Hi everybody. My name is Isaac Levy. Everybody calls me Ike. This lecture is on the topic of free BSD jail, which last year got some interest here at DEF CON because it was used for capture of the flag part of why I'm here today. Quick Ike context so you guys know who I am. I've used jails extensively for a long time.  Throughout the lecture I'm going to say a lot of stuff. I'm not religious with operating systems and bashing other ways of doing things. Every tool's got a purpose. But some of my arguments are based on specific threat models.  It's always interesting to argue in a constructive manner. Warranty. It's a lot of information. I'm going to be moving really fast through a lot of material. I will be around if anyone has questions. And I will be trying to stick to really classic stock UNIX processes and ideals. Stuff that is 30 years and older. So there's no real, what do I got to do? Oh hold it up here. Okay. So I'm not going to present any Ike specific magic. Oh my God. Thank you. This is what the BSD user group. Really. Thank you guys. So I'm not, and I'm assuming you know your way around UNIX. So I'm not going to spend a lot of time on simple things. Starting with a quick exercise, scale, patterns, and complexity. Has anybody in the room seen the Eames film, powers of ten? 1977. Really great. Great piece. It's up on YouTube, URLs in here, URLs in the notes. It's a great film where they zoom through the galaxy and they start with this guy sleeping, which you can kind of see over here. The whole film is just about a guy sleeping. And they zoom way out of the galaxy at these distance intervals of powers of ten. And then they zoom back in, into the guy's hand, and into, you know, down to quarks. Get really teeny. Do you need something? Good morning. Okay. And throughout it there's this really cool situation where you have all these patterns that keep reemerging visually. I find them really interesting. There's patterns, patterns. Okay. You get the idea. Well, this is the little Ike universe for the day. The Ike's Internet universe. And you know, start at the outside and we've got like, you know, satellites and all kinds of telecommunications equipment and gear. We zoom in. There's a map from the Opti project. Thanks. Dan Kamitski, who just spoke. And you know, zoom into the east coast and zoom into my home in New York City. And you slide past a nice bug meeting and into a building. And we're in the bowels of a data center. And in the basement you'll find the last bug meeting. And we all know what data centers look like in the room, right? You get down to the cables and the network infrastructure. And at that scale you find another guy sleeping, conferences. We all know what's inside a server. We all know what's inside a computer. Then we get down to the ethernet port and we'll jump over into, you know, what's listening on those ports. In this case we have Apache and SSH listening. And here's what we're here to talk about is the Unix system. And they're the gateway into the Unix system over the network. And then we've got our daemons of processes running and applications behind that. And down at the bottom we found these little things at really small scale climbing around the data center and we think the NSA made them. And all of that complexity, all of that mind boggling stuff, just to pull up a web page, right? Pretty wild. You know, this stuff can be more formally referenced in other ways, like OSI model. But I like my little idea of this. Yeah. And we all know about hardware. Not worth talking about. Hardware is getting smaller, faster, cheaper. Like those little things next to the matchhead are embedded web servers. Stuff gets small and cheap. So in all of this, let's focus in on the Unix. This is my diagram of Unix for the day. And it looks wild and complicated when you first stare at it. But then after a second it looks kind of familiar. See a bunch of familiar Unix stuff. And it can be broken down into something even simpler. You know, your system ends up being your user land kernel devices, at least in the way I'm talking about it today. And those things, though, break down into stuff that we're familiar with. User bin, user local, you know, home directories, that kind of stuff. Device nodes. So, you know, our world is complex. And it can do a lot with it. System administrators tend to think stuff at scale where a given system is just one unit. So let's look at it as a simple thing.  This is one other little part of this exercise. Trip out for a second for the math heads in the room. Mandelbrot fractal, Julia set. And as we scale through stuff, again, we're noticing all these patterns. It's the whole deal, right? This gets really trippy. Just kick back and enjoy it. You know, so look at this stuff. Start looking at our natural world and the world that we create, our world. And if you start applying similar principles, hey, man, get into virtual unixes, too. Why can't we, I don't know, do fun stuff at different... You get the idea. I'm going to go faster through all this stuff so we can get to the meat. Okay. Now, look, these ideas, like virtualizing stuff, virtualizing your operating system, the stuff's not old at all. Okay? Unix in the first place was designed to be a time-sharing operating system. All right?  To overcome this inefficiency so many people could use the machine, time-sharing was developed. The obvious next step was to allow each person to run several programs. Unix is one of the multi-programming operating systems that now lets each person execute several programs simultaneously. But the usefulness of multi-programming was restricted by the existing terminals. Then the first multi-programming terminal was built. Okay. So then we get Rob Pike talking about the... I've got this whole movie if anybody wants to watch it sometime. You get the idea. So, what kind of real-world context warrant virtualizing the entire operating system? We already run, you know, we have multiple processes we're threading. That's all pretty advanced, little stuff that's mature. But what about the whole OS? Why do we need to do that? Okay. External security threats, why we're all here, making development messes. But the real focus of why Jail was created in the first place is to deal with the problem of mutually untrusted users.  Right? That's what you usually think of with mutually untrusted users is, you know, us. But, you know, really it was designed for these mutually untrusted users. A bunch of people using computers for various purposes. You know, why are these people all sitting waiting for subway train? Why are they mutually untrusted users? Well, the guy on the far left, he is not to be trusted in that woman in the pink jacket's kitchen. All right? He doesn't get to touch stuff in there. And she's not to be trusted with his motorcycle, conversely.  But this is why we're here. We're here to talk about hackers. Here's a bunch of them at Shmucon.   They wouldn't stop using Telnet.  We all know this. You know, like, this guy's barefoot on a ladder in a pool with an electric drill, right? And users have funny user interface requirements at moments and funny habits. And sometimes users are just outright abusive with the media. Right? Yeah, users get abusive. And some users just that's how they do it. Then you get into cultural clashes, right? People have different ideas about how, what's cool and what's not. Like in India, they love rats. In New York City, we do not. Okay? And, you know, you have mutually, programs are mutually interested users. Two bugs.  And some of the worst mutually interested users are professional sysadmins. Muscle memory kills. We all know this. We make the worst mistakes and the most mistakes. Cause we're doing this all the time. You know? So what do we do when shared infrastructure? Like, if one person blows up something with shared infrastructure, everybody using this shared infrastructure is affected. Right? How do we mitigate this problem? How do we deal with this in some way that, you know, all users can be always doing what they need to be doing? Well, we lock down machines, right? It's not fun to work on machines that are so heavily locked down. We really cumbersome to do simple tasks. You can't run all the software you want. This isn't a way to manage everybody to keep them at the point of a gun. Right?  I still think it is fun. Alright, one more last little thing is if you're maintaining a lot of old junk, Jails are great. So this rack with all those one gigabyte scuzzy hard drives is, you know, I've got three web servers, a local SSD and sCache file server for two people and two dev servers. It's a lot of juice. You know, all of that stuff could be shoved into a nice brand new high density 1U box and you run a bunch of Jails and we've got all of our isolated systems. And hey, get another one and it's redundant. Alright, so let's get into nitty gritty. What is a jail? Jail is a part of FreeBSD. How many people in here use FreeBSD? Yeah, alright. How many people use OpenBSD? Yeah, cool. A lot of BSD people around here, right? Great. What is Jail? It's a user space utility like if config. Alright, real simple. It produces a virtual system image and this is process tree based. Okay. What is a Jail system call? Well, it's a system call that Jail uses and it calls CHroot and attaches it to an IP. Pretty simple. And it's very few lines of source code. What Jail is not, it's not a classical machine emulator. Like, if we have time, I'll get into more of them at the end. It's not CHroot. Okay, this is commonly misused vocabulary in other UNIX cultures. OpenBSD people. Stop calling CHroot Jail. It's really annoying. Please. It's not CHroot though. It's something completely different. Great users for Jail. Hardware resource sharing. You can securely separate on trust the user's processes. They're great for learning, development, testing, hacking. You want to test your new root kits on some safe environments?  Insane, high availability possibilities. Moving jails around from machine to machine. Cool for honeypots because you've got a God view of a system. And they're really cool for highly vulnerable network services.  Poor users for Jail. You don't get a kernel in a Jail. So if you got to do anything that requires dealing with a kernel, you don't got it. You have limited network and device interface access. And, you know, poor users for Jail is like when CHroot will simply do the job. Like Bind on FreeBSD, you have some simple flags in a C startup that, you know, just start buying in a CHroot environment. It's not really worth building a full Jail for that because you got to build a whole OS. And note really, note worthy Postgres does not run securely in Jails because Postgres uses, this one's a real annoyance, uses system 5 IPC calls, shared memory, which totally borks the whole idea of, you know, keeping jails separate from each other. That's a Postgres thing. If anybody wants to talk about it with me later, I'd love to.  How to Jail. Okay. Look, the definitive instructions are in the man pages.  You know, but it's real simple. Three steps. You compile your FreeBSD user land from the source code somewhere on the host machine with some minor tweaks.  