live. Hello everyone. We promised to break everything. We broke everything. Very good. Hi Ben, nice to meet you here. Ben, nice to meet you. I don't know where we broke, but as I said, this is a CNCF official event, so respect the CNCF code of conduct to everyone. And as we have here a great guy, Ben, Vice President of R&D at Armo, and we will bro the security of Kubernetes and show to us the code. Ben, thank you so much for joining us today. Thank you for having me. Let's go, break everything. Yeah, let's go for it. Hi, so are you there? Hello, do you see my screen? Oh, not yet, but it will. Hello, Tunis. Nice to meet you. We feel it's here. We are going just a minute. Just a minute there. Hacking easily. Oh, I will be more. Hacking is illegal, if you guys see, etc. Good. Hello, Mongolia. Nice to meet you. Thank you for joining us today. Hi, guys. Bruno Kaufman, my friend. Nice to meet you here. Thank you so much. Let's, oh man, let's, let's learn how breaking, not how not break Kubernetes. Awesome. With Ben, one more, please. Yeah, just tell me when to start and I will start here. You can start. Let's go. Yeah, do you see my screen? Not yet, please. I'm, I'm re-sharing my screen. Just give me a nod if it's being shared. Oh, for me not. I don't know. Got it level. I'm not seeing it. Let me check the if it is on Twitter. Okay. Oh, you cannot. Okay. We are, we are facing a little problem with the streaming, restrain. That way they did a bit more. Please. Oh, great. Awesome. Very great. So, hi guys. I'm really glad being to be here.  So, so what we are going to talk today, I'm going to show you our take on, on, on attacking Kubernetes. I'm going to show you a few simple attacks. You're around. And let's jump into it. So, just as Paul said, you know, I'm Ben, I'm a VP R&D at Armo. And just for your, you know, for your to know, I'm a white attacker for really long time. And I love hacking and just as much as I love Kubernetes. And, you know, we all love Kubernetes and cloud native.     So I know that I saw here that someone was concerned about, you know, the legality of, of hacking, you know, we are hacking Kubernetes and we are doing stuff in order to, to, you know, to make things better. And, you know, I, I also encourage everyone, you know, to report issues to the Kubernetes teams, rather than Kubernetes teams, if they found something else, just as I did before. So what, you know, what an attacker can once from Kubernetes cluster and Kubernetes system, you know, you may want to steal data. And, you know, here I'm talking about not just stealing data, you know, necessarily directly from the Kubernetes from, from a pod, but stealing data using the credentials that has been stolen for Kubernetes cluster. So think about all the, you know, cloud credentials, you know, you are having in your cluster in, in your different objects and also in your file system. So each of them can be an attack vector in the mean of stealing more data. Also, you know, Kubernetes cluster can be used to, to, you know, to gain computational resources. So it can be a, you know, it's going, it is a, it's an interesting data vector, you know, today that when people are looking for computational resources in order to do some mining and stuff like that, to, to use the Kubernetes in order to gain such computational resources. We've been starting to hear in the security community about ransomware in around Kubernetes. People are locking out administrators and, and locking data in order to, to, to, you know, to have some financial gain. And, you know, it's a real threat.  So these things that occur may want, you know, when we're looking into a Kubernetes, Kubernetes environment. So my story today, I always like to tell, you know, a framing story here around these, in these talks and, and our story begins with, with Google's, Google's online boutique microservices demo application, which is, you know, we are calling it hipster shop and because it was the old name and, and, and, you know, we have hipster shop running in the GKE in Google's own Kubernetes solution. And, you know, this is an online application, a web shop, which is running with Kubernetes. And it has some security measures in place. So containers are scanned for local abilities before uploading. We have installed Falco in this cluster.  So this is when the attacker is going to start to work. And just, you know, in order to, to, to enable you to focus on this whole talk on this demonstration and, and, and, you know, I will stop here and there to, to review questions and try to answer during the time to answer your questions in place. But my attack is, is, has been broken down to, to several smaller attacks. I'm going to, to install a malware or get the operators of this, of this Kubernetes cluster in order to install malware in, in their cluster. Then I'm going to use this malware to, to get, get into the pod of the victim. Then I'm going to steal the service account from this pod and, and from remotely, not from the, not from the Kubernetes cluster, but from remotely I'm going to use the service account to identify myself against the API server and start to communicate with the API server from outside the cluster. And, and then I'm going to start to steal secrets from your Kubernetes cluster. And, and after it, we are going to exit to, to the worker nodes and, and still more, more interesting things from there. So this is, this is up until now. And let's, you know, jump into, into the first vector, which is actually, you know, the, yeah, sorry, Paul, have you asked something? So, yeah, just, just one thing. Our friendly brain asked if you will talk about any attacks over the OS hosting from the Kubernetes processing. You covered this, this kind of attack today. So not true. So we are going to exit to the, exit to the OS level at the end. But at the beginning, we are focusing only from the Kubernetes layer. It's more, more of that. So, thanks. So sure. And again, just ask me questions during the time and I will stop for, for, for answering. So let's say that for now I'm taking the hat of, of, of the operator, operator of this, this solution. And, and, and as the operator, I'm, I'm opening my slack one morning. And, you know, I, I see that, that first, obviously I'm in the Kubernetes channel, but I, I returned to my home channel and I see that my friend just sent me that, that in the microservices demo, there is a new version. And I'm pretty great because I, usually, you know, I, I love new versions of, of the software because they are usually better. And, and, you know, I go to the GitHub and I see that, well, this, this, this must be a very, very good, very nice and very good version.  So I'm, I'm going into this public repositor at Quay.io, which has just scanned this image. And I see that, that it's, it's a pretty good scan result. Okay. The Quay security scanner has not detected any vulnerabilities in this, in this image. So as the operator right now, I'm, I'm, I'm pretty, pretty fine with installing, okay, this new version from this public repository. And, and what I'm going to do now is just before, well, I've got disconnected, maybe from, but what I'm going to do is I'm going to go to my solution, okay, which is working here. You can see the online boutique is, is up and running. And, and, you know, I can see my workhorse here also running smoothly. And from, from my control shell, okay, what I'm going to do is I'm going to patch, okay, this, this service, I'm going to install this version 0.2.2 of this front end. And, and, you know, we'll see what, what is going to happen. Okay. I've, I've updated with this new version, my deployment, and the new version started to work. Okay. And I'm the operator coming here doing some checks. And, well, it's still working. I'm, I'm still able to buy stuff in the boutique. So I'm, I, I feel fine. I am go to sleep now. And, and now to your bounce. So, sorry for interrupting you again. But you, when you put in your, your show, you can increase a little bit your character size, because it's seen, it's seen a little bit, just some, yes, a little bit more. I, I'm not, I think I've already the largest. I'm not sure that maybe the lights theme is better. Oh, do you think it's better? Oh, no, come back to black. I think that's okay. Okay. Okay. It's not okay. No problem. And please, if it possible, could you put your, your name, your Twitter account, people are asking. Yeah, sure. At the end. Okay. Someone switch screens if it's okay. Okay. Thank you so much. So for Interp too. So what's happened here behind the scenes is that I'm as an attacker. I'm switching, you know, my hats and I'm the attacker. I was able to add a back door into, into the new version of, of this front end component here. So actually, my code as an attacker is started to run in, in your cluster. Now you can say that, well, you know, I, someone took it from a public repository, but, but, you know, there was endless, you know, examples in the last, even in the last month of tainted images in public repositories. And I, I, you know, everyone was looking, was worried about cybersecurity and reading out cybersecurity. I guess, you also heard about some of the solar winds attack, which is what we call, was supply chain attack. And, and, and you know, exactly this is what, what it is, what I'm showing you that, that I published a malware enabled version of a public component in the public container repository, and I got someone to install it. So now what's happening at the next step? The next step is, is that the next step that as an attacker, okay, I'm going to connect my backdoor. Okay. So I hope the text is there here. So I'm going to connect this IP, okay, which is actually the public IP of this web shop at the service board. And I'm going to connect. Okay. Do you see my, my friends? Is it okay? We're going to connect my backdoor within the service, which is totally legit. And what I can show you that I've opened a reverse shell in the pod. What you see here, that I threw a TCP connection. I've opened a connection against the service. I've added my own request path and connected my backdoor, which was embedded in this new version. So right now you see that I've opened, opened this. If you want, I see that people still want even bigger text. I'm going to just put something even. Okay. So I was able to, to connect my, my malware. And right now I'm running a process within the pod. I've opened the reverse shell. So I have an access, access to the, to the system, to the pod inside. And, and the, when I'm inside, I'm, I can do different things as an attacker. Someone, Daniel asked what service permitted this. So this is not really a service. Again, we have taken a, a, a, a legit application and added a malware to the legit application. Okay. And, and someone installed this, this version, this malware version of this application because it was pushed into a public repository and no containers can reveal the actual problem with damage. Okay. So actually what's running here is it was the front end application, which you can see also in the microservices demo GitHub at Google. And what I'm going to show you that, that beyond just, you know, looking into the files, what I'm going to do here, I'm going to, to take one very, very interesting file here. This very interesting file is, wait a second, this doesn't look good, right? This, okay. So this file is, is the service account token. Okay. Service account token is, is actually the secret running the secret, which is, has been mapped into the Kubernetes pod. Wait a second. Okay. So service account token is, is actually the secret, which is used by the Kubernetes pod, which wants to connect the Qube API and, and make requests to Qube API. This token is used to authenticate this pod against the Qube API.  