Following the recent attack on four communities in Kajiroliki government area with 32 persons killed, houses braced with children and women displaced in various IDP camps in the Kaduna state, the Southern Kaduna-Bibu Union has distributed clothes and food items to internally displace persons in Kajirol, Abiladiru-Fa'ata, the supporters presented from our studios. On day the 5th of June was a sad day for the four communities of Dogon, Noma, Gamu, Onguansaket and Maikori village when bandits attacked and Q32 kidnapped others and many went missing. Speaking at a distribution of the food items to the IDPs at Maraban, Kajirol, president of Sokapu, Jonathan Ashakes said the victims of Kajirol bandits went serious need of food items, clothing and shelter. He said the continuous attacks by terrorists in Adara communities and gruesome killings must be put to an end. Where a helicopter was seen hovering and the helicopter instead of firing at the attackers fired at the victims, the natives of the communities while the attack was going on. Eye witnesses said it was a white helicopter but the state government through the commissioner of internal security came with a statement affirming the fact that there was an attack 32 people were killed. Ashake lamented their alleged white helicopter sighted in the communities leading to the killings of innocent citizens, several others missing with many injured while calling on government and own levels, security agencies and international communities to investigate thoroughly to bring corporate to justice. We thought the helicopter was somebody might have alerted the security men and they are coming to our rescue. No and behold they just came and I was starting to shilling everybody there. Our people of concern is have they really come to assist us or they've come to assist the bandits. When we saw our people falling down as the helicopter was firing then we too we dispatch because we cannot stand the strength of the helicopter and those on the ground. A lot of people they were killed in the village and a lot we were hiding in the bush. They burned our food and clothing and with a lot of things in their houses including our house they burned everything. Earlier the bandit demanded 15 million NARA. After a few days they later demanded additional five million for the safe release of kidnapped victims. Please we need help in our village because our people has been killing our house has been destroying many things we lost life and our people in their hands now. We don't have any money that we are going to pay ransom to collect our people but now they are saying that we are going to pay 20 million. Recalled at Kaduna State in a statement at the Born Helicopter queued innocent locals saying the NEF are repelled the terrorists.


Hi everyone, Joe for jaspyscasebreaks.com coming at you with jaspys 15 box all you high-end basketball mixer random team break right here 30 spots. It's a high-end mixer. Yeah, it's a great It's a great mix of high-end products right here. So it should be pretty fun No that common ship in this stuff But Luca second year stuff LeBron and Yannis will ship and Kobe's if there are any I think that's a standing rule for now Subject to change at any time, but it's standing rule for now It's a great list of boxes right here spanning a number of different years. Look at that So that should be a lot of fun. So just keep all keep this in mind when you are trading This is part of tonight's Jersey Palooza promo or this weekend's Jersey Palooza promo So if you're on this list You're automatically entered in there. So you're good to go Thanks everyone from buying their team straight up and congrats again to the winners And all 30 basketball teams are in we've got some college basketball on the background Let's roll it randomize each list three and a six nine times for names and teams and Ninth and final time after nine we got Steven down to see two different steves Steven s and Stevie top and bottom after nine. All right. Once again three and a six nine times for the teams one Eight and ninth and final time after nine.  Lizzie out Chen with the Clippers Catherine You got the Celtics Kyle Cook with the OKC Thunder Corey with the Kings Zach with the Grizz It's also at the spot that you won Kevin last Bob ojo Nets He has him up for trade Michael with the Bucks Brian with the Bulls Greg with the Hornets Robert with the Spurs Catherine with the Sixers Alan with the Magic Matt with the Rockets Catherine with the pistons and Steve Engelson You have the Minnesota Timberwolves Let's get all the teams and names on one Screen here. Let's box these up I'm going to pause the video and Allow for a little bit of a trade window when we come back We're gonna see if there's a trade and then the break itself. Let's take her out and be right back All right, welcome back folks There was a lot of trade chatter, but no no deals were done, which is all good So you can see some of the boxes right here and then you can see the rest of the boxes on the top camera right up there We were just talking a little bit about that LeBron James logo man that I pulled And I was telling Jared Thanks everyone once again for getting in That's telling Jared who has the trailblazers in this one and he was watching that live and I was like man Here I was stunned when I pulled that I couldn't believe it at first and then I just kind of Kind of had to not overthink it You know and I was just like had to focus on like all right, let's put that in the thing Let's put that in the other thing. Let's make sure I don't drop the card So I have to be really careful on that We're there really just started to register as like man That's probably one of the best cards of the product right there, too Zach thinks Zach Paul thinks the pull of the product All right, here's 1213 Pani just panini basketball. I think two autographs per box is what we're looking for here Autographs from hardwood greats of the past present and future including Kevin Durant and Anthony Davis That's what it says right here rated rookie signatures featuring some of the top talent now remember. I'm glad they explained this here Remember there was like a lockout or a strike or something like that So they so panini had to end up combining two draft classes in one So this is whenever you see stuff like this. It's actually really good Really great value in there But yeah, that LeBron James poll was pretty it was pretty stunning for those of you who haven't seen it Well, there's the TMZ article in the chat. They they did Guess they're following us too, and here's the I think the link on Twitter At jasky's breaks where you can see that logo man as well. I mean what I guess I suppose Zion would be would be something that would that might even be a little bit better just because it's a rookie But yeah, I mean that's got to be One of the polls the product obviously LeBron James is exclusive to upper deck his autos are exclusive to upper deck So whenever we see anything card or relic related little extra boost in values because This stuff just is not as not very common on the secondary market Remember folks no veteran common ship except for LeBron James and Yanis and second-year Lucca Dodge's cards And Kobe cards if any first stack right here Yeah, Steven's like wow amazing card is isn't it? It's going on auction the that night the buyer or the winner of that card who won it in a random number block of all things But The winner initially was like, oh, yeah, send it to me. I want to see it. I want to hold on to it I think I'm gonna hold for a while and then a few hours later He was like, you know what? No, can you guys just take because we did the we pulled Jason Jaspi pulled that? Pulled that Connor McDavid RPA out of the Cup Hockey and So we pulled that and send it to our friends over at Leland's Leland's auction And they ended up selling there for $130,000 a little bit more than that So he knew that we were part of that and then he was like, you know what? Can you guys just set all that stuff up for me? And we're like sure. Oh, there's the Kobe packs right there. So we're pretty lucky. We're pretty fortunate to be able to pull a Couple big monster cards like that. All right. Here's our first box Good luck. Oh Also in this case right here, I don't think we were running this too often But we're gonna go by city. So Charlotte stuff will go to Charlotte New Orleans stuff will go to New Orleans Are these gonna say rookie cards on them when I come across one? Marcus Cousins, where did he say he's he re-signed somewhere? Wow Anthony Davis autograph That's not too shabby That goes to New Orleans that'll I'm glad I explained I'm glad I reset that reset that New Orleans Charlotte situation there But yeah, this goes to New Orleans obviously and Anthony Davis authentic signature going to Adam Cuperman Who won that spot got randomized the pelicans? And he's probably expecting, you know, he's probably looking looking towards 1920 stuff But here's a surprise in a 1213 box Anthony Davis now is that what is that rookie in? Yeah, exactly. I was like I was just thinking I was chasing Zion's but I think this is rookie Because he was 2012 right and this box has 2011 and 2012 Rookies right there. So there you go. This is the the famous dual draft class one and now a champion as well Yeah, he was the number one overall pick in 2012 pretty nice Snap I got a member to snap a picture of that. I gotta set that aside just off to the side here Yeah, Stephen, you're right. It kind of What doesn't it doesn't? Doesn't feel like he's been in the league for eight years already Stephen is saying Here's heat edition of LeBron James. That'll be for Marcus Just like you're kind of like Look how skinny he looks right there But you're kind of like, yeah, I guess he has been around for a long time and But doesn't feel like a lot Kind of both at the same time in my head. It's almost like wasn't he Justin didn't he just get drafted. We just talking about the brow Yeah, the brow is still super thick. There's an Anthony Davis right there rookie card Yeah, Oliver seeing sales from 150 to 250 Adam saw one for around three What about that Anthony Davis rookie card? I think maybe the fact that doesn't have RC on it. Maybe that I Don't know. Maybe maybe that Concerns collectors. I don't know There's another autograph right here this Tashon Taylor Brooklyn Nets Kevin Benedict tried to trade couldn't trade mojo Yeah, it might be worth a hold might be worth a grade Maybe that rookie card Worth a hold see how the rest of Anthony Davis's career Shapes up They're just trying to figure out money stuff with the Lakers right now or how many years Years and money, but it doesn't look like any Davis is on any sort of free agent tour I think he's definitely coming back to the Lakers Yeah, maybe maybe maybe PSA slow boat and no rush on that Anthony Davis All right, so nice start in our first box. Sean Jaspy will give you three dollars and 59 cents Adam Kaeperman Kobe these be some of these I've seen numbers, but these will all go to the Lakers, of course Set those aside there. Where should we go next? What that was? So that was the oldest box 12 13 And I think the next oldest box is the 1617 boxes. So there's 1617 limited Got this the Anthony Davis on the on the box. Oh Yeah, Sean's not very good at negotiating Adam. Here's the next box right here Behind Luel Deng is Alex a Brins and I don't remember this guy at all and there's There's Papa Giannis That's for the Sacramento Kings. That's gonna go to Corey and the Kings and Behind Luel Deng Lakers edition is Alan Iverson. Oh, I thought I was gonna be an autograph decade dominance Jersey 1999 Prince that goes to Catherine and the Sixers I was that was gonna be an autograph. All right, and there's Luel Deng I'm pretty sure the Lakers are still paying him like a million dollars After they stretched out his deal. That was 1617 limited. Let's go to 167 Prism mosaic This one right here. Yeah, that's 1617 Prism mosaic Ben Simmons here, I think among others Remember Ben Simmons autographs also exclusive to upper deck just like LeBron James So the value of Ben Simmons rookie cards also get a nice little boost on the secondary market. Oh Yeah, wait, what are the leaks say on Luel Deng's contract? I know the Lakers were trying to figure out how