And thanks everybody for joining us here again for another crisis conversation live from my social distancing home office. Today, what we're really wanting to dig into is the lives of frontline healthcare workers. You know, over the last couple of weeks, we've seen so much about the lack of personal protective equipment and a lot of what a lot of frontline workers are facing. As they as they confront this really frightening and potentially deadly disease. And so today I want to kind of take it a little step further and talk about how that's affecting not only work and life, but really use this as an opportunity to ask the question what can we learn what can we learn from this experience. I think we've all been now social distancing long enough that we started these conversations with the idea that we would come together and share stories in our inner isolation and try to understand this kind of this very fast moving pandemic and how it was affecting our work and life. And I think that we can still do that but we're sort of sort of settling into a kind of crazy new normal. And I think now is the time to ask what can we learn and how can we emerge from this better and stronger. And I think that there are some bright spots, things that we can learn, but let me start first with Dennis Dennis it's turnover to you.  When I when I talked to you and heard your story about sort of what you were experiencing at work and how that was affecting you at home. It's an incredibly powerful story so let me turn it over to you introduce yourself and just tell us sort of a day in the life of Dennis Kosin. Sure. Yeah, I know I've been a registered nurse for about 13 years. Most of the time I've worked at Cook County Hospital in Chicago which is the biggest public health hospital in the area I worked in ER there for about eight years. In the past four years I've been working at Chicago public schools as a school nurse. And then part time I work at Provident Hospital which is down on the south side of Chicago for the last two and a half years I go there one one one day a week. And I think the thing that that I've learned about this. And I've known this ever since I went in, even before but personally highlighted for me the disparity between what it means to become a nurse and then the kind of environments that we're dealing with. We're told that we're when we're in school that we're going to be helping people that we're going to be providing health care, fixing people's health and all the rest of that's true that's 100% true. But there's a gap between what we're able to do and what what's needed and I think this COVID pandemic has really shown a spotlight on that disparity between what's needed so so far and what we have in Chicago is as people may have heard it, which is a lot of cities, while African Americans only make up about 30% of the population there over 70% of the deaths in Chicago and that's really horrifying, but it's also on another level not surprising, because because the way health care is run in this country, where it's basically focused on what makes money, unfortunately, rather than what's needed for people and so I think it's really shown a spotlight on that disparity. You know, we can keep talking sort of about this big picture, you know, the CDC came out with a new report this week about how many frontline health workers are infected. I think the number was 9,000. But again, I don't know how widespread testing is so we don't even know if that's a real number. But you know, of those are about 27 deaths and many of them are white middle aged women sort of the kind of the backbone of the nursing population. Okay, talk to us about what is that like to get your job, you know, you're there to, like you say, give care and care for others. What's that like when you know when the job itself could be very, very dangerous and actually, you know, I'm searching for the right word I don't want to say detrimental but potentially could harm your own health and your own care. Absolutely. Yeah, no, and I myself had an incident when I worked on the afternoon of March 20. I went down to the ER was supposed to only work an eight hour shift ended up being a 16 hour shift because there was so many people so many nurses called in sick we couldn't I stayed over to help out. I had a call a few days later saying I had been exposed to two patients who had tested positive. And this was after I'd already you know gone home that Saturday morning I lived with my wife, and my 12 year old, and upstairs from us are my wife's parents you know they're in their mid 70s. My mother in law has significant health issues.  It was really, it was really difficult for me. And so, but I'm also on the same hand, I'm relatively fortunate like I have a job that pays living wage we have a house that I could be done in my basement and be there for five, five days while waiting my results. But it just made me think about all the families who don't have those same kind of resources.   It's going to spread through your through your conditions in a much sharper way, especially for for poor people and people of color. And you know, you'd also talked about the, you know, the hospital on the south side the ER where you where you work, that that's also closing in the middle of a pandemic which you know you were saying you'd never see that in a wealthier community. So what are you doing, right, are you doing now.  It is, you know, it's it's a business magazine. And it was just odd that the Cook County was saying well we communicated to the people. Providence is located in the south side of Chicago and the Washington Park neighborhood. I don't believe that crane Chicago business the high bear has a very high subscription rate in that area and just I'm just guessing that I don't have data on that. The fact that they would just in two days tell the people tell the nurses Oh by the way your emergency room is closing that would never have happened in a community where like Northwestern Memorial Hospital is located where Illinois Masonic is located those are both much more wealthy well resourced areas Washington Park is not one of those areas. There's there was a study done a couple years ago the difference between life expectancy and Washington Park which is where Providence serves and Hyde Park Hyde Park has University of Chicago is a very well endowed institution I think they're there they've a billion they their life expectancy there is 14 years greater in Hyde Park than Washington Park. So that was just stunning that you would close an ER that serves a community of color in the middle of the pandemic it was stunning to me and they said it was for safety reasons they said that one nurse tested positive show me a hospital anywhere in the country that has not had a health care provider test positive when if they're treating COVID patients it's part of the this part of the picture but none of them I guarantee none. No institution around the world who has a worker test positive has shut down. So in the meantime they basically said the nurses go we're going to send you to other places you can work at Stroger which is their main campus or the Sir Mac which is the hospital that serves a community jail. So I opted to go work at the jail and I was there Easter Sunday. I'm going to be going there again this coming Sunday. So I want to talk with you about that and what that's like, you know because you talked about you're in Illinois and I think the CDC statistics also show like the death rate for African Americans is five times that for for white Americans and so I want to go back and talk to you more about the the prison but at this point, you know I'd love to bring in you as an emergency room doctor in the Washington D.C. area and Lynn when when I was talking to you, you know you'd mentioned Dennis was was was exposed to COVID and you know you isolated in the basement. You're still living with your with your husband and your daughter and you were talking about the sort of the steps that you go to try to protect protect them really and protect yourself can you just sort of walk us through a day in the life of how you like just go to work and come home from work. Sure, I'm happy to do that. Yeah, I in my process has changed quite a bit from how my job was a couple of months ago. In order for me to go to work I generally get dressed I put my cell phone and two plastic bags and I go get in my car and drive into work and one outfit. I change my shoes I put on the second outfit. I put my mask in my, my gear on and then I go into the department. And then while I'm there I change my protective covering multiple times throughout my shift, and then at the end of my shift I wipe everything down my shoes my badge everything.  I put that bag in a bag on my porch, and then I grab another. I take my clothes off on my porch so that's now two sets of clothes. I go inside and then I shower and then I come out. And so I definitely think it adds a lot and I don't you know honestly I don't know if that's enough or if that makes any sense at all. But you know I think the thing that struck me is that this is a new disease and it's a disease I've only known for four months as compared to any other disease I've studied in my career. So there's a little bit of science out there but what I know is that we're not sure about the spread of the disease. And because of that I'm trying to be as careful as I can. It's interesting that so even though you're you're still at home you're trying to separate as much as you can from your family can you talk a little bit more about what you're doing and and then what that what that's like but what's the impact now on your family with you kind of being so separate. Yeah sure. Yeah I'm lucky enough that I have a separate area in my home which I know a lot of health care workers do not. And I am in my bare bedroom where I have a bathroom next to me and I've walled that off and I no one else uses it and I stay in there almost all the time I come out for meals. But I'm trying to minimize how much of the air that I breathe out of my oral nasal pharynx goes into my family.   Yeah yeah I have a toddler and so that's hard you know because she hears you in the house so you know initially we thought maybe I would just stay completely isolated but that that really wasn't possible and I have some colleagues who also have toddlers and they've had to make the difficult decision of do they stay in their homes or do they send their toddlers away to live with their spouses in other states and I would say people have done both things.  