This was really a collective work and without any of them this wouldn't have happened in the same way. So this is a quite long work that took place over the last three years. And the idea is coming from the following facts. If you look at the situation around concerning 3D dimensional crystal structures, they are very well known. You have hundreds of thousands of them that are populating databases. So at least the structural parameters are very well known and even more properties and comparatively 2D materials are still a very fast evolving field but where you don't know so much we know maybe a few dozens of them. So the idea here is to try to fill this knowledge gap and if we imagine now we have such a 2D materials database with a number of quantities inside we could think of doing high super screening, so looking for high mobility materials, ionic conductors, catalysts, topological insulators, piezoelectric, ferroelectric materials, superconductors, pintronics materials or porous membranes. So those are some of them were already beginning to do it in the lab. Others are the state of project. And even you could also build a property database with quantities like thermomechanical properties, stability or electromagnetic magnetic and this in itself also has a big value. So that's what we are trying to do and the method is to try to exfoliate compounds that are known experimentally from the 3D structures where the 3D structure is known. So we begin with external databases like the ICD and COD and we look for structure that looks like this. So with a certain screening algorithm that I will describe, we really want to see gaps if you want between some layers. So when we have found them, we want to put a little bit more physics inside. So we then turn to DFT calculation first to relax those 3D structure and then to compute the energy between those layers to make sure these are really weakly bonded. And from that we can filter even further and get our 2D database which we can populate with properties. So electromagnetic magnetic properties, phonons and eventually topological phases. So let me begin with the algorithm to screen those layers. So the idea is fairly simple. You have an initial structure. I drew it in 2D here but you have to imagine a 3D one. You build a supercell and then you try to identify atoms that are chemically connected. And our definition of chemical connection is just based on interatomic distances. So you look for atoms for which the distance between them is smaller than a certain value that is given by the sum of one diverse radii minus some quantity delta. So the idea behind is this plot here from this reference. Essentially when you look at the distribution of interatomic distance in all kind of structures that contain this diver, you have a peak of chemical bonds here. Most of the time covalent bonds but it can also be other kinds of strong bonds. And you have another peak that is made of Van der Waals bonds. And in between you have most of the time a gap that we call the Van der Waals gap. So the idea here is that you want to be sufficiently further from the Van der Waals peak to be sure that really you are inside a peak of chemically bonded things. So you are sure that they are really chemically connected. So when you have found those groups of connected atoms, you want to know if it's 2D or not. And the idea is fairly simple again. You just look for periodic copies of a given atoms because you are inside a supercell. So this makes an ensemble of vectors and you can just compute the rank of these vectors.  So it can be 2D, it can also be 1D or even a cluster if you don't find any periodic copy. So we can get any kind of substructure with any dimensionality. So since the algorithm is in essence simple, it can deal with many complex situations because it's very general. So for instance, you can get things that are with a stacking axis, not along a crystallographic axis. You can get such structure where the layer really spans a lot of adjacent unit cells. So you really need this atom here and this one here as well as the unit cell here. You can get also these kind of things where the layers are really interleaved and there is no kind of vacuum you could define here. So you really need to look at individual bones or also such complex structure where you have clusters between layers. When you have done this purely geometrical screening, you want to go a bit further and put a bit more physics. So the idea is to try to split such a 3D structure and see the energy of interaction between the layers. So here you need an ingredient that is not given for granted in DFT calculation which are van der Waals interaction because most of these compounds are holding only through van der Waals interactions. So you need to use van der Waals function. We have chosen two, I will show later, a posteriori that they work well. The two we have chosen are the DFT with C09 exchange and RVV10, but there are many more and actually I doubt that it would change significantly the results. So the other ingredients also that you need are good super tensures and here I would like to insist also on another work that we did in the lab which is to compile a library of pseudo-potential. We did not do them ourselves except for one exception but essentially we collected all the possible pseudo-potential libraries testing them compared to Olexon calculation and testing conversions until we get for each element kind of the best pseudo-potential. So this is the SSSP which is available on the web and it's highly reliable. So a few words about the functionals that we have chosen. If you look at the structural parameters of these compounds computed with DFT, if you do not use a van der Waals function and if you look at the error in the interlayer distance, so the out of plane axis if you want versus the packing ratio, so the lowest packing ratio is more empty is your structure if you want.  Now if you instead use the two van der Waals function we have chosen, the spread is much reduced and the systematic error is almost absent. So this gives the first confidence of what we are doing. But you need a bit more because we are going to compute energetics, binding energies. So we also compare with the state-of-the-art reference binding energy from RPA which we did not do ourselves but they are coming from here and on these well-known layered compounds essentially the difference in binding energy is not only it's not very significant but it has a certain magnitude but let's say the compound to compound difference is more or less the same as the RPA with the van der Waals function also. So we are pretty confident that we can use the van der Waals function also for the energetics and that's what we did in the end but only the binding energy is not completely enough because it's a bit arbitrary to fix a threshold below which you will say okay those are van der Waals layers, van der Waals bounded and above they are not. So we try to find another descriptor which we choose to be the difference in interlay distance between a non-van der Waals and a van der Waals computation. So if you want, if you take a function like refPB that is supposedly probably very approximately van der Waals free, you can say that those van der Waals bounded compounds shouldn't bound and the interlay distance should grow indefinitely versus something that contains van der Waals that will bound them much tighter together and that's actually what you see. So for small binding energies which are on the y-axis this difference in percent is very big and grows for that graphite actually. While when the binding energy is much bigger this delta is much smaller. So in the end we have three regions, we have identified kind of three regions. One is quite clearly the region of easily exfoliable materials. Here the yellow one we think that clearly not exfoliable or at least with difficulties and in between there is this intermediate region which we are not really sure of but the binding energy is still relatively small so they may be exfoliable. We think that there is still some possibility to exfoliate them. So let me summarize where we are up to now. So we have done the geometrical selection on more than 100,000 structures from external databases. So this gave 5600 layers structure which for some of them more than half of them we relaxed, the others it's still ongoing or they are really much bigger so it's more complicated to do them. Then we computed the binding energies on those, we exfoliated them, we ended up with 1,800 monolayers and we can go further with these identifying prototypes which I will show doing structural relaxation and computing some properties on the most promising materials. So this is what I will show now. Let's begin with some statistics. So if you look at the distribution of point groups among the layer materials versus those of the standard 3D databases it's quite striking to see that actually there is no real preferred point group compared to the external database except for very few exceptions. I like this way of looking at this where you really see that actually low symmetry point group are very present in layer materials so it's not only hexagonal or trigonal, there are really lots, all kinds of things. Also with the structure we did some prototyping, the 2D structure, so we took about 1,000 of these structures and tried to identify using Pimogen and the structure match of Pimogen some prototypes. So the most common one, those are the 10 most common. The most common one contains 67 structure, it's the cadmium diadide, it's also the 1T phase of MOS2. So that's not surprising if you want. There are others that are more surprising like this trital arid that contains a rare earth or even this quaternary compound that is also quite well represented. Now maybe you wonder if these structures are stable. So to evaluate the mechanical stability which is the first step, we computed the phonons. Now there is a catch here which is for 2D monolayers one has to be careful. Typically one uses 3D periodic boundary condition with a big vacuum between the layers and in some cases it's not good enough even with a very