not to pay him like the last couple million dollars because They need it every little bit. Oh Buddy heeled Jamal Murray in this class Oliver saying nice There's Chris Dunn Tyler Eulis Jabari Parker. So all of these will ship They're an all-cards ship situation in this mosaic Jordan Clarkson earn on Gomez Malcolm Brogdon Oh, we're still on the hook for the money. Okay, so we're still on the hook for For Luel Deng Yeah, I didn't think they were gonna win that that appeal or whatever they Whatever they call it. I Think all right. So nothing too crazy in there um, I Want to say they were trying to say that since Luel Deng doesn't play anymore I think they were trying to argue that there that he suffered a career ending injury While still with the Lakers, which means they don't have to pay the stretched part of the contract a little complicated But that's that's what they said. All right, that's it for 16 17. Should we get into some 17 18? And now we're just kind of in some nicer. I don't even know what direction to go in Why don't I just go let's just bounce around a little bit them. Let's just do contenders Let's do the heavier sort of base card stuff Maybe some blasters and then we'll maybe do that stack and then end with some choice origins and one-in-one Something like that. I think Mazgab is off the hook. I Don't think I don't think I think they were able to just move him and not have to Really stretch his contract or anything But Mazgab I think actually played some minutes dang just never worked out And he was like just injured and when he was healthy, he wasn't effective He didn't get minutes, but he was getting like, I don't know. He had like 12 million a year something like that And then they were finally able to trade him and then there's like some sort of stretch provision So they could be less of a cap impact. I don't know exactly how it works But they're able to do that and so they're but they were still on the hook for some money here and there, but They're gonna have to pay it I mean in a million dollars or so for the Lakers payroll anyway. I mean, you know, that's like That's like maybe You can probably get a decent player to gobble up some minutes for a million dollars ring chasers old veterans We'll just take a small little deal Just to chase a ring with LeBron Maybe put in a few quality minutes here and there golems ring chasers All right, let's see what we find in here some cam reddish Save a Yanis onto the combo right there There's John Marant lottery ticket It's current edition of course Grizzlies That will be for Zach Paul won that spot got randomized the Grizz Was that it was the Luhel ding a Jim bus deal? I think that was still My blanket on his name is still the the the other guy Who's in Charlotte now, maybe Tremont waters and Carlos boozer Legendary contenders autograph 195 out of 199 Chad M want to find vintage Kurt Rambus cards What about an old Carlos boozer? Zach with the jazz and they've been running this laser tag commercial a lot think about getting Get laser at this break brought to you by get laser X comm The entire blaster I'm sold a 300 foot range There's Lakers edition of DeMarcus cousins to 65 What do you have get laser X comm if you have if you have that then I think we could I think we could play against each other Ryan Kobe Wow Steven Savinsky with the Los Angeles Lakers Get out of 1920 contenders basketball gets a Kobe Bryant on card on card autograph 21 out of 25 just a few off the jersey number because that's what Jaspie's does I never hit Jersey numbers I saw it flipped around.  Kobe actually held this cart RIP Kobe. I miss this guy What a hit there's SGA to 199 Ryan Harold saying that he saw one from 1899. This is 1920 but 1819 contenders 4500 raw Yeah, that signature is so smooth, right Steven That mama mentality right there Great great signature How do you top that I don't know I should probably pull a Zion autograph after this Ryan Harold saying rest of this make may seem a little blase after that one Yeah, if the break drags a little bit, I'll just keep I'll just show that again for the duration of the break or Kobe Shrine right there is awesome LeBron James LeBron James logo man out of immaculate basketball not too long ago and now Kobe Bryant on card autograph out of contenders If you're one of the 60 some odd people who watch that live you can tell everybody. Hey, I was there when dot dot dot What is it? This is oh Is this mosaic Timo? Red and gold wave prisms in this is Damien Lillard and Gold wave miles bridges Yeah, it is mosaic Timo. There's the gold wave which are the more Shorter printed ones compared to the red wave T-Mall being the big e-commerce site in China Panini had made an exclusive for them. There's Damien Lillard red wave for the trailblazers. I'll be for Jared Red wave John Wall does he want to trade? Or who's gonna take John injured John Wall in that contract? There's Shaq Or coming off of major injury Johnny says what's better than one Kobe out of two? I don't know where could where the second one could even come from Kobe autos else, but I didn't even realize there were Kobe autos and contenders Silver Bam out of bio red wave lengths in Galloway DJ Augustine Ryan Harold you're always here. So you always see the polls and you're excited and sad simultaneously. Why are you sad? You should be happy for Steven Savinsky. Oh because you want them in your collection. I see there's Eric Gordon NBA debut John Morant Dylan Winnler red wave. Oh and Robert. I think was asking. Yes, all Luka Donchiches will ship second-year Luka Donchiches This John Morant goes to Zach in the gris and we got gold wave Mufondo Kamen Gelli Gold wave rookie This Jaylen Brown red wave The honest onto the combo highest Jones red wave That was mosaic T-Mall Yeah, is it plural Luka Donchiches or Luka Donchai? All right, that Mufondo is for the Clippers, Liza Chen with the clip show All right, what should we do? Maybe some of these hanger boxes? Yeah, let's do a dozen basketball hanger box Usually those are flipped around and it's just like an insert And that then I'll make my usual joke. Ah, there's Panini trolling me Making me thinking was in the autograph. So I just assumed that was gonna be the same thing Not this time There's Rudy Gobert Cracked ice relic for the jazz that'll be for Zach a guy green These are exclusive to these sets right there. There's Isaiah Roby and Hachimura, okay See that's what that's what usually happens. All right, let's do a chronicles hanger box And A green LeBron James back here marquee for the Lakers Steven Here's a John Morant for the gris that goes to Zach. He actually missed that dunk or was blocked mr. Block something like that All right, blaster time. Let's go to there's to 1718 blasters We've got a prison blaster and a Donner's optic blaster. So let's think back to our Jason Tatum draft class here 2017 I think that might be my favorite card of the year to the John Morant Luminance card where he's dunking.  Which kind of makes it funny. Was it you Oliver?  I Look at that. I mean, look at that athleticism. He's He's posterizing Kevin Love right there.   What is that? What's what's Michael doing out there in Charlotte? There's the Montess of bonus Sterling Brown play Thompson Kyra Irvin. Why did they pay Gordon Hayward that I like Gordon Hayward? But I feel like Charlie paid a lot for Gordon Hayward or maybe if you're a team of that market You have to overpay for guys like that It's Ivan Mitchell for Zach and the jazz other blaster box A great photography too I kind of wish there was actually for shots like that Where's the where's the photographer credit? All right still same year 1718, but this time prism I think it's this and one more box Celtics Catherine That's your uh, your last two chances for Jason Tatum uh, rookie cards Yeah, because jordan don't doesn't know what what the F. He's doing Mitch Cupcheck. I was trying to think of Mitch Cupcheck the old Lakers GM who had Who had maybe there's Covey again Who had maybe signed that ill-fated lual dang deal Isn't he in charlotte now There's tony bradley jazz for Zach But I don't know maybe that's maybe maybe in that market though in that market size Ryan they're just like well, we got to overpay for guys like Gordon Hayward If he could stay healthy, I guess he'd be a solid player, but like a 34 million dollar a year player LeBron James Cavs silver that goes to scott claremont Nice prism silver out of a blaster box. All right, let's get some court kings. Let's get that old court kings going This is what old court kings look like now the court kings. They trim down the box a little bit Favors pal gasol his brother mark on my Lakers now Where does where does this guy go? James harden they're still talking about there's anthony davis tilakina points in the paint lamarcus aldridge kuzma rookie portraits chris middleton to 25 And we've got out of 200 tj leaf fresh paint autograph That's for the Pacers. That's going to go to bryan croft 178 out of 200 and then we've got a draugage It's 299. Yeah piece of his jersey miami That'll be for marcus John shombie doing basketball College roots looks like we've got a randomizer between New Orleans Indiana San Antonio and golden state. There's david west progressions I think it's kind of a cool cool design I guess if you're a big david west fan get this framed up and Set that back there All right now another court kinks 2019 2020 so current court kinks Actually known to the draft is oh Actually this I have to start referring to this as last year's draft class now It's an autograph on the bottom. There's cj mccullum maestro pascal siacum rj barrett level two Damian lilor tatum samanich Kobe white Relic is jordan pool art nouveau Obi-wan what's going on things are well look at that that's for luke and the warriors And the autograph behind kevin love is his old ralph samson high court autograph for the rockets It's matt Lieber tried to trade couldn't trade mojo 157 out of 179 Now some contenders optic basketballs still last year's draft class There's two on the way donovan michael devin booker historic pakes 13th overall I guess that 13th overall pick wasn't too shabby. We'll do a randomizer for this At the end as well along with that card up there Hassan white side Behind andre drummond is jalen brown red wave Not numbered And behind him is seiku dimbo Is that it? Oh, this is team all contenders optic. I was like, where's the autograph? All right, so it's those red waves that were the two Main cards here That threw me off for a second. Let's go to origins That kobi's pretty awesome. I don't know make out of a mixer of all things All right, there's paul george 99 bradley beal the wizards That zack levine and adamol scofield And behind joel m bead is his teammate matisse tidal Origins relic going to cat and the 76ers And behind joel m bead is jersey and autograph for charlotte pj washington jr Well, the hordes haven't stopped piling some some interesting young players pj washington jr davante gram You got terry rozier. They've got some solid names on there gordon hayward Their draft pick from this year. I forgot who he was but their draft pick from this year They can get all that to click might be a great team. Maybe maybe not Maybe not first team all mba. Oh lamello. That's right. They might not have uh First team all mba guys, but as a team that could be very different and interesting All right, speaking of charlotte. Here's nicola batum We got blue victor oladipo for indiana Three out of 35. We named the dog indiana and it'll be for brian croft This winsl. You're gonna help me out here. It's on the song. Check the bottom first.  Wow 15 out of 35 That'll be for erin clark and the washington wizards Sean jaspy big fan of the hachimura and behind justice windslow is harry giles 92 out of 99 going to Corey and the kings Should there be like a harry giles harry styles like buddy comedy All right, and the last one of this break and then we'll do a couple randomizers I think the card on the bottom is the Base card here and it's going to be goga batadze 19 out of 20 Indiana pacers bryan croft And the last hit of the break Is gonna be Another laker Old laker elgin bailer Old laker great 20 out of 99 first team signatures What a break for the laker is steven With that one and there you have it. Let's do some randomizing We'll do a we'll do a quick recap after the randomizer as well So it's we're going to use one dice roll for both cards First of all, we've got donovan mitchell utah debon booker phoenix and the david west card was uh new orleans Indiana pacers antonio spurs and golden state warriors Let's roll it and randomize it two and a six eight times for each list A team on top gets it after eight one two three four five six seven And eighth and final time after eight phoenix With that one by the time I get to phoenix, she'll be rising steven s With the sun's winning randomizers too All right next one six and a two eight times for this list right here one two three seven and eighth and final time goes to new orleans, of course it does That david west going to adam cuperman and there you have it boys and girls What a break so here's the recap we had the The elgin baler we just saw a second ago some pretty nice stuff The hachimura out of choice the zion out of choice pj ralph tj silver lebron james donovan mitchell rated rookie john marant cards mba debut alan iverson relic papa giannis anthony davis rookie card lebron james heat edition anthony davis rookie auto And of course the kobi ryan right there on card autograph out of contenders It's pretty nice. How about that? And there you go ladies and gentlemen that was jaspy's Uh 15 box allu basketball mixer. I'm joe for jaspy's case brakes.com r.i.p. kobi miss you man. We'll see you next time on jaspy's case brakes dot com


