane virtually. We did this because a number of our customers, given what they're facing with the COVID pandemic, wanted to hear more around news, around what our product launches are, how they could use this, et cetera. And really I'd say there are three key product launches that I want to highlight here. We had a number of different announcements and it was a very successful conference. But the three that are the most relevant here. One is we've always talked about being a platform and we've set this for the past four to five years, I think. But over the last year and going into the next couple of years, we're investing very, very heavily in making our platform even more powerful, even more extensible, even more customizable so that it can go across the scenarios that you've described, right? Which is whether you're on-prem with Octax's gateway or you're in the cloud or you're in some kind of hybrid environment or you're using some mix and match or work from home, people in the office, et cetera. So really what we did this year over the last year was deepen our platform footprint. And we started releasing the core components available in a platform, which we call platform services. So we have six components. We were directories that is customizable and flexible so you can build your own schemas, et cetera. And you can store users, apps, information related to them. We have an integration platform that we've made available at a deep level where our customers can use SDKs, tools, et cetera to be able to integrate with Octa. We have a data platform, which we've talked a lot about. And then we released three new platform services. And one was what we call Octa Identity Engine. We talked about this last year and this year we talked about it last year from a customer identity perspective. This year we broaden it to our workforce identity. But also what that does is it allows you a lot more flexibility for situations like we're in, right? It allows you flexibility to define security policies at the per app level. So you could decide, hey, for my email, I don't want my customers to have to use a multi-factor authentication, but for Salesforce, I would definitely want them to use a multi-factor authentication if they're not in the office. It also allows you to have a lot more flexible factor recovery. So for example, if you forgot your password, one of the biggest pain points of COVID has been the number of help desk costs. I've been rising through the roof. The phone calls are ringing nonstop, right? And one of the biggest reasons for help desk costs is, oh, I can't log in. I got logged out. I either lost a factor or I forgot my password, so it helps with that. So that's one set of announcements. The second set of announcements was we launched a brand new devices platform. And personally, this is my personal favorite, but really what the devices platform allows you to do is the feature in it that we launched is called FastPass. And what FastPass allows you to do is it actually takes password list to the next level.  So now imagine if you're on a Mac or a iOS device or an Android or a Windows device, just being able to face match into your iOS or being able to touch ID into your Windows Hello and you're automatically logged into Okta, right? That is, and the way we do that is we have this client across all these operating systems that can really understand the security posture of the device. It can understand if the device is managed, if it's safe, if it's jailbroken, if it's unmanaged, it can also connect with multiple signals on the device. So if you have an EDR or an MDM vendor, we can ingest those signals and what they think of the risk. We can also ingest signals directly from apps. If apps think like G Suite and Salesforce actually track user behavior at a certain risk, they can pass those signals to us. And then we can make a decision on, hey, we should allow the user to authenticate directly into Okta because they've authenticated into their device. We can make a decision that says, no, let's ask them to step up with a multi-factor authentication. Or we can say, no, this is too risky. Let's deny access. And all of this is configurable by the IT admin. They can decide the risk levels they're comfortable with. They can decide the different risk levels by different apps. So that was another major announcement. And then, and as a product person, you rarely ever get the chance to actually increase security and usability at one time, which is why it's my favorite. You increase both security and usability together. Now, the last one was a workflows engine. We call it workflows lifecycle management. And we, it's really, we launched a graphical no-code user interface. Identity is so important, so many business processes for our customers. There's so many business processes built on identity. For example, if someone joins your company, you usually either have a script that allows them access to the applications they need to, or you actually have an IT admin sitting in there trying to manually provide access. Or when they leave, right? What workflows lifecycle management or lifecycle management workflows allows you to do, is it actually allows you to provide, it actually provides you with a no-code graphical user interface where you can build all these flows. So now you don't need someone that knows coding. You can even have a business unit. So for example, if I, for me in the product, for the product org, I can have someone say, hey, build a business process. Similarly, it's something you would build in sort of like an iPad. And allow everyone that comes in to be able to have access to Figma because we use Figma a lot, right? Those are the kinds of things you can do and it's super powerful. And it takes the ability of our already existing lifecycle management product to the next level. Well, thank you for that summary, Dya. So I want to kind of close with, I mean, those of you have been following theCUBE for a while. I think there's some similarities between Okta and ServiceNow. They're obvious differences, but we started following ServiceNow pre-IPO was less than a hundred million dollar company. And we've seen that company build out as a platform company. And that's really what Okta is doing here. We're talking about a total available market that's probably north of 50 billion. So the question I have here is, you know what Frederick and Todd started 11 years ago, playing on the dynamics coming out of the financial crisis then got us to where we are today. Now you've got the challenge of you've achieved, reached escape velocity. Now you've got this massive growth opportunity in front of you. How do you see the product portfolio evolving, expanding? And I'm also interested in post COVID-19, you know, no whiteboards, no face to face contact, at least not for a while and how you're kind of managing through that. But how can we expect the product portfolio to expand over time? What can you share with us? Sure, let me answer the question on the product portfolio. So one of the, given how pervasive identity has become and given how not just broad, but at the same time deep it is, there are multiple different places our product portfolio can evolve to and a number of different places we're thinking about, right? So one, as you mentioned, today we play in workforce identity and customer identity. But we haven't even begun to talk about how we might play in consumer identity, right?  So often an employee is not using their identity to lock the sales force and you have an attack on a company and often an employee is actually logging into their Gmail, their personal Gmail or their personal or some personal website, their bank and their credential get compromised and they're using the same pass for the product. So the more we protect consumers, the more we can directly protect both enterprises from an employee as well as a customer perspective. Obviously we're an enterprise company, so it doesn't mean that we are going to go direct to consumer but there are ways to make employees more secure by with a direct to consumer offering it. So that's one. The second thing is managing identities. I think we've as the number of applications as the number of technologies are proliferate, managing an employee's life cycle through that, governing that the life cycle is matched properly administering, et cetera, is also pretty, it's also becoming very, very challenging. It was all well and good when there were 10 apps and you were on, that's not true anymore. An average company uses I think close to 200 applications and then if you broaden that to other resources like infrastructure, there's a lot, lot more. So how do you actually build automated systems that based on the employee's status, based on their role, based on the project they're on provides them the right access for the right amount of time. The third thing you mentioned is, and you touched on this initially, but there's this concept of zero trust security, right? The parameters disappeared, how do you provide zero trust security? So if you look at the industry at large today, there are tons of different security vendors trying to provide security at each point. If you talk to any CISO, it's really, really hard to cobble all of this together. And one of the things we're trying to do is, we're trying to figure out how with our partners, we can build a end-to-end solution for end-to-end zero trust for our customers. So that's another area of the product portfolio we're pushing. And then finally, with the whole digital transformation and customer identity, yes, more and more companies want their customers to interact online. Yes, more and more customers find convenience of being able to interact online. But really if you think about it, the world has changed dramatically over the last two or three years with privacy laws, with things like GDPR, CCP, et cetera.  How do you actually manage their consent? How do you ensure that while you're using all this data from across these apps that we talked about, and you're using it for the customer's benefit, how do you make sure that they get us to private, they're still secure? And how do you ensure your customers trust? That's another major area that I think our customers are asking us for help in. And so those are the areas or so that you should see us make significant progress over the next two to three years. Obviously, we're gonna take a platform approach to it. We don't believe we can solve everything ourselves. So some of it will be us building ourselves, other of it will be building a platform and helping our partners build on top of us. Us and some of it will be through partnership. But that's generally the high-level directions we're headed in. Well, thank you so much for coming on the Q and the Q and sharing the product roadmap and some other details of Okta. Great company, really interested in watching its continued ascendancy. Good luck in the marketplace. And thank you for watching, everybody. This is Dave Vellante, Cube Conversations. We'll see you next time.