And this is used, okay, by Kubernetes in order to authenticate services. Now what I'm going to, what I'm going to do here, as I'm, I'm going, as an attacker, I'm going to take this service account token. Okay. I'm returning to my cloud shell, okay, which can be, you know, any, any other shell from Word. Okay. And, and I'm taking this token and, and I'm going to use it later. And beyond that, the token, okay. I'm also taking something else, which is a certificate. C-A-C-R-T. Yeah. So this is also the certificate, which is used for communicating with the API server. And I'm copying it just as I did with the service account token exiting now and disconnected from, from the pod. So, yeah, there is a real good, really good question here. So are all service account tokens mounted in the pod in this way automatically by Kubernetes? Yes. At least the question by us is really good. So auto Kubernetes mounts the service account tokens into the pod. I did not, didn't do any explicit mount here. And, you know, every Kubernetes pod has a service account by default, which is the namespace service account. And I, and, you know, you can see it in the pod, but you can tell Kubernetes not to mount this into, into your, your system. So, yeah, returning to place. I'm going to store my certificate also. I have an old certificate here. I'm just cleaning it up. And what I have here at this console, I have two things. Okay. Sorry. Two things here. Okay. One is the token. The second is the certificate. So I'm returning, you know, to show you where we are in, in this whole scan. So we've opened the reverse shell and stolen the service account token. Okay. From this pod. Now, the interesting thing is that, that I'm going to, that service accounts are, are a way in Kubernetes to authenticate services within Kubernetes. Now, the interesting part is that, that as of today, these tokens can all, can be used from anywhere to authenticate against the QBAPI server. So now you don't need, you don't necessarily need to be in the cluster. And why this is important. This is important because if I'm operating, you know, within the system, I don't necessarily want to do it from within the system. I, it's, as an attacker, it's way more easy for, easier for me to do it from the outside. I, I have to clean up less, less after myself. Okay. Doing that. Now, let's just go into one. I see that we have a few questions here. So, well, literally asked, I would imagine tokens should only be able to list view and not much harm unless our buck is messed up. So it's a good point. Okay. There are, it depends on you really, you know, what are you doing? Okay. There are public facing pods. I mean, public facing, you know, pods, which are, you know, can be accessible, accessible from the public internet, which do have, do have a service account, which is meaningful. So by default, a default service account usually doesn't have any interesting authorizations in the RBAC system. But, but they're allowed, which too. Okay.  And I, more or less, I agree with you. But, but, but sometimes, you know, for example, monitoring tools, which are used from remotely to monitor systems, usually need, you know, need a lot of authorizations. And they're also public facing. So it's a kind of good target. In this case, okay. In this case, you know, what we are going to do, we are going to use this service account token to start to talk to the Kubernetes API server. So there is a simple, prepared simple comment here, which I want to, you know, do a very fast walkthrough with you. So the interesting part is that I'm, I'm, I'm, obviously I'm using curl in this case, but I've added a header authorization header to the curl request authorization where the beer is contains this token with just, which we've just copied here. Okay.  And I'm turned to API, we want namespace is default. But so what I'm going to do here, I'm going to show you that that using only curl and this service account token, while not running inside the Kubernetes cluster, I'm able to do, to connect this, the Kubernetes API server. So I'm just need to set up here. The, the address is set API server, taking cluster. This is the IP of the API server from the outside world at port 443. Okay. And as you can see, I've just got a response using the, this token from the API server from the public internet. And not with inside the cluster. So it is, it is also, you know, a small proof of concept, okay, that you can start, you know, to, to operate against the API server using this token. As next stage, I'm going to show you, okay, that that I using this token, okay, and, and, and I agree with one of the questions, obviously this talk, the service account has privileges here in the system. But I'm able to, to, to start to jump Kubernetes secrets. So just as I did here, the, wait a second. I did my, my request here to pause. I'm just in the same way. I can request secrets. And I get the answer, okay, from, from the QB API. Also, I can go to the hipster shop namespace. Okay. And as you can see, you know, I can look into what kind of, of secrets are residing here. Okay. In this namespace. And I, I bump into AWS XSID. Okay. And this not just can be, you know, any kind of secret XSID or, or, or any kind of authentication token to other cloud services. So obviously, you know, if someone starts to access your secrets from remote, it is a problem.  And, and I was able to, you know, to, to dump the secrets remotely, you know, using golly curl and, and this token. But also, you know, I have other secrets here, like the, the recipe of, of Big Mac sauce. And here are the ingredients. So, you know, have, you have, you have here a lot of, you know, stuff you're taking from the API server. So, sorry for interrupting. We have a question very interesting. That is how, how, you know, the API server in the point. Yeah, of course. So you are talking about, you are talking about maintain or retain security, security key. And of course, you can use it everywhere. But to use it, one thing you need is the door. And the door is the end point. So this is a good question. Yeah. So, okay. I didn't want to cover here because I didn't see it very interesting, you know, in this talk, but, but there is an easy strategy. Okay. So scanning, scanning, you know, and crawling, you know, IPs and, and more or less, you know, the IP range is used by Google for, for, for Kubernetes API endpoints are, are pretty clear.  But, but, but it shouldn't be, you know, a big, a big task to, to find out. And yeah. Our friend, our friend Valid asked you if you can show how much access you have. Yeah. You ask it here. Yeah. I am going to show, show it at the end. But, but I cannot, but obviously Valid, okay, just, just as I told before, obviously, you know, this is a elevated service account. Okay. I, I don't have, you know, I'm, I, I agree with you that, that obviously it has authorizations, but just think about, you know, any, any monitoring tool that monitors cube objects and even secrets. I guess the cube API needs these authorization levels. So, so it's not really, you know, far-fetched thing that, that they, that they do have this account. So, this account do have elevated privileges, you know, beyond the simple things. So, return, okay, I've showed you that, that, that I've just was able to, to, you know, to take the secrets and dump the secrets out. Now, as the last part, and we are getting to the last part of this remote attack, what I'm going to do is, is creating, you know, more, more persistency in, in the system. And, and in order to do that, I'm going to exit the, the, this pod and not just, I'm going to create a new pod in the system, okay, which is going to mount, mount a host, mount the host file system.  And what I'm going to do is, I'm going to take from there the, the private key and, and certificate of the Kubernetes node, which is used to authenticate the nodes against the Kubernetes management system. So, as I told you, again, I still have these elevated privileges, and I've just created a new namespace and, and which is not really, you know, interesting, just fine things. And what I did is I've created a new deployment, okay, just let me show you what we have here. So, within this new deployment, okay, you have, again, the same core request, more or less, again, the same API server and host. And, and, you know, what, within this new namespace, which is called that namespace, I, I've pushed, I created a new deployment. And just to show you, you know, there is nothing really curious about, about this deployment, but what you have to, what you need to see here, that there is a mount, a volume mount within this pod, mounted from the host, the root directory of the host. And, and, and, you know, I'm, I'm going to connect this and in order to start to look on the host. So, let's see the questions. So, do we have new questions? So, this is one of our big Mac, but let's, let's put this in the, in the, in the, in the on them. Yeah, yeah. Okay. It's going to be on comment. So, yeah, where were we? So, this is the, for me, you know, doing these tricks, you know, the interesting part was that I've never used used the Kubernetes API beforehand from Curl, and you know, here I started to use it from Curl and at this stage of the attack, you know, I want to start to execute processes from using this authentication mechanism. And in order to do that, you know, in the one hand, I wanted to use Curl and in the other hand, you know, I need to connect the exact API of the pod in Kubernetes. Now, honestly, you know, I've never went to this site. So for me, I'm sure that most, for most of the audience, it's not, but for me, it was new that to see that that the exact API in Kubernetes is actually a WebSocket API. And, you know, when I realized that I saw that, that, you know, doing WebSockets in Curl is not a, you know, it's not an easy thing to do. So that's why I've just wrote myself a Python code, you know, which actually does this connection for me, you know, based on this authentication token. So I took some code from our stuff. Okay. And the interesting part is here, more or less, you know, this line, okay, which I'm using here to create the configuration for the Python module, in order to think that we are running inside the cluster. So I wouldn't call this an attack, but it's an interesting thing, you know, that, you know, that you can convince your Python Kubernetes module that, to take the token certificate you want from a different place, it usually takes. And then I'm connecting this Python module in order to execute comments on the destination pod. So what I'm going to do here is I'm going to get the pod name for, for us, which is what's bad name, space in space is pods rep name. Okay, so I have this and yet deployment name here. So I have here another thing here. So what we are going to do here is, is start to look on, on this pod which was, which has mounted this volume. And we are running in the bad name space. This is the pod name. And I want to see what we have, what do we have in this directory. Okay, so we are missing the certificates. Just give me a minute. So export certificates. So we don't have, okay, we have our hosts are not working. Certificate is, is not called certificate. Wait a second. I just need to check what they're wrong. I think I need to copy again the same certificate. Let's take it from here. Um, yeah, no, it's actually, I think I do think that I had a typo there. I just reconnecting. Okay, now it's working. So actually again, using this, this token, okay, I've looked into the, the host a, a file system under Warly Kubelet PKI. And, and yeah, I, I know that again, I see the comments, but the PAM actually with the A, I know that I did the before a typo. And that's why the database used PAM. So returning to this. Um, so with, if someone looks, has the whole host file system in, and especially, you know, under Warly Kubelet PKI, you know, there are these certificates here, certificate files, which actually contain not just the certificates, uh, but also, uh, private keys. So if I'm, if I'm looking into this, um, okay, I do see that I got the electric curve private key, uh, here and the related certificate there. So, um, in my, if I take it and parsing it, uh, um, if I'm looking to what do I have inside, uh, X509 in host PAM minus text, I think. Yeah. So I've parsed this file and I do see that, you know, I do have, uh, a certificate which is good for the next five years. So, um, if I'm taking away this certificate, uh, and I have, I can have permanent, uh, permanent access for the next five years, uh, to, to this cluster from within. Um, and obviously it's, it's a good thing for the attacker to take. It has, um, I can, uh, connect, uh, you know, the control plane of Kubernetes and start to get everything you have in this DCD for any type and manipulating it. So it's also a good thing, you know, to take away if something is running.  