Okay, the recording is on. This is BC 111, faith. Second lecture for today. I'm going to go ahead and share the course notes. So let's go to chapter 2. So we're done with chapter 1. Any questions? Chapter 1? What's your name again? Jayadeva. Welcome. If you get the course notes, they'll give it to you. Diana will give you the course notes. So let's go to chapter 2. In chapter 2, what we want to do is talk about God's sovereignty, grace, and faith. So God is a sovereign God. That means he's all powerful. He can do whatever he wants. Nobody can stop him, hinder him, prevent him. God is sovereign.  What is grace? That means he gives us freely what we don't deserve. That's grace. It's a God is sovereign.   Why does he still want us to have faith? That is the question. And we need to clearly understand this because many believers, many Christians, don't understand how these three interact. That means the sovereignty of God, the grace of God, and our faith. They don't understand how these three interact. Because if you think like this, God is sovereign. He will do whatever he wants and he can do whatever he wants. Who's stopping him? So we say, if God wants to heal me, he will heal me. If God wants to bless me, he will bless me. So leave it because God is sovereign. He will do whatever he wants to do. Whatever he wants to do, he will do. Or we say, it's the grace of God. God will freely give to us. Why must we have faith? Why must we believe God? Why must we read the scriptures and believe the promises and stand upon the promises? And why must we have faith in God if he is giving to us by grace? And how do these three interact? That's what we want to answer in this chapter. So let's talk about the sovereignty of God, which the Bible presents to us very clearly. So Jay, we'll get you a copy of the notes. Maybe in the break time, we'll organize that. So the Bible is very clear about the sovereignty of God. Examples, scriptures we can see in Job 42 and verse 2. Job says, I know that you can do everything. I know you can do everything. And no purpose of yours can be held from you.  Who can stop you? You can do everything. So if God wants to heal somebody, he can heal. If God wants to bless somebody, he can bless. Whatever God wants, he can do. Nobody can. God is sovereign. Our Psalm 115 verse 3, the Psalmist said, our God is in heaven. He does whatever he... God can do whatever he pleases. Or in Daniel, chapter 4, verses 34 and 35, Nebuchadnezzar, the Babylonian king at that time. He says, all the inhabitants of the earth, and he's talking about God, his dominion is an everlasting dominion. His kingdom is from generation to generation. All the inhabitants of the earth are like nothing and who can restrain his hand? Who can stop the hand of God? Who can restrain his hand and tell him, what are you doing? Nobody can stop God. So the Bible is very clear that God is a sovereign God. He can do anything. Then we also know that God is a gracious God.  Now what do we mean by grace? Grace means God gives what we don't deserve. That is grace. He's a God of grace. We don't deserve it. We have sinned. We do wrong things but still God loves us. Tilly blesses us. Tilly gives God as a God of grace. And grace is available for everyone. Some scriptures on grace, it says in Psalm 86 verse 15, you were Lord God, full of compassion, gracious, long suffering, abundant in mercy and truth.  Merciful, gracious, patient. And not only that, Psalm 145 verses 89 says the Lord is gracious, full of compassion, slow to anger, great in mercy. The Lord is good to how many people? All of them. He's good to all. He's not partial. So in his grace his grace is available for everybody. He's good to all. So I can't say only that person, only that person. No, no, no. The Lord is good to all. Good to everyone. Equal. So God is sovereign, all powerful. God is gracious, He's loving, He's compassionate and He's gracious to everybody. He's not partial God. His tender mercies are over all His works. And yet there is the coming together of grace and sovereignty. That means God is gracious, but He's also sovereign. And what He says is, because I'm sovereign if I want to do some good to somebody, I'll do it. If He wants to single out somebody, He will still single out because He's sovereign. His grace is available to everyone. But if He wants to give one extra apple to Nikhil, He'll give one extra apple. Nobody can question why you gave one extra apple. I'm giving apple to everybody, but I want to give one extra apple to Nikhil. I'll give one extra. Or Vimal. I want to give two oranges to Vimal. He'll give two oranges to Vimal. Why? Because He's sovereign, then He will do what He wants. He's God. He's gracious. He'll give orange to everyone. But while He's gracious, if He wants to give two more to Vimal, He'll give who can question. So in Exodus 3319, God says, you know, he's telling Moses, I will be gracious to whom I will be gracious. I will have compassion on whom I will have compassion. Meaning, I am a gracious God. I am a compassionate God. And in my sovereignty, if I want to extend mercy, grace, compassion to somebody in a special way, I'll do it. So even in the expressions of His grace and compassion, He's sovereign. So He's impartial, and yet if He chooses to, do something as a sovereign God.  And in His sovereignty, He can extend grace and compassion as He chooses. His grace and compassion is available to everyone. But yet in His sovereignty, He can do something special. I understand. So example. Example. Why did God choose Abraham? He could have chosen somebody in China. He could have chosen somebody in Japan. He could have chosen somebody in South America. He could have chosen somebody somewhere else, Africa. Why did He choose Abraham? And said, come, I will make of you a great nation. It's not like there was lottery in heaven and Abraham picked the right. It's not like that. So God is good to everyone. But He wanted to fulfill a certain purpose. And so He chose a man, and this man was Abraham. Nobody could question that because God is sovereign. He will do what He wants. So He is good to all. He's not impartial. But He chose Abraham as a sovereign God to carry out a particular purpose that does not make Him impartial. It only is an expression of His sovereignty because He's still impartial to everybody. I love everybody. But I want to do something. I'm choosing right now for this one. I'm choosing Abraham. Or you think about in John chapter 5, Jesus comes to the pool of Bethesda. The Bible says there were many sick people lying around the pool. We don't know many, maybe 50, maybe 100.  Jesus comes to one man and asks him, do you want to be well? Do you want to get well? Excuse me, there are 50 people. Everybody wants to get well. Or I don't know whether now maybe 100 people. Of course everybody wants to get well. That's why they are there. But He comes to one man. He says, do you want to be well? This man doesn't know who Jesus is. He's thinking somebody has come to help him push him in the water. So He says, sir, I'm sitting here for a long time. Nobody's able to push me first in the water. You think you'll push me first? He's thinking like that. Because when an angel went to the water, the first person a cotton got healed. I'm sure all these years He must have tried going first. He always missed, came second, third, last. He never made it first. So He's thinking, oh, who is this man who could put me first? But Jesus tells him, rise, take up your bed. And immediately He's healed by the power of God. And then Jesus says, I only do what I see my Father do. This is John chapter 5. What I see my Father do, that's what I do. That means the Father God wanted to heal this one man. But what about all the others? Isn't God good to everybody? Well, we just read in the scripture, God is good to all. But yet in that, He is also sovereign. That means He can sovereignly move and do something special for somebody. If He wants to, He is a sovereign God. Nobody can question. So grace, sovereignty and grace. Then in that connection, the God is sovereign, God is gracious, where does faith come? Where does faith come? So the wrong posture is God is sovereign, God is gracious. If He wants, He'll do something good for me. I have to sit and wait. If it happens, it happens. If it doesn't happen, I have to go through life in Heaven. I'll ask why He didn't help me. Well, the Bible doesn't say that. The Bible teaches us about faith. So, while God is sovereign and God is gracious, what He says is this, what I offer by grace anybody can receive through faith. So what God gives by grace anybody can receive by so that is very important. So why is faith important? What God gives by grace anybody can receive by faith. So you don't have to wait for God to sovereignly give you an expression of grace. You don't have to wait. You can receive by faith what He gives to everybody through grace. So that's where faith comes. And for example salvation is a free gift. It is a gift of grace. It is available for every human being. It is available for every person. Today, if there are 8 billion actually there may be less than 8 billion. But example, if there are 8 billion people living on the planet Earth right now, all 8 billion people can be saved right now if they all have faith in the Lord Jesus Christ because God is giving salvation as a free gift by grace through faith in Jesus. Anyone can receive anyone right? And yet at the same time God will sovereignly appear to somebody so sometimes you hear these stories somebody you know the Lord may speak to that person in a dream or he or she may have a vision. The Lord may come to that person. Now why doesn't God come to everybody? Suppose the Lord Jesus came to all 8 billion people today right now everybody will say yes Jesus is Lord saved finished. Why doesn't He disappear to all 8 billion people? Because He's made it available by grace and He wants us all to come by faith. But because He's sovereign He will still appear to one or two, whoever He chooses in a very personal way, in a very powerful way in a dream or a vision or something those people will get saved. So that's God being sovereign. But the same thing He does for them it's also available for everybody by grace through faith. Are you understanding? The person who may have had a vision and to God saved, His salvation is no different from the salvation of the person who received it by grace through faith. Same same salvation, same no different. So what are we saying? We're saying that by faith we receive everything that God gives by grace. Anyone can receive. Anyone can come to God and receive from God what He freely gives by grace we can receive by. Now if God chooses to move sovereignly in your life to do something okay that's up to Him we can't dictate. What we can determine is