So what's it what's it been like for your husband you know we had had a crisis conversation a couple weeks ago about how women tend to do about twice the housework and childcare even when they're working full time and that this you know that this coronavirus is really upending a lot of that potentially particularly among health workers where it's like 70% of all nurses are women and you see stories about you know like you'd mentioned a couple people you know nurses are staying at hotels or they're staying completely in different places to stay away from their families, you know kind of what's happening, you know, in your own in your own home with, you know, with your husband sort of not only doing the physical labor but all of that invisible mental labor that that women tend to do when it comes to caregiving and housework. I think it's definitely hard. I, you know, in addition to my clinical work my non clinical work has increased in addition to just, you know, reading about this disease and trying to learn as much as you can. So, because of that, he's trying to work while also watching her and then he processes on orders all the food, make meals, and then he's trying to make sure that she's occupied so coordinating zoom parties or almost virtual babysitting with grandparents on the iPad while you're taking a call at work, and, and all kinds of things like that. So, well thanks so much Lynn, you know you talked about. Next I'd really like to bring Ramon and Ramon is a nurse practitioner in the New York area which is we all know has been one of the just the hardest hit outbreak areas. In Ramon you also have family and you're like one of the, like many of the people that we're talking about you're actually living separate from them. Can you talk a little bit about your own, you know, your own story your own experience and what's happening with your family. Yes, thank you. So, you know, I've been a nurse for about 13 years, an NP for about five. I'm married my wife is about five months pregnant right now. I have a three year old son. I actually, you know, have been working in the outpatient world in the last few years. So when this all started. We started to work from home a little bit. But as soon as you know the work from home days were over. I decided it probably would be best to move out.   So luckily, a family friend, you know, was more than happy to give their apartment, you know, for a healthcare worker. So I moved here. And, you know, about one week after moving here, they actually redeployed us to the floors in the hospital to help out. So I worked in COVID units and non-COVID units. And at that time, I had, you know, actually felt very glad that I did move out a week before because, you know, I didn't know that I would be going to a COVID unit initially. And I didn't, I wouldn't know what, I don't know what I would have done if I had to come home from work and that they figure out where to go and what to do, you know. You know, you were, you were saying too when we were kind of talking and getting ready for this podcast that, so your wife is five months pregnant, you've got this young toddler and so she's not able to work because she's in the position that you're right. In a sense, it's a privilege to be able to work from home. I'm very privileged that I can work from home. Many people can't. But then the people who, you know, who are also trying to do childcare on top of that, that's also almost impossible to try to do both at the same time. We last week, we talked to Sarah who basically a single mom because her husband's overseas with two kids and her job just didn't understand why couldn't she keep working and try to take care of a one in a three year old. So it's literally impossible to try to do that. So you were talking about your wife is now taking time off, but that's eating into time that she was hoping to have for maternity leave, which is sort of another huge problem that we have in this country where the only country that also doesn't have a paid maternity leave policy. You know, can you talk a little bit about that and sort of what she's experiencing and all of this with you and you're not, you're not there because you're trying to protect them because you can't help in that situation. What's what's this like for your wife. Yeah, so I mean during all this time of change, our daycare also closed down understandably to help stop the spread of disease. And so my wife who initially did try working from home is unable to because now she has become the only parent in the home and also is the only person taking care of the household, which is terrible to think about.  So it's it is really tough for her and for, you know, our family and you know did the fallout from this will be, you know, months and probably years to come. Well, thank you so much for sharing your story.  Now you're going into the into the prison and helping there, which, you know, as we know from reports is I think that at one point was was sort of the most infected highest rate in, you know, in the country. So, yeah, what are you seeing there and what are you what are again what are we learning that we can that we need to do better in the future. I mean, it is impressive to me it's a lot of the things that we're learning are things that are known, in the sense that there are horrible inequalities when it comes to how health care is distributed in this country. And learning about underlying reasons why there are these life expectancy differences like I was saying between Hyde Park and Washington Park you know just one street separates 14 years of life that's just stunning and it should have been a three alarm bell ringing for for years and should have been cared for and so this I think has exacerbated these COVID has exacerbated these underlying conditions so in the jail there's constant issues with short staffing with nursing so some of the people I took care of. Were on the one hand just horribly afraid on three detainees have already died from from Coronavirus that they caught in the jail. There's hundreds of detainees that have it. It's worth remembering that a lot of these people in the jail are not there because they've necessarily be convicted of anything thousands of the people who are there. Are there simply because they're too poor to afford bail they don't they don't have the $500 a month will be $5 million for for people who are for many people in this city to they can't just get out and so they're stuck there. The state ended the death penalty you know in 2011 but it has functionally in some ways been reinstated by not allowing these people who are there so many of them for nonviolent charges just awaiting trial. And the city says well it's too dangerous not not physically of the communities but it's too dangerous to set these people up because they may infect others. And my response that is right now in downtown Chicago there are literally thousands of empty hotel rooms the tourism industry obviously is a huge break right now. So why not put these people who are just awaiting trial who many of them who are there for nonviolent like traffic violations whatever let him stay at the Palmer House let him stay at the Intercontinental having there for two weeks they can do a wellness check on them on a regular basis and then they can go back to their communities. There's certainly solutions that could be put forward for many of these detainees in the jail and I hope that the county starts making the better decisions. Oh man, what an amazing story and you know, I love that thinking big about how we could really try to use this crisis to learn and really do things better emerges a better place a better country. You know at this point I want to move one of the participants and Hoffman posed a question in the chat so and let's bring you up and have you pose the question and then we'll have all the panelists respond. Hi yeah thanks for for prepping me in here my name's and I teach at a community college in the DC area. And many of my students are single mothers, mostly primarily women of color, and many of them are nurses aides working in nursing homes and hospice settings. And at the same time they're also working towards nursing credentials and mothering. So you can imagine how the COVID situation has impacted their lives in these really profound and heartbreaking ways because while they must continue to work. They also are trying to continue to work online towards their credentials and in their college classes, and their, their kiddos are home, also trying to now manage e learning. And so, and at the same time, they're getting sick. One student lost her ex husband this week to Corona, and he is the primary financial resource for the family. I have a question about how can we in higher ed as we're thinking big about, you know, how these different systems articulate and how they can come together how can we in higher education or in training programs address and protect these lower level healthcare workers who who don't yet have the credentials, right and the, all of the different supports and access to help, well they probably have access to healthcare but actually in some case they don't, and disrupt the gendered and racialized class stratified labor pipelines that are going to continue to evenly impact these populations, if they can't get these credentials, right. So, that's my question. So, what suggestions do you have, do you have and how can we think about, you know, higher ed, who is going to be getting actually a tremendous amount of money through the cares act to to funnel some of maybe some of these supports towards those those students. Well let's start with with Dennis. Those are so there's some excellent, excellent and troubling questions and how do we know what we do how do we emerge better with that. You are who are seeing this through the zoom that I'm definitely not the face of what nursing looks like in in the Chicago area by any stretch. I'm a Chinese person I'm identified as male, but most of my coworkers most of them went to nursing school with our people of color women most of the nurses I work with that Chicago public schools are in that demographic. My feeling as far as I don't know if there's a short term solution to to the callers question, but I think the long term solutions have to be examined. I think that nurses come out of school with tens of thousands of dollars in debt that makes no sense to me. If you want to go into investment banking or be, you know, some kind of money maker real estate tycoon. Fine, you got to pay for your own school that makes sense but if you want to go into a field. That's about taking care of people that's about improving people's lives that's about giving back to your communities. Why should you be paying for school? Why should you be coming out of your education? I'm sorry to shout and get excited, but come out of this in in debt that makes absolutely no sense. There should be a preschool for anybody who wants to become a teacher or a nurse social worker. I mean those are just the names off the top of my head, things that actually contribute to society. There should be childcare provided to those people who want to pursue the education so they can be supported. There are other people I went to nursing school with I went to Malcolm X college community college I really appreciate what the, the, the questioner asked about it. That's that's who goes to those schools and they need to be put more resources