So, uh, hey everyone, and uh, thanks for attending this session today. Uh, can everyone hear me okay? Okay, great. Uh, I'm Naranjan. Uh, I'm currently a software engineer working on the Itzdo add-on, uh, for AKS at Microsoft. Um, specifically right now, um, I'm focusing on, uh, multi-cluster, very topical, um, edge traffic management, and, uh, various other Itzdo features that we are incorporating into our add-on. Uh, so today, uh, I wanted to cover some important, uh, security considerations of using Itzdo. Um, both based on some, uh, feature requests and, uh, frequent questions that we've received for our add-on. Um, as well as some, uh, broader guidelines and best practices that have been adopted throughout the Itzdo community. So, throughout the ecosystem, um, it's become pretty common to refer to Itzdo as being, uh, secure by default. But, uh, to borrow a phrase from the book Itzdo in action, which I highly recommend, uh, everyone here, check out at some point. Um, it's more appropriate to consider Itzdo, uh, almost secure by default. Um, so even though a lot of Itzdo's, uh, security capabilities like MTLS and automated certificate management, uh, are enabled out of the box, um, there are still various vulnerabilities and loopholes that operators need to be aware of and take actions accordingly. Now, there is being work done by the project maintainers and various stakeholders, um, to make the default settings more secure. Uh, but there's a, a limit to how, um, robust these baseline security settings can be. Uh, just given the variation in architectures and networking typologies with, uh, Itzdo and Kubernetes, a one-sized, uh, fits all approach to security, uh, is just not feasible. Uh, in terms of what these potential attack vectors and, uh, security risks are, um, there are quite a few that are worth considering. Uh, we still haven't fully locked down communication, especially when it comes to, uh, restricting inbound and outbound traffic. Um, we haven't addressed the possibility of misconfiguration and configuration drift, uh, which is a problem throughout the cloud native and Kubernetes ecosystem. Um, staying on outdated Itzdo versions with CVEs is another major one. And even after we take some steps to harden our environment, uh, there's still avenues of bypassing our security controls. And a lot of that stems from relying exclusively on Itzdo as a mechanism to secure our applications. Um, and also without the right level of telemetry, uh, we might not be having enough insights into our environment to detect anomalous behavior. Um, or on the other hand, uh, we might be, uh, end of being too verbose with our logging and inadvertently leak sensitive information. So what we should be striving for, uh, is to implement zero trust principles. So, uh, never trust and always verify, least privileges, and assuming that an attacker is already in our network and attempting to limit the damage that they can do. But fully putting these principles into practice requires some additional steps on our end. We also want to achieve defense in depth. So, building a holistic security architecture so that there isn't any single point of failure. So not only do we have more Itzdo configurations, uh, that we need to tweak, um, but we also need to look beyond the service mesh itself to incorporate additional tools to establish guardrails at multiple layers. So some of the areas, uh, we'll be looking at will be authentication and authorization, uh, edge traffic, uh, PKI, and a few others. And, uh, to conclude, I'll showcase a brief demo of what a more secure setup, um, that incorporates multiple controls could look like in practice. Uh, I also just wanted to point out that this list is not all inclusive or exhaustive. Um, it's pretty much impossible to, uh, squeeze in every single threat you might face in a 25 minute session. Believe me, I tried. Um, but at the same time, uh, you don't necessarily need to account for all of these risks or, uh, take all of these measures. So, uh, the goal of this talk is to, um, provide an overview of various security risks that could be applicable to you. Um, and propose some solutions and tactics for you to explore later. So, to start off, uh, let's talk about authentication and encryption. As I was highlighting earlier, uh, ITSDO does, um, enable auto MTLS, uh, out of the box. But, um, it's important to delve deeper into what exactly this means. Um, there are two levels to MTLS. Uh, one is what kind of traffic our servers accepting, which is governed by the peer authentication resource. And, uh, the other is what kind of traffic the client side cars are sending out. Uh, which is controlled by the destination rule. Um, so the default peer authentication setting in ITSDO is permissive mode. Uh, meaning that even though auto MTLS is enabled, uh, by default, the side cars can still accept plain text traffic, uh, from non-meshed workloads. And, uh, the reason of, uh, having it as permissive, uh, is to make it easier to migrate your applications, uh, to the mesh, uh, especially for, uh, larger organizations where onboarding can be a very complex process. Uh, but once you're done onboarding all your applications to ITSDO, uh, you set the MTLS mode to strict to, uh, enforce that MTLS is used. Um, so after migrating all