Next up, I'd like to welcome Joshua Chu Tan. He's from the ANU College of Medicine, Biology, and the Environment. And the title of his three-minute thesis presentation tonight is Targeting the Root of Vision Loss. If I asked everyone here to think about the one sense that you couldn't live without, I'm willing to bet that most of you would have immediately thought of your sight. That's because our vision and what we see plays such an integral role in how we perceive the world around us. Now the tissue responsible for that is known as the retina.  What if this part of your retina was responsible for your color perception as well as your central vision? And then this damage leads to your visual field looking like this. Well, this is exactly what happens in age-related macular degeneration, or AMD. This disease is the leading cause of blindness in the developed world. This disease costs the Australian economy up to $5 billion per year. And the most common form of this disease has no cure. AMD is a serious problem. Now due to the many factors that are at play, therapies are very hard to come by. But I'm researching a potential gene therapy using tiny molecules called microRNA that are like the gods of gene regulation and have the ability to bypass this problem. How? Because a single microRNA can bind to multiple targets. So instead of controlling just the one gene, we're controlling its entire pathway. Instead of superficially cutting just the stem of the weed, we're ripping out the whole root. So in the case of AMD, we know that the inflammatory pathway plays a major role. So we've injected an anti-inflammatory microRNA into the eye, and what we saw was a decrease in genes responsible for inflammation, cell death, as well as a slowing in the damage progression of the retina. What we've now done is identified multiple microRNA that can each regulate pathways leading to AMD, and by injecting a cocktail of these molecules, we can slow the progression of the disease and hopefully halt vision loss. Now I want everyone to look at this image again. Imagine living the rest of your life with vision like this. So the next time you're with your loved ones, study their faces, their every feature. Commit that to memory. Cherish that image because one in seven of you will lose that ability if nothing is done about this disease. With the use of microRNA, my hope and my goal is that for millions of people, this image can become clear. Thank you.


Good morning. Good afternoon. Good evening. Welcome to another episode of the Stack Rocks office hours This is episode three and I'm here with Mendar de Wachtar to talk about Kubernetes network policies. I'm Chris Short your host with the most here on Redhead live streaming Mendar introduce yourself to the audience. It's your first time on the channel. So, you know, feel free divulge Thanks Chris for the short introduction. Yeah, hi I'm Mendar. I work with the Red Hat Advanced Cluster Security team. I joined Red Hat via the acquisition of Stack Rocks And I've been with Stack Rocks for just over two years and contributing to almost all the components of Stack Rocks Network segmentation, policy management, risk computation And outside my work. I enjoy being active trail running Cycling, kayaking. So if you are in the Bay Area and you know want to join in with me, hit me up Nice Things I used to be able to do So Kubernetes network policies There's a lot to them, right? But You're gonna break it down for us. So, how do you want to do this? cool so what I'm gonna do is share my screen and Kind of walk through Short and sweet demo not too complex Basically, it will take us through how to write network policies and what are some things to Look for when you're writing and enforcing network policies. All right So first of all, what are these, you know, what is a Kubernetes network policy, right? So In the simplistic terms, it's basically a means of controlling inbound and outbound traffic You know from the parts perspective, right to other parts are to the internet, right? and This is achieved via Something called as labels and selectors and widely used by various Kubernetes resources, right? Such as services as well so Kubernetes network policies and Kubernetes like the bugs are very like They're like the the network policies are like the guiding angels wherever whatever is the label, you know The network and if the network policy kind of sees it Satisfying it it will just you know stick to it. So that is one very crucial piece that is also important in You know identifying. How are you going to segment the applications, right? So what I'll do now is basically jump into, you know demo So basically let's create a namespace so that I can You know show whatever I yeah, yeah, so by default No network policies are You know enforced, right? I mean there are some CNI plugins are managed Kubernetes services, which like Deploy or claim to deploy, you know default network policies, but those are essentially Allowing all the inbound and outbound traffic, right? So basically it's Doing it's not enforcing or it's not, you know limiting any traffic, right? so it's as as it's its behavior is as there is no network policy, right and Keep the Kubernetes network policies being namespaced Has actually a huge advantage Although there are like some limitations, but it also has a huge advantage When we are thinking like Kubernetes has been a game changer in like how we like deploy and maintain applications Right or even to certain extent how we write applications, right? Everything is very application centric, right? and the basic principle being, you know You know the applications or the pods need like serve the purpose and you know disappear, right and With this namespaced kind of environment, you know multiple teams, you know, you know having these, you know Different namespace working in their own namespaces kind of allows you Kind of provides this natural way of segmentation and that is something, you know One needs to keep in mind When writing Kubernetes network policies and how you can take advantage of Network policies being namespaced, right? We will talk about some limitations and how we can, you know, overcome them later in the during the demo, but you know For now, let's get started So what I'm gonna do is I'm gonna Create a very You know simple You know Environment, you know mocking there's like a database. There's a middle layer or the service layer And there is a front end, you know the typical Okay, okay, so we are running into problem What is the DB supposed to represent? Okay, so we were missing in this. Okay. Got it. All right So So we have our DB. I mean it's essentially an engine X and that You know, which for demo purposes, I'm you know treating it as a DB then let's say we have a catalog service. Let's say, you know, this is an application which is Serving Which is basically serving Okay, so the issue was we did not create it in the namespace All right, all right. So, okay, let's get to what we have Interesting, okay, so there is the syntax error here So what I ended up creating me like a band name. Yes the first rule, right All right, so let's So let's create The service called catalog, which is basically, you know acting something like, you know, providing a catalog of products And so what we have is now we have two pods, you know One is behaving as a database, right? It's an engine Excel pine and one is behaving as catalog, right? So right now There is no network policy enforced in this particular namespace, right? so if I go into If I exit into one of the pods namespace Yes, that's correct. There we go. And let's say we try to hit, you know Google.com or something like that You know, I'm able to reach out. I'm able to reach out to the internet I'm, you know, I should be able to reach out to the other You know pods however right now I've not exposed any other pod You know as service like so what I'll do is I will expose db On port 80. Okay, and of course we are Okay So let's get all the pods again However, let's also figure out what, you know, let's look at the IP addresses the plus IP addresses that are associated with them and as well as let's look at the IP address and As well as let's look at, you know, what are the services that we have now? All right. So if I go back Into catalog And try to Get db. I should be able to reach to it. Okay So basically this what it's demonstrating is I deployed my applications, right without enforcing Kubernetes network policies, right and It's not controlling any traffic. It's open to the entire internet and You know communicating Open to, you know, any kind of intrusion Think unwanted things, right so There are two approaches to this when you're writing Kubernetes policies, right? You can start off by Having a deny all policy in place which which means basically deny all the Inbound and outbound traffic, right when you're deploying a new application Let's say in a