whether or not we receive what He freely gives by grace through faith, whether we receive or not we determine that. We don't determine His sovereign move, we determine what He freely gives by grace through faith. Is it clear? So God throughout His Word, let me just look at this here that whenever God speaks, or whenever God wants to do something, He declares His Word we believe it and then that Word is fulfilled. So even in your personal life, so like the example in Hebrews 11 verse 8 to 12 about 8 perhaps, you see God may give you a personal Word and say I want to do this in your life but you by faith you have to walk with God to see that Word fulfilled in your life. So even Abraham he was called by God but he still had to walk by faith to see God's work fulfilled in his life. So he mentioned about Abraham he had to walk by faith. So there is what God gives to everybody by grace through faith. There is a specific working of God in your life. So you're learning in a different course on fulfilling God's purpose. You're learning about how God has a specific plan and a purpose for your life. So for each one of us God has a plan, has a purpose and by faith we have to do that purpose. That's how Abraham walked. Same thing with Joshua and so on. So do we understand this that God so this is where faith comes and do we understand the importance of faith now. So God is sovereign God is a God of grace and this is where faith comes in. Now what I want to also present to us here is and we see this in the ministry of Jesus that when there is no faith, when there is unbelief God will not force America. I mean he can if he wants to as a sovereign God but normally normally he will not force because he wants us all to receive by faith. So you see in the ministry of Jesus in Matthew 13th chapter verses 57 and 58 that when Jesus came to his own town hometown of Nazareth. So Nazareth was a town where Jesus grew up and Jesus came to his own hometown it says here in verse 58 of Matthew 13 he could not do many mighty works there because of their unbelief. In his own hometown he couldn't do many mighty works because of their they didn't believe. I say hey this is carpenter he made the desk I am sitting on my chair I am sitting on he only made how he can do America see that's their thinking. He is a carpenter he made the desks and chairs and he said how is he going to do any mighty work. So he didn't believe same thing in Mark 6 you know Mark records this it says he could in verse 5 Mark 6 verse 5 he could do no mighty work there he laid his hands on a few sick people and healed them so just few sick people were healed and he marveled because of their unbelief. He couldn't do many mighty works. He was wondering oh these people full of unbelief they couldn't believe so they struggled. So now let's think about this was Jesus as anointed by the Holy Spirit in Nazareth as he was in other cities he had the same Holy Spirit did Jesus have the same authority so the problem was not with Jesus he is still the same Jesus but yet he could not do many mighty works in Nazareth. Why?  So we see here even in the ministry of Jesus that he required people to come by faith so while God will do things sovereignly by grace the norm is he requires us to receive by faith what he freely offers us through so try to understand the dynamic of God's sovereignty of grace and faith. God can work sovereignly but he wants us to come and receive by faith that's the norm. Now some things to consider here that God in his wisdom has deemed it fit for both these to coexist that means he is sovereign and he is gracious, he exists and he wants us to operate by faith he's kept all this together and he decided it's going to be like this it's not you and I made it up but God decided that this is how he wants to work and there are certain things that depend solely on the sovereignty of God for example the Lord Jesus Christ will return that is the work of God whether you and I have faith for it or not doesn't matter Jesus will come you said Jesus is not coming, Jesus is not coming, he'll come, hello how are you he will come, he said he's coming back he will set up his kingdom whether you and I believe it or not he's going to set up his kingdom on earth he's going to rule and reign for a thousand years so that is God will do his work because he's sovereign nobody can stop it as part of his eternal purpose so whether we exercise faith for that or not he will do it and in extending all his gifts freely to us out of grace God is being equal and fair to all of us see he's actually being impartial when he says look I'm giving salvation healing provision deliverance I'm giving it to everybody freely by grace I just want you to come and receive by faith everybody has to receive by faith so what's what's God doing he's saying I'm making it equal level ground no partiality everybody comes and receives by faith it doesn't matter if you're a rich man poor man educated or uneducated it doesn't matter which country you live in whatever everybody has to come and receive by faith so equal it's equal for everybody no difference so when God is telling us to come by faith he's actually being very fair he's actually being equal to every person so so in Romans 4 in verse 16 Paul says you know he says it is of faith so that it might be by grace so that the promise will be sure to all of the seeds that means there is faith there is grace so that the promise is equally available to every person Romans 4 16 so the promise was based on faith from the Good News Bible Romans 4 16 so the promise was based on faith in order that the promise should be guaranteed as God's free gift to all because he wants to make it available to everybody I'm giving it by grace all I want is everybody must come by faith so he's made it equal to every person then just God's here the realm of faith has its perimeter set by the will and purpose of God we cannot by faith change God's sovereign will okay so the boundaries of faith is set by the will of God I can't change the will of God by faith in normal things you know I can't do that but like we said God has willed that Jesus Christ will return he's already said that in the Bible now I can't use my faith and say Jesus stay in heaven don't come I can't do that I can't use my faith to say Jesus will not return no no no no he will return whether you use your faith or not he is going to return so I can't override God's sovereign plan faith has its boundaries and lastly there is a realm of mystery by because God will sovereignly exodus grace and mercy independent of a person having faith you know sometimes this happens even in some settings example a Sunday service somebody comes to church they don't know abc of who Jesus is they don't know they come they sit on the service and they are praying and God heals that person the person says I came with this problem I got healed do you know who Jesus is no I don't know who Jesus is then we are wondering how did this person get healed does it know anything about Jesus there is no abc of the Bible nothing but this person got healed how but because God is sovereign he will do it if he wants to do it he will just move so while we understand the importance of faith and grace and faith we also understand there is realm of mystery where God will sovereignly exodus grace and mercy even when a person doesn't have faith that is God moving as a sovereign God are you understanding this okay so the reason I put this as chapter 2 is because this is the area where many people get confused they don't understand but if we are very clear in our minds that God is sovereign he is God of grace and in his grace he gives us everything freely but he wants all of us to come and receive by faith everything God gives freely by grace I must receive by faith and if God in his sovereign he decides to do something special that's up to him it's okay but I still must come and receive by faith everything he gives by grace okay let me just quickly see if there are any questions on the online students any questions here a lot of questions okay alright so let's look at the questions here from the online students Nina the virtues that we need to make every effort to add to our faith do these get added on as we mature in him or do we make a conscious effort okay so Nina is asking the question in relation to our previous chapter second Peter chapter 1 verse 7 through 7 onwards where Paul said you know add to your faith those seven ingredients so the question Nina is asking is does it happen automatically as we grow or do we consciously add to it so based on the rest of scripture we can say that we have to consciously grow in those things we have to be conscious about growing in knowledge about growing in kindness about growing in love and endurance so these are things that we work with the help of the Holy Spirit through the word of God and through our fellowship with other believers we grow in these things so that would be the answer you know with the help of God and his word along with other people we grow in all of these another question here from Nina when we pray for those who are sick of other faith can we depend on his promises on or off healing or will the sovereignty of God be in operation now there is no one set answer it really depends on the individual if the individual is open to hearing the gospel what we would do is we would share the gospel because the gospel is the word of faith it will build faith in their hearts we tell them about Jesus who is healer who is deliverer who is a miracle worker and then in that context it is their faith in the message preached through which they will receive healing or miracle and that's based I'm basing what I'm saying on Romans chapter 10 verses 8 through 10 because Paul says the word of faith which we preach it produces faith so that's the norm that's why we have to go and preach the gospel to people even the unsaved we preach the gospel they hear about Jesus they believe in Jesus Christ and in response to their faith they experience salvation and healing and miracles and deliverance that's the normal but there will also be this we also have to accommodate or be open to the fact that there will be times when God will move sovereignly so suppose somebody comes who's never heard about Jesus and you have only one minute to pray maybe you're on your way and you don't have time to explain the gospel what do you do still pray because God can move sovereignly independent of faith so we have room for that as well but if you have the opportunity of course our responsibility is to preach the gospel is to explain the gospel to them and encourage their faith and then pray you don't have time you don't have the opportunity we still pray because God can move sovereignly independent of faith and bring a healing or a miracle in their lives so we are open to both ways but the norm is you have to preach the gospel and then for them to believe and then the miracle work happens Krisha has a question if you have a dream for a specific direction and we have a feeling it's from God should we have faith it's from God how to discern yeah Krisha so one is of course we need to test and see if it is from God so the Bible tells us second Corinthians the 13th chapter second verse it says in the mouth of two or three witnesses let every word be established so if you have a dream you pray and say God I want you to confirm it so sometimes it may come as the dream itself and be a confirmation of something God has been speaking or sometimes there will be other confirmations that come so we need to receive confirmation that this is what God is speaking to you a very important is you listen to the inner witness of the Holy Spirit Romans chapter 8 verse 14 and 16 the spirit bears witness with our spirit that we are children of God so the Holy Spirit bears witness with your spirit so there is an inner witness of the Holy Spirit okay so you have a dream Holy Spirit is bearing witness this is from God there is a piece of God in your heart Colossians 3 verse 16 let the peace of God be the empire in your heart right so God's in your heart so you've got the confirmation then what we need to do is then we need to step out and work it out by faith just like Abraham which we read in Hebrews chapter 11 8 onwards you know