of your workloads, uh, you can create a peer authentication like this, uh, in the ITSDO system namespace to configure, uh, strict MTLS at a global level. Uh, however, uh, this setting of global MTLS can be bypassed. Um, in ITSDO, a, uh, workload level configuration would take precedence over a namespace level configuration, and in turn the namespace, uh, would take precedence over a global configuration. So, um, if a non-admin for example, uh, creates a peer authentication with the mode as disabled, uh, our permissive, um, or permissive, uh, that targets a particular workload, uh, then this would override our global strict MTLS policy. Uh, the same by the way also applies to destination rules. By setting the TLS mode as simple or disabled, uh, we can override the, uh, global auto MTLS setting. Uh, as I'll talk about in more depth later, uh, the solution to prevent bypassing of the peer authentication and destination rule settings that we want is to leverage policy enforcement. Uh, so now that we've touched on authenticating and encrypting communication, um, we can use the authorization policy resource in ITSDO to set access controls. So, uh, which workloads are authorized to communicate with each other. Um, and we can also be pretty granular about how we set these rules. Uh, for instance, um, authorizing requests based on the originating namespace or, uh, service account or also based on specific ACTP methods or request headers. So a recommended best practice is to create a, uh, deny by default authorization policy in the root namespace and then from there, uh, explicitly set your allow permissions. Uh, so now, uh, we're implementing the principle of least privileges, uh, by explicitly permitting communication on a case by case basis. And also, uh, as per the ITSDO documentation, um, some recommended safe patterns for, uh, authorization are to use, uh, allow with positive and deny with negative matching and to also use, uh, URL normalization, uh, to prevent bypassing or policy mismatches. Uh, while ITSDO's, uh, authorization policy, um, on its own is pretty powerful and flexible, um, it's possible that you might need to use a more sophisticated, uh, authorization mechanism like, uh, Open Policy Agent or, uh, OAuth 2 Proxy for instance. Um, if this applies to you, uh, you can configure an, uh, external authorization provider through the ITSDO mesh config and, uh, set a custom action in the authorization policy, uh, to delegate the authorization decision, uh, to the external service. Uh, we also need to validate that the end user has valid, uh, credentials from an identity provider. So you could use the request authentication, uh, resource to verify the end user JOT token, uh, based on the URL of the provider's, uh, public key set, uh, and then, uh, the request authentication, uh, will extract the claims. Um, but if you actually want to, uh, deny requests or set access controls, uh, based on the claims or deny requests without JOTs, um, then you need an authorization policy on top of the request authentication. Uh, sometimes folks forget about the authorization policy. Um, and in ITSDO, this end user authentication and authorization would typically be done at the Ingress Gateway, um, at least in most cases. Uh, it is worth pointing out though that, uh, while you could use JOTs at a workload level, uh, for communication inside your mesh, uh, this is typically considered a less secure compared to MTLS. Um, but if you want to use JOTs or, uh, end user verification for intramesh traffic, uh, I would advise to use some kind of token exchange mechanism, um, and use, uh, JOT authentication on top of MTLS, uh, inside the mesh, not as a replacement for it. Um, also because ITSDO can't get access to all the JOT fields, uh, besides the issuer and, uh, different providers might put, uh, more information in other fields, uh, you likely need to integrate with an external authorizer, uh, to write more granular policies. Uh, the next crucial consideration for, uh, improving ITSDO security posture is how we manage traffic at the edge. So a good rule of thumb is to have the, uh, ingress and egress gateways, uh, in their own separate namespaces, uh, and then we can restrict access and configuration of the gateways, uh, to administrators or whichever team in your organization is managing traffic at the network boundaries. And when we expose our services, uh, externally, uh, in the gateway custom resource, uh, we want to define them individually and explicitly, like the configuration, uh, on the right, um, instead of using a wild card host, uh, as is the case, uh, with the example here on the left. Uh, to secure traffic through the ingress gateways, uh, we want to ensure that the incoming traffic is encrypted. Uh, we could either use, uh, do that by using, uh, SNI pass through or TLS termination, uh, depending on whether the back end application, uh, is serving HTTP or HTTPS. And, um, as touched on earlier, uh, we could also have the request authentications and authorization policies, um, that target our ingress gateways. It's also not uncommon for users to integrate their ingress gateway with, uh, some web application firewall, uh, to help prevent against, uh, various type of web exploits, uh, like SQL injection, uh, cross-site scripting, or DDoS