and there's resources that exist out there. Why is it that Wall Street, these big companies are being given this bailout of millions and billions of dollars, while people who are actually doing work, you know, not getting that same kind of relief we need to examine so many things out of this crisis and I really hope that we are going to fight for the changes that we need. All right, awesome. Lynn or Ramon do you have you have some thoughts. I can speak a little bit sure. One of the things I noticed an emergency medicine is that nurses come and they're very excited and then they often about mid career decide to go and leave and get a nurse practitioner degree or a doctorate in nursing. There's a major drain of these mid career nurses out of the emergency departments and I think if we had a system where we rewarded nurses for being good clinical nurses monetarily, perhaps we wouldn't be pushing them into other fields and the emergency departments and other departments within the hospital could reach the benefits of having those people stay around longer and teach our new learners. Excellent point. You know Ramon what do you have some thoughts. Yeah, I mean, you know something I realized a long time ago that is kind of coming to light now is that you don't see someone walking down the street and scrubs, and think, Oh my God, they're putting their life on the line. You see a police officer firefighter, you know, EMT you may think that. But I think that people are seeing that healthcare workers, you know, are on the front lines and do deal with things in the emergency room that are unknown to them and they're bringing these dangerous home to their families and putting themselves at risk and you know, the people that are training or, you know, parenting during this time, they don't have an easy choice. You have to go to work. You want to go to work, you want to help, you want to be a good parent. And there's there's a very hard balance. I mean, like Linda saying, all the steps she takes I mean that adds hours into your day going to work coming home from work, you know, it's it's really trying and you still don't know if that's enough. Yeah, it's really tough. You know, I see that we're coming down on time and so I did want to add I wanted to go back to Dennis and Lynn and Ramon if you had some thoughts to just, you know, here, here again we have a crisis and it's it's really showing what's fraying what's broken what's near what's what's breaking and in the United States, you know, what, what do we need to do next what's, you know, Dennis, let's start with you you've mentioned a lot of really important systems that are broken right breaking. You know, what do we do, what do we learn out of this and who needs to be in charge of making these changes. I think right now it's clear that that healthcare providers and justifiably so are being held up in the media in public as as as Ramon was saying as as Lynn was saying as these heroes that are going in. But I think that's that's half the story. We have been working conditions that that are would be considered embarrassing in any other country that hasn't a similar economy. And these are chronic disparities that have existed in this country of decades, if not for decades for centuries. And so I feel personally as a health care as a person who participates in providing health care. We need to lift up our voices to not just talk about ourselves as heroes, but talk about the fundamental things that are broken. Why is it they're not sick time for people. Why does there are disparities when it comes to health care. Why are they not why do we have a poor profits health care system. All those things are things that we need to be shutting from the rooftops right now, towards changing things fundamentally. Right, as well as talking about the mass incarceration that you're that you're now facing at the jail. 100%. So, Lynn, you have some final thoughts about what do we learn from this. Sure, I think that emergency medicine needs to be given surge capacity. You know, we always operate with our, our emergency departments at 120% full. And when something like this happens. It's very hard to respond. Yeah. All right, great thoughts. Ramon, the last word goes to you. I mean, I think just like Dennis and Lynn were saying, you know, we are always working at capacity with limited resources. And I think this pandemic has actually brought those to light and I really hope that it can be fixed moving forward. But we do have to, you know, point it out to, you know, everyone and people that can make change to make that happen. Right. And this is this is that we're trying to play our part in that trying to bring these voices to light bring these conversations to light, making sure that workers have a voice making sure that the public really understands how these systems are broken and gets behind the kind of larger policy changes that we need the investments and the, you know, the kind of the larger workplace cultural changes that we need. So what we can do as individuals, you know, how we all need to be understanding and pushing for these kinds of changes. So I want to thank Dennis, Lynn Ramon thank you all so much for being here and sharing your stories. I want to thank all of the participants who have chimed in in the chat and thank you so much for being part of the conversation today. My amazing better life lab team, the amazing new America event staff, David Shulman, an amazing producer thank you so much for helping us put these conversations together. Next week we're going to be talking to Kelly Yoast who is a remote and flexible work strategist. We've been all doing this, you know, many of us for a month what do we, what are we learning what, how is this going to change the future of work and what about the people who can't work remotely. What does this mean for future work systems. So thank you all so much for joining today wash your hands stay safe and we'll see you next week.


Looking for some exciting adventure on the big screen? Disney as you covered with Strange World. A movie that strangely had almost zero advertising and for some reason didn't head straight to Disney Plus. Let's talk about it. I only bring up the Disney Plus thing because I feel like Strange World is not a movie that's gonna do very well at theaters. As I stated, it had almost no marketing push behind it. It's not a known property and people just don't seem to be going to movies anymore unless it's something they're familiar with. And that's kind of a shame because Strange World's not a bad movie by any means. It's actually pretty solid.  And you know what? There are actually a couple of cool twists that make this movie interesting. It keeps it from being your standard stock adventure film where different generations of heroes learn a lesson from one another. Now, it does have that, but the way it does it, I think is a little clever. It goes beyond some of your basic tropes. Dennis Quaid plays Jager Klade. He's an adventure.  He takes his son as he playfully refers to a searcher everywhere with him on his misadventures. Searcher is voiced by Jake Gyllenhaal, who I honestly thought was voiced by Paul Rudd. I didn't know until I looked it up on IMDb, but the whole movie, I'm like, that's gotta be Paul Rudd. It's just like not a problem. I'm just pointing it out. Father Klade and his son don't see eye to eye. They're very different individuals. So when Searcher's dad wants to go beyond the mountain peaks and Searcher sees that there's something that could help their planet survive, they butt heads and tragedy strikes. The movie then jumps forward like 25 years and we see a very different world. One entirely built up by Searcher and his findings all those years earlier, but the humans have laid all their energy producing crops into one basket. And once they produce a cold, the planet as they know it's gonna start dying off and it's now up to Searcher all these years later to once again go on a quest to find a solution to this problem. Along the way, he and his team are gonna discover some beautiful vistas, strange creatures, exotic locations, and it's all rendered beautifully in that top tier artistry that Disney's known for. The movie's also paced pretty well too. It's an hour and 45 minutes long, probably could have shaved off a little bit, but as it stands, it has a very good pace. There's a ton of messaging here. It's not subtle in the slightest about environmentalism, how we're destroying the planet, about different generations of fathers pushing their baggage and their hopes and dreams on their children, trying to make the best byproduct of themselves, but not really listening or paying attention to the kid and instead being selfish. It's all there, it's all very obvious. The thing that's gonna piss people off, which has often been the case lately with Disney as they try to branch out and try to tell different types of stories and involve different types of people, is the son is gay. This doesn't bother me in the slightest. I have a 10 year old son, I took to the film. We both really enjoyed it. He clearly picked up on it. No, the son isn't like making out or anything, but again, everything's so hit over your head. It's not talked about a lot.  I'm bringing this up not to bash on anyone, but as a public service announcement so you know what to expect in case you're thinking about taking your kid and you feel uncomfortable with that sort of thing or trying to explain it to a small child, there you have it. As for me, this movie was pretty solid. It wasn't anything amazing by any means, but it was honestly better than I thought it was gonna be. I was expecting a pretty straightforward affair. Like I said, there's a couple twists and turns that keep you invested and thinking, oh wow, I didn't see that coming. I like what they did here. Bravo, let's move on. There are some fun side characters. The son who I mentioned, he's definitely the worst part of the film. I kind of was annoyed of him.  Do I suggest you rush out and see it? No, this is a movie you can watch at home. I don't think it needed to go to theaters. There's just not enough there for me to say, yeah, absolutely day one, go out and watch this. That's really all I have to say. Strange World's a solid film, nothing that's gonna set the world ablaze by any means. Looks pretty, sounds great, gets in and out pretty decently, quick, and it entertained me, so it did its job. All right, those are my thoughts on Strange World. Let me know in the comments if you saw it and what you thought. Like the video if you had a good time. Subscribe if you haven't as I post tons of movie content each week. I'd love to see you stick around. Take care.  Since I still have you, maybe think about joining me on Patreon at patreon.com slash adamdosmovies, becoming a YouTube join member right here on YouTube via that join button. And I'm also on Twitch, live streaming a podcast with my buddy, bless every single week going forward. It's a fun time. I'd love to have you there.