test environment, you know, like It's not going to be used immediately, right? And what do you want to understand is, okay, you want to See how your application is, you know, kind of reacting to that deny all policy, right? How is it failing, you know where all it's trying to reach and another good thing to Accomplish this is to have good logging, right, right? Whether if it is failing if you know silent logging or whether it's crashing and things like that, right but The other side of the coin is writing Kubernetes network policies can be a daunting task and I agree to it, you know Many a times, you know developers You know kind of shed the responsibility to the administrators And you know there is there could be a possibility that there's no proper check between you know how the applications are moving forward, you know The other approach is like, you know put it in a test bed, you know with allow all and observe how the application is behaving, you know for let's say A window, you know where all the application is trying to reach. So this is going to be your baseline, right? Right and identify if that baseline is even something that you anticipated or even something that you expected Yeah, right. Yeah, there could totally be something wrong with the image. Maybe reaching out and grab a package kind of thing. Anything Correct. Exactly. And then kind of reverse engineer, you know kind of scope it down by putting in place, you know some network policies, you know And things like that. So for example, what I'm going to do now is I have, okay, let me first show I have deny all policy here. Okay, pretty simple. Yeah, pretty simple. It's selecting all the pods in the namespace demo And not allowing any traffic, right. So another thing, another point I should be touching on is network policies are basically like based on the rules of allow list, you know what must be allowed, right You cannot have rules, such as, you know, block these block only XYZ connections and allow everything else.  So, you know, kind of block everything So what I'm going to do is take that policy and apply it to be angry It's going to rebel. Yes, I'm going to lose my I'm going to lose my PRP my customer base when they're trying to shop from my wonderful catalog. Yes, so catalog has a very beautiful index file Correct. So let's go back And try to hit Google if I did everything right, we should expect this to time out. Right. Oh, yeah, about it. Right. We can also try to reach out to the other pod And it should be all right. Cool. So right now we have like a completely isolated name space anything any new deployment or any existing deployment or pod in this name space cannot have an inbound at an odd bond connection to anything else. Right.  So you start from the most restrictive network policy and then kind of move outwards right so as I already Okay, so exposed the DB service, you know, and I want my, you know, catalog to basically query the DB and, you know, like get some records out of it. So basically what now I need to do is I can now ingress on DB like, you know, from catalog, right, so that I can explicitly allow those two exactly exactly so that I can fulfill those queries, you know, so let's try to do that. So I have prebuilt this YAML file writing. YAMLs are kind of sensitive. I can understand a pain, you know, like even an indentation could make a huge difference. Don't try the tool for that. I feel like. I would actually want to touch upon a tool that I came across and I've been using it, which kind of elevate some pains of, you know, writing network policies, but yeah, we'll get to it. Okay, cool. So let's look at this, what this policy is informing, right, so it's, it's, and it will be enforced in the namespace demo. And on the pods, which have label app is equals to DB, right. And it's an ingress policy, right, telling that, okay, allow all the ingress from the pods, which are labeled app is equals to catalog. And this is the scenario we want to support right now, right. So let's just go ahead and apply that policy. All right. So that's the DB policy. All right, so let's see what all policies we have now in this particular namespace demo. All right. So as you can see, there are like two network policies, right. One is denying all the traffic. One is allowing a, you know, traffic to the pod DB, right. So one would question like, you know, how, you know, what is an effective network policy like what should happen when I have multiple network policies, right. So one thing is out of question like I created both these policies scope to this namespace for this namespace demo, right. So the namespace policies, the effective namespace policies basically the disjunction of all the rules. So basically, if I have policy saying, okay, don't allow, like, do not allow any traffic ingress traffic. And I have, and if I have another policy saying, okay, allow ingress traffic. So it's like a true and a false right disjunction. You're going to, what's going to happen is the effective network policies going to allow ingress, you know, for that particular part. So that's how network policies work. And how it plays, how it, how it is important is like, one needs to pay attention on how you're right writing network policies, like keep it simple. You know, don't write a network policy which is trying to address everything, you know, like having 100 lines of rule 100 rules in it. Don't make it too complex because complexity leads to mistakes. Network policies being, you know, kind of a challenge in the first place.  So have network policies scoped to the functionality, like what it's supposed to do, you know, if it is supposed to work on a pod, like let's say in this case, a DB pod, you know, scope it down to that deployment that pod, you know, is it supposed to allow ingress traffic, ingress traffic, and have those things, you know, have this segmented out so that, you know, you can revoke, like take out some network policies if something breaks and, you know, work your way through debugging. Right. So the first, you know, one of the important rule is, you know, try to keep it simple. Right. So I have an ingress policy. So does that mean let's try to, you know, reach out to DB. Okay, let's see if it's going to work. Right. It's not. Okay, let's, let's pick up the IP address and, you know, try to get to it. So I have an ingress policy on DB, but somehow I'm not able to reach it via, you know, catalog, you know, from catalog. And the answer is you have umbrella network policy blocking connection for all the other, you know, pods, you know. So now what I have to do is explicitly add a network policy to allow egress from catalog. Right. So that, so when you're writing network policies, it's almost like you define the behavior on both the ends. You have an ingress policy on a pod. You kind of have to have like, you know, a egress policy, a complimentary egress policy on the other end with, you know, which, which you want to communicate with this. So it's two way communication. So yes, exactly.  Right. If I remove that restriction, right, deny all I can reach to DB from catalog and you can, we can walk through that as well. Right. But since I'm starting with the most restrictive policy and I'm, you know, opening one door at a time, I know what I'm doing. I know what I'm opening up. Right. You know, through these explicit rules in the network policies, right. I have this network policy for catalog.  Right. The port numbers. 53. That's a very good observation there. Okay. Thank you. The writing ingress policies has been like it's traditionally kind of straightforward. But when it comes to egress policies, it becomes slightly challenging. Because to, for one reason being, you may not like one may not know how the application is exactly behaving like what does it take for the application to work properly. Where does it need to reach out? Does it need to reach out to, you know, GKE bucket to get some, you know, data for at startup time. But the most primary thing is most likely it will, you know, it has to reach, it has to be able to reach to DNS server. Right.  Correct. Right. So if I do not have this rule, right, basically, if I try to reach the pod, you know, using like the name, right, it's going to fail. Right. Because I cannot reach to the DNS. And that's the most important note to make, right, when you're writing an egress policy, make sure you can reach to the DNS server, right, whether it be cube DNS or other DNS servers that you're used, make sure you're not blocking that. Right. Now there are caveats of this rule basically it's allowing, you know, traffic to all the pods on port 53. You can scope it down. You know, by labeling the cube system namespace.  