I'm as successful and fulfilled as I could possibly be doing what I'm doing now. This is my eighth year with the Disabled American Veterans and I've been a National Service Officer. My name is Jacob Drost. I'm a Marine Corps veteran. I was deployed to fluge Iraq as a sniper. We worked in four man groups. You know, when you work in a group like that, you have a sense of service to those closest to you. And that's one thing that I learned in the Marine Corps to serve others. While I was in the Marine Corps, I sustained a back injury. At the time, I didn't really think too much about it.  Although you might not have a problem now, you might have one 60 years from now. Heck, look at all these guys that are coming back from Vietnam, you know, back in the early 70s. And now we find out that Agent Orange is slowly killing them. That's a DEV is their voice. DEV is our voice. We're here to help you weather the storm. There is somebody out there. There is somebody that can help me. There is somebody that can relate with me. That's what the Disabled American Veterans is all about. I'm a veteran and my victory is being able to serve others.


Bienvenue, tout le monde. C'est difficile de passer après une grande chanson ce matin, mais mon objectif n'est pas éthique, mais technique. Donc, si je vous donne cette histoire aujourd'hui, c'est parce que je crois vraiment en CFFI pour improving la maintenabilité et la naissance robuste de l'extension de Python. Je veux partager avec vous ma connaissance et ma expérience afin de vous convaincre pour vous donner un travail à la CFFI la prochaine fois que vous avez besoin d'écrire une extension Python. Si vous étiez à la quenote Mondique, Armin Renature s'est dit que la CFFI alloguer la Python pour évoluer une étape plus tard. Je suis totalement d'accord avec IMM et cette parole réinforcée cette vision. Donc, qui est-je ? Je suis Jean-Sébastien Bevilacrois. J'écoute 3 softwares tous les jours et je suis un fan de l'écosystème et de la philosophie de OpenSouth. Vous pouvez trouver une grande partie de ma contribution sur GitHub. En plus, je travaille à Linaigra. C'est une compagnie française qui prouve 3 softwares et c'est cette compagnie qui me encourage à donner cette parole aujourd'hui. Si vous avez besoin d'aide pour un 3 softwares, juste contactez-vous. Nous serons heureux d'y aider. D'abord, pourquoi nous avons besoin d'une extension Python ? Je vais vous parler de ma utilisation. Un an plus tard, la nouvelle API Vulkan a été réalisée. Vulkan est une nouvelle API graphique qui va remplacer OpenGL dans le futur. C'est donc un API graphique de haut niveau. Vous pouvez créer 3 games avec ça et c'est cross compatible avec Windows, Linux et Android. En ce moment, j'ai appris OpenGL, développement et Vulkan. J'ai eu l'opportunité d'improver mon knowledge 3D et la knowledge de haut niveau. Bienvenue à vous ! Soudain, avec un C-language, vous pouvez avoir un système d'erreur, comme Segmentation Fold, et avec Python, c'est très difficile de traiter Segmentation Fold. Valgreen Tool peut vous aider, mais c'est toujours un task difficile que vous n'aurez pas appris. Je peux vous montrer. Pour écrire une extension Python dans un C, vous devez utiliser l'application C-Python. Ça vous permet de créer un module et d'adverter des fonctions et des classes. Donc après lire l'application C-Python, j'ai commencé ma extension C. C'était clair et j'ai perdu cette conflite, mais c'est toujours C. Nous devons combattre encore Maloch, Free, comme usual, mais, parce que c'est trop facile, l'application C-Python ajoute la quantité de référence et l'application cumbersome. Je l'ai presque donné plusieurs fois par rapport à l'aimment de Rock. Donc maintenant, nous allons voir une solution existante pour résoudre la complexité de la extension C, mais avant ça, nous allons voir l'application C-Python et l'application C-Python. De tout cas, je vais souvent utiliser l'application C-Python et l'application C-Python pour expliquer clairement ce que je veux dire par ces termes. L'application C-Python veut dire « application programming interface ». Et l'application C-Python veut dire « application binary interface ». L'application C-Python veut dire « humain use ». Si vous appelez une fonction, vous devez savoir le nom de l'application C-Python. Donc, en application C-Python, c'est tout expérimenté dans le code saut. L'application C-Python est très similaire, pensez-vous à l'application C-Python de l'application C-Python. C'est très clair que, quand vous écrivez l'application C-Python, vous utilisez l'application humaine. Puis, quand votre application C-Python est compagnie, l'application C-Python va accéder à l'application C-Python. Peut-être, vous vous inquiétez à l'application C-Python. Mais, accéder à l'application C-Python avec l'application C-Python vous permet d'utiliser un lien dynamiquement à l'époque. Les deux peuvent être utilisés dans un langage interprété comme Python, sans compilation. L'application C-Python peut être intéressant d'utiliser. Vous devez explicitement décrire l'interface binary comme vous le verrez après. Vous devez voir la solution existante pour facilement décrire l'extension Python. Comme je l'ai dit juste avant, vous pouvez le faire avec l'application C-Python mais c'est un task difficile. Le premier est Python. Python, comme vous le savez, je pense, vous utilisez un approche intéressant. Il peut exécuter directement votre code Python et vous pouvez ajouter des éléments de syntaxe de l'interface. C'est très bien mais comme vous pouvez le voir sur la table, quand vous commencez à ajouter un syntaxe de Python votre code Python n'est pas plus Python. Et donc vous perdez la compétition et Python devient une dépendance de l'interface. Vous devez prendre ça en compte avant de l'utiliser. Cette dépendance de l'interface peut être dangereuse. En plus, le premier objectif de Python est d'imprové la performance de la compétition C-Python. Python peut être compilée et TOS supporte l'application API et l'application API mod. Une autre solution bien connue est C-Types. C-Types est un built-in. C'est un très bon point parce que vous pouvez être sûr que C-Types est toujours disponible. Avec C-Types, vous n'avez pas besoin de compilations. Ça fonctionne seulement en l'application API mod. Vous êtes dynamiquement liés à un application de l'interface durant le type. Si vous avez un application de l'interface de la compétition C-Types, vous devez apprendre un nouveau API. Vous devez transmettre votre C-Header à l'application C-Types. Dans cet exemple, je déclare un point strict et reposé la fonction vector de la compétition C-Library. Comme vous pouvez le voir, c'est error-prone et cumbersome. Si vous avez un très gros libraire, ce sera pire et ça pourrait vous donner parce qu'on a misé un API. Une autre bonne partie. 7 ans auparavant, 2 très bonnes personnes Amin Rigo et Mathieu Fijiarski créé CFFI. Vous pouvez savoir ces names depuis qu'ils ont été occupés de PiPi2. Ce n'est pas un morceau. Pour l'information, PiPi is an alternative Python interpreter with aJite. Donc, à l'abord, CFFI a été un alternative to C-Types. It was working only on the API mode. Later, the API mode was added and revolutionised Python extension ecosystem. Before CFFI, to create an API mode extension for Python, you had to use the C-Pyton C-API or Cyton which at the time was working only with C-Pyton. With CFFI, extension are working with C-Pyton 2, 3 and PiPi without changing one line of your code. That's good. Now you understand API and API mode, I can show you how it works with CFFI. But just before that, let's introduce another concept of CFFI. This one is a lot simpler than API and API mode. In the inline mode, everything is set up every time you import your Python code. In the out-of-line mode now, you have a separate step of preparation and possibly compilation that produces a module which your main program can then import. Of course, inline mode is available only for API. Since API mode require compilation. Let's see some examples. These first examples show how to work with API and inline mode. This is the first feature supported by CFFI and it's exactly what C-Type is done for. So we can compare it to C-Types. Like you can see