large vacuum because you have long range Coulomb interaction and the periodic images interact. So fortunately there is a 2D version of the DFT code quantum espresso now with the truncated coulomb interaction so this has been developed by Thibault-Soyer. And this allows for instance to get the proper LO-TO splitting or I should say maybe the absence of splitting because so that's boron nitride that's the high part of the phonon dispersion and in 3D you have really a splitting between LO and TO while in 2D the LO mode actually bends down until it reaches the TO and the only thing that is discontinuous is the slope actually. So with this code you can get this right which is quite important. So now how do you deal with the stability? So the idea is to relax the 2D structure to compute the force constant and then to look at possible unstable phonon at gamma so meaning imaginary frequencies and if there is one you try to distort the structure to follow the instability and you use this as an initial guess and you go back here and you do it again. So we use the speedily the library from Atsuhi Togo to perform this kind of things and the symmetry analysis and this allows to go from a situation like this where you have really a highly negative phonon at gamma to something like this where this is well stabilized. So in the end we have 245 phonons actually now we are computing more and let me now make a small parenthesis because up to now I talked about results which is the thing that happens in the project at the very end actually and before this end there is all the technical stuff you have to do and let me say a word about it so all of this has been I would say made possible thanks to the platform AIDA which you have heard about which is one of the flagship code and AIDA is about really dealing with all the calculations you want to put on a cluster that you want to launch on a cluster and most importantly also storing all the data generated by this calculation storing the provenance of this data they are linked together so you have a structure that gives a calculation that would give another structure for instance so you have in the end some graphs, some trees it's also an environment where you have really connection between different kinds of codes for instance ASC, SPG, PIMAGEN you can all use them within AIDA and maybe most importantly the sharing so all that we do in AIDA the workflows we develop, the data we generate can then be easily shared with other people using also AIDA so this is really the key tool in this study and in Marvel at large I would say so let me show you an example of workflow that is the following dispersion workflow so it's a workflow to begin from a structure compute the dynamical matrices and in the end get the following dispersion and in this actually you have lots of sub workflows so the structure relaxation first you need to go through several relaxation until you're sure you have reached a convergence the dynamical matrices you have to do some initialization then you compute for each queue point you compute a separate you use the pH code of quantum espresso and actually all these are also workflows that are really low level workflows that deals with all the restart management on a cluster the fact that maybe your calculation can fail for some external reason and just need to relaunch it all there is the CPU time that was reached and you need just to continue it this kind of thing and even some small logic to change a little bit the parameters to make it work so this is a quite complex workflow but then for the user it's simple to use actually recently with Giovanni Pizzi we have developed a fun and turnkey solution which I can show I hope you can see something but anyway so essentially you choose a structure and you choose if you want to relax it you choose the computer in which you want to compute and so this is really a small hub that you can readily use you choose the pseudo potential library you choose some k-points density mesh there is also some advanced options like the smearing or this kind of thing and then you generate your input and just have to click on a button to run the workflow so after that you'll go to some status app that will show you what has happened so now I skip some of the waiting part and now it's finished and you see the result right away also in the same application so there is the band structure and also the phone on dispersion so now if I tell you that this is so easy to use that a kid could use it maybe you would not believe me or maybe you would say this is just a nice sentence it's actually true because what you've just saw has been performed by ten years old daughter she did it on the computer without even let's say the closest thing from a computer she used to use was a smartphone and she did it very easily so she computed the phone on dispersion of aluminum that way so let me go back a bit to the properties and go to the perspectives of this study so after that we computed the magnetic and electronic properties by scanning possible ground states so both ferro and antiferromagnetic configurations and this is a plot of the absolute magnetization in Bohr magneton per unit cell versus bandgap and those are the materials that we found so I indicated the strongest ones all those that are insulating which are very interesting the red are the antiferromagnets blue are the ferromagnets you see also some chemical trends like the manganese compound the vanadium compounds or the chromium compounds here around also the nickel here so all this is going to be actually published in one week from now on February 5th in this Nature and Technology paper with all the co-authors and also the electronic structures so this is a just 258 electronic band structure those are effective masses the color indicates the thickness of the layer and the size indicates the bandgap that's the work of Davide Campi who is preparing a paper on this and we also searched for topological insulators and actually we found one actually Antimo Marazzo found one and there is this Sarkov paper here so it's based on the recruiting guide which is actually known as everything in this study it's a known 3D bulk compound that has been discovered in Brazil so before concluding let me show you all my co-authors and really I would like to thank all of them because what they've done was really crucial I would also like to thank the founding partners and the computing time from CSCS and now I will leave you with my summary so we found essentially more than 5,000 layers of material with a geometric screening then out of them almost 2,000 easily exfoliable structures not easily but exfoliable structure among which 1,000 should really be easily exfoliable we did all this with AIDA which keeps the provenance of all calculations easily shareable now we are computing phonons, magnetic, electronic topological properties and all this data is going to be in the materials cloud is actually now available in the materials cloud and in this DOI here so as I said there is a nature and technology in present it is going to be out next week thanks a lot for your attention


Hello and welcome to the session. In this session we discuss the following question which says the inner circumference of a circular track is 220 meters. The track is 7 meters wide everywhere. Calculate the cost of putting up a fence along the outer circle at the rate of rupees 2 per meter. Use pi equal to 22 upon 7. Before we move on to the solution of this question let's recall the formula to find out the circumference of a circle. This is equal to 2 pi r where r is the radius of the circle. This is the key idea to be used in this question. Now let's see its solution. Consider this figure where this is the circular track which is 7 meters wide. We take let the outer radius of the circular track be capital R meters and let the inner radius of the circular track be the small r meters. So this is capital R, this is small r and this track is 7 meters wide. Now we have the inner circumference of the circular track is equal to 2 pi r meters. It's given in the question that the inner circumference of circular track is 220 meters. So we have 2 pi r would be equal to 220. So from here we get pi r is equal to 220 upon 2. Now 210 times is 220. So we get pi r is equal to 110. Now taking pi equal to 22 upon 7 we have 22 upon 7 into r is equal to 110. Further we get small r is equal to 7 into 110 upon 22. So this is equal to 7 into 5 equal to 35 meters. Now this small r is the inner radius of the circular track and this is given by 35 meters. That is we have small r is equal to 35 meters. So the inner radius of the circular track is 35 meters. Now it's given that the track is 7 meters wide. So width of the track is 7 meters and hence the outer radius of the circular track is equal to the capital R and this would be equal to small r that is inner radius of the circular track plus the width of the track that is 7 meters. Now we got small r equal to 35.  So we get capital R is equal to 42 meters. That is we say outer radius of the circular track is equal to 42 meters. Now the outer circumference is equal to 2 pi into the outer radius of the circular track which is capital R. We put the value for capital R that is 42 then we put the value for pi so 2 into 22 upon 7 into 42 meters is the outer circumference. Now 7 6 times is 42 and so this comes out to be equal to 264 meters is the outer circumference. Now in the question as you can see we have to calculate the cost of putting up a fence along the outer circle at the rate of rupees 2 per meter. So we are given the rate of fencing the outer circle is equal to rupees 2 per meter. So the total cost of fencing the outer circle is given by multiplying the outer circumference which is 264 into the rate of fencing the outer circle that is 2. So 264 multiplied by 2 rupees would be the total cost of fencing the outer circle. And this is equal to rupees 528 is the total cost of fencing the outer circle. Thus rupees 528 is the final answer for this question. So we were supposed to find this. So this completes the session. Hope you have understood the solution of this question.