Just like throwing flags at if config or something else. Practical comparison between a Jail system and a regular computer. Pretty much the same thing. Over here we've got, you know, a device node that's been hidden from the Jail. We have no kernel. And other than that everything's there. So let's make a Jail. This is the best way to talk about how to really secure and break Jails. Our host machine is a FreeBSD 6.1 machine. Preflight, we are going to get our source to build with. CVS up is a great mechanism. If you're not familiar with it, send the FreeBSD handbook. You can just get the source via FTP or whatever on disk, on CD. You make somewhere for the Jails to live. So you have to think about where you're going to put them on disk. Putting them on a partition that takes most of your system and is just there for Jails is a great idea because then, you know, waste all this space with a whole lot of, excuse me, then you lock down the amount of space your Jails take up and separate that from the host system. You want to make somewhere for Jail related start and management scripts to live. Comment on starting Jail from RC. There's stuff in the system to start Jails from RC. This is bad in most Jailing contexts. This can thrash painfully. If you have say 50 Jails on a box, 100 Jails running on a single piece of hardware, and a couple of them are having some kind of problem. You have to power cycle the machine. If you're having problems with those Jails when they're all starting up, they're going to bite you and it's really painful to untangle how and why they're barting you especially when they're bogging down your whole boot process and your system. Later. Let me see. So, pre-flight. Here's the man page from the Jail. Here's the first important lines. We're going to keep those up in the corner as we do this. So, we're going to suit a route. We are going to figure it out where we're going to put our Jails. Okay, our local Jails. Gravy. We're going to make a directory for our first Jail to live in. We're going to call it Chick and our host is Chicken. So, we just found user, local, Jails, and we're going to put this directory in there for Chick. Now, we're going to change to user source. Here's how you get your source, CVS up, or FTP or whatever. We've got our source. And we're going to run Make World with the destination directory being the directory we just created where our Jail is going to live in the host's user land. Alright?  And so, what do we just do? We made our directory and we just populate it with the base user land utilities in our operating system. Now, we're going to mount Dev. We're going to mount our devices and real quick there's an old, little old trick when we mount Dev to, it's an old school thing from previous D4 where you soft link a kernel. It's not on the man page as a requisite, but nobody was sure what you would do. Like, we don't have something called kernel in the root directory of the server. What kind of problems could that cause? Well, none at the end of the day. So, you don't have to even put something in there that looks like a kernel, but not a tradition. Why not? You could actually compile and put your whole kernel there but in the case of making honey pots, for example, where you'd want something to look like it's for real. But, you don't need to. Let me see. So, yeah. What do we do? So, we mounted our device tree. One other comment. You can hide a number of devices from your jailed system so that you can't see, for example, all the disks you have in your system or all the network interfaces or all of whatever on your system by throwing flags at the mount commands for mounting DevFS. So, pre-flight. Common question. Why isn't this apart all automated? Why can't you just push the button and go make it? Well, because God knows how your system set up, how much disk space you have, where you're going to be putting these things and then in just a second we'll see that, you know, you've got to add users to your system before you can do anything with it. You're working with a headless virtual machine. You need to do some configuration that's specific to you. So, this is all stuff you just got to do. And stuff that you can script out for yourself very easily to automate. So, we're going to configure the host. If config, we're going to add some things to rc.conf in our host so that basically what you want to do on your host is lock down anything that would listen to, that would bind to all IP addresses on the machine. You want to bind everything just to the host machine's IP address. So, common sense here. You just, you don't want something listening on IPs that could be listening from jails. Let me see.  That's all on the man page. Then you want to configure your host's SSH statement to only bind to the host's IP address as well. Because then you get into this condition where if SSH dies and you chill the host could be answering on that IP address and it gets real confusing. So, you want to just be real, real careful on the host machine when you're configuring it, real minimal. And then we're going to configure the jail. So, we're going to call, make the jail call. This is the man page again and we're going to do a bunch of stuff in it. We're going to follow this list of simple things that are the same things you do when you install and create a new operating system. So, we make the jail call and suddenly it's kind of like it's kind of like a single user boot on a machine. You just got a root shell in this jail and nothing's running except your process. Except the shell process. So, check the host name. We just gave it, you know, chick.diverseform.net If you check who we are, we're root and we're in the root directory. We're going to run system install and be lazy with this, but also to see that, hey, the program just runs just like a standard and free BSD install. And go through setting a root password, adding users to the system, and setting your time zone. Ta-da! Network services. We want SSH to be running. We've got to figure out a way to get into the jail, right?  It's got no anything. We need to have an interface to it. So, hey, SSH, cool. And now if we check the jailsrc.com file, we'll see that, hey, neat SSH is enabled. Let's add a few more things. This is all again checklist from the man page. Et cetera, et cetera, et cetera, et cetera. Anything important here? No, not really. It's all in the man page. So, what do we just do? We have all, are usually built devices mounted. We just populated this with specific data. Our users added ports if we needed to, added other softwares, whatever we need, just like we're setting up a stock brand new system. So, we're almost there, right? We configure it, we call a jailed let me see, yeah, we're finished. So, we exit out of that shell, the jailed shell, and we're back in the host machine, chicken, and we're going to add our IP alias. We're going to give chicken .200 address, following again the man page. We go through it, it's got 200, our host has two. We're doing pretty good. Now we're going to mount the process file system in jail, so that jail has a procfs to use, and there it is, mounted. So, what do we just do? Mounted proc and gave our host machine an IP address for this jail to use. So, start tangent. Here's a script about starting a jail. It's pretty easy to walk down the script to see how simple it is to start this thing. It's easy so you don't have to keep typing the path to your jail to just define it as a variable. Define the IP address, define the host name, and we just mount, make sure we've got our IP interface. We mount devfs and procfs, and we just make the jail call and run RC. So, the jail booting process starts after init and at RC. And here we go. So, we're going to make the jail call. Here's the start. We're just going to start it manually. Does everybody understand the line that they're looking at that's highlighted in red? Pretty simply. I mean, we've got our jail, our path to our jail, a host name for the jail, the IP address we're going to bind it to, and we're going to use a shell to kick off RC as the process is running inside the jail. And kaboom. Here we go. We hit return. WEMO. Hey, this looks like starting up a freebase demachine for the first time. We need to type a bunch of random junk to generate entropy so that our system creates its first keys. If anybody's, you know, going to record this and wants the image of this jail so they can crack the keys on that later, just give me a holler. And hey, it started. Wow. And it started and that looks like any regular boot demessage. It started SSH. Important so we can get into it. On the host machine if we execute command JLS list jails, we suddenly get this little return of the jail, the IP address, the host name, and where it's living. Nifty. So let's SSH into our jail. Let's get into it. And if you notice the IP addresses changed a little bit in the slides, but that's okay. Still .200 for the jail and .2 for the host. So this is just a regular SSH login. There we go. Ask for a password and we're in. And we have our standard login message that we see scrolling down here. We just logged into the system and we, you know, added that user Ike. Logged in as Ike. The host name is Chick. We are in Ike's home directory. Neat. Alright. There's the computer. And it's just like any new server that you could think of at all. You know, like right here we're going to run top. Here's a video of running top. Like there's all of our processes running. A little send mail that we set up running. Submit only SSH. Pretty simple. Pretty cool. So inside the jail we also have root. So we can do whatever we want inside the jail. Pretty cool. Now that we're inside the jail, how do you know you're inside a jail? This is useful for honeypots. This is useful for a number of things. There's a patch with a URL listed here. Also in the DEFCON CD materials. For how to patch the jails to not ever show that you are jailed. It's a pretty simple patch. But if you're in a jail, SSH control will tell you you are or are not. So let's exit out of that SSH connection and we just walked out of the jail. Will be. The jail is still running. So from the host how do we find processes on the jail? This is from the man page. Some flags you can throw at PS so that you can find the jail based on its jail ID. And the jail ID, just every time you start a jail it just keeps stacking a new integer up on top. So the jail 1, 2, 3, 4, 5, 6, 7, blah, blah, blah. But there's all the processes that belong to the running jail. Pretty simple, right? Now if we want to kill those processes from the host system we want to effectively stop the jail, shut it down.   Another thing we want to make sure and do is unmount those proc and dev FS mounts. That's a common mistake that trips people up because they will very silently stack up and you'll have several mounts of dev and proc FS in the same place. Which will only cause problems for applications intermittently and in very weird and surprising ways that you may not find for weeks or months at a time. That's a little gotcha. Okay, so we're going to use the start script that we were looking at earlier to start the jail. So that's way it's a one line start. And really at the end of the day, let me just say something off to the side here, it's really, really important to treat your host machine like a platform that you never touch or log into or use for anything other than running your jails. You only want utilities in your host machine that are for the purpose of running your jails. You do that, keep really hardcore uptime, which you can absolutely do with FreeBSD, then suddenly your jails are the things that you're always dealing with starting, restarting, stopping, running applications out of. And it ends up being a consistent platform. Okay, so we're going to start our jail. Boom! We've got that shell script, so we go for it and there it goes. Started. Really, really simple. And again, there's SSH started up as part of the process. And there again are our processes as seen by the host system. Now JLID6. Pretty cool. So running processes. We're going to use JExec right here. JExec is a utility that you can execute a process within the jails process tree. So right here we're going to run PS to get the processes from the inside of the jail. Using JExec, let's bring it up right now, is generally a bad idea in a lot of contexts. JExec makes a call to a low level system called JailAttach, which basically anytime you're executing a process that's controlled by a process on the host that you're executing inside of your jail, that right there is a vector for something in the jail to escape the jail and get out of the jail. So if you do something with JExec to something that's been compromised or set up for you to do in the jail, like if you commonly grab some kind of file out of the jail and your jailed user finds out about this, they could craft something very malicious for your program to return to your host system. So you want to use this intelligently. Let's see. So in this case, if PS had somehow been compromised and changed around, tweaked, in some ways take advantage of the JailAttach call, it would be screwed. So also in the host's process file system and in the jail's process file system, the status file contains as its last field the host name of the jail of the process which runs or just a dash