with CFFI, you just pass the C either to C-Def and open your library, that's all. No API to learn. CFFI syntax is clean and intuitive. Like I said, with C-Types, you declare manually the library structure. So I will just show you a small demo of the API mode. On this example, with the open non, I load the entire scene in space which contains printf function, cprintf function, like that. So to let CFFI know this function, I had to give it with C-Def. Then I create a char argument and I can pass it to the printf function. Then I print a string with our char argument. Let's try it. It works. So I print with a cprintf function, not with a Python printf function. Let's make a big difference. So like you can see, it's very simple to use. So CFFI goes one step further with its API mode now. Syntax is still similar, but you can notice a difference. We pass C code to CFFI with the set source function. Then you just ask CFFI to compile your module. Your pattern extension is robust, fast and easy to maintain. With this API mode, you can't have segmentation fault due to a mismatching API. You can if your code is not well-written. Moreover, it adds convenient features, like you can see. You can replace useless value by 3 dots, but I will not go into detail on this feature. So just a simple demo with API mode. I think I have a small problem with my talent. Let's continue. So now the very interesting part. I'm currently building a 3D engine with Python and the new Vulkan Graphic API. Like I said to you, I created a Vulkan wrapper directly in C with the Python C API. But if I'm here today, it's thanks to Armin Rigo. Because when I show him my Vulkan wrapper on ISE, he tells me you could have used CFFI. And then he explained me how to create packages of CFFI. It takes no more to meet a new challenge, write a Vulkan wrapper directly with CFFI. Was I ready to lose months of work? Yes. It's an odd decision because I spent a lot of time of my wrapper in C. But I definitely made the right choice. I'm going to show you why. So, like all engineer, we love statistics. The Vulkan API is huge. Android of functions, Android of strict, Android of constants. More than 5,000 lines of code just for the C header. And there is a XML descriptor. So, wrapping all this API in plain C is just madness. As you can see with these numbers. More than 60,000 lines for the generated C file. But I'm crazy enough to have done it. Whereas with CFFI, it's only simple and clean Python code. To give you an idea about time, it took me one month and a half for the C version. And only two weeks with CFFI. This time is only on my spare time. So, I think it would have taken only one weeks at full time with CFFI. And moreover, when I got an open DSU on GitHub, I can fix it in one hour maximum because it's just Python, clean and simple. The C version was too difficult to maintain. So, how it works. In both cases, I use a generator because the wrapper, like you saw, is very big. So, Kronos Group, the group behind Vulkan, did a very great job with Vulkan. It's open source and you can contribute easily to GitHub to the spec too. It provides an XML file that describes the API. So, my generator takes this XML file as input and generates the Vulkan wrapper as output. By doing a generator, I can update the wrapper in two minutes when a new relation of the API is released. So, basically, here are the steps. First, I load and pass XML definition. Then, I generate the data model. Then, I generate the Python module with Jinja2. Jinja2 is a template engine. I think you know it. It's very famous in the Python community. So, passing is done with XML2Dict package. XML2Dict is a Python module very good to pass an XML file without IDH. So, it transforms your XML into a hierarchical Python dictionary. So, the first step is done. We have a good data model. Is it to pass? So, we can pass it to the Jinja2 template. I focus only on this part because that's where the two modules differs. What you see here is the folder structure of the C extension. Like you can see, there are too much things involved. So, to keep code maintainable, I have to split it up. Line of code is a good indicator because you can see it's very huge, but what is more important is the complexity of the code. So, you can see it's very huge but what is more important is the complexity of the code. Like you can see, it's huge. Moreover, with C code you have to manage memory yourself and this is very, very error prone. Now, the same thing with CFFI. It's very different. Despite of its looks, what you see on screen means a lot. With CFFIs, I did not need to think about architecture. It was very obvious all in one file. One more point for CFFI. But you don't have to trust my words when I say CFFI is better. Let's see it in action and you will understand. Constant is the easier part and both cases are simple. In C, we just use the CPyton C API to add constant to our module but we have to take care about the variable type. With CFFI it's just Python and it's dynamically typed variable. But only with constant, you don't go far away. Next step is to create binding for strict. Here's the difficulty. But in Python, there is no strict concept. So there are classes which is similar. With CPyton you have to handle the new, the Dell in it get for each member and I don't handle the set. So you can't with my C wrapper you can't update an object after it is initialized. You have to use malloc to allocate memory for your object in the new. In Dell you must free your object and in it you have to pass each parameter with CPyton which can be tricky. And in get, you have to convert your C strict to Python object. I can assure you it takes me lot of time to figure out how to properly do it. Code is so long that I can't show you an example on screen. With CFFI now it's 40 line. CFFI handles for us object allocation and deletion. I just use plain Python to handle all strict initialization in a generic way. I repeat to be sure understand this generic new function works for all my strict. With CPyton API the step I showed you must be done for each strict and there are hundreds of strict in the Vulkan API. When you really realize these benefits you just fall in love with CFFI. So what I showed you until here is the API mod. Let's try the fast and robust API mod now. We are going to wrap a C library with the API out of line mod. This mod is robust and fast but you need compilation. I don't know if you know Shatter C. It's a library we are going to wrap. Shatter C is a free software done by Google and gives you the ability to compile GLSL language to spear v binary. GLSL and spear v if you just do some 3D development you may know this language. So I usually to create an extension with API mod I usually create a folder dedicated to CFFI that I name CFFI build and I recommend you to do so to keep a clean separation of concerns. So in this on the screen Shatter C.h contains functions signatures and strict. We just copy past the header provided by Google and CFFI handles it. I don't need to to modify it in this case. Pie Shatter C build folder is used to generate the Python extension. So next we have the pie Shatter C folder containing our wrapper and finally we'll take a look at the setup with a special feature of CFFI. So the definition first. Like you see we first read content of the Shatter C header and pass it to the cdf function that's all for the definition. Sometimes you need to rewrite your header but in that case the header is so clean that I can give it like that to CFFI. So 3 lines and CFFI knows how to handle this library it's very beautiful. So now the building part with this few lines we tell CFFI to compile the cells with statically linked library Shatter C combined and to name the extension Pie Shatter C. Shatter C combined is a static library that we have to compile before running this CFFI part. I don't show you how because it's not directly linked and related to CFFI. You can look on GitHub where you are interested in. Like you can see there is no C code involved we just tell CFFI to open a Python portal to the Shatter C library. Here again it looks like magic. So now we have to use it. Currently our extension is ready but we remain dependent