But for now, I'll just leave it as is. And move ahead. So let's apply that. And now we have three policies. We have an inverse policy on DB. We have an egress policy and catalog. Let's go back and see if we can reach out to. Yes. So we could reach out to the DB pod. Right. And we could reach out to the DB pod, not using the IP address because we have not blocked the path to the DNS. Right. So, this is, you know, this is like a very simple kind of demo I had, I have like double of more network policies here. I would specifically like to, you know, like, maybe show another one. As I said, you know, Yamal can be confusing. This is another form of More than one way to Yamala cat. Yeah. Yes. Right. So, So it's, I came across like a very, there's a very good meme out there, which is like, oh, there's like a Kubernetes which like a cat is very cute. Right. It says like, oh, you said like just Yamal would be sufficient. Right. But it's not the case. So both are essentially denying, you know, the traffic both ways on all the parts in this namespace demo. Right. But, you know, like there are different ways how it is written. So, you know, knowing like testing out the network policies is always, you know, critical.  So yeah, I mean, this was the short and sweet demo. I had Yeah, and let's, I mean, this is an office hour. I believe. Yeah. Yeah, if you have questions, feel free to ask them. In your example, the You open port 53, but I feel like there's a better way to do that. Right. Like I would just open up port 53 to Cube DNS, Cube system to the, you know, API on port 80 or 443 depending upon the situation. I mean, how else can you like make that rule better, tighter kind of thing. That's, that's a good question. So let's open up that YAML. Right. So there are some prerequisites to do that right since network policies are tied to labels and labels on, you know, the parts. Generally, you need to make sure that, you know, if you want to scope it to something, make sure that that particular part has appropriate labels, right. Generally uses, you know, create namespaces and, you know, do not label them. People folks like label parts, you know, deployments and other things. Most likely they'll expose it through, you know, services like load balancer and things like that. But namespaces, right. So then you also got to like label the namespace, right. So let's let's actually try to do that. Let's see if I can actually do that without. Okay, so we have cube system. Okay, so I'm going to list people in the cube system, right. So we have the cube system sting right there. Let's describe cube system and see if it got anything. Nope. So we have this label namespace metadata stack rocks IO cube system. So I have stack rocks, the advanced cluster security instance running in this particular Kubernetes cluster which applied the label, you know, we do that. But otherwise you wouldn't see this label. So let's pick that label and kind of work our way, how we can scope down the DNS rule. Right. All right, so what I want to tell it is namespace. Okay, so scope it down. Right. So I want to scope it down. Match the label. Right namespace is equals to so and so. Right. So now what, so now we have scope it down slightly. Right. So what it's telling what this network policies informing is allow egress traffic to put 53 for all the pods to all the pods in namespace, you know, having gotten this label. All right. So it's still like, okay, you know, you can still reach out to all the pods in your DNS namespace. Right. So we might need to scope it down further. Right. So let's say, let's describe, you know, what your DNS looks like. All right. Okay. So huge idea. Yeah. So, there's a label here, which we can likely use, you know, gets up as equals cube DNS. Now, I want to also talk about, you know, labeling, you know, what, what, what are some basic rules or tips that one should, you know, be aware of when you want to segment the network policies or basically your applications. All right, I'm going to cut it again. Just so that we have it on the screen. All right. So what we have now is we have a network policy, you know, scoped down to parts having QD gets up is equals to cube DNS label on the, sorry, in namespace having that particular, you know, label, right. But the caveat to this is, although I've scoped down my network policy, and if someone is going to, you know, add a pod with the exact same label is going to start allowing egress traffic to that label as well. Right. That part as well. Right. So, there are two parts to this right writing network policies and forcing network policies and how you write those network policies but the other part is enforcing who can write a network policies and who can label resources in your environment. Otherwise, you know, anyone having you know those permissions to introduce new network policies or introduce new or update the parts with new labels can basically go around the wall that you're trying to create. Right. And there are a couple of ways to kind of achieve that enforcement you can have an admission controller in place that kind of restricts, you know, creation of, you know, like a patient of those resources are like creation of network policies. Like, you know, or you can also use like Kubernetes RBAC rules to basically kind of scope down, you know, who can do what right remember the principle of least privilege, the way you're going to achieve security is by adhering to that principle. Right. For example, if I had these network policies in place, right. And then if I let me just show allow all if I go ahead if someone is able to apply this policy, all my effort is waste. Right. Right. Because it's going to allow all inbound and outbound traffic, you know, to this particular names. Right. So, so, so they're like, you know, so that that's another important thing, you know, how you are going to compliment the network security through network policies is kind of having some kind of enforcement and adhering to the principle of least privileges, you know, so that people cannot go around that while you're trying to create. Yeah, don't hit the all the play all.  So, and I know that involves ingresses and RBAC and all that fun stuff. But is there a network policy for that. There. Unfortunately, no, there. No, it's because network policies are something, you know, application of it like they're meant to be application of it they're meant to be focused on, you know, application, right, what works in one environment but let's say you have Cassandra and things like that and, you know, like you what works for that particular environment may not work for other environment. But there are these, you know, basic, there are these basic points, right, what to look at right, let me actually, you know, go to that right this slide. Now this is not an exhaustive list. I've just tried my best to in a list couple of things which I feel are important to look at when you're writing network policies right.   So there are like some, you know, basic things that one can start at and like work their way towards it.  So definitely I mean, testing network policies is a crucial thing you do not want to break applications in production. Yeah. Yeah. Don't start testing things on prod. Right. But, but I also want to, you know, highlight one thing here like network policies, you know, like the declarative nature of Kubernetes and how you write applications or how you kind of deal with the resources in Kubernetes. I think it's in a way kind of pushing developers to, you know, kind of start moving the security from administrator to the application development, like basically those who are, you know, like developing application know the architecture of that application and how that app is supposed to behave, you know, the best, right. So, you know, it basically shifts enforcing security, you know, in the early phases of applications lifecycle, right, you know, it very well start in, you know, during the development of the application as well, right. So that's, I see it as an advantage. I see Kubernetes network policies and the nature of it being the declarative nature of it being an advantage, you know, to, you know, allow anyone like to enable the developers to kind of, you know, take that responsibility shoulder that responsibility to enforce security early on. So, somebody's asking how to do this with a route, like, you know, and of course, I'm going to link to documentation for that. So, let me just do that real quick. Yeah, so routes and kubernetes and open shift land are like ingresses and kubernetes land, they actually predate ingress. So this is something that bread had had to create to satisfy customer need when open shift was launched. So route specific security annotations and things like that are all documented on this page I feel like, and locking things down there is as easy with a admission policy so make sure that, you know, the ingress is good to go it's not opening things that shouldn't have open. And, you know, you can do that with a number of, you know, different.  Yeah.  