for all the rest of the processes. A lot of people who don't run jails in previous days don't even really think about the dash. So back to this comparison, the host can see all the processes, the jail can see its processes, and when you look at a given process on host, in this case, what are we looking at? I think I'm looking at SSH on the host, SSH in the jail, and SSH name in. The jail has the host name as the last item in what's returned. The host has a dash, wild excitement, tedious details. Also in PS, you'll get a J, if a process is jailed or not. So you can do all kinds of things to script this stuff. Does everybody get it? Everybody gets it. You get your virtualization. Okay. Excuse me. Is there any way to stop that process information? Yeah. Patches to the source of free BSD. I would actually email the guy who did the patch before to dis allow host SSH control information leak because that guy does a lot of honeypot stuff and he may have already done it basically. So we get it. So the best practices and opportunities. Okay. And while we're with the metaphors, anybody who knows who PHK is ever thought of the similarity here? I did. Okay. So first and foremost kind of idea. Nobody's broken out of jail yet. PHK would love someone to do so. He wrote the jail feature originally around 98. And in conversations and just kind of discussing this with him, he kind of feels that I would agree that it's still kind of an esoteric thing. Like there's not a critical massive of Unix or BSD users who are running a lot of jails all over the world. So maybe it hasn't been a real big target for people. But the things that it's built on with your CH route and your TCP IP stack on free BSD sure as heck are. If someone breaks out of jail PHK really, really, really wants to know about it. That gets him really excited. So best practices SSH indoor jails to manager processes. We already got that. You can always see the jailed file system in user land from the host server but be careful when you're tiptoeing through your jails because you got a lot of things that are soft links and all kinds of other stuff that are part of your stock operating system. Like can anybody in the room yell out what slash home is on a free BSD system? Like what actually is that? User home. Right. Soft link. So if you're tiptoeing into user home in your jail, that and you have the same perhaps user name like I've got Ike in my jail and maybe Ike in my host. If I go tiptoeing into that, suddenly I could do something to a bunch of files on my host machine when I meant to do it to my jail. So it's a really bad practice to really spend a lot of time doing stuff to your jails from the outside. So you design your jailing system carefully and be creative with core UNIX utilities. I mean there's how many stock system calls? What's the cut? 1200? 1200 stock system calls. That's a lot of stuff. There's a lot of utilities in there. You can do anything with what's in the box. Batteries included. Use your highest secure practices for your host server. So this means everything, everything, everything.  This means every kind of lockdown you can possibly think of, apply that crazy hardcore painful rigidity to your host server so that you liberate your jails to really be used and not be locked down that hard. Okay? So great utilities. In FreeBSD4 it's really worth mentioning or anybody using that JPS, Jkill, Jtop, they're all imports. They're kind of pearl based. They've got some rough edges, but boy they're useful. Five and six onward, built in, PS and all have jail flags. Plus, JLS for listing jails which we've seen. J exec, 10 minutes. Wow. J exec for excusing stuff in jails, day attached. I'm going to jump through some of this because he's going to read this stuff. Additionally handy or other stuff. Look common weak points in jails. Host name lockdown. If people change the host name of their jail this can get real confusing. Say they know the host name of another jail in the box and you're doing something where you're trying to either stop or start a jail and you don't know which host name it is now and things can get very, very confusing. So you can lock that down. Other things, resource attacks, partitions, disk images, another one, fork bombs, memory hogs, there's solutions to deal with that. Direct, which we'll talk about, direct diver access, flags to melt, FFS and PROCFS. What about this stuff is unique to jailing or this virtual machine environment. Like this is a bunch of special stuff you've got to learn and deal with if you're going to secure your jails. The only thing that's unique is host name lockdown. All the rest of this stuff is classic UNIX stuff. All right? So you don't have to learn a lot of new stuff that's going to be just specific to jailing if you want to run jails to run virtual machines. Comments on isolation. We're going to start whipping through all this stuff. Cool thing called the open route project that a guy named Evan Cermanto did. People talk to me about that later.  And there's a number of ways to mitigate them. Let's jump through where they come from. Okay. So process attacks. There's something on the DEF CON CD that a friend of mine, Brian Redman, gave me to use in testing out jails. He made it a long time ago. It's called hog. It's a few lines of source code. And what hog does is hog just a certain chunk of memory. Real simple little program. Well, you can create a fork bomb by running a while loop and taking a hog, in this case hogging 99 megs of memory. So this is going to fork off an infinite number of processes all hogging 99 megs of memory until swap is, you know, burning. Well, you can lock this stuff down. Brian, here's where Brian made it. And he's blown up a lot of really big systems with this little piece of code. Memory and process attacks. Here's how you deal with it. You just lock down maximum processes and how much memory gets used by the processes. And let me see. Then you want to set immutable flags on the file. And then you could start up the jails themselves in a higher secure level so that those immutable flags root can't change these files, these very special files. So root becomes a little less than root, but in a trivial way for most purposes. Or you can actually set the assist control variable on the host machine so that no jails jailed root can change flags on a file. Change immutable flags. Honeypots. Okay, so this is that little comment on honeypots. We already talked about disk resource control. Put at least your systems again on a separate partition to isolate them from your host machine. And file-backed disks are really, really, really cool. Disk images. A lot of people use Apple machines and are familiar with disk images there on FreeBSD and the handbook they call the file-backed memory disks using the MD config utility. Cool stuff. Very simple way to create partitions without truly creating partitions. And they're fast if you compile them into your kernel. Which is a pretty simple little flag. And we won't get into how to use them because the FreeBSD handbook does a great job of telling you how to use them. Automation.  If you're deploying stuff to a lot of jails, updating jails. You want to be aware of your Dev and Proc mounts. Be aware of SimLinks. And you can also use FreeBSD ports. Hey, cool. You can... Let me see. Oh, not for the ports collection, but say you're in a big enterprise environment and you have a lot of specific custom jails you want to roll out. Like, you know, hundreds and maybe thousands of jails in various environments. Well, you could actually use the ports mechanism not taking and putting a whole jail in the public ports tree.  But here's my custom OS. No. But, you know, in a big enterprise environment it's worth actually looking at how the ports mechanism works because you could deploy all kinds of custom jails using ports locally. And then you can also stuff stuff in CVS or Subversion. Upgrading's really cool. You could just use build world. Upgrading's cool on FreeBSD in the first place.  I just looked at the time. I'm going to keep moving on faster. It's in the handbook. It's real simple. Anybody has questions, ask me later. syscontrol.com. There's a bunch of syscontrol variables which are important, like set hostname allowed, right? So that the jailed user or rude can't change their hostname. In ForcedatFS, this is so that the jail can see only particular details about file system mounts. By default, the jail can see all file system mounts on the whole operating system yet it may not be able to touch files on them. This is a bad thing. This is information leak. Like hey that guy's jail is on my machine too.  Now I know that. So you can lock this down to a point where your jail has, can just see its mount points or see none. Allowing raw sockets for ping etc etc. All of these things have consequences and they're pretty self-explanatory. Access to routing sockets. System 5 IPC allowed. PHK put that in so we could run Postgres. Thanks man. It's a pretty insecure thing though. And CH flags allowed again getting into whether or not the jailed can change their stuff. And then of course whether or not we're jailed. Firewalls moving on. You can't run a firewall from inside a jail. You want to talk about it? Talk to me later. Start script with the disk image. Well there's a few lines added for all of this stuff. Some little miscellaneous for crontabs just so that your logs get really really nice and quiet inside of your jail because you don't need to save entropy and you don't need to adjust the time and it will just work and log it. Miscellaneous gotcha. You want to make sure that you change flags if you're trying to remove this jail directory. Quick words on true virtual machines. Look this is from the VMware catalog, excuse me from a brochure of VMware's. Here's a structural comparison. VMware's are really classical virtual machine and there have been a lot of them over the years. A ton of them. VMware's a popular one nowadays. And a pretty good one. A lot of people use it to run stuff. Well you got your OS, your hardware, your OS and the software that virtualizes the machines that then get loaded into it. Very different model from jailing where you just have your hardware, your OS and isolated processes. So once you get that, let's look at attack vectors real quick. VMware's got a couple problems that jail doesn't in the context of creating really secure services. One of them is, hey, your operating system is of course a risk and that's a risk in all cases. The software itself is something that has an unknown developer headcount and it's closed source. Which all of those issues well those are discussed in a lot of other lectures here. In a similar vein though, if we want to talk about attack vectors for jail, people need to really root, they need to really crack CH root and TCPIP sockets on jailing. I'm getting the kill switch here. So I'll just finish this sentence and kind of flip on and go. So at the end of the day basically what I'm getting at is a lot of people in the world rely on FreeBSD's TCPIP sockets and CH root. Therefore there's a lot of hands working on jail without even knowing it. Then we get into Slayer zones which by the way are being used in capture the flag this year. They have little problems that can be overcome but zones are cool. Zen is a whole other ball of wax which you don't have time to talk about. Then you have Microsoft doing things with hardware virtualization, bad bad bad stuff. So look, here we are. We're almost to the end. So look, at the end of the day jails are this really simple thing that you can combine with anything else on your BSD system. Which means a lot of other really cool technologies that are upcoming that just work with jails. Because they're all modular, independent isolated things from each other. So with that stated you can do a lot of really cool stuff with jails. We missed a lot of fun stuff but that's it. Look, quick key special thanks to Winermute. I mean who taught me to jail in the first place. And reality. By the way, by Winermute a drink he's up here. And also PHK and Robert Watson. There will be stuff, a rata from this that didn't make it on the DefCon CD like extra slides, up a nice bug website in the library and I'm Ike and thank you all very much. There's that.


