Let's get started. So today we're gonna be talking about an incident that happened to one of our customers about a year ago. And I thought it was important to share the details of the incident and hopefully share with the community and hopefully we can prevent those kind of incidents from occurring at our own companies. So just a quick introduction. Thank you for the intro, Lauren. But I currently work at the Cloud Health Technologies company that's focused on managing cost and governance across multiple cloud environments. And my main responsibility is mostly security and compliance now, although I did start it in technical operations, DevOps, et cetera. As Lauren mentioned, I also do a little bit of car racing on the side and I juggle and do some Accra stuff. It's part of our circus community here in Boston. So how many of you guys are familiar with cryptocurrency? Just if you don't mind raising your hands. Okay, all right, it's a pretty big crowd. And how many actually lost money recently on cryptocurrencies? All right, it's pretty embarrassing thing to admit, but thank you for sharing that. What I wanna point out is the Cryptojack in and out of itself is a way to leverage somebody else's compute resources to mine cryptocurrencies. And there's a variety of ways of doing it nowadays. You can do it through browsers and JavaScript. You can do it on your home routers or your personal laptops. But you can also leverage physical resources in data centers and also cloud environments. So it's pretty pervasive. Things like, for example, Pirate Bay recently had a JavaScript that was a bit mining monero. And it happens to real companies as well. Most recently in this year in particular, Tesla was in the news recently. They've had apparently an open Kubernetes cluster that somebody leveraged to deploy containers and run Bitcoin mining operations in their cloud environments. Same thing happened with insurance provided in UK, Aviva and Jamalto as well. And most of those are due to leaked AWS credentials. However, I wanna point out that many of those things go unreported, like it's a pretty embarrassing thing to admit that your account's been hijacked for crypto mining operations. And it's not like a data breach where you have to report it to authorities, et cetera. So a lot of those things, because they're embarrassing, they don't get reported out in public. The thing, for example, like about the AWS leaked credentials and account takeovers is a pretty serious thing where it can potentially destroy the company. In 2014, if any of you remember, there was a company called Codespaces where their root account, AWS account, got compromised and the person that took over that account demanded ransom that was, which was not paid. And essentially, because the company was completely based in the cloud, the hijacker destroyed the company, including the backups and everything else. So speaking of setting up property strategy, so the company had to close shop because they had no way to recover the data, their customer data, their own data. So it could be serious. So let's talk about the incident itself and the timeline. We, about a year ago, when this event happened, we got a support email to a support personnel, essentially stating that, hey, we discovered that we have about 200 instances running in our AWS account across multiple regions and they were generating about $12,000 a month in EC2 compute cost. The customer stated that they didn't have any cloud trail enabled and absolutely no audit logs of how it happened. But it did notice is that one of the accounts, I am a user that was typically given read only permissions, all of a sudden had admin rights. So they sent us this email hoping that we can help them investigate because we do monitor our customers' accounts and we do have some data on them. So as a part of the handling this incident, they obviously reached out to AWS support. AWS had them completely thoroughly clean out their AWS account that was affected by this. They just right away, a little bit too late now, enabled cloud trail in that account to capture the audit data. And then they worked with a customer on the refund. Again, the refund part is case dependent, kind of at the mercy of AWS on this. And what we did on our side, because our platform essentially captures the state of the accounts at like 15 minute intervals, we went through database backups at like certain point of time to reestablish the timeline of what exactly happened during the incident. And I'm gonna go into the details of that timeline a little bit on. But we also configured our cloud health platform to help customers to monitor for this kind of things, the security module on that platform and then some of the best practices in terms of cost reporting and cost spike reporting like this. So the timeline part, this is where it's interesting. So it happened around March and what we found out that there was a series of AMIs created throughout the world in multiple regions and they were publicly shared AMIs, windows based. And what we noticed that when we're doing forensics the first thing that happened during the incident is that one of the users in the environment had admin privileges, their access key, that Amazon has two slots right, AWS one key and two, the access key one got rotated. And right following that, our platform started detecting other changes like the user that was affected that was read only supposedly was giving admin rights and console access, et cetera. But then immediately following that, we started seeing multiple resources around the world in multiple regions, started getting created. And you could see that in terms of the span, all those activities happened in less than 10 minutes. Right, and then we started detecting that, hey, 200 or so windows, C4 actually, C4, 8x relage, windows machines, starting getting detected. We started getting collecting the performance metrics of those machines and we immediately started seeing 100% CPU utilization across the board and all of them. And then the day later, a customer kind of discovered the spike in cost in their AWS account. So a couple of things I want to point out on this timeline is that for us, the majority of the data about changes in IEM and permissions came from one particular report called Generated Credentials Report. In that report we were able to exactly establish the timeline of one of the user. Credential got changed, when the user permissions got changed, when things changed on that particular account. Another thing I want to point out is that, I don't know if you noticed that the first operations that we saw, right, was that access key one got rotated. And does anybody think like, why that's peculiar or a little bit strange? That why this is the first operations that an attacker would do? Yeah, exactly. Not just you, but if you imagine that, if you somehow share your credentials, right, those guys are not the only ones looking for them. So not only they want to lock you out, but they want to lock out anyone else that's scanning at the same intervals. So it's like the first one in, wants to lock everybody else out. So another thing I want to point out was highly animated, templated, right, they had the pre-baked AMIs already ready to go, all they need to do is to spin them up. All the configurations for AWS accounts, VPC, security groups, knackles, everything, right, they all got preset and spun up. It was limited to 200 instances, and this particular reason is because that's the default AWS account limit. So they probably could have spun up a lot more if they could. So that's kind of like the summary of the timeline. I kind of want to go into discussion about how we can actually prevent this kind of incident, right, and those instances are fairly easy to prevent. Couple of points I want to point out, like the root account is the most important account you have in AWS. You want to make sure that it's locked away in a safe, and the best way to do this is get a physical MFA setup for that root account, disable all in any API access to that account, and just really don't use it at all. That's just the most basic thing you can do. It's a God mode like account, so treat it with respect. The second thing, there's various types of users that you generally would use in AWS, and for typical users and operators that people that would log into your AWS accounts, there's a couple of things you can do. A, you can enforce the MFA on all those users and operators, and Amazon provides you this amazing IAM policy that you can overlay on any and all your existing IAM policies assigned to a user, and it will just enable MFA and will allow the user to manage their own self credentials without disrupting anything else you may have set up in your own policies. So it's a very clever policy that they come up with. By all means, do use it. Well, obviously the MFA works really well for AWS console access. It gives you a little feel to put in a one-time token. Sometimes it's a challenge to use it on the CLI. There's a tool that you can use for CLI AWS vault, quite a handy tool. Other solutions that you may be already using, leverage Staml or SSO, like Google, Octa, Ping Identity One login, all good providers for SSO login to your AWS account. So there's no need for actual user in AWS. And some of those do provide CLI-based tools, leveraging the MFA as well. So one last thing there, do not give out direct permissions to users. IAM permissions ask users to assume role that they actually need to use in their accounts. So on the application and application services accounts, those are very important. Obviously a lot of us run services and kind of need to generate AWS credentials for the services to run and operate in our cloud environments. But Amazon provides you really good solutions to bypass that, right? Come up with instance profiles that you can sign permissions to instances where you're running your services. And you can leverage IAM roles for those services. Another addition that works, I've seen it work very well in the very contained environments where you exactly know where the services are running and which IP addresses they're gonna be using. One of the suggestions I've heard is adding conditional statements to your policies for the service accounts to restrict it to specific IP addresses that you're using for your infrastructure. Couple of other quick pointers, right? Do not ever please follow me as give out the start out star to your service accounts. It's a bad idea. Couple of ways to prevent from, if you do have to use AWS key and secret key, have prevented from getting into your source code, especially to your public repos.  