Well, thank you for joining me this afternoon for this talk entitled Cloud Native Thread Modeling and Adversary Immunization, Picnic Sanctuos. My name is Rafiq Harabi. I've been the IT ward for almost 15 years, and I've been with Cystic for three and a half right now, working mainly with the customer in Europe and Middle East on Cloud Native Security advocacy and moving them security to the cloud. Before that, I've been working on consulting, go-to-cloud programs, mainly with consulting companies like Deloitte and entity data. So there is my LinkedIn profile, my Twitter, please feel free to reach me. So what we'll be talking about today, we start by talking about the Cloud Native application building blocks, how it's different from the legacy world. Then we'll get into the multitude of cloud attack surface and the different challenges that it come with. Then we'll get into the thread modeling, the different techniques that we use for the thread modeling, following by the Adversary Immunization for Cloud Native application. And finally, you finish by listing the tool that will help you to do this stuff plus takeaways. So let's start. On open time, it was quite simple to protect monolithic application. They are deployed in a kind of VM or physical services. And what you need to do is just putting a kind of firewall or EDM in front of it to detect any intrusion. But this is a little bit different or totally different when it comes to the cloud. First, because the cloud services are public, they are exposed to the outside world, you have different services. They are living together in your cloud account, your cloud project organization. And you need to define the right control access for each team or each service. Also, this complexity of multiple services together generate a lot of logs, and it will be really hard to detect unusual activity. Let's see how the cloud native application is built. So we have the cloud infrastructure. Then we have the workload that can be containers, serverless. Maybe some workloads coming from on-prem, just shift and lift. And all this stuff is working on top of Kubernetes, whatever is managed by your teams or you're taking one manager service from the cloud provider or container as a service. And we have a batch of, let's say, satellite services that you need for your application, mainly everything around identity and access, a network like load balancing and so on, managing the services like logging and monitoring, and finally everything around data like databases and objects and storage. So this is bringing different layers. So we can see in the middle you have your code. This is your business application that is delivered. Then you get this layer of abstraction or separation that is the container, then another layer, which is Kubernetes. We can imagine that you are deploying your application in specific namespace, so it gives you another layer of abstraction. And finally, we have the cloud provider. So we have these four C layers. And the challenges that is coming with the challenges that you have, first dynamic surface attack. For the simple reason that your developer team or your services team, we need to go back to a kind of central or enterprise architecture and ask for modification. They have a panel of services that are provided on the cloud, and they can't pick and trade the architecture depending on the business requirement. The second thing that those bad actors that are trying to get into your environment and steer, for example, some sensitive document, they are using the same tool. So if you are using Terraform to accelerate your cloud deployment, they may use Terraform to deploy any malicious stuff. So they are using the same tool, and they are moving to the same speed as you, which is not the same in DIGA CO2. Distributed and microservice, distributed system and microservice, they bring a lot of intercommunication that will bring more and more cores generated. And by the way, it will be really hard to detect any unusual activity, plus the lack of visibility when it comes to 100 of microservices talking together. And finally, your security team need to follow the same step as you, which is a little bit challenging in the enterprise world. So before going into thread modeling and adverse elimination, I'd like to mention this phrase from John Lambert. He's from Microsoft's security team. And I like this phrase because it's describing the way that attacker think and the way that defender think. So what he's saying, he's saying defenders think in lists. So usually you have a list of compliance, or you have a list of stuff that you need to report to your management, or you need to report to the authority because you have some regulation to comply with. But attacker, they are thinking totally different. They're trying to move from one step to another until they get access to your system and get what they want to get. So this is really important to keep in mind that you don't have to think about leases and just the kind of check leases to say, hey, I'm compliant. But you need to think in a way how the attacker is going in order to be able to protect your environment and your enterprise. So let's go with a couple of definitions for the guys that are not coming from security background. Thread modeling is the exercise to identify the different building blocks of your system. Then you didn't find the threat and the mitigation for this potential threat. And it's always concerning valuable assets. Let's say if you have, I would say, images that you are using in your public website and they are exposed in a three bucket, you don't never mind if someone access and get them. So it's always depending if the data is valuable or not, or the asset is valuable or not. The adversary emulation on the other side is the exercise to use the same tactics, techniques, and producer coming with those bad actors to mimic these tactics and be able to see and to test your system resiliency against that. So here we are taking the choice of a bad actor trying to mimic the same activities and make sure that our system is resilient against those attacks. We have different methodology for thread modeling or different techniques. The most known is tried from Microsoft. They've been developed by Microsoft. And here we split the thread in six categories. We have also known other known methodology or techniques like attack tree, where we are dispatching the system in a kind of a route and different lives and children. And when everything is true, the different children, we can identify an attack that is possible. And finally, Dataflow, which is a kind of graphical representation of the user or the end user or any other user on the system. And it can define the different interaction between the different blocks and can spot the risky configuration. So the pillars are the system architecture.  And you need to make sure that you have a bunch of actors identified, either like the people that are working on the system, or the people that are on the other side, but actors, then listing the different threads depending on the interaction on the system, and finally defining mitigation. The slide approach is coming with six categories, as I mentioned, spoofing, tempering, refrigeration, information disclosure, those, and escalation of privilege. And how it's going? Let's say that we have this example of a digital bank. We define the different blocks, then we define the different interaction between these blocks. And finally, we define the kind of trust boundary when those services or these blocks can make it together to lately identify any weak point and potential threat. Yes. So let's define a little bit the person that I've been talking about, the business owner who need to balance between the business requirement and the security requirement, the application developer who is helping identifying the architecture of the application, and also implementing the mitigation. The adversary who is trying to put his element in the shoes of attacker and try to mimic the same tactics. The defender who will be thinking about implementing mitigation. And finally, the security architect who will be advising around the different best practices and regulations that the company need to be compliant with. So let's deep into the dread modeling for cloud data application. I'll be going from containers, Kubernetes to the cloud, giving some examples how we do that. So just I'm spotting here the thread, container thread, from OWASP. So we have a kind of thread that is coming from Legacy World, although they're already related to specific architecture of containers. So let's, first of all, define a kind of data flow diagram. So we have a developer who is writing code, writing the container manifest, maybe a Dockerfile or other technology. Then he's pushing these to a repository. And from there, we have the bead and the push of the container image to a kind of container registry here. The next step will be pulling into the