Good afternoon everyone and welcome to the really long title that's around blockchain and health care My name is Jim St. Clair. I'm the executive director for Linux Foundation Public Health And I'm very pleased to have four of my friends here today to talk about both health care as an industry and life sciences As well as implications for blockchain and I think just get into some of the details Great question. Perhaps opposed everyone Is there anyone here that comes from a health care background or associated with health care of life sciences in your business practice? Great fantastic one two three. Yeah, that's great. The numbers building four got a good one. Yeah, it's standing good Good five. I said five snuck in there. Do I get six? I want six everybody got six on the floor Yeah, it's good. Absolutely well great Well, so this is intended to be informative as much about the wild and wacky world of health care and life sciences Which are commonly associated with one another but really constitute huge industries on their own And then of course those aspects of blockchain from an architecture from a decentralization from this standpoint with that I'm going to turn it over to me to my panelists in La Florida introduce yourself and pass the mic down and and talk to everybody Okay. Thank you. Jim. Hi everyone. Nice to see you all. My name is Flora Nanda. I am from Pfizer I am the technology and process lead for Pfizer and one of the main focus of technology areas is blockchain So we have like different projects. We are part of different consortium which are our external initiatives and We have in internal initiatives as well. So Before Pfizer I am in this corporate industry for quite a while I come from semiconductor hardware manufacturing software licensing and as well an academician So I have a long career. So when you come to blockchain I kind of understand the pain point cross industry as well though. I'm from healthcare or life sciences right now Hi, I'm Sophia Lopez. I'm one of the founders of collido a web three infrastructure company. We've been Very focused on helping enterprises adopt what three technology over the last five years Prior and we run thousands of chains for cross industry So but healthcare has a special place in my heart Just because it touches all of our lives and then also I had the privilege to work in that space I was at IBM for 10 years. I'm an engineer by training, but I actually worked for two and a half years Just you know with clients trying to bring Bring technology to help solve their problems work primarily with providers in that role, but A lot of interesting things going on even even back then in the healthcare space So happy to talk about what we're seeing in web three and healthcare Thanks. We have a great mix of Perspectives here. My name is Alan Bachman. I'm an identity practitioner and research architect over the last five years I've explored supply chains B2B and identity and my views today will be my own and not reflective of my employer Hello, my name is Charles a coach who I work for a small book store Call AWS Amazon Amazon now for about three years I run global business development for our Amazon managed blockchain service and also quantum ledger database So we you know, we're seeing a lot of innovation in the space, especially in health care Digital transformations taking place across the industry and a lot of them are looking to adopt blockchain services And you know, so I'll be happy to talk to you guys about some use cases that we're seeing Being adopted Great and Charles since you you're the last one over the mic I'll kick off with you for questions sure as we mentioned before we even get into the blockchain aspects of it Just provide briefly to the audience your perspective on some of the challenges that you see health care industry life Sciences is wise and then of course share with everyone else. Sure. So I think you know initially, you know When block chains started becoming, you know Adopted, you know, a lot of the challenges that we saw are focused on creating cost consortiums and you know for to allow different health care providers to share information and so there have been some Challenges as far as you know getting different organizations to work together and and that's kind of where we saw a lot of resistance But over time we're seeing more adoption and not in for a hybrid model where some data or some information is stored on private chains and then using public chains for more, you know information that's can be Anonymized or allowing for a faster adoption for from a customer perspective. So in decentralized identities one area where that's We're seeing a lot of interest to allow, you know Patients to store their data and also have control over the data and you know and share the data and give access to Patient data across public chain. So that's we're seeing a lot of increased usage and increased adoption in that space. I Think an area, you know, that's a simple But in a consideration that should be emphasized when you're starting out just so that you don't get stuck is Focusing on alignment. So the first part of alignment is getting people together to talk about this is what the technology can do What it should do What's the hype around it? Let's you know get past the terminology and then the second part is look at What the group needs, you know identify the basic common Shared services that you need Focus on creating those basic shared common Services that you need and then promoting apps that are built in those consortiums to use those, you know shared common services and Hopefully that sticks with everyone because as you elevate your app or you know, go forward You want people to have trust. So Anything that's built in a dev set gop or repeatable manner that's been scanned and has had transparency You know will accelerate software development and confidence I Was thinking One thing I wanted to start with it just looking at least from the shoes of the The folks in the trenches.  So, you know 30-day re-admit Issues are on data blocking. So over the last decade in the healthcare space. There has been, you know drive to digitally transform Obviously moving to the cloud as part of that working together as more of an ecosystem because you have population health You have coordinated care. So you can't have all the data and all the silos like traditionally has been in the industry So I think you know I first start working in the space some a lot of CIOs started thinking this is a good time to retire Because we've got these regulations We've got You know fees and penalties if we don't comply So how can technology help us and and you'd see often in a lot of these organizations, you know They were buying packaged apps and didn't really have the skills to to deal with some of these new challenges So I think you know that applies to now looking at Web 3 blockchain digital assets, you know, how do you get the skills internally to do this? You know try to avoid Focusing on the real problems of bringing multiple parties together and solving issues like what can we do? That's a common shared service working together versus everyone trying to reinvent the wheel But trying to stay a couple layers above just, you know, the technology itself and and how could they move quickly and show real business value? Yeah, I agree with all of them I would I would tackle this question in a different little different way over the years with working with different business use cases and blockchain technology We categorized all the problem areas into three groups from the life sciences perspective one is from the health data Second one is clinical trial and third one is supply chain When it comes to health data, it sounds easier than done It's very complex all the way from collecting the data storing the data processing the data and who owns the data, right? We just I was listening to this Cali health down and everything so true the problem is so that is one challenging area We can use blockchain to solve some of it But we need blessing from the ecosystem partners and all of it The second category is clinical trial starting from the discovery phase all the way to marketing post marketing survey real-world Evidence everywhere. I see where the technology can fit. There are challenges, but there are opportunities as well using this technology And supply chain everyone knows about supply chain. It's multiple parties. It's the good transfer through multiple hands. It's a low hanging fraud But technology adoption wise there are many challenges. I would not talk about this one like multi-party bringing everyone on board And adoption of the technology. There are many technology providers, but who is buying it, right? Who is consuming those ones? Those are the main areas we have to look at. So that that is my perspective Great and floor if I could pick up from there since Sophia opened the door and digital transformation Kind of everyone's thoughts on where your organization's a digital transformation journey and what are these things to consider? Okay, that's that's an interesting question. Yeah So everyone is talking about digitization and digitalization So I got to understand recently that there are two different concepts digitization is automation Digitalization and changing the mindset as well as the automation So from from the digital transformation perspective. Yes, the mindset is there. The culture is gradually changing the leaders and Management team are trying to put together teams that think in the digital transformation way. I would talk specifically about blockchain So there are many technologies out there. I would compare blockchain with cloud AI ML and all those technologies Cloud and AI ML got their adoption but blockchain from the enterprise perspective struggling a little bit That is because like it's a multi-party business not a single party I cannot simply say that Pfizer has a blockchain network running its own note. That doesn't make sense So we are not not yet there But what what we are planning to do here is like we can go towards public blockchain And try to think of some use cases that we can go alone So that that would be a faster route to adoption but digital transformation is pursuing agile methodology product management All these things are coming to Enterprises so yes, we are out there. Maybe next two three years All organization will be digital transparent I must tell the same things like I always closely observe the market the work force that market is looking for right now I get requirements like Digitalization of sales organization Digitalization of quality organization digitalization of marketing organization So it's good to see and these are very business focused with digital strategies. So our organization is also out there One comment I was reflecting when you were speaking is you know, if you just look at digital transformation and organizational change, there's Well-known change management specialist John Cotter who said 70% of organizational change initiatives fail So a lot of times people will look at the technology but it's not the technology. It's the people and the processes So, you know, he has a number of principles that help make you know What are our principles that might guarantee a better chance of success and one the first one is you need a burning platform People need to be a jump from where they are because their feet are on fire So we did see that with COVID. So, you know, we collider runs networks across industries and You know in the insurance space, which is Probably just as mired in compliance and regulation and legacy systems as healthcare They told us that their digital transformation roadmaps accelerated by decade and