Good afternoon everybody we are here. I'm getting a little feedback Thank you. I'm here with my really great production staff. I want to say hi to everybody. It's been two months since we've been on the air and Let's see Better do some. Thank you. Thanks to Kevin executive producer board up to my photographer my cameraman Daniel Thank you so much to Emily in the front office to Jordan My executive producer to Let's see here to Megan Who who's involved in this whole thing and then obviously Miss Lauren Glenn David Ian? I'd like to thank you all a channel 17 We are in beautiful downtown Burlington in the old north end and I am I haven't we weren't on in August Which is too bad because Unfortunately, that was the day of the primary and So I was working as an inspector of elections in Ward 2 just down the street on Archibald Street, and that was a long day But that was quite a day The primary had some very interesting results. We're gonna go over all that we're gonna be on the air for about 40 minutes You want to hang out talk to me say hello? I Have to I think anyone doing his historical or political program I've got a comment on the the death of the passing of Queen Elizabeth 70 years as a monarch there she is Wasn't she beautiful? She was great You know, there's a short list of people who are really really truly Amazingly great, and she was one of them She never gave an interview They always said that her mother told her something like Never complain never explain and keep moving on she was very stoic and when you look back on it the first Prime Minister that she met as Queen was Winston Churchill and The last was the new Prime Minister, and I don't know if we have that picture. There's a there's her last official picture Oh, there she is There's the Queen God bless her God bless her that's the new Prime Minister Liz Truss and were That was taken two days before she passed and that was taken at her her home in Scotland the the annual the the summer palace and Well, there she is. God bless her now also kudos to the name the new the new King Now King Charles the second and I wish him well He I'll just say a prediction. He'll never be able to outshine his mother. She she had so much grace in class. She brought it England was Britain was still in rationing they weren't rationing from 1939 to 1953 and She brought them out of that into the 50s the 60s the Beatles the whole hip London and then the you know all the events of the 70s and 80s and Diana and then Diana's unfortunate death of her two sons being born Wills and Harry and What the monarchy has gone through and the death of Prince Philip he was 99 years old Well, so anyway, can we see those pictures one more time of those two there? She is that's what I believe when she was coronated in 1952 and Then this is the Queen with the new Prime Minister two days before her passing in 2022 thank you Kevin those pictures are great. She aged so gracefully. She really was a wonderful woman Okay. Oh, that's a good picture. Yeah. Thank you for bringing that up and you can see the Prime Minister is so delighted to talk to her More than a living legend The only person I can think like that in the United States would maybe be like Jimmy Carter or the late Mrs. Kennedy Just star power man Nothing like it. Okay So our condolences to our Canadian friends where the Queen was the you know de facto ruler on all the money the currency chairman of the Exeter, I think it's called and Let's talk about I have to talk about something that we talk about every month in the show and it's been two months So I'm gonna have to talk about it twice. It's so important and that is COVID Okay, we are not out of the woods on COVID. I Have gotten for I've gotten the two shots and the two booster shots and I'm looking forward not forward But I'm going to get the the new shot as soon as I can I'm 59 so I'm eligible to do that if you haven't got the first shot my friends it is Painless as I've said this before on the air when I did when I got it I I said to the nurse I said, I'm sorry. I don't think that it pricked my skin and the nurse said Oh, yes, it did. So there's virtually no symptoms. That gives you 70% clearance and boy, you take that in Vegas, wouldn't you 70%? Anyone who's not vaccinated you're really letting everyone down for example my 87 year old mother You know, she she cannot get caught coronavirus So she cannot be around unvaccinated people and I have some a couple I have three very good friends and they all know who they are I'm not going to say any names, but they're not vaccinated and You know, I I can't really hang around with them. And I I'm a little upset with them I think This phrase has maybe been used before but if you know if you believe in America if you believe in the world if you're a World citizen if you're an American citizen. Hey man, you got to get vaccinated Now let's talk about in the state of Vermont We have that a program you can call and I think we might be able to bring a graphic up on this it's called 2 1 1 and 2 1 1 is the number to call if for example, you have questions I'm not sure if we can get that up Kevin. If we could that would be great and we can leave that up for a little while Please um if you have questions about hey, I'm nervous about getting vaccinated or where do I go? I have a question. Okay. I need to make a doctor's appointment. I don't have a doctor. I don't have insurance You know, we have this unbelievable Medicaid program in the state of Vermont and the insurance It is really really very helpful and it takes about five minutes to fill out the form And you know if let's say you're having some tough times and you're down on your luck You you know, maybe you're not working or you or your jobs aren't making the federal minimum wage standards You know the income I believe it's about twenty two thousand dollars. You can get that insurance now also 2 1 1 can help with Hey winters coming, you know, I'm gonna have trouble filling my tank or I've trouble paying my electric bill You can work with Burlington Electric. They're such wonderful people there. They really are a great job. Hello to my friends Darren Springer and Mike canerick. I wish you both very well Darren is the the head of Burlington Electric and Mike's the communications director. Those guys are glad to help you They are good people. They are my good buds. I want to say hello to them and we are so lucky I my electric bill was all of twenty six dollars last month. Isn't that incredible now? I don't live in the Taj Mahal or anything, but It was very reasonable. So if you need some help if you're looking for work if you need a doctor's appointment, you haven't been in the dentist for a while or You you need someone to talk to we all have some post-traumatic stress from COVID My friend we stayed inside for a year. That's got to do something for you If you're having problems finding a school for your child if you need school clothes If you need help if you need someone to talk to this 2 1 1 number it's statewide 2 1 1 number is really great and Again, I will mention that at the end of the show. So if you're not vaccinated Please get vaccinated at least get the first vaccine And I bet you if you get the first you'll get them all I will be getting that fifth one the omicron That takes care of the omicron. Hopefully this fall so um Anyway, I'd like to just thank everybody. I think president biden has done an excellent job with this managing of COVID We seem to realize I guess unfortunately that we'll never be able to eradicate it. It's just the living with it And I also must give some kudos to dr. Fauci. I read a couple. Hey, there he is Can we hold that for a second because I got to say something about my pal Tony Fauci dr. Fauci What a great guy he's worked on the cutting edge of american health since the 1970s He's retiring. He's 82 years old. He always reminded me a little bit of my father my dear beloved father So dr. Fauci, I appreciate all your good work, and I know you appreciate what we've done up here. We had some excellent numbers unfortunately You know some states lost God, new york state lost. I don't know 200 000 people maybe and and we lost I believe a little over a thousand And I might be wrong on that. This is not the show where we're going to talk numbers One is too many. Um Okay, there he is. Mr. Biden. Hey, thanks a lot. I think that was a little prompting from my uh From my cameraman there. We both like joe a lot Well, also speaking president biden and dr. Jill who I think is fantastic Will be traveling to london to lead the american delegation to say goodbye to queen elizabeth that special relationship Between america and britain is always very something Even though there's still burn marks and bullet holes in the capital where they tried to burn it in 1812 and they did burn the white house But boy, they've been our our long neighbor, you know with with canada was part of the empire for years. So You know, I guess that's something you have to talk about with queen elizabeth the empire But I guess, you know, we could do a whole show on that the the good and the obvious very bad too Okay, let's talk about joe biden. Mr. Biden made an excellent speech in philadelphia Okay, he talked about the magna republicans And the fact they're criticizing the fbi the fact there was an attempted coup There was a treasonous coup on january 6th. Please make no mistake about that Overwhelming capital police trying to kill capital police vandalizing desecrating Doing all sorts of stuff in the capital breaking through barriers breaking windows destroying documents Waving confederate flags now if you think that's cool, turn this damn show off right now And I don't want you to watch because you're not my audience if you think that's cool okay and thank god The capital police was helped by the national guard, but it took far too long and Did the president cite this? I think he did did he know that they would invade the white house? I'm not quite sure That has got to be That would have to be decided in a court of law and not not on a on a television show We see Since the last show the the raid on mary lago by president trump and I asked kevin Please no pictures of mr. Trump not today If if you examine the records President obama president bush president carter president ford president reagan the first president bush You can go all the way back They were scrupulous about working with the national archives about Any top sirens clearances are are kept in the strictest of confidence Actually, there's there's documents that don't even leave certain rooms of the white house and we have evidence that Mr. Trump, I would have to be complimentary to say they were stored in a haphazard way They were all over the place. They weren't organized. You'd have a top secret next to just a regular document supposedly he would flush documents