of CFFI. It means that for example if you want to pass a pointer to a function you have to use the CFFI to access this function. But when using your wrapper your users shouldn't need to know CFFI it's just a dependency. So we are going to write a small Python code especially for that. This code is located in Pie Shatter C init and is loaded automatically when you import your module. So this is the init file. So first we load our extension which contains CFFI and lib modules. So the lib modules contains all functions and strict related to our library. And if CFFI is used to interface with our library. Let's examine the compile into spearv function. Remember the Shatter C library allows you to compile GLSL to spearv so this is this function. All functions defined in our extension can be accessed through lib the lib object. If you take a look at the compile line here the third line we can pass pure Python type like int or string and CFFI converts it for us. It's clean and intuitive. A small note with Python 3 string must be byte. Next Shatter C returns a pointer to us we have to tell CFFI to convert it to a byte Python object. Like that I can use it in my program with namepy or something else. So we first get back the pointer and the length but we can't directly copy the data to a byte in Python because byte type is immutable. So we have to copy data into a byte array, a temporary byte array and pass it to the object. You should take a look at the ffi1memove function. It's very similar to the memcopy c function but directly in Python. So here I'm doing memory manipulation directly in Python. Good, that's good CFFI. So in bonus CFFI provides set up tools extension you just add the entry CFFI modules and your extension will be built by set up tools. It's a good way to package your module. So let's see the example. Ok, so we can enjoy the result. Let's play a simple game, very simple just for the demo. So like you will see I'm using the new shiny Vulcan API with Vulcan wrapper and the byte Shatter C wrapper to convert GLSL code and put it inside the graphic card. So this simple game is written fully with Python and make use of the new shiny Vulcan API. So very very simple game. Not impressive but we can do impressive thing now. Before finishing this talk I have to thank two very special persons. Without them this talk will not exist so please welcome the sponsors of CFFI Armory Ringo and Machete Fijalski. I think they did a lot for our Python community and they are very valuable persons because I talked with them yesterday, very nice. And thank you so much for your incredible work. You make the greatness of Python and you deserve our respect. Thank you again. So I hope that like me you can try this talk. If one day you need to use a C library or you need to improve performance of your code, please think about CFFI and thank you for your attention and have a nice day. If you have question. Do we have any questions? Thank you for the talk. Just a quick one. So the demo was Python 2, right? Not 3 because 3 takes bytes not strings. Can you repeat please what was using Python 2, is that correct? With Python 3. 3.6. Because strings are passed as bytes. Yes. Thank you. Is this only interfacing to C or can you interface to C++ as well? So currently I think it's only C but you can, when you have a C++ library because PyShadow C is a C++ library you can do a C either for your C++ library et then you use it with CFFI. Hi, how about interfacing in existing libraries that does its own garbage collection? I will come because I don't understand from it. Good question, maybe I mean can help us because it's very specific. So garbage collection well you need to do it completely manually, it's a story.  There is no automatic garbage collection at the level of CFFI simply. Hi, is there any specific pain with handling callbacks functions, stuff like that? With the recent version of CFFI there is a very good feature about callbacks so you can I handle them. With the Vulkan wrapper back if you know Vulkan IPI I don't know and I handle them I can generate them automatically so you can take a look on my GitHub. If you need callback with CFFI it's a good example. If there are no more questions I can't see any last minute things. Alright, thank you very much for your talk. Let's give a hand to John Sebastian. Thank you.


Hi and welcome to the session. Let us discuss the following question. Question says find the values of the letters in the following and give reasons for the steps involved. Let us now move on to the solution. Now first of all we will rewrite the given puzzle that is AB multiplied by 5 gives CAB. Now clearly you can see we need to find three letters. They are A, B and C. Now clearly you can see one space of 5 multiplied by B is B. Now this is possible only if value of B is equal to 0 or 5. We know that 5 multiplied by 0 is 0 and 5 multiplied by 5 is 25. Now once place of 5 multiplied by 0 is 0 only and once place of 5 multiplied by 5 is 5 itself. Now we can write since once place of 5 multiplied by B is B it must be that B is equal to 0 or B is equal to 5. Now note that unit space of 5 multiplied by A is A itself. So we can write once place of 5 multiplied by A is A. Again this is possible only if value of A is equal to 0 or value of A is equal to 5. Now we know that first digit of a number cannot be 0. Now A is the first digit of the number AB. So A cannot be 0. So correct value of A is 5. Now we can write so A is equal to 5. This is because first digit of a number AB cannot be 0. Now we get the value of A as 5 and possible values of B are 0 and 5. Now let us consider the first possibility that is A is equal to 5 and B is equal to 0. For A is equal to 5 and B equal to 0 we get 50 multiplied by 5 as 250. Here we have solved the given puzzle. Clearly you can see value of B is 0 and value of A is 5. Moreover value of C is 2. Note that another possibility of B equal to 5 fails as for A equal to 5 and B equal to 5 we get 55 multiplied by 5 as 275. Now here these two values of A are not equal to each other. So B is equal to 5 is not the correct value of B. So here we have solved the given puzzle. Required value of A is 5, value of B is 0 and value of C is 2. So this is our required answer. This completes the session. Hope you understood the solution. Take care and bye for now.


Hi and welcome to the session. Let us discuss the following question. Question says, find the general solution of the following differential equation. Given differential equation is, dy upon dx is equal to square root of 4 minus y square, where y is greater than minus 2 and less than 2. Let us now start with the solution. Now we are given with differential equation dy upon dx is equal to square root of 4 minus y square. Now let us name this equation as equation 1. Now separating the variables x and y in equation 1, we get dy upon square root of 4 minus y square is equal to dx. Now integrating both the sides, we get integral of dy upon square root of 4 minus y square is equal to integral of dx. Now this integral can be further written as integral of dy upon square root of square of 2 minus y square. 4 can be written as square of 2 and here we will write is equal to integral of dx. Now using this formula of integration, we get integral of dy upon square root of 2 square minus y square is equal to sin inverse y upon 2. Clearly we can see here x has been replaced by y and a has been replaced by 2. So we get this integral is equal to sin inverse y upon 2. Now we will find integral of 1 with respect to x. You know integral of 1 with respect to x is equal to x only plus c where c is the constant of integration. Now this can be further written as y upon 2 is equal to sin x plus c. We know if sin inverse z is equal to theta then z is equal to sin theta. Here sin inverse y upon 2 is equal to x plus c. So y upon 2 is equal to sin x plus c. Here theta has been replaced by x plus c and z has been replaced by y upon 2. Now multiplying both sides by 2 we get y is equal to 2 sin x plus c. Now this is the required solution for the given differential equation. Now this is our required answer. This completes the session. Hope you understood the solution. Take care and have a nice day.