And in some cases, like Key Nuker could potentially go and invalidate those keys before they end up on your public GitHub repos. So, other suggestions on a general side, on the protection, just keep the default limits. I know a person that by default, whenever they would spin up a new brand new account with requests from AWS, there's exorbitant limits to like 10,000 instances, 20,000 instances, so you doesn't have to deal with it later, but in a situation where I had before that could have been devastating to the company. There are a couple of benchmarks you can apply to AWS accounts and a couple of companies here, like Threadstack, for example, that are a sponsor of this event. They can help you configure your AWS account to the best practices. And by all means, please enable CloudTrail in your configuration. That's the only way you can audit to see exactly what's happening in your accounts. So pretty important. Couple of other quick notes. You can set up billing alerts directly from your AWS accounts and trigger an email warnings whenever you detect sudden costs increase or spike. Or you can use tools like CloudHealth to configure similar alerts in your environments. Some other points about the CloudTrail monitoring. One of the best practices and part of the well-architected review from AWS, they do recommend and mandate now that all your CloudTrail accounts, all your CloudTrail data from multiple accounts should be all dropped into a centralized, kind of secure AWS account. So it can be tampered with or accessed by somebody else. And then on the real-time monitoring and alerting piece, couple of tools like Threadstack, SumoLogic, Splunk, all this alerting and monitoring services, you can feed CloudTrail data into them and then you can look for suspicious activity. Like for example, the first one I pointed out, the way the access key got rotated, you can flag those activities and report on them through those alerting and monitoring tools. So that's it. One last item there on this particular topic. I did notice, right? Because those AMIs were publicly shared from an attacker's AWS accounts. And you typically can determine the provenance of those AMIs that you're using your infrastructure. They either be coming from your OS provider like you, Ubuntu or Red Hat, et cetera. So there's a kind of static account IDs or your own accounts where you're baking your own instances, for example. You know those account IDs, so you can potentially track to see if you have some foreign AMIs being spun up in your accounts as well. So I think that's it. One of the things I wanna just make sure that when you leave this conference and you start looking to your account configurations that you focus on three things, right? Key takeaways that I wanna make sure that everybody takes in considerations when they go back to work. Enforcing the MFA on the root account and users, essentially, very essential and it will prevent majority of the attacks. The attack that we saw on our own infrastructure when one of our developers committed by mistake the content of their home directory to a public repo including that dot files. A minute later, I kid you not, a minute he committed this data to a public group, a minute later after we were back to look at the cloud trail data, a minute later we saw denied access requests to change the AWS key. It takes a minute from you posting that data to a public repo and somebody tracking it and using it. So MFA prevented this particular attack, right? And the user would have pretty significant privileges, right? So essential to enforce MFA. Get rid of AWS key and secret key. Amazon provides you tools and services to free not to use them at all. It takes a little bit of work, but please do that. IAM role's a more secure way of doling out privileges in AWS. And then for the love of God, please, enable cloud trail, I can't stress that enough. It was painful to reconstruct this whole incident by looking at database snapshots like every 30 minutes. Cloud trail would have made it so much easier. All the data is in there. So that's it. Thank you guys. So with 200 instances for about, what, six, seven days, do you have any estimates for what the profit of that attack was? A year, well, it was March last year. So I assume that at the time it was quite significant. I mean, it's actually free money, right? The fact that we still don't know exactly which type of currency was used. It could have been Monero, Bitcoin, it could be Ethereum. There's no indication of which one it was, but I know for sure that it definitely was not like protein folding that they were computing on this. Thanks. Thanks for that. That was great. What, do you get a sense of how automated these attacks are, like how much of this human seeing vulnerability and pressing a button, or if it's just like troves of bots roving the internet automatically setting up machines? I believe it's highly automated. And there's, if you look at the timeline there, there was a, obviously the attackers are prepped for it. So they already have pre-bundled AMIs baked all over the regions. And they, as soon as they discover the credentials that they can use, within 10 minutes you can expect that you're gonna have infrastructure running in your environment, mining Bitcoin or cryptocurrency or other. Highly automated. I don't know exactly what was used in automation. If we had cloud trail logs, it would have been probably easier, but I suspect something like Terraform CloudFormation templates or just straight API calls. Hey, good presentation. What about MFA on mobile devices like Google Authenticator, is that fine? Yeah, absolutely. You could use it for your root account as well. Makes it a little bit less secure. But for the users, mobile MFA is perfectly fine. Thanks. What's your advice about robot accounts? Robot accounts, you mean service? And MFA. Service accounts? No, like AWS accounts that are not human people automation accounts. I think IP whitelisting restrictions are given out very specific privileges for the robot accounts to be able to do its work. Typically works. You know, key, secret key. And again, I made a recommendation to not use them at all. Amazon allows you to set up trust between AWS accounts using IAM roles. By all means use that. This is the safest, most secure way of giving some other account in AWS, giving access to your policies or resources. I'm kinda curious, cause you talked a lot about the financial cost of when it happened. They had to use this as a spun up. But from the time they contacted support and got everything wiped and no one was really accessing the account, what was the logistical cost to them of how long until they were able to actually legitimately use their account again, get in there and start pushing out builds and making progress on what they were expecting to be doing? Yeah, in this particular case, the customer in question had about thousands of AWS accounts. And it was only one of the accounts that got compromised. It was a development account with very little things in it. It literally had like five or so IAM users and no resources at all. So for them, the cost of cleanup was or time to get it back was negligible. But I can suspect that for other customers it could be a major headache, right? Because you need to audit and check absolutely everything to make sure that nothing else got changed or hijacked. Somebody didn't create another AWS account with kind of backdoor privileges in it. So it could be costly and time consuming. What was the fallout like for your team when your developer committed his home directory to a public repo? Yeah. Yeah. Just a side story, we use Slack quite heavily. And the developer had, along with his own data and his home directory, had a Slack token that was used for some of the integration work. And Slack token, if you've seen it, it has a very specific set of characters at the beginning. So it's very detectable. And about 10 minutes after you're committed to the GitHub repo, we got an email from Slack Zendesk, notifying that they've detected and invalidated their own token. And they provided a link where they discovered it. And upon looking at it, I'm like, oh, uh-oh. I see the guy's name, GitHub, public repo, and I'm seeing a whole bunch of other files that should not be there. And it was a panic mode, trying to call the person up. Obviously it's his own private repo. I can't do anything about it. But I finally got hold of him when we started doing the cleanup effort. And then during the investigation, when we were looking at our own CloudTrail data, we quickly determined that whatever credentials he had for AWS in his own repository got rejected, essentially, because of the two-factor authentication. So by all means, set up two-factor. And the policy that AWS, the one I provided, makes it so much easier. It's an overlay that snaps right in, over-existing policies and roles, that makes it much more secure. Just going back to MFA real quick. So you know how some password managers, like one password, let you save the MFA token into the vault. And I know that sometimes people have talked to insecurity, say that they're not a fan of that kind of feature, because then when they try to take down someone's access, they might still have a copy of that URL. So I guess what you're paying on people who try to get around the multi of the MFA, and use one device. It's hard to get around the multi-factor authentication because the user identity itself is stored and managed in AWS. So if you disable that user in there, they don't have access anymore. But in terms of using the on the endpoint kind of MFA generated tools, essentially downgrading itself to a single factor, right? You're typing in your password on the same machine where you have that token being displayed. If somebody has access to your machine, key logger, screenshots, they essentially can get access right from your machine, just being on your machine. Having it on a separate device, mobile device, is essential, just keep it separated. Can you please give more detail or examples on how the keys and secret keys can be abused or misused? Well, the worst one I pointed out was when the company got completely obliterated and destroyed, that's the worst case scenario. I wanna make sure that everybody realizes that storing your data in a single cloud or a single AWS account is not safe. You wanna make sure that you have access strategy backups going somewhere else in a separate S3 bucket in a completely standalone separate AWS account. You can set up the S3 bucket to S3 bucket replication to avoid that. There's multiple ways of, other ways of abusing those key and secret keys, obviously data breaches, right? Tesla, in this particular case, and one of the examples I gave had an open Kubernetes cluster running in their kind of development account, and the Kubernetes cluster had a couple of workloads running on them that exposed certain secrets in the environment variables, including key and secret key that then was used by the attackers to go and forge their S3 buckets that belong to that account. So we're able to access data that was related to car metrics data used for development purposes. So it ranges from obviously something like crypto mining, to hijacking data, or using it to stage another attack on somebody else, or completely destroying a company and holding a company for ransom. How do you recommend handling service account access from containers if you're not using environment variables or a secret key access key? It depends where you're running the containers. A lot of the, for example, Kubernetes allows you to, if you're running on top of EC2, for example, right? It allows you to leverage and dole out specific permissions from the instance profile to the pods of services. They're running this Qt2 IAM or something like that. There's a plugin that allows you to leverage IAM roles that are doled out to the instances. So you don't have to store that key and secret key. Cool, and that's all the time we have. Thanks again, Anton, awesome. Give him a round of applause. Thank you. Thank you.