Um, I didn't get any notification from Falco about, you know, about, uh, any suspicious activity here.  So just, you know, uh, recapping, uh, uh, this stuff. Um, so we went from, you know, uh, from doing initial penetration to the, to the cluster using a front, uh, a front end application. Um, which was in, in my case, it contained the malware. Uh, but just as it contained the malware, it could have a software vulnerability. So I see, I think I saw, uh, last week, a very interesting, uh, other video, uh, which was posted in, in the Slack, uh, in the Kubernetes, uh, uh, security group, uh, uh, when someone did the same initial penetration, uh, using a well-known, um, uh, vulnerability in Drupal. Uh, but in, in our case, we used, uh, a malware and we've packed the malware, uh, um, malware, uh, uh, uh, to, to connect it. And this malware was, was what we call packed, uh, using a tool called Azure. It's an open source tool. And it's, it, it encrypts and decrypts, uh, the malware, uh, with, in the RAM. So therefore it is pretty, uh, um, uh, pretty stealth. Um, and it's hard to detect. Um, and when we attacked, connected this backdoor, we started, we took the service account tokens for authentication from the pod, then start to use the service account token, uh, from here till the end in order to authenticate ourselves from outside the cluster using this token. We showed that, you know, easily, if we have, if you have access to the QBAPI from the outside, you know, you can start to, obviously you can start to read secrets. Uh, you can start to bring a pod. And in our case, we brought the pod and, and also taken, uh, um, uh, from, uh, from, uh, our pod, we used it to, to mount the host file system and taken, uh, the node, uh, certificate and private key. And so let's go to, to some more, uh, uh, uh, some, uh, some more questions. Um, so, um, I have a question for valid. What would you, uh, what would you do if you wanted to defend against this attack? So it's a very, very good question. Okay. So, um, okay. Now I, uh, obviously I, I have a problem answering. Okay. Because ARMO is, is one of my companies optionally doing protections against such, such attacks. But obviously, you know, one of the most important thing here is to be sure where we are taking your, your software updates from, okay, subline chain is, is a very delicate thing. And, and obviously as, um, not just from commercial point of view, but from, you know, as a community, you know, we have to think of, of how we can better protect, uh, the supply chains and how we can better, you know, look for, for such a packed malware. Um, and obviously, you know, taking, uh, taking versions, uh, where you have a pretty decent, you know, um, uh, respect from the place where you have, you have taken it. Um, and, um, and also, you know, I, I do think that, that, that we need to improve our, our runtime detections. Obviously I, I, I do feel that although I understand why, but I do feel that it's not a good thing that, that you can authenticate using, uh, a service account, uh, um, from the outside of the public internet, from the public internet against the Qube API and Qube, Qube API is not checking the source IP. Um, although again, I, I do think that there is, uh, there, I know that there is design reason for that, but, but, but still I feel that there can be some improvement here.  Yeah. And more questions. Um, yeah. So Paul asked about this, uh, Drupal thing. I think that, um, yeah, I'm going to post it. I, yeah, it's here, uh, in the, in the security, uh, thread. It was posted. I'm, I'm going to, I'm writing down. I'm going to try to, uh, share it afterwards. More questions. Um, but there's a, for example, you cannot block APS or within the enterprise. For example, I'm just weird using githubs. Um, yeah. So it's also a good question. Okay. That's why Falco has not, uh, um, not reported access, uh, to ETC credits, PK files. Uh, there is a good reason for that because these files are, uh, can be used legitimately. Also the service account files can be used legitimately. Okay. So, um, these are legit files, which can, which are accessed by some of the processes. Now the question is how you can differentiate between the good process and bad, bad process, uh, because only obviously kubelet is accessing the PK, the private key files, uh, and within the pod also, you know, maybe the application itself uses this service account. So it's, it's pretty hard for Falco to, to not going into love, uh, none of false alerts here. Uh, um, yeah, I'm, I, I will, I'm going to share with you also, uh, Polo, where should we share everything, uh, the everything, the, you know, the things we've, we've just shown here. Yeah. Yeah. This, this show will, it's being recorded and, uh, I invite everyone to join us in chats for CNCF and of course, uh, invite Ben to, to be presenting CNCF slack, uh, because there we can, uh, share other contents. And, uh, after all, please put your, uh, tweeted account because you can, uh, share the, your, get, get, your, get, uh, entry to people, get their files, et cetera. It's so much important. Of course, again, everyone is welcome to be part of CNCF slack community and reach, reach us there and ask anything. Of course, I know that sometimes it's difficult to, to make questions. We have, I'll just from everywhere, YouTube, uh, to really, uh, LinkedIn. It's some, it's, it's amazing, but at the same time, it's difficult to manage all questions and at the same time, we'll answer everything and everyone be represented. So, uh, it's, uh, please, everyone come on, uh, reach us in CNCF slack channels and we'll be there to help.  Yeah. Uh, but can you put that? I don't see how I can put it in the chat. My Twitter and I, yeah, I see it. Yeah, we will. Yes. And, uh, Libby, please, uh, put the security now. So everyone's welcome, you know, to, to, to talk to me. I'm going to stay for at least for a half an hour or two in the security slack. So, uh, I will be, you know, happy to answer. And I hope, um, this talk was interesting. I was really, it was fun for me. I hope it was, you know, it gave you some interesting insights.  It's amazing projects. It's a project inside the SF landscape. Yesterday I was with Dan Pop, chatting, talking about Falco. Yeah, it's really amazing. And, uh, it's, uh, what, what, what I can see here today was a set of best practices together with the tools and the, uh, questions and what about the security, security, security, uh, issues when, when you can cops. I think I have, sorry. Oh, yes. I, I'm, I'm here. Oh my God. Again, the internet. Please, if you want, can send a cable for me. I will be amazing because I'm lost every day, every time my connection is terrible. Okay. Uh, Ben, uh, I see, uh, can you hear me? No. I live here. Yeah. So good. Oh, Ben, I saw many, many good best, best practice. Of course, you showed the, the patterns when you have, uh, attacks, et cetera. Uh, do you have an, uh, oh, I like libraries. I like reference. Uh, when I can, uh, when I can read more about that, uh, you, you, you have a, your, your page, your, your armor has a blog that show more about the security. How, how can I learn more because learn, it's difficult. It's amazing to see you're showing, you will watch again the show, but, uh, uh, we want to get something in the hands to learn, to read. What do you think to have something that can show to us? Yeah. So, so, well, I, you, I really, you know, I'm restarting my screen share. Um, um, sorry, because I've just removed that share. Um, oh, but you don't see that. Yeah. Okay. So you have almost like IO. Okay.  And also on LinkedIn, we are, we are publishing every, uh, every week some interesting reading here.  So, uh, so therefore I didn't want to make a big buzz around that. Um, but obviously, you know, I'm, I'm going to make you, you know, write up here in this blog, uh, and, uh, and, uh, and we'll, you know, you can follow us here and read here and also in our, uh, LinkedIn and Twitter accounts. You can follow us. Oh, great. Thank you. Uh, we, uh, of course, again, I, I, I want to say you, you are read to answer questions in, in offline, of course. Uh, so you can, where, where is the better place to meet, to read to you, Ben? Uh, you are from your Twitter or from your our likes. I prefer our Slack, CNCF, of course, because this is a community. I'm on Slack. You're welcome really to write me on Slack. Um, I, I'm trying to, my most, you know, to, to, to answer you on, on Slack. And if not, I'm, I'm, when I open it, I'm, I'm sure I'm going to answer every, every questions. Also, you know, I, I, LinkedIn and Twitter's, these are my main places where I publish, but, but Slackie, if you want to, you know, discuss me with me and I love discussions about security and also about Kubernetes. Uh, so, so you're really welcome to connect me on, on Slack, uh, Ben Hirschberg, uh, uh, um, and, you know, find me there. Okay. Excellent. And Armor has a Twitter account, too. Uh, yeah, I do think, but, but I think that I'm, I'm, uh, I'm not sure where it, where is it? Uh, uh, we'll, we'll post it here. Okay. Okay. Okay. Excellent. Excellent. Uh, oh yeah. If someone's interested. Okay. You have a LinkedIn account. Okay. You can reach you in the LinkedIn too. Amazing. Uh, Ben, of course, was amazing. Of course, was amazing. I don't have more questions here. Oh, uh, our valid asking that could not see an, an message related to what you said in the SIG, SIGSEC, I suppose that is on SIGSEC from Kubernetes or CNSF. What, what are you, Paolo, Paolo, Paolo. There is a Paolo, my friend from Italy, maybe, because Paolo is Italy. Uh, and, uh, we can, of course, we can try this again the other time. So again, other, other, uh, oh my God, fading again. Oh, yes. Come back. Sorry. Oh, that's the problem that live in some place where the telecommunication is also very good. It's here in Brazil. Sometimes we have problems with tech communications. Okay. Our 4G is like 3G. Our 5G is like 2G sometimes. Okay. So, was amazing. Break the things with you, uh, Ben, and want to invite you again for next time. Talk more about SIGSEC. SIGSEC is a point, uh, it's a DevSecOps. SIGSEC is a point very, very important for us in, and we are increased that we can see the, the, the, how much the, the battle, the, the attacks, the cyber attacks are growing the world. We are doing, uh, every day when we open newspaper, you can see that someone have a data branch or something else, my accounts are breaking at many times. So really, really important this, this subject. So I want to, I can, to invite you to present for us. You can choose. I can't stand in the deep dive or, or another time to this. And of course, uh, uh, I want to invite you, Ben, and everyone from Armory and from the chat for our Cuban Europe, you have a session for Secure, right? Cuban Secure today will be amazing. My friend ambassador, Ricardo, uh, is doing a great job in the, uh, doing, uh, working the, the community from this, this, this, uh, event. You'll be there. Uh, you'll be there, Ben. No question. I'm, I'm going to be there. You know, I love Cuban. Oh, okay. But, but, but we can, we, we're participating in the Cuban, right? Yeah. Oh, excellent. We can, we can read to you there. Okay. Oh, Ben, thank you so much for, uh, this, uh, uh, this show today. Uh, this show, uh, we don't have more questions. I'm seeing your blogs. It's amazing here. I, I'm, I'm open here. I have a container drip, another example of why ATTP based authentication is flowered. It's yours. Yeah. Okay. Yeah.  