Awesome. Thanks for joining, all of you that are joining live and for those that might be watching it afterward and as a recording. We'll be talking today about service networking and the security aspects to keeping that communication secure. We'll be looking at a few different technologies like WireGuard and TLS and how they come together to provide security in a way that's more amenable to our cloud native type architectures and workloads. My name is Christian Posta. I'm a global field CTO at solo.io. I've been involved in open source for quite a long time. I've been working on Kubernetes since before it was 1.0. Same thing with the service mesh ecosystem very involved since January 2017 or so. I've written a few books on this topic. Now, coincidentally, I just got an email from the publisher last night saying that all of Manning's books are on sale today. Maybe go take a look if you're interested. But I've worked very closely with a lot of solo customers and open source users that are looking to modernize their infrastructure. They're typically moving to some public cloud. They're adopting containers and technology like Kubernetes, and some of the models and paradigms that we used for managing deployments and observability. Those have shifted and changed and we're modernized. Now, they're getting to the points around security and networking. That's where we're going to focus our efforts here. We're going to look at an agenda here that we'll talk a little bit about the need for some of these more modern security and networking changes. We'll look at some case studies, look at some technology, and I'm hoping that if I manage the time correctly, that we'll be able to look at some demos as well. I work at solo and the background is we work on these application networking problems. We work with enterprises, we're adopting modernization efforts at scale, and what we've picked are we believe the best of breed products or project from open source that we then use to solve some of these problems. You'll see some of these open source projects mentioned in the presentation here today. We're going to start the conversation with what seems and appears to be a fairly simple diagram, but has a lot going on under the covers when it comes to networking and when it comes to security. Now, in this case, we're talking about service A talking to service B. But when you think about how the service A find service B to talk even in the first place, especially in this in a more cloud dynamic world, how can we observe what is happening, like what happens, are we going to know when calls fail, and services are out of SLA, and so on. More importantly, who is service A? How can we prove who is service A and who is service B? In the past, we would think about who service A is based on where it's deployed. We would think about writing rules and policies about it based on where it's deployed. It would communicate using things like TCPIP and so on. This is still fundamentally in place when we talk about cloud native networking. IP is still when you're talking about things like REST APIs and JRPG and so on. IP is still a foundational unit. Now, in previous generations of technology where we would use IP and network segmentation, we would use complex firewall rules based on these units of identity, where things live and IP addresses. We would use, like I said, firewalls and gateways and routers all to implement this. But as we move to adopting public cloud, as we move to things like containers and Kubernetes, this world becomes a lot more ephemeral. Workloads can spin up. Workloads can become unhealthy and get killed and move to different hosts and everything's a lot more dynamic. When you're going from on-premises to public cloud, you don't own that network anymore. That's AWS or that's GCP's network and you have to live within it and write some rules about how that fits. But sometimes those models don't fit the same way that they do on-premises. What we see as part of that is the bad guys are out there. The attackers are out there. They are finding all kinds of different ways to get into what you've traditionally might have thought of as your network or your corporate network. Using all kinds of different schemes, all kinds of different attack vectors, and a number of which can be used together to breach a particular network. This idea of thinking about security in terms of, well, if we just make a boundary and keep the bad actors out, then we'll be safe. Because that isn't the case. Actually, there's a number of examples why and where that isn't the case. I don't mean to pick on this particular one, but here's one that came to my mind back in 2014, where the Sony hacks, very sensitive emails were made public, even pre-production films were made public, and the attackers had very deep and widespread access to Sony's networks. But this didn't happen because they just left the API gateway unsecured or something. There was a number of things that led to this, including things like phishing and malware and so on. But one big part was that once they got inside of a particular boundary, they were able to move around. They were able to learn more and inspect and move laterally, and that enabled even more of the attack to unfold. And so when we started thinking about modern service networking and securing them, there are a few tenants or some contexts that we have to have in place that aligns a little bit more with what reality is. That these networks, we should assume that there is, there are hostile actors in this, whether it's internal or external, that the possibility of breach, even though you believe your network is just, within your own boundaries and perimeter, is susceptible to data exfiltration and service hacks and so on. So the way we should be thinking about standing up APIs, standing up microservices, standing up databases and caches and so on is to authenticate and authorize and encrypt as much of this traffic as possible, even though it might be within your quote unquote, corporate network. And some of the things that we need to have to be able to write policies about this is knowing who is whom. We want to be able to constrain who can call, what services can call, what other services under what circumstances. We want to also be able to audit and understand what calls are happening in our system. And we want to be able to deny or apply limits and constraints and so on, while keeping the interactions between these services confidential. We don't want bad actors that might have made it into our boundaries, into our networks to be able to see what's happening and understand patterns about what's happening in our network. And lastly, we want to, even though a service might have access to another service, we want to limit exactly what they have access to with fine-grained authorization policies. Now, this is not some pie-in-the-sky type of theoretical aspiration. A number of organizations have implemented a networking and security posture that lines up with some of these desires. And we're gonna look at an example from Google. And... So Google published a paper on their application layer transport security. Oops, there we go. That they built to address this, these circumstances and this type of infrastructure at scale. And they ended up developing this back in 2007, right around when TLS 1.0, 1.1 were out. And at that point, Google had seen enough attacks on SSL and TLS that they determined that that protocol is a little too complex, too many options, too many moving pieces and too many attacks against it. That they would need to, they should, and they wanted to go off and rethink how can they build a security layer in their RPC networks that eliminate some of those weak points in the security. So what they did is, and you can go see this paper, is that they tried to pare down what they thought were the more secure algorithms for implementing their security. They created an identity model that can be layered on top of the workloads that are not tied to where a workload is deployed. And they tailored it very specifically to Google isms. Google uses protocol buffs heavily. So they use protocol buffs to encode the certificates and on the wire protocol and so on and improve their security, like I said, by limiting to ciphers and protocol schemes that provide things like forward secrecy, authenticated encryption, and safe exchange of session keys and so on. The design and what they were hoping for was for this to be transparent to their applications, that their authentication and authorization rules would be tied to an identity model that could be run, could be interpreted regardless of where it run or what the server name was or application name was. And so they built this identity model. And the way that it worked is the workloads RPC clients, when they spun up, they would go ask for what they called handshake certificates that would allow this ALTS handshake to occur and to occur in a way that can be verified and authenticated. They had this notion of a signing key and the signing key would then issue the, would sign the handshake certificates. And then when the RPC clients tried to connect with each other, they