The Mahdi is not only an embodiment of the Islamic belief but he is also the symbol of an aspiration cherished by mankind of its divergent religious doctrines. He is also the crystallization of an instructive inspiration through which all people regardless of their religious affiliations have learned to evade a day when heavenly mission with all their implications will achieve their final goals and a tiring march of humanity across history will culminate satisfactorily in peace and tranquility. This consciousness of the expected future has not been confined to those who believe in the supranational phenomena but has also been reflected in the ideologies and cults which totally deny the existence of what is imperceptible. For example dialectical materialism which interprets history and the basis of contradictions believe that a day will come when all contradictions will disappear and complete peace and tranquility will prevail. Thus we find that this consciousness experienced through that history is one of the widest in the communist psychological experience of humanity. The religion when it endorses this common consciousness and stresses that in the long run this world will be filled with justice and equity after having been filled with injustice and oppression gives it a factual value and converts it into a definite belief in the future course of humanity. This belief is not merely a source of consolation but it is also a source of virtue and strength. It is a source of virtue because the belief in the Mahdi means the total elimination of injustice and oppression prevailing in the world with it a source of inexhaustible strength because it provides hope which enables man to resist frustration. How so ever hopeless and dismal the circumstance may be. The belief in the appointed day proves that it is possible for the forces of justice to face the world filled with injustice and oppression to prevail up in the forces of injustice and to reconstruct the world over there. After all prevalence of injustice how so ever dominant and extensive it may become is an abnormal state and must be eliminated in the long run. The prospect of its elimination after reaching its climax infuses a great hope in every persecuted individual and every oppressed nation that it is a sale possible to change the state of affairs. Although the concept of the Mahdi is more widespread than the Muslim community yet its detailed features as determined by Islam meet more fully all the aspirations attached to it since the dawn of history. They are in greater conformity to the feelings and sentiments of the oppressed and the persecuted of all times. It is Islam which has given a concrete shape to an abstract idea. It is no longer necessary to look forward to an unknown savior who may come into the world at a distant future. The savior is already here and we simply have to look forward to today when these circumstances arrive for him to appear and begin his great mission.


Hey guys, I'm Celeste, with Calte's Museum. I'm on sprawl in my PJs right now, talking to students about the new Stephen King movie coming out, Dr. Sleep. What is sleep? She must be a Bergen student. Yeah, I'm a Bergen student and I'm a mom, so literally what is sleep? That's why I love to eat that from my house. I feel new. You score? Oh my gosh! You score things! Literally what is sleep?  What is sleep? Oh, not much now.  Yes, a lot. Like, I will sleep. You're great tonight. Every night. Every night? Yeah. Even if I, like, have a mixture and I'll just kind of plan ahead and I don't like to sleep. That's fine. Yeah, I really value sleep. So, how many hours do you get a night? I'm a good night, probably like six or seven, on a good night. What's the normal night? Normal night, more like three to four. Where is the weirdest place you've ever fallen asleep? Weirdest place? I don't know, like... Yeah, oh my shower! Question here! In the shower? So, where is the weirdest place you've ever fallen asleep? Underwater. Wait, why explain? How is that possible? I don't think I know. Oh my God! Ooh! I went to the Rugby World Cup over the summer. I made his last ever AT&T part and I fell asleep. Uh-huh. If you could go into anyone's dreams and mess with them, what would you do? This is the final answer. Thank you for watching, everybody. I think it was... I would just put the clown from it together. That's terrifying. You are not invited to any of my future dreams? I would act normal. Like a normal dream. Yeah. Kind of act. But also just kind of... slip in weird stuff. Okay. That messes with the brain. Okay, like what? I don't know. Just kind of like make the hair fall out or something like that. Real subtle. Okay, yeah. Just subtle stuff that there like was going on. Yeah, definitely some things to make them wake up. Like that was... That was unusual. Alright. Watch Dr. Sleep in theaters November 8. Yeah.


Welcome to the September 26th areas cloud agent python maintainers meeting lots to talk about. There's an agenda. We're recording Any trust policy is in effect for the Linux foundation and the hyperlegic code of conduct is in effect Let's get into it any announcements adjustments things people want to talk about We can now send nonverbal feedback. Yes slow down from reactions on the toolbar Are you glad? Really zoom let us know that. Let's see where to do it. But anyway, all right Am I editing? I am not. Sorry with that. Okay PR 2486 is needed For an upgrade that at least we have to do I don't know others Need it basically we have a very old issuer that is in production and this upgrade fixes some tags and Other issues related to issuer revered records. Basically, we've had a problem with Every time we do a revoke. We've had to fix the revocation Meaning we have to sync up. What's in the wallet and what's in the ledger and that comes back to this once we go to 010-2 We wouldn't be able to fix it. I believe or something like that. So anyway, we have to get this fixed in We'd like to do a 010-3 with just this fix So I wondered a is there anything else that ought to go into it and be any objections to it and see Shanjot being sure that we can actually do this as a separate release. Is that doable as a 010-3 Shanjot, but that'll work Yes, there's no dependency with the code that's there in me right now. It's all like I think it should work like no no new commits that that have a dependency The status on this is basically from yesterday the unit test that was pretty like in the fixed ledger entry function That's what I have fixed in this PR. It wasn't unit test covered earlier So it has covered now and the peculiar logic with the escrow profile session That was proving a bit tricky to do it in test has been resolved So that test has I've added that test gen just squashing the commits into a single commit just like Minimizing the get commit history. That's what I'm doing right now and should be good to go in next oven Okay Comments from anyone on us doing a 010-3 The only comment I have is that we have Some changes that we'd like to see in a release pretty soon as well I don't think those are quite ready and if this is all ready to go I have no issues with supporting getting out at a 010-3 release But I definitely probably would like to continue pushing on a 011 release after that one comes out Okay. Yeah, and that was the next which is to look at this So 010-3 with just that one right now, you don't have any others that you need in there Daniel So the big one that I'm pursuing right now is the the mediation routing keys fixes and that is going to come with some changes in the behavior in out of band I think at least Which seems like it would probably not be a Patch release I suppose so yeah I don't know why my fancy Why can I not edit it? Why is it not there anyway? I did a nice fancy Here's all the releases since then and got it all set up, but it's not showing up. Okay And even that's not working Let's look at merged Man, I'm not having a good keyboard day Okay, the merged I came up with one that would eliminate the ones that were put into the they're only in Maine and And So Basically, we'd be talking the ones but basically everything on this page Move that code did exchange version set. So none of these these are just sort of maintenance things The peer did resolution. That's a big deal bug fix documentation documentation and their container Obviously big thing we're getting in here would be just SD jot. So that's a significant enhancement That's clean up update pie did is clean up. So Doesn't look like 11 would be that big a deal. So that's good It's got a lot of things but not that mostly to do with developer improvements Yeah, the main thing that we're pushing on right now Is that the routing keys PR but that's pushing us in the direction of Compatibility between our out of band and did exchange implementation with At least recent releases of AFJ. Yeah So right now we don't really have the ability to do a did exchange protocol with AFJ because it's using did pure one We don't intend to implement did pure one, of course, but they're they're working on a did pure two and then This also influences our compatibility there because we also don't have the ability to do public did out of band With AFJ because our routing keys are inappropriately Formatted on on the ledger. So did you go on the ledger? Yeah Because they're unqualified. Yep. Yeah, and then we've got this you saw this, right? Yeah, right. So I Think the right out of sync Yeah So the RFCs I think were probably a little confused themselves. I Don't think it was clear to the authors at the time what the difference between the did key reference and the did key itself was Yeah, I think the intent is clear that it should be did key references, but the examples are incorrect So what AFJ is doing is accepting either a did key or a did key reference But it's currently sending out Just did keys but only an out of band in the did exchange. It's it's using the fully The full reference did key and routing keys Yeah, so I think we can probably do something similar in that where we're willing to accept the just the did key Yeah, but then we'll just transform it to the reference so we can process it Yeah, as if it were a correctly formatted value and then we put in the same fix in AFJ Right, and then we're good to go with switching over to using references. Yep. Okay Coordinated updates love them. Yeah Okay And you're dealing with this right now Yeah, I've got some tests that need to to be updated. I think this is the main failures there right now Okay, so this is that's the main thing you want Um Well, so