We have a great opportunity to enhance our security. And it's just as you said, it's really important. Yes, for sure. At the, at the least it's cloud native is a distributed computer and we have a microservices that it's like a gremlin. You don't know what is a gremlin because it's a film very old, like me, but microservices is a gremlin. Yes.  So we can have care with security in many aspects. So thank you so much again. Dan was amazing. We will watch again, your presentation because I want to learn more with you was amazing. I want to thank you for our more that has gives you a opportunity to be here with us. And I want to thank you, everyone. So guys, thank you for joining us at this last episode of our, this week in the cloud native is our live stream, the cloud native live stream. It's amazing, our cloud native TV. It was great to have you, Ben, with us talk about security aspects of Kubernetes and break everything. And we also really love the interaction and questions from the audience was amazing. We did not talk about the big Mac recipe, but okay, I don't know if you have a big Mac today was amazing too. And we bring you and we bring you the last cloud native code every Wednesday at 3pm Eastern time. Next week, we will have someone very, very good to present something amazing like Ben. Thank you, Ben, to join us. Thank you, everyone. Thank you. See you, guys. See you. Bye. See you the next, the next week. Come on. The same bad channel in the same bad time. Yeah. Yeah. See you. Thank you.


Täällä on kaksi asioita, joita pitäisi katsomaan, joita voimme esittää esittämään ongelmasta, kuten ongelmasta ja identifiikasta. Ongelmasta on tarkastella, että kaikkia varioita pitäisi olla metriä. Joten meidän on täytyy esittämää varioita, joita on varioita, ja identifiikasta on tarkastella, että data on todella paljon informaatiota, että esittämään ongelmasta, joita haluamme esittämää. Tämä on haluamme esittämää samalla, jota on todella todella yksi. Ja on possettava, että haluavat esittämään varioita, joita on matematiiksan ja possettavaa esittämää theon yleensi. Tämä videossa voimme esittämää, joita on haluatlaa, mitä haluatelua, joita voisi esittämää varioita. Joten tämän osin katsomme yksin, johon ongelmasta A1 ja A2, ja toki haluamme esittämää varioita. Ja meillä on kaksi variaatioita, nämä kaksi variaatioita täällä, ja sitten meillä on kaksi faktorologioita. Joten meillä on viisi asioita, joita haluamme esittää, ja joten on viisi asioita. Sitten me alkaa esittämättä. Me calculemme model-implate-korelaiset. Joten meillä on kaksi variaatioita, variaatioita A3, A2 ja variaatioita A1, ja sitten yksi korelaiset. Joten meillä on yksi kaksi asioita, joita haluamme esittämää dataa. Joten me alkaa esittämään model-implate-korelaiset. Joten meidän on yksi asioita, ja meillä on kaksi asioita, joita haluamme esittämää. Joten kaksi asioita on yksi asioita. Ja se ei voi olla esittämättä, tai se ei voi olla esittämättä tietysti. Joten yksi asioita on, että ei voi esittämättä 4 tehtäviä asioita. Joten se on se idea. Jos sinulla on lisää, niin haluaa esittämättä. Joten tämä ei ole esittämättä. Ja meillä on tietysti, että voimme esittämättä model-implate-korelaiset, jotta voimme esittämättä jotain tekisistä, tai voimme esittämättä enemmän asioita, ja kaksi asioita. Joten tämä ei ole esittämättä, joten asioita on negattavuus. Factor analysis, without additional constraints, always requires at least three indicators. Factor analysis of two indicators only is not a very meaningful analysis anyway, because while you can make it identified by saying that these factor loadings, for example, are the same, that would identify the model, then the estimation wouldn't give you any meaningful information anyway. So let's take another example or work more with this example. So let's assume that our correlation matrix for this two factor model, each with one indicator, is, so we have A1 and B1, they are correlated at 0.1 and we have three parameters that we want to estimate. So you can't, we have one correlation that depends on three parameters and these other variances don't depend on the model or they do depend on their terms but we don't really care about those in this video. So why is the correlation between A1 and B1 so low? There are basically three different options. It's possible that A1 and B1 are both highly reliable indicators of these factors A and B. It's also possible and then the A and B are just weakly correlated. It's also possible that A and B are highly correlated but A1 is unreliable and therefore we observe only a small correlation or it's possible that A and B are highly correlated but B1 is unreliable. The problem is that we cannot know which of these three options are, is correct because they all have the same empirical implication which is that this correlation here is quite small. So that's another example of non-identification problem. Here we are estimating five things so we have two error variances, we have two factor loadings and one factor correlation. We are trying to estimate it from just three elements of information. We can't do that. The model is not identified. We cannot know which one of these three explanations is correct empirically. Of course we can then use theory and rule out one of these alternative explanations based on theory but that goes beyond our factor analysis estimation and identification. So this model is not identified. It cannot be estimated meaningfully. Let's take a look at our scale setting now. So the identification basically means that you have more information than what you estimate. So the number of unique elements in the correlation matrix of the indicators must exceed or be the same as the number of free parameters that you estimate from the model. Okay. So normally we have in export the factor analysis we have standardized factors. So the idea is that all the factors have variances of one, means of zero in the exploratory analysis and that defines the scale of these variables. So every variable must have a variance. In the exploratory analysis the factors are scaled to have unit variance. So they are standardized and then all the factor loadings are then standardized because of coefficients for that reason. Then what if we don't standardize the factors. So we are saying that instead of saying that the factors variance is one we are estimating the factors variance. So we add these factor variances here and factor variance here. So we have 15 free parameters. We still have 21 units of information from which we estimate but we estimate 15 different things. So the decrease of freedom is six which means that this model is over identified. So it's positive so in principle it is possible to estimate this model meaningfully. We can do the estimation. So let's assume that that's our observed correlation matrix. That's our implied correlation matrix. Then we can find the values for the phi and the lambdas so that this implied matrix reproduces this correlation matrix perfectly. In this case that's possible because these correlations all have the same value. Generally in small samples you will never complete reproduce the data but this example you do just to simplify things. So we can estimate and that's one set of estimates that will give you the exact exact fit between the observed variable, observed correlation matrix and the implied correlation matrix. So we're fine right. Turns out we have a small problem because there's another set of estimates that also reproduce the correlation matrix perfectly using the implied correlation matrix. So you can plug in these values to the equations and see that they produce the exact same implied correlation. So we have here factor A's variance is one versus factor A's variance is two and therefore they produce the same fit. So what do we do? We can go and come up with indefinitely many examples. So if factor A's variance is 0.5 then we will have different values for factor loadings but still there are empirical correlation matrix reproduced perfectly using the model implied correlation matrix. So this is the problem of scale setting of latent variables in confronted factor analysis models. So we need to set the metric. So the factors themselves because we don't observe the factors. They are just arbitrary entries. We don't know whether they vary from 0 to 1 or 0 to 1 million or minus 5 to plus 10 or whatever. We don't know their range. We don't know their variances. We don't know their means. We have to specify the scale of each factor ourselves. In exploratory analysis we typically don't model means and then we assume that we fix the variances of the factors to be ones. In confronted analysis there are reasons why we don't fix the variances to ones that I'll explain a bit later. But the problem generally is that we must define whether we are talking about centimeters or inches. Do we talk about Celsius or Fahrenheit? They quantify the same exact thing and they are equally from equally good measures from a statistical perspective to measure length or temperature. We have to agree on what is the scale that we are using. Also a regression gives us the one unit change, the effect of one unit change in the independent variable on the dependent variable. Considering our regression coefficients only makes sense after we have considered how we define the unit. So what is the unit of A and what is the unit of B? We have to set them manually so we have to decide a scale setting approach. In exploratory analysis as I said we typically say that factor A and factor B on all factors have variances of one. That produces standardized factor loadings which are standard that regression coefficients of the indicators on the factors or in the case of uncorrelated factors they equal correlations. We use that in exploratory factor analysis. We cannot use that in structural regression models. Structural regression model is an extension of a factor analysis model where we allow regression relationships between the factors. The reason why we can't use these approaches is that the variation of an endogenous variable, a variable that depends on other variables is a sum of those other variables. So we can't say that a variable's variance is one if that variance depends on other things in the model. But that's beyond this video. Another very common approach is that we set the first indicator to be fixed, the first indicators loading to be one. This is the default scale setting approach in most structurally Gaussian modeling or confirmatory factor analysis software. The reason is that this can be used pretty much always regardless of