Good morning everyone, Basel Chapman on this Monday the 5th of June we're looking at the Dow at 11 o'clock Tiger Financial News Network Market Update down 112 at $33,662. We're anticipating that somehow or other there would be some kind of a pullback from the higher Friday because that was like a three-in-one session the higher Friday was $33,805 round number highs amazing how you can get round number highs at that particular level and today we went to $33,804. So this could turn into a peak B most importantly how those three-in-one sessions on Friday where there was like the early morning at 8.30 with the market dropped quite sharply actually very sharply and then rallied and then it rallied for the rest of the day so it was one session then two sessions and the third session was the last hour with just a little bit of a give back at the end of the day giving it kind of a Marabosa candle which really has no wicks but a huge big candle so we're watching that closely the S&P has been just a little bit stronger today than the Dow it's up $692 at $4289 it did make a new recovery high I'm calling this E right now it could be an alternate count but in the meantime QQQ's had a very strong move even with the S&H is pulling back a little bit the QQ's up too at the $356.70 making the $351 to $347 area in the next few days really important support to hold the IWM I didn't do that by mistake I forgot it big pullback down 251 at $179.51 not quite ready for prime time looking at the US bonds US bonds are down 830 seconds and 127 32 seconds so yields are in the higher range they haven't broken out yet crude oil crude oil is up was up sharply now it's only up 91 cents with the Saudis cutting back whenever they cut back actually crude pulls back looking at gold gold was down sharply then it was up and now it's up four points at 1973 holding well the dollar the dollar at this particular point is given back some of the gains is down four ticks yeah I think that what we're looking at here is a market that says we're waiting for certain areas like the financials like the XLF to really garner strength and hold that strength for about four or five sessions say yep got a rotation now in the sectors that were very weak as a semi-conductors take a bit of a breather they're down 1.53 have a great day stay tuned for great programming here at TFNN and Basel chairman signing off dahi's down 1481


Hi everyone, Joe for jaspyscasebreaks.com with 2019 Panini Contenders Optic Football 10 box Pick your team number 16. Now this this break comes from a loose case, I think Where did this come from? Do you guys remember? I wrote next time on here 10 box enter pick your team 16 2019 Panini Contenders Optic Football I think in the description it does say this is just a loose case not from a fresh master Not sure but I this must have come from somewhere Would have written a number on it. I don't know what happened either way. It's here Let's do it. Oh, yeah, AJ Anderson. I think I think it's about time for another for some more jaspys hit packs, right? I think Nick said we're ex we've been working on a on the next edition of Our next big hit express release We've been working on that for a little while That'll be happening. All right, we'll do we'll do a randomizer for this since there's serial number We're gonna do separate randos for that. There's Dalvin cook to 99. All right behind Kenny G is Jacobi Myers that'll go to the Patriots Matthew G and then behind Kenny G is David Montgomery that is a on-card auto There's one per box one's usually a sticker and one's usually an on-card that goes to Reynaldo Galvin and Da Bears All-Cards ship to this will do a randomizer Next box Darius Leonard a supernova die-cut Christian McCaffrey Nice, I think those fall one per case and a Joe Flacco Broncos edition going to Jeremy Tillman Supernova Christian McCaffrey going to Ryan Redmond and the Panthers must be a case hit at Oliver rookie ticket auto bills Jeff Mason Daniel Jones to 149 Wow That goes to Ryan Redmond and the New York football Giants who's having a hell of a break The last two breaks the previous video Did really well and then this one he's like all I'm doing is looking for Daniel Jones and you get one on-card Daniel Jones and That's numbered 55 out of 149 Next box Matt Gomes. What up? It looks like a redempt on the bottom There's old Albecom Jr. Another randomizer here between these two teams. That's out of 99 And there's Aaron Rodgers to 99. We got Karen Higdon to 27 I like that the green Pulsar they added for this year's set.  What I don't know what's going on in in your your neck of the woods sure it's not too different from a lot of places All right next what? Vaughn Miller got a couple Redskins right here Lynn Collins Adrian Peterson to one 65 and Baker Mayfield to 199 you guys are hanging there good good to hear There's Gardner Minshew asking you shall receive Justin Cahill. I guess it's this kind of break today any other requests Justin Cahill With the Gardner Minshew the second not numbered but still nice. There's starting QB QB one There's Damian Harris 135 to 149 That will be for the Patriots Matthew G and there is Matt Ryan Next box You're welcome Justin. That was last spot mojo, too So they were literally the last team taken nobody wanted the Minshew Nobody wanted them until the very very end and then you snagged him you're rewarded. There's Quincy Williams There's a gold randomizer here. That one's out of ten eight out of ten Darius Shepard got Julian Love to 75 for Ryan and the New York football Giants There you go. He got his Daniel Jones. Everything's just gravy now behind Matt Ryan is Five out of ten all-time contenders Brian Dawkins Nice serenity with the Eagles nice Nice low number two out of ten right next one. Is there a plate there? I see a plate I think that's an auto in the Indian in that first auto spot Oh Eli Manning winning ticket to 165 Adrian Peterson to 99 a redemption on the bottom the plate is Jim McMahon For da bears Rinaldo Galvin With the Chicago Bears and Matt Nagy's talking right now Matt Nagy wishes he had a Jim McMahon. All right, and Marquis Brown Notorious non-signer, but that's another one for serenity. She has the Ravens, too Nice Hollywood Brown though. Oh Is that a it is a one-of-one Kevin reminding me of the train whistle Losing my mind Rinaldo out of fives and under all aboard the big hit express What's happening Kevin losing my mind? Brain is fried I guess Aaron Rodgers to 165 Julio Jones to 50 There's Byron Murphy 7 out of 27 green pulsar autograph for Brian Croft and the Cardinals And they've got Darius Layton rookie ticket autograph right on the card for Ryan and the Giants Levy on bell Peyton Manning to 75 Reggie White to 99 Reggie White Reggie White Zach Allen 54 out of 75 For Brian and the Cardinals You think Mitchell Trebis he's gonna rise up and we got Tony Pollard On-card autograph for the Cowboys Joe Clanton on the board Not sure if I'm sold on Mitchell Trebisky. I mean, maybe if he had time to marinate a little bit Maybe if he was picked in a later round, I feel like there'd be a lot less pressure on him but John Hillman those are not numbered Otis Anderson is numbered to 165 Cortland Sutton to 99 Broncos Giants Julian Love another one for Ryan Redmond nice another nice break for you, man Two in a row. What's going on here? And Josh Jacob. There's my boy. Josh Jacobs for George. George Dang Nice on-card auto Josh Jacobs I hope he can can keep thing no sophomore slump for him. I don't want any of that That's a little scratch on the top loader right there. No worries, Ryan I appreciate you getting in can't win if you don't play All right last couple autographs and then a few randomizers boys and girls trendsetter Who's alliance fan by the way saying that the Lions are gonna win the division 6 out of 75 Alvin Camara not at 199 Derek Henry Um, did I miss the news that they fired uh, Matt Patricia and that Matthew Savard's all of a sudden 100 healthy his back's not ailing him Rashaun Gary Green Bay Packers Vinnie the Packers there you go Vinnie on the board Appreciate you getting in and the last one here is Nikhil Harry 117 out of 149 Barry Sanders coming back to the Lions Calvin Johnson coming out of retirement All right, there's Aaron Rodgers right there as well. There you have it Randomizer time. Let's do That that and that And we'll use the same dice roll for those three new dice And a few I need one more a few lists So the first one will be Rams Steelers Second will be Niners Titans And the out of 10 the low numbered one would be Cardinals and Redskins Let's roll it and randomize it Stephen punk Who's a bears fan is pretty skeptical trendsetter Logan who's a Packers fan is also skeptical of that your NFC north rival six and a five eleven times for each list team on top gets it one two three four five six seven eight nine ten eleven Pittsburgh with that one Steelers Michael Gulucci seal curtain with the Steelers A little consolation prize at the end for you there I don't like a lot of rammed on org. I don't like 11 times one not this late at night two three And 11 the final time Tennessee on top after 11 that'll go to Zach Wilson There you go Zach That'll go to you and then we've got the final one here once again 11 times team on top after 11 one two and 11 the final time Washington with that one Jeremy Tillman with the Redskins little consolation prize for you at the end too And there you go boys and girls That's a nice break of 2019 Panini contenders optic football in the books pick your team 16 from jaskiescasebreaks.com I'm Joe And I'll see you next time