down the toilet at the white house um So pretty crazy I think he's in serious trouble. He operated the presidency as a private business. I think he evaded taxes Uh, we see who's we know he's colluded with putin Okay We know that it was a dishonest and illegal presidency what he did with the pardons And it's a very very dark chapter in american history President biden is doing a great job. Can I get him up there or maybe dr. Jill, please? I love her too. She's a partner. There she is I'm hoping she comes to Fromat before the election. No, we don't know about that. That would be fantastic. I hope she will soon She has a very busy schedule PhD in her own right, uh, still teaches community college in virginia Excellent person outstanding. So she and president biden will be traveling to london to represent us so well And I think that's just such a class move For a class lady. Uh, I think it's great. The president is going Let's talk about the midterms. I believe let's see for last friday last saturday was 58. So it is We are 55 days away from the midterm elections. That would be also the state elections here in vermont 55 days so I'll basically seven it's seven weeks from today. I'm cutting this show tuesday at five o'clock. So Seven weeks from today. God willing. I'll be at the polling place at word two now Let's talk about We've we I think anyone knows about the primary. I'm just going to spend a couple minutes on it Um, big big wins for becca ballot. Congratulations state senator ballot majority leader. Oh, no, I'm sorry You're actually president pro tem of the senate She ran an outstanding camp campaign. She had a very able challenger and lieutenant governor molly gray I don't know if we have any pictures of becca or molly um Yeah, hey, there she is molly molly's a friend of mine and you'll be back Hey, there's becca and that looks like she's at the state house.   They did a great job charlie. He did a great job and all the volunteers It was it was very nice to hear the hum of a very happy campaign office also big win Full disclosure. I'm working part-time on this campaign for my main man I love him congressman peter welch Who is now? Yeah, there he is good picture of peter. What a great guy. Boy. I respect him Who knows he uh, he's in berlington quite often. Maybe he's watching this show if you are peter. Hello I know you've been here for the debates many times and you are a big fan of of town meeting tv So I appreciate you man He had a big victory the only upset there was that I believe that we were going to be facing christina Nolan who was the republican she was a former she was a former Prosecutor federal prosecutor and she was a moderate republican I don't think she was really a trump republican, but because so few people voted in the primary She lost to a very hardcore um Trump type person his name is jerald mulloy and he will be facing congressman peter welch and I Am working on that campaign and I've endorsed peter. I think peter is fantastic We're lucky with this delegation senator. Can I get him up there senator lehi my main man? Let's see if he's coming up. There he is Congratulations senator lehi on your long years of service Your excellent new book that is out. Also that comes with them A lot of pictures because he is an avid avid Photographer and many times this supplied the ap Or upi with pictures when the president is signing a bill remember when he came into the senate at age 34 President jerald ford boy, wouldn't it be great to have some moderate republicans really make this two-party system work? That's the president wasn't the senator lehi came in he is retiring in january I think I think the world of him. He's been so kind to me. I've worked on his campaigns I'd like to say hello to his whole staff and also hello and good wishes and good health to mrs. Marcelle lehi Boy, what a great couple that is and grab that book. It's a really great read He talks about everything and you know all the 47 years you got a lot to talk about Okay, why i'm talking about him. You know, I better bring up I got to say he's the most popular politician in vermont most popular person in vermont Two-time candidate for the us presidency. There he is Nobody's man, but his own Nobody's man, but yours That was a senator where I grew up in canada kit low wiker. He said nobody's man, but yours and that's bernie Billionaires can't buy him or senator lehi or congressman welch, okay They have done such a great job to get these stimulus bills We see that When talking about the stimulus bill in china, you know, we've got to get away from our dependence on chinese goods And this this bill gives like 500 billion dollars or something to making chips in the united states And these cameras can't work with chips or these microphones can't work with chips. Nothing works without chips this microphone um That vote was 50 50 You know, I got to thank I got to thank senator manchin. He You know, I know he's a conservative democrat, but he came around and we we elections as brock obama said elections have consequences And hey, I better give her a shout out. How about our great vp kamala harris? She cast that deciding vote I don't know if we got a picture of her um, I hope so she's outstanding and um, I think you're gonna see the ticket I think You know and boo-hoo to the new york times are saying that president biden shouldn't run I mean that is just absolute folly and nonsense. He will run and vice president harris will be his running mate and They're gonna dismantle over the republicans put up now if the republicans put up donald trump They're setting course of democracy back 20 years a two-party system has to be one and two It can't be like this. It's got to be somewhere in the center Okay, uh, we see some other candidates. Maybe um, the governor of florida Ron de santis Very conservative would not play well in vermont. Um Okay, i'm not quite sure where I am on time. I'm thinking about 15 or 20 minutes I wanted to talk to you today about let's get everyone registered to vote Okay, I have a friend in the office here who I just She moved from one town to another so we're able to do do a change change of address form just a simple form right here and um and What people don't understand because in the primary they were not sent ballots Is everyone who's registered to vote in vermont will be sent a ballot Okay, so my friend that moved to her new town She will see a ballot at her new address not her old address For example, if I live on green street, let's say I moved to pearl street and I didn't change my address That ballot would go to green street. I wouldn't be getting mail there It would be kicked back to the city and there'd be put a challenge on my uh, my name So if you've moved even apartment moved or moved down the block All it takes you can go to city hall. You can download it. You can do it right online the secretary of state's web's office website Um, we're going to talk about the secretary of state in a minute Um You can go to city hall now. Let's talk about burlington because I think most of the audience is watching us from burlington City hall is open eight to four thirty monday through friday. It is closed 12 30 to 130 and um for lunch But they are glad to register you my friends tensin and philip and sarah They're great people You can go on the secretary of state's website and Can do it online. I am a big fan of using the um using the voting form because I feel that um One for example when I just registered my friend I get they get a copy They get a carbon copy of this they can use that to get a library card where they live They also know they're registered. It also gives them some idea of like I andrew I live at 32 green street Okay, this is where I live. Um, it's a legal document that's signed and witnessed. Um I uh So It's 55 days to the election. So let's say you're watching this you're turning it on you're sitting around On the couch. I'm not registered. What do I do? You can go to city hall You can go to the secretary of state's website. You can give me a call. I work best on telephone. I'm an old timer So my telephone number is 802 540 07 17 that's 802 540 07 17 you can give me a call and hey if it's anywhere within 20 miles here I'll make it out to register you. Okay, and we'll grab a coffee and have a laugh too. How does that sound? um We see that so much is in play Okay, let's talk about what we have on tap for um For the races in vermont. Okay, we have the okay. Let's talk about the senate race again My buddy peter welch Is the congressman he is running for us senate. Okay, and I really believe he will be elected I'd endorse him. I'm working on his campaign. I think the world of him We also who was we all know that's uphill, but hopefully she can push fill a little left He has an enormous mandate. He needs to start using it Governor scott if you're in burlington and you're watching this You are a very popular governor.  Let's use That mandate for something there he is. Okay, that's that's one of the few republicans that we like up He's an honest man and a decent man Uh, I as a democrat will not be voting republican. I am on the democratic state committee and uh, I will not be voting You know, I vote the democratic ballot Um at the dnc in washington, there's a poster and the first rule is and it's underlined like 50 times is um Never and then an ever ever ever ever ever vote republican But governor scott I saw him at the fair where he was there for the 100th anniversary celebration along with my friend tim schae Who is the uh the head of champaign alley expo? They're those people are very kind people and governor scott. Um If you are lucky enough to get elected, let's spend some more time in burlington. Let's do more housing Let's work on opiates. Let's work on uvm Let's work on the north country. It's economic malaise up there more people Are dying that are being born in formal and that's a big problem Okay, we're gonna move on from governor scott because that would be a different show And I thank you kevin for putting him up there. Um, okay, so let's talk about lieutenant governor We've got uh former lieutenant governor. I bet you have a picture of him mr. David zuckerman Hey, there he is And you know, that's an old picture because he cut cut his ponytail and he donated the locks to um Charity to make wigs for cancer victims So david's a good man and he's running. Okay. We'll talk about him for a minute. Leave it up there He's running against uh state senator a guy named joe benning who is a moderate to conservative democrat is not a trump democrat Now I would think david would have the upper hand in this election, but we'll see what happens They'll both be campaigning hard david's done a good job. Um, it's a He and the governor. I I really want them to find some more common ground if they're both elected. That would be great Um, okay, also