attacks. Uh, you could either do this by integrating with an open source tool, uh, like OWASP, uh, Coraza, um, into your ingress gateway with a Wasm plugin, or, um, you could also have a cloud-based WAF, um, in front of your gateway. Uh, another option is if you're looking, uh, specifically for rate limiting, uh, you can configure this through an Envoy filter. Uh, I would add though that, uh, we're, though we're talking specifically about ingress, uh, right now, um, you can use web application firewalls, uh, or, uh, global or local rate limiting for, uh, intramesh traffic as well. Um, there's a great lightning talk from earlier today that unpacked this more. Now, for managing egress traffic, uh, the first thing we need to do is set the outbound traffic policy mode, uh, to registry only from the default value of allow any. Uh, and then the mesh administrators can create, uh, service entries to selectively add external hosts, uh, to its DDoS service registry, uh, to make them accessible from inside the mesh. Then, uh, once we route traffic, uh, through the egress gateway, um, there are two layers of controls we could use to ensure that the egress gateway isn't bypassed. Uh, one we could use the sidecar custom resource in it, in its DDo, um, to limit the scope of the outbound listeners in the proxies themselves. And on top of that, uh, we can use Kubernetes network policies, uh, to block any traffic from pods that aren't destined, uh, for the egress namespace. Uh, another piece of advice is to perform TLS origination, uh, at the egress gateway, and have MTLS set between your sidecars and gateways, uh, in your destination rules, as opposed to, uh, originating HTTPS traffic from the applications directly. So the advantage here is that you can then, uh, target the egress gateway with authorization policies and have even more fine green control of your outbound traffic. Um, it's also best practice to have the egress gateway deployed onto its, uh, own dedicated node pool. And then you have cloud firewall rules to block any requests, uh, that aren't routed through the egress gateway nodes. Um, if you're interested in diving deeper into egress traffic management with its DDo, uh, I cover this more in greater detail in a previous lightning talk for last year's ItzdoCon. Uh, next, uh, let's talk about some additional steps for certificate management with Itzdo. Uh, so by default, uh, ItzdoD will act as both the certificate authority and the registration authority. Uh, meaning that it both verifies the certificate signing requests, uh, and, uh, issues and signs workload certificates. And to do that, it uses a self-signed root certificate, meaning that your root of trust is generated by Itzdo itself and, uh, that signing key is just living as a secret directly in your cluster. So, um, that typically isn't really safe for production. So one alternative framework, um, is to use a plug-insert model. So here, uh, ItzdoD would have an intermediate certificate, uh, issued by a root CA that lives offline. And, uh, the root cert, uh, can be secured, for instance, in, um, some cloud key vault or key management service. And then, uh, Itzdo would use that intermediate cert to issue and sign the workload certificates. The other approach would be to use an external CA, um, so here, uh, we'd be delegating the responsibility of issuing and signing certificates to an external service altogether. Um, there are multiple options here. Uh, you could use, uh, cert manager, uh, Spire, Kubernetes CSR, or, um, even different combinations of all of these. So, uh, in the example up here, for instance, uh, you have cert manager, uh, acting as the root CA to, uh, issue certificates to ItzdoD and the Spire server. And, uh, you have Spire receiving the CSRs and issuing the workload certificates. As for which one of these PKI models is better, um, it really depends. Uh, each one has its own respective advantages and disadvantages. Um, and organizations are also using different deployment models and, uh, they have varying requirements, uh, in terms of their, uh, PKI infrastructure. Uh, if you want a more detailed overview of the pros and cons of each of these approaches, um, I would highly suggest checking out some additional resources online. And, uh, these two talks, uh, right here from last year's KubeCon and, and ItzdoDay, uh, would be really good places to start. Uh, another important mechanism for enhancing our security framework, uh, is to use policy enforcement. So, uh, as I was mentioning earlier, uh, we could use solutions like Gatekeeper or Caverno, uh, to block peer authentications and destination rules that could override our desired global, uh, MTLS setting. Um, an administrator might also want to enforce that all workloads are injected with a sidecar. Say for instance, if a malicious user, uh, was trying to, uh, bypass Envoy. And, uh, they could do that by rejecting pods, uh, that try to disable a sidecar injection through a resource level annotation. Additionally, uh, given that, uh, misconfiguration can easily undermine our overall system security, uh, it would be prudent to block or set limits, uh, around some of the higher risk and error prone features, uh, like for example, Envoy filters, uh, allowing them in more limited capacities. And also, um, it's a good idea