then the next thing that we really want to push on after this is getting the did peer support in For did peer to and did exchange So those are those are kind of the two big ones Okay So that's that one This one that one I'm less Invested in having that one pushed in quickly, but it's just getting rid of some old stuff that was unused anyways So it's just a cleanup. Okay Shantja you've got this one in work in ready for review This is Underly going testing right now. So I got the initial review But after that I had to make some changes because of the issue I discovered So yeah, yeah, let's be let's keep on the convert to draft one necessary This one This one is ready for you. Okay, and then this last one Are we gonna close this one? Are we gonna move forward with it? This is really old. So Should we just close this one? Or is this a useful fix I Haven't looked at the code recently, but I would have to guess that it's probably hopelessly stale at this point Yeah, and the effort to resolve merge conflicts might be Yeah, yeah Shantja, is it a good idea to close this one? Do you even remember it? I don't have to like take a look again, but it's like whatever at that stage I started working It was stopped at a decent stage. So I'd like it'll be Like if we need to we can just recreate early reopen this but for now, I think we can close this All right Is there an issue that is linked to this one to track the the actual problem I believe so Oh that one resolve no error message if tail server is down. Okay. It was there Yeah Thanks Yeah Yeah, I guess I keep these open at least it sounds like it could be like a very helpful for some Agreed it can be very helpful Yeah Okay, that leaves that one more issue In the review required which is this one Right. This one is one that I've had on my to-do list to to look at deeper Kind of the main challenge here is that I think there's a better way to do this I just haven't had the time to think through what the better way would look like and to suggest alternatives here So, all right, it's fine to leave it. I think Yeah, let's just leave it so our review requires our Let's get a look at those. Let's keep using draft when things are not ready And we'll figure out what to do We'll and then we'll plan a 011 release Just as a matter of interest where are we how close does that get us At some point we need to go over what's left in the You know in this Set of things for a IP to I think we've got that one nailed Whoops Daniel, do you know way more about root coordination than I do? Do you remember where we are with that I? Believe from a protocol perspective, I think we're actually In a good position on the coordinate mediation protocol now I think the only thing that was out of spec was the did key usage We are Cutting over to a state where we can accept either base 58 or or did key We already were accepting both of those actually but we're storing them as base 58 hence the issues with being pushed to the ledger in the incorrect format But I think from a protocol perspective. We were already. Yeah. Good to go there used a key that was The update About this the encryption envelope. No Okay, I have not looked at this recently. No, yeah So on the did exchange one So we've merged in like the the did resolution for a did peer to and the storage of did peer 3 as aliases to the did peer 2 But we're not yet able to use those in our did exchange Protocol so we've got one extra step to complete there before we're good to go on that one and Sire tuck you are not going to be available Jason For at least how do you know how long you're still going to be on MDS? after you come back so so Jason's off to Utica New York to referee a international across event which is pretty wild And then but you're also doing MDS we can't hear you if you're speaking we can't hear anything you're saying Jason if you are at least I can't I assume others can't Something wrong with his things put a chat I missed that so Hopefully we can hear from Jason in a second here But if he's unavailable to work on that and I get through the routing key stuff here Hopefully pretty shortly. I can put some time in on Getting the did peer to And did exchange put together. That's a high-knife priority for us that I think they they want me to push on that so Yep Um, I didn't realize Andrew you are on the call Would you be able to take a look at where we are with 587 and sort of you know, don't do it but sort of give us a Here's the state of it and here's what would need to be done. So spend an hour or two on that to Give us guidance us to where we are Yeah Most of the functionalities there in in Oscar. Yeah One of the sticking points is just going to be doing resolution during did resolution during unpacking which I would probably restrict to Methods that don't actually make any external calls personally You know resolving did peer and did key right? Oh, hold on. So that would be so you're saying You would not use For not use Public goods Hard to say and I'm sure there's a use case for that too Um Yeah, I'm I'm aware of at least one scenario that my Interested parties would have they would want to see did web be able to be used in a did-com perspective. Yeah, I know So going back in my memory a long way, I know Um That's something that matter to bias always used to say they wanted to be able to do is use the same did for all the did There did calm Yeah, I mean, I mean it's implementable. It's just like You got to hold that hold on to this message in the queue while you do the resolution and If you get a hundred of those at once Yeah, it could be a problem. Yeah Anyway, um, I think you've got cashing though, right? We do yeah, we've got a cashing layer in there. So the resolution would be subject to cashing It would okay well, so assessment of What was needed and where we are with that? Yeah, you know, these two were both dropped as I don't believe they were ever Merge, right? This was just closed and yeah, both of these were closed So they never were applied. So the question is if they weren't applied, where are we with them now? That's funny to remove a mitt. Yeah, we just did that I think Well, we're about to we haven't done it yet But we will and and those two would be just we're not gonna change the we're just gonna change the flags to default to being on We're gonna keep the flags and default them on give no way to not use them Basically the change. Okay So that one certainly take this is likely taken care of this one was a larger change Remember how many? How many updates? Yeah, there was 20 file changes. So there were a fair number of changes to do with these I don't know how many were Yeah, so some of them were real versus Or sorry, we're code changes versus test changes. So Anyway, you could do a bit of an assessment of where we are From an AIP zero if we are that close zero eleven might be one zero zero So yeah, I guess we're we're not looking at doing protocol support for did come to yet, but No, but we're getting close to being able to With the With this the rotate protocol that's in place Still a draft but That would enable us to get ready To transition to did come to okay, cool Okay. Yeah, if you could give us just a written update of what you think we're at that would be I think you're the by far the best to know at the envelope later where we are Okay, thank you. Can you hear me now? No, I can't Yeah, right with the integration work I'm working on just the backhand stuff. I'm hoping probably within a week or two of work I should be able to have that stuff polish and ready for a production. However Again, I'm off a couple days and then there's probably some stick handling And if they want me to do some front-end if they want me to build front-end buttons and stuff for it So I can see it stretching out all the way till maybe end of October Which would be which would then allow me to dive back into the did peer stuff. Okay, that's a long way Yeah, if they if they want me to build in the UI components have them like be able to update and error correct and things like that But I don't know exactly whether They're gonna need me to do all that obviously the less the better, but I also know that We want this built and if we want it built more than they want to build it then Yeah, okay, I'm probably the one doing it. So yeah It'll be probably a little bit more time before I jump back into the peer which is Unfortunate of someone to see that cost the finish line Obviously, I can't wait and if Bloom's able to take it then he should cool Yeah, I think I should be able to Put some time in it well before the end of October. So I think I might be able to leapfrog you out there. So, okay Okay, we've looked at the PRs If you don't can we extend this meeting a little bit more Does anyone mind I mean, I sort of assumed we would I think we need to change this to an hour long meeting anyway and Cut it short when we can I'm gonna have to leave in two minutes, but I I think you guys can carry on without me. I'm just listening not very helpful You're always helpful. I mean, I know Um any Okay, to keep going. Yeah. Yeah Okay Awesome that this is closed Daniel. Thank you for that great work. I'm figuring out exactly what was happening here very clever So this was submitted by Ariel from From the AFJ team Two services Acropy wasn't resolving them but the reason was because these IDs are identical and so when we were Serializing we were dropping one of them because they were the same Nice work. I noticed he's already got a PR into AFJ to fix their side of it Nice Okay, so 020 dev1 of an on credits RS is there which eliminates which uses the latest CL signatures So this is now ready available and so should be merged into an on credits RS Which last I checked was oh also on Daniel shoulders not good So at some point this needs to this will need to go in I suspect The peer did pieces probably higher priority, but Daniel up to you to figure out what what works for you I think either I cut out or you cut out for a moment there, but I think I got the gist of what you're saying um Yeah, the Did peer stuff is probably gonna be my my first priority for a little bit at least But I'll see if I can squeeze in some time anywhere for getting that merge taking care, okay? I'm pretty sure I talked the whole way through that so it wasn't on my side Bob shared components version We now have again tagged releases for ask our We're automatically picking up indy VDR and indy credits in aqua pie Or sorry indy credits are automatically picked up so indy VDR and ask our need to be added So those dependencies will be updated Imagine Uh shanjot