container host whatever is Kubernetes or not. And then we have different communication. Either a container has a privilege to access to the OS and the kernel, or the container will go to the Docker engine for some activities, and finally it goes to the kernel. So this is the different, and we have also containers to container communication. This is coming, for example, if you have the different package services that they can't communicate together, or maybe they don't have to communicate by there is a misconfiguration. So if I'd like to spot the thread vectors here, first of all, it would be a vulnerable OS on container engines that someone can hook into. That's like the most common threads. Vulnerable application, this is like the same as legacy world. Exposed container engine, we are not protecting your circuit on the container. And secure image registry, when someone can push an image or alter or temper an image and do some malicious activities. And privileged containers that can access to the host, plus misconfigured container. And also host escalation, plus finally having this unsubmitted network between the different container when I can hook from container A to B, and extract, for example, one database password through the secret or something similar, and be able to execute some lateral movement. So this is like the top seven or eight container thread vector. So I'm not listing everything here, but I'm giving some examples of the most popular ones. So the next step will be to define the container thread categorization of these threads. So you can see here that we are trying to put this together, for example, for this boot thing, someone who is accessing on the source repository, or someone who will be accessing on the container registry and trying to temper a container image. Also, for example, for the reputation, someone who is disabling the logs or modifying the log data for the naive service that can be on different layers, network, or storage, or so on. So the idea here that we start categorizing the threads that are in your context, and the next step will be to be able to do a mitigation or assessment first, and then mitigation for those threads. So this is something that we talk about later in the adversary emulation. Let's move now to the Kubernetes thread modeling. So similar to the container, we have a different layer of abstraction that's coming with Kubernetes by default. First of all, we have the cluster, the node, and the namespace, and the hub depot. So this is like a kind of different protection that it comes by default with Kubernetes, but are not sufficient. So let's see how we can identify that surface of Kubernetes. So here I'm putting the different components that are part of Kubernetes, worker nodes, master work, control pane, the registry. I'm taking this example from the CNCF financial user group that I've been doing an exercise about Kubernetes thread modeling a few years ago. So it's so talkative. So here's the idea that we start identifying the different boundaries. First of all, we have the machine segregation. We can see that we have three big compartments, the control pane, the worker host, and the image registry. Then we start defining the different boundaries. Here you can see, for example, for the control pane, we are defining one boundary for each component, API server, scheduler, and controller. And we are also defining another boundary for the API server and the ETCD server, because they are working together. Similar exercise for the worker node, when everything around kubelet and container registration could be defined as a trusted boundary. Same for kubuproxy, which is modifying the AP tables to make communication. And finally, the pods. On the other side, we can define another trusted boundary for the image repository when this is talking together, like getting the image, and so on. So let's say we have this different trust boundary. The next step in the exercise will be defining the data flow, how the data flow is going from one component to another. So let's assume that we would like to deploy one application, a sample application. So the user will be applying a deployment. So what will happen, they either kind of apply or mutate deployment, depending if the deployment exists or not. This is go to the controller. We send some data, and we get some data. And then we have the scheduler. If the deployment doesn't exist in the cluster, the scheduler will try to schedule the deployment. And he'll be talking to the kubelet, telling them, please pull me this pod. The kubelet will be talking to the container D, trying to double check if the image existing in the container, in the cache. If it's not the case, it will be pulled from the image repository. So we have this communication. And then what will happen, it will send back the image to the container D to have the run C running the container. And finally, we'll be defining the service end points. So we'll be pulling the service end point information. And the key proxy will be defining the API communication to be able to redirect every request to this specific pod. So you can see this is like one simple example that is like, you can see it's a little bit complex. So from that, you can start spotting and identifying the different threads. So for the purpose of the presentation, I just tried to summarize everything here, like removing a lot of blocks. That's just some common threads or attack victor that are for the kubelet. First of all, you have this access to the API server or ETCD. They are not protected by default in kubelet outside of the managed service, of course. So the idea that, hey, the first thread here that someone can hook in my API server, can hook on my ETCD, make some configuration, deploy some new workloads. The second thread, if you are deploying a dashboard, dashboard can be misconfigured. It can be an entry point for altering some stuff on the cluster. And we have also the same as the container. We have an access to the registry. And we can do some activity on that. So it's a malicious container that's coming from the registry. We also have the same, which is an application that with vulnerability, such as log for G when someone can use this vulnerability to do a kind of remote code execution. So it's still valid in case of Kubernetes. And then we have the gain access to the secret when someone can just get the secret. For example, connection to an external system or a database, because we are not defining the secret inside Kubernetes. And finally, we have the Docker daemon misconfiguration when someone can hook into the Docker daemon from Kubernetes. So let's move now to the cloud thread modeling. Using the same methodology, which is tried, you can see by default that we have these three layers, which is the cloud account, the organization, and the protection. Here I'm talking in the case of Google. I'm taking an example of Google Cloud Storage. And we try to define the different thread model that is coming with the service. So on the next slide here, what I'm doing, I'm putting Google Cloud Storage. But I'm putting also all the next services that are working with. So you can see that we need to define all this communication. Cannot take just the service, but all the communication to be able to see the big picture. So we see the big picture, and we try to slice and dice and define each thread. So I'm taking just one example here, which is an admin user who will be applying to access to one packet. So the first thing, either he will go to the Google Cloud Console or maybe going to the cloud API, and then we check the organization policy. And depending on that, we give him access to the cloud storage service. And finally, access to the bucket. And of course, if I'm enabling logging and monitoring, I would get one entry in my logs and one alert going to the event if there is an alert defining. So this is like a simple example. How it's focused for just one access. But here, I'm putting another example, which is putting everything together, like the different actors and the different communication. You see that it's become very, very complex. That's why it's usually an iterative exercise when you start from one scenario, one thread, and then adding another thread and try to mitigate. So here, first of all, what I'll be doing, I'll be doing the different assets that I would like to protect. So I have a different user that's accessing my storage. They have tokens. So I would like to protect those tokens. I also have the content of the bucket. This is an asset that is valuable for me. And of course, I have the log data that may be valuable as well if it contains some high-sensitive information. So this is the three assets that I would like to protect. And here, I will be starting to find a different malicious user that can appear. So first of all, we can have an internal attacker or an internal malicious user that you want to get some of the issue for him or for any other reason. So this