Right. Scalability, right, is one of the challenge right you, for example, you know, standard DNS like allow egress traffic to DNS is something probably would be natural to throughout the organization, right. And teams deploying their applications in different namespaces, you know, might most likely, you know, want to have that template, right. So, there are, you know, like each, there are these CNI plugins and different managed Kubernetes services have, you know, different choice of CNI plugins. But these CNI plug CNI plugins have something called as like global network policies or like cluster level. You know, that kind of addresses the concern of scalability, right. Let's say if someone wants a workflow such as, you know, when any application that is deployed, must, you know, have, must allow egress to, you know, the DNS servers of that organization, things like that, right. So, these CNI plugins kind of enable it. And the Kubernetes network policies work in work hand in hand with like these network CNI plugin, the CNI specific network policies, right, so it's a complimentary, you know, feature. And most CNI plugins, you know, like, have, you know, things like visibility as well, right, like, you have deployed network policy, what next, should you sit back, right, that's, that's some, that's something always get asked, right, like how do you, how do I, you know, kind of observe the environment and how do I kind of adapt and how do I update my network policies. For example, like Celium has a very awesome, you know, like network observability, I'm not sure whether it's like a paid thing or not, but they have like some logs, network policy logs, which basically have like custom metadata telling okay, which network policy allowed or denied a connection from what part to what part, you know, things like that. I believe, you know, because, you know, there's EBPF and EBPF has been like, you'll see it being used in more and more places because, you know, the enriched data that you can get using that has been advantageous I think and the KEE data, data plane V2 has that feature as well.  Right. So that's another important aspect to that. Very good point. I just linked in chat folks to the last episode where we talked about EBPF and implementing security and monitoring around Kubernetes with it. So, feel free to check that out. You can always find us at our web page, which is just simple link here live streaming. So, yeah, no other questions from the audience. I feel like Naveen, if I haven't answered your question, please let me know. And I'll ask, Mandar, but he was asking, you know, how do I get things out of the cluster basically have access to things. If a connectivity failure occurred like between, I guess, I think he I'm thinking he means between nodes. But how do you like diagnose if there is a fail connectivity failure. Yeah, like, he wants to know what's the source IP. So, so I'm confused by the question. So, all right, I'm trying to answer it well can be confused. Let me think of like, let me put out some couple of points.  And I mean, essentially, when you, when I'm running a cubicle, you know, create namespace or get part it's essentially you know, arrest fall to the API server right and everything gets logged in there. Managed Kubernetes services, most, if I'm not wrong, most likely have the feature the logging feature turned on by default. So that's like one good starting point. Network policies are not going to deny are not going to block, you know, any communication between the pods and the node that the part is residing on. Right.  If you're having admin privileges, you can keep total and kind of diagnose get the application logs and things like that. So I've got a question in here does stack rocks or now advanced cluster security help automate the management of these network policies rather than having to manually create them. That's a good question. And I would love to show stack rocks or ACS. Let me share my screen. Awesome. All right. Let me know if you can see the advanced cluster security. Okay, cool. So, one of the most, you know, I talked about a feature of stack rocks is a network observability network segmentation. And as you can see here, I'm not sure if you can see where I'm hovering, but basically top left. There are like three kinds of views active allowed and all right. So the active view is basically showing all the connections that are active right now, you know, so that's like a good way of, you know, of observing like you know how my applications are connecting and this is a test. Basically, I'm testing out, you know, how my application is communicating, you know, this is the view we provide details about you know what port and whether it's an egress connection the protocol and things like that. We also added support for a kind of scoping or making it explicit to which side or your application is trying to reach out to, you know, outside your cluster. So this is about active connections. So coming back to that question. Right. So, a loud view kind of provides that the space of how your applications or what all kind of connections your application can have. Right. As you can see like, you know, there are different. Let me zoom in. So these boxes or the squares are namespaces and these, you know, circles or dots are your cards and deployments. And each of them is having like a different legend. Right. Right. So basically, as you can see, if I hover over DB. If if you go back like I had a inverse policy in place for DB it and it would only allow connections from catalog. And you can see right cannot reach out to the external world you cannot see that arrow right. So same thing like, you know, like, you know, other part I think this one this was the one which I created. Now, you can go to network policy simulator. Let me let me filter down first so that it's okay. So we have this demo cluster and the associated namespaces. What you can you'll see multiple options here and what you can do with these is first view what are the active yamls. Right. So these are the policies that I applied to the namespace demo. Right. So I can see what are my, you know, network policies in this particular namespace. I can edit those network policies and upload them here and see how it is, you know, taking effect. You know how it's changing. Right. So there are ways to basically like upload network policy. Right. Let me see if I can navigate to the folder. I believe in you. Allow all I believe we had not applied. We did not apply that but all of a sudden your DB can talk to the API server. That seems crazy. Right. So this is another way to, you know, make sure like how your network policies behaving and whether it's, you know, kind of meeting the expectation without breaking the application. Right. And then you can, you know, like tweak the network policy if it is not, you know, meeting the expectations, scope it down, scope it up and then see it. And then you can also apply it. Right. Like if I apply this it's going to start allowing connections to, you know, it is basically going to allow all the ingress and egress. So StackRex provides a very good tooling around, you know, elevating those pains of writing network policies. You can also generate network policies. Let's say you did not have any network policy or you had some network policies in place you can select a time window. Like let's say I want to generate a network policy based on the connections made to the app in past hour. Right. So I go to network policy simulator, click generate and simulate network policies. It says, you know, no network policies are needed to be created or related because literally I haven't allowed all. Everything opens. So yeah. So this is a very good, you know, tooling from StackRex to kind of, you know, play with network policies, you know, and build network policies. Yeah. That's awesome. So you can kind of just say, you know, look back at this sample of 24 hours, see what's happened. Exactly. It'll all be right there for you. That's awesome. And StackRex, I mean, has a couple of more things like network baseline. So I mean this demo has not been running for a very long time. I just spun it up right before this meet. So basically something like we have an observability window during which we observe the connections to an app and kind of lock it down and any new connections, you know, or any connections deviating from that baseline are highlighted as anomalous connections to basically asking you, hey, is this something you anticipated? If you anticipated it, okay, you can mark it as a baseline, you can move it to the baseline. If not, then probably you'll need to update your network policy because, you know, someone is trying to reach to your app. Right. So that's, you know, another cool tooling from StackRex, you know, to observe beyond the period of like, you know, you have applied the network policies, but what next, right? Yeah, and like, can StackRex highlight abnormal activity? So the, so right now, I should say advanced cluster security, I'm sorry, I keep saying StackRex. Advanced cluster security. I'm wearing a StackRex sweatshirt. I know, it's throwing me off. So we do not analyze packets. So we observe connections, you know, we observe the connection information basically the endpoint, you know, like the endpoint information, the protocol and things like that. We do not perform analysis on packets like, you know, we have like, I know there are some, you know, there are like these firewalls which perform packet analysis and kind of block or allow connections based on that. It's not that granular, but what we want to make sure is you can see the connections coming from an endpoint and make a decision whether that endpoint can be trusted. Allow it or don't allow it. Right. And once you have that rule for that connection, and since network policies are basically like sitting at the edge of the application, like the guarding angel, right?  