signal oil program that whistle is your signal for the signal oil program the whistler and the whistler and I know many things for I walk by night I know many strange tales hidden in the hearts of men and women who have stepped into the shadow yeah I know the nameless terrors of which they dare not speak yes friends it's time for the signal oil program the whistler rated by independent research the most popular West Coast program in gasoline you know it takes extra quality to go farther and signal is the famous go farther gasoline so look for the signal circle sign in yellow and black that identifies signal service stations from Canada to Mexico and now the whistler strange story murder on Rourke Island on Rourke Island had a curious beginning there was no hatred in Keith Brandon's mind no anger no malice in the beginning there was only relief and freedom and love for a girl named Kathy Dunn as each small private club he could see her across the floor standing near the piano the blue light working magic on the white satin of her evening he smiled as he walked towards me I'm waiting but you're glad to see me please Keith not now kind of welcome is this we settled everything a year ago now if you don't mind wait a minute let me talk to you there's nothing to talk about Kathy they're all watching it what you're dressing please Keith I tell you I've got to talk to you that's all there is to it if you want it in the middle of the floor it's all right now you've got something to tell me I suppose your father's changed his mind put the seal of approval on nightclub singers haven't changed a bit have you old friendly approach well let me tell you something first you had a choice to make between me and your father and you made it as far as I'm concerned it stands pretty bitter I think I've a right to be Kathy I told you then that I loved you I always would I'm sure until father put his half million dollar estate out against me it was different after that wasn't me or the money didn't take you long to decide go right ahead father died last night that's why I'm here you're free now I want you Kathy I love you I wish I could be Kathy please please keep let me you know you love me Kathy tell me I do keep darling I do it was worth waiting for after all wasn't it key the dominating smothering influence of your father is insistence that you live under his roof and eat at his table that you jump every time he cracked the five hundred thousand dollar whip he held over your head for that long terrible year after you made your decision to see it through to the end but it was worth it and they're both yours now Kathy and the money or rather the money in Kathy because you know in your heart that the money will always come first there's a wonderful feeling of freedom inside you as you drive up the treeline drive of your uncle Matt's estate the next morning it seems there was something about the will Matt oh Keith my boy I'm glad you're on time this is Mr. Bradbury your father's lawyer executor of the estate and you do sit down Keith thanks Mr. Bradbury and I have been talking over your father's will doesn't seem a little soon 24 hours that's the way he wanted it 24 hours what do you mean he was part of his arrangement with me that the provisions of the will go into effect 24 hours after his death the probate will come later of course that's why I called you in this morning you see well no I didn't say anything to me about it there are a lot of things he didn't talk to you about Keith what for instance is a state for one thing oh wait a minute you're not telling me that was a change no no change he promised me that when he died I relax Keith his state is yours all right then as we get it over with there must be some papers to sign just a minute your state is yours Keith but it's your father's request that I hold it in trust for you what kind of double talk is that take it easy let me finish Keith according to the will I am to hold the estate in trust but there'll be monthly allotments to you out of the income and you will be eligible to receive them as long as as long as you live with me under this roof he can't do this to me he's dead that money's mine he tortured me kept me prisoner in this house for years he can't do it anymore he's a hairy man he can't reach up out of his grave I don't care I don't care sorry I had to slap you Keith I just had to do it sit down come on sit down I said whether you're aware of it or not your father was very fond of you he felt you still need someone to look out for you I agree with him I'm of age didn't care myself you're a highly emotional young man Keith not as stable as you might be what do you mean not stable you did attempt suicide once over a girl what I was a kid in high school well maybe so I remember it seemed pretty important to your father at the time so I do a crazy thing in high school and he decides I need a guardian for the rest of my life why are you trying to make excuses for a mat you know what's behind it all as well as I do with a bitter selfish old man who had to have things his own way even after he was dead this isn't getting us anywhere Keith let's get the things settled nothing I can do then tell him Bradbury we'll take effect tonight mr. Brandon according to its terms you must live with your uncle six days out of every week suppose I refuse the estate goes to the public hospital fund see how long does this go on as long as your uncle is alive after that I guess you're on your own Bradbury there's nothing in there about marriage is there what do you mean just a minute Matt Bradbury supposing I decide to get married and bring my bride here to live would I be fulfilling the terms of the will you're not considering marriage key answer my question Mr. Bradbury wild no there's nothing that would prevent it great how'd you like to have another steady border Uncle Matt who is it Kathy Don you broke up with her a year ago I saw last night I'm going to be married when tomorrow maybe any objections you you know how your father fell I don't think that makes any difference now nice of the old boy to leave me a loophole suppose I refuse to allow her to come here what about that Mr. Bradbury I'm afraid you can't not he has a legal right to marry and live with his wife if you refuse to let her come here you're preventing him from complying with the terms of the will I see Uncle Matt you better set an extra place for dinner I'm bringing Kathy with me well you're feeling a little better as you drive away from the house toward Kathy's apartment on the other side of town you're on top now for the first time since the whole maddening thing started 15 months ago when your father suddenly decided he wanted you with him for the rest of his life from then on nothing made sense there were no explanations no reasons for anything he knew when the cards were down you do anything for that half million he was right wasn't he you walk up to Kathy's doorway a half hour later hoping she'll understand hello Keith how are you darling all right I guess something wrong no I guess I just talked with Uncle Matt it's not quite the way I told you last night he was appointed trustee of the estate and I'm gonna have to live at the seat is I know I've just talked to your uncle on the phone what did he call you about to tell me about the will he had no right to call you I'm glad he did you you belong there with him Keith what do you mean please don't make it hard for me dear I've decided not to marry wait a minute he didn't tell you everything we're going to be married you're coming there with me to live there's no way he can stop but don't you see I love your Kathy I want you there with me please Keith I I've made up my mind I'm not gonna change it that's all what else did he say tell me Kathy nothing nothing what major change then you wanted to marry me last night what made you change your mind I was something else you told you something else I'm vicious on the you'd better go now and Kathy yes Keith don't don't tell anyone what I just said well of course not I'm sorry I said that said I kill him with the prologue of murder on Rourke Island the signal oil company brings you another strange tale by the whistler just think by the time next week's whistler rolls around it will be 1947 and your car will be another year older more than ever it's going to need the more conscientious service that cars get at dealer owned signal service stations and when I say more conscientious let me show you what I mean when signal dealers lubricate your car for instance they don't take chances on memory no sir instead they check against signals factory recommended lubrication chart which shows every lubrication point on your car and they use nine specialized signal oils and greases so each part will have the exact type of protection it needs for long trouble-free service but do they stop there no sir just to make doubly sure not a single part has been overlooked they check each point again which is why it's called signal double check lubrication now that's the kind of lube service you want when today's aging cars have the last until there are enough new ones to go around and that's the kind of lubrication you get from your friendly dealer owned signal service station and now back to the whistler it came to a climax that morning and Kathy's apartment all the hatred the frustration the rage against the idiotic demands of your father well up inside you and exploded in a single remark I said I kill him and though you don't know it the elements are all there and a pattern is beginning to take shape for the murder on Roark Island your life in prison is beginning all over again with uncle Matt is the jailer instead of your father six days out of every seven keys you're free to come and go as you wish but six days out of every seven you must live with uncle Matt the cedar thanks I thought you'd like this room best nice view of Lake Washington out of the window here great hardly contain myself we want you to be happy here that in the will to what they have to be happy you don't have to stay here Keith you're of age you can leave anytime you want let's not get into that again selling my soul for a half a million dollars and I know it you leave me alone of course we'll have dinner at six don't worry and so it begins again Keith and during the weeks that follow your life falls into a rigid pattern breakfast at eight dinner at six evenings in the library with uncle Matt pouring over his stamp collection and you know it will last as long as he lives that only his death can bring you at last to the thing you've suffered for before long you realize the will to murder is somewhere inside you but it's not until a night in early spring that it finally crystallizes into a plan in many ways it was like all the other nights you and uncle Matt in the library the dull novel stamp collection half penny black I wasn't such a type for that just saying if I wasn't such a type what I'd buy that half penny black stamp dealer in town's