what kind of variables we have here as A and B. And what kind of relationship we specify between A and B. And the idea is that we scale that if we assume that classical test theory holds. So all these errors here are just random noise. Then the variance of A is whatever is the variance of the true score of A1. So that's also appealing if we consider that the only source of error is random noise. Then the variance of factor A is the variation of A1 or what the variation A1 would be if it wasn't contaminated with this random noise here. So that's also one reason why this is appealing. It allows us to consider the scale of these indicators without error variance assuming classical test theory holds for the data. And this is such a common approach that there's a rule of thumb that I present always use the first indicators to fix the scale. We can see that the papers that we have used as examples in these videos are using these approach. Meskidan lasarini, you can see that all loadings of first indicators are once. So they set the scale of the latent variable by fixing this loading to one. And then they have the Z-statistic here. And you can see that the first indicators don't have a Z-statistic. The reason is that they are not estimated from the data. Instead a researcher says that these are once, they are not estimated. And if something is not estimated, it doesn't vary from sample to sample. So it doesn't have a standard error. So we can't calculate the Z-statistic for it. We can see the same in Yli-Rengos paper. So Yli-Rengos paper, the first loading it's not one, but it doesn't have a standard error. And that, it doesn't have a Z-statistic, it doesn't have a standard error. So that's indication that they actually are fixed the first loading to be one to identify or to scale the latent variables. If you want to have standardized factor loadings, so you want to, if you want to have loadings that are expressed in the scale of the exploratory analysis where the factor variances are once, then you can rescale the confirmatory factor analysis results afterwards. So your software will produce that for you if you check the standardized estimates option there. So these are standardized estimates, but the scaling has been done after estimation. So you first estimate an unstandardized confirmatory factor analysis where each factor is scaled by fixing the first indicator, then you scale the resulting solution. That's the same approach that you use for standardized regression coefficients. You first estimate regression, then you scale the parameter estimates later. So the summary of identification of confirmatory factor analysis models. A model is identified if every latent variable has a scale and if the decrease of freedom is positive and it's also every part of the model has to be identified. In confirmatory factor analysis, after we have established that every latent variable, every factor has a scale, then all factors with three indicators are always identified. So three indicators, if you have three variables, you can always run a factor analysis no matter what. Then if you have two factors, then we can either say that fix that both are equally reliable. So we fix the factor loadings to be once or we can embed this factor in a larger system. So just two variables alone, we can't estimate a factor model unless we fix these factor loadings to be the same. If we embed this two-indicator factor into a larger factor analysis, then we can estimate it because we can use information from other indicators to estimate these factor loadings. And one single indicator rule, if we have a factor with just a single indicator, then we cannot estimate the reliability of the indicator because you cannot estimate reliability based on just one measure. That's the idea. We have to assume what is the error variance. And typically we do that by concentrating the error variance to be zero. So we say that this factor A or construct A is measured without an error if we can't estimate it. Of course we could constrain the error variance to be something else. If we know that the indicator has typically shown to be 80% reliable, then we can fix these variance here to be 80% of the observed variance of the indicator. But that's really done. So identification is a requirement for estimation. If our model is not identified, it cannot be meaningfully estimated. Identification basically means that do you have enough information to estimate the model? If we have one correlation, we can't estimate two different things from one correlation. You need at least one unit of information for everything that you estimate. Ideally you have more information so that you have redundancy. So we need to have a scale for each latent variables and the decrease of freedom must be non-negative. Ideally it is positive and the more positive it is, the better our model tests are.


Hi everyone, Joe for jaspyscasefrakes.com. We did it. We filled up the jaspys 13 box Optoprism basketball mixer featuring a luka donchich psa 10 prism rookie card giveaway. That's pretty nice There you go There are the boxes involved in this break so we span from 1718 through 1920 You can find more Lucas in here Trey Young's Jason Tatum Zion's John Moran's All the all the top guys over the last few years Big thanks all of these folks for getting into the action and congrats to the people who won their spots in the Those hangar box breaks and the two-sallow pack breaks that we did All 30 teams are in Let's roll it. Let's randomize each list two out of five lucky seven times one two three four five six and seven then final time After seven times we've got Thomas down to Nancy seven times for the teams one two three four five six and seven then final time after seven times we've got the New York Knicks All the way down to the Boston Celtics All right, so Thomas with the Knicks Zach with the Raptors Greg with the Gris Colin with the magic Jonathan. You got my Lakers Brian with the Kings James with the heat Bill with the Rock It's Corey with the jazz Chris with the trailblazer Zach with the exact G with the Clippers Adam with the Suns of Matt last spot mojo Bucks Aaron with the Sixers Daniel with the Pelicans. There you go, Daniel Adam with the Pistons Alexander with the Hawks. There's a good team to Thomas with the T Wolves Tony with the Hornets Golden State Warriors for Adam Thomas with the Wizards Corey Dallas Mavericks Matthew with the Cavs Nets for Adam Kelly Mackie got the Spurs Jeremy with the Thunder Bulls for Derek Robb with the Pacers Denver Nuggets for Daniel and Boston Celtics for Nancy Who had the Memphis Grizzlies again and Greg with the Gris? That's all right. There you go What's great about this break boys and girls is that it spans the last three draft classes and There's solid rookies in each of those draft classes that span a bunch of different teams So there's a lot of a lot of great opportunities for big hits We're gonna pause the video really quick and when we come back We're gonna see if there's any trades and then we'll have the break stick around All right, welcome back everybody a little bit of trade chatter, but in the end no deals were done Big thanks all these folks for getting into it appreciate it Same as the list you saw previously There's a Luca that we're giving away So we'll re-randomize your names at the end of the break and the name on top We'll get this PSA 10 Luca Donchich like with the perfect fitting team back right here, too. I love that All right, so there's one two three four five six seven eight nine ten eleven twelve thirteen. I sure did And we'll start with the with a whole box of 17 18 cello packs I'm gonna put this on the knit cam right here. So he'll he'll start ripping those open How do you feel about these? There's a there's a honey There's a honey. There's a dollop of time inside like a like a gusher. I will do a mega box Oh, what'd you get in the hit draft on Instagram at Jasper's breaks mark? Oh I got to send you the website that that now owe sent me You can buy The horse racing you can buy a tiny tiny fraction of a horse And they're depending on like the star thing where you're like, you never know, but I think you actually get money back If you I mean if your horse wins Whoo mark got a LeBron prism PSA 10 Pretty sharp All right, so ladies know we're gonna we are gonna kind of bounce around on the years But I'm gonna close out with that choice box and the prism hobby box right there Lot of of huge hit potentials in here ladies and gentlemen Isn't there? Oh, oh, sorry, maybe not I own I saw four cards There's four cards for a pack not four cards per Box I misread them. We're gonna close out with the prism hobby now Hey, let's see what that hollow is gonna be first PJ Washington, Jr. Nice hollow for the Charlotte Hornets Tony Now better I think so. Yeah, is that big enough? Can you see you monitor yourself on that camera? Well, I know I heard and I was just like that was not me Because it was near the end right there I must have happened a week ago Because I usually I usually refill it before you can go Yeah before it hits 20% Hollow PJ Washington, Jr. These inside baseball is down the little things that make or break our day Tony cover with the Hornets. He won that spot I don't know what you do with batteries But then did you then did you hear that when you first get your device you should grade it all the way to zero? Yeah, and then max it out at a hundred percent. Yeah, and then that so I mean who knows what's correct who knows I was gonna say the PSA. I was gonna say is that public service announcement Not PSA the grading service is that veteran commons don't ship in this break except for right LeBron veteran commons Kobe veteran commons Yannis the vet commons and Luke adage second-year Luke adage cards Otherwise no vet commons will ship all of these will ship because these are parallels These aren't numbered by the way these pink hypers Right here. What's that? Get that hanger out of the way whoa Mark saying that if you even even if I have like a half percent Half of a half percent interest in that horse Apparently we get winner circle access even if I just buy like ten dollars of a horse No, they can't give you winners access for that then there'd be like there has to be a minimum Otherwise there'll be like 30 people in there. All right. Well, I definitely have to do that You don't dress up. You can just sit in the back Let the real owners up front That's what mark saying I gotta look else I'll forward you the link that he sent There's Derek Rose Histon's edition even though But look we go by the logo on the car that'll be for Adam cupperman Coursing this silver and I love these orange cracked ices nothing significant there that Kobe will ship silver Jackson Hayes That was the hanger box So these were all the cello packs that you normally used to seeing Go one at a time. What do you want? Feel free to You want the whole thing? Wow? There you go. You can see me shift boxes over. I'm gonna hold this All right, you guys can see everything on the top camera right there So you can see that everything is on the up and up Good luck. So this is 1718. So we're looking for Tatum's obviously among others, but Those are the main ones There's the honest onto the compo silver How well his non-rookie Cards will still go. It's pretty wild Bucks Yeah, especially if you get it graded Matt Lordich got the bucks With a straight-up spot that was the last spot mojo as well silver Frank Jackson I mean nowadays you just have to sleeve any silver Like immediately you never know Frank Jackson could go off next year and all of a sudden everyone's like Anyone buying any silver Frank Jackson's pelicans? That'll go to Daniel Silver rookies especially