we saw that they and they were doing really interesting projects There's actually one consortium. That's over a hundred years old They have 24 different projects going on industry working groups with the across life and annuities property and casualty reinsurance Doing things like creating a master death record in the US. We did, you know when COVID was happening There was no way, you know people you're asking the widow Who's seven-year-old husband passed away to take a paper copy of the death certificate to the bank to the funeral home And get like 15 copies of these in the middle of a pandemic. So I'm that's pretty crazy So nationwide prudential and others said we need to come together to get solve the shared data problem across industry And that's what blockchain is really good for, you know digital assets now layer on incentives with tokens So there's a healthcare network that many of you are familiar with called synaptic that we work with and they use tokenized incentives really is a data monetization Play that if you contribute data or you update data you get paid You avoid the tragedy the commons other people who are not participating not contributing They'll have to pay to subscribe to that data and in other cases we see instead of the fungible tokens and non fungible So documents like powers of attorney, you know as you're digitizing I didn't actually know the difference between those two. So I love when I learned something new So digitizing these very paper-based manual processes, you know Now you can represent something with global identity with these token standards And, you know, there's a group of 200 insurers We're working with around the surety bonds and their power of attorney represented with NFTs or things like credentialing in the space as well So it's a lot of interesting developments but a lot of it's trying to put the easy button into technology and letting people focus on some of the Organizational business legal issues of getting Multiple parties and ecosystem to work together and I guess in multiple people mentioned I think enterprise blockchain started thinking about solving the frenemies Alan said in our prep problem competition, you know, this shared problem But we're also seeing a lot of enterprise saying hey, I'm gonna participate in a dozen or more use cases So I need a web3 gateway. I might run a node in one network I might launch my own solution and it's really more of just the decentralized app that people can access Might be to see could be b2b So how can I do that at scale and that's an interesting next evolution? We're getting to what people are planning, you know, multiple types of participation across web3 projects So I'm gonna just talk about from like just a generalized perspective and when I look back at you know Open-source projects and how they you know progress The thing that sticks to me is the accountability, you know, how do we add? Accountability to make these systems that we say are trustworthy actually trustworthy Just because it's on a blockchain doesn't mean it's you know, awesome And I look at you know Existing industries, you know, they do know your customer and they do the proofing they do account resolution And if you can not only verify that the transaction on your blockchain is High confidence, maybe not perfect And you can also identify that the people behind it are real. They're not bots or some type of duplicate account Some pretty big things can happen And you can get to some of those, you know root issues that we were looking for the big thing that I see when you have Accountability is the overall trust that you don't have to tell people right they get it they they can see You know what you're trying to do so at AWS we work with a lot of customers who are going through their digital transformation as She mentioned earlier, you know during COVID we saw like a you know Giant increase in customers wanting to adopt blockchain for you know, COVID Vaccine tracking, you know for certifications and lots of our two or three projects and We also see for you know supply chain like as you mentioned earlier but not just tracking the Those location and but also tracking the chain, you know tracking the condition for instance COVID vaccines require, you know cold storage So, you know, we see all that we saw a lot of implementations of you know using Temperature sensors IOT devices to track and storing all that information on the blockchain So that's actually led to a lot of other conversations that we're having with traditional, you know healthcare life sciences companies for in things like patient consent tracking and other use cases another very interesting use case like you mentioned was for incentivizing patients or help, you know to share the healthcare records for or Ensuring that they're leveraging or taking taking their doctors advice, you know taking their medicines and offering them tokens So they can be paid so the law very interesting use cases that we're seeing And it's definitely you know as in the Elka industry. We get a lot of you know customers asking what their competitors or their peers are doing and you know they want to you know do a POC or some sort of Pilot to see if they can leverage it. So that's driving a lot of adoption of the service across the industry And Charles, I'll just pull in that thread for a minute from your perspective AWS We've heard quite a bit so far about things like governance and accountability and building consortiums What do you see for consortiums and consortium governance coming along with Customers as a bedrock to their to their blockchain exploration efforts Yeah, I think you know Generally what we've seen is we when we ask customers You know especially customers reach out to us and say hey, we're interested in doing a blockchain project I mean one of the first things we ask is what which which partners are you interested in working with are you or partners? are you expecting to join the consortium and one very easy to indicate of Whether a project is gonna be successful is if you can identify one or two partners that are willing to join you in that POC if you're not if you can't find somebody you're just gonna build it and hope they come Most likely it's not gonna go anywhere And and we've also seen that sometimes it's best to look at the market leaders or you know companies like Pfizer You know who are who I've already and a lot of market presence And there are lots of projects in that space regarding things like you know settling pharmaceutical claims and you know PBRs which is a pharmacy benefit management and so working with those large those organizations were able to actually you know build You know more successful consortiums, you know going forward He knows too much Yeah, it's interesting there are a lot of different models And one thing I didn't mention actually in the intro so I was at IBM and launched IBM blockchain platform Actually, Chum who's here we worked in the early days with lots of different models I think you had a slide of a lot of these or a member With we're observing the patterns. So you mean there could be an existing consortium So we see that in some industries like I mentioned insurance in the US There's one that's over a hundred years old So they naturally have these sort of working groups of membership and then they're looking at how can they sort of operationalize going from you know a lab and I identify use case project and then graduating the projects up But you can see companies who form a new co or basically join venture so to Charles point People don't like joining their competitors thing. They want to be equals around a table So we've seen some models of that especially like the first generation of enterprise projects and the cautions there are Even if you're well funded by deep pockets Who are each of the members you're basically a startup and then the people who are on that In the new co need to think and act like a startup. You need to be very focused on product market fit There was you know great discussion by one of those consortiums in the member summit talking about what they learned And you know you need to listen to what the market needs and is the problem Solving urgent pervasive and people are willing to pay for it Because you can't have this sort of corporate mindset like there's gonna be some CFO who just keeps funding you and you need to you know You need to you know, you need to be able to deliver value and Not spend like five years reinventing all the plumbing layers and never get to providing value So so those are some different models and then there are people who you know have the industry relationships A lot of this are existing business relationships that now you're digitally transforming There could be things you couldn't do before that you could do now So we have some industries who say we've been trying to solve this for 10 years and now we finally the technology is here and we can do this So there could be situations where there is an industry solution provider and people are subscribing to that service But you know, there's better faster cheaper. They're evolving the way they're working or more like an evolution Or that could be a revolution just using some of the new web 3 constructs. We do see in some of these Networks instead of forming a new co and a legal entity that sort of makes decisions. They stay completely decentralized so they're just an alliance and It's really has tokens It's almost like an enterprise Dow that they're trying to align sentence that way So so lots of different approaches and you sort of have to think about what makes the most sense for what you're trying to accomplish But keeping an eye on What's the product that the product market fit, you know, what's the value you're driving should be what you start with and then You know the technology there's a lot of plot projects were involved with her people don't even know blockchain is delivering the like better, you know product or efficiency and they're getting a lot more traction and you don't need to say Hey, there's blockchain inside because it should get to that across many of these use cases where people are using it Because it makes sense or it drives some additional benefit But not because of the technology inside and I think that's where you know AI started 30-plus years ago. It's gotten to you know It's woven into the tapestry of a lot of offerings today, but it took a while to get there And I think blockchain is actually moving and web 3 much faster than that So that's the good news, but there's a lot of learnings along the way, which is why it's great to be Discussing this with a lot of the industry leaders Okay, I forgot the question maybe it was around consortium Okay, the first thing for us like I will talk strictly from a corporate perspective because we are not selling service We are consumers of the service, right? So it's interesting that you mentioned that we don't have to worry about funding. Oh, yeah We have to worry about funding. So for the first thing we need to do before even jumping into any decision We have to get business buy-in because business is the one who funds all the projects even with the digital innovation The operating model has not been changed though the mindset is changing the operating model to change the operating model It will take a while So first thing is we get the business buy-in once the business is ready. Then we think about the consortium building So there are different models. We follow for example, we can partner with other external consortium with our all our peers and all our Actors like maybe for pharma industry to be wholesalers or the dispensers like Wal-Mart Walgreens in the US. I'm sorry. We are in Ireland. I'm