attorney general. We have charity clark who won a very Spirited primary over there she is. Hey, that's a nice picture. Excellent. I think that was taken at the capitol too and um charity is an assistant attorney general and manager of the attorneys at the At the attorney general's office and she in the primary She beat a guy. He did a great job too. He is uh, washington county prosecutor His name is rory t bolt an excellent guy nice nice guy Military veteran. He did a good job. We had two excellent candidates there. Um, let's talk about secretary state I think it was a bit of surprise. I thought the deputy secretary of state christ winters was going to win But um, sarah copeland hansis had a lot of name recognition She's a long time legislator in the majority in the majority party and democrats, obviously She represents bradford down by the connecticut river and uh, she won a very spirited very It was good. It was on the issues. It was really good. I'd like to thank chris winters He's a friend of mine and I also want to congratulate sarah. She did a great job. Hey, there she is excellent. Um and then State treasurer friend of mine great guy mike p check. He's running on a post. So congratulations mike I don't know if we have him. Um, she's not running again. And I want to wish the very very best to her She is about the best we have. She's such a kind wonderful person I hope you're doing well down in berry city. I hope you're feeling well I want to thank you for your millions of kindness to everybody And such a loyal good person and a loyal democrat um, and then also, um The auditor dug hoffer is running again and he will be reelected. He does a good job Solid democrat kind of fusion democrat prog. He's doing a good job I also must welcome back to city hall Ms. Samantha she and she was campaign manager for um She was campaign manager for molly gray And unfortunately molly came up a little short Samantha did an excellent job on the campaign. She is back in her former role as communications director For mayor murrow Weinberger. Do we have a picture of him? He's been mayor 10 years Been elected four times Friend of mine. He's I think I I'm a big fan of the mayor. There he is And that's by that new fountain looking good in that suit murrow. Um I also need to talk about the loss of a community leader and a good friend of mine His name was tony reddington anthony reddington. He died of died of cancer. He was 82 years of age And you might have known him if you ever went to the npa's He his big issue was the roundabouts and bike lanes, but he cared passionately Passionately for burlington. He was an outstanding guy We worked hard together on the npa steering committees. We went to so many dinners. He chaired so many meetings he He was for some things. He was against others He was a longtime state worker in both new hampshire and vermont. He was a graduate of norwich university His name was tony reddington on october 8th There's going to be a memorial service for him at the unitarian unit uu church Unitarian church top block of church street october 8th tony reddington rest in peace. You were a good brother, man Um, I miss you. I miss having tea with you at uncommon grounds and I sure miss uncommon grounds Okay, I've got let's see about 12 minutes left Let's talk again about okay I I hate to I I need to rehash this but let's talk about The 20 percent maybe 25 percent of people who are not registered to vote in vermont If you are a felon if you made a mistake And something happened some stuff went down. Okay in your youth Maybe it was bad. I'm sure it was bad But if you've paid if you if you are not if you are not on probation or not in prison You can vote and I'd be very honored to register you to vote. I just registered my 1650th voter Okay, um If you are going to school here if you're going to champlain college if you're going to uh, You know vermont, you know community college of vermont if you're going to Wonderful uvm if you're going to champlain st. Mike's I love them all Okay, if you're going to marlboro college, you're going to johnson state. You're going to middlebury I don't care where you're going linden state northern state now landmark college sterling college Goddard college You can register and vote in vermont if you are here you can vote here Unlike a lot of other states. We want you to vote Now in a lot of states they would say hey, andrew you move to texas. Where's your texas id? You're going to school here at university of texas Okay, and I'd say hey, I don't have texas id. I'm from vermont. I'm just down here going to school They would say i'm sorry. We can't register you they do that as close as new hampshire, which is 90 minutes from here So We think that's an impediment to voting so If you do not have vermont id you can register to vote with the last four digits of your social Okay, not we don't want your full social. I've registered more voters than anybody in the state of vermont that's what secretary states told me and We don't want your we don't want your full social. Um So you don't have to have a vermont id Let's say you've come upon some tough times and you don't really have a place to call home We can register you we can register if you get mail we can register you at A shelter we can let's say you're crashing with a friend your couch surfing as the kids say We can register you unlike a lot of states We want you to vote please we want you to vote and Uh, I did a project last winter. Thanks to usa today They had a thing on all 50 states their voting laws and I was able to sit down and look at it all and um It uh We really have the best rules. We have a 35 day period Of early voting so you can go to berlington city hall. You can go to hindsburg town hall and you can vote early We are going to be sent a ballot this year, which I think is fantastic I wish they had been sent when there was a primary but there was three ballots democrat progressive and republican They thought it was too big and too partisan to send but everyone is getting a ballot That's why I must stress if you lived on green street and you moved to pearl street That ballot is not going to follow you. Um, you need to change your address again You can give me a call 802 5407 17 go to town or city hall or go to the secretary states website um But that ballot is not going to follow you can also go to the polls, which is tuesday november 8th 7 a.m. To 7 p.m. I'm going to give you all the words in berlington right now ward one Up by uvm modern christie school right across from The red cross on mansfield avenue ward two my home ward six archibald street iaa also known as wheeler school ward three 120 north street um that is laurence barn school um ward four I believe that is saint marx church on the avenue. I don't have the address Ward five that would be bed burlington electric south end To all my friends in the in the five sisters. Hello, and we'll see you down there At burlington electric ward six That would be edmunds elementary and middle school right on main street um, and then ward seven is Uh the heinenberg senior center on goss court right past the shopping center So I oh and I forgot ward eight the newest ward Is at our wonderful public library, which is 235 235 college street So you've got so if you live up by uvm you could be voting in wards one you could be voting in wards five You could be voting in ward eight. Um, you can call the city clerk. That's 865 7000 You just press prompt one or you can stop in that's at 149 church street. They are open eight to 430 monday through friday Um, let's say you're not going to be around. Let's say you're going away for three months on sabbatical Or you're going hiking. You're doing the long trip. You're doing the long trail and then March walking on the appellation trail or you're going to san francisco to start a band We can send you an absentee ballot. Okay These elections really I know it's overused But these elections are going to be so important. I believe I think the house is going to come down to one or two seats And we've seen how the republicans and I know the democrats have done it before have gerrymandered the hell Out of some of these districts, especially out west and down south I think we are going to gain a couple seats in the senate And I think president biden is doing a good job.  Okay, and and and And miss harris and the first gent the second gentleman. Mr. I'm off. I love that guy Full disclosure. I am on the ballot Again, I'm running for my seventh term as justice of the peace I've just registered my 1650 third voter and I just performed just the other day my 150th wedding So I would like to ask for your vote. It's on the back side of the ballot There's 40 people running in only 15 wins. So please if if you know I ask that you vote democratic and I sure I hope you vote for andrew champagne We are going to close this the last couple minutes I am going to I have about three minutes left. So We will be on the air the second tuesday in october We will not be on the air the second tuesday in november Because that's the day of the elections and I will be working at the polls So remember again, we have same day registration. Let's say it's november 8th. You're like jeez. I need to vote You can same day. Okay. I have these here. Let's see. You've got some props for you Right way September 20th is national voter registration day Boy, that's a big day for me. I love it Please register to vote today September 20th november 8th, whatever it takes I have about two minutes left and I think Looking back in history when this show is looked at I think we're going to finish it with a tribute to the queen So if I can get those two pictures, there she is lila bet that was her nickname You know her mother queen mother lived to be 101 And I'd like to see the last picture of her so gracious. I think it's almost more beautiful in a way there she is she She was queen my entire life. Well, I look at her And look how happy the prime minister is to see her Um The whole empire from 1952 I was born in 1963 So put it this way my mother is 87 years old. She was 17 When the queen was was coronated now when I was 13 I went with my parents and my sister We went down to boston to see the tall ships Which were part of the american bicentennial and the queen Rode by in an open car with then governor michael de caucus. That was quite a day That was quite a day. That was july 13th 1976 I saw some pictures in the boston globe Well, I look at her. She's glowing there with all the promise Now as I said you can debate the empire all you want We know that many people have been discriminated murdered pilder pilfered In slaves because of the british empire at one time it took up one quarter Of the world's geography So she was there when it kind of ended But she kept a stiff upper lip You know her love of family her love of britain her love of scotland her mother was from scotland her love of horses and The don't complain Don't explain. That's the classic. I think some more people could use that probably even me But we're coming down. We have two minutes left and um the way that she conducted herself Was really really great and uh What we're going to do for the last minute of the show i'm going to take off my microphone I'm going to thank you and we're going to leave you with that picture and a little tribute to the queen Thanks so much