That extra mojo there. Think about Dennis Smith Jr. Think he bounces back. It's just cuz he's on a bad team He was hobby hot for like half that season Tony Bradley All right, I'm gonna have to look into that Chris and mark If we go go through that service that mark sent me invest in a tiny part of that horse and then end up with End up with a winning horse and get into the winner circle. I'm down Adam Kelly tried to trade couldn't trade mojo gets a silver rookie Jarrett Allen He's a fun player to watch big blocks big dunks Solid player. It's Gordon Hayward Very Giles Adam saying it's telling you Michael for sure. He's gonna erupt when he gets a full season That's the trouble, right? He's got to get a full season injuries or is are his sort of Achilles heel injuries There's Dennis Smith Jr. It was LeBron James insert will ship of course This is Mavs Dennis Smith Jr. Corey with the Mavs. I'm sorry silver Clay Thompson No Tatum's in here There's ojalee. Come on. Did I miss a D Mitchell? No D Mitchell. I've not seen a D Mitchell either No van No van Mitch No, zoe No faults. Oh, sorry Chris. You need your teams too, right? Chris Maxwell you have With the spot that you bought straight up Portland Trailblazers We got LeBron calves edition right here prison basketball that will be for Matthew Powell This is 1718 prison basketball. These red waves not numbered They miss a John Collins. Oh, I like John Collins And Justin Patton is your autograph Like that look what do you want from me? It's like what do you want from me? That goes to the T Wolves Thomas with the T Wolves DJ Wilson Dwight Howard silver There's a silver Alonzo ball Lakers that goes to Jonathan L with my Lakers another guy who needs it I don't like that top over there another player who needs to To shed that injury tag. I feel like those ankles have been an issue for him But still pretty popular even on a secondary market a lot of love for him still in LA Went to high school out here near where I grew up Chino Hills Yeah, let's right there. There's the Ivan rabbi 42 pink pulsar John Collins green And then went to UCLA and got drafted by the Lakers. So still a lot of Los Angeles love for him try to find a silver kuzma somewhere too There's a silver Lori marketing nice couple nice silvers in their bowls Derrick Melanson 17 other shot at those 1718 at the 1718 draft class. Good luck everybody Brett Brown disco. This must be a fast break box We've got Patrick Ewing Justin Patton He said do we have another Justin Patton? Are all his photos of him just dressing like dressing nice Just dressed up That's a 75. I know must not. Yeah, Thomas with the T wolves Jason Tatum base Nancy with the Celtics. Yeah, it's not bad if it grades out nicely maybe more Scary Peyton Blue John Collins blue disco to 175 nice and Lori marketing in autograph. Yes Rookie disco auto Derrick Melanson with the Chicago Bulls. I see if he ends up staying on the on the bulls Tim and Kobe white could form a nice duo there Zach Levine still there get a couple other guys in the mix maybe some Consistency in the coaching side of things They're in a week east. There's torn prints to 50 chair cross there the next thing you know Next thing you know No base cards and there's emergent Donovan Mitchell as well disco Parallel for Corey and the jazz We got Donner's optic basketball There's Jimmy Butler pink Velocity is 79 Alfred Peyton orange to 199 Jason Tatum rated rookie. So there's another one for you Nancy not a hollow, but even these base ones will still Resell pretty well in the secondary market Special if that grades out nicely the Iceman George Gervin to 175 LeBron James lime green Nice that'll be for Jonathan L and the Lakers No, sorry, this is calves edition check that sorry Jonathan 90 out of 175 Matthew Powell with the calves and we got Matt Costello Signature series autograph for the spurs that'll be for Mac Mike McCarthy with that one We got a hollow dame that'll ship That's a hollow rated rookie Lori marketing on nice And out of 39 Tyler Dorsey black Velocity. Let's get some more prism here So this is 1920 prism fast break and see the disco parallels in there. So obviously these parallels will ship Calliola in it to 175 We got Robin Lopez to 125 bucks silver Jabari Parker cam reddish Dylan Windler and Wow fast break autograph Kareem Abdul-Jabbar out of a fast break box Lakers Jonathan little Laker Joe mojo nice Dylan Windler disco as well for the cabs Chris Middleton blue disco for to 175 that is And that goes to Matt Matt L So save let's save a Kevin Porter junior for you to set that aside Mike Yannis fearless disco and Deandre Hunter disco for Alexander and the Atlanta Hawks I Can get those We're almost done We've got pink disco Marvin Bagley 2 out of 50. Wow the rare boss man on camera experience silver Jason Tatum second year We've got Justin Jackson to 75 for the MAGS That's for Nancy the silver Jason Tatum second-year Jason Tatum. No third year Jason Tatum Still silver still nice Kevin Durant and Will Barton in the back. I got some Donner's optic right here more Donner's optic Maybe some sort of retail version of Donner's optic Right there. So this is the 1920 Donner's optic. Good luck everyone Right in the middle nice Zion base They're in the middle of our 16 box opto prism 13 box opto prism basketball mixer Or we're giving away that Luke adage PSA 10 at the end at Jaspie's breaks is our Instagram That's where Jason is right now doing some hit packs So you can holler at him While we're in the middle of this we still have a little ways to go. So if you have the itch pop over there There's I on right here that is Clippers Daniel Christian got randomized the Clippers for this straight-up spot Pelican lives Daniel Christian ad to 50 and the seer little is your Disco autograph rated rookie disco autograph Chris Maxwell with the Portland trailblazer. You got that silver dame That's gonna be heading out to you to Jay Crowder Is Smith you got a stargazing onto the combo disco The inserts won't go for as much, but there's they're still nice Like this It's pretty nice to there's Laurie marketing. Wow. There you go There's the yonuses. I did this is this is the significant one here Matt with the yonus disco refractor That's pretty nice. This other yonus will go to of course All right next little stack here This is 1819 Donner's optic. There's Tila Kena and Rated rookie hollow Jacob Evans the third These blue ones aren't number. That's why I'm freezing by those they will ship of course Jacob Evans third for the Warriors. That's gonna be for Adam cuperman Michael poor junior rated rookie card is nice He's that guy just has to say healthy You could be a monster in this league Nice rated rookie Luca Donjich There you go Cory with the Dallas Maverick. That's strong. This grades out PSA 10 $1,000 maybe Still probably get a good grade raw to There's Grant Williams DeAndre Jordan in that checkerboard pattern, which I think is exclusive to set and Troy Brown jr. Autograph for Thomas and the Wizards. That's with a Spot that he won got randomized the Wizards. Nice. Not bad Winner stays hollow LeBron James That's Kaz addition and that will be for Matthew Powell. We've got You see something interesting We've got another Lori Markin and hollow Markel Fultz rated rookie Kyle Kuzma rated rookie hollow Lonzo ball All sorts of fun stuff there at court Kings LeBron will ship Deer and Fox not too bad either more faults Dwayne Bacon and EK honey Bogu. All right, so some nice rated rookie cards in here including that hollow Kuz Which will be for the Lakers that's gonna go to Jonathan nice break for the Lakers Markel Fultz is a sort of a stash Stash on the bench. See what happens We're remarking solid though Derek Molanson There you go Bulls Derek next little stack right here. We've got the honors optic first There's cooking show Joe be Bobby Flay boss man Jordan Jordan Clarkson to 199 Surjibaka to 149 like his cuisine. I do too. Yeah. Yeah. Yeah. He does a good work good steaks. Good burger guy There's quendery weather spoon for the spurs. Thank you Mike quendery weather spoon spurs Mike McCarthy with the weather spoon autograph Dropping it on Zion's right here. There's a Zion. There's another Zion There's a John Marant. So we got the Kobe white rated rookie card For Derek and the Bulls we got the John Marant rated rookie card for the Gris Greg And we've got a Zion Williamson rated rookie card. None of these are hollow, but they're still nice For the Pelicans that will be for Daniel Christian with the Pells And the all clear for takeoff insert Also for Daniel Christian pink velocity Rudy Gayety 79 ties Rome hollow Joe Harris to 59 Hollow quendery weather spoon Save save that up Rui Hatchimura the rookies 33 out of 99 That's for Thomas People people like the hotch Another Hatchimura another LeBron James All-Stars Enos Cantor Hollow Might as well save that second-year Luca Donchich, huh? Mavs Corey we got some prism Right here, and there's Nick Claxton right out of the gate Rookie autograph for the Brooklyn Nets try to trade couldn't trade mojo mojo Adam Kelly Aaron holiday red wave not numbered And a silver Cody Martin That's for the Hornets that'll be for Tony. We got a LeBron James and a John Marant right behind him so the LeBron James going to Jonathan Lakers and The John Marant not a silver but still nice for Greg and the Gris It's an impact Zion another Zion I mean all of those ions will add up Daniel Christian as you know Pretty nice stuff here silver 740 a Michael Porter, Jr. Silver second-year Michael Porter, Jr. Just has to stay healthy And Dreymon at the end all right one more box to go and it's a really nice box 1920 prism hobby Good luck everybody, and then we'll give away that that Luca. I remember when those when those boxes were only like I Think so. Oh man.  Oh, wow probably probably Unfortunately, probably some alcohol involved They're impaired 50 cops and 50 the so Nick did a little drive-by because that's on his way home He did a little drive-by had a little video for me and Jason And I think I think Nicky night crawler could be could be a thing at this whole if this whole Group breaking thing falls through we might have an alternate career. All right. Good luck everybody last box And then we're giving away the Luca. Don't you Parallel stack route to large here. All right. Good luck everybody. You know a little swig of water here, too Where's my water? All right? Good luck everybody. We're gonna go through orders after this and see what else we're gonna get into We got Kurox silver and a PJ Washington sensational signature That'll be for the Charlotte murder Hornets Tony cover with that. Got Jalen Brown to 199 one yeah 199 for Nancy and the Celtics Derek Jones Jr. Red Wave We got Wilson Chandler to 299 and RJ Barrett hyper nice John Moran and Justin James rookie silver John Moran going to Greg and the Gris It's nice RJ Barrett hyper. I think that's the first significant Nick's hit of the day that'll be for Thomas or of this break that is hyper RJ Barrett Kobe White strong to Derek Molanson Poor zingas red wave We got Julia Oka for blue cracked ice to 99 Oh and a nice hyper far out Zion Williamson. Does Bobby play ever lose his own show? I don't think he does That goes to Daniel Christian and the Pelicans. There's a Yanis there. We've got Chandler Parsons To 149 Evan Turner hyper and a Zion base nice out of the prism that goes to Daniel and the Pells Silver Dearon Fox and a Justin Jackson for the Mavs sensational signature signatures and that's for the Mavs Cory. I guess we're paging mr. John Carlos Stallone the Instagram channel needs you at Jasper's breaks another silvered silver Jabari Parker Nick Klaxon hyper Kevin Love to 299 and That's that there you go ladies gentlemen a very nice break boys and girls Excellent stuff. I'll do a quick little recap just a second here But let's know the randomizer do except for this So if you had a not so good break still got a shot at this nice PSA 10 Luca Gemini 10 Luca Get a great break Be a very excellent cherry on top So let's go back to the list here So from Alexander the hawk sounded Thomas and the wizards and everybody in between Let's get everybody's names there. Let's roll it. Let's randomize it six and a one lucky seven times name on top gets the Luca one two three four five six and Seventh and final time six and a one seventh and final time again Seventh and final time Big thanks everybody who got involved. Thanks for joining and congrats to boom Nancy volleyball Nancy Randomized seven times her names on top and she gets the Gemmin 10 Luca Donchich There you go Says Donner's on the label right here looks like whoever submitted it they're on the bits prism right there So there you go. Thanks for watching ladies and gentlemen Joe for jazby's case breaks calm I'll see you next time. Oh, let me do a recap. I'll see you next time for the next break though on jazby's case breaks calm We got a lot of stuff on the site and I don't think not too much sold out So we're gonna we'll go through order if you're watching live We're gonna go through orders after this and see see what we got But we got a lot of time to fill a lot of breaks and break a lot of things So let's do it. Let's get it done Actually Nancy didn't have a bad break either with a couple rookie Jason Tatum's as well So there you have it there you go boys and girls again Joe for jazby's case breaks calm I'll see you next time for the next break. Thanks. Bye. Bye