not familiar with the pharmacy system But that is one thing for example, we are in part of pharma leisure where although there are 17 Pharmaceutical industries, we are part of that group as well There is another model that we follow that is kind of startup-led model that is a chronicle and middle-aged model So that start up will get funding from the venture capitals and then the start-ups Responsibility is to build a consortium Then the start-up invites us to join the consortium But remember we have to get business buy-in to join that one because we have to finance our participation as well So that is another model the third kind of model, which is an interesting model like we start internally Then we build a POC in a small scale Then though we invite our peers to join the network in the POC then pilot then then then and then right then scale it In all those models the governance is very important Actually, if we do not have a proper governance the first question we go out and get from our peers or the partners Who has Right to decide who joins your network, right? This is a permission network for the enterprises So then who deploys the court who decide the court change management like Dave say coughs So if we work on the governance from the gate go in parallel So by the time we reach the end of the POC and we are ready to jump in the pilot We have the governance model, but it is very crucial for the enterprise models The last model, which is my favorite model, which I always Advocate for forget about all the enterprise blockchains forget about all the permission blockchains and everything you said wave 3 is Advancing why can't we deploy our use cases using public blockchain? We are talking about some regulatory aspects of it, but it totally depends on what data I'm actually you are putting on the public blockchain. Why can't we build our own use case using public blockchain as? So I am an advocate for that one But as I mentioned, we are we have to get business buying we are not yet there But we are pushing for some public blockchain use cases Interesting enough that there is a decentralized autonomous organization dowels in clinical resource space. They call it decentralized science I think we were talking about that So Pfizer has expressed interest to invest in Vita Dow. It's a public news That's why I am at the liberty of discussing it with the audience So that mindset is there is from Pfizer ventures, which is a very good thing. So that is the first Step in the right direction. So that is where we stand from the consortium perspective Excellent excellent good feedback. And I think we have about five minutes left on our schedule So I want to give the audience a chance. I'm sure there are some Questions brewing that I can I don't there's a mic out there if there's not I'll be happy to bring it over to you For any questions or anything you want to bring up? Okay, no questions. Oh, there we go. One right there. Yeah All right. Hi, I'm John Coltrane. I think we've all met but I'm I'm with polygon So I like the sound of the public blockchain stuff, but I'm curious what the Dow concept What are the what would be the kind of? Operations of the Dow. What is the Dow trying to achieve? I think dowels are a great use case also for enterprises, but just curious what you're, you know How it's working with Pfizer. I'm gonna bring the mic back to you. So you get the recording Okay, so this is this is Pfizer's interest to invest in the Dow as a venture capitalist I mentioned it's a Pfizer ventures interest. So we are investing in this company not like we are Participating in the day-to-day operations are buying their token. I think that token is called Vita token We are not buying that token. So we have a considerable amount. We are investing there But our interest is in clinical resource base, which is the decentralized science concept The concept of this clinical research is like we we will fund the project that will not get funding Otherwise, there are many research initiatives, but they die soon because they don't get the funding The intent of this clinical research or the dowels in clinical research and decentralized science in general is to provide them funding I think Vita Dow is working on some product in the longevity area and we are interested in that one But if you follow the Vita Dow's paper, they white paper, they the use case is very interesting It is not about in the token you buy to get the voting rights because Dow is all about voting rights and everything It's not only the token you buy, but it's the intellectual property as well There is an NFT angle to use the intellectual property getting generated with this research would be deployed as an NFT and You can monitor monetize it in the marketplace selling it or leasing it. So that is another interesting angle So we are interested in the whole concept. So we are in this we expressed interest in investing in this organization. Makes sense Okay, thanks for the question Yes, great question time for one more and no more questions and if we have no If we have no more questions, I'd like you to thank my outstanding panel and appreciate your participation today Thank you


And welcome to Psychic Medium, Tony Green. I am Tony Green. I'm a Psychic Medium channel, and I am ready to get this show started. So, couple quick messages before I get on with callers and answering questions. First one, I'm on every single Monday at noon, unless I'm traveling, because they won't let me do the show from a plane. Why? I'm kidding. Choking. Okay. Second, every single Monday at noon for a minimum of 30 minutes. I try to keep it to that 30 minutes spot because this show does air, this is second, does air WSCS, Roku, and a number of other streaming channels. So the timeframe is that 28 and a half to 29 minute mark, which I always go over. So if you're watching the beginning of this show and you don't get to see the end of it, you can go to my YouTube station and see it on my YouTube station, okay? Third, I'm on most Wednesdays for a second show, which is Relationship Wednesday. So if you have specific relationship questions, please call in on Wednesday and I'll be happy to answer those questions for you. The energy is on today. So we had a full moon on the 18th and it was the longest full moon of the year and it was the last full moon of the year. And let me tell you, people were intense this past weekend. Intense, good, intense, bad, just intense. If you're wondering why everybody was intense this past weekend, it might have something to do with the full moon. Okay, I wanna thank everybody watching on YouTube and commenting on YouTube. I'm going to start taking callers. If I call your area code, please have a specific question or connection available. And put your phone off of speaker and off of headphones to make sure that we have the best possible connection, okay? And you get one question. So make your question count. Don't ask me a question and then say, oh, but what I really wanted to know, then ask what you really wanna know. Cause there's a lot of people waiting online for answers and I'm gonna have to get to the next person. So don't play around with your questions. Don't expect me to guess what you want. I'm psychic, but I'm not gonna spend 10 minutes trying to figure out your most important answer in this moment, when you probably have about seven questions you could ask me. So know what you wanna ask and ask it. If you wanna connect with a loved one on the other side, have a very specific name of a loved one and your relationship to them. And if you have a question, ask that question right away. Okay, here we go to the first caller, area code 860860. How can I help you today in my call? Okay, we're gonna pick one of those. What's the most important thing to you? Now, let me just say for you and anybody else listening, if you have a lot of questions or you wanna know about a lot of areas of your life, that's awesome. I'd love to help you with that in a private session. Right now on air, I take one specific question and I think that's pretty darn generous of me. So, okay, which one is most important? Okay, and okay, so the first thing I'm hearing, can I please ask your first name? Okay, the first thing I'm hearing is there's going to be a move for you at work. Now, this doesn't necessarily mean you're going to move to another company. This can mean a move within your company.  So, I feel like you're going to get a promotion, but it might feel like a lateral move to you, meaning they're giving you a new title, but a lot of the same work. But as long as better pay comes with it, we're good, right? I do feel like there is something brand new coming in for you at work. Now, it's interesting because I'm hearing two things. I'm hearing you could branch off on your own. Okay, I am hearing that. And maybe there's something you want to do on the side or you've been thinking, maybe you haven't even been thinking of branching off on your own. Maybe you haven't thought about that as a possibility, but I'm just gonna say this for you and everybody listening. Everybody wants to hit that next tax bracket. Everybody wants to hit those numbers. Sometimes we just can't do that working for someone else. Sometimes we have to get up and get out on our own to hit the numbers we want to hit as far as income and savings. And if we do the thing we're most afraid of in life, sometimes it will bring our biggest dreams true, make our biggest dreams come true. Okay, having said that, we don't have to quit our day job to start our own thing. Now, I don't know why all these messages are coming through for you. They are, so I'm giving them. I do feel like there is the possibility for you to branch off on your own. And I feel like if you don't do that in 2022, you're probably going to do it in 2023. And it might, it's something that's going to, I'm hearing it's going to surprise you or it's going to take you by surprise when you end up doing it. Now, you might say to me, and I get it, you might say to me, I don't have a career that I can do off on my own. I would object to that because any career we have, we can do on our own, okay? Any career. We can become a contractor, we can start our own business, we can, but this might be something that you're not necessarily aware of right now or you're not aware of how you would start it off on your own right now. But you are, I feel like there is a very powerful potential for you to do something on your own, a business, a business on your own. I also feel like in 2022, there's going to be promotion for you. Now, is the promotion within your business? I hear a yes. I like that. I hear a yes on that. But I feel like at the end of the day, is that going to be enough for you? I'm not sure, that's something you have to decide, but I do feel like you're going to take the promotion. I feel like that might come around, I hear April and I hear June. So something might come around in April and then something else is going to come around that June, July time. I'm just going to tell you, I do not know why I'm hearing this. Every time I talk about this promotion, they go ahead and they slide in this possibility of you going off on your own. Now, whatever that means for you, whenever that comes in, really seriously look at it. Seriously look at it, seriously, because they wouldn't be saying this, if this wasn't something that was pertinent and important for you to consider. Okay, love? Excellent. Thank you so much for calling in. I really, really, really hope this was helpful, even though you might not know what I'm talking about at this time. You are so welcome. I hope I get to hear from you again. I'm going to go directly to the next, excuse me please, I'm going to go to the next caller, 256. 