got a fine used copy but he wants $40 for kind of quiet tonight wouldn't be surprised if we had little rain when the winds from the southwest rain sure follow do I always say that every night at 855 never miss on the band I got a headache any aspirin upstairs ought to be some of the medicine cabinet oh thanks I'll take a look but there isn't any aspirin in your medicine chest so you try the one in uncle Matt's bathroom find the aspirin on the lower shelf start to close the cabinet door when your eye lights on a bottle a prescription bottle half hidden by the others your hand shakes as you pick it up examine it closely and it's at that precise moment that all the elements come together to form the plan for a murder three months in the future on a tiny tree covered dot in the middle of Puget Sound called Roark Island you are not much interested in your breakfast the next these darn strikes wonder where it'll all end up excuse me uncle Matt some matter aren't you going to finish your breakfast I'm not very hungry and that I'd run down to the library do you mind the library yeah I heard about a book the other day and I sure go ahead just bold me over I guess the public library is the last place in the world I'd expect to find you yes I know I haven't a card but I don't want to take the book out I just want to look at it here what was the title again Materia Medica it's a textbook on drugs that's a very interesting question I don't mean to be stupid doctor but not at all the drug is habit-forming more than that to a victim of certain forms of heart disease it's like eating or breathing it's the difference between life and death how often do they take it once a day usually if they start failure of course how soon two days possibly more it depends thanks very much doctor always glad to help out a detective story writer you know I'm quite a mystery fan myself 825 and that's our number I just wanted to double check I probably filled that prescription myself what does the card say first filled February 14th dr. Talbot for patient Matthew Brandon say and so except for the name of the prescription of course extract of digit others hello Uncle Matt well you must have done a lot of reading been gone all day I had a few other things to do oh yeah you know what today is Saturday April 16th big day isn't it Keith how did you know never forget a birthday an envelope careful I open that yes and I see what it's empty isn't it look down on the corner there oh a half penny black right thank you been wanting okay I I don't want to say chief let me say it will you I took a long walk today Uncle Matt I did a lot of thinking about you and me I've been awfully wrong I want things to be different now I really believe you mean that chief I do don't worry boy I always thought you had a great heart things will be different now yes key things will be different now and you didn't lie to him you did take a walk and you did do a lot of thinking about how you were going to kill him this summer on Roark Island murder him with a perfect ingenious plan that had no possible chance of going wrong the first thing of course is to get his confidence and his spring changes into summer you develop an interest in his stamp collection go for walks with him along the lake spend evenings together at the theater and finally on the day in early June you decide he's ready just look at the lake out there you know as long as I've lived here I never tire of it I don't think I could ever live away from water you know it makes me think of the summers you and father and I used to spend on Roark Island I haven't been there for years we still own it don't we yeah the lodges still live worth the Dory let's go huh just you and I we could do a little fishing loaf around do you really want to of course I do look you need to change to we could hire a boat to take us out there bring bring food with us and spend a week or 10 days George what about it it's a deal three days later as you stand on the jetty on Roark Island and watch the boat moving out into the sound on its way back to Seattle you realize that there's no way you can fail now by the time the boat returns uncle Matt will be dead of heart failure and at long last the legacy will be yours the doctor told you he couldn't last two days without digital 9 should make it certain after dinner it seems an eternity before Matt yawns and finally suggests going to bed you lie there tense until almost midnight he's out in the sleep now breathing heavily as you quietly get out of bed and slip on your clothes first the small boat moored down at the jetty I don't want to do it you cut it loose stand there a minute watching it drift out with the tide then you hurry back to the house on the kitchen table is the portable radio telephone Matt brought along as a safety measure you take out the rectifier to walk quietly to the rear of the house where he can't hear the most important thing of all is the bottle of digitalis you'd seen him slip into his luggage when he thought you weren't looking you carefully feel through the suitcase at the foot of his bed take it out make certain it's all he has and then walk to the sink you empty it you fill it with water from the faucet five minutes later it's back in place in the suitcase there's nothing to do now but wait how'd you like your eggs Keith right got the table set where the plates they're on the stove getting warm I smell that boy nothing like the smell of bacon and eggs is there yeah let me help you dish up take care of the coffee will you you know Keith yeah they're going to have a great time together from now on aren't we nothing let's sit on the breakfast the whistler will return in just a moment with a strange ending of tonight's story tomorrow being New Year's Eve most programs tonight are wishing you happy new year of course we want to do the same but just wishing doesn't always make a thing come true that's why the signal oil organization has asked me to go a step farther tonight and leave the thought with you which if it saves just one life will be well worth this moment of your time New Year's Eve is one of the most hazardous nights of the year for drivers and pedestrians many people are at the wheel who shouldn't be cars are old driving conditions are not good if you don't absolutely have to go out don't but if you must drive take it easy keep the speed down keep a sharp eye on other drivers and pedestrians I know these are somber words for an occasion like this but if all you friends of the whistler will just remember them tomorrow night it'll go a long way toward keeping some unnecessary auto accident from Marring the happy new year which we of the signal organization hope will be yours and now back to the whistler well it's a little unusual to be sitting down to breakfast with a man you know is going to die in a day or two yes it's all done now isn't it your only chance of getting away from Roark Island vanished when you cut the boater drift down at the dock and smash the rectifier tube of the radio telephone Uncle Matt brought along for safety reasons yes the murder has been committed already hasn't it it happened the moment you emptied his bottle of digitalis down the sink and refilled it with plain water you might last 48 hours but it's a good nine days until the boat comes back from the mainland you know it'll happen long before they're halfway through breakfast you look up from your plate to see him watching you a quiet smile on his face your father never would have believed you could eat like that you know Keith you're a different boy now than the one he knew a good or bad it's wonderful I'm going to do something I promised him I'd never do I won't be with you forever I think you can take it now believe me he was afraid you'd kill yourself if you ever found out about it that's why he was so unreasonable about your staying home why you refuse to let you marry that's why he wanted me to take care of you what are you see this did you tell us I'm going to let you take care of it now Matt you'd better develop a lot of respect for it you've been getting it secretly in your coffee for two years now it's the only thing in the world that's keeping you alive let that whistle be your signal for the signal oil program the whistler each Monday at 9 brought to you by the signal oil company who have asked me to remind you to get the most driving pleasure in 1947 drive at sensible speeds be courteous and obey traffic regulations you'll go farther and have a happier new year featured in tonight's story were David Ellis and Charles Seal whistler was produced by George W. Allen with story by Harold Swanton music by Wilbur hatch and was transmitted to our troops overseas by the armed forces radio service this is Marvin Miller speaking for the signal oil company this is CBS the Columbia Broadcasting System


Yeah, yeah, it was nice that we built a big lead in the fifth set. I didn't have to sweat too much, but they really made me sweat in sets three and four. But that's volleyball. I mean, it's never easy, and that's a really good team. They were ranked nationally for about half the season. And yeah, we're up 2-0, and then laid back a little bit. But they actually took it to us in those sets three and four. So it was nice that we bounced back and fit. It's a classic kind of thing. You try to get the team to play well, even though you're really far behind in that fourth set, running into the fifth. I think that's a really good observation. We kind of picked it up where we left off in the fourth set. Even though we lost, we got all momentum back. I think the key was that we got back to playing like we did in the first two sets.  I'm trying to tell them to teach them to always aim at the court and never be aiming for out of bounds. It's not that they do it on purpose, but you always should be aiming for the court.  And what else? I'm trying to remember, I think our passing is steady down in the fifth set. We passed while we blocked well. Lyndon had the best block of the season on there. He's a super player of Peterson. He just happened to surround the ball, and there's a lot of talk going on through the net that kind of goes over my head, but I heard it in the locker room. They were all happy that they won because of all that talking through the net and stuff.