The Lagos State Ministry of Education has said it is investigating the complaint of a parent, Mr. Barenade, who alleged that his daughter, Mabela's Barenade, was sent out of Odomola Junior Secondary School, Lake Bear, for using the poster of one of the contestants in the last election to wrap his books and statements. The Commission of Rural Education, Mrs. Folasha de Adifisaya, noted that the principal has been invited to explain what transpired. Sharia showed the public that the matter would be dealt with within the scope of strict regulations, as the reason for sending home the students is unacceptable. Adifisaya noted that the Ministry promotes and runs a public school system devoid of politics and political insinuations. Where did you get this book from? You bought it from someone. From who? Are you people campaigning in this school? What is this one? Hey, one I want to teach. Hey, you've turned this class to a politician class, you. What is it? This is what you want to learn this morning, Nia B. Hello, hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


ich basically says it will take approximately 10 years to reach a steady state number of carers with plans and statements. It goes on to say this assumes the right to personalise short break support under the carers that are at the establishment of the bill as implemented from April 2025 although that date is still to be decided now given the the kind of comments you made earlier on about demography rise in demand generally speaking without this do you think that even this is a realistic timescale basically to deliver that by 2035. Gosh that's a big question. I think against the context of all the other changes I think it could be really really challenging I also note from the the upper and lower estimates that it then flatlines from 2029 30 I mean I don't think that's realistic I think in any context I don't think that's realistic I think demand well costs increase pay increases demand increases so I think it's just it's one part there's so many moving parts in this that I think it's I think it could be really challenging. Okay did he ask that we hadn't had any discussion on that and any questions on that previously so I thought I wanted to touch on that. For yourself actually Sharon it's this issue in your own submission we say that there's concern that the recommendations increase free personal and nursing care for self funders will not necessarily deliver a reduction to the amount paid by self funders I'm so wondering if you can expand on a wee bit about what your concerns are there. So our concerns is that the care home providers will put their rates up and the people won't then see the benefit of that increase and as you'll be no doubt aware the rates were privately funded service users are significantly higher than the rates that the local authority contracts would have and we did see this before when we seen the introduction of free nursing and personal care that the rates for privately funded clients did go up and none of these go through the local authority contracts so we're not able to provide a level protection either to those service users. Okay that's very important and for yourself in terms of your own submission Paul you've said that if a new national care service can't be fully funded then the Scottish Government should agree to last recommendation independent review of adult social care to considering consultant options or raising new revenues to increase investment in social care now what kind of new revenues and options would we be talking about potentially. Okay so what we're talking about there is the broader picture in terms of the tax and revenue raising situation that exists within Scotland and what that points to is the fact that you know the root of many of the issues that people have with the care system is funding right and that's again it's a theme that's there within those submissions and it points across to I think Mr Mason made the point earlier on if there was an amount of money of that volume that could be put into the system right you know is there a better use of it than structural change so if there was money to properly address a if there's money to properly address demographic change to address things like inflation to address investments in the system there is no doubt that you would get a better system of care right and what the submission is pointing to is can we be alive to every opportunity right and I get it's a phrase that's doing a lot of heavy lifting to try and generate those funds for investment that that may well be tax policy it may well be things for example like charging for services but again within that within the move towards the national care service and within the financial memorandum there is a desire to look at charging for certain care services with a view to move in the other way and reducing those so it's that broader picture it's about proper funding okay thank you very much I'd like to thank your witnesses for their contributions today we're going to move into private session now so I'll just call a two minute break to allow our witnesses the public and the fish report to leave


Welcome back everyone to theCUBE's live coverage here at theCUBE. Open Source 2023 in Vancouver. I'm John Furrier with my co-host Rob Strecce. We're bringing out all the action and the theme today is getting into the sustainability. We talked about energy. Open Source is bringing the value of software with the new infrastructure transitions to help the world be a better place and to save the world. Climate change is huge. I've got a great guest here, Eric Erlinson who's the data science team lead emerging technologist at Red Hat. Red Hat doing its part. Eric, great to see you. Thanks for being on theCUBE. Thanks a lot for having me. This is an area that is exploding just from a political standpoint and from a human global standpoint, climate change. Technology behind it is going to be the key to success. Open Source software is now the industry, software industry, so open source, climate change. What's your role? What do you do at Red Hat? What's the initiatives that you're working on? Well, as the data science team lead at Emerging Tech, my role is to understand strategically important technologies for Red Hat, but also because we're an open solutions company, the open communities that surround all these ecosystems. And specifically in terms of sustainability, I've been trying to assist them with building out a open data mesh platform to serve all of the actual data federation needed to give us the right answers in terms of aligning all of our economic activity with the environmental impacts. I look at it as the operating system of climate change. Because it's nerdy. There's a lot of technology. Again, we've been riffing on the whole tech aspect of it, but there's a URL, os-climate.org, as you can check that out if you're watching. Os, like operating system, dash climate.org. Data is a big part of this. This is a data opportunity to get it in and get the right data and use scale and AI, for instance, to solve the problem. But first you got to set it all up. You have the infrastructure and the architecture to do that. Take us through the challenges and the opportunities. Sure, so like the first challenge is that the actual regulatory climate is evolving fast, every year, almost every quarter, there's increased requirements for companies to report their impacts. So in order to do that, you have to be able to align financial institution investments with the results of these reports. So imagine you want to evaluate the physical risk to all the companies in your investment portfolio. And to do this, you have to understand the actual locations of the assets of each company, where are their factories, their warehouses. Now imagine like you have a warehouse next to a river. Now, if our climate modeling suggests that this river is going to begin flooding more frequently, that is basically a physical risk to the value of your portfolio. But imagine now, just that sentence I said, what are all the different kinds of data sources you need to create that one simple answer among many? You have to understand lists of actual physical assets. That's a huge piece of data right there. You have to understand their lat-long locations, and then you have to actually align that with the outputs of complex climate models. And so there's like three or four entirely different data sets you need to bring together in one place to provide these kinds of answers. And they're all coming from different places. So in order to meet this kind of federated data need, we're leveraging the latest like data mesh architectures because data meshes are by their very nature federated in terms of like governance and data ownership, and frankly physical location. Does it matter which data mesh that you're using or are you leveraging like Presto or Trino or all above or allowing people to kind of bring their own? That's a great question. Obviously in order to do this, we're making specific technology choices. In our case we are using Trino because it is actually designed to provide this kind of federation. But because it is being designed as an open architecture, people are free to make their own individual technology choices. In examples, take Trino. In many ways Trino behaves similarly to something like Spark SQL or Spark structured streaming. And so I can imagine if somebody wishes to deploy their own data mesh in a space they might choose to use Spark SQL. They could use obviously Presto. In fact, in the talk I gave yesterday I devoted a slide to talking about all the possible open substitutions that you can make in the space. And I think one of the interesting things that comes in and I think you brought it up is getting the data, bringing all the data together. And I think one of the things that I've seen and really I guess eats at me and is that people greenwashing things and they come out with their carbon footprint tool