What's up everybody? Jayz here with jasperjasecasebrakes.com 2019 pinning me flawless football one box briefcase break number three random serial number break Just sold out And again every spot you purchase will get you one random number between number one through 25 Then it works just like a serial number break. Just remember the blockchain redemption will be randomized at the end of the break And as an example if you get randomized number four, you'll get all cars with four being the first number next to the serial number dash on the left side So again four out of 25 four out of five four out of ten Just like that and just the number that matches So good luck guys and as you can see I put the lead draft picks like a little acronym Joe must have just put e4 but again customers at one spot in the lead number four five and six are in here And then customers about straight up So good luck in the numbers one through 25 Let's roll it and we got a six and a five eleven times Good luck one Two three four five six seven eight nine ten Remember it wasn't 11 five into six boom Kane down to Joshua Now let's go 11 times You're on the numbers one through 25 one two three four five six seven eight nine ten and 11 Eleven looking number 13 at the top down to 11 after 11 times So can you have 13? Jared with seven came with three dad with 21 Anthony with 16 side with 15 dad with nine John you have 18 Aaron last spot Mojo gets spot number one Anthony you get number 23 Quinn with four Diane with 20 Steve with five down with six Jared with 17 Ray with two John with 22 Hans with 19 Diane with eight Chad with 24 Hans with 14 Brian with 25 Brian Crawford 12 and with 10 and Joshua you have 11 So let's Alpha-Petizan one through 25 and if anybody wants to make a trade quickly, I'll open it up if not Close it Mitch All right guys and close the trade window No, I haven't had it open for about 20 seconds 30 seconds doesn't look like anybody wants to trade so Closing it. Let's see. All right guys, and again, this is from a fresh case Fresh case Let's open up this bad boy Mitch mana. All right, so Top or bottom If I roll a one two three, we're gonna go to the top four five six the bottom six so one two three four five six a Little line through this don't have a marker. We'll just put serial number Could be potentially number four If we use it for that All right, good luck official list again All right again the blockchain is gonna be randomized and it's a Brett Favre breath far MVP's diamonds which Now I'm curious. I believe diamonds is a really really low number MVP's or no, sorry diamonds are out of five So they go out of five There you go. Someone's gonna get that one of ones would be Platinum's Very nice. All right awesome We got a Tony Pollard 14 out of 15 so spot 14 going to Hans we got One out of ten a triple relic Devo Sam and Marquis Brown and DK Metcalf, which would have been a randomizer. This was a regular pick your team break But since it is a serial number break, it's gonna go to spot one and Aaron next we got is Paris Campbell and that is 18 Out of 20 spot eight or 18. Sorry So spot 18, that's John Next one we got is 12 out of 15 That would have been a randomizer as well. Cardinals of Rams alneas Williams That's 12 going to Brian Croft and we got a Tim Brown 14 out of 15 nice little three-color patch For the writers But again serial number break going to 14 and Hans and we got a Two out of five Omari Cooper to Ray Phillips of that one to and of course after a cowboy you always got to have an eagle, right ten out of 15 That's one two three four color patch Carson Wentz Spot ten going to Aaron Very nice very very nice All right, so there you go. Now let's switch scenes or not switch things a switch Here Let's go the first middle hit We got wow look at these patches It's like a little something stuck to this How about this? Tony Romo, Dak Prescott and Troy Aikman One out of ten. Look at the CO and Cowboys And Dak Prescott's patch, I believe Look at that one That's going to Aaron and we got a six out of seven diamond of Ray Lewis Lucky number six Dan Tyson. There you go. What a Ray Lewis diamond And the final hits Where's the eagle?  We got a Garner Minchew Nice two color patch and wow what a break for spot 14 14 out of 20 Little RPA of Garner Minchew and 14 going to Hans Honestly 14 is a kind of a high number and yet a lot of 14s came out. So there you go Garner Minchew out of 14 nice 14 here with Troy Brown 12 18 14 again fortune just straight up killed it though There you go That was the break guys. This was the quick flawless one box briefcase zero number break number three Number four. Hopefully he's in the store. We can get another one going get again Everybody's gonna have a shot at this Brett five block chain reduction So I randomized the customer names and customer number one gets it Snake guys two times customer number one gets the blockchain one Because that's how we do it Steve tells you right here No matter what the redemption is we're gonna randomize it And now if this was a random number block break and it was a redemption no matter if it's a one of one It's out of five. It's out of 20. It's out of 99. We still randomize it So that's that's just the way it is If we would have put it differently then obviously we have to go by that but Redemptions are always gonna be randomized at least in this format for sure. All right. Good luck So snake eyes two times. So that was a one I must have rolled it already. Yeah, there's a timestamp. I must have just did it and Here's two times boom two times snake eyes Jared From e4, which I don't think I called your name. Unfortunately had spot 17. There you go Here's your Little consolation prize, which is not a bad one. Of course breath bar MVP diamonds, which I believe to be at a number five So they go congratulations. Jasky's case breaks calm


Hello, everybody. Thank you for making the time to come to this on a Friday afternoon. My talk today is about hypervisor security. It's labeled the elephant in the room because, at the moment, people seem to be closing their eyes, covering their ears, and hoping that the particular virtualized room they're in doesn't catch fire and sink their entire business. I'm going to talk a little bit about breakouts, about the potential for them, and whether or not the threat is theoretical or real. We're going to address some of the data leakage and virtual machine compromise issues that people will face in the cloud. My name's Robert Clark. I've been the lead security architect at HP Cloud for a year or two now, and been involved in OpenStack for about two years. I've been involved in developing security solutions for a lot of the challenges we face in public cloud and now with private cloud as well. And I was one of the founding members of the vulnerability management team at OpenStack, so I've really been around since the start of the point where OpenStack considered security to be a real priority and issues that needed to be dealt with. Since then, I started the OpenStack security group, along with Brian Payne from Nebula. We found this gave us a good set of perspectives from a core private cloud and a core public cloud to be able to address security concerns. Because we don't have a security group talk this summit, I'm just going to very quickly tell you a little bit about the security group, because if you're in this room, you're interested to some extent in security in OpenStack. We were established coming up on two years ago. We do a number of things. We issue OpenStack security notes that sit alongside the OpenStack security advisories, and they serve to provide extra security information for people deploying clouds. So they may involve third party bits of software, or they may involve common configuration mistakes with OpenStack, and they serve to provide more security in deployment. We consult with the OpenStack VMT. So when vulnerabilities come in, the vulnerability management team is very small. And if, for example, it was a hypervisor security issue, they may well reach out to one of us in the ISSG to run through the issues with them and decide whether or not it's a big problem, whether it can be deployed, whether it needs to be fixed immediately, or it can wait for a release cycle, stuff like that. Among security initiatives, we have the OpenStack Security Guide, which I'll speak to you very quickly, because that is important for this talk. And as of about this morning, we have 97, 98-ish members in the OpenStack Security Group. So one of the main things that we can say we achieved in the last six months was the publishing of the OpenStack Security Guide. It's