would exchange and like I said, verify these based on the root of trust. The protocol that they ended up designing and building for this, like I said, was based on protocol buffs, but it's fairly straightforward. The client sends its initial parameters and requests to start a connection. The server will then use some of those parameters and its own parameters, create the session keys and present its certificate. And then at that point, the client can actually start talking in an encrypted way. And so you'll see this is a very simple one round trip time handshake that enables then the subsequent authenticated and encrypted communication afterward. So if Google built this, and Google built a lot of technology that predates things like containers and Kubernetes and so on, should we be looking at rebuilding this ourselves to be able to use something like ALTS ourselves? And the answer is no. We haven't really seen that adoption of something like ALTS outside of Google, because there are existing building blocks that can be used to solve some of these same problems. And more specifically, what those problems are, what we're trying to do is number one, get security, authentication, integrity, checking and so on into our network communications without having to go re-engineer and force all the applications to change and try to do it transparently. Things like focusing on simplicity, reducing the number of different ciphers and protocols and the complexity of a handshake to determine what to use. Let's keep that as simple and focused on safe ciphers as possible. We want identity to be the focal point, not where things run. So we need some way to assign identity and there are a number of ways to be looking at this. The first that we're gonna start off with is WireGuard. Now you may have heard of WireGuard. It is sort of a big piece to some of the popular open source projects or even organizations that are built around it, things like TailScale and Cilium, you'll see it mentioned. And what it is, is a way to encrypt packets, datagrams that are running at layer three to provide confidentiality between services and do it in a way that's transparent to the applications. So it actually, WireGuard lived, if you look at the Linux implementation, it lives as a kernel module. It is focused on simplicity versus alternatives like IP set, for example, which can be very complex, even if you just look at the number of lines of code in the particular projects. It actually uses a fixed set of ciphers and cryptography.  It doesn't try to get too creative with how it encapsulates this encryption. It just puts it into UDP packets. And it allows the WireGuard components to focus on doing what it does really well and then the configuration, some of the pieces like how you exchange public keys and so on are expected to be done out of it. It doesn't try to conquer the entire world, like maybe some of the other implementations do. If you wanna look at an example between two hosts, WireGuard can be set up and configured using similar tools that you would for other network interfaces. So things like the IP CLI or if config.  And then WireGuard does the rest. It will automatically encrypt the traffic going over this tunnel. And it will encrypt it using very strong and known curves and ciphers and hashing algorithms that are known to be safe and known to be performance. The idea here with WireGuard, however, is if there is a vulnerability found, then don't just continue to support it, just upgrade and move to something that there are no vulnerabilities known. And this is generally from a simplicity standpoint and from a security standpoint tends to be a good thing. However, there are some downsides to WireGuard. Being able to upgrade everything all at once could be difficult. And the implementers of WireGuard have made it very clear that they want to keep it, they want to support one stat of ciphers and algorithms at a time. Maybe they make some leeway for upgrades and so on. A bigger challenge is that WireGuard is not FIPS compliant. So if you're in an organization that needs to support FedRAMP type workloads or working with the US government that requires FIPS compliance, this could be a hindrance and it probably won't become FIPS compliant. NIST and the federal government are pretty, let's say they're bureaucratic about how they pick what ciphers they want to standardize on. And the process for doing that, the roadblocks for doing that are actually quite high and there doesn't seem to be any interest from the WireGuard community in doing this, going through this compliance process. But it's likely WireGuard will not be FIPS compliant going forward. And the last piece is that WireGuard is fantastic technology and I do wanna point out that just because it's not FIPS compliant doesn't mean that it's insecure in any way, but it doesn't do things like service to service mutual authentication or identity, right? You will have to layer something on top of WireGuard to achieve those capabilities. And out in the wild, things that we see people doing, things like, well, we'll just create JOT tokens and have them signed by some trusted secure token service. We have a layer in OAuth and we'll use these tokens to provide a layer of authentication while WireGuard provides a confidentiality and encryption. Or there are other options, maybe you create your own custom authentication mechanism and protocol, the Sillian project has done that and we'll take a look at that in a second. Or you could just layer TLS and client certificates on top which would get you to that next level of authentication. So in the Sillian project, what ends up happening is a way of layering on top the mutual authentication process and then allowing things to proceed under the covers as encrypted traffic using WireGuard. So what happens is in Sillian, in a particular cluster, a Kubernetes cluster, you have two different nodes on which there might be workloads, service A, service B. And then when service A tries to talk to B in that node where service A is deployed, Sillian will check, hey, are you authenticated to talk to service B? And if it's not, it will just drop the packets. It won't do anything with the, it won't allow the connection to proceed. But in the background, what it'll do is it'll go, try to create a mutual TLS connection to the node where service B is or some other node, just to prove that service A can talk to service B with client certificates and mutual TLS. And if that connection succeeds, it'll stop the connection, it'll go mark in a little map that, okay, A can talk to B. And then when the TCP retry occurs, the packet will then eventually make it across because it has been marked authenticated. Now in this separation of mutual authentication encryption, it's possible that the traffic goes across the wire unencrypted because the MTLS part is not actually tied to the record protocol. But if we enable WireGuard, like we saw in previous diagrams, then we can get that confidentiality between services that has been mutually authenticated out of band, right? So that's, we can achieve a level of security with an approach that builds on top of WireGuard. If we take a look at TLS, Transport Layer Security, we can see an alternative, right? Because TLS implements things not at the IP or layer three level, it implements things much closer to the application at TCP level where you know about ports and sockets and this type of stuff. And if we look at TLS 1.2, which is actually very common to be used these days, we look at the handshake protocol which involves a series of steps of exchanging protocol information, cipher suites, random data, free master secrets, all this type of stuff, certificates for authentication and eventually through this complex series of handshakes get to the point where we have session keys, we have authentication and we can start encrypting data and getting that confidentiality. Now, TLS 1.3, which was released in 2018, simplifies this a lot more. The handshake in TLS 1.3 looks more similar to this, where the client reaches out and says, hey, I wanna talk TLS 1.3, here's a cipher I wanna use and here's some parameters that I wanna use for key agreement. The server says, okay, I like that. Here's the key agreement we're gonna use. I'm gonna start encrypting my response because by the time you get it, you should be able to understand and decrypt it. And then at this point in TLS 1.3 in this handshake, we are ready to understand and encrypt data. In an M TLS scenario, in that client finished message, we can send the client's certificate to be able to perform mutual authentication. And if you look at the handshake here and we won't go into too much detail in the record protocol, but in the handshake, you can see this is the one round trip exchange. It looks a lot more similar to what we saw on the ALTS diagrams. And so for those reasons, TLS 1.3 is faster because it uses fewer round trips. It is safer. TLS has gone ahead and reduced the number of ciphers and cipher suites that can be used, including getting rid of a number of ones that aren't safe anymore. And I think the list of supported ciphers in TLS 1.3 went from, was it like 30 