and say, hey, we're going to tell you how much carbon you're really utilizing when you're on our infrastructure or something like that. How is what you guys are kind of doing helping to kind of bring openness and transparency to that? There's a couple different ways. We are architecting the system to use data as code principles. And so all the different pipelines that different data owners and providers use to bring to our system will be encoded using things like a layer of pipelines or DBT pipelines running on air flows and other architecture we're exploring. And so people from the community can both review our open source code for correctness. But then when it comes to what you talked about the individual reported pieces of data, they can also challenge that or correct it. It's like if somebody says, hey, look, you know this number is wrong. The people who provide it can correct it or people can maybe with the right tooling offer corrections. Yeah, I think that's the interesting part is that again, us coming into this and seeing it from the outside in and looking at it and going, okay, this is super important for people to understand not just the consumption part but the supply part and understand both and where is the power coming from, accounting for all of this? Is it carbon neutral, non-carbon neutral? And we were just talking to the LF energy folks just before this and having some discussions with them. How does this tie into, I saw that you guys were at COP 27 in Egypt or at least the Linux Foundation was, how does this tie into the, I would assume SDG7 initiatives? Yeah, well, we're working closely with a lot of these regulatory bodies. Obviously, many of them are interested in what we're doing because we're offering a possible open community around allowing the entire financial world to use our data to get better answers to these questions. I think one example of how this plays is, as you know, there's a lot of initiatives that give you estimates for how much your compute workloads are actually emitting in terms of carbon and the first versions of these really just gave you global averages and so in a sense they were much better than nothing but they were also very crude. Now the problem is if you want to go deeper there's almost a step function of complexity. If you want to take the next step, all of a sudden now you have to know the physical locations where your workloads are running, you have to understand where those data centers are getting their power from. You have to understand what from hour to hour the actual power mix is. It's like how much is coming from coal, how much is coming from wind or solar and imagine all that data, it's like on a per hourly basis at least, you have physical locations, workload locations and if they migrate it changes and then mapping it into getting from the actual power providers like what their power mix is. So it's a huge data federation. I like the portfolio alignment tool as an incentive for the company to get value out of thinking about how to energy. I went to the OS website which stands for open source. I think operating system, I'm an OS guy. Because we need an OS for climate change. It should be like, maybe Red Hat, they could sell OSes. So on the website you have three pictures, the vision and goal which is a beautiful earth.  Okay, I get that's factory, pollution, sustainability. What's the picture for technology? Because in our world we get data centers, crypto's been criticized for energy consumption, more GPUs are pumping and mining Bitcoin, huge energy carbon impact of crypto. Now we got AI, these large language models, like open AI, I hear that they're kind of cranking a lot of carbon. What's your view on that? Can you share just your nerdy geeky side of it? Because I geek out on that, I wonder what the pollution is going to come in. I've been saying that AI is going to create more code pollution because it's auto-coding a lot of stuff, a lot of misinformation. So in a way that's content pollution but there's also carbon impact with AI. What's your geek out view on some of the crypto and then now AI is similar, is crypto? I love your question. I think you have to take like the sort of long technological arc view, like the research, the way you make progress in the large language model space for research is you increase the size of the models. For instance, GPT-4 is estimated to have on the order of a trillion parameters and runs to operate it at all requires absolutely the largest, most expensive GPU workstations and blades available. And I have not seen the carbon impact reports from those but I expect they're quite large and like you said, I think there's probably a useful potential comparison with crypto except these are all above board. But you think you agree that's probably pretty heavy? It's pretty heavy. Now having said that, just in the last two months there's been an absolute explosion of progress with open source models and research papers where what they're doing is figuring out better algorithms to get similar results from smaller models. And so you're going to actually see people obtaining the same kind of intelligence from these smaller models that you can get from something like GPT-4. People will continue to use tools like GPT-4 to explore the frontiers of what's possible with these neural networks. And I think there's probably an interplay here like in companies that are using these models have to report their carbon impact. And so, you know. This could be an impact to open source. Because open source, the smaller models that have just released that have actually energized the open source community. Open AI is the large language model for the, they want to rule the whole world. But now you're starting to see a lot more open source quick solutions hitting the market. Yes, and you know, open source does this to all technologies. It tends to democratize them and commoditize them. You know, it has the effect of when it's successful undercutting large proprietary vendors. And I'm aware that these vendors are also aware of this.  It's interesting. People are complaining about the effects of AI when they should be focusing their energy on the carbon footprint, Rob. Right, yeah, and I think it's interesting because I think with AI and where it's going, I think from an open source perspective, do you see them contributing back into this, into OS climate and how is AI really helping or is it not right now with what you're working on? There is a role for AI. An awful lot of what we do is, I would say, more traditional, you know, data engineering and ETL. There's a huge role. However, a lot of companies, we talked about reporting earlier, companies submit their reports in unstructured formats. There is no standard thing a company can fill out. And so imagine you have tens of thousands of PDFs every year filed by companies from all over the world reporting all of their impacts, but every single one of them is using their own custom reporting format. So enter large language models such as chat GPT. For the last two years or more, we've been experimenting with what I'll call pre-chatbot class AIs to take these reports and find the answers. It's like you can literally, as you know, you can literally pose questions to these things and you literally have a list of questions and say, how much carbon is this report claiming? And it will go through the document and try to give you an answer. And so what's nice is the increased capability of these latest large language models promises to be a huge asset for taking all that unstructured, hard to work with data and actually compiling it into a format that's usable for computing answers to our questions. And that solves a lot of problems around this undifferentiated heavy lifting. The old way was merge all the reports. Someone has to do that grunt work.  That's the whole point of it. You almost couldn't afford to. Only the very largest financial institutions could actually afford to like do the ETL on this data. And that left all the rest of the entire financial universe basically unable to field their own solutions. And so OS climate's goal is to provide a truly global community resource so all financial institutions can make all their financial activity in their investment portfolios climate aware. So basically the bottom line is, is that the entire climate change initiative is a data problem. That's right. At the end of the day, you got to have the data and you got to know how to apply it. That's where AI could come in and help with things like getting those reports, maybe moving the needle a little bit. What's your take on AI writing code? Cause I mentioned code pollution before. I introduced that concept at KubeCon in a way almost tongue in cheek, but it's actually got tracks where you're like, you're right, it's like bad code. It's like pollution. That is true. So it's going to, you know, code to watch code. I think that'll get solved. But I think ultimately, what is the downside of AI? What's the upside and downside of all this new open source? Yeah, well, I think, you know, the upsides are in some sense familiar because every day we read the reports of the amazing things. People are prototyping with these models. You know, when you watch them doing the right thing, as you all know, it is really, really, it's truly like watching what we used to see in science fiction, interacting with these. And I think part of the downside is that a lot of people watch them in action and don't realize that it's really nothing but a, you know, very fancy next word predictor. And it, because they operate like this, of course, you know, they will with equal confidence give you something that's correct but also just make answers up there incorrect. And as you say, there is tons of progress. I mean, any statement I make about the error rates basically becomes untrue within like a matter of months. It is magic. It's truly next gen material. This is like definitely next gen. And it's early. I totally bullish on AI. I think it's going to be the kind of tornado that's going to, you know, topple unstable old ways. You're not set up for this wave or this tornado. You're going to get wiped away. I truly hate to use the word disruptive, but I think in a real sense, you know, when it all shakes out, there's going to be disruptions. It's going to change, you know, the way we humans create our own content in the same way that like handheld calculators change the way we used to do arithmetic. Yeah. I like the word disruptive enabler because it's an opportunity to enable new things.  That's a good example. I do know, I know given the current state of the art, the way I like to frame this whole issue is that they are very capable of acting as an assistant. But humans, because they're capable of making mistakes, you know, the humans operating them need to interact with them as like a manager or an editor, taking their content, reviewing it for correctness and either fixing it yourself or these days you can of course ask the models to fix their own outputs in some cases. But I think that's the way I see it for the, you know, near to midterm for sure. Eric, thank you for coming on the queue. We had a little long there, a little AI side track there. Congratulations on the work that you're doing and kudos to Red Hat for stepping up and being part of this project. OSclimate.org. I'm sure OS loves the OS being operating system because they are, you know, Linux is Linux and but open source dash OSclimate.org is the website. A lot of great tools on there, got a great project. Check it out. It's the queue bringing you all the action here from Vancouver. We'll be right back with more coverage after the short break.