Hey, good morning, everyone welcome to the session attacking and defending kubernetes P e enclaves and critical infrastructure. My name is Robert Ficala I'm the co-chair of the kubernetes policy work group and a member of the cncf security tag Have led some security assessments in that group, and I'm also assisting with kubernetes third-party audit In my day job. I work with high security critical systems things in payments banking health care and government and Of course, I've enjoyed the Spanish hospitality as I hope you all have as well So what is a tee when when they assigned me the auditorium? I assume that Lots of people were coming for a free t-shirt, but we're not talking about teas in that sense talking about trusted execution environments These are hardware enabled Enclaves that allow you to protect your code and data while in use. So many of you are probably familiar with the concept of protecting data at rest on Distorage and in data stores and transit TLS TCP IP sockets protected by encryption integrity here. We're talking about actually making sure the code That is executing in the CPU is protected Isolated and the data is encrypted Just to show of a hands. How many of you are familiar with what T ease or enclaves are? So few few any of you using those in production today? So more the experimental stage. I think that's the norm So Those of you who may have done attack modeling Threat modeling or even trust modeling will at some point start making assumptions documenting those assumptions and if you're operating in User land usually you're making assumptions like I can trust my hardware provider I can trust my chip manufacturer. I can trust my cloud provider I can trust my sys admin my root users who are employed and background checked But what if you can't Who would who would need this level of trust and integrity? Well, we're talking about critical energy infrastructure. Well, really any critical physical infrastructure systems Defense military systems if there's a large financial Opportunity then you may be storing value in the billions of dollars and so it becomes a high value target So that's the audience. We're really addressing today Those are the attackers that we're interested in and those of us who are defending those are the environments that we're defending I Mentioned some of the use cases, but I think where T ease and enclaves really got their their start was Enabling a more scalable version of what had already been used for a decade plus things that were hardware-based and rooted a Trust chain so that you as a developer could deploy code in a secure way, but that was very hardware specific It was often dedicated hardware modules You might plug into a server or it was a specific board and a client desktop or laptop And so this was a way to really scale this up to cloud and make these more virtual But in general you can also use this to increase your compliance posture And we'll talk about a little about that at the end And if you're doing in a regulated environment GDPR of course is a common topic for us today operating in the EU then you might want to have a way to Prove that you are protecting that user data from the Cloud provider itself and then again as we get into blockchain and smart contracts if you want to protect Intellectual property doing machine learning and you want to be able to use data. That's not yours And you did or you and or you don't want to disclose your algorithms. These are all use cases for Hardware-based encryption hardware-based isolation And so that's a quote from the confidential computing folks you're basically trying to remove as much of the attack surface as possible Down to the as close to the hardware as you can get So if we take a quick deeper dive into what exactly this means at hardware level It's really a special set of registers and opcodes at the CPU level. That's interacting with usually a memory protection Co-processor or unit on the CPU and it's enabling the the separation of a trusted area in memory usually enabled at the BIOS level and then in a small amount of microcode and That allows you to marshal calls between a trusted region of memory an encrypted region of memory and Then outside of that enclave you can pass secrets in you can get secret data out encrypted And it's unique to that processor, right? So, you know you're operating in a particular environment and that you can you can verify that we'll talk a little bit more about that So it's authenticated as the data is passed in it is now Confidential and even at the code level you can be assured that the code itself Has been checked for integrity that no one has tampered with it. It's exactly the code that you expect So there are many well, there are a few chip implementations by far the largest is Intel's implementation SGX and they have some newer capabilities TDX Which we can talk about a little bit later. I Am not affiliated with Intel or any chip manufacturer. I'm not affiliated with any Enclave or TE software provider. I have no horse in this race. I am essentially an operator probably like many of you looking for a way to solve a particular problem and and SGX is one implementation. That's widely available arm and others are making progress but if you look at how that Memory encryption works you've you've got some reserve memory and You've got pages of memory in a lookup protected in in the microcode a Lookup table and then any time you deploy an enclave and any of that Reserved memory space for your enclave is managed in a in a cached Array so that you have a mapping between what pages are being used and how they are assigned to each enclave So an important part of how you establish this trust is that you need to know that the code and that metadata There's some cryptographic keys for that encryption There's cryptographic keys embedded into the hardware unit to establish that root of trust by the manufacturer need a way to Measure to a test that everything is exactly as you expect And so you're using things like cryptographic cryptographic hashing and asymmetric encryption So you're hashing all the information the metadata on the chip. You're hashing the the state of Kind of a bootstrap set of enclaves on the chip a provisioning enclave a signing enclave And you're able to to then know as the client in the untrusted space Whether you're operating in an environment that you expect So typically on the hardware they'll have special effuses that will Enable that root key and then typically there's a derivation key derivation function So you're kind of using key encryption keys and then eventually when you call these trusted functions to to pass things in and out of Untrusted space you're using those derived keys So when you when you initialize an enclave securely you've you're passing in secrets and keys from outside You're doing this attestation process. So you're saying that if two Enclaves on the same CPU need to communicate with each other that they know that each of those are Have not been tampered with and have integrity and have an identity and then if you need to Attest to some global registry so that you can move data across CPUs then you're usually attesting to something like an Intel Registry and that's why they've embedded their Public key in the in the chip so that you can make that secure connection to Intel and verify There is a on the chip there is a component We talked a little bit about a provisioning enclave to kind of bootstrap all this There's usually something a quoting enclave that manages that verification to to the global registry So data you need to have data that you've Operated on in the enclave need to somehow persist that outside the enclave And that's where SGX and and others arm have a scheme for sealing the data And then that way you can call special routines that will allow you to encrypt it with a key that you know came from the enclave Persist outside of the enclave and then be able to restore it back into the enclave and use it for later Otherwise if you if you're only operating on very small amounts of data You might not need this, but any any practical application we're dealing with machine learning Blockchains, etc. You're probably going to need to seal data and persist it outside of the enclave securely although I will note that newer generations of SGX chips do you have Expanded memory it used to be limited to you know a very small amount now it think it can go up to a terabyte Let's see. So how how to practically how do we make use of this? You have a few options you can kind of handcraft your code Re-architect your application to use only the specific o-calls and e-calls these Trusted entryways into the enclave between untrusted and trusted you can try to wrap it You can there's some code that we'll talk about that will allow you to Convert your existing code into enclave ready code And then kind of a newer option is to use things like wasm to create bite code And that that can be used across te architecture. So you get a little bit more portability and the idea is that you're getting The application you have today. You're just cross-compiling that So those of you who might be fans of Costa de Papel I'd like to put myself in the mentality of what would the professor do so Probably he wouldn't go for direct assault through the front door So you wouldn't attack the boundary directly although you might use that as a form of misdirection You would probably try to attack every part of the supply chain. You'd probably attack The personnel involved the cloud provider. You'd probably attack the provider hardware systems integration so interesting Reports in the last couple of months from some startups doing work on looking at Components on a board found that a vast majority of them have fakes So you're getting a bill of materials. It says it's from this manufacturer that manufacturer and you realize nope It's it's been tampered with or it's you know something off of a different market And it's been repackaged to look like the chip you're expecting so Your highly motivated Attacker for high-value target is going to make no assumptions, right? They're going to assume that all parts of this system are attackable and they're going to spend the time and the resources to do that So it's patient research and it's not not something that can be Accomplished with you know