Abraham was called by God to go out and it says here by faith Abraham obeyed God and he went out not knowing where he was going so he had a word from God but he still had to obey by faith and that's the same with us also we God speaks to us maybe in a dream a prophecy through scriptures however but we need to obey by faith okay I hope that helps Krisha okay any other questions questions from here yes go ahead you can sit down and ask sit down just speak loudly so I can hear you go ahead okay I understand your question please sit down so the question is we said that faith cannot override it cannot change God's sovereign will so if a person we pray for doesn't does not get healed does it mean that it was God's will for him not to get healed so that's the question so to answer that question we must first ask another question which is what is God's will concerning healing and we know from the Bible that it is God's will to heal every person of every sickness how do we know that many scriptures Psalm 103 verse 3 lest the Lord or my soul forget not all his benefits he forgives all your sins and heals all your diseases it's very clear God heals all our diseases and Psalm 103 is for everybody it's not just for few people anybody can read Psalm 103 it's for them so God heals us of all our diseases so another way we can say it is whatever Jesus did on the cross he did it for everybody what Jesus did on the cross he did it for everybody he bore all our sins on the cross that's why we can tell any sinner it is God's will for you to be God's will for you to be saved why because Jesus bore the sins of the whole you are with me so when a person comes and says I want Jesus to forgive my sin we never say I will pray and I will ask God whether it is will to forgive your sin or to come to heaven or go to hell no we know instantly because Jesus died for the sins of the whole what Jesus did on the cross he did it for everybody so what else did Jesus do on the cross on the cross he bore our sicknesses and our diseases so that we could be here so even that work of carrying our sickness and our disease so that by his tribes we could be here is for everybody because he did it on the cross whatever he did on the cross he did it for everybody so when a sick person comes we say hey just look to the cross the same cross on which he bore your sins he also bore your sicknesses and diseases that's why we can say so the answer to that question is it is God's will to heal anyone of any condition any disease another reason we can say is look at the ministry of Jesus in the ministry of Jesus Jesus is the perfect expression of the Father if you want to know the will of God look at Jesus he is the Word who became so this is the Word of God in action this is the will of God in action in the ministry of Jesus not even once did he tell a sick person oh for you it is the Father's will for you to remain sick God wants to make you very spiritual God wants to teach you a spiritual lesson one person he spoke like that in fact the Bible says all who came he healed so that's the will of God right so like this we can look at scripture we can prove that it is God's will for any sick person to be healed from any disease so having knowing the will of God we can pray with faith expecting that person to be healed so when you pray for a sick person you never pray if it be that will please heal this person never pray like that why because God said I already told you my will why are you saying if it be my will so we never pray like that oh lord if it be your will heal him else take him to heaven we never pray like that that is the wrong way to pray why because we already know the will of God Jesus never prayed for a sick person that way there was only one person the leper he came to Jesus he said lord if it be your will healed me Jesus responses I will be healed so it is not good to take the children's bread and throw the dogs yeah so when Jesus came in his earthly ministry his first priority was to minister to the Jewish people the nation of Israel so that's why even in Matthew 10 when he sent his disciples he said go to the lost sheep of the house of Israel that means right now God's plan was minister to Israel after the death and resurrection of Jesus then the gospel was to be preached to all the nations you understand that so that's why at that time Jesus told this woman I can't take what I'm supposed to give to the children meaning Israel and give it outside I can't do that but what happened her faith jumped the fence right she said but God just give me crumb from the table enough so even at that time even though God's plan was only for the nation of Israel at that time she was still able to receive by faith you know so faith overroads at that in that particular case right because by faith she received although that at that time God's plan was for okay so it's like an exception you know God did that let me just answer one question in the chat Surya will faith alone can say from anything and from everything so Surya let me just answer that question like this you know the word salvation in the Bible in the New Testament is the word sozo and I think you will be studying about it in lifestyle evangelism class as well salvation the word salvation in the Greek is sozo and it's a comprehensive word that means when the Bible says saved or salvation it includes darkness of sins healing from sickness deliverance from demonic power victory over evil or sickness is whatever the works of darkness so salvation is comprehensive it simply means that God is taking us out of everything Adam put us under so by grace you are saved sozo by grace we have sozo through faith so the answer is yes everything God is keeping as that package of salvation we receive by faith that's why we can say you know forgiveness of sins healing for your body victory over sin victory over demonic powers deliverance safety preservation wholeness emotional and physical healing it's all included in that word sozo so everything that God is giving as salvation we receive by grace through faith I hope that answers your question if it's not clear please let me know Surya any questions here yes Charisma please sit down yeah go ahead okay say that again if a person has faith oh is that predestined by God no I'll give you a word please sit down Matthew chapter 15 all the same passage he referred to verse 28 this woman comes to Jesus and Jesus says oh woman greatest your faith be it unto you as you will we'll study it in the coming chapter so how will was involved her will was involved not the predestination of God or the predestination of it no it was her will she decided to go to Jesus she decided to have faith oh woman greatest your faith be it unto you even as you will another reference on 15 verse 7 if you abide in me my words abide in you you ask what you will and it will be done for you so faith involves our will we'll study about that okay so time is up time is up already so thank you we'll pause here we'll continue this next week okay please take your break I would like to pray but time is already gone so I don't want to delay the next class thank you guys thanks for joining online see you again next week God bless


lands with crappy Docker files, which is a shittier version of Bash versus writing and stuff that's much nicer like Python or Ruby, etc. Do you see in this future a way for us to be able to share code and best practices so that we can stand on the shoulders of giants rather than on their toes? I don't have a great answer for that. I will say this, maybe if we're not spending so much time messing around with the configuration management code, we can actually push best practices upstream into the packaging of these applications so that they install by default with good best practices and not have to have Chef configure your good best practices later. Beyond that, I'm not quite sure. I'm over here. It seems like in your mind, this is about security patching. It sounds like in your model, security patching has equal weight no matter how big or small the security patch would be. In the ideal example, a kernel patch is equally painful on either case because you'd have to patch and reboot no matter what. In your case, you would go and patch and reboot anyway, that's cool. The middle case would be like OpenSSL where you have to patch and restart. You guys better be. You don't just patch. You have to patch and restart. Then the minor case would be like a shell shock where you need to patch Bash, but it sounds like in your case that you would patch and then shift and reinstall across your entire fleet to patch Bash? Or if not, do you just sort of wait for the next cycle? I was wondering about strategies for small patches or are there no small patches?  I think the thing that's great about this is because you're releasing every time you push code to your application, you're releasing a new copy of your whole operating system and everything. You get so used to doing that. Your application teams are so used to rolling out new AMIs or new Docker images that, yes, it's the same amount of work to roll out a kernel patch and a change to Bash, but that amount of work has become routine, trivial. I was looking at some stats at Netflix. We're pushing 4,000 times a week. When you think about something like a security update where you've got a kernel change, you might grab the teams that have servers that talk to the internet directly. You might push that code out. You might force them to rebuild and relaunch immediately. The same thing for your SSL vulnerability. Something like a Bash vulnerability, you've got a situation where there's some risk, but you can put that into your standard update process. It'll roll out over the course of a week. You can make your own decision as to whether or not that's critical enough to patch that way or force a rebuild across your whole infrastructure. Yeah, so the question just so that makes sure the recording gets it was how do you make sure that your whole priority security patch makes it to all of your infrastructure. The answer is we run an auditing script that looks at all of the infrastructure and will alert and notify owners of applications if the base AMI that they're running on is out of date by whatever defined spec. Normally, that's one quarter. You shouldn't be more than a quarter out of date, but if there's a security update and we need to change that window to a week, then we can notify everyone who hasn't questioned the past week. So that way you can kind of maintain that urgency on updates to all of your infrastructure. Hi. Just a quick comment because I am a database geek. I would say that you can totally do databases as immutable infrastructure.  