That blast radius gets a lot smaller the tighter those policies are. Yeah, exactly. Like allowing, you know, some people do have or intermix. You know, dev and stage and prod across a fleet of clusters, not that, you know, there's anything wrong with that. But usually prefer product on its own cluster so you wouldn't want your dev stuff talking to your, you know, prod stuff or even your stage stuff potentially right like or there would only be one kind of lateral movement of package. You know, that's been tested and done from your CI system into the various environments. So yeah, there's a lot of power and a lot of potential here. And I think I believe, I believe that has been the underlying principle with, you know, things, Kubernetes, right? It has made it more explicit, you know, why namespaces, why application focus, you know, why things need to be, you know, focused around applications, it's because it should be in that way. Right.  Right. And, you know, I've said this to some ops people before it's like Kubernetes forces you to understand applications better. Right, like you kind of makes it more every point. Exactly. And that's how it should be, right? Like we shouldn't be saying, you know, hey developer, what VM size do you need? And that be the extent of the knowledge that we have of that system, you know, other than patches that are applied to it or whatever, like we should understand the traffic coming in and out of it. We should understand, you know, syscalls to an extent of what's, you know, being called and if that's, you know, valid for that application. So doing the profiling is a really good feature, right? So you can actually sit there and say, hey, developer, you know, if you're not the developer looking at it at the time, you could go back and say, hey team, is this expected? Like, this kind of looks weird to me. Is that legit or not? Because you never know, right? Like, Kubernetes has been game changer. I have to agree to that. Yeah. I mean, yeah, so you've got some resource links here and I'm going to share the slides after we're done here folks, so Awesome. Don't worry about that. Yeah, I would like to, you know, make some like special mentions of the couple of things. They're like a couple of blogs written by my colleagues. They've also been submitted to CNCF around, you know, what are the best practices for writing ingress and egress network policies.  This person is, I guess, network policy enthusiast and he has put out a bunch of samples, recipes, you know, like of network policies and how they behave. It's, I would recommend everyone to like check it out and it's good in, you know, kind of understanding, you know, and learning curve. And I mean, I put out some resources here but definitely this is not an exhaustive list and I do not want to stand behind any particular managed Kubernetes service or a CNI plugin. But, you know, like these are some most commonly used CNI plugins and, you know, kind of services. So, you know, good starting point. If someone wants to look at, you know, the CNI interface and things like that, you can go to their GitHub. I've also put links to network policy logging that is something new addressing the question like how should I detect intrusion, how should I add up my network policies. And the intrusion protection bit is pretty awesome because normally that's done like at your network edge and being able to do it right there and cluster is great. Last but not least, definitely, we look forward to, you know, contributors to the stack rocks community you can go to stack rocks.io reach out to us. We have blogs, you know, like if you have any cool ideas on talks things like that. And if someone is interested in looking at red hat advanced cluster security product, you can go to this link and request a demo. I guess you can also reach out to me and I can kind of moderate and forward that email to appropriate people. And yeah, we are hiring. We got job folks. If you love Kubernetes, and if you want to work in your, you know, security space, definitely go to this link. In other words, advanced cluster security and you will see a list of openings. Our team is looking to hire good engineers. So either you can go there or again, you can reach me out like LinkedIn or any other means and I'll make sure it's going to appropriate people in the organization. Well, man, our thank you so much for coming on really appreciate your time today. This is awesome. Awesome demo. Great work. And we'll see you will see y'all in a next month. I think this is monthly show. I forget. Yes, yes, so many shows. So yeah, folks, if I don't see you between now and next time, stay safe out there and Amanda, thank you again for coming on. Really appreciate it. My pleasure. Thank you, Chris. Have a great day.


waiting for the train especially late at night and this is who's kind of late and you're standing by the train you're like kind of waiting for this thing and all these sounds and things that have happened throughout the night kind of coming over into your brain washing over you like a dream like reminiscing of what just happened that night waiting for the G train maybe that doesn't really sound like that but at least that's the story he tells me so I feel obligated to tell you and relay that that that that to you and that's what inspired that piece for him but what you were hearing is just some very simple delays and granulation at the end and it's actually off of my last record on you Amsterdam called aorta which is which I'll be playing a few other pieces tonight the second one is also part of that it's it's a shorter work called limbs it's actually a third movement or a second movement of a larger three movement work by a composer named Daniel Wall who originally is from Brooklyn but now he's living out in LA and I think he's enjoying the sun and writing a lot of film scores so I haven't seen him in a while but I will probably see him this weekend and this one's called limbs I think we're pretty nice kind of introductions to what I what I do which is a lot of kind of acoustic piano playing mixed with some electronics and the next one is a little bit longer I'm gonna warn you it's about 20 minutes long and it's probably the one that's a little bit more out there but feel free to drift in and out and and daydream or nightdream or because it's by an Icelandic composer named David Bringer-Fansen and he wrote this piece for me last year it's actually a one piece out of four pieces that he thought that it would be a modular kind of work he has one for for solo trombone and electronics one for cello electronics piano electronics and a one for I believe a trio or quartet and electronics and they were supposed to exist either together you can perform them together or as separate solo pieces and he was telling me that what kind of inspired this work well the cartography of time kind of you know Jeremy cartography of time pretty self-explanatory but he recently had a child and she would always ask him to tell him her the same kind of bedtime story but by the time he finished the story she would still be awake and would ask him to tell her the story again so he started to think how can I stretch out this material over a longer period of time so hopefully by the end of it she'll be asleep well hopefully you won't be asleep by the end of it but feel free to drift in and out because it is very simple materials I'll be playing a little bit of inside the piano some very simple kind of harmonics and like muted strings but a lot of them will be manipulated and stretched out using technology with my trusty laptop here so I'm not clearly playing a solo show tonight I'm playing a duo show because a lot of it won't happen if the laptop's not performing too so I hope you enjoy it and get some good rest too hopefully you'll feel refreshed after this piece I'm gonna take a short break and I'm gonna do some things with the piano but I'll see you back in a few minutes well originally