something in TLS 1.2 down to five in 1.3. So we've significantly simplified the list of ciphers that can be negotiated for TLS 1.3 and focused on ones that are known to be secure so that in a session establishment, you can't be tricked or downgraded into more unsafe protocols. TLS can do authentication, along with encryption and integrity checking. TLS does meet VIPs' compliance for those that need that. Instead of layering on Jot tokens and other things, you don't really want to share those because if a Jot token gets recovered somehow, it can be replayed and reused potentially. In TLS, we don't share those private key materials. We publicize the public keys. The sessions are ended and terminated at the applications, at the ports where the applications are listening. And like I pointed out earlier, TLS 1.3 actually does kind of look like the Google ALTS implementation, although it a bit late, but it does look like that implementation we talked about. Now, TLS doesn't have, isn't a panacea on its own. There is no way to specify or a standard way to specify identity. Things like issuing keys and identifying revocation and rotating those keys can be complex. Do the applications handle them safely? We hope and every library, every framework is a little bit different in terms of how it does that. So it's not a bulletproof way just by saying, okay, we're gonna use TLS to solve some of these problems around identity and transparency and authentication authorization. But in terms of identity, you may have heard of a open source specification called SPIFI. Now SPIFI aims to try to solve that problem that there is no real standard way of specifying identity in TLS. And SPIFI stands for Secure Production Identity Framework for everyone. It intends to solve that identity problem independent of what type of application on what network it's running or what cloud, public cloud or cloud containers, VMs, it doesn't matter. It's fairly simple and straightforward. Identity is specified with a resource looking string and is asserted and signed by some sort of authority that presents this in what's called a verifiable identity document. Things like an X519 or a JotToken. And the SPIFI implementations try to take into account that we prove identity by its context, where it's running, but how it's running. And we do a lot more checking. We don't just rely on a JotToken or a username or password or we actually go look at the environment and say, okay, you say your service A. Are you really service A? Are you allowed to be service A? And then we attest that and prove that and then issue these identity documents, the signed credentials that then service A can use to assert its identity. SPIFI operates kind of at layer four, kind of at layer seven, just depending on the implementation. SPIFI, the verifiable identity documents, they, like I said, can be used as X509 docs or as JotToken. So the application that has to deal with that JotToken. So now we can solve this problem of who is service A. So service A comes online, it talks to this SPIFI workload API and says, hey, I'm service A, give me an SBIT or one of these identity documents. And then the workload API goes and does some research behind the scenes. It doesn't just trust that service A says it's service A. It might go look at the host, it might go look at the process ID, it might go look at labels and other contexts associated with this process to determine whether or not it is service A and can it actually be service A? It's not somebody trying to impersonate service A. So this process is called attestation and the implementers of SPIFI have an engine for doing this. I'll point out a couple of implementations in a second. But then once service A has been attested, then we can issue a SBID document that can then be used to prove its identity. And this, like I said earlier, doesn't matter what host is running on. Doesn't matter if it's in containers or VMs or lambdas or anything. This is independent of where things get deployed and can be used across workloads and across platforms. Now, the SBID actually contains the string that URI that I mentioned that describes the identity, which is specified in a format of what is the trust domain for this particular identifier? And then maybe there's some sort of hierarchy or way that we wanna structure our identity names, but then eventually what is the name? In this case, it would be service A that belongs to the BAR organization that lives under FU and is owned by this trust domain. We can also issue JOT tokens, which then get signed by the signing authority in the SPIFI implementation. And then these JOT tokens then can be presented as proof of identity and signature verification to understand that it was actually signed by the right authority. Now, if we use the X509 documents for our SBID, we can plug those in to our TLS 1.3 implementation and now get authenticated and secure communications between service applications or APIs or microservices. Following a model, again, like I said, we don't have to go off and try to reinvent ALTS from the scratch that we already sort of have it. Spire is a implementation of the SPIFI spec. So if you're interested in learning more about that, go to spifi.io and there'll be a lot of information there about the spec, but also about Spire and actually running and operationalizing it. And I know at SOLO, we use Spire to implement identity and workload identity across workload types. So now what about, so we covered the encryption and confidentiality, there's a few different ways to do that, authentication, identity, we talked about that, how do we bring this together and do it in a way that's transparent to the applications? Because now we know who Service A is, but we need a way to use those identity documents in a TLS 1.3 communication and do this in a way that doesn't force all the applications to have to change. And an example of doing this is in a recently, well, I guess it's not recent anymore, it was a year ago where we announced the sidecar list version of Istio. So Istio solves this problem and has solved this problem for a number of years by injecting a sidecar next to each of the applications. That was the intent to try to be transparent. So we didn't have to update the applications directly, we could just capture all the traffic that's leaving or entering an app and force it through the sidecar. And then in the sidecar, we'll handle this. With Istio ambient, we don't need to do that anymore. We don't need to inject a sidecar, we can handle this stuff within the pods network namespace but not in a sidecar. And so take a look at ambient for an implementation of that. And in fact, I'm going to, I think, go into a demo now that shows some of these concepts that I talked about and illustrated here in action. So first, we're gonna take a look at our environment. There's a lot of stuff going on here but what we're gonna take a look at is in the default namespace, we have a set of apps. We have the sleep application and we have the hello world application. And these apps can call each other without any problems. So if we come in here and we do call combinations, we can see sleep v1 can call the hello world v1 and sleep v1 can call hello world v2 and so on. Right. But what we wanna be able to restrict who can call whom and to do that, if we take a look at, we will take a look at maybe using Cilium or CNI to be able to do that restriction. We'll take a look at mutual authentication and approaches for doing that. However, if you'll recall earlier in the talk I mentioned, using IP addresses as the unit of policy can end up breaking down at scale. Now let's take a look here. So if we look at, we'll start off with Cilium and we'll list our services again and we'll enforce a policy or set up a policy that says sleep v1 can only call hello world v1. And that sleep v2 can only call hello world v2. Actually that's supposed to say that. So what we're gonna end up doing is looking at our policy document, this happens to be Cilium, the implementation is not that important. But what we're saying is for hello world v1 can only be called by hello world or by sleep v1. Sleep v2 cannot call hello world v1. So let's apply this document, this configuration and let's also set up a policy for sleep v2 and hello world v2. Those can sleep can call hello world v2 but sleep v2 cannot call hello world v1. So let's apply this as well. And now let's take a look at what's happening under the cover. As I pointed out, Cilium does layer a MTLS mechanism or sorry, a mutual authentication mechanism on top of encryption, on top of WireGuard. So what we're gonna see down here is, I hope I didn't mess up the demo script here. I did. Give me one second. Why didn't that work? What are the chances that live demo fails after I've gotten it working seriously 20 times? Let's see if we can do that. All right. So what we're gonna do is we're going to capture packets in Cilium and when we make those calls, what we're gonna see is the MTLS handshake happen. Remember that's how we assert the identity for mutual authentication in Cilium but then we don't use the encryption part. We delegate that to WireGuard. So if we now make