available on the docs page on openstack.org. It is available in HTML, PDF, and you can buy it in tree form. It was built in the space of a week in a documentation sprint involving major participation from all these organizations I've got up on my slide. And it's very valuable. This talk will speak to a number of points in the Security Guide. I would encourage anybody who's serious about actually deploying OpenStack and letting real people run amuck on it to spend a day or two reading through this guide, because there is some really, really good information there. However, it was written in a week. If you find problems with it, please feel free to submit a patch or just reach out to me directly and I'll make the changes for you. And these are the people that were involved. Right, so I'm going to speak to you a little bit about virtualization. This is a conference talk rather than a design talk. So it's going to be a mixture of higher level and lower level information. Compute platforms serve to essentially aggregate compute loads such that you don't have to have as many servers sat around. And there are various other reasons you might do it, obviously. HP Cloud has been selling and making clouds in some description for many, many years. HP has been selling virtualized platforms for a long time. Virtualization technologies really fall into three categories. And the lines between these are very, very blurred nowadays. It used to be that you had hosted hypervisors, paravirtualized, and full virtualization. Nowadays, depending on how you interpret those different things, Zen could be full hardware virtualization. KVM can have some paravirtualized elements depending on the way you use it. So these are very broad categories. And one of the things I ran into when trying to create this talk, and as I say, it's kind of pitched at a number of levels, is trying to work out a nice way of modeling a virtualization stack in one model. Because if you look at, say, Zen or KVM, they are very different in their approach. But there are a few fundamental similarities. We have a device emulation layer and a hypervisor. And the hypervisor in some situations, like KVM, will actually be a part of an OS. So KVM sits within the kernel. And you have a full Linux OS. QMU provides the device emulation. Those of you that are more familiar with the data paths that happen in typical virtualization stacks will be aware that you can draw a lot more lines between different components on this diagram. But we're trying to keep it at a reasonable level. Zen operates slightly differently. So Zen is closer to what would be a type one hypervisor, a bare metal hypervisor. It still makes use of QMU to provide a lot of its address spacing for machines. So that's all your addressable devices, apart from CPU, MMU, and a couple of other bits and pieces. So this is what our generalize stack is going to look like for the rest of this talk. And I'm going to discuss different ways that different parts of this stack can be attacked. The results of those attacks, whether or not those attacks are realistic in today's world, whether they might be in the future, and some of the mitigating controls you can put in place to protect yourself from these various attacks. So for this, I'm going to introduce an actor. Our actor is called Mal, short for Mallory. That will make reference to some people. Mal is a malicious virtual machine. This could be a VM that's been created for malicious purposes. So we run a public cloud, and a very real concern for us is that somebody will create a virtual machine to either directly attack us or attack one of our customers. In a private cloud, this could be exactly the same for a customer of the organization or put an employee in the organization who, for whatever reason, is deciding to carry out malicious actions. Equally, this could have been a perfectly benign customer virtual machine that has been compromised by some outside attacker, which we see in public clouds fairly regularly. So what does a compute host look like? So a compute host, for the purposes of this, is just a container with a few virtual machines within it. So in this example, Alice has two virtual machines. She's co-tenanted with Bob. Bob also has two virtual machines. This compute host has a hypervisor, being Zen and or KVM, and device emulation provided through QMU. And on the left here, if you can see that, we have a kind of combination of the base layer that would either be the Linux kernel, Linux OS, or DOM0. This is the best way I could find to explain these attacks in a way that would be fair to both KVM and Zen. So we have a compute instance. Mallory has gained a point of presence on this compute instance by either compromising another instance that was running on the host, or by simply asking to have a VM created. There are a few attack options open to Mallory, straight away. Mal can go after another virtual machine on the network just using straight up network attacks. Mallory can sit there, create a virtual machine, deploy Metasploit, and go straight after another machine. And if security groups are in place or your chosen networking rules aren't as effective as you would like them to be, that may happen. In most clouds, this is a valid attack vector, even if you have to route your traffic out to the border and then back. Virtual machines are almost always requiring some sort of network connectivity, and therefore you need to take appropriate steps to protect them. We're going to look at this a little bit more in a moment. Mallory going directly after the KVM or Zen layer and how it might interact with QMU. So we're first going to look at how KVM can go after QMU. So there are a number of vulnerabilities that have been recorded over the years that would allow a virtual machine to attack the QMU layer. QMU is very large. It supports a large number of different devices, all of which have different interfaces. They all have wide address spaces that are accessible.  And he really did a lot of this stuff for the first five or six years of QMU's life. And there's still some legacy code there. And while he's pretty much borderline genius, it's a lot of code for one person to write, and there will be more bugs in there. So if an attacker were able to compromise QMU and gain a point of presence within QMU, they could potentially attack the Linux OS. So in most situations, QMU is going to be inside some sort of process running on a Linux machine or on a Zen Type 1 hypervisor. In either case, QMU is running in Zen. It'd be attacking DOM zero. But in either case, you end up attacking a Linux OS. Typically, there's a possibility for access to other resources once you compromise the Linux OS. So at this point, you'd still only be a user of Type, whatever Type you gave QMU. So you can access other parts of the Linux OS. You can potentially access different OpenStack services because OpenStack is very trusting of what's running on compute hosts. There are ways to contain what can happen after a QMU compromise, which we'll look to you later. And of course, the obvious thing that people are going to be looking for there is a privilege escalation. If someone's able to gain root along this path, then they basically own the compute host. Once you own the compute host, you own all the virtual machines within it. Another method of attack that we actually see a little bit more focus on, if you look at the vulnerabilities over the last few years, they do seem to be focusing right now much more on the core hypervisor technologies. Someone's able to compromise KVM or Zen. They may be able to read the data or write to the data within other virtual machines, but might not necessarily be able to break out of those hypervised processes to really do much else on the system. However, KVM is based inside of the Linux kernel, and therefore, there is an obvious escalation path there.  