that probably would might be one once you get through the last of your Work on the other side to to get this as a transition task We'll see how that goes Um I can I can probably put in a graph PR just to test Okay, those uh because there's a dev release of ask our Yeah, up that we can test against And it would be right that was the other part of that discussion um Should we go I I don't know how soon Zero three zero ask our will be out should we actually do a release where we rely on dev one or should we wait until I would wait. I don't think it'll be long but um One thing I'd like us to Validate is the postgres 15 Yes, okay on kubernetes because I can only test it locally. Yeah okay Okay, so Then andrew if you could do this upgrade with a work in progress and flag it for way he can run the Testing on the upgrade. Okay. Awesome. Okay. Good. Thank you And then this last one Yeah, this might be another good one to put into an upgrade again I don't think it affects us. This was a conversation and basically they're flagging that we're using a a dependency that's Got a vulnerability reported and it would be good if we could get past that um So it would be good to get this upgrade done sooner than later Uh, is a am I right in that any any objections? um And I'll just flag it as a high priority. So we've got the the button on it Um, I haven't seen if they've made any breaking changes Yeah, that's the obviously that's the whole question. I I'm not even sure what version I guess we're on Yeah, anyway Obviously somebody would need to run this and then see how we do with the the integration tests Typical dependency updates those are the ones I flagged any other ones people have to fly from the issues Did we look at 2501? I noticed that you had it in the list. I don't I don't know that I saw you pull it up Uh, oh I didn't pull it out. Um, so this one is just a Fun dependency dance. Um, so we recently added the multi-format librarian And there's an issue with using typing extensions greater than we're equal to 4.6. I think um The issue has been open for a while The workaround isn't too painful. Um, but it's Starting to cause a bit of a headache with resolving some dependencies. So Yeah, I think that typing extensions there's another one as well that There's a like one version that matches up between all the other dependencies and stuff. So yeah Yeah the The other thing that's kind of exacerbating this is we've also recently pulled in the peer did python library from sygba Uh, which also is perhaps a little overly picky of which versions of things. It's expecting Um, I've submitted a pr to them. Uh I haven't gotten much of a response from sygba yet. Uh, I'm meeting with them tomorrow So I'll I'll see if I can knock some heads and get things moving there Um, yeah, there should also be a pr for me from like a month and a half ago or two months And I never got a response which is Jet having the library generated peer three because it doesn't even know that dude peer Thieves a thing and it's a pretty simple algorithm So I tried to add it as a method to to that library and got no response So, um, yeah, they haven't been super responsive and if you want to poke them on that one too Yeah, I think probably the right answer is to encourage them to move it out of their repos. Um, yes Just not sure where you're exactly to encourage them to move things I guess. Yeah Are you a member of their organization? I am not. Um, well, I am in the github sense, but like I have very little I don't know. That's right. They make you a maintainer on that. They probably could And I could I could probably push for that as a stop gap. Um, yeah, uh I'll talk with them and see what's possible and uh, see if we can get things moving there so we can Uh unravel some of these dependency conflicts. Yeah, okay I should probably open an issue actually, um explicitly stating that While we've done the pited update on the zero ten two branch, we haven't yet done it on main Because of these dependency conflicts. So I'll open one up just to track that that needs to take place still Yeah, I've lost one of my topics in here Yeah um Yeah, let's hit this one first Um, so we've had an offer from disney Which is not disney disney Which is I think both the company well, it's a it's a linux foundation Uh foundation disney foundation Um, and I got a note from somebody involved in that that they want to implement open id for vcs in Um In acopai and they're looking for guidance on on doing that they've done a evidently They've made a few prs to just minor things, but they usually they basically use acopai as a black box And just use it So They are now interested in adding open id for vcs and they wonder Are wondering what guidance we have for them in what to do um I've invited them next week to I invited them here as well, but I figured it was too early anyway So I'm not bothered that they're not here. They said they couldn't make it, but um They're likely to be able to make the acopai next week um Thoughts on I believe we have talked about making it a plug-in. I have asked them for what admin api they They would like to have um, so what what interface from their controller they would expect um so Basically, we have the option of figuring out. Okay. Here's how we suggest you do it um, I I know Daniel you talked previously about doing it as a plug-in. Is that still where you're leaning? anyone else have other thoughts on On what to do Daniel So we've got a proof of concept that we've been working on for open id for vcs. Um It's The way we've structured it is we've actually had it be a separate service outside of acopai and we're just making use of Like the jwt sign and verify endpoints Yeah provided by the admin api to perform the crypto um Take advantage of of you know, secure storage all that stuff. Yeah And then just implementing the open id for vci protocol within a separate context We're like We're still pretty early stages. I would say with that I don't think we have a problem with being more open about our our progress and work on that so far but we we have been kind of Behind closed doors a little bit so far on that And most of that's not because there's anything I actually secret there just Yeah, we're just, you know, don't want to air the dirty laundry out. I guess So, uh, yeah, we're we're still working on that. Um, we're to a point where we're interacting with uh, the spherion wallet Which has open id for vci support Um, just because it was there and available and it was easy enough to pick up and and use it to interact with things Yeah So that might that that I think that would be something that we'd be happy to demo on like an akapod call Soon ish I'm not sure if next week is too early or not. Um, I'll have to talk to adam and char and see How they feel about that. I guess not to put adam on the spot here Um Well, I think for me to do connect you guys directly with Sergio Um, who's the person that's been talking to me directly Um, I certainly wouldn't mind talking with them and and sharing what we've learned so far at least. Yeah. Yeah. Um I can Probably join in as well. I've done a quick proof of concept Open id Issue in some presentation also with the spherion wallet. I think it mostly only supports the Jwt vc, what is it? Jwt. Yeah, jwt vc drop profile at the moment Yeah, it sounds right Or the sometimes it's called the jff drop profile. I think So here are the disney Foundation members Um, so I I think I've heard of this. I think it was mentioned at the linux foundation meeting notice. It is a linux foundation Uh community if you will And info search certainly is Well known in our community Um, not too sure. I'm pretty sure I've heard of nimlab before Possibly gaya, um, but it's a it's a decent possibility. You might be able to get, um You know, you might be able to be used, uh, you might get development help on this so That could be a good reason to do it So out of curiosity since hansher mentioned The proof of concept. I'm curious in in your approach. Have you been doing it? Similar to how we've done it just outside of akapai or or what is your approach been? Uh, I wasn't using akapai okay, so it's uh Just a it's like one one python file that generates a a jot and sends it over Cool, um and has the oauth endpoints right the paradigm wallet ought to be an option as well I was running into some some strange issues there that Will probably be fixed soon, but Um, I was able to issue a a jot to it yes We have plans to uh to use the afj open id for vci client package that they've got and try to set up some automated testing on our side um and Test that out as well. Uh, haven't gotten to that quite yet though And I assume this is akapai as an issuer and verifier great Yeah, yeah In the very literal sense where it's just signing the credentials and and uh performing the key look at the look up and uh signature verification. Yeah. Yeah Yeah, I mean we can and probably ought to track things internally as a protocol with states the way we do Um over didcom But uh that would Require some api changes if it's done externally so we've This is something that I could I could see going either way to be honest. Um, so far we've been um Pursuing it and like so it's a companion service to akapai and we use akapai for the issue of verify steps but then also We're expecting a controller um to the The service that we've put together and just like how akapai delegates the business logic to its controller uh similar model where we're delegating like The determination of exactly what credentials are on offer um to the controller and uh Letting it handle the storage of those values as well So regardless of how the you know the values intended to populate the credential are are being obtained whether it's through Like a form submission on a website Or if it was pulled from a back end or something like that, uh, we've been delegating The reporting of the actual values to ultimately be issued um to a separate controller service Okay, I think you can also You can do it mostly statelessly by Using like an encrypted jot in the id token I think that's right. Uh, so you You know you can put all the the issuance parameters in there And then they will be submitted by the client In the final step Right Interesting. It's just the state parameter. I think it's called I'd like to take a closer look at that Um the I guess the the bigger barrier there is if you want a small qr code Then you probably want to shorten that to just a reference right um So in the flows that you've been implementing it sounds like you've been doing the pre-auth flow as opposed to the