You can do single master databases. You just need to be not afraid to fail over. And I'd argue actually the benefits for doing it with database systems is actually if anything greater than the benefits for application code. Cool. Well, you guys get together afterwards and hash it out over beer. I might be misreading you, but I feel like you're sort of equating AMIs and Docker images somewhat. I am, yes. And I feel like they're kind of different paradigms and I mean, I have nothing against Docker files. I think Docker is the greatest thing since sliced bread, but they are kind of different paradigms, like different ways of looking at systems, right? Containers versus systems. Containers, I mean there was a whole talk on containers versus VMs earlier yesterday, I think. There's definitely a difference between containers and VMs. The argument I was making, and I'll let you finish your question, but the argument I was making is that in the world of immutable infrastructure, you can think of them very similarly in that you manage a collection of VMs or you manage a collection of running Docker containers. I've also seen some people who struggle with how Amazon runs things, they run one Docker image per VM. So like, you know, that works that way too. No, but I guess, like let's say you were starting fresh with a project and you're like, well, should I Dockerize this or should I AMI this or how should I make this? What would be considerations about that initial sort of, let's see how I want to create this immutable infrastructure? I think today if you're doing a greenfield deployment, I would start on Docker, but that's just sort of like an instinctual thing. I don't think I have a sound rational argument for why I would do that. I think there's a good argument to be made for either one, and you start thinking about your own use case. Put that outside the topic of this talk. So I had one more question about that. I want to ask you like how immutable would a given system be? So like let's say I spawn a virtual machine, it runs my thing. Like is the user read-only? Is it actually read-only? I mean like how far down that rabbit hole would you recommend going? So Mark Bridges from CF Engine has this argument that nothing's really immutable because as soon as you turn it on and bits are moving like it's been muted. But I think, right, you're still going to have log files. You're still going to have parts of your system that change as part of operation, but I think the idea behind immutable is sort of more of this golden image idea that like you're really, you have a very, very known start place for every instance that launches, and you don't ssh into that machine and change stuff on it while it's running. You don't run configuration management on it. Sure, your application is probably going to write some log files and maybe like have some log files to set state and things like that, but fundamentally you're not as a user changing the system when you are ready to upgrade the application you're going to destroy the system and start over again as opposed to working with upgrading an existing system. So we can argue about the definition of immutable. Have you ever seen this pattern or suggestions for doing this with things like developer workstations to keep developers have the same versions of things? Obviously you're not rebuilding, you know, max every night or anything and they have their own cruffed in tools and usually that's the configuration management thing or you have some other way to package it. I know Ticketmaster just gave a talk that they're packaging their tools in Docker containers and shipping those out, but that may or may not be the right solution as well. So I really like this idea that developers do a lot of their development on VMs that are in the cloud and that you destroy and create the VMs as you need them unless you do that on your local workstation just because then you're starting from the same clean slate every time. Obviously that requires your IDE to be capable of working like that, requires developers to adopt a few different patterns, but it also means your developers don't need crazy-ass high powered workstations, they can just like use essentially a terminal. So I certainly like that methodology, so I do a lot of my work, but I could see the arguments for pretty much anything. Okay, I just wanted to be clear about one thing or two. It kind of relates to the definition of immutable, so it's probably because I'm an idiot, but it might help others, but it doesn't mean if you have an application that needs to dynamically create IP tables rules, it's like things can be changed, right? It's not that things on the instance never change, right? But the idea is that you're not upgrading the instance. And then the second thing I want to walk out of here and know your opinion on is, so if I have like, you know, scntp.com or whatever, I want to change one thing about that, like iBurst, whatever thing. So the philosophy here is to make a new image, reprovision everything, right? Yeah. Now hopefully that's something that like, NDP doesn't something that's an urgent change, right? You build that into your base AMI, it's going to roll out over time. Most of your applications will pick it up within a week because most developers push more than once a week, but like everybody will get it eventually. Yeah, and I hate to split hairs about this part, but you had to think about the promise of configuration management, right? Things being out of sync. Yeah. It's not that this addresses that or makes it go away, right? It's just that, well, we already have that problem, so it doesn't matter if we still have it, right? The out of sync. There's two ways of thinking about that. I think, yes, the way you said it, but also most frequently my issue is not so much that like my application tier and my web tier are out of sync as far as their NDP comp file. I'm more worried that all of my web servers are the same and all of my application servers are the same. And this gives you that promise. Got you. So you know, we were talking about, we're rebuilding an AMI every single time. So do you like offload that to a team that get installed new packages every time? So you have an automated process that builds your base. You're talking about the base AMI? Right, yeah. So the base AMI is just kicked off by an automated process that runs on a weekly basis in general and can be run, like can be kicked off by a force update process in some other way. Netflix, the performance engineering team is responsible for that image. I could see, you know, an infrastructure team being responsible for that image. You have someone who's like responsible for making that, building that image. And however you want to build it, you can either start from yesterday's image and just run app to get on it, you know, app to get update on it, or you can run or you can start from scratch, you know, download the vendor's base image and run update and then install your infrastructure packages. Like that could be done, you know, I said that in my talk, it could be done with a configuration management tool, but like, again, we're down to like five people in your company at most needing to have to ever deal with that tool and it only runs in the sandbox of which is your build pipeline for your base AMI. So it still makes sense to like have a reproducible way to build that image, whether it's an AMI or, you know, virtual shoe or whatever, right? Yeah, you definitely want to have a process that builds your base image, that's completely repeatable. What I wanted to mention is I agree that immutable infrastructures have a lot of advantages at the same time coming back to configuration management. So one of the things we are losing in mutable infrastructure is if you look at the configuration management, so there's a lot of now how in models, for example, Chef Presby's, Tapas Manises, etc. which then, for example, give you an example I've been using for many years right now, for example, the Ancient X, the Apache cookbooks from Chef and there are the side-offs that at the end have a configuration file, which you have in Docker, in the Docker image. You have actually a lot of resources which are built around it and which help you to basically, it's not only the configuration file, you will also configure, for example, your modules, whatever, and that's something you're actually losing in a Docker file. Because in a Docker file at the end, you will just basically have a Docker file which hopefully has some same values in it and if not, then you will basically have to go back and actually to rebuild it by yourself with a configuration management tool, you have actually all this kind of intelligence in those configuration management scripts in there, and that's something that we're losing. So what I'm kind of proposing is that that's something we should as well add for Docker. Yeah, I think, I mean, that's back to the are we losing a bunch of knowledge that we had in configuration management as we move to a new paradigm and I think there's an argument to be said that public, published like, Jeff Brazell has all these, this whole repo of great Docker files for building Docker desktop applications. You're going to want to publish your Docker files so other people can learn from how you do your Docker. Just like you can publish your Chef recipes, you can publish your Docker files, other people can look at them and learn from them. I think that's a perfectly reasonable thing. Yeah, but I mean, so the Docker file is just only the binary file out of it, and then you have some possibilities to have basically some parameters you can pass in while when you have configuration management, maybe actually if you pass in a certain amount of parameters, you're already... I think the Docker build file... The Docker build file is something that you could publish. Now I was saying earlier I don't think that that Docker build file should have much in it, but I mean if you want to share some of that knowledge, maybe that's a way to do it. I don't have an answer to that particular problem though. So that's kind of a gap which is for me kind of missing, which could be actually technically fixed, so there would be nothing stopping us from having a DSL which then can be running as a kind of a pre-processor for passing that in. I think we're like almost out of time, so let's take this whole conversation to the bar and let maybe one more question. How do you recommend handling cases where the application may need secrets so you don't want to bundle into the image like passwords or certificates? Yeah, don't bundle secrets into your application. You should have some way of doing secret discovery, distribution in your infrastructure. Like that's a whole separate talk that I could go and do, but I know that HashiCorp has an application for doing that. Netflix has some open source stuff that's coming out soon that will help with that. There's a huge world of, yeah, that's just a whole other talk, but yes, don't bundle your secrets into your Docker files or your application. Great, thank you, John. It's a great talk. Hey, hey everybody, good afternoon. Last session of the day. I want to introduce Ben Carrow today. He's going to be talking about the dark arts of SSH. He came here from Portland. Give him a warm welcome. Thanks, Matthew. Okay, Mike's working good. Yeah, this is the dark arts of SSH to make sure you're in the right place. Thanks for sticking around for the last session. So where are we? This is SSH. It actually, OpenSSH has a logo. It's the blowfish and here it is. Not many people get to see this thing, but some artists spend a lot of time on it and I think it's kind of cool. So we're going to talk about what is SSH, how is SSH used, some of the more advanced topics, and some things from the long tail of applications that use it and libraries that use it. Yeah, things we're going to talk about libraries, X-forwarding, some really cool things to do that are a little better than X-forwarding. But first and foremost when you learn about SSH, the first thing you learn is I can use this to connect to a remote machine and I'll get a command line on there and I can type commands. The second thing you learn are these things, keys. When you log in, you're kind of sick of typing passwords, so you want to be able to log in potentially without typing a password if you're doing it a lot, like a lot of sysadmins are. You can think of keys each as a unique identity. There's two parts. There's the key like you hold here or you can see here and there's the key holes which would be like the servers you could log into potentially. So there's a public or private one and they can have a password or they can have no password. And if you're thinking, okay, if I'm sick of typing my password, why would it help to give my key a password? Aren't I going to type that as well? Well, yes, except if you use this thing called an agent which I'm going to talk about in a little bit. But first, I'm going to talk about creating some keys. This thing right here is an old style key maker. These things are really cool. So that's what we're going to do now. And I apologize. There's some code blocks in this talk. I can try and make these bigger for folks in the back, but let's see. Can we see this? What happens if I increase the size? Is it going to throw my presentation all the way off? Yeah, that looks okay. Let's see if it screws up the slides later. But what we can see here is we run this command called SSH key gen. And it will ask us a couple questions like what file name do we want to give our key that we create? And do you want it to have a passphrase or password? And then you press enter again because most people don't put a password on it. And it says, hooray, you've created a key. I'm going to put it at these file names. And then there's one last piece that it prints out. And this is a relatively new feature of SSH and by relatively new, I mean in the last five years or so, art. It's a beautiful piece of ASCII art for you that's unique to this key. And if you don't know the command to actually find this thing, it's difficult to get it to print this. It's kind of tricky to get it to print it again. So when you generate it, it will show you this little piece of ASCII art. And if you want to see it again, there's a command down at the bottom, SSH key gen, and you pass it that command in the file name that shows you the art again. This can be useful because no one really wants to read the print up top there, and the open SSH authors knew this. So they wanted to create a representation that might be a little more useful and easier for humans to use. So let's go over two keys. We have our private key, which pretty much looks like this. If you just look in the file, there's a comment at the beginning that says, begin the key material, and then it prints out all the key material there, and then says, end key. If you've ever used GPG, you've probably seen a lot of files that look exactly like this. Yes, and if you have a key with a pass phrase, it'll look a little bit different. You'll have these two extra lines that I've highlighted up there to give it a little more information about it. And that's about all there is to a private key. Let's look at a public key now. This looks a little bit different. For open SSH, there's actually two styles of SSH keys. There's I think the regular P-E-K style, and there's the open SSH style, which we're covering here.  