256, how can I help you today? I don't want to take that nonsense someplace else. Whatever's going on there, that's pure nonsense folks. What's that about, right? Let's go to 630, 630, how can I help you? Hi, thanks for taking my call. Absolutely, what's your name, where are you calling from? My name is Dion and I'm calling from Wisconsin. Oh, hi, hi, okay, how can I help you today Dion? Okay, so I am looking to sue a lawyer and his law firm for interference of inheritance. Any information that would help me find the right lawyer to take my case? Okay, so the first thing I hear is you also have to go for negligence. Negligence is pertinent, in this case, the word negligence is very pertinent. You have to go through the buyer association. And I do feel like the lawyer that you are going to use practices both in a neighboring state and in this state, I do feel like whichever lawyer you choose, they primarily practice, let's just say in Illinois and in Wisconsin, but primarily in Illinois. And I do feel like, what part, may I please ask what part of Wisconsin are you calling from? So you're right there. Excellent. I'm in Lake Geneva. Okay, I just, I love Lake Geneva so much. Oh my goodness, I love being there in the summer. It's so nice. Okay, so here's what I'm getting. If this case is in Illinois, you need an attorney that practices both in Wisconsin and Illinois and the primary place they practice is in Wisconsin, but they have the, the, you know, the one thing that I heard about Illinois court systems is that they are very, very, very, very corrupt. And don't come at me. I've heard this from so many people, even attorneys. I've heard it from attorneys. So in this case, the first thing you wanna do is you, I'm gonna tell you something what you need to do here. You need to go to the, and a lot of people will look at this as a lot of work, but if you wanna get done what you need to get done, you need to go to the, what is it called? The attorney general or the state attorney, the state attorney. I've done that, I think that already. But I wrote a whole book about this and published it about the corrupt, law suits and everything like that. Now I'm just after just getting my money back from the lawyer who did all of this. But I do know what you're saying. I reported it to, I've been working for FBI and they didn't even care. I've been away everywhere, you know? Okay, so what, again, the Bar Association and make sure, okay, so when you report this, you have to bring, here's the thing that it's very emotional and we think that if we put our emotion in it, it's going to affect people and make them wanna look at it more. Not always, you have to be very factual about this. You have to be very, these are the facts. Here's the evidence end of the story. So when you report this to places, you have to just state the facts, okay? The attorney you're going to use is primarily in, is able to practice in both states, but primarily here, but understands the way the court system works there. And the reason you need somebody who works in both states is because I feel like, you know, what I'm hearing here is the attorney that did this, they're part of the old boys network and they know a lot of attorneys, the good attorneys won't go against them. So you, I do know of some, I do know of some attorneys that might be able to give you actually a great deal of my, some of my best male friends are attorneys and I can give you the number of one of them that will be able to give you, if they can't help you, they'll be able to give you a referral to somebody that might be able to help you because sometimes you just need that person that can get you to the right person. So I'll, if you text me, eight, nine, four, one, four, eight, nine, seven, two, eight, six, nine, I will text you back one of their numbers so they can get you to the right person, okay love? Yes, thank you for all your help, I appreciate you. Thank you. My pleasure, I'm going to go to the next caller who is 504, 504, how can I help you? About either a memory or an event that's either happened this lifetime or another that's creating my blockages to manifest or clearly speak to the other realm and clearly because nothing is coming in clear. Okay, is your question, did it happen in this life or the past life or is your question, is this going to be released? Or memory, that is. Okay, that's a statement, what's the question? There's a memory or an event. No, that's the question. Okay, you want to know what the memory or event that is creating your blockage is? Creating the blockages for me to manifest. Okay, I'm so sorry. Okay, I'm just going to say, because you say manifest and then you say connect with the spiritual realm, those are two different things. So, and then you, I know that this is probably something with me that is not comprehending what you're, I'm sorry, I'm giggling when I get nervous, I giggle. So, and I'm not, I want to make sure I'm understanding what you're trying to say to me. And so I'm going to repeat this to you. And if it's accurate, please tell me yes or no. You want me to tell you what the memory or event is that is blocking your ability to manifest? Okay, I get the first thing I hear is that it's a belief system, not a memory or an event. Now, belief systems are created in our childhood or they could be created in a past life, but this is a belief system and I'm hearing this is a belief system that you were brought up with. So, if we're talking about manifesting, then what I'm going to tell you is something you learned in your childhood is prohibiting you from moving past the mark you're at. So what I'm going to do now is I'm going to do a clearing for you, for everybody listening, for everybody re-listening and this clearing is at the 18 minute mark. And we're going to clear anything blocking or stopping us from manifesting the best in life. Let's clear all of that away. And the other thing that I get for you is you, there's this almost the word I hear is guilt. Now, this can mean a million different things to me. What it means to you is what it's going to mean to you. And I'm going to tell you that when we have guilt, no matter why we have this guilt or where it came from, it could be from taking a cookie we weren't supposed to take when we were two, okay? And I'm not even joking on that. I'm seriously not even joking on that. And then we were reprimanded and it left such a trauma in us, okay? Whatever this guilt is that's stopping you is really, I'm just gonna, I'm not even gonna go any further on that. I'm just gonna say, we have guilt. I get a yes for you, for you, everybody listening, re-listening, re-watching, we're gonna clear that. And as I start to clear that, and I have a lot of listeners and watchers who are highly sensitive to energy. And if you guys are feeling what I'm feeling, give me a heads up, give me a hands up, give me a yes on YouTube. And I feel my head just spinning and my throat just shutting down. And my heart is pounding so hard right now. So I wanna cry. So whatever it is that caused this guilt, and maybe it's everybody, like everybody who's listening and watching right now, all of the guilt collectively, it's actually making me like wanna shake a little bit. Like my body is like, I'm trying not to let my body tremble or shake. So whatever this is, and you know what, when it happened, this is how you felt, okay?  When this incident happened, that's how it made you feel. That was your reaction to the incident that initiated this guilt in you. So you might go, well, I don't feel that. I don't remember that. That's okay, it doesn't matter. It's clearing out. If you feel it, it's going. Let it go, let it go, let it go. Hoi, vey, hoi, vey, ho. And thank you, Fawn, for, or thank you, Heather, for responding. And thank you for letting me know that, yes, you're releasing also. I'm going to tell you that tomorrow, and yeah, I'm a little shaky on this one. Whatever this is, by tomorrow, you should wake up and feel relieved, okay? Now for women especially, and I don't love this, and women of a certain age, especially, we weren't brought up to be the breadwinners. We weren't brought up to be, our parents thought generationally, it would just continue the way it had. So we were brought up maybe without a focus on being successful and making the most and being okay with making the most and going for it, where boys traditionally have always been brought up to be go for the top and make the most, and it's okay to get money. And sometimes when women take that role, it's not looked at the same way it is when a man takes that role. It could be something as simple as that. I don't think it is, beautiful girl, I really don't think it is. I think it is something that goes, you know, I'm getting this as something that happened when you were four, maybe five years old or started when you were four and went to when you were five years old. And it was very impactful in your life. And it changed something. And if you, whatever this is, I actually hope you don't remember because I wouldn't want you to have that memory come back to you. So I hope, I know that you might not feel this or know of the change right now.  So I can't wait for you to feel that and to know that there are changes from this. And I hope this was helpful for you, love. Okay, I'm just gonna go to the next person then and you're welcome, seven, three, two, seven, three, two. How can I help you today? Hi, good afternoon, Tony. This is Caroline from New Jersey. How are you? I'm doing wonderful. How are you? I'm out in Africa and he wants to go to a Bible college. I actually, the country that he's in, it's in Ethiopia. Does, is that where he's supposed to be for a little while? Because he wants to come to the U.S. as well. Ooh, you know, this is a really difficult, this is very, so the first thing I hear is be careful. And the second thing I hear is stop. Okay. Now, I don't know why I'm hearing this. You probably know better than I do why, but I hear be careful and stop. I'm hearing there's some possible deception with this situation. I don't know where and I'm not, I'm not gonna take the time to look at exactly where the deception is. If you know there's deception, you just let it go. I feel like somebody is not being honest with you in this situation. I am hearing that you are being deceived and there's a word that's whatever it is. But this is basically, this is what I'm getting and I'm sorry that this is what I'm getting. I wish there was a better answer. I don't feel, I feel like here's what I'm gonna tell you also your intentions may be pure, but no, but the other person or people involved, they are not, they are not pure in their intentions in this situation. And I do feel like you need to really re-examine all of the moving parts of this. I do feel like if, okay, okay. The other thing I'm getting is if somebody really wants to go to Bible school and they approach that Bible school, there are a lot of scholarships and grants in those Bible schools that will especially bring somebody from another country in. You need to really look at all the moving parts of this. You need to remove yourself from this situation. You need to take a breath and allow yourself to pull back from this completely, completely like I'm hearing sever the tie. I feel like there's some manipulation going on here and I'm really sorry. I don't like to say this, but I'm happy I get to say it because in saying it, hopefully it's gonna help you and you're the person I'm here to help right now. It's you. I'm here to help you. So thank you. I hope this was helpful for you. Is he 22 or is he older?  I'm just gonna say this and I'm gonna have to like start getting ready. I'm gonna have to start, I'm gonna say this to you. It doesn't matter. Don't, here's where they get us every time when they are manipulating us or deceiving us is they leave us confused and we're so busy trying to figure out that one little part or why or whatever, let all that go because that will keep you in it. When we're trying to, if there are things that we are confused about, we need to hit the road, Jack. We need to be out of the situation, whether this is, if we're trying to help somebody in a relationship at work, there is no reason, no time and no sense in any sort of confusion. We need to move into something authentic and where we're not confused, okay? If you wanna help somebody get through Bible school, make a donation to a Bible school that they can apply to somebody. This situation is not honest, it's not accurate. They are, and I hate to say this and I'm so sorry I'm going to say this, they're taking you for a ride, they're taking you for a ride.  There are many ways to do the right thing. There are many, many ways to do the right thing. Like I said, if you want to help somebody get through Bible school, go to a Bible school and help in that way, help set up a scholarship foundation that not only you but other people can donate to to help them get through Bible school. There we go, there's the answer. You