some calls, we should see that some calls succeed. The ones that we expect to fail actually do fail. And in the bottom pane, we can see that authentication handshake happened using MTLS but then we can also see that sleep v1 cannot call hello world v2 and by subversa that sleep v2 cannot call hello world v1 which is what we want, right? Right, number of policy is enforced. Now the way that it is enforced under the covers is Cilium has a mechanism for specifying identity this Cilium identity is not spiffy but we can take a look at what it is. We can see that in the default namespace we have four different identities, it makes sense. We have four different services. And if we look at one of those identities, nine zero five eight, which represents sleep v1, we can see that it's created by a set of labels. This identity is created by a set of labels. So we go and we see and understand some context about what a workload is and then we assign an integer to it and that's the identity. If we look inside of Cilium's agent, what we can see is that this identity under the covers for Cilium to understand and apply network policy it has to be looking on the wire at, well, what is the workload? How can we identify this workload at runtime? And it does that by using IP addresses. And so it builds up this list or this map of IP addresses that are mapped to identities on a particular host and whenever connections are made it looks and said, okay, are you this IP address? Okay, you're this identity. Okay, I have this policy attached to this identity. Now, what we're gonna do here is we're gonna scale up the number of sleep v1 replicas and what we're gonna take a look at is how this identity mapping with IPs is not as foolproof as we want it to be. So we'll give it a second for our scale up to happen. We scale it up sleep v1 and if we look in this cache now, we can see for this particular identity we have a number of IP addresses. We have a number of, let's come over here, we can see sleep v1 services, each with their own IP address, but they're all mapped to this one identity in Silio. Now, what we're gonna see here is this identity and this mapping between IPs is susceptible to some types of failures. All right, so let's simulate in a scenario where the node on which some of these workloads run can't for some reason communicate with the CUBE API. Now this can happen for a number of reasons, network issues, the Silio agent is inundated with updates and is slow or doesn't have enough resources can't process these, the CUBE API could be slow. Maybe one of your cloud providers is doing something on the backend that's causing some issues with the CUBE API to be slow. So what that means is the node that is watching for pod changes and IP address all this stuff that's trying to map to the Silium identity could get out of sync, right? It's intentionally, CUBE API is intentionally or has been designed to be eventually consistent and can get, you can get into scenarios where things get out of sync. But now what we're gonna do is we're gonna try a few things here to see if we can get the IP address that was assigned to sleep V1 to get recycled and assigned to sleep V2. Because if that happens, we could potentially sleep V2 could call Hello World V1, which it did in this case. We ran a test, cycled some IPs and in fact a sleep V2 IP address did get assigned to, sorry, sleep V1 IP address got assigned to sleep V2, which then under this type of mapping to IPs for identity can get tricked and we don't want that, right? So let's take a look at another approach. Instead of delegating the policy to an identity that's mapped to IPs, why don't we enforce policy that's tied to identity that is asserted on the connection itself? And that's what we're gonna do here with this deal ambient. So to do that, we're gonna put the cluster back into a state that allows the node to reconcile and to get all of its information. So we'll eliminate that communication issue between the node and the QBPI. And then we're going to install its deal ambient mesh. Now, its deal ambient mesh is a side carless implementation of service mesh that actually implements the stiffy spec and ties that to a TLS 1.3 connection like we talked about in our talk here. So if we take a look and cross our fingers, hopefully things are coming up. Uh-oh. Give me one second.  The last step, which is just setting it up for the live demo, that part gets gipped. So give me a second, let me download the, and I was hoping to pre-cache these so they would go a lot faster, but instead we're gonna have to wait for some of these images to come up and to get loaded correctly, which it looks like now the SDOD control plane is and some of the other pieces are starting to come online. Maybe I'll give it a second. So while we're waiting here, hopefully it'll eventually come up. But what we're gonna do here is we're gonna set up its deal ambient mesh, bring those workloads into the service mesh. We're gonna run that same test that shows the node failing to talk to the Kubernetes API and then show that since the identity is asserted and authenticated on the connection on the wire, it doesn't matter what these different IP caches are doing. And what this will show is how, you know, we talked about earlier, some of the attacks that we've seen at other organizations, they don't happen because there's just one big gaping hole. There's a series of difference weaknesses in the system that could be exploited at just the right time, just the right circumstances. What we want is defense in depth and to be able to have networking policy to control things that the IP layer is good, but we also need to have a layer that asserts authentication, so on at the application layer as well or the higher up in the stack. Okay, so we have SEO ambient mesh installed. We're gonna bring those workloads into the service mesh and specify authorization policies like we saw earlier. Sleep v1 can only talk to Hello World v1. Sleep v2 can only talk to Hello World v2. Right, so now we got that in place. So if we come over here, we look at the ASCII system namespace. We do have a number of components, including the control plane, the workloads in the default namespace are, let's see, are part of the ambient mesh. We've labeled them correctly. And now what we're gonna do is we're gonna demo that wrong identity again. We're gonna get into that same state where the node cannot talk to the QVAPI server. We're gonna cycle through and get to a state where a sleep v1 IP has been assigned to a sleep v2 pod, which would allow us to go around that network policy, but then we'll cross our fingers and hold that. Since we now have defense in depth, that we'll catch that at connection time and just allow the connection. So let's see, we're starting to scale up, scale down, try to get the system into a state where sleep v2 has a sleep v1, an old sleep v1 IP address. Now we're trying, and we did get into that state, now we're trying to call it and it's hanging up. It's not doing anything. We're not allowing that connection to succeed. And this is because on the wire, as the connection is being made, we are doing the mutual authentication in line with the rest of the security. And we're doing this transparently, as I mentioned. The default, if you look at these workloads, they don't have sidecars. Istio is running and applying its policy, but it doesn't have sidecars. We're able to do this in a transparent way. So that's all I have for today. I think we did pretty good here on time. I'll leave you with a few additional resources, including links to things like ALTS to the WireGuard spec, understanding a little bit more. I purposely didn't use the phrase zero trust in this session. It's become too much of a marketing term. I tried to cover the concepts directly, but obviously there's a lot more to this and I left a few links for that. I'll leave a link to academy.solo.io. This is a place to go and get your hands on with these types of technologies and do that in a free way with a self, we provisioned the lab environment, it's a couple of clicks, it's running on instruct and we guide you through understanding how Cilium works, how Istio works, how Envoy proxy works and some of these other components that can be used to build a modern and secure application network. So with that, I want to say thank you. I want to, I'll leave my contact information here, both email and Twitter address here or handle here. Reach out to me anytime, happy to take questions offline, happy to take a look at people are asking for a copy of the slides. Yes, the slides will be made available. People are asking about a copy of the demo. Yes, that's already on GitHub. I will, I'll make sure to put a link in the slides to the demo as well. Yeah, so with that, thank you all for joining and like I said, reach out if you have follow-up questions, slides will be available and hopefully this was worth your time here. So thank you. Thank you so much, Christian for your time today and thank you everyone for joining us. As a reminder, this recording will be on the Linux Foundation's YouTube page later today. We hope you join us for future webinars. Have a wonderful day.