So nothing running on that machine can trust what's going on there anymore because Zen has direct access to the hardware. And the result of that is everything's compromised, and we all have to go home. So what does this mean for a cloud? So I've been focusing on a single compute host, but clouds aren't single compute hosts. There are many thousands of compute hosts potentially. And they are made up with various supporting services. The supporting services in OpenStat right now trust each other quite a lot. I'll come back to that in a second. But what does it mean to be a cloud of this size? It means that somebody could, again, create a virtual machine on one of your compute hosts. And if they have a vulnerability that they can leverage, they may be able to, through one of the mechanisms we described earlier, gain root on that box and essentially own everything that's on it. However, if you consider a cloud where you have a lot of virtual machines that have the same vulnerability or a public cloud where you essentially pay to pop up VMs wherever you like, you can end up with lots of parts of your cloud compromised at the same time. And that allows you to go after various different services. You may, for example, if Alice and Bob are on a machine that someone wants access to, they can continue to pop shells on cloud hosts until they find the machine they're interested in. Alternatively, they can just compromise one more quietly. And then this was the case as of a few months ago in OpenStack, you could then, if you had compromised a compute host, you could just say to your block store, hey, I want the block store for Alice or Bob or Pepsi or Coke or whoever that company that I'm paid to get lots of information about is. And that seems like a bad thing. So we'll come back to how to stop that happening. One thing that we get asked about a lot in customer engagements is virtual machines, slide channels, affecting entropy, all that sort of stuff. So side channels tend to focus on cryptographic mechanisms. This is because it's a very strong area of academic research, and it's a nice place to be able to show things in a really provable academic way. Virtual machines deployed for any sort of production use, typically at least some of them have some sort of secure transport on them. Web servers, voice over IP, VPN, chat applications, pretty much anything nowadays that's interacting across the web, at least, will be using some secure protocols at some point. So I'm going to talk you through a little example of a documented side channel attack in Zen. That was in a simplified version of Zen with certain things turned off to make this easier. It's important to recognize that, because you can't necessarily go out and own AWS with this, because they run Zen. They've done a lot of smart things there. But if you were to deploy it very naively or deploy it in a way that the academics have, then you can do some interesting stuff. So if you can consider this example of Alish, who is interacting with Bob over a TLS or SSL tunnel. Consider a man on the side, or a man in the middle, who can be privy to this data, but not necessarily interpret it or understand it. Once SSL's in flight, you're invariably talking about either RC4 or above, so more than likely AS128 encryption traveling between these two places. So unless you are able to decrypt the initial key exchange, you've got very little chance of actually breaking the traffic and understanding what's going on. On the compute host here, I've highlighted the CPU and the level one cache, because those are the specific things that are targeted in this attack. And when you look at side channel attacks, whether or not they're poisoning entropy or attempting to recover bits of keys from other machines, they invariably tend to enter out to CPU caches. So Mallory's back and has gained a point of presence on a compute host that they care about. And using the techniques that were described in the paper that is referenced here later, they are able to interact with the level one cache very, very rapidly. They continuously allocate large segment sizes. They continuously reading and dumping and reading and dumping. And by doing this, they're able to collect fragments of the key exchange that happened between Alish and Bob. And once you've got the key exchange, you can derive the key, and then you can replay the entire SSL session and read all the data. So it's fairly trivial, then, for Mallory to pass that information off. You can pass this, shows it very simply. A slightly nicer method of using this attack would be to have Mallory have several point of presence, or perhaps even a legitimate account on your cloud, spin up 20 or 30 VMs to do the number crunching for you from the one that was performing the side channel attack. So as I said, isn't this all a bit theoretical? I have been in meetings with virtualization vendors where I've been told that hypervisor attacks and hypervisor breakouts are purely theoretical and academic, like the side channel vulnerability we spoke to a minute ago. So in 2008, Cloudburst was presented at Black Hat. ImmunitySec demonstrated a breakout of VMware's hosted product. VMware at the time said that they accepted there was a vulnerability in the hosted product, but it didn't affect the SX or ESXi. ImmunitySec said otherwise. The reason this came about was because it was found in 3D drivers that were compiled into VMware that weren't used for anything anywhere. There's a lesson in there for later. OK, so the Zen Onage Trilogy, Joanna from Invisible Things Labs and the rest of her team released three different vulnerabilities in Zen. They involve three different types of attack. The first one went after direct memory access mechanisms within Zen. The next one was a system management mode attack, which essentially allows you to interface with machines before they've really come up. System management mode is sort of a transient mode between your base OS and full. And blue pill shimming, which is quite interesting. Blue pill would allow you to use the virtualization extensions on the host system to move Zen into its own virtualized space to essentially shim yourself underneath between the type 1 hypervisor and the CPU layer, which is useful. Virtunoid, Nelson L. Harsh, KVM, full breakout, attack to dangling pointers in the KVM code, essentially pointers in computing for those of you who want to know. Pointers point to different bits of memory. When they're deallocated, they should be destroyed correctly, but sometimes that doesn't happen. And then if you're very, very clever and have lots of time, you can find out ways to point these to things you do care about and either read from them or write to them or do other nasty things. sysret64 was a Zen vulnerability. It affected the power virtualization context switching mechanisms within Zen. So although sysret64 is a command that you'll find in a number of different types of systems, it only affected the context switching within Zen. And again, allow for a potential full breakout. And to come back to what I was saying earlier, full breakout means everything on that system is owned. VMDK has left the building 2012. The SSI file handling logic error is a classification for this vulnerability. However, if I were to tell you that it meant you could load the block store of any customer on your cloud, you might consider it to be just as bad as a full breakout. Essentially, yeah, you can attach the storage, the database, all the information that a customer has running on their cloud, apart from their VM run state and its ephemeral memory. KVM had three CVEs come out on the same day. That was a fun time to be me. They range from denial of service and memory leakage to a full potential breakout. I've listed the CVEs here. They're reasonably well written. The IOAPIC vulnerability was an out of bounds read, which had the potential to mean that somebody could read the running state of another virtual machine. An obvious example of an exploitation for that would be attacking the key exchange of a machine that was doing cryptography. If you consider that a number of people run VPN gateways in the cloud, then all of a sudden you get access to a lot of different people's data. The time vulnerability was a use after free, which again comes down to memory management and abuse of pointers. And the setMSR is a function that is called low level in a lot of systems. And there was a buffer overflow in the code. It was just badly written and able to be exploited. So I've run through, I think, four or five different vulnerabilities over the last five years. We should convince you that people need to start taking this a little bit more seriously and be a bit more aware. And if that doesn't convince you, this really should. So this is the number of security vulnerabilities in virtualized products for the whole family, from everything you can think of that comes into virtualization. This is from the excellent IBM X-Force report from 2010, which is why the data runs up to 2010. And you can see that there is a massive increase in vulnerabilities reported. Now, this is more than likely due to many eyes. More people are recognizing the importance of virtualization products and going and looking at them. Doesn't necessarily mean that they're full of holes. But given how many were found in the last 10 years, I'm inclined to believe there is still more to find. This table here is, I'm not going to speak to everything in it. It breaks down the different types of vulnerabilities that have been found in virtualization tech. It's a very recent paper that's referenced here from some guys at Princeton. I suggest anyone seriously interested in virtualization technologies goes and has a read of this. Again, it's nicely presented and breaks down all these attacks type by type. You will see here that Zen and KVM are pitted against each other. At the moment, KVM seems to be winning in terms of having a lower number of vulnerabilities. While I think you can deploy both securely, I'm not convinced that this is necessarily indicative that one is much more secure than the other. What is obvious is that you can configure either of them to be incredibly insecure. So I think perhaps at this point, this is a good question to ask, it seems a little bit tricky. So there are a few things you can do. You can turn on relocation read only for all your binaries in your virtualization stack.  