authorization code flow Yes Right because those are also the only ones that are implemented by saryon and the other way. Okay. Yeah. Okay. That makes sense um Yeah, so I guess to summarize the topic a little bit here. I think There's there's obvious tie-ins to akapi and there's ways akapi can support doing open id for vci But i'm not sure that I would have that be a direct responsibility of akapi still Um, and we've had it be slightly more decoupled than having it be a plugin So far. So it's just something that depends on the admin api yeah Yeah, I mean if you can create jots and sd jots through the api, I guess you you can just glue it all together at the controller level And we can We can add more of the glue later on for akapi to do those things automatically Yeah, for sure Okay, um, what I'll suggest is how about this i'll i'll create a dm conversation with the three of us and Sergio And then we'll tentatively say at akapi next week. We'll talk about this Um, but base it on how you know where he is and what what value you think you can get from him Does that sound right? Okay, and then if if we don't think you know, he's actually got Got much then we'll we can defer it if we feel like it cool okay, um Sherman, uh, do you want to give us a quick update on where you are in rs I saw lots of closing things yesterday and merging of pr. So I was happy to see that What's next? Um I think i'm gonna try and put the rotate api in Oh, I thought it was done. Sorry No That no because we did that after we started the non penciling. So that's going to come in Hopefully that's not Any kind of trickery or anything? Um Yeah, hopefully it's pretty straightforward. Um And then there's still like all the pie tests have been commented out Which is a chunk of work that I'd like to get into in place to Remove ones that aren't needed and get the other ones updated So that they aren't just forgotten about Then there's a big one that I think should probably be tackled soon and the reason I bring it up is so it's Quite diverged from me So that's I think 24 11. I think it's the ticket number For that So that needs to be done And then that's also the work that I think Andrew and Daniel have to coordinate because there's going to be that chunk of work for The that Andrew did with the stuff So I'm suggesting we bring that I'm going to be away In two weeks so um So one punting it off on other people Is good for me, but also that will be a few days where I'm not doing any work Yeah, oh, I think 506 that I believe that's 2506 which is upgrading to an on credits and Sorry upgrading to an on credits to zero two zero and in doing that um Adjusting the revocation end points to deal with the fact that tails files are no longer needed for issuing and And revoking but some additional Fields are so the the things that Andrew did when when credits was upgraded on the mains on the main branch Yeah, so I guess there's a few tickets. I'm just like there'll be on The 10th through the 13th. I won't really be working So it's a good opportunity to kind of get that branch cleaned up without me trying to you know, I think it'll be tricky enough getting it Kind of in sync with me and touching up all those missing things But it'll be easier if I'm also not actively working on something so Just planning forward if if um, we could get the resources together from the 10th october 10th through 13th to tackle that I think would be ideal so there's not two different things going on Um, I think that also happens to be IAW. It is. Oh So it's a bad. It's actually a bad time Okay, well, that's too bad I just thought it'd be ideal that I wouldn't be like bashing away in there and causing conflicts in that. Um, so maybe we'll have to think of that rethink that but um Other than that, yeah, I There's a lot of little things like say that the cleaning up those tests and stuff and getting those into sync um probably We've kind of skipped over the endorser side of things Um, yeah, yeah That is the only I think that's the last big thing left Yeah, and then then it moves into how do we migrate there's a lot of tickets about You know migration processes and things like that that have to be squared away, but um, yeah, I think The endorser thing is going to be a fair chunk of work. Um, yeah So right now there's a bunch of all all the Yeah, there's a whole bunch of B2E tests that are commented out because they rely on the endorser and um It would be nice to deal with that. Um Yeah, I mean things are going they're going slowly It's one of the big problems in the revocation arena is that I have I have no idea what other than the concept of revocation I have no idea what the contents of the tails like I have no idea what any of that at a technical level means So it's it's uh, it's difficult. It was difficult for me to know what was going on and what I was ruining or whatever, so Um I could have given you a full overview of it Yeah, it's just I don't know the code level, but I definitely know all of the concepts and what's in it and how it works I should probably get a still get a brain dump of all that just so that I know going forward what what At a technical level kind of what's what's happening. Um So that was a bit of a that was a bit of a slower thing than I think it should have been but that's Maybe my fault for not saying hey, I don't I'd like to know what This means that means but um, so by moving on. Yeah, uh, the get the rotate one in there um, get the tests kind of in sync with whatever is going on and then, um Yeah, the endorser is probably the next big thing after that. Um, but if we can't coordinate um The merge for main and the that cleanup while I'm away. Um, that's kind of huge as well So we'll have to figure that one out in short order Okay Okay All right, I think that's everything And we're pretty much in time anyway anything else we should raise at this point. Um One last thing that comes to mind So we've talked about creating a plug-ins repo. We haven't done that quite yet, right? No, um We do have a developer. We're thinking of putting on that as soon as he becomes available He's getting his first taste of aqua pie um the repository but um We weren't able to shift him into that already but the idea was for him to create the repository and begin to Foculate it with existing plugins Okay, uh, just thinking thinking ahead, I guess a little bit to a one dot o release Perhaps it's a little too ambitious But it would be kind of nice to be able to drop some of the less critical things into plugins things that are, you know Use case specific for instance mediation Yeah, uh, having that all be contained within a plugin would be nice, uh Also, I think it would be nice to be able to move the connections protocol out Um as well. Yeah Yeah, I had that repo that was like a proof of concept of what we wanted out of there, but it's been kind of sitting around waiting for Such an opportunity as to actually populate it was something useful. So Yeah, it'll be interesting to get that in I know there's there's a couple of small really small plugins in traction that aren't really Traction specific so like change the connection alias really small things basic message storage Stuff like that. That's not really like say traction things and just kind of little enhancements that They they can probably move out of there as well Um, just so there's few more real simple examples for people that want to do stuff and contribute. I think but yeah I like your idea of starting to move stuff out um where possible and uh Yeah, that would that be be interesting and also good because I think we can That way we can also tighten up the core acupuncture code as well. Yeah, exactly. Yeah so Is the goal for this repo to house all the code of all the plugins or just like references or installation like Yes core What we would call core plugins official plugins official plugins things we don't want in may um in acupuncture, but we do want readily accessible and and such that people can add additional plugins that Make sense I just I just very easily predicted in like two years will be like this repo is too big We've got to split split them all into their own repos um But if if it's if it's yeah, if it's being um narrowed at least um, that makes a little more sense. So, okay Just wanted to yeah, I mean when I heard that My other side fear is that we get a thousand repos and they're all different. Um And and that too becomes unmaintainable. Yeah, no, that's fair. That's fair No, I think I think it's uh, again And also like we can draw the line and seem like oh, this shouldn't even be a plugin at all Like let's just make a native behavior, right? Like exactly or this is too obscure that you can create your own repo in some place else Yeah, no, I think I think that makes sense. Just wanted to raise that. Yeah I almost want to be able to use it as like the graveyard for for deprecated protocols as well and And in that case, I would want to see things like be removed altogether eventually But until we're to a point where you know, the whole community has migrated away thoroughly enough Then it's available at least as a plugin and we can put breaking change Into the changelog and say here's exactly how you retain this if you need to Yeah, you can restore it by by including the obsolete plugin. Yeah, that's a it's a good framework to transition away from the core functionality Yeah Awesome. Okay. We're out of time Thanks all It was a good meeting. I think I will extend this to an hour and Um For our team at least probably cancel Suggest we don't have a Tuesday stand up and For our part we'll do this and others can figure out what they want to do We'll see Anyway, I appreciate everyone being here And Happy delightful rest of your day. We have some things to do Thanks


Now that we've explored workplace scenarios and general behavior, let's jump into how you'll actually talk to people at the office. A face-to-face meeting has its advantages, and you can't hide in a cubicle all day. But more and more often, technology does a lot of the work for us. Additionally, technology is constantly changing, and in order to know the proper way to use new devices and software, you must keep up with your training. In Unit 2, we'll learn how to utilize and create effective channels for communication, even amongst workplace distractions, like ringing phones, last-minute errands, and of course, YouTube. With these lessons, we can establish tools and tricks towards communicating in various ways via various platforms. We'll even get down to nitty-gritty details like grammar and punctuation. Let's get started.