kind of in an academic exercise So to enable all that memory encryption the supervision of those O calls and e-calls in and out of the enclave CPU cash control Wear memories how memories laid out you've got to have a lot of features and then to build on top of that you've got to have You know firmware you got microcode you're going to have kernels and operating systems and drivers and then inside of your Application that you've now somehow enabled for enclave you've got this whole set of code all of which would be part of the trusted computing base or Attack service if you look at it from the perspective of an attacker So a big part of some of the shortcomings of enclaves is that they are susceptible to side-channel attacks So you can measure the the timing you can measure the rhythm the cadence of operations and then you can Baseline good versus bad you can tease out bits of a secret key just by measuring The kind of thermodynamics of what's happening over time And so you will talk a bit about some of the defenses at the end But that is a non-going concern and the chip manufacturers continue to layer on every generation defense techniques for side channels So I just I'm not going to go into the detail of what what this attack tree looks like But just to put out there the idea that every one of those CPU caches the bus caches the bios all of these have attacks that are documented either academically or in Some open source literature so it's it's not a given that just because it's in hardware It's secure. I think if you take away one thing today that you know trust is is very difficult in these types of systems You know, do you trust something because it comes in a box and has an Intel logo? Do you trust it because you hire a third-party? Evaluation you I mean and in smart cards and some phone manufacturers. They go through a certification process with labs Is that trustworthy? Maybe it's like risk and you put out all the designs for the hardware for all the and open source all the code Is that enough to be trusted or are enough? reasonably educated folks looking at that code in a meaningful way already just rely on Standards bodies and talks like this to make your own decision What I what I think I would have you come away with today is it's not a silver bullet. So I've heard some High-level hand-waving that if you put everything in the TE then you don't have to worry about XYZ That somehow it's bestowed this magic that because it's in a TE No other controls are required and it's perfectly secure. I think I would definitely take this A way today that that is not the case that you do have to be if anything more concerned and scrutinize more exactly what is going into your trusted computing base and try to minimize that attack surface All those knobs and levers that we looked at in implementing this memory segmentation memory isolation They offer attack points So where does Kubernetes fit so we're here at a Coupe gone obviously we're all interested in how Kubernetes can use this technology So the the most obvious way to think about this is at the container level at the pod level We wanted to play our workloads somewhat easily into Kubernetes. We Talking about that attack surface You probably don't want to bring the entire Kubernetes control plane Into that trusted computing base because again any any flaw in that trusted computing base is exploitable as attackable So you really want to constrain down to the most useful unit and for all of us in the Kubernetes environment That would ideally be the pod So that's I think we're going to focus most of our attention Now if you're trying to operate this you already have a tough job operating Kubernetes as it is Now as a dev ops person you may be required to restructure your application re architect Maybe cross-compile things you have to worry about how T's are communicating Do you put are you assigning workloads to the right nodes? Are you putting the right? Hardware do you have a mix of CPU nodes? They have the right feature flags and the bios? So It gets very very difficult very very quickly So we're going to talk a little bit about some open source help And this is again. I'm not affiliated with any of these projects So this is just a menu of options that are out there Some I've I've used some I haven't So open enclave, so I look at this as your first step So if you're you know Right above just taking the SDKs from the chip manufacturer and using their utilities open enclave adds and a layer of abstraction Right, so they're trying to get multi TE support cross OS support When you're developing for enclaves from just the SDKs You have a lot of responsibility the crypto libraries that they distribute are usually marked as not for production They may not have you know pass-fips You don't get any operating system. So you have to produce libraries of your own or Use existing libraries that have been tested on these enclaves So open enclave gives you a lot of that functionality at a kind of an SDK abstraction and makes it possible to do More powerful things in fact most of what we'll talk next in somewhere Another either uses open enclave directly or has learned a lot from open enclave and mirrored some of their approaches So the next level of abstraction is you can kind of wrap your Application into a unicolonel lib OS Basically, you're creating a process. So instead of having a modular OS with kernels drivers separated You're kind of taking the exact opposite route You're compiling everything into a static executable and that's what you're going to deploy in your pod So there are a couple of open-source projects that you should definitely take a look at Oclem and forgive the project folks if I mispronounce any of these Oclem is one Grameen is another used to be called graphene But I think there are it's important to note there are caveats and as an attack you're thinking These are attack points Some of the implementations maybe works in progress You know found a couple of example nuggets on on github and some of them rely on more academic notions of how to verify and There's a lot of attacks that are using things like return return oriented programming jump oriented programming So you try to understand how memory is written And and what timing and try to get control of the environment. So not all of these Open-source wrappers have been hardened against those attacks and probably not many of them have been studied and Oclem and Grameen are certainly the ones have been studied the most and use the most but there's definitely some Find print that you need to go through and ideally if you have the opportunity review the code yourself Here's just a quick over. I think Grameen is on the left Oclem on the right, but they basically You know worked within the host They have kind of an abstraction layer And and then they you execute your executable that manages all of the processes They have a tool chain that takes your your code and then verifies it and You can then deploy it in the enclave So there's another way to do it. It's kind of create a shim. So in clavar is an approach where you kind of create a shim they call it run e or run and They allow you to use your your containers They're OCI compliant pretty much out of the box, right? So you can now just run run or run e against your container and create an enclave compatible Container and they also like I say they piggyback on Oclem and Grameen and the wasm so Yeah, I think this one is a pretty easy way to get if you have a pod application You don't want to or can't do much refactoring and you're not that much interested in the details of how the different SDKs and Attestation plug-ins work. This is a pretty convenient way to look at it again The caveat there is now you're expanding your trusted computing base. So you're bringing in for all that convenience You're bringing in more code that is susceptible to attack So that you know folks can analyze the way that things are are written how the O calls and e-calls are they patterned and They can extract secrets if they do that level of attack So another approach is marble run And so they're trying to take the microservices approach giving you a lot more functionality around Managing the secrets, you know, you all the attestation It's really just you're defining YAML adjacent and it's like any other microservices infrastructure No code changes required. No special tooling required And they can deploy Grameen and Auclum apps as well. So it's kind of a nice Stack I think again the biggest concern I would have with this is that now you've added even more Convenience and functionality and even more to your TCB. So it requires you to really think through What are the trade-offs of you know, do you trust all of that code that providing you that infrastructure? Do you really need a microservices approach for this critical application or is this, you know, maybe something that is down the road? I'd say that the last one I Would take a look at is nArcs So in this case, they're have taking your code You don't have to make much code modification at all if any and you're cross-compiling that to to wasm so they manage all of the Functions for the O calls and the E calls. They're doing all the remote access station They've implemented pretty much everything you need to deploy your your wasm app The problem here, of course, is if you're not familiar with wasm If your application is not organized so that you can quickly partition it into cost-compileable components This might not be an option for you. I'd say, you know for fairly modular small applications This is a great idea and I think There's project the project is making a lot of fast progress. I think they'd not quite up to production standards I think they themselves would would note that in the documentation, but I think it's it's a way forward in the next couple of years So I've given kind of an overview. This is my take on if I lay out What are the what are the attributes we're looking for in a platform? And then we kind of overlay those approaches, you know come on the left The SDK the plugins you can use kind of off the shelf You know, you have to do everything yourself and you know while there's You know a very small trusted computing base You really have to do a lot of work, right? So you're kind of trying I'm trying to find as someone who's deploying these systems I'm trying to find the balance between Make it an easy enough for me to run real-world applications But do it enough of the legwork to make sure that I'm confident and can attest that I have a trust Trust computer base that I can I can myself Audit and verify so I think if I kind of my my choice and I think we talk about that a little bit Oh, I'll come back to that. Sorry. So if you're thinking about this from a defense perspective Talk about that, you know minimized in the trust computing base