And what this means is exploitation is very, very hard. Stack canaries are a fairly well understood technology now, essentially inserting known values into the execution stack of binaries and seeing if things overwrite them. It's a great protection against buffer overflow. Never execute and DEP, both essentially the same technology, CPU level tech that is supposed to, again, stop binaries moving to the wrong places. Position independent executables are a prerequisite for address-based layout randomization. So if you have ASLR enabled, you're doing PIE anyway. These are very, very useful for making it much harder for a successful exploit to gain a point of presence. So you may still end up with denial of service type situations because people are able to make things crash. But gaining reliable exploitation becomes much harder because knowing which bits of your address space to jump to to gain functionality becomes much harder. And this line at the bottom is a compile line of how to do all this for QMU. If you want to compile QMU to support all this or have it all built in or if you're not sure if your vendor does, send them this and ask them if they do it this way. And this is taken from the OpenStack Security Guide. So not only does the guide have fairly high level information and pretty pictures and stuff, it also has some pretty low level information on just how to get it done. So reducing the tax surface is important. The Cloudburst vulnerability is a good example of this. Cloudburst actually combined a couple of vulnerabilities in different systems that didn't need to be in VMware for what it was trying to do at the time. If you look at a standard compile of KVM or a standard compile of QMU, you will see that you will have things like 3D graphics turned on. You will have multiple network devices that you've never heard of and never ever want to support. You'll have sound support. And more than likely, the entire Bluetooth stack supported in your virtualization stuff. We don't have a huge use for Bluetooth in our data centers, so we turn it off. Mandatory access controls are very useful. Anyone who's looking to deploy this stuff at any sort of scale really should be considering using either SE Linux or App Armor. They both have pluses and minuses. They both work in slightly different ways to try and achieve the same things. That is to say that it makes it much harder for processes that have been compromised to change their behavior to be able to access different parts of your system that they wouldn't ordinarily be given access to. It basically gives you very, very tight granularity on what processes are allowed to do. This is an example of Svert running on a Linux KVM hypervised system. In Linux KVM, VMs are running in separate processes, and each process is labeled by SE Linux. And SE Linux can then track what the process is doing and block it from doing anything it shouldn't be doing. So if a process running a virtual machine suddenly starts trying to make calls to other parts of your kernel or tries to reach out to different devices or any other sort of horrible behavior, SE Linux or Svert, in this case, is able to detect that and alert on it.  So to go over what I just mentioned, these are all points that are spoken to in the OpenStack Security Guide. These are all things that will stop the majority of hypervisor attacks and hypervisor breakouts being able to damage your cloud significantly. There's very little protection against really big zero days that come up in virtualization technology. However, you're not necessarily likely to be affected by these vulnerabilities when they are found.  It won't be used. It's not going to turn up in metasploit on day one, or it's very unlikely to. Is anyone who's going to disclose it that way will be looking to do responsible disclosure?  But for the most part, if you apply these different technologies, if you go and read the OpenStack Security Guide, which goes into much, much more depth on every single one of them, then you are going to put yourself in the best possible position. And you will have done your due diligence to protect your cloud from these sorts of attacks. So these are the parts of the OpenStack Security Guide I've referenced. Again, I can't say strongly enough. Please go read it. Please contribute. Thank you for coming to my talk. I hope it wasn't too scary for you. And if anybody wants to do any more research, here's a bunch of links that are incredibly useful. And obviously, my slides will be online, so you don't all have to take photos. Thank you. Any questions? Sure. So if some kind of exceptions happen, blame it. Absolutely. OK. So the question was around the timing of the attacks, and whether or not you will have time to respond to attacks when they happen. Is that right? And that's not just for the side channels for the other type of attacks. OK. It's really very much context dependent. If you have a lot of these technologies turned on, then attacks that attempt to circumvent them, especially things like ASLR, tend to be very noisy. ASLR doesn't work in the kernel. For obvious reasons, you can't randomize the kernel space quite so much. So attacks directly attacking the hypervisors will generally be very quiet. A lot of the things that are going on here aren't, they're not traveling over network interfaces. They're the direct interfaces the kernels have, the direct interfaces that the compute instance kernels have with the systems that are providing their virtualization. So they're exposing, in one way or another, they're exposing PCI and that sort of stuff. So you're talking about very, very fast buses that can, albeit virtualized buses, that can be interrogated very, very quickly. I would expect there will be traces of most of these types of attacks. Where you draw on the line in terms of inspection very much depends on what your agreements are with your customer. Certain customers aren't going to like you, EIP tracing all of their compute instances, for example. Very, very paranoid ones, but, however, may pay you a lot of money to do that. Sure. So I'm not comfortable speaking exactly to what Red Hat have done, because I haven't spoken to their guys about it directly. We did have a couple of guys from Red Hat working with us on the OpenStack Security Guide. I know they have worked very hard on a lot of this stuff. They contributed heavily to things like SBIRT, so they do take the virtualization stack security very, very seriously, much like we do at HP Cloud. So we apply, wherever operationally possible, we apply all of these technologies. As with anything, there are going to be points where you have to make trade-offs between actually having a cloud that works and a cloud that is ultra secure. That said, I think if you combine all of them intelligently, you can make some really strong security assertions about your cloud. As to the direct question about whether or not Red Hat have compiled out parts of KVM, I don't know. So I think that the question was that I didn't speak directly to the, are you talking about the LiveVert drivers and stuff like that? Sure. I didn't speak to that because I'm not particularly expert in Zen. My day-to-day work is in the KVM world. We do a lot to isolate QMU from basically everything else that's on the system, because there we have it running in a quite a discrete process. I would say that that's not particularly well addressed in the OpenStack Security Guide either. And if you would like to have a conversation about contributing to it, that would be great. OK, thanks. Thank you very much.