to, uh, disallow custom resources that are experimental or alpha. And, uh, you can get more details on that in the It's DO, uh, feature status doc. Um, we also might want to set some fine grain validations, uh, around, um, say authorization policies and gateways, uh, to enforce that some of the safe patterns I was alluding to earlier, like broad hosts, um, are actually being adhered to. Uh, to secure our environment, uh, we also need adequate visibility to determine who did what and when. Um, so either through the mesh config or the telemetry API, uh, we can enable Envoy access logging. Uh, and then from there, you could forward these access logging to some, uh, analytics workspace for your specific cloud provider. And, uh, from there, you could leverage some rich alerting and visualization tools. At the same time, however, um, it's important to verify that our telemetry isn't leaking any sensitive information. Uh, for instance, if some of your logging data has personally identifiable information, uh, you want to redact or encode that information accordingly. Um, there's also some request and response headers that It's DO injects, uh, that users often want to remove. Um, the X Envoy peer metadata is a particularly notorious one. Um, though it's possible to remove or, uh, reformat some of these headers with, uh, Envoy filters and, uh, Lewis scripts and, uh, virtual services. Uh, there is some ongoing work by the community and the project maintainers, uh, to help simplify this process further. Uh, finally, I wanted to quickly touch on some other honorable mentions. Uh, to harden our environment even further. Uh, we want to be mindful of workload and image security. So, uh, the very useful tip here is to use the It's DO chain CNI plug-in, uh, instead of the It's DO init container, uh, because the init container requires root capabilities, uh, to write IP tables rules. Um, and you should also be prioritizing upgrades and staying on an It's DO minor version, uh, that's still receiving security patches. Uh, one helpful way to avoid remaining on outdated, uh, or older versions of It's DO or Envoy, uh, that still have CVEs, is to, uh, deploy and upgrade It's DO through a GitOps workflow like Argo CD. And, uh, this way, uh, you also get the added benefit of, uh, minimizing configuration drift. And lastly, uh, to re- to reiterate the importance of defense in depth, uh, you'd want to use Kubernetes network policies to address, uh, ports and protocols that aren't captured, um, by It's DO. Uh, so to conclude, um, I wanted to offer, uh, some suggestions, uh, regarding, um, just, uh, how many of these security controls and mechanisms, uh, you need to incorporate. Uh, one caveat is that the way that, uh, I went about describing these layers, um, is just one conceptual framework. Uh, other users and It's DO community members, uh, might define these, uh, layers differently. Um, for instance, uh, some other guidelines and talks on the subject have used the OSI model to describe, uh, the various threats and mitigation strategies. And that's also a perfectly valid way of considering it. But, uh, regardless of how you define these layers, uh, what's more important, um, is that you have, uh, comprehensive and, um, holistic coverage over all of them. So, uh, as an analogy, um, if you were preparing to dress up for a snowstorm or, uh, very cold weather, um, it wouldn't make much sense to have a thick jacket, uh, on top of a sweater, on top of thermals, uh, but to go out walking barefoot with shorts, um, right? So, uh, likewise, if you have a setup that incorporates all the It's DO security, uh, tools, uh, but doesn't take advantage of the controls offered by, uh, Kubernetes or your cloud provider or other extensions, uh, then you're going to be, uh, vulnerable to various threat types and malicious actors. So, uh, as one example of what a more hardened setup could look like in production, um, in this demo I've used various It's DO security features and configuration options like the, uh, chain CNI plug-in, uh, outbound traffic policy and strict peer authentication. Um, and I'm also using Gatekeeper, uh, to prevent bypassing of a lot of these settings. Uh, at the Ingress Gateway, uh, I'm authorizing requests based on, uh, the JOT token and I also have a web application firewall installed as a WASM plug-in, uh, to protect against other types of web-based attacks. Um, I also explicitly needed to create a NAT rule, um, to make the Ingress Gateway accessible through the firewall. Uh, so another layer of security right there. And, um, I'm also controlling outbound traffic policy, uh, through the Ingress Gateway and network policies. Um, and then I have the firewall as another line of defense, um, that only allows traffic to leave the nodes, uh, if it's routed through the Ingress Gateway nodes. Um, and on top of that I have a cloud-based key vault to secure, uh, the root certificate and I'm also forwarding the access logs that I've enabled to an analytics workspace. Uh, so now just for a quick run-through to take a closer look at the security architecture. Um, yeah, so as you can see here, leveraging GitOps as a handy tool to facilitate installations and upgrades through Argo CD, and also monitor configuration drift. Um, for my PKI model, um, I'm using a plug-in