But what if I tell you that other people had actually made it happen within three months and you can do it as well. You just need to push through your dream and challenges. Today I had a pleasure to invite our alumni Tina Chan to share with you guys how she was able to conquer all the challenges and become a successful product manager within three months and even if she had no technical background, no PM experience but she was able to become one of those role models inspired millions of women's out there. Hey guys this is Dr. Nian City, a direct product and featured in Forbes. I've helped 100 people lend their dream PM job offer in fan companies and unicorn startups and continue to get promoted as a product leader. If you're interested in product management course, please go to PMExceler.io to learn more. To learn the most effective way to become product managers, you should subscribe to our channel, hit the bell button and like this video so you'll be notified every time we post a new video every week. Hi Tina, how are you? So glad to have you on our show. Hi Nancy, how are you? I'm doing great. I'm so glad to talk to you. Yeah, you graduated like a few months ago, feels like. Eight months ago. Eight months ago. Eight months ago, awesome. Yeah, feels like. Just like eight months have changed a lot, especially you have been doing so well for your new career. I'm so glad for you now share with all the audience and especially lots of women are out there or even men and women or immigrants that feel like they don't have as much of knowledge and background and you had a breakthrough.  Can you do a quick introduction of yourself? Hi everyone, my name is Tina and I am currently a PM at Zero. On the side, I love building products so I have an e-commerce store and I love creating stuff so I have a YouTube channel sharing my PM journey how I break in with no experience at all. Awesome. So Tina's YouTube channel is very popular. We're going to link it in the description of this video. Everyone needs to follow it. I am trying. I'm trying. I'm trying. You're too humble. Awesome. You're waiting to see the next YouTube star out of our alumni community. Awesome. Cool. So Tina, you mentioned that you actually came from customer success background. You have no experience. That sounds like huge challenges for all the aspiring product managers thinking about breaking into PM. Can you tell us regarding what are those top three challenges you have and how exactly you conquer those challenges? Right. The top challenges that I had is first, I always, when I'm in the program, I always see other students that have like great background. They have consulting, they are from big four and then they are like, they have computer science degree, they are data scientists and fun fact, my career started when I was a customer service and customer service and tech is just so irrelevant and my biggest fear is I don't have the skill set to break into it and that's like the biggest challenge. That's like first and then second biggest challenge is that whenever I send out my resume, I just don't have response because my background is all like very customer centric but then when you know like a lot of company they use the AI to filter out the resumes because my resume is very customer centric so when I send it in, I will just get like, I just have no response so I can't even land an interview. So that's my biggest challenge and my third challenge is that because I don't have experience, although I have like relevant experience like working on project with my previous companies around like PM stuff but I don't know how to package it in a way that it's going to make me stand out. So that's like my three biggest challenge, I cannot stand out, I don't get called from HRs and I don't have technical background. So Tina sounds like huge challenges and people will be scared but you push it through. Can you tell us how do you solve these challenges starting the first one? Starting with the first one without technical degree okay so I just have to tell everyone that this is like the biggest myth. You do not need to have technical background. I mean it's great that you have because you can talk to engineer, communicate engineer easier which is what I found at my job right now. I have the biggest style when I'm in my role, I talk to my managers, I talk to my PM peers, now like I get to know them more, I'm like hey I don't have technical background, is that okay?  So if you are like me, you are you need you have customer background, be proud because you can talk to the customers. Yeah exactly. Yeah we have seen a lot of people actually more than half of our students do not know how to code, no technical background at all, no even like no technical degree at all but they all like become a product manager. I think lots of people just think about because tech company, the name is like tech and they're like oh I need a computer science degree and then once you spend thousand stars on computer science degree, you still couldn't become a PM because you don't know how PM works. Yeah it's a myth. Yesterday I was talking to my colleague in the social event and then she was like I don't know how to reach out to customers, I'm so afraid to talk to them and then I'm like oh okay and then at that point I'm like okay yes I am worth it, like it's a worth, yes I have value so I think people who have customer background you guys need to be proud. Oh this is amazing and especially verified by your co-workers. Yes and then I used to work at Uber so I work at Uber, I work with the UXR to do like survey, to do like interview with the customers and that's like just up level of me, you know even though I don't have legit PM titles but I have projects where I can showcase myself, I can improve myself, I remember when I was joining this program then see I was talking to you, I don't have experience and you're like Tina like you need to move away from this mindset, like if you just keep having this mindset like you're not be able to land a job because I think I don't have experience but all these little projects actually count for me to come to the customer like just do random stuff, not random stuff but like valuable stuff, it helps. Yeah exactly lots of people actually do have the relevant experience but they never speak, yeah but they don't know, they don't know until they start to learn the end-to-end product management by methodology is like oh right but I think I had it. Yeah I think what's like different in your program is because you like talk to your students one on one every time, it's not like you come to class and then you teach the course and advise you later, you're like okay here let me help you tell me your story and you're very good at picking out a student's story and then tell the student hey Tina like you're actually good at this, this is really important, you should help the students to realize what they are good at, I think that's like different, so I know what I'm good at because before I'm like oh I know nothing, I'm not very good, I don't know anything, I cannot get a job, yeah. Now I was like whoa highlight your customer experience, you're all in this. Yes, yes, awesome, I didn't know it was worth it but yeah. Awesome, so now talk about not able to learn interviews, how do you get 30% jump? So again like I touched on, I had relevant experience working on projects but I don't know how to use like the PM link for example, I do like customer interview but I don't know that's all user research, for example I talk to the customer and they want something and I share these like whatever feature they want to the product team and that's filing or sharing pain points, that's pain points and I just don't know like I need to use this like keywords and after you know like working with you and then working with the recruiters in the program then they help me to, they teach me how to write it in a PM way versus me just writing it as me like writing up bullet points, more effective and more efficient and more like able to highlight my experience in the PM field. Yeah exactly, actually we have a YouTube video about different kind of keywords people need to put on the resume and you guys can check it on top of this video once you switch the mindset, immediately increase the success rate, like 30% more right away, awesome. So now let's talk about your third challenge which is you said you don't have experience, we kind of mentioned earlier right? Yes, yeah the third challenge is also like my biggest worry, I was worried because I think I don't have experience but I think what, how I overcome with this challenge is that one tips I found really helpful is I go on LinkedIn and I look at different job posting and I will highlight each job posting's requirement and keywords, I'll be like oh like this, I think I know how to do this, I did it before and then I just kind of like use that keyword and then make portfolio, product portfolio, which Nancy like you really helped us to you know create a product portfolio, highlight all the experience that other job posting has and then showcase it and send it to hire managers, send it to like the HR to showcase even though I don't have experience but I've done something similar before, trust me. So that's like actually help as well and also like practice, doing this actually helped me practice my PM skills in the job. So one of the things that Nancy touched on before in the program is creating product persona, customer persona and then you touch on that so much and I remember the first time I created Nancy like no this is wrong, I do this and then you give me so much feedback but I learned and