5 ways to enjoy the holiday without spending money This holiday season, the idea of missing out on the fun stuff is sickening. However, if you are on a tight budget for the holidays, it's time to create your simple plan for the holiday. We always want to enjoy the season. It's the last moments of the year. While this isn't a bad idea, when your financial capabilities are limited, it can feel as though one is missing out on all the fun things. Well, there's good news for you. There are ways you can enjoy the holidays without spending money. In this video, I'll share with you 5 ways to enjoy the holiday without spending money. This will help you become a successful person. If you're new here, consider subscribing so that you won't miss other interesting videos like this. 1. Host a movie night with friends Some of the most memorable moments of the holidays are the times we spend hanging out with family and friends, doing one thing or the other. Usually, it doesn't matter what we do. It's been together that matters. So, you can host a bunch of friends to an amazing movie night, get a couple of drinks from your refrigerator, and probably have some of them come with popcorn or any other snack, depending on what you all prefer, and enjoy a great time with the ladies or the boys, depending on your group of friends. You can either stream movies online or subscribe to movie platforms online, turn off the light if you like, to give it the cinema feel. Perhaps some 3D glasses will make things a little more interesting. Pretty much simple, right? You'd be surprised at how much fun this can be as long as you were surrounded by some of the people you love. It wouldn't matter where you are watching a movie. What matters is that you are watching it with those that matter most to you. However, if movies aren't your thing, you can try hosting a game night. As long as the rest of the crew are also into games, why not? Whatever activity you and your friends prefer doing, go ahead with it. 2. Find out about free or cheap events around you With the holiday season comes a lot of events, free and paid. However, you'd need to be able to research these events to find them. It could be going to the park, a cooking competition or anything whatsoever. Again, the aim is to spend quality time with your family and friends. So, get everyone together and go have a nice time when you find one of those free events around you. 3. Organize a picnic party with family and friends This is much like hosting friends to a movie or game night but this time around, it's an outdoor event and everyone's going to be involved, especially the food part. You can get everyone to bring different items for consumption while one person is responsible for drinks, another for snacks, another for candies and bars, etc. Also, you can check around for parks that are free in your environment so that besides the food, you don't have to spend money on anything else. And as for the food, you can make do with some of the items you have stopped in your home already. 4. Take a road trip For the sake of sightseeing, you can take a drive around some of the interesting places in town, put on some Christmas songs and sing along, get some snacks along as well. The only thing that will need funding on the trip is the fuel you'll be getting. If you set out as early as possible, you might even visit your neighbor in city and join the views and creative memories with your loved ones. You can stop over to exercise your legs for a bit and also take some pictures or videos with them. Guess what? You'd probably look forward to a similar trip the next holiday because the holidays are all about creating memories with the people you love. Always remember that the holidays are all about your family and the beautiful people around you. So, irrespective of the number of days you have to spend together, make everyone of it count by creating beautiful moments like this. 5. Make Christmas interesting for others This time around, look for some ways that you can make the holidays fun for others, not just for yourself. Have you considered volunteering? A 2009 study by social psychologist Georgia A. Barraza, PhD, and neuroscientist Paul J. Zak, PhD, suggests when people are empathetic, 47% more oxytocin, a.k.a. the feel-good hormone, is released into the brain. Volunteering can be something as simple as serving a meal at a homeless shelter, open a busy mom, watch her kids, so that she can get a break and go get all the shopping she needs to get done, baking some cookies, and giving as many as you can think of. You see, the aim is to make people happy. When you do, it'll confer a feeling of fulfillment on you, which in turn will make you feel happy as well. If this isn't one of the best forms of happiness, then what is? This time around, think less of yourself and more about others. Think about ways that you can make this holiday worthwhile for others. It'll give you one of the greatest feelings ever. Thank you very much for watching our videos. We'll like to give you another interesting video for you to enjoy next, but before then, our team will be very happy if you can like this video and share it with your friends on social media. If you're new here, don't forget to subscribe so you won't miss other interesting videos like this. Look at your screen now to see two other videos we handpicked for you to enjoy next. We love you.


So, I'm very, very guilty of creating videos on daily habits that can change your life. I get it. I'm sorry. But I rarely end up talking about consistent habits and rituals I do to make me feel better or feel just calmer and more at peace. In this video, I thought I would share five consistent habits I did in 2020 that really made me feel internally the calmest I'd been in a very long time. What up fam? It's Alex Hine, author of Milk the Pigeon. I field guide for anyone lost in their 20s. It's on Amazon and Audible if you want to hear me whispering in your ear at night, not to make that creepy or anything. Now, I've also included a free download below this video. The free download is for a free journaling worksheet to help get your life together and plan out how to have the most incredible life in this coming year. So, you can check it out right below. Now, the first ritual I practiced was surrender, specifically pretending as if everything was destined for me. So that time where I was in the last year of my doctorate, which is a clinical doctorate when I'm seeing patients and I have to have patient contacts, and yet coronavirus forced our school clinic to close down and the clinics outside of schools to close down out of fear, and yet I had 50 to 100 patient contacts I had to get. So I pretended that this challenge was sent for me. Now even though it was very difficult to graduate and it was very depressing to graduate, the silver lining of that was that, well, if this was sent to me, what was the lesson? And I found that those three months of my last term of school and that following summer allowed two really positive experiences to happen. The first experience was that I ended up studying all this material I'd been wanting to study for four years during my doctorate, but I was way too busy and so I had no time to study them and ended up going down all these really, really cool and really interesting rabbit holes that really helped me just reinvigorate that interest in my field. The second thing was that I ended up going home for three months to take my medical boards, which meant I was home with family and I got to really enjoy the New England, both the summer and going into the fall, my absolute favorite place and my favorite time of year. The second thing I ended up doing that helped me feel a lot calmer was vibes. I started paying attention to the feeling I got when I interacted with someone, but specifically after I had left. I was reading one of these hippie New Agey books about vibrations, blah, blah, blah, and the author suggested a very good exercise. She suggested that a guru told her to pay attention to the feeling you get when you're with somebody and especially the feeling you get when you leave. Don't judge it, don't rationalize it, don't intellectualize it, just pay attention to it. And I started noticing, oh, that really peppy girl at the front counter of the coffee shop. I really like the feeling I get when I talk to her. Or this one acquaintance in business, I don't know why, but I always feel agitated when I interact with him. Don't know why, not judging it, but that's really interesting. That one person on the street, they say they're fine. But every time I bump into her, she always feels really depressed, really exhausted. So I started following up on these hunches and I asked people what was up and I found that 100% of the time there was something going on that matched that emotion I felt. The third thing I started doing to feel more peaceful, more calm was what I call zigzag. I started doing the opposite of what my personality normally wants me to do. So I was having this call with a friend and I was telling him how this year I'm treating it as a sabbatical. I want to do nothing, I want to rest, I want to not set any alarms, I want to work only five hours a day. This is a goals group, a mastermind.  