You do I would recommend that Intel and others have done some formal verification So that's where you model the system and use you know either higher order logic or symbolic logic to look at What the behavior of the system should be and then you compare that to the behavior of the actual system? I Would say for those open enclave even the Ocklam Grameen I think if they could benefit greatly from using that formal verification approach and You know, it's it's not a silver bullet either. You still have to continue to do that every change. It's not going to find Concrete bugs in you know code check-ins It's going to really model the system and find fundamental design flies, but I think it gives you a level of Integrity to the to the design that you can be more comfortable using a particular solution So on the hardware side, you know, the chip providers themselves are adding more control over the memory layout and memory access You know for those Return-oriented programming jump-oriented programming attacks, you know, it's all about understanding memory rights and reads and a particular sequence or a particular timing and and comparing that to Trying to extract from that a signal that gives you the the key or you know branch information and extracting out Either the secrets or understanding more about the algorithm and the code that's running inside So to to do to prevent that they are adding features There's some software approaches that come a software supervisor that can check those calls and either add random delays and things like that or just block We reassigned things all together Yeah, so there's Intel has TDX it's their newer capability and that's adding, you know different king to the memory encryption And it's you know adding more granularity to the Memory page encryption And it does have support on a case. I will note that The achy if you're running Kubernetes on Azure They have a lot of support for all the tools that I've shown again not affiliated with Azure But you you will find it easier to do some of your prototyping on Azure using their confidential AKS support So let's talk a quick bit about compliance compliance When I talk about compliance I'm usually talking in the form of like a government standard and something like NIST Where you have to demonstrate that you your system meets certain security controls So the security controls that I've listed here from this state 153 Rev five and they have different baselines high and moderate low usually for any kind of critical infrastructure or military system you're gonna be looking at high baseline and So they lay out specific requirements for a system, you know, you you've got to isolate and protect memory You've got to isolate processes And so all of the features we talked about earlier with enclaves really check these boxes. So It's not otherwise Possible without dedicated HSMs or other specialized hardware This makes it very easy to meet these in a kubernetes environment and at least You know document how enclaves are are being used to implement those controls there's another set of even more granular controls which if if you're contracting with government agencies they can layer on Specific controls that may not be in a particular baseline. So here again the formal formal model for your Verification is helpful. You're getting Non-monifiable executable. So that's a lot of these boxes get checked by using enclaves So where do we go from here? So this is this derived from an actual system build-out And you know for us we have to look at it from the attackers view and and the defenders view For us, you know, we really wanted to use things like marble run or an RX and arcs But again, we were very concerned about the the size and the scope of that TCB. So The other end of the spectrum we we didn't have the time We didn't have the developer team to write to the raw SDKs and the plug-ins So we kind of fell in that middle ground and and are using Testing both combination of the Acklem Grameen and then you know, we are looking at in clavary. I think our our current inclination is To not using clavary just given that extra level of Code that it adds with I think not not that much convenience not to say that it's not a good project It's just for us. We'd rather incur a little bit more of the pain In verifying and understanding how things are implemented and do a little bit more of that work So that we can have an understanding of that trusted competing base So we will be posting kind of build-out Updates and we'll be posting all of the designs and all the attack models all the Tax scripts will be posting that on our Twitter feed. You guys are definitely welcome to check it out and Take a look Just how are we doing on time? Are we have enough time for questions? Great Yeah, so the question did everyone hear the question the question is about You're protecting the key, but what about the supply chain code that you're pulling in so as as you're pulling in libraries and open source into your application that is part of the the trusted computing base that you're now relying on so The There's no real magic to how the enclave is going to protect the supply chain It will provide code integrity so that you know that the the code that you've compiled into your application Or that you've cross-compiled the wasm is the same code that you compile But it's not going to and then you know when you load it into the enclave It will verify cryptographically hash that it is that code So you know that it hasn't been modified from the time you compiled it and into the time It's running in the enclave, but up until the point where you are compiling in that code. That's your responsibility Right so and I think that probably represents the largest and most fruitful attack surface if I think of it as an attacker You know I can somewhat dismiss a lot of the hardware You know without I would say for a high critical system I'm absolutely gonna put that on my list, but the low-hanging fruit is to go after the supply chain Right, so I'm going to try to introduce very subtle timing Changes in open-source libraries that nobody really looks at too closely So I might go attack their github repos. I might attack their their JavaScript packages I'm going to try to exploit those return-oriented programming jump-oriented programming tricks and extract data out of the enclave using those open-source bugs or Malware hacks that I put into that open-source library So that's to me why I want to minimize that as much as possible and You know the the folks that open enclave You know I think would probably be the safest route where you really have to scrutinize everything you're bringing in But it just leaves a lot of work for you Yeah, so the question is if the orchestrator and control plane should essentially be in the enclave as well, right? So a couple of answers there one, you know just at a very high level There is a performance hit when you when you work with these enclaves, right? So you're losing a lot of the memory optimizations different levels of caching different, you know hardware Performance optimizations, you may be losing a lot of operating system caching and performance tuning So you have to consider what is the performance hit in using this and if I just stick the whole database or whole you know application stack and Control plane and kubernetes into the enclave itself, you know the performance hit is going to be significant Not to say it's impossible And certainly with those newer processors giving you more memory. It is possible Above and beyond performance you've you've got to look at why right? so if if you're following that attack tree and you're minimizing your trusted computing base That's kind of at odds within adding the whole control plane and the whole orchestrator in there as well You know so do I need to do that? What's what am I gaining by adding that in there? I don't trust the operator. That's explicitly part of our model. I don't trust the cloud operator I don't trust the root users of the system. I don't even trust the board manufacturer The only thing I trust is that intel or arm chip So everything else is about convenience really and you know developer productivity So I think it's just a trade-off you you you want to minimize the amount of code that you have to either formally verify or You know quasi formally verify and scrutinize and do code audits and code reviews and lab tests or whatever mechanism You're going to choose But as you expand that into kubernetes, I mean as I mentioned at the beginning. I'm helping the Six security group do the third party kubernetes security audit and that hasn't been done since 2019, right? So I'm you know don't know what's going to shake out of that, but I'm sure there are going to be a few things The attackers of course are going to be looking for every opportunity in every layer of kubernetes the implant code that will enable those memory layout memory timing attacks and So it just gives them a huge surface area. So I'd say for If you find something kind of a moderate level of risk, it's it's definitely something I'd consider but if you really It's you know the nuclear missiles. I think it's too much convenience to trade off Right. Thank you Rob. Great. Thank you everyone


But the governorship candidate of People's Democratic Party in the state, Oladik Pupua de Butu, has decried the harassment of members of his party in some areas of the state. The governorship candidate, who spoke shortly after voting at his Wesley Primary School Iqbaru polling booth, Ward 5 Units 4, said reports coming from some parts of the state indicated that thugs were allegedly disrupting the voting exercise where they are unable to manipulate the exercise. They called on the security agencies to leave up to the promises they made before the election. Speaking at the polling centre, Independence National Electric Commission, INEC officials assured citizens of being just India dealings. The reason that it has been today, because people really feel directly affected, but unfortunately people are being traumatized, the electorate is being beaten, the electorate is being harassed all over the state. Why? Simply because they want to exercise their franchise and vote. In the early days, let us see when the counting begins, because that is when the true sense of what we have done comes to the fore, and builds a hopeful and transparent society. In those foundations, we will be able to build a compassionate state and truly workable states where nobody is left behind, and ultimately will be a state that is fit for all of us to live in. I'm prosperous. Thank you very much. I said it and you heard me. I'm encouraged with the turnout because people are truly affected and they are responding in a true desire to improve their lot. Hello, hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.