This is going to be a walkthrough of an auto transformer, a step-down auto transformer. What we have here, we have a 575 volts source, and we have a load connected across 35% of the windings. Which means that we are going to be using 35% of the voltage of 575 volts. Our load, our 12-ohm load, will see 201.25 volts. And all I did for that was to take 575 and multiply it by 35%, or 0.35. The next step is, let's get the current going through our load. We take, using Ohm's law, we use 201.25 volts divided by 12 ohms, and we get 16.8 amps. That's just by taking 201.25 volts divided by 12 ohms to get our 16.8 amps. Now we're going to try to figure out what our primary current is, which is the current over here, and then we're going to be left with trying to figure out what the current is across our common winding. Let's figure out the current over here first. What we're going to do, the easiest way that I know to do this, is to figure out what your VA, the power being used at this load is. Because remember with transformers, whatever the VA at the load is, has to be the VA at the source as well. VA in is equal to VA out. I'm going to take the voltage, 201.25 volts, and multiply it by 16.8 amps, and I'm going to get 3,381 watts at my load. Like I just said, whatever this watts is here, it's got to be the same over here, which will give us 3,381 watts on the primary side. Then to get our primary current, all we have to do is take 3,381 and divide it by 575 volts to get a current of 5.88 amps right there. Now if we have 5.88 amps on that side, and we have 16.8 amps on that side, the only thing we have left to figure out now is the current going across the winding from this winding right here. The current going through this part of the winding is in series with this source, so it's going to be the 5.88 amps. Now what I'm going to do is I'm going to move this current down to that point there. I'm going to move this current to this point here. Now I have 5.88 amps at that point. I have 16.8 amps at that point. I have this little node here. If I have 5.88 amps suddenly turning it to 16.8 amps, it has to be getting current from somewhere. That current's coming down here and adding to the 5.88 amps to give me the 16.8 amps. So all I have to do to figure out my common winding is to take 6.8 minus 5.88 and I get a current of 10.92 amps across the common winding. And that's all you have to do for a step-down auto transformer. They're not that difficult. Again, just a quick walk-through.  You take this voltage divided by the ohms of the load to get the current, which is 16.8 amps, through the load. Then I can take this voltage times this current to get this power. VAN is equal to VA out, so we can take that power and move it over to here. We take this power, which is the same, divided by that voltage to get that current. And then we take this current and that current and we subtract them from each other to get the current across the common winding. It's very similar in a step-up transformer, which will be the next video. See you there.


Thank you for being here. Thanks to the organizers for managing this room. I'm glad you did the work. I'm talking about authorized entities directory. Authorized entities is the main objective. The name fits the objectives quite well. It's me, I'm doing stuff. So what are the main objectives? This catalog is what you can read about every identity and access management. So everybody, every product, website, you can read those objectives. So no difference. But I want to clarify why things are designed like they are. A couple of years ago, actually six years ago, I just set up a small, LDA-based directory service for a customer in a highly secure, separate data center environment. And it was really deliberately separated from the rest of their world because they had to achieve more strict legal requirements. So they have to match more strict requirements. And then the IT security department guys came and they wrote a report, oh, everything's fine, but there are some low-hanging fruits you should also try to solve. And one of these low-hanging fruits was user accounts should only be added to systems where they have to be added. And this was a very simple open LDA-based directory service. So like with most installation of this kind, every system could see every user and every group.  But this particular customer is running data centers with thousands of machines. And then they said, oh, Michael, LDA user-based management, you can do that and we need that for the rest of the data center also. But the rest of the data center, they have very different roles like developers accessing test machines which are spawned for only a few weeks or something and they have highly secured systems where they do credit card processing or where the account passwords are stored of their customers' accounts. And so I was scratching my head how to accommodate this wide range of different systems with a single directory service. And then, okay, then you remember, okay, this standard set of requirements. Need to know principle, least privilege principle, separation of duties. If you look at all these different roles and people acting in a very agile manner, they are very much into DevOps and you have around, they have 300 or 400 users acting like this, very agile in various teams. Then I scratch my head saying, okay, I have to implement a delegation model and that's not really new, you know, but I have to delegate a delegation module where they can act in a very agile manner. And I didn't want to implement a delegation model based, for example, on organizational structure or something like this because this doesn't work. It's also always a project structure and they have temporary structures, temporary projects, you know, so things are changing all the time. So you have to achieve, to provide a solution for that. Then, of course, if everything is changing all the time, you know, you might want to look afterwards, oh, why did somebody did that? And you have to check whether people are complying to the security requirements the IT security department wrote down. So this led to some paradigms, some technical requirements, some more concrete requirements. I stripped this down a lot, some more, you know, you can see on the front page of the project, but what really is important to me is that things should not be right, access control should not be assigned implicitly. It should be always done by somebody knowing what he's doing. So this is very important, you know, so not by somebody, some team lead in an organizational structure saying, yeah, my employee has to do this and he doesn't know what he's acknowledging, you know, so always have people in charge to really know what they are doing.  So there's no anonymous access at all and everything, everything, user accounts and machines have to individually be authenticated. And I also, I really hate super mighty proxy roads. We heard in the last talk about loosely coupled systems, syncing data and for this data synchronization, it's good to have this data synchronization, but the requirement then is that you have super mighty credentials for the target system to be synced, you know, so you have system accounts which have domain administrator rights in active directory or something like this, you know, and I try to avoid this as much as possible. It's not always possible, but I try to avoid it. And also, this system strictly distinguished between persons and their multiple accounts. So a person is not an account, a person will never get a password, but the accounts which are connected to these persons will get a password. And you should avoid to directly derive access rights from the organizational structure because organizational structure is going to change nearly every four or five times a year, you know, so you cannot, you cannot rely on that. One of my customers, he said, he made a joke, a project lead, he made a joke, he said, oh, I take our department name as password because nobody can memorize them and they are changing as often as I have to change my password according to the password policy. Yes, okay, so role separation acting on different systems is really implemented by different user accounts which is somewhat inconvenient for the users, of course, for the human beings, but this is the only chance to implement different security policies for different roles. So, and of course, I mean, this is also trivial, you have to provide persistent IDs which never change over the lifetime, which never change, not only over the lifetime of something which never change and which are never going to be reused. Yeah, this is also trivial, but I always have to tell this to my customers, you know, so strange enough. So, there's a pretty straightforward role model and the super high admins are the AI admins, they can manage the idea system itself, that's their task. There are also the system administrator managing the system but also the initial data, especially they maintain zones and zones are just areas of delegated administration. They set up zones and delegate them to other so-called zone admins. The zone admins are the guys who are really doing the daily data maintenance work. Those, the zone admins are the most important administrative role for the daily work because they are supposed to know about the systems. They are supposed to know, oh, if I put a user in this group, it has this impact on these systems. Yeah, and this is not trivial because in reality, it's often like this, that somebody says, ah, I have to access this system and then somebody says, yeah, you have to ask this guy to put you in some weird group and nobody knows what this group is really all about and what impact a group membership has to all the systems. And then, at one time, you disable the group and then nothing works anymore. So to emphasize it, a zone is an area of delegation but you have to chop up your environment, your infrastructure in small manageable areas and assign the zone admin role to people who really know what's in this bucket.  They put the semantics inside. Okay, and of course, there are companion auditors roles which can read at the global level or at the zone level. So there's another rule which is called setup admin and setup admin is a role somebody who is allowed to set up and administer a service or a host within a cluster, mainly, you know, within a service group. We come to that later.  