And then he said, I guess in retrospect, your lazy sabbatical year is more ambitious than the average person's regular year. And I was like, all right, fine, I get it. But the point of this was really simple. If you are normally someone who's pushing and hustling and disciplined and up early and is doing your homework or your work early and you're getting things done just for 30 days, try doing the opposite. You know, for 30 days after 8pm eating, I didn't go to a class, I didn't do a workshop, I didn't study, I didn't work, I didn't read. I watched Netflix for three hours for a month. And man, I felt so relaxed. I slept so well every single night. I had no problem sleeping and I felt really good after I got over the initial phase of feeling guilty for being inactive. Now, if you're someone who usually watches Netflix three hours a night, maybe try doing the opposite. Wake up earlier and meditate or do a little bit of yoga or go to the gym. If you usually are just chilling at work, try to be the best, most ambitious employee for 30 days, over deliver, stay late, do what it takes. If you usually struggle and in the evenings you like taking it easy, try dedicating one hour a night to reaching one of your most important goals or working on one of your most important or exciting projects. And just watch how these things affect your life on both sides. The fourth thing I started doing to really feel better and more at peace was calm, which meant that I started making decisions from my body and not my mind. Now, I shared this example here before that really had an impact on me, which is where about four or five years ago I went on the date with this girl. And on this date, this is one of those examples where you meet someone through a friend and you see a picture, but then you meet them in person and they are way hotter and way better in person.  That just doesn't happen. I met this girl, stunner, tall, beautiful, modally, friendly, smart, educated, like all the things I would have wanted on paper. And yet we had a good date. I didn't feel that excited. I went home so bummed that I did not feel excited. I didn't feel like I really wanted to see her again. I didn't feel alive. I didn't feel that I didn't feel drawn to her. And this was that reminder that the mind tells you one thing. Why would you ever not want to go on a date with that again? But the body, the heart tells you another, unfortunately. And so I started practicing this principle. Well, what would happen if I decided all my decisions from my gut and my body, not my mind? Well, I started changing my breakfast because my body wanted something different than my mind wanted, which was an athletic or a fitness goal. I started avoiding friends that I'd hung out with for a long time because I felt pressured or judged or tired or annoyed. And I started hanging out with people who are a little bit different. I started making all these different decisions on what to eat, where to go, how to arrange my schedule, and even what time to get up. And I found it pretty profound. Alone in the quiet, you can only really listen to what your body wants. The body's your gut. The body, your gut wants one thing, but the mind has convinced you that you should want another thing. The fifth was rest, trying not to force anything. I read this quote from some generic guru on Instagram. And here's what it said. It said, don't try to force anything. Let life be a deep let go. God opens millions of flowers every day without forcing their buds. So this guru dude on the internet aside, I just tried to see what would happen if I didn't force anything. You know, I lived basically like an animal for 30 days. Wasn't hungry. I don't care, so I didn't eat.  Or, well, am I going to reach my fitness and athletic goals and my weight goals? If I wasn't hungry, I didn't eat and enforce it. If I had a little bit of insomnia rather than getting in my head and getting anxious about it, I just put on a movie. Watched a movie, put on my sleep timer until I just passed out. I woke up feeling fine, no anxious, no anxiety at all. If there was something in my business I wanted to work on, I worked on it. And if I didn't like it, even though it was my biggest revenue generator, I just stopped doing it for 30 days. And I found that there's this crazy feeling of calm you get if you don't try to force anything. Just like in this resting mode, this river's flowing. I'm going to jump into it, drink a beer. This river's not flowing. I'm not going to go down it, even though I've been going down it every day for the last five years. This friend river's flowing. I'm going to hang out with them. This friend was a longtime friend. Haven't been feeling it lately. Not going to ask to hang out anymore. Try feeling all the little paths of life, your diet, your friendships, your career, fitness, everything. Little rivers. Which ones are flowing? Play in those. Get the inflatable duck. Ride that down that river. Not the other ones. So these five practices made a really big difference in my life last year, where the number one goal was really just to feel good and just to feel calm. Now, all these concepts we've talked about here are these kind of inner psychological strategies for being more at peace and improving your life. And that's why I've decided to partner with Noom for this video. Noom is a really unique approach to your wellness and your fitness goals. Now, as someone who's written an entire book on the psychology of habit change, specifically for weight loss, I love it. If you're wondering about what to eat, Noom actually fuses nutrition with the psychology of habit change and behavioral change, including the fact that it comes with a food and exercise tracker and a personal goal specialist. Now, I personally think that the main reason people fail at getting fit or reaching their goals is primarily psychological. Like, there's no quick fix for changing your relationship with food, with exercise, or ultimately with yourself. So, again, we all have to understand our own emotional triggers and the things that make us react unconsciously if we really want to succeed and see consistent results long term. Now, there's a free 30-second quiz using the link below that you guys can try out. Go ahead, check out Noom on social media, and don't forget to check out the special link below for Modern Health Month readers. So, that's all I've got for you today, guys. Check out Noom, the special link down below this video, and I will catch you in the next video.


Good morning. Myself, Dr. Sanjay Sarsamkar, working as an assistant professor in the Department of Humanities and Sciences, Walchand Institute of Technology, Sulapur. Today we are going to learn about organic reactions and synthesis of drug molecules part first. Learning outcome. At the end of this session, students will be able to explain the different types of organic reactions. Introduction. Organic reactions are chemical reactions involving organic compounds. Obviously, there are two types of reactions. One involving carbon called as organic reaction and the other. Other than carbon elements are involved, such reactions are known as inorganic reactions. So, we are interested only in this organic type of reactions. The basic organic reactions are addition reactions, elimination reactions, substitution reactions, rearrangement reactions, photochemical reactions, pericyclic reactions and redox reactions. Our today's content, it is, we are going to learn about addition reactions, substitution reactions, elimination reactions and rearrangement reactions. So first, addition reaction. When two molecules combines to form one product molecule, it is called as an addition reaction. For example, addition of hydrochloric acid to ethylene molecule. This ethylene molecule and hydrochloric acid react with each other and it gives us the product that is ethyl chloride. How this reaction proceeds? We know in case of this ethylene, carbon-carbon double bond is present, that is unsaturation point is available. This bond break opens and hydrochloric acid gets added up against the double bond to each carbon. So, pi bond opening gives site for addition of a hydrogen and