And the format is key type, space, the key material, space, and then a comment. And usually that's, usually comment is like a username at host or something about where you generated the key. And SSH-RSA is the most common. That's going to be RSA style keys. You can have DSA style keys as well. And one interesting tidbit there that the middle section, the key material, is in a special encoding called base64. So it's a lot easier to transport over network. And if you look at the very beginning if you send that to the base64 command and pass the dash D flag to decode it, it says the key type in there already. So the first one is kind of redundant. So how do we use these things? We place them in this directory inside the SSH directory called authorized keys. That's a manual way to do it. SSH comes with a command called SSH copy ID and you pass it dash I and then the key name and where you want to send it. And it will basically do what you see in the first block of code up there. One of the cool things you can do is there's a service called termbin.com which is an open source service and you can echo things to it from the command line and it's a paste bin. It will paste it for you. So in this case we are echoing our SSH public key and then telling termbin.com please post this for me.  This is one of the easiest ways to send public keys if for example you need to do this over Twitter or something that's going to limit your length. So let's take a look at an authorized keys file real quick. This is the anatomy of an authorized keys file. You can see in the first block there's two keys there. There's my personal key Ponderosa and there's my work key for Mozilla. And those are very simple. It's just one key per line and optionally there's a bunch of options that you can associate with it and I'm going to go into those a little bit in the next slide but we can see here if we want to restrict someone to only playing NetHack we can do that very easily with authorized keys. That means when they log in they're just going to go straight into a NetCat game. No shell. These are the options you can do. There's a command. There's an environment if you want to set your shell to a table flip. You can use this to kind of allow only certain sources of addresses in and you can restrict other options with this as well. Interestingly there's actually like an RC file that gets run whenever you log in. I've never heard of this until about a week ago. It's .ssa slash rc and that file just gets executed whenever you log in. So if you want to do some kind of setup you could do it from there. Next section. Can anyone tell me who this is? The Twin Peaks fans in the room? The special agent Dale Cooper from the TV show Twin Peaks. I wanted to use this as an example to talk about agents. Agents are processes that run on your machine that handle the registration of SSH keys for you. Examples of this are like an SSH agent that comes with OpenSSH OSX has one built in called keychain.app and Nome has a key locker. Yes, Nome key ring that does the same thing. The OSX and Nome ones actually have pretty GUIs and you can manage passwords in there and certificates and all sorts of wonderful things. But for the purposes of this presentation I'm just going to show you the hacky little agent usage that I use and a lot of other people use if they don't want one of the more robust solutions. With this you just run eval and then SSH agent and then it starts it in the background and prints out a couple of environment variables for you. So you just make sure these are set whenever you want to use them and then it's running on your behalf. And whenever you try to start a new SSH connection it knows to look for these environment variables and then use them to try to talk to the agent before they send you for a password. By default when you start the agent there's no keys in it. So you have to add one and you just do that by typing SSH add and handing it a key. And then if it's got a password you type the password and then it stores the unlocked key in memory for the whole life of the agent. You can set timeouts on this and it's a best practice to do it. Let's move on to a little more configuration. You can check these out in the man page for SSH and SSH config. There's a file in .ssh called config and it has a couple blocks in there. The two kinds of blocks are host and match. And the host block you give it a nickname so mine is IRC and this is the server that I run IRC from and you can give it a couple options like what is my host name that I want to connect to, what is the port. You can set up port forwards from other things in here and you can also chain these together. With match you can glob all of the host names together so I know that whenever I have to log into a Mozilla box my username is always going to be bcarrowatmozilla.com so instead of having to type that out all the time I can just stick it in a match block here. So let's say we've connected to my host and now I'm having some really bad problems with a shaky network connection. There's a couple things you can do to try and keep your session alive and make your host more aware of when your network is being shaky. Maybe it should retry a couple times. Maybe you want it to fail right away. The first of those options is TCP keep alive and this is basically your host sending little network pings to the remote host to try to make sure the connection is alive and if it's not let's say it doesn't return and there's a timeout there of maybe 60 seconds it'll just hang there and after 60 seconds go by it will just kill the connection. This has a problem in that because it's TCP an attacker could actually spoof it and try and keep your connection alive for longer and that might be something that you can run into. So SSH built in an alternative called the server alive interval which does the same thing but because it's not done on TCP and it's done through the encrypted channel then an attacker can't go in and just send keep alive for you. Additionally there's another little tool called auto SSH and it's a wonderful thing in that it has exact same commands as SSH but when the connection dies for some reason it'll just start it right back up again. The best way to use it is to type SSH and you get the command you want in and then to make it a little more robust with a restart behavior to make it enterprise software you just replace SSH with auto SSH and it does what you'd expect. But let's say your network connection is even more unstable. We have another thing called Mosh and this used to be a relatively new project but now it's much more common to use for developers and for people who have to SSH in from coffee shops which might have a connection that you're sharing with other people and it just doesn't have that much bandwidth and you can use it like SSH except it has a couple limitations and there's a couple kind of scary things about it. So in our first code block here instead of SSH we're just typing Mosh and we're going to host.example.com and then you log in and then let's say you close your laptop and you get on an airplane and you log in from another coffee shop afterwards and you open your laptop again you'll still be connected to host. After it does the initial handshake it will just use UDP so if your source address changes it can roll with that and it'll just resume your connection to the other side which is a really cool feature when it came out and I'm happy that it caught on and is maturing more. It does have some scary parts like if you look at this bottom code block here we're finding the Mosh process and then we're looking at the environment variables and if you look at the bottom highlighted line there that is the key material that is private key material that you can just pull from an environment variable which is kind of scary but as long as your user never gets compromised it won't be an issue but Mosh has a couple restrictions that I mentioned earlier and one of them is that SSH can have arbitrary data channels that's what lets you do port forward and exporting cool things like that but Mosh is just a single data channel it doesn't actually support any of that but if you don't need that then SSH can give you some cool features like local echoing so if you have a momentary lapse in your connection you can still see what you're typing which is really useful for things like IRC on a shaky connection. Another cool thing you might not have seen is SSH has a little command line built into it so if you type tilde dot no no tilde dot will kill your connection don't type that one unless you want to. Tilde question mark is this whole thing out here and it allows you to do things like background SSH make a new tunnel, kind of redraw the screen print the help message and you can kind of generally administrate your connection through this little interface here when I first saw this I thought it was really cool because it's like I found this secret command line that I never knew existed.  