is like one thread or like one thread after that I have to spot. Also, compromise it on the user who someone just access to his laptop or his workstation. Compromise it external user that's coming through external integration, external attack that gain access over internet and do some misconfiguration. Yeah, Google Cloud infrastructure agencies. It can happen. So I have to spot that as well. And after defining all the actors, I will try to see if there is any thread for each actor. So here, I'm taking the example of someone trying to access a bucket through one of these, either he's an admin user, he's a storage user, or he's like coming from another DCP project. So here, you can see that the potential thread is chef of credential or access token that can be used for malicious activity. And I'm defining three actors. He's defining the internal actor, the malicious user, internal malicious user, and the external attacker over internet. So this is like the three types. And then I'm trying to see how he can get to the asset. So here, I can see that there's a different path. And once this happened, back that if he's like a normal user, he can get access to read write to the asset and get some data. And if he's an admin user, he can alter or modify the security sitting for the bucket. So this is the impact. And here, I'm doing my category. So I'm telling that this is coming in this specific category. So the next step will be trying to mitigate these. So here, I'm putting a kind of example just for the case of the demo. But yeah, you can define one or multiple mitigation for that. So let's go to the next step. So the first step is thread modeling here. I'm defining my system. I'm spotting my threats. And I'm trying to define all the threats and define mitigation. But this is a very time-wasting and very penny exercise. So the idea here that we need some tools or some adversary methodology to be able to run this in iterative ways. So the most common framework for that is Mitre attack. It's a framework that defines common language plus different adversary behavior to define the security poster of different layer of IT infrastructure, including cloud provider, SaaS, and so on. And it's coming from the Mitre organization, which is a non-profit organization. So here we define the Mitre matrix, which is defining different tactics. You can see that the tactics goes from left to right. This is just from the initial access until gaining access into the system. So then we're defining the different techniques. So each tactics come with different techniques. So you can see that I have different techniques to have an initial access to environment. And each technique will be defining one or more sub-techniques. And within the sub-techniques, we get the procedure. This is the example how you can do it, depending on the different thread after defining the real ones. Then the mitigation. How can I mitigate this thread? And finally, defining the detection. So I would like to detect, if this has happened for me, what should I do in order to be able to detect this kind of thread? So this is already useful to start doing adversary mitigation. We have this for container. So we can see that on this view, we have all the different techniques, tactics, techniques, and procedure for container. And similarly, we have one made by Microsoft for Kubernetes. So it's concentrated around Kubernetes. You have the different tactics, techniques, and procedure. We have also another one for cloud providers. So we can get this for the top three cloud provider, AWS, Google, and Azure. And you can see the same way you have the different procedure depending on each cloud provider. How would the cloud attack emulation work for work? First of all, I have to choose one by three attack techniques. So I have to choose to test one by one, like the atomic elementary. And secondly, and then I would take the test one technique. Then I will execute the procedure, get the result from the procedure, analyze the result, see if I have thread or read thread or not. And from there, I will implement mitigation and go to the next step. And you can see it's an iterative process that's go over and over and over. It never stopped because behind the senior developer, we develop new servers, change existing services, and changing the tech surface and the stuff behind. So we need to have this idea in mind set that this is an iterative workflow the same way you are doing continuous delivery or continuous deployment. Yeah, the last part of the presentation, I'll be talking about different open source tooling that will help you doing thread modeling and adversary omidation. The first one is atomic red team from Red Canary. It's open source. They offer coverage for cloud infrastructure, AWS, Azure, and GCP, beside the Kubernetes and containers. And they have a library of tests mapped to the Mitre attack framework that I showed previously. So I'm putting here one example of a procedure. Here you can see that we are trying here to create a key, a new access key in IEWS IAM. Secondly, I'm trying to save this key to a file called AWSSecret.credential.credits. And then I'll be trying to extract the AWSSecret. So here you can see that we start thinking about automation so we can do it in an iterative way. And each time I have a new application or I have a new environment, I can apply the same paradigm. A second example that I find really interesting for someone who just started doing thread modeling. This is from a company called Redquart. And what is good, their example, they are quite simple. So they give you a very simple example. Like here you can see that we have a Kubernetes manifest that you can deploy and you can mimic the attack. So this is something really interesting for someone who will be starting learning adversary immigration for Kubernetes. Caldera is a complementary tool for automated teams. So they're offering this kind of automation around adversary immigration. So they have a building behavior, map it to attack imagery. So you can choose one of the scenario or multiple scenario. And you can't run this scenario in an automated way, gathering the logs and spot what is missing for your system. So this is really interesting when you wanted to start automating the adversary omidation. You have attack workbench. It's a kind of workbench when you start documenting, exploring, creating your own knowledge base around what's happening in your environment. So it's an overextension for the military attack. So you can just building your own something that is oriented and customized for the real purpose of your environment and your enterprise or your company. We have also the Maitre detect. This is not an official tool from Maitre. But they give an interesting idea about spotting the different, let's say, gaps in detection and coverage. So let me give you an example. They can tell you, for example, if you wanted to do detection around Kubernetes, someone who alter something, a cluster load, create a cluster load inside Kubernetes or something similar. And you don't have Kubernetes load activated.  So it's ingesting and defining, prioritizing which kind of logs and ingesting you need to have outside of seams, including seamstress and other tools. AWS Thread Composer, quite interesting. So you define your application flow. You define your application metadata and assumption. You can even upload one diagram for the application. And then this will help AWS to list the threads and provide you the mitigation flow. By the end, you will get something like this, which is defining the different thread that you have on your system. If they are high, if they are medium, if they are low. And then you have the different category related to the stride framework. So here you can see the different categories. So it's really interesting because it offers a high level definition of thread that is in your application. Stratosthread team, quite interesting. They offer coverage for AWS, GCP, Azure, and Kubernetes. And here, the idea that you have a list of procedures of attack scenarios that are ready to use. So all that you have to do is just select one of these attacks, run again infrastructure, and by the end you get the list of the results depending on the configuration of your infrastructure or the configuration of your environment. And what is good, as I mentioned, they offer like 43 major cloud providers plus Kubernetes. I'm listing here also a couple of offensive tool kits regarding to the major three cloud provider. We have two tools from Reno Security. They are quite interesting. The first one is called Paco, which is an exploitation framework for AWS. And this is coming with another tool or another application that you can use for learning, which is called Cloud Goat. And this is a learnable by design application based on AWS. So this is the kind of the tool that you can use to start learning about adversary emulation. For Microsoft, we have two tools that you can use using, Microburst