chlorine from hydrochloric acid and that ends with the formation of a ethyl chloride containing only one single bond. This can be explained with the help of this schematic representation. This is ethylene molecule, this is hydrochloric acid, which gives us ethyl chloride. We can see this video downloaded from the YouTube itself regarding addition reaction. When an addition reaction happens, a carbon-carbon double bond or triple bond of an organic compound is broken. The electrons shift to connect to hydrogen atoms, halogens, hydroxides or other compounds. The connecting with hydrogen is called hydrogenation. Connecting with chlorine is chlorination and when it is flooring the bonds with the organic compound we call it a fluorination reaction. The number of double bonds in an organic compound can be calculated by the amount of gas consumed in addition reactions with hydrogen molecules. These reactions require methyl catalysts to break the covalent bonds between hydrogen atoms. Bromine molecules are dark reddish brown in color. When participating in an addition reaction, bromine is required to be dissolved in a non-polar solvent like carbon tetrachloride. As bromine is used up, the color of the solution will fade. This reaction has a higher chance of happening at room temperature than the previous hydrogenation reaction, so it doesn't need a metal catalyst to boost the reaction's speed and probability. The reason to this is that a bromine atom has more electron shells which results in higher bond length and lower bond energy. Here's an example of an addition reaction. The reactants are propene and hydrogen bromide in the sulfane of alcohol. Bromine has much higher electronegativity than hydrogen. In other words, it really wants to take hydrogen's electron. So when hydrogen bumps into the unstable pi bond between the carbons and its focus is no longer fully on its own electron, bromine takes a chance and grabs hydrogen's electron and runs off. At the same time, hydrogen takes an electron from the pi bond and bonds with carbon. We see that now one carbon is missing an electron. It has a partial positive charge as a carbon cation. Bromine on the other hand has an extra electron, forming a negatively charged bromine anion. When the carbon cation tries to get an electron back, it seizes an electron held by the bromine anion, thus bonding and creating two bromopropane. This process of breaking a pi bond is an addition reaction. Next reaction is substitution reaction, a reaction in which an attacking species that is nucleophile, electrophile or free radical replaces another atom or group in the substrate is called as a substitution reaction. For example, chlorination of methane. When methane reacts with chlorine in presence of ultraviolet radiation, it gives methyl chloride and hydrochloric acid is also formed. This can be explained once again by means of the schematic presentation. This is ethane molecule. This is chlorine molecule when they combine with each other that forms ethyl chloride in presence of ultraviolet radiations. At this juncture pause the video and answer the question. An organic reaction yielding only one product is A, addition reaction, B, elimination reaction, C, substitution reaction and D, rearrangement reaction. So the answer for this question that is an organic reaction yielding only one product is A that is addition type of reaction. Next reaction is elimination reaction. When molecule is split into fragment molecule it is called as an elimination reaction. Example for this it is ethyl chloride when refluxed with alcoholic potassium hydroxide it gives ethylene molecule and hydrochloric acid. Again this can be explained with the help of this presentation. This is ethyl chloride, potassium hydroxide and ethyl chloride reacts with each other and that forms ethylene molecule also this forms potassium hydroxide and water molecule. Next type of reaction is rearrangement reaction. A reaction in which either the carbon skeleton or the functional group or both are modified is known as rearrangement reaction. Example isobutyl alcohol in presence of acid gives a tertiary butyl alcohol. So rearrangement of species occurs hydroxyl group it is transferred to the car this particular carbon and it forms COH bond over here and at the same time the carbon which is carrying hydrogen it is promoted to this particular carbon and it forms a CH3 group. Second example for this it is allyl phenyl ether and when it is heated at about 473 degree Kelvin it gives allyl phenyl. Again we can represent this by this particular diagrammatic presentation isobutyl alcohol gets converted into tertiary butyl alcohol in presence of H plus ions that is acid and this is for allyl phenyl ether when it is heated it gives allyl phenyl this rearrangement of a molecule it is known as rearrangement type of reaction itself. For this particular presentation I have used a textbook of organic chemistry by Morrison and Boyd and for YouTube video this particular link. Thank you.


Are your retrieval practice tests, or are they also learning tools? Now, recent research on retrieval practice shows that regular quizzes in classrooms boost student learning across a range of subjects and grades. We know retrieval practice works, but we also need to mix the variety of techniques, not just online quizzes, but quizzes that can also enhance not just short-term memory, retrieval strength, but long-term retention, too, which is storage strength, both which outperform just re-studying material. The benefits of retrieval practice cuisine in this research is evidence, regardless of whether the format matched the unit exam, or remained effective over extended periods of time, including the end of year tests. So click the link in the video. You've got the full paper, and tomorrow I'll give you a blog summary and recommendations about what teachers should do. Teachers should use both multiple choice and short answer quizzes to reinforce concepts and adapt to student needs. And I guess what if? Well, imagine the impact on student engagement and understanding with regular, varied types of cuisine. And of course, what you do in an early years classroom compared to what you do in an A-level classroom is also something that we should factor in. So teachers who embrace cuisine as a teaching strategy significantly enhance student learning and retention and what's not to like.


Joe Chicho have you ever had any students who contact you for math classes after watching your videos? I've had some yeah Yeah, yeah, I've had some but usually I bear the advertisement. It's word of mouth Like once I've been established and I did change cities like six years ago So I had to slowly get established here as well, but now that I'm established here word of mouth carries it, right? So in general I don't really Look for too many clients aside from people recommending me and I do work with a school. That's you know, I work with I Have a lot of students on on the spectrum Everybody's on a spectrum, but I have a lot of students on a spectrum and I'm just good at I sort of specialize teaching mathematics to Those who do not fit inside the box and since the box is getting smaller and smaller My clientele is getting bigger and bigger so It's a sort of a niche. It's not a niche market because teaching mathematics is extremely important super Like needed in our society because as far as I'm concerned, it's probably one of the worst taught languages in the Western world Worst taught courses in the Western world. So if you're by the way gang if you're Wanna Get into a business. It's not a recommendation a personal finance or anything But the world is in desperate need of math educators Okay, so


1. Precision viticulture has experienced significant growth due to improved and cost-effective instruments and methodologies for data acquisition and analysis, such as unmanned aerial vehicles, UAV. 2. The aim of this work is to compare NDVI surveys performed with UAV, aircraft, and satellite to assess their capability to represent intravenured vegetation spatial variability. 3. Results indicate that the different platforms provide comparable results in vineyards characterized by coarse vegetation gradients and large vegetation clusters, but low-resolution images fail in representing part of the intravenured variability in more heterogeneous vineyards. The cost analysis showed that the adoption of UAV platform is advantageous for small areas and a breakeven point exists above 5 hectares, above such threshold, airborne and then satellite have lower imagery cost. This article was authored by Alessandro Matisse, Piero Toscano, Salvatore Filippo Di Genaro, and others. We are article.tv, links in the description below.