then the first three months when I first hired at zero, I created customer persona for my company, my manager was impressed, he was like oh my god this is great, so I learned, thank you. Awesome, mind blown, yeah I love seeing all of you guys just improve massive real skills, I think that's a fun part, learning a job, getting paid it's not about just getting paid, it's about actually you love the product and then starting from day one you create amazing customer persona, this is beautiful, awesome and so Tina can you tell us what's the biggest mindset shift that you had to push you to the next level? I think the biggest mindset shift that I had was when I started getting interview calls and then when I started like passing like first rounds of interview and second rounds of interview and then coming back to the program and keep like mock interviewing with you and then with other mentors and then just keep improving and then knowing this is actually doable and then this is just like a numbers game, I remember you mentioned this a lot like it's not just us, it's not just like a company looking for candidates, it's us looking for right fit as well so I started to have this mind shift where I think that it's okay if I don't get a job because this job is not meant for me, I'm also looking for my for my own job and that's when I started to feel more confident, I'm like I'm also looking for my fit, it's not just they are looking for their fit and then I like started to present more confidence and and then and then just it just worked out because I'm like presented more confident and then yeah I think that's yeah this is awesome and I do like the insight you shared regarding it's like dating process yes yeah it's you need to choose the other guy you cannot let the guys choosing you it's up it's wrong we want to take out the power in dating the same thing as for job hunting as well so yeah I think this really helps like I think I remember before I went on all my interview before before I like hop on the zoom I just I really like take a deep breath it's okay I'm also finding my fit it's fine if it doesn't work out you know like the universe it's gonna send the right fit for me it's totally fine and then that just like calming down and then making more confident this is awesome it sounds weird but yes it works yeah yeah later on I told others a new trick which is very funny was about during the during the pandemic oh sorry during the layoff seasons we're going through layoff season right now it's an arranged marriage match not just random match like become an arranged marriage match have a perfect match but it's still a match process um yeah change your mindset change your life hey guys like this is a golden tip you had today and so Tina you have been a part manager for eight months already so tell us what do you do like a p.m like 30 seconds what do you do at the p.m every day people are very confused I think what I do as a p.m it's literally what Nancy's program mentioned we write user story we write acceptance criteria we create customer persona we prioritize the roadmap and then we make decisions based on you know different criteria that we learn in the program impact risk all that thing you know we communicate with stakeholders you'd be a really good collaborator and communicator so then when you are shipping and launching product you don't step on each other's toes and then just launch reiterate ab testing awesome sounds very simple but you do need to watch her day in and life as a product manager I'm gonna put right here it's also on her youtube video which has all the details behind scene stories and actually I really love the pace in the music very chill on Friday night when we don't watch like Netflix videos watching what you're doing awesome I gotta put it up there so Tina what advice do you have for others who want to start their p.m career especially have just gone through the process yourself um if they want to start a p.m career what advice I would get if um I will give advice to people who are similar to my background which is having no p.m experience or or only have like small relevant product p.m experience which is just keep applying keep mock interviewing and keep working on side projects because side project is where you can practice it's not just like showcasing the product to the to the interviewer it's own it's also for you to practice how can you be a good product manager creating portfolio pick a product you're interested in and then going through like the product lifecycle I think that it's what really improved me the most I learned from not knowing how to write acceptance criteria to know how to write acceptance criteria and this is what I need to do on my job day to day each product that I build I need to write acceptance criteria how to create a persona a custom persona it's not just like ascension like as you mentioned Nancy it's not just about right finding a job it's about can you do the job once you land a job too so doing creating product portfolio not just helping you to land a job but also helping you to you know not get fired after you have a job exactly actually have to actually get promoted also what one of my students uh oh Mimi got promoted within a year in her new job you have four months to go you might get promoted as well she started to manage people now she became a good manager in a year wow good for her yeah awesome we have great chance to continue working on the great job this is amazing Tina awesome okay great so everybody thank you so much for joining us and thank you Tina for sharing all the amazing advice with other people and actually Tina brought in a very important part I want to highlight this for everybody it's very important you exercise the pm skills before you even start your pm job and also get feedback regarding writing requirement not just writing everyone knows how to write but most people do not write good requirements right so people need to learn how to do better um so we have the product portfolio methodology and one can just use the same methodology we have like free training on product portfolio free tools I'm going to list all the free product portfolio tools in this video and also in the description of this video and you guys should just get started right away started for free awesome oh anybody who is interested in pm exciter feel free to go to our website pm exciter.io to learn more I'm looking forward to see all of you guys being a successful product manager in the long run awesome awesome so Tina thank you for joining us and so great to see everyone here in any last minute tip you want to give others and also how others could find you in the future you know you guys can do it even without experience because I did it so you guys can do it to believe in yourself be confident and you know just off you go you will be great and if you want to have questions more questions from me feel free to connect with me on linkedin and also I have a youtube channel I share about everything about pm highlight a job my journey day to day stay in life go check it out awesome so we're going to link it in the description of this video and if you find this video very valuable make sure to like share this video with any expert and product manager and comment below let me know if any other questions I'd love to see all of you guys become successful product manager in the future and this is dr nancy from pm exciter die on we'll see you in the next time bye guys bye


Welcome folks, we have the Dow Industries trading up $210, Nasdaq is up $31, S&P is up $18, Gold Contract up $25, trading at $18.17 an ounce, we have Silver up $0.28, $0.24, $0.19 an ounce, Light Sweet Crew, check this out man, holy cow, up $2.50, $0.81, $0.32 a barrel, notes and bonds, the 10-year up $17 ticks, trading out at $131.27, the 30-year up a full point plus $24 ticks at $162.29 and on the bond market folks, $32 ticks equal one point, so you're almost up two points inside of the 30-year. What you have out here, the 10-year is yielding today, $1.45, rates are going down, prices are going up and $1.00, $1.00 failed at its high, bottom line, you're down $29 ticks, that's not a lot, but you're still dealing with a, $1.00 is fighting over $93.29, right now we're over it, we're $94.38 and it goes over its highs, it goes underneath them, bottom line, we'll see how this baby shakes out. The Euro is at $1.15, the Anisep, $113.41 and the British Pounds at $134 to $1.00. You know when we take a look at the spy, what you have at the spy, we're all at all time highs, that's the bottom line. You've got $146, you're at $468, NDX 100, same type of setup and the NDX gave it up intraday for a few minutes. Bottom line is that you're at $398 inside the Qs, gold contract, bottom line finally caught a bit again, gold, my take is that we're going to go higher, we're going up to this $18.36 level. What we just did is that we do have an ABC structure on the way up, now the ABC on the way up is a beauty man. We took out the 1815 area, I think it was a 90.8 AB, yeah it's a 90.8 AB which would get you into 1848 and it's 1836 that my take is going to, if we go to 1848 guess what, you're going to be up at 1922 on about a heartbeat. Notes and bonds, we take a look at notes and bonds, we have with notes and bonds out here, 10 year, it's up 17 ticks, what do you have with the 10 year right now, also wide price spread, accelerated volume, this 10 year is going to make its way up to the 13312 and let's go take a look at that oil market out here, talking about a bid man, holy cow. You take a look at the oil market, well, you get a consolidation, stay right there folks, come right back.