and PowerZeeve. And for Google, you have the Google Cloud Platform security control mapping to Mitre attack. So this is the most popular, I would say, tools or toolkits that you can use to start learning about it. So what we can take back from this talk, first, security need to be automated, especially in cloud area, because you have to follow up your DevOps team, your DevOps team. So you start thinking about doing the same way as infrastructure as a course, having policy as a code, and having a policy-driven security. Another thing that you can use, the cloud-native monitoring observability tool or logging tools to get all the ingestion and start building some detection around that. And just keep in mind that you need to be really agile when you come to the policy, because it changes from one environment to another from one data to another in cloud. And finally, as I mentioned earlier in this talk, I think in graphs, not lists. I put a couple of further reading here. That's quite interesting that you can take your time and read when you are back home. I think that's all from you today. Thank you very much. Don't forget to rate the session. You have the QR code, and any question is welcome. Thank you. Go ahead, please. So thank you for presentation. Very interesting. So it seems like dealing with cloud-native application security is very challenging. And so I'm wondering if there is an enterprise-lave application to deal with this. You mean for enterprise, right? Yes, enterprise-lave. OK. Gartner defined recently what we call it CNAAP, cloud-native application posture management, that define for blocks. These main four blocks are CWPP, which stands for Cloud Workload Protection Platform. So everything around the protecting workloads, such as containers and hostages. We have the CSPM, the second capability in CNAAP, which is Cloud Security Poster Management, everything around cloud configuration and inventory. And the third building block is CIM, or CIM, which is standing for Cloud Entitlement Management, Infrastructure Entitlement Management. And this is everything around AAM access. So you need to make sure that the right person or the right service have the right access to the right service or the site asset at the right time. So if someone coming just to do some debugging production, you give him one token that takes two or three hours. And the final block, which is cloud detection and reference, everything that is trying to spot any attack real time based on system activities plus ingesting load from cloud provider. So there is a bunch of vendors, but yeah. But if you wanted to do it with open source tools, you can do it. But you need to do a lot of integration. But yeah, for each piece you have an open source tool. But yeah, you have to do a lot of integration. So now that I have done thread modeling, I have enumerated my threads. How do I go about ranking threads in a risk-based way and communicate the priorities? Very nice question. So yeah, first of all, you need to do context-based. And let's take an example of vulnerability management. Let's say that you have a container that is running and you have 300 vulnerable. First step, you say how from this 300, which one are high-end critical? So let's say from 300, you get 100, they are high-end critical. The second step is saying which one are really running in production. So there is some techniques to detect this. So you have, let's say, from 100, you get 80 running in production. The third one, you say which one they have exploit? Public exploit on the internet. Because if there is a public exploit, anyone can get the public exploit and try to run the vulnerability. And fourth is having fix. So let's say that from 80, 40 they have public exploit and 30 they have a fix. So for your developer team or DevOps team or infrastructure team, there is no excuse to go and fix it immediately. Because you know that this library or this dependency they have a fix. So this is like the kind of prioritization for, okay, the kind of presentation for vulnerability management on the cloud side. You need to think on the other side, for example, a bucket that is public, encrypted, private, have access to internet and stuff like this. So it's a little bit different from the cloud configuration. Thank you very much. Thank you all. You can join me on Cystic Booth later. If you have any question, if you want to see a demo or stuff like this, I'll be here today, tomorrow, and on Thursday on Cystic Booth, yeah, please come and have a great discussion. Thank you very much.


Okay. Hi everybody. Thank you for coming. My name is Sonia. I work in the community management division at the OpenStack Foundation And part of my role is to also manage to the ambassador program. These lovely people who you see sitting behind me So just first No, we're not nice girl No, okay. We're not moving Here we go. Okay So So the purpose just want to give you guys an overview of why we did this and why the program is here So then you have an understanding of also where you can get help from these guys and what they can do for you So the purpose of why it all started was firstly to improve communication between the foundation and the user groups So we have user groups all over the world in many different regions So it's hard to keep a track of everything But if we have one person or a couple of people in each place who can talk to the user groups hear what they Are saying and what feedback they have it makes our job a lot easier to make it better for the user groups So these guys are really pivotal part of us knowing what's going on with them The second part is mentoring and advice for user groups So when they first start out there are times when they're not sure what to do Whether there's a particular sponsor they should seek out or where to get sponsors who should speak The list goes on there's a great number of things that have to be done to get a user group up and running So part of these guys job is to help those new ones The new groups get through that process and then also if there's questions that come up along the way for a more Experienced group. They can also guide them and the third one is advocating for open stacks So attending open stack day speaking on behalf of the technology and promoting how great it is That's that's part of this role also like getting out there networking and getting the word out and Lastly one of the biggest benefits is their local knowledge So being able to know what's going on in the region and what the culture is all about that really helps with improving that Communication and also being in a smooth process within that region So they do a fantastic job of all these things and I'm going to pass on to Lisa who's going to introduce herself Okay, thank you very much Sonia and also. Thank you very much Sonia for everything you've done Sonia Please give Sonia a big round of applause Sonia has come on board very recently and she works for a town fact field who we all know and love and and she's come up to speed really quickly and And and and she does this all from Australia, which is like a completely different time zone So it just proves that you know, it doesn't matter where you are located Graphically wise and and we just are so proud of her. So thank you so much for all you've done in a really short period of time as she said, I'm Lisa Lisa Marine Ampe you can call me Lisa and I run the San Francisco Bay Area user group Which I might venture to say is the world's largest open-stuck user group. I don't know maybe maybe Um, yeah, no not just showing off. It's we're lucky. We were the first ones. We're meetup.com slash open stack and And we get a lot of international Participation as well. We're six thousand plus members and we do that because we We broadcast our meetups through through Google Hangouts. I do to a month We always record the sessions and put them on the website their content is out there It's fabulous and we try to help the other geos just by giving the content out there And and so it's and I send news newsletters out by monthly as well to all those six thousand members We we negotiate, you know discounts for them. It passes the conference passes and things like that So so we really try to try to go to bat for our users and and even in other geos So we feel quite lucky to have a six thousand plus user group membership And I and I am the US open-stack ambassador. I guess that's what you probably wanted me to say I I'm very proud to very quickly be sharing this role with Sheila Who is hopefully gonna help me do the the east coast because the US is big And so I will I think at that point do everything west of the Mississippi I love how they decide that the US is divided by the Mississippi River because that's not even half of The I mean it's kind of more like oh the people on the east coast like the the like where the parts of the hurricanes hit We'll give that to Sheila, but Lisa you have everything else So anyway, it's a big country