One of the best side effects of the Trump presidency has been the hostility of the so-called deep state or intelligence community directed at the president. This in turn has led many Americans to realize that America's powerful, unelected secret police agencies serve an agenda all their own, and that they choose sides in political controversies. Consequently, polls show one's views of the CIA and the FBI depend largely on one's ideological bent. Polls from Fox News and NBC News in recent years show that, as various government bureaucracies have ratcheted up their hostility to Trump, more Democrats and Hillary Clinton voters have said they trust the CIA and the FBI. Hello, this is Ryan McMaken, and you're listening to Radio Rappler. Why the president and this deep state should be at odds has never been obvious to casual observers. Last month, however, in an article titled Trump's War on the Deep State Turns Against Him, The New York Times at last explained that there is indeed very real enmity between Trump and agencies such as the CIA and the FBI. The Times contends that Trump, quote, went to war with the professional staff, unquote, of the intelligence agencies and the State Department. The Times notes Trump has condemned deep state bureaucrats and claims Trump's, quote, hostility toward government was strong from the start. He blamed the leak of the so-called steel dossier of unverified allegations against him on intelligence agencies and never trusted their conclusion that Russia intervened in the 2016 election on his behalf, unquote. Trump was right to be defensive, of course, but that controversy over Russia was never really about what the Russians were up to. The focus was always largely on how much Trump colluded with the Russians to win the 2016 election. Ultimately, the evidence was so non-existent that after a nearly three-year investigation, Robert Mueller was unable to establish evidence of collusion between Trump and the Russians. As Glenn Greenwald has noted, quote, not a single American, whether with the Trump campaign or otherwise, was charged or indicted on the core question of whether there was any conspiracy or coordination with Russia over the election, unquote. But this lack of evidence did not stop John Brennan, for example, from claiming for months that he had special secret knowledge of the matter and that Trump, or at least those around him, were going to be indicted for colluding with the Russians. Although Brennan is a former CIA director, he nonetheless clearly remains well ensconced within the world of his fellow spooks. He is, as ABC News correspondent Terry Moran put it, quote, cloaked with CIA authority, unquote. Brennan even insisted that he ought to retain his security clearance, presumably forever, even though he is accountable to no one, such as the mindset of the deep state bureaucrat. They live in a world where they deserve special privileges just for being government employees, or even having been government employees at some point in the past. Moreover, Brennan has been joined in his attacks on the president by other former high ranking members of the deep state, including former FBI chief James Comey and former director of national intelligence, James Clapper. Those currently employed by the deep state have joined the anti-Trump campaign as well. Much of the current campaign against Trump is likely being fed by CIA agents, and according to Senator Rand Paul on Wednesday, CIA analyst Eric Sierra Mella is supplying much of the prosecution's information. Alexander Vindman, an army officer and bureaucrat with the National Security Council, has testified to Congress in order to fuel impeachment efforts against the president as well. None of this is to say that the Trump administration lacks any taint of corruption, like all presidents that is likely the Trump administration expects favors for favors. The only thing different about Trump is he is not skilled at keeping the everyday corruption of the White House a secret. But what is especially problematic for him is the fact that so many of his critics coming out of the bureaucratic woodwork are from intelligence agencies and from the military. Unfortunately, in the United States there is a well-established bias in favor of employees from national security agencies. Even the very language used by the media speaks to this favoritism. In the Times piece, for example, the authors speak of one of Trump's critics, one, quote, William B. Taylor Jr., a military officer and diplomat who has served his country for 50 years, unquote. Note the implied selflessness of Taylor's work. An equally accurate description of Taylor would be he was employed by government agencies for 50 years, or the taxpayers paid his bills for 50 years. Instead, we're told he served his country, as if there was no chance that anything he did during his time there was not selfless service to the United States. The propaganda value of the media's pro-military bias is not lost on the officers themselves, and it's no surprise Vindman, a lieutenant colonel, testified to Congress in his military uniform. Other examples can be found every time Trump fires a life-long bureaucrat from the upper echelons of the various national security agencies. For example, last summer when Trump fired director of national intelligence, Dan Coates, the Atlantic portrayed Coates as a principled idealist who spoke truth to power. Coates was fired, the author tells us, because of his devotion to the truth, even if it undermined Trump's agenda. The best proof of Coates' honest determination, we're told, was the fact that he, quote, won praise from former intelligence officials, unquote. In real life, of course, Coates is a life-long politician and bureaucrat who, prior to his dismissal, had collected a government paycheck for four decades. As a politician, he lobbied for gun control in support of the disastrous 2003 Iraq War. He trashed the constitutional right of habeas corpus. Like James Comey, Coates defended and sought to hide the government's use of torture. The idea that his post-congressional career was marked by dogged devotion to the truth ought to strike one as rather fanciful. But even The New York Times is no longer pretending that the deep state doesn't exist and that it doesn't have its own political agenda. In fact, as noted by Robert Mary at the American Conservative, the Times article even, quote, portrays the current impeachment drama as the likely Dano Ma of a struggle between the outsider Trump and the insider administrative forces of government, unquote. This is especially significant since it is also increasingly clear that, quote, American foreign policy has become the almost exclusive domain of unelected bureaucrats impervious to the views of elected officials, even presidents, who may harbor outlooks different from their own, unquote.  Some of these deep state agents even admit their willingness to subvert the official chain of command to suit their own purposes. Vindman, for example, told the impeachment committee he actively sought to subvert Trump administration relations with the Ukrainian government, largely to preserve Vindman's own vision for American policy. In the mind of this mid-level bureaucrat, American foreign policy is said not by elected officials in Washington, D.C., but by the bureaucrats themselves. Back in 2017, the battle lines between Trump and the deep state were already being drawn. At the time, I wrote, quote, this isn't to say that Trump is the good guy here. As with the U.S. military establishment overall, the deep state is by no means monolithic. Like any group of self-serving institutions, there are competing factions. Trump clearly has allies within some areas of the deep state, as can be reflected in Trump's attempts to massively expand military spending at the expense of the taxpayer, unquote. But the fact he's considered an outsider by Washington by so many should suggest there are reasons to support him over the entrenched bureaucracy. Indeed, as Greenwald pointed out in a 2017 interview, it's not a coincidence that former and current members of the deep state clearly preferred Clinton to Trump during the campaign. The deep state bureaucrats prefer an insider like Clinton, who can be trusted to not upset the national security status quo in any way. Although Trump is no true friend of peace or human rights, he commits his sins largely out in the open. As such, his presidency is relatively transparent, and Greenwald prefers that to the hidden and extensive crimes of the deep state.  These, of course, are so numerous as to be impossible to list, but just for starters, we might refer to a 2017 article by Cheryl Atkinson in The Hill titled, 10 times the intel community violated the trust of U.S. citizens, lawmakers, and allies. It's a laundry list of illegal, immoral, and blatantly unconstitutional acts, which well illustrate the near total impunity with which these agencies operate. Abuse of spying powers is so rampant within the FBI, for example, that even the lopsidedly pro-spying FISA court was forced to conclude the FBI routinely overstepped the bounds of legal surveillance. And of course, without the heroic whistleblowing of Edward Snowden, the NSA would still be falsely insisting that it doesn't routinely spy on virtually all Americans, whenever and however it likes. In response to these facts, one might still insist, but presidents lie a lot and break laws too. That's true, but the difference between presidents and deep state bureaucrats is well illustrated by the current impeachment controversy. It's the president who's facing indictments, public attacks, and the prospect of removal. On the other hand, the deep state bureaucrats who oversee many counts of corruption, illegal spying, and leaking remain safely hidden from public view.  As the years pass, they become ever more entrenched in the federal bureaucracy, invisible to the public, and as we are now seeing, often answerable to no one. Presidents come and go and they often face fierce opposition from the other party or from the media. The deep state, meanwhile, is said to be full of national heroes who serve their country and speak truths to power. It should be easy to see in the battle between the president and the deep state, which side is the most dangerous. Thank you for listening to Radio Rothbart. Have a wonderful day. For more content like this, visit Mises.org.