So, and normal users, they can just read their own entries and see member of groups where there are also members of. Okay, so this is the system architecture. Mainly, we have an admin workstation here. We have custom tools, the official API of maintaining data in IEDA is held up because I didn't want to invent another web API stuff with security controls in place. So I have everything there and the access control here in the back end is implementing all the restrictions. So all the access rights and all the constraints. So therefore, I could also use my very generic web UI as an administrative interface for adding users, maintaining groups, things like that, all this data. And there's a special password set, service application where users can anonymously trigger a password reset and there's a two-step process also getting the zone admin involved to reset the password. So, and then guys working here are using the usual SSH client to administrate their Linux servers, Unix servers, whatever. You know, this is just an example of SSD and ZoodoElder being used. And those integrated systems, SSH servers with shell access, database servers or web applications or something, they all go to read-only consumer replicas. So there's a two-tire architecture and this red line is very important to me because the systems in your data center do not access the writable provider. So there's an additional boundary, security boundary so that if something goes wrong here you cannot change data here. LDAP is a hierarchical database, you know. So there's a directory information tree. This is not as important as it looks like because the access control is not based on hierarchical data. So this hierarchy is just for, yeah, because people like it. I could have flattened this completely, but people tend to, yeah, if they have a zone they like to have a tree, a sub-tree with this zone. That's the whole point of it. There's no technical requirement for this. It's just like putting files in a folder. So at the first level there are the zones. There are some special zones with completely public data. All authenticated users can read this. There's a zone for administrating the system itself. Usually there's also kind of a zone where you put organizational data in there, person objects and departments or locations also. So, and then you have any arbitrary zone. And this zone has two special, this is since hard coded, but there are groups defined which act as zone admins and groups which act as zone auditors. Again, also this relationship does not have to be hierarchical. So, and then you have user objects, you have group objects, you have service groups and you have Zoodoo's rules. And then within service groups you have hosts and server services. You can also have tool users which are also services. And because I wanted to point out system management you can even tie the network configuration to the host object. So, this is the complete entity relationship diagram. As you can see, you can see nothing. So, I have a more friendly version of it. And this is the core of the authorization. And so, I usually start here. Service groups are really just clustered services. I could have also caused this service because it's just it models a clustered service. And what you basically are doing is you group your service instances, maybe a cluster of a certain web application or a bunch of hosts which have the same security policy. You group them and then you assign the certain roles, the certain access rights by setting links to groups. And those links also affect the open LDAP access control rules. So, for example, setting the link IA visible groups to a group makes this group object and the members therein visible to all the instances here. So, these instances are authenticating and they are then authorized by the open LDAP ACLs. They follow this link. They work their way through these links. And so, this service or a host gets authorized to seek groups and members. So, it's a little bit different than what other implementations are doing, not the system is filtering which uses groups. It grabs from the directory. The directory has a rough filtering by setting this visible relationship. And this also applies to, for example, the visibility of Zudo's rules. And there are other links. For example, this link is pointing to groups just to accommodate what Zudo LDAP or Zudo over SSSD is requiring. Okay. Yeah, and of course you have network devices. And, okay, and the setup admins, they are allowed to add those entries and those entries. And they are allowed to assign user passwords to the host and the services. What are network devices for? Actually, okay, okay. Actually, I come to that later if the time permits. Just a few notes on client integration. Clients are deliberately kept dumb. They have just a search base and they have their own credentials and nothing else, no special filters or something like this. Filtering is all done within the Open LDAP server. And regarding the schema, I try to accommodate everything which is legacy out there, especially I have a hybrid group schema which allows to use the same, very same group entry with the member attribute and the member UID attribute. No matter what you configure in your SSSD, for example, it just works. So, and I have support for host maps, you know, and this is what the network device entries are for because network device entries, I come to that later. And what I deliberately do not support is net groups because I find net groups to be really, really bad. I mean, we agreed already on the mailing list about that. So, net groups must die, die, die. So, one application, there was another requirement so that admins do not have direct SSH access to servers anymore. And you can achieve that with running the SSH client with a proxy command establishing a connection to a target system. And this target system, it might have a completely different user management. It might be a weird appliance like hardware security modules or NTP appliances which you cannot directly integrate with LDAP servers. They have strange system accounts, you know, but you don't want everybody to get to this port directly. So, what you basically are doing is in the directory, you add instances for those legacy systems and you pretend that this system is directly integrated with the directory, but it's not. So, you have to, for enforcing this login relationship, which user ID can log into which target, we implemented SSH proxy. In the normal case, that's the usual stuff of doing the SSH login with PAM and SS data and things like that. But only the gateway admins can get really a shell. All others are forced to only start a certain command where they can say, oh, I need a TCP relay to this target. And this proxy command is basically an SSH connection to this gateway. And here you can see this is the user name in the directory. So, this SSH daemon knows this user. And so, this wrapper script asks whether this user is authorized to access this SSH target. So, you have the very same data in your authorization data in your directory, which applies to enforcing the login write for systems which are not even integrated with your directory. Of course, this requires that you restrict SSH access to the gateway. Any questions? How many minutes? So, we're really in a hurry. Two factor authentication is also implemented. It's implemented in such a way that the OTPs, the seeds are really in token entries in the directory. And there's a two level proxy mechanism for validating the typed in user password and the OTP. If somebody is interested, I can demonstrate that later in the coffee corner or something. But the same architecture. And this is a process for enrolling OTP tokens, which is also just implemented in there. You can basically an OTP admin is resetting a token and he gives the user one part of an enrollment password and the other part is sent via email and the user is going to a hardened enrollment client where he types in this enrollment password and plugs in the UBIC key. And then the shared secret is generated here and it's already encrypted with a master secret and written to the token entry. So, and this is a really highly secure process which avoids that on any systems the OTP seed and the user's password are present in clear text. That's what we wanted to achieve by this process. So, time's up. We still have four minutes. Ah, okay. So, we still have four minutes. System manager. This is the future and maybe this is why I typed 2019, I don't know. To come back to your question, a network device entry is mainly a triple with a MAC address, IP addresses, and an FQDN. And you can do a lot of nice things with this if you have this data, if you really maintain a consistent view of this data because you can use it for network access control, the usual stuff, you can use it for OS deployment because, oh, I really hate it. People are setting up OS deployment like, ah, yeah, we have to implement dynamic DNS updates just because they don't have a database where they have the MAC address and the IP address and the FQDN. And if you already have it, you can just use it by adding a very simple DHCP responder just looking in the database. So, very simple. Yeah, and if you have this data, you can just write a wrapper script and you will install the procedure, trapping the data, producing the XML for libvert or something else you might use. And, of course, you can use all this data also for implementing Ansible Dynamic Inventory. That's what I also want to do because this whole system is also set up via Ansible.  Okay, that's it. Questions? That's the point of the person's pocket. So, what is it? Ah, okay. Yeah. Okay, so this one, I'll repeat the question. What's the person object is for? Mainly, the person object is tied to your HR processes. So, normally you don't maintain person objects manually, so you grab it from the HR department and they are responsible. And each object has metadata with status and lifetime and things like that. So, if this person gets deactivated, all connected user accounts will be immediately deactivated. So that's what it's for. And there are also department object and location object that's on the complete diagram. Okay. Oh, two questions, is that possible? Last question. Last question. So, how is that all implemented underneath? So, you said you have a web UI and is there a product script that's actually doing that? Yeah. Open LDAP, open LDAP server with a configuration, plain open LDAP server, bunch of Python scripts, Python web apps. Okay, thank you.