Speaking of the arbitrary data channels though I want to talk about tunneling for a little bit. What do I have up here first? Yes, forward that's like forward forward? Yeah, forward port forwarding is when you're SSHing to a remote host and there's something near the remote host or on the remote host that you want to get access to. So in this example we have an internal wiki at Mozilla and I want to be able to get access to it without dealing with VPN software or anything like that. What I can do is I can say SSH dash L and the local host is implied there but you can replace it with something else if you want and then it says I want to make port 8000 connected to internet.mozilla.org the wiki I want my port 8000 to be port 443 there and I want to get there by going through the host ssh.mozilla.com and as long as that you can hit enter and as long as that SSH session is alive you can open your browser and go to local host port 8080 8000 and you'll be presented with the thing on the other side. Reverse forwards are the exact opposite of that. Reverse forwards I'm going to use in a little trick right after this. They're really cool there like if I have a port on my laptop and I want to expose it to the internet I obviously don't have a public IP address here but I have one on my co-located server so why don't I just SSH in and use a port there to give everybody access to something I want and you use that exact same syntax for it the dynamic forwards that's the outside one and 8000 would be the port on my laptop dynamic forwards are a SOX proxy which is a way of transparently tunneling traffic through it so instead of having an http proxy the specific to http or something like that a SOX proxy can deal with all of the TCP traffic on your host and how you start that is you just pass a dash D and then a port number is usually 1080 if you find the tutorials or something on the internet and that will just sit there and open up port 1080 on your laptop and any traffic you tell to go through there will come out the other side of the SSH connection one last thing I wanted to talk about here is sshuttle which unfortunately got cut off but this is a really cool project by a guy named Aaron is there a bar? I would love to scroll down oh that's unfair tell you what I'm just going to go to the github page there we go cool it's a proxy but it's done at the IP tables layer so your system firewall layer and how you use it is you basically just oh god I can't see that I'm going to go over here for a second yeah wow that says absolutely nothing okay yeah you get cloned it and then it has a binary in there called sshuttle and you tell it what host to connect to and whether you want DNS to be forwarded or not and then you turn it to the IP tables and transparently tunnel all of the systems traffic through it and this is a really cool way if you don't want to end up mucking with socks proxies if you're turning them on or off a lot you can use this this works on OSX it works on linux and when you're done with the firewall you just hit ctrl c and kill this and then you're back to your regular system and it's a little bit more of a transparent proxying I wrote a little code block here for it a couple things here I already told you about ssh-d and then the port there's a program called tsox which is like this little shim binary on your system and it has a config file at ctsox.com and you just tell it where your sock server is and then it will intercept all of the network calls the network system calls and run it through the socks proxy first so there's this website icanhasip.com and if you go there it will just show your IP address it's very useful for testing or scripts or something else so in this case we're doing that at first we get our local address from here and then we do ssh-d and then if we do that again at the very bottom instead of getting your local address you're going to get the address of your socks proxy shout out to Rockspace for hosting this little service I'm glad it's up there for all my scripts I'm going to be really screwed if they take it down one more example with the tunneling thing sneaky tunneling trick it turns out that python has this feature where if you pass dash m a module name it will run some code associated with that module and in python there is a really cool module called simplehttpserver and it does exactly what you expect so oh god alright so I'm going to go into code and I'm going to do python-m simplehttpserver and I'm going to say in a second here there we go it's listening on port 8000 so if I just go to localhost on port 8000 it gives me my directory and this is really useful if you want to share local files to someone over the network but it's even more useful if you combine it with that ssh trick that I showed you earlier so if I do ssh-r and then just says listen on all interfaces for this traffic and then port 5000 and then localhost because I'm running it on my laptop and port 8000 and then tell it where to go publish this as soon as I log in it started sharing it so let me go back here and I'll just go to bke.ro which is my domain and port 5000 and suddenly I just shared my code directory on my laptop on the public internet this is really useful if you have some files that you need to give a vendor but they're behind a firewall and you totally can't give them access you can do something like this to give them a little bit of access and make it easy for them to go see whoa there we go another cruel trick is x forwarding this is kind of a classic x trick that they added support for a classic ssh trick they added support for a long time ago if you just pass the dash capital x option and it will start an x session and forward all of the windows to you it's kind of because x was written a long time ago it makes a lot of synchronous calls and it's kind of slow and it has this huge security model and if you don't want to deal with that for performance reasons you can just pass ssh-xy and then I have a server called s and I'm just going to run bash on it so now if I just type xterm and we wait a really long time for this internet connection I should get an xterm window to pop up the dash y option is insecure mode there we go it does less round trips now I have a little xterm from my remote server and it's okay to do it for xterm but you can also do something like firefox or you can do something like a music player or something else firefox does a huge amount of calls so it's really slow to start up so we're definitely not going to wait for that there is one more let me see one more tool called xpra firefox thanks buddy wow so like going to cnn.com or something is probably going to take a minute or more something that's a little more useful than this because when I control c out of this it's just going to kill firefox but what if we wanted to stick around for a while there's another utility out there called xpra which is exactly what it sounds like you ssh somewhere and you start an x session and then you can attach and detach from it just like a console screen and you just do that with the syntax here if you're interested in that tool you can go to xpra.org and it's available for windows mac and linux and for linux they actually have repositories for all the distributions too let's move on to multiplexing connections one of the cool features that ssh has is that let's say I have my big host that I ssh to all the time instead of maintaining 1100 tcp connections to it I can maintain one connection because ssh supports multiple data connections so why don't we just use those the way that you can use these with ssh are a couple options that you have to set in the .config file one is called the control master and that just tells it to turn on or off and then the control path which is the file system path to the socket file that it uses to communicate so the way you turn this on is you just add the two lines control master yes and control path and then put it somewhere in your home directory and then no matter how many times you ssh to that host they'll all just use the same connection yes okay is that a hard limit or is it okay yeah it's really cool it has kind of a bug in it in that sometimes when you exit the connections they'll just hang there and if you have control c it'll kill all of your other connections so I turned this on once for a performance optimization with like some server scripts and we ran into a bunch of hung connections and it turned out to be that yeah let me see is that yeah so I I put a little timing thing under there so you can see when I ssh the first time it'll take a couple seconds to spin up but the second time is almost instant alright moving on to some more things there's some libraries that are really useful for this parameco is one of them that is a library to embed ssh in your applications so this is really useful if you're making a web server or something like that and you want it to be able to talk ssh so if you're making a maybe a github clone or something like that and you have your users upload an ssh key and you want to be able to use that somehow you can use parameco to do that from your application and twist it is kind of the same way but that's more for writing custom servers so if you want to write a custom server that has some weird behavior like forces everyone to play nethack or doesn't ask for a username at all or it parses the username into we used to have a back where I worked we had a switch server a console server so you would ssh into that with your username plus and then the port number and it would figure out which computer to connect you to. This is a piece of hardware that sits in a server cabinet and has a bunch of monitor and keyboard and mouse cables going into each server so I'll ssh in there with my username is bcarrow plus 8 and then it will connect me to server 8 regular ssh can't do this so if you need some behavior like that, twisted conch specifically makes it fun and easy to do that yourself unfortunately I don't have my demo working right now but yeah so I apologize alright you probably can do that do they support ssh like handshakes they might to do that you can do the open ssl command line and then sserver kind of a basic input output that you have to write another program to go do yeah so it's an interesting question I don't know the answer I'm sorry so let me see some best practices for the server permit root log in no by default on some distributions you can still log in as a remote user over ssh the general recommendation is to create a non-eroute user and then log in as that and then use sudo or sudo to set that up gateway ports these things disable users from binding ports onto non-loopback so like the trick that I did with my file sharing where I expose that to the internet I wouldn't be able to do that I could only expose that to local hosts so other people on that computer could look at it but not the internet in general this is useful to turn on or to disable unless you actually have a legitimate reason for it so disabling passwords entirely most of the ssh servers that you see exposed to the internet are going to have a feature like this simply because passwords are like a huge target so if you look at the failed logs the failed logins for ssh servers it's mostly just spam people are like brute forcing these servers trying to find a password with a common username and sometimes they succeed but if you turn on or if you turn off password authentication then they can't even start another feature that got added a little while ago is called the authorized keys command so instead of having an authorized keys file the server can specify a script to run and the script will return all of the public keys that are appropriate for that user so if we have this enabled in the server and I tried the ssh in there the server will run whatever command I specify here and pass it my username and the script is expected to go look at LDAP or I don't know Curl or like look in SQLite or something like that and return a list of public keys that are acceptable for me yeah so in review ssh is really powerful and it pays to secure it and it's one of our best and most mature tools for doing remote administration using SOX proxies sshuttle and tsox allows us to have a lot of great network agility it allows us to forget where we are like if I'm hidden behind NAT and it allows us to maintain a public presence on the internet and lastly little tricks like python dash and simple HTTP server is a great trick to provide access to vendors or anybody else that we might need to communicate with alright that's all thank you we have some time for questions if there's any questions some relatively noted using ssh just going to start in AWS with all these utilities that you as I'm sure you've probably heard a lot before the arch wiki is it one of a place to like the arch linux wiki even if you're not running arch linux they have a lot of user tricks and things like that in there you talked a little bit about ssh agent but you didn't talk about the sort of tricks of allowing it to follow you over multiple hops oh yeah that is an excellent point I apologize I think that was in the original material but it didn't end up in here if you pass ssh to the dash a flag your agent will follow you into all of your subsequent hosts which can be a great thing but it can also be scary because anybody else who compromised that host can then go make authentication requests on your behalf and so I know that the security apps people at a company I used to work for would warn people if they're going to ssh into a compromised host they should be sure to disable the agent forwarding before they finally got there yeah thank you for that you have slides available online somewhere yes you should go to bke.ro everything is on there so that's my blog WordPress instance thing and yeah right after this talk I'm going to post these any more questions alright let's thank the speaker for great talk