In contemporary open economies with efficient capital markets, if any firm exploits investment opportunities efficiently, the firm's stock market value can be increased substantially. Now how it can happen to understand this? Let's see an example. We have a two company sample in our example with certain information where expected earning per share is $5, dividend payout is 100%. This means that there is no retention or flow back. This means that the B in this particular case is equal to 0. Dividend payout is 100%. Then reinvestment is 0%. The perpetual dividend per share is $5. Rate capitalization rate is 12.5%. So the share price is equal to the simply D1 over K. We have no G. This means that there is no dividend growth rate because there is no reinvestment policy. The resulting value is $40. This $40 says that no growth in the company's value. This means that no change in capital stock and earning power over the time to come. Therefore, there is no growth in the dividend. This particular strategy is termed as a no growth strategy or zero growth strategy because we don't see any growth rate in our example. All of the earnings are paid out as dividends without any retention or flowing back. So in this particular case, dividend cash flows are the simple perpetuity. Now we have the opposite of no growth strategy. This means we have reinvestment plans that we have growth strategy in this particular case. Now assume that one company starts a project with ROI of 15%. This means that the return on investment on this particular project is equal to 15%. This is greater than our cost of capital or K which is 12.5%. Now low dividend payouts that shows that the company will reduce the dividend payouts in order to have some reinvestment plans. So there will be some retention, there will be some flow back. So the dividend payout is low, then the 15% return on investment for the owners. And if full dividend payout is there, then 5% by shareholders on their individual investment. This means that if there is low dividend payout, the company has certain reinvestment plans inside the company, inside that particular project. And that project will earn 15% ROI for the company's shareholders. And if the company pays full earnings at the dividend, shareholders will have no choice but to earn only the 12.5% as the K. Now we have new retention policy by this company which is 60%. This means that dividend payout will be 40%. So the new dividend per share will be equal to $2 per share. Now what will be the effect of this growth strategy on the company's share price? Definitely the stock price of this particular company will go high. Now we have two types of reinvestment plans, low reinvestment plan, low reinvestment rate plan and high reinvestment rate plan. What is the implication of these two? Let's see, under low reinvestment rate plans, there are higher dividends in the initial period and low dividend growth rates. Under higher reinvestment rate plans, there are higher dividends, higher dividend growth rates backed by the higher reinvestment of the earnings. And that reinvestment of earnings enhances the stock value more high. If we see the graphical application of these two reinvestment plan, we can see in our example where the black upward curve shows the higher reinvestment plan and the lower blue upward curve shows the lower reinvestment plan. We see that the dividend per share is higher in the higher reinvestment plan and that is increasing over the lower reinvestment plan by a higher rate. Now how much growth can be there if the company has a certain reinvestment plan? We have an example in continuation of our earlier example. Now we have outstanding shares in number of three million, initial investment of hundred million dollars, return on investment or return on equity of fifteen percent. We have total earnings of fifteen million. So the earnings per share we have five dollars, reinvestment at the rate of sixty percent means we have a nine million profit to be reinvested or plow back in the company. This means that percentage increase in the asset would be equal to fifteen point one five into six million and that is again equal to nine percent. With this nine percent more asset the company will earn more profit by nine percent and it will pay out nine percent dividend more to its shareholders. Now what will be the dividend growth rate which is G? To determine dividend growth rate we need to multiply return on equity with the plowing back ratio which is equal to sixty percent and the return on equity is equal to fifteen percent. So the value of G or the growth rate is equal to nine percent. Now we can determine the stock price of this firm. We have formula of D1 over K minus G, now we have D1 of equal to two dollars, so we have K of twelve point five percent and we have now determined the G that is nine percent. The resulting value is fifty seven point one four dollars. So we see that under no growth strategy the value of the firm stock was equal to forty dollars per share and under growth strategy the value of the firm is equal to fifty seven point one four dollars per share. So with the inception of the growth strategy the per share stock price of this company has increased by seventeen point one four dollars. Present value of growth opportunities, we see that the decreased payouts and the higher flowbacks increases stock price by seventeen point one four dollars as we have earlier seen. This means that the planned reinvestment provide expected return greater than the K. The investment opportunities with positive net present value raise the company's worth. This NPV is also called as the present value of growth opportunities and how to determine present value of growth opportunities we have a formula that is the value of a firm is equal to value of a firm having no growth plus the present value of growth opportunity or PV go. So when we add up these two variables the resulting value comes to the value of the firm. If we put our numeric values in these in this model we see that P naught is equal to E one over K here E one is the earnings per share and K is the capitalization rate plus we will be adding their present value of growth opportunities. We see that our earnings per share are equal to five dollar and our K is equal to twelve point five percent and the present value of growth opportunities we had just computed that is seventeen point four zero dollars. So solving this model it gives us the value of fifteen point fifty seven point one four dollars and again this is the value over the value if the firm has no reinvestment plans or the no growth plan. Now one thing to be noted that the growth is not the investor's desire. The growth raises firm value only in a case where the project's return on investment is greater than the firm's cost of capital. Now to understand this we have another example the sister concern of our recent company in the example has an ROE of twelve point five percent which is equal to K that is twelve point five percent and that K is the cost of capital of the company in our example. So the company's cost of capital is equal to its sister concerns return on equity. So in this in that particular case the present value of growth opportunity is equal to zero because the flowing bag is equal to zero and the growth rate is also equal to zero. Therefore the present value of this company will be computed using the perpetuity phenomena and that is even over K even is five dollar and K is equal to twelve point five percent this is this gives us the value of forty dollars now assume that there is a certain amount of flowing bag of the profit and that is sixty percent. Now to determine G we again need to multiply return on equity of the project with the project's firm's cost of projects flow back ratio and the return on equity of the sister concern is twelve point five percent and its flowing bag ratio is sixty percent. So the growth rate for the sister's concern or the sister company is seven point five percent. Now we can determine the present stock price of this sister company using the constant growth dividend discount model which is D1 over K minus G. Now again D1 is equal to two and K is equal to twelve point five percent whereas in now the company has growth rate of seven point five percent and the resulting figure is forty dollars per share. We again see that if we determine the present value of growth opportunities of this sister company we need to determine the even over K from P naught this means that the value under both the variables is the same that is forty dollars the resulting value is zero. So in that particular case the present value of growth opportunities for this sister concern is equal to zero. The reason is that the ROE of the sister company is equal to its parent company's cost of capital. Now reinvestment just maintains the stock price then there is no increase in the firm value. Why? Because this project's ROI is just equal to the firm's cost of capital that is K. Reinvestment can only be justified if the project's return on investment is greater than the firm's cost of capital. Flowing back is non-beneficial if the present value of growth opportunity is equal to zero this means the firm has no growth strategy or it is equal to a no growth strategy. The implication of no growth strategy is certain that is the mature age firms with considerable cash flows but limited investment opportunities are termed as the cash cost because at this stage with no profitable opportunities the mature firms raised cash flows are available for the shareholders for a certain period of time and that is the reason that without any new investment these cash flows are milking by the shareholders. So the firm is termed as the cash cow for its owners. To understand this we have another example where earning per share is $5 and earnings flowing back ratio is 60% ROE is 10% capital capitalization rate is 15%. The expected dividend per share is $2 and present value of growth opportunities we need to determine. Now for that purpose we need to have the value of G we put the very a value of ROE and B into the computation of G model we have 6% growth rate now with this we can determine the present value of the stock using D1 over K minus G resulting value is 22.22 dollars per share now now we can determine the present value of growth opportunity and if we see that P naught is equal to 1222.22 dollars per share and the value of growth opportunity is equal to 5 divided by 15 the sum of this model is equal to negative 11.10%. So this firm has negative present value of growth opportunities this means the company's ROE is lesser than its cost of capital or K so what is the implication for this negative present value of growth opportunities such firm is subject to the takeover policy by another firm and the buying firm's management will do what it will takeover the firm it will have no retention plane and in this way the firm value will be increased because there will be some perpetuity of the earnings because all of the earnings will be paid out as dividend so the value of the firm will be equal to E1 plus K which is equal to 5 dollars per share over the capitalization rate of 15% and that is the value per share comes to 33 dollars per share so this way the new buyer has increased the value of the firm