the program was supposed to only three pieces long so we would have been done but I don't know I wanted to play some of these pieces that my friends wrote because I said I would a long time ago and I'm gonna do that so the next piece I'm gonna play is a piece by Fjola Evans who's a friend of mine from Canada and also she's also part Icelandic but I met her a few years ago and I really loved her work so I asked her to write a piece for me and she's never written for the piano and she wanted to write something for prepared piano and she so she wrote this piece it's called Mammal and because she thinks of the instrument as this kind of mammoth whale of an instrument there's so many sounds and so many sound worlds and she just wanted to create kind of soundscapes so I use some very simple piano preparations kind of a la John Cage without nuts and bolts and screws but with some kind of like blue tack you know that you would use to put things on the wall and it transforms the instrument into almost I don't know I'll let you think about it I don't know maybe it sounds like a whale or maybe another beast a piece that that since it's so new and that's kind of like one of the great things about being able to work with composers who is willing to kind of collaborate with you she's still revising the piece she right now she just she graduated and where is she going to school now I think she's at Yale she's doing her master's there and I think just yesterday she was still like hey can you change the preparations on the piano like she took a photo and made a recording and so it's still a work in progress and and so every time I performed it it's still slightly different and and I'll get this recording I'll send it to her and she'll get to hear it and be like wait you know she might completely cut up a section and revise it and so next time I play it it might be completely different so you heard one version of this piece tonight but let me just take out the putty really quickly and then the next piece is a it's is the oldest work on on this program by Alvin Lucia and it's a piece that's called music for piano with slow sweep pure wave oscillators and it's exactly that what you're gonna hear is two like kind of sine wave sweeping at different pitches at different speeds and rates between the semitones and because of the natural properties of the sine waves and what I'll be playing you will hear a kind of a natural phenomenon acoustically in the space and so tonight Colin who's doing sound I think he gets to kind of perform a little bit because he was gonna be able to manipulate depending on how everything is sounding you will hear the different beatings as the tones move away from the the stable pitch that the piano will be producing but let me just take out the preparations and I'll begin that Lucia piece he wanted to kind of we went to school together we had to play a piece together by Jacob Druckmann called Come Round and I think the piano part had inside piano and on the keyboard and all these kind of crazy things and he has never seen that before you know he didn't have a composition background really but he wanted to do something like that so together about ten years ago he decided to write this piece for me and also another pianist from California named Vicki Ray who was part of another ensemble called California Ear Unit but commissioned and worked a lot with composers and performed a lot and record a lot of work that were very kind of crucial to contemporary music so hence the there's some very simple preparations in the piano actually I'm going to be using eight dimes and I'll kind of let you hear kind of what it sounds like John Cage he's famous for these pieces not as an interlude you know written 46-48 and he prepared basically 40 like half of the keys like 44 notes in the entire set which takes about maybe two hours to do but he used anything you can find you know like screws and nuts and bolts but you can try this at home just be careful to not damage or touch the hammers or touch the dampers but anyways keep these things in and it changes the pitch and it almost sounds like a gommel on ensemble unlike a viola's piece which I use something very you know malleable and soft it created more subtle tone this has a metal on metal strings so you're gonna get something that will sound like this it's a different place it's gonna change the instrument completely people say he did this because he was working in Seattle and he was playing for like a dance school asked to write some music for it and the only thing they had was an upright piano and he's like well what can I do to try and make this work you know I want to create some sound world but the only thing I have is a piano so he some people say that how he kind of creatively found a solution when there wasn't a percussion instrument so he started playing around with prepared pianos so that he can have more of an orchestra at his fingertips and it's really really fun I'll try and do this as quickly as I can this takes about five minutes cages he takes me about two hours he also asked me like what kind of music do you listen to like besides classical and I was like well you know I really like a radio head and so he was like okay let me try and create some sounds resemble that more the pieces notated and after the piece all for coming thank you for inviting me it's really a pleasure to be able to be here to share the music with you you know because it's these are odd pieces not many people get to hear it and you guys we're all part of it so thank you for staying for the entire show kind of you know before for fiola's piece it might change how it resonates oh that was not a good example this will pocket change oh yeah it's just 80 cents it's amazing so yeah like before when I was playing the cage a little bit for his centeno in 2012 yeah I had like you know bags full of different nuts and bolts and he's plastic and I don't know if you're familiar with this one but he has a cage you know a very precise measurement of his preparation and I was carrying all this screws all the time and metals the muted low note really is holding the string or yeah so you know any of these things with a lot of like yeah yeah so basically it was specifically that was just for more like the more you mute on this side of the screen


So in the past several episodes, we've been talking about knit collection, a free plug-in for Lightroom and Photoshop and what I've been doing is kind of dissecting some of the filters that are my favorites and how I like to use them, whether it's for a black and white photo or a color photo or whether it's to do some sort of creative adjustments like reduced noise, those kind of things. But one of my absolute favorite filters built into this collection, which is free by the way, is the Pro Contrast adjustment. And it does exactly what it says it does. This is for enhancing contrast in an image and I think that it just works fantastic. If you're someone who's not really familiar with ways to increase contrast and kind of give your photograph that punch or that lift that you've been looking for, this filter right here is going to be the one that does that for you. So what I've done is pulled up three completely different photographs and I've brought up three this time because they're unique in the way that I sort of interpret them. And so if we look in the upper left-hand corner, we have an image that's very monochromatic. There's not a lot of color. There's really only a few colors in here, but this image is really flat. And whenever you have a photograph that's flat or lacks contrast, this adjustment is going to work really, really well. But it also works in an image where we have a photograph that actually does have contrast. So if we look in the upper right-hand corner, we have an image that has a lot of similar tones in it. There's a lot of green in this photograph, predominantly green. And while it's flat or lack of contrast because it's a flat, unprocessed file, there is contrast with respect to the lights in the sky and the darks in the shadows. And so I want to show you what this pro-contrast adjustment is going to do to an image like that. Then where we don't have a flat image or an image that has sort of a single color or high degree of contrast, we have another image down here at the bottom that has a lot more color in it. And I want to just show you how this filter is going to interact with these three different types. And then you can kind of play with this filter on any image that you have to see what the results are going to be. So let's jump into Lightroom and give this a shot. So what I'm going to do is just grab, say, the first image, take it into the Develop module. And from here we're just going to go up to Photo, Edit In, go to Color Effects. Now this is the trick, okay? Pro Contrast, it's not its own plugin. It's a filter within one of these other filters. So