me reservations about pieces of parts I mean it is a little different because typically our board is we're either weighing in on policy or on something like that but not typically putting a board endorsement on something other than maybe a grant application or something like that we don't usually we don't usually do that something like this comes out town meeting day right yeah okay so Jeanne with Jewish motion and I will move what Chris said okay I got it okay so we got second Paul and David no this gag group was laughing over me Paul and David hi wonderful yep we're in crisis this is not kicking something down the road but the planet in this moment and I go back to in 2009 we had my mother she was 94 something like that we knew we couldn't keep her forever but we knew if we didn't get rid of the oil to meet the house and at that point the wood pellet boilers around there was zero rebates in the state and the backing envelope said we just burned oil for one more winter it would take us 17 years of burning wood pellets to equal that and I didn't want to do that that meant $15, $16,000 which we didn't have to but to do it to know that then we had 17 years we were like we were taking a big step there was a stretch for us and that's what we all need to do individually as communities as a nation otherwise we got a roof I would just recommend reaching out to your local representatives to stress the the more local points of how that affects little me and Bethel and how do I pay for it and get to the stage because we know how this is all of a sudden it's adopted and you have to do it by a certain date and by the way you're not giving me money I'm not helping you do this and then you're sitting there going well I can't afford that like you know I mean so so it's kind of make sure those points are made through our local legislators because you guys rock thank you folks and good health discussion we all are guilty of hypocrisy when we talk about these aspirations and we want all of this I'm a carpenter he's a carpenter so when it says Danny and Loggy we don't want to ban Loggy we need Logs to build our houses and people need houses and that's going to continue I'm still heating with natural gas I bought the furnace not that long ago and I can't afford to just yank it all out and I got big trees around the house I'm not going to cut them down for solar so we're all this together and we're not I understand where you're coming from and you're coming from all of us we just got to do the best we can thank you good night Mary thank you yeah well we're going to have to go to the meeting and go watch socks game dinner enough with your dinner the socks are on right now I want to thank the select board I want to thank the select board and I want to request that the action items be put on a future for discussion at least on our next I'm not sure to go on the next one I have to look at what's out there definitely those action items should be sent to the energy you've got the action I do but those would be good for them to work on I would suggest that we at least discuss those in a future meeting I move we adjourn oh we're not done you still haven't finished the adjourn it all depends on how fast trees yeah it's going to be fast 30 seconds go stay here you're going to want to know that application today that the VORC that half million dollar letter of intent that we wrote please to notify us that our application has been reviewed and we were invited to submit a full application the year school was competitive our proposal stood out above 104 unique applications so that letter of intent I'm sorry but I'm going to pat myself in the back I took a whole day to write that how many it's down to let's see so it says 140 it says you are one of 37 applications we are invited to in total the selective applications have requested 12.8 million in funding which obviously they don't have so the next thing will be how we're going to get that done we're going to do some work on it Rebecca Sam Moore stone but so far I think I have two people I'm sure Ellie will want to weigh in because there was some concern of hers on behalf of that letter does it say when the next date is yeah it says that next week we're done so we're going to get a follow up message with information on how to do it and when it's done all I know is that we were we made it so thank you for attending that meeting we made it that far so it is exciting so also I'll make sure you share that tomorrow conservation because you know Chris four was there and everything so yeah so so yeah so I just got it yeah so it's good so thank you for coming to the meeting yeah let's have a good evening see you guys thanks so other than thank you John take care good to see you let's see no I'm not Jean Paul there was the so good news more good news two rivers the bylaw modernization grant we talked about budgeting there is no match so we don't have so that's great so there's no you don't have to put anything in there right so there's no money how much was that grant we wrote for five hundred well the VORC's five hundred thousand dollars the bylaw modernization grant is about eight thousand dollars eight thousand yeah but when we with no match that would be great the not quite final DWSRF numbers that Paul wanted are in your packet still waiting complaining as much as we can to the state we have you know telling them we want more money you posed us going through environmental you know that process we want you know we want like another half mill whether we'll get it or not I don't know but we're going to fight for it why not you know what we can say we can demand so then budget numbers talk about that Ponello bridge is an ongoing saga had a meeting with the FEMA folks from the state and FEMA and the hazard mitigation program so Chris bump and I he sent me a RFP from another town for culvert replacement I turned it into a bridge we put some back up stuff into it we're trying to set we're going to still stay with North Star Hydro they were the ones who did the H&H study for the bridge and we're also going to stay with contact engineering apparently the person that works with the town of Bethel for that engineering firm it already started dealing with them so the feds are saying we can use them and that helps push us a little bit further so I sent that tonight before the meeting to Chris Bum to have him take the peek at so what type of timeframe are we looking at I am still well the hard part is obviously Army Corps of Engineers weighing and now you're looking at spring job well basically the RFP is going to say that we want final drawings and everything done by the end of February but we have to keep FEMA in the loop because we have to look for bats we have to look at historical preservation so there's a good 60 to 90 days worth of review in there but FEMA is saying this is the last project left out of that disaster DR45 so they kicked us out back in the queue which is fine but they're willing to stay involved as we go which is great so once we get a new engineer we'll have another FEMA meeting that way so things go well looking like late spring or something like that we're looking at I would say late summer by the time I said things good so anyway so we're pushing forward to it through it just so you know that's what's going on the earlier we can get that out the better opportunities we'll have the agency of transportation has a very robust program coming out from HGS which means contractors are going to fill up quick well for us honestly I can't control it at this point the RFP goes out I want a response back so we can award it and for them to do design plus also the review is going to take a while I think the town crew will end up removing like 10 trees we're going to try to get A&R to come in right now they're environmental or they're biologists to look for bats so anything that we can get done now is going to but some of the stuff we just won't have control over the timing so anyways that's all I got perfect select board meeting minutes from the 27th Paul promised us a thorough review on those Linda you made a motion okay Ellen favorite nice have it there was some other communication just they know some stuff for you guys to know that the revised outer loop of the trail was re-routed to avoid to avoid a marinal pool you guys had to know that so that's in there think some other minutes information on going thing on right road that we're dealing with but I'm waiting for hoping the class 4 road committee will schedule a meeting they'll go up there look at that I want this class 4 road committee to make recommendation to the select board then the select board can decide on the work as well as having any disgruntled neighbors when would that happen I don't know I've written to the chair a couple of times so of the class 4 road committee I know we've been busy so I'm hoping sooner rather than later but in the meantime it is what it is and everyone got a letter what's going on I'm not sure I remember talking about it we haven't just with something in the package it's an ongoing did you see a letter in the packet between two one of them had been keeping up a water bar that we'd asked them to maintain another the other resident in the area was putting in other water bars and doing other work that was they are that was disturbing the other so one couldn't access his fields from the class 4 road and so basically I just don't pull that thread on that sweater yeah so we have to so I did send a letter you know registered letter to both parties have dealt with both parties at this point the road crew is going to go up and do where some water bars were dug pretty deep so our equipment couldn't get into their own field we're going to put a little gravel in there so the water bars can still water will traverse but at least it's accessible but I've spoken to the chair of the class 4 road committee and asked him to you know put this on an agenda sooner rather than later so they can take a peek because it's a class 4 road so if they don't want to get a permit to work in the road for $125 that we can approve or disapprove then it's tough and it's an ongoing feud what I don't want to happen is the town is to prefer a butter to try to sue the town because we haven't made a decision so that hence the letter saying everybody sees and desist nobody has the right to do anything for the policy unless


Love you infinite fam.