and so we might negotiate territory We might like redistrict here not to like bring up a sore spot Politically speaking, but anyway, so I'm US ambassador And if you are in the US and particularly if you're in the West Coast ping me and then the fabulous Sheila Who's sitting there waving this soon to be helping us on the east coast as well and super qualified She does Northern Virginia and she's run meet-ups for years. So So, thank you. Thank you all for coming. Oh You are having Mike. Yeah, so I'm Erwin Galen Ambassador for West Europe. I'm running a open-stack user group for France since five years On our ambassador since the beginning of the program. So so we are very proud to Integrate a new ambassador. So Lisa Marie for us. You are like a big president for us unique New things with ambassador not only running Your user groups so during this session we will make a report about about the community about new new members on new action of the groups Okay, so my name is Martin kitchen. I'm also the ambassador for Europe together with Erwin and I'm organizing the user group in Hungary and organizing the open-stack day in Budapest So Yeah, that's all And my name is Marcelo. I am the ambassador for Latin America and I help some countries like Brazil, Argentina, Chile, Peru and other countries there and Also, I'm in coordinator of Brazil user group and organizer of the open-stack day Brazil Hi, my name is Akira Hasegawa from Japan and I'm the first Open-stack days organizers and now open-stack days is a kind of the very important Events for the local user group. I would like to share the such kind of information and Sharing the such knowledge is with you and so on. Thank you so much and I'm Akira Yoshiyama from Japan I'm I am one of Web administrator of Japan open-stack user group and Thank you for coming We spoke of Lisa Marie. So say you are doing this for a long time But new new in the group and also a new ambassador since the last Open-stack summit in Barcelona Ilya Alex Segev Who is based in Russia? So here you have the complete list of ambassador. So US will change soon Okay, so one of So we are in continuous Link with all user groups and since the last open-stack summit The new logo was published but all all the user group was complaining that was their logo So so yeah, so you have shared this to to the user. So now Now you're complaining. We liked the square. We liked it. Just it's good change. It's good Not complaining. I loved I love my little stickers complaining not not to have received a new logo Design so We won't get any new logos and this is me right so we can Create some print materials with the existing logos and we will keep it for a little bit longer time You know the the first question I got asked in January when you put out the new logo and I put it on the the website and I put it on the Twitter feed And I we did the meet-up at GoDaddy right where they where they talked about running docker on open-stack And it was an awesome user group thing And it was I think in January and the first question. They're like, when are the t-shirts coming out? Okay We just got the logo so if you want to give us t-shirts apparently the user group is is clamoring for them You work on it. Okay. We I think we even have a sponsor for it from the I think the Trilio guy signed up for that Yeah, basically, it is very important question and I think the foundation is working on that during the last three years Oh, yeah, the t-shirts can get not exactly the shirts But some swags for the user groups might be the most maybe what we can give away for them I think it is any important integration with open stack. We got that covered. But when is the swag coming? Don't you though with the new open-stack logo Gary Kovorkin Pasadena an LA user group committee. Thank you so much, Gary Yeah, can we just know who's here? So who here runs a user group? Can you raise your hand? Yeah, love it. Okay, awesome From all over the world, too. Okay, cool. Just so we know who we're talking to Okay, and basically we get some new you official user group statuses for for example, we have a new official user group in London in Europe and Yeah, if I we are realizing well, we have new official user group in Los Angeles and San Diego So basically what this official status means that basically we have some requirements against the groups that we will have a very diverse organizer set up for the user group and Basically, they need to do Meetings very regularly. It means it can be even three months or every month or every week It depends on the local group under so it does not to be driven by only one company So you can find out on the open stack ambassador page on on groups that open stack that are all these rules so So with this status you have support with more support with a foundation on the you can apply You can apply on the on the website. So also a big list of new user groups. So Phoenix Ren in France so in in a independent part of France And also Belarus and Mexico City and Santiago For South America. So quite quite active So when when they asked me to be ambassador in the beginning of the year The first thing I tried to do is recognize the user groups that were Contributing so much to our community and you know, we kind of knew who they were because you know Who's out there just doing the work and putting themselves out there? I gave Gary a shout out because of the work He's doing in Pasadena for for many years has been so fantastic and I for some reason he wasn't recognized as an official user group if you go and look at the I Track the US. So we've got nine official which means like if you look at the User groups, they have the red logo with the orange the red square the red open stack logo Do you have an official name for that the red open stack square that thing? So there's his red and then the the 36th of the rest of them in the US are we're gray and So I started looking at that.  So we started figuring out, you know what it takes to become an official user group And it turns out he was doing all the things for so long Did John Stardar us in San Diego also? The best candidate for that and so the first thing I did as ambassador was was to reach out back to Sonya and Tom and just Be like hey these guys are bringing it, you know every month in their community They've been doing it for so long and they need to have this official user group status So, you know if those of you that are running user groups in your community and you don't have the official status You might should have it And it might just be a matter of contacting your ambassador and figuring out how to get that official status And then and then and then having your ambassador really showcase the fabulous things that you're doing in your user community And maybe later if we have time I'll talk about some of the amazing things that Gary and John are doing and in LA and San Diego And even what we're doing in the SF Bay, but that those that was my first task I went after those two and Coming after the rest of us next because I know there's a lot of goodness happening out there in other regions So also on the side are supporting events so one of the event we have supported for With a foundation for last year is for them. So a few people in the audience. We are also at this event So a big event with more that's six thousand people And also about sadder most of ambassador are running opens tag day So they they they help new new groups who want to to launch this this type of event so since the last last summit and huge number of Open-stack day have been launched. So we can speak of Prague in France. We we have launched as a first Open-stack day for Asia, so Thailand So Thailand is maybe first open-stack days but already in Asia have the open-stack days event several countries. Yes So Japan you were saying Japan is just gives a number of your open-stack day, which is Japan so you know the open-stack day is originally founded in the Tokyo and this one our event is Around the two thousand three thousand people and the two-day event. So, you know, the budget is very big It's pretty hard to manage in that if you can share such kind of the knowledge It's also welcome and yes so it could be a good objective to To have such high number of attendees and for for us also to to new open-stack day, so Yeah, so we we did I think the new ones were New York Which was in New York City and Mountain West which we did in Salt Lake City, which was awesome To cover Joseph George was was part of that Gary was part of that community So but we had the ones that were established we we did open-stack Silicon Valley Which was you know pretty well attended and open-stack Seattle we did as well So we had the regular ones, but we did add New York and Mountain West So again later if we have time we might talk about what was thinking about doing for open-stack days this year We're gonna probably do something very different There's nothing on the schedule now for for the US open-stack days because we have some that some things in process But those were the new ones, but don't expect them to be that this year Okay, so now Martin some some new data about the community. Yeah, basically We just need to see the numbers we have fantastic growth and I think the user group community size is very well balanced between the continents of the world So maybe we can improve somewhere in South America and in Africa and if we are looking for for the overall growth since Barcelona, so the North America has fantastic numbers and And everything is growing very well This is hilarious. We're like the smallest, but you guys know with statistics, right? It's hard to grow Percentage-wise when you're already really big. I'm looking at this.   