you just need to know where to find it. So it's in the Color Effects Pro 4 section. So we're going to click on that. And here we are. We're in the Color Effects Pro panel. Now if you're looking at all of your filters, these are alphabetical. So just scroll all the way down till you hit the P's and then you'll see Pro Contrast there. So I'm just going to apply the Pro Contrast adjustment. And by default, when you look over on the right-hand side, you'll see Pro Contrast there now that I've selected it. And you'll notice that all of the values are at 0%, which means that as of right now, unlike some of the other filters, when you apply it, you instantly see a change. This one when you apply it, you're not going to see any change whatsoever. So if you go in here and you start toggling on this checkbox to see the before and after, you're not going to see anything happening. So don't freak out. The reason is because you need to go and apply the adjustments that you want. Now there's three here. You've got Color Contrast, Correct Contrast, Dynamic Contrast. And the one that I use 99% of the time is Dynamic Contrast. You can play around with Color Contrast to see what that's going to do, what kind of boost that's going to give to your color. But since I have other ways of adjusting color, some of which we've talked about on this channel, I don't really find myself using this color adjustment very much, but the Dynamic Contrast adjustment just in itself is amazing. So that's the one that we're going to focus on in these three examples. So what I'm going to do is start to bump this up and just pull it all the way up to 100%, which is the max, just so you can get a sense as to what this is doing. And so if I toggle this before and after, you can see what that's doing. Now, I don't know why this is, but I find that my magic number on this, the number that I like to find myself at with Dynamic Contrast most of the time, is around 40%. Sometimes a little less, maybe between 20 and 40%, but typically I find myself at about 40%, depending on the photograph. So I'm actually just going to bring this down to about 40% since that seems to be my magic number most of the time. And now I'll just toggle this before and after. And you can see what a nice job this does. What I find that this does most of the time is it's tackling the midtones most of. In other words, it's protecting the really bright, bright stuff and the really dark, dark stuff. And it's concentrating itself in those middle tones, those gray tones. And so I think that's why this works so well. It doesn't really over-contrast the image, but it really gives it a lift. So I'm going to go ahead and save this change. And then we'll go ahead and try this adjustment on one of the other examples to see what that looks like. So I'm going to try this image that does in fact have some contrast with the bright sky and the shadows and has a lot of similar color in it. It's got a lot of green in it. I want to just see how this is going to act. So we're going to again, we're going to go up to photo, edit in, go to color effects, pro and accept this. And we'll wait for this dialog box to open. Alright, so we've already got pro contrast loaded and it's already got 40% in here. If you're jumping from image to image, this might be the case because it's going to grab the last adjustment that we used. But don't take that for face value. Make sure that you check that pro contrast is being applied and make sure that there's a value of some sort in here. In fact, mine does have 40% since that the last that I used.  And if we look, you can see how it really gives this photograph a lift. But our highlights aren't really being overexposed and our shadows aren't being darkened to the point where they're unmanageable. So I really like what this is doing. I think that this works well. So I'm going to go ahead and save this change. But now let's see how this acts on a photograph that has not a lot of contrast in it, but has a lot of different color variations. So we're going to choose this last option. Go to photo, edit in color effects. And here we are. We have our image. We have pro contrast applied at a 40% just to keep these consistent. And if I toggle this adjustment on and off, again, you can see what a nice job that's doing. Now just for the hell of it, I want to just pull up on some of this color contrast just to see what that's going to do to the photograph. So I'm going to go ahead and bump that up. And if I just drag it all the way to 100 and back down, you can see how this really lifts the colors just a little bit and sort of warms them up. I'm going to keep this maybe around 60% for this photograph. But again, it's going to vary from image to image. You might try this on your photograph and find that you're not really crazy about it. And that's okay. I also want to try the correct contrast. And when we correct the contrast, you can see that this really does start to boost the contrast both in the highlights and the shadows. And that's something that the dynamic contrast wasn't really doing before. Again, that's the reason why I like it so much. But with all these three adjustments, we go from this to this. And I think that that does a really nice job. Now, there is one thing about this that I'm not really crazy about. If you look in the upper left hand corner of this image, it looks like I'm getting a really dark shadow or a vignette in the sky of some sort. And I'm not really crazy about what that's doing. But one of the things that's built into all of these nick filters is the ability to drop a control point in there and remove this adjustment from a particular area. So that's what we're going to do. We're going to grab the subtract control point right here, which is the negative. We're going to just select it. And then we're going to come over to the dark area of this photograph and just drop the pin by clicking. And just like that, it's going to take that out. I'm going to grab one more negative control point and drop it all the way up into the tippy left hand corner and take that out also. So if I go before and after, you'll notice that that whole left side of the sky isn't being changed at all. It pretty much stayed exactly the way it was. But now we have the whole bottom section of this photograph being adjusted with these three adjustments that have been applied. And that looks really nice. So we're just going to go ahead and save. And from here, after you do this, like always, you can go into Lightroom and continue adding any other adjustments that you want, whether it's from the basics panel, a curves adjustment, playing with the colors some more, adding a vignette, whatever it is that you want to do to your photograph in Lightroom, you can do. But go ahead and try these filters on your images and see if they don't give your photo the lift that you were looking for. Thank you so much for watching. We'll catch you in the next episode. My name is Adam. I'm out.


Hello, I am Dr. Bhaskar Shani, Head of the Department of Pediatrics and Chief of Division of Pediatric Infectious Diseases at Manipal Hospital, Bangalore. The child should get fever, otherwise it is of no use. That is the other myth generally they have. But in fact it is not like that. It all depends on the child's individual system. Few children react, few children don't react, but the effectiveness will be same. So whether the child gets fever or not, the vaccine would have started working, the vaccine would have provided a lot of protection as usual. Nothing that if fever comes, the vaccine is more effective, nothing like that. Both are good.


The amazing health benefits of cat ownership. Did you know adopting a kitten or a cat can greatly benefit your mental and physical wellness? Look at these amazing health benefits that come with owning a cat. Just looking at your cat can signal the release of oxytocin, a powerful neurochemical that brings feelings of joy and happiness along with a decrease in cortisol, a stress hormone. Petting a cat can calm the nervous system, lower blood levels of stress-related hormones, and enhance feelings of well-being by boosting levels of serotonin, the feel-good neurotransmitter. A cat's purr creates vibrations within a range of 20 to 140 Hz. Science shows that vibrations at specific levels or frequencies cause healing changes in the body. The average house cat generally purrs in the range of 25 to 50 Hz. Exposure to purring vibrations at 20 to 50 Hz is associated with increased bone density, suggesting applications for osteoporosis, particularly in post-menopausal women and the elderly. If you are looking for an easy-care pet companion, consider adopting a cat or kitten, and you too can start enjoying the many healthy and entertaining benefits of life with a cat. If you have any questions, please call, visit, or email us, and one of our knowledgeable staff members will be happy to assist you.