Okay. Anyway, just in case you're just glancing at this and not paying attention The base was a little bit different Okay, just saying oh John you're here John Sardara San Diego user group I was talking about you earlier and And Tom I was talking about you and now I'm seeing people I'm gonna stop talking about people because I don't talk about people when they're in the room You're on your own kidding So we are speaking of open-stack events. So we have we have started to To report for the so you said for us. It's not still completely defined the scheduling. No Do you want to talk about that now? Okay, so speaking of John Sardara's And and Robert Kathy and the people who have been involved at Gary Kvorkin the people have been involved in Bringing us these open-stack days of the US. So last year we did Silicon Valley, Salt Lake City, New York Mountain West and Texas and Virginia got canceled right we didn't end up doing Virginia. Do we do Virginia? No, okay So we had a few others planned, but I think those are the four that we actually ended up doing This is a hard thing for resources. It's a hard thing for the foundation to support It's a lot of travel for the presenters. It's just a lot And we can't thanks Denise who is working a lot to support in which region? For from the foundation to help for organizations. Yes, so then you know So we were so this year and I really got a credit John for this to coming up with a way to kind of Franchise this if we can use a business term or templatize it and figure out how can we make this easier on? Everybody on the speakers on the foundation on the regions Particularly the regions who it's you know Silicon Valley is easy because we we have a lot of content there that just exists there and people will come there And we have speakers there But what about the regions where it's a little bit harder to get the speakers and it's a little bit harder to get the people so John came up with this phenomenal idea about how to kind of build a template and more franchise this Maybe hit universities so that the you know Maybe we make it like a meet-up But an all-day thing and it's technical content and it has hands-on labs and it and it's like a this kind of glorified meet-up and it has more you know Presentations at the end, but you know we get cheap resources because the university signs up and we get you know cheap Servers and storage and that were you know the compute and all that because the university signs up And then or we get a group of speakers who are willing to commit to three different open-stack days Okay, you live in Silicon Valley, but then you all you're going to do Portland. You're also going to do Colorado So we're working this out still and and if you have thoughts and want to help us, you know, let us know But with the US we don't want to do what we did last year Where we just kind of exhausted the concept and we had so you know and it was this I think I spoke at all four of them And you were probably at all four of them and and as were you I believe and so You know and I and probably can point to the foundation members here that also had to cover all four of them So we're trying to figure out how to best support the community in a way to bring the resources to the areas that don't normally get The resources but can't support You know trying to fill the rooms and get all the money and get all the contents and all that So it's a little bit of a work in process for the US for this summer And we'll kick it off with the open-stack seventh birthday party That'll probably be the first wave of it with hands-on trainings and labs and things like that And then we'll go into open-stack days from there and did it work? Did it work? Okay Was it successful? Yeah, yeah Yeah, so we might try that and John's putting together a phenomenal blueprint for that Okay. Yeah, yeah, you could do it in Europe that way as well or whatever the regions, you know We want to package this, you know, open-stack days in a box. Does that work? Yeah, but basically it is a bit more complex question because you need to manage the sponsorship and everything It is not always as trivial But also maybe you do it that way too, right? But yeah, because we were discussing about difficulties for some even to get sponsors So also perhaps it could be for some groups helping to share sponsor for a tour. It's like a big rock band Sponsor the tour. You can song and you would make the battery, Martin So so you are sharing the sponsor also could could be an idea you were speaking of Japan Where you have a huge budget on the and it could be helpful of course Sponsorship is the one with a nightmare for me because of the budget Also, you can see the each region have the same month same days For example, June is maybe Europe and July is Asia like that. So we are currently Controlling the How often and when we will held the open-stack days and this case maybe the contents material and Sponsor budget is also can match in the some regions. I think but it's not working well Not started yet, but so that's kind of the yes Activities also good because of the you can see the lot of the days event and maybe the foundations costs and I mean the Travel and give the sessions. It's also the big effort to the days event so we need to reduce the such kind of cost and some Such kind of things who I need I think so So but of course it's Kind of the move and and Maybe the last year Open-stack days event held in the more than 20 Around 30s in the world and this year maybe more than 30 hot event in the all-around world so we have to how to say Need more the change and Finding out the goods process or something we need to discussing it more and more I think yes What do you think I'm also I have a question for you guys Do you find That you get more out of an open-stack days and you would get just running your meet-up your monthly meet-up I mean you could take that content and And offer the same content over you could do it monthly by monthly, you know by weekly So why is it over a meet-up and I'm just being a little bit devil's advocate, but It's a yes my opinion, but why I started the open-stack days because Such a meet-up. It's Very the frequently doing but it's only for the one technology sites and Nobody can educate the Open-stack market itself So it's better to do the little bit more Venus side event in the locally That's why I started the days. So this event is not only the technology, but also the marketing and Businesses user experience such kind of the things is mixed on the event. So Globally we can do the such kind of things in this global summit, but in the local there is nothing So that's why yes, it's a maybe the differences between the meet-up and the dates In like in Brazil we doing regular meet-ups more not so big like you open-stack day and Talk about one on the subject no no no any subject Yeah, basically my experience that Yeah, my experience that So my experience that With the open-stack days we can reach a very different audience So the meet-ups are providing a very good base for an initial audience But with the open-stack days we usually are shooting on a region so the meet-ups used to happen usually after work during During a work day and and the open-stack days usually a one day or a larger scale events where usually Most of the people from the region we had basically visitors from More than 10 countries for the Hungarian event So it is the largest event in the region Yeah, it's really more young the business and for for for friends We are running a really technical event So some some events are less technical for beginners, but it's really driving different type of people You have still lots of technical people but but more business and people also who want to to discover open-stack So and I think some people who know open-stack for a long time like Speaking of veteran they are still waiting this type of event because they know open-stack So perhaps some guys are not coming in meet-up, but they are coming to this big event because they will choose content on They will have lots of content for for a big event like open-stack day. I Think for us it's a little different because we do a summit here in the US or in North America So there is a place for the marketing and the vendors to go and and I I'd I totally get your point That's what I wanted you to say You know the the difference between a meet-up which is not vendor-oriented and not a vendor pitch in any way Whereas you get a little bit of an opportunity for that at the at the days where you have booths and things like that It's a little mini summit and you're bringing it to regions that don't get a summit in North America We do get a summit so we have a little bit of that and and you know I want to talk to the foundation about this are we pulling from what would be at the summit You know when I I've been running this user group almost four years now And and over the years when I asked for a show of hands of who's going to the next open-stack summit over the last four years that Show of hands has been decreasing Like by a large mark I mean in the early days it would be like half the room was going to a summit and then when for Bartholona No one except for the presenters. I had in the room Like I think I had Hirschfield presenting because he flew in for it and one of the Starmer's in it Me and and Sean Roberts was there and we were the only ones who were going to Barcelona So we were like wow and the room had over a hundred and seventy-five people in it for that particular meet-up We were doing Kubernetes as the underlive open stack was a very popular topic and so I thought wow Okay, so this is why we bring the content to you because you're not necessarily going to go to the summit Regardless of this this meet-up or not. I mean it had nothing to do with us So the open-stack days I think are an opportunity to bring content like the meet-ups to regions that where people aren't traveling travel budgets Aren't what they used to be. It's just a different focus So I was curious about that for the other regions that don't actually get an open-stack summit that the open-stack days are probably even Maybe more valuable. That's why I asked However, how about the upstream training such kind of the things is doing on the day's event in us or I mean the open-stack newcomer need some Contribution education and this global summit doing the upstream training and We in Japan we Open-stack days doing keep doing the ups local up to it training to the people Because of the expanding a much more new comets to the open-stack Communities so such kind of the things is also I think the very useful and things in the base event I think yeah okay, basically we have a few minutes back and I like to welcome Sonya on board and and anyway, it is good that you are here for us and I Hope we will see some improvements in the communication between the ambassadors and foundation and between the ambassadors and the user groups and and we have some initial idea maybe if we like to Get more ambassador on board. Maybe we we can work a little ambassador on board in process that covers the proper communication and and sharing information between us Reading them to the ambassador user list and and etc. And The other idea we had that it would be great to see return community report similar to the user report that the user commit is providing for For every summit because we have a lot of data I saw that you started to collect some some changes of informations about the user groups So we can make it happen and we can we can create some useful content for everyone Well, I'm excited to work with you all to make those things happen and they're ready sort of in the pipeline Expanding the program. We've got Sheila coming on who's going to be amazing And there's processes involved that have been established to bring new people in which I put Lisa through and a number of others who We're thinking of bringing some in so we've got that into make it a smooth process So it's easier for the ambassadors to just jump right in and get started and not feel too lost Like we threw them in the water without a life jacket. So yeah I know like when you first join OpenStack, that's just how it feels, right? And with this data also with our user group We are discussing with other user groups who are asking to get some some data about the attendees To the event meetup or OpenStack day and also sharing perhaps every country can be different But sharing experience with data will also help other groups making better event Or more easy to organize. So I think ambassador could be this type of glue to help the ambassador We we are discussing directly between groups But ambassador can make this link on the on share the knowledge because sometimes for for making website We have to contact over over over groups, but it's not easy You must know the people but but ambassador can improve this link between groups We are excited to work with you all to make that all happen in the next 12 months But we don't want to scare anybody because so I never made a website I finally I have some help now in SF Bay. It was all I could do to run two meetups a month So I was focused on the content. I was focused on getting amazing presenters I if I had to do it myself, you know, but we just kept the content going. I finally got a guy John Starmer He's amazing and he's helping me. He built a YouTube channel. So we were archiving the videos there He's he's he's helping with the Twitter feed that we put together I can handle Twitter, but I can't like all that, you know, you want to know how it's really done talk to Stardarus over there. He built he has like an email address. He's got a whole. Oh my gosh Ecosystem, he's running in San Diego. He does hands-on labs. He's got, you know, a distro He's he's because he gets resources from from the local University I mean, it's it's a little bit ridiculous kind of an overachiever making us all look bad But it's phenomenal what he's done with his user group on his own No one asked him to do it So you can do that you can get an email list and then you can get your users to then start communicating with You can did you could do a slack channel to what's your chat ops? Yeah Oh, yeah open-stack San Diego or clone the website. Yeah, he's got all his labs on a github repository to after each meet-up Bare metal data presenter prior packets. I'm repeating it because it's being recorded They provide hardware. He got them to donate hardware so he can run an open-stack cloud during the meet-ups Like can we give this man a round of applause, please John Stardarus San Diego user group We defining how a user group can just just get it done other user groups whoever's watching this on in the worldwide ethos John Stardarus. What is the what it you know what can I just do this for a second? Sure? So my email address it's at John at open stack San Diego org so and the hosting provider packet they Rent machines by the hour and so they just give us access to a bare metal machine and then I've got scripts to install it It's all it if you go to github.com Open-stack San Diego all the workshops that we do all the scripts to build a lab to do the tutorials are all in github So trying to make it available to the other user groups make their life easier Yeah, I know we have super user awards But if we could have a super user group award my vote right there John Stardarus San Diego. Wow really well done Thank you so much So we are quite out of time, but I think it's very important to To discuss if you have some questions because Ambassador are working for the community. So now he if you have questions We can hear you Anything perhaps take the microphone Okay First of all, thank you for your work guys. I think you're doing a great job I'm like advertising open stack What I was missing and actually that's why I also try kind of Was thinking how could I help you is that? Selfie, thank you is Okay So these these user groups are look localized and Well, first of all, this is this is the key of your success because you are like localized with those people who are interested in all this I can you can go there You can advertise to them. You can you can help them but what's completely ordinal to this is if some people or companies are interested in a specific set of skills and knowledge and know how to operate an open stack in a in a In a certain environment, for example, like in in the DAC age, so Germany area its Modder companies auto mobile companies Or for the whole Europe, it's basically tackle companies and is there any Movement inside the ambassador program where you also try to handle this orthogonal um Thread of interest Meaning that not just I'm connecting the people who are already are localized to the same place But also connecting people who are actually interested in the same subset of this knowledge Yeah, basically basically the foundation Website contains the market place so Well, and you're you're Germany what part of Germany? I'm from Switzerland. Oh, you're from Switzerland. Do you guys know each other? Chris Franks? Do you guys know? Okay, we'll make some connections But yeah, I think it's very interesting and the perhaps organizing or helping to organize a remote event with a video or It can spread over different countries not only one country, but I think it's very interesting idea. So We keep your name on perhaps so we can discuss of this at the end of a session Because if we take here the telco, we are discussing with you there in science HPC If you go in a user group, yeah, they will not find many people in their interest and yeah It could be very interesting to be a catalyst of this type of of groups That that could be perhaps a little bit more virtual, but it's very interesting And I just mentioned Christian Frank who organizes open sec days Germany And it's one of my favorite people we work together for about six years No one I'd rather go to prison with awesome guy And really in in trench in the open sec community So you guys are kind of sort of in the same region. So you should talk So yeah, new question the same question but In trying to start something it takes a huge amount of time And I know we were talking before it takes an enormous amount of time to get all the resources together to really provide great Content for the users who come to the groups that being said a lot of you all have done a lot of work And I think that's kind of what you're asking Besides like this awesome website that you've created And any other is there a way to kind of like share that information so that if someone has a little less time But wants to get something started on a more limited basis that there's automatically a central place to go to find A lot of great content That it that's definitely an issue that's been raised in the past In the last couple of months even things like finding speakers some groups are just unsure. Okay, where do I go? What do I do? So we're working to it's another work in progress. I joined in January. So a lot of things like going on But we're hoping to get some sort of repository or a guide or some sort of thing that user group Leaders can just go through or someone who's looking to start and just go, okay Let's tick the boxes. Where can I start for this? Where should I go for that? Like a how-to? 101 for user groups basically So for example like girls who code they have Suggested things to start with and then that's in a central repository so that you can pull that So yeah, same idea. Yeah, so something we would love to work on and make happen So it makes it easier for anyone's like you to just come through and start something And then we just sort of guide it and get and get it through the process as well. If that, you know, you have questions, so And major Rodriguez can like we give her a hand for the phenomenal keynote that she did on day one The probably the best you know mom And we had a talk earlier and I said to how do you want to get involved? How much do you want to get involved? Can we get you involved and I love it? I love the passion this community It's people like you guys that want to bring this thing forward and it's so phenomenal So awesome awesome awesome So just to yeah quick quick question. We're five minutes out of time It's okay. It's great First first of all, I want to say thank you to for all yours. Yeah, I come from Vietnam and We become an official user group and The second here is I want to ask you a question that is Any requirement for a small user group in Vietnam? We are official so we can run you open stack day. So is there any requirement for? For it's more is a group for to run the open stack day Yeah, yeah, you know a few a few years ago We have only two or three company that test that run testing open stack And now we have about 10 company that run open stack in the production So it's there is more number. So it is this or three foreign and when stack day in Vietnam Yeah, yeah, basically depends on the number, but I suggest to start work on it and Talk with the other guys who are organizing open stack days And I'm sure that you will get all of the help from from the community Because I think there is no rule it's for it's for this it's very good to discuss with Ambassador because they are they are sharing experience with other people. So sometimes when it's possible to make to create some package to publish so So some some some information on guidelines are published But also it's very good to discuss with ambassador and on people who organize event with 3000 or also he has organized 3,000 people or less for meet-up can can help a lot Yeah, okay. Thank you on the last question Quick question. Thank you all for the great works, and I'm the one running one of the people running opens that how I use a group So we we face we are facing a big problem is that we are hard to find speaker for the meet-ups So is there any ideas on how to encourage people to speak in the Yeah, so we have a speaker bureau. So you wanted you are you are working you are working on it And there's also a tool called the foundation speaker bureau which you can go to online It has a list or like a repository of all the different speakers That have ticked like they the participate in a summit or an open-stack day and spoke and they said yep I would like to be contacted as a potential speaker at a meet-up, and there'll be information Like whether they're willing to travel or what topics they can talk on so that's a great place to Go and find particular people who might be able to come down and and give a talk I can talk to you afterwards and Local speakers So there's actually a lot of people working on open-stack, but they're not willing to share Taiwan Do you have major conferences that come through one of the things I would recommend is one if you have a major conference coming through Your town grab some speakers that are there already They would often love to come and speak to the local communities because it's an access that they don't normally have and They'll be in town also you can look at other user groups are ours is one from San Francisco meetup comm slash open-stack Paying any of those people they travel they travel a lot and sometimes they're willing to come out to you So there's content there that can come to you But definitely the conferences that come through your town hit up those speakers just find it a cool Even if it's not you know open-stack it might be DevOps might be cloud It might be some peripheral, you know containers of course container worlds developer week There's a lot of conferences. I bet that comes through your town Just find an interesting speaker and have them come and speak at your meetup They will probably love it and be happy to do so. Thank you very much. Thank you Thank you guys


How's Lenny McLean? Lenny McLean was cool. I was in prison with him when he'd done the murder. He was in my first documentary. I've been on a few boxing shows with him. Yeah, it's cool. They're all really cool. What happened was the Premier Division naughty men, the Freddie Formans, the Ronnie Reggie Charlie Cray, the Ronnie Biggsies, they all knew that I was better at doing in front of camera than they were because they've had their old life going on but now they're actually expected to go, sell ourself. Dave is the best one for that. So they wrapped me up in cotton wool and sent me out to try and sell them. You know, get their book deals, get their film deal, get all that because they weren't used to it. Not that I was the biggest gangster. I was the best at that bit. Networking. Networking. If Lenny McLean's your mate, why do you want to have a fight? Get Lenny McLean to do it. He's the best at that. So, and the rest of the world didn't know that. The rest of the world thought I was out clambering for get a load of me. The gangsters were loving me for it. Who's the toughest man you've ever been surrounded with? It's all different people, I'm afraid, in different situations. The best nightclub dormant fighter I've ever seen was Lenny McLean. You know, you're born for certain things. Usain Bolt born and run, Muhammad Ali born and box. Lenny McLean was born to stand in doorways and fight groups of men. Because he made it famous when dormant got famous, individuals, because there was every Saturday you had football violence. One Saturday, two Saturdays a month, London got 20,000 Liverpool supporters for Saturday night playing Arsenal, 20,000 Man United supporters playing Tottenham, 20,000 Leeds supporters playing Chelsea, 20,000 Newcastle supporters, all down in London for the night. So the little dormant in the London West end had 100,000 Norveners to compete with one night. So there were fights. There were no radios, no trouble accident number five. You actually went, help me! And dormant had the sleeves ripped off their jeep skins and looked like dormant. And 30 blokes of standing at the bar all with a chiver having a bit of Charlie and the government went from out. You had jobs then, that it was different kind of dormant and he loved it, loved pain, loved the taste of blood, went to work with a broken collarbone, a broken nose and a tooth knocked out, his arm in a sling on a Friday and went to work on a Saturday and still no one would fight a gun.