cert, uh, with Azure Key Vault, uh, to store these certificate and keys. Um, so you could see the, uh, CA certs, uh, secret here in the ITSDO system namespace. Um, and then you could see the secret provider class that maps the secret to the key vault. Um, now let's see what happens to incoming traffic entering the mesh. Uh, we see that a request without a Jot token, uh, gets rejected by the authorization policy with the 403. A request with an invalid token gets denied by the request authentication. Um, now request with a valid bearer token succeeds as expected. Uh, but what happens if I tried, say, a cross-scripting attack? Um, because I have the Karaza web application firewall, uh, running in the Ingress Gateway to detect these kinds of exploits, uh, we could see that that malicious attempt also gets blocked. And if you see the Ingress Gateway logs, uh, we could see, uh, Karaza doing its work and reporting the anomaly. So now let's take a look at communication, uh, inside the mesh. Um, I have a strict peer authentication in the ITSDO system namespace. Um, and if I try creating a permissive policy that overrides that, we see that it will get blocked by Gatekeeper. Right? Um, I also have a deny by default authorization policy. Uh, so, um, if I have my sleep application trying to communicate with HTTP VIN, um, it'll return a 403 because that communication is not authorized. Okay, cool. Um, now let's take a look at egress traffic. So here, I needed to explicitly add a service entry for cnn.com, uh, to make it accessible from inside the mesh. And, um, that's because I have the outbound traffic policy in the mesh config set to registry only. But if, uh, sure, sure, sorry. Yeah. Uh, for the interesting time, I'm just gonna, uh, wrap that up. Um, but yeah, the main thing there is just multiple lines of defense and, um, basically, even if the traffic is bypassed through the egress gateway, then the requester will end up getting denied. And, uh, if you wanted to try any of this on your own, um, on a different crowd provider, uh, here are the equivalents for GKE and AKS, er, and EKS. Um, also the slides will be available, uh, online, so feel free to download and take a closer look later. Uh, yeah, a few other additional resources if you want to download the slides and check these out later. Um, also Zach has done a lot of work with Istio and Zero Trust, so, um, he is the go-to person for that. So yeah, that's it for my talk today. Uh, I hope you found it helpful and, uh, thanks so much for attending. Uh, please feel free to reach out on LinkedIn. Uh, please scan the QR code and leave feedback if you enjoy the session. And, um, yeah, um, that's pretty much it for me today and please enjoy the rest of Istio Day. Thank you so much, Nirajan. I don't think we will have much time. Um, actually, we might be able to take one question. As John, you come up and set up the laptop. If there's any question, uh, to Nirajan. I have a question. Yes. Do you want to answer the question? Sure. What is your opinion, uh, on using security frameworks like SE Linux or App Armor together with Kubernetes and Istio? Sorry, uh, could you repeat the question I didn't hear? About the use of, uh, SE Linux or App Armor within Linux, uh, to harden, uh, the containers. This is a question. What is your opinion about this? Uh, I'm not, uh, as familiar with, uh, the specific, uh, container security tools, but I think, um, yeah, there, there are various, uh, ways you could go about, like, uh, hardening your container images and you do want to have that in your, uh, environment, um, along with the other, uh, uh, like Istio and Kubernetes security controls. Um, I did have something briefly there about workload security, but, um, but yeah, hardening your container images using, uh, distro less is always good practice. Okay. Thank you.


All right guys, this is the behind the scenes look at April 2017 This video is going to have clips from Japan and Thailand But it started at the beginning of the month in the airport in Brisbane We're getting ready to go to what is now probably our favorite country on earth Japan Before we got to Japan you might have asked yourself well, how did you get around Brisbane?  There are tons around Kyoto So I thought that would be an opportunity to get a good interview You're watching footage right now from the bullet train going from Fuji Yoshida down to Kyoto I think this train goes a hundred and sixty miles an hour at its top speed. It's pretty fun So this is footage from once we got into Kyoto. This is actually the the stairs that I'm going to our be Airbnb There's a pretty funny part coming up that I wanted to show you guys. I got such a kick out of it This is a pretty humble residence, but it served its job pretty well, and it was very cheap for the area But you see that little nook on the right. Well, there was a washing machine What you're looking at is water spilling on the floor That was the drain pipe for the washing machine was just leaking on intentionally Onto the ground then threw a hole in the floor down to the earth can't say I've seen anything like that one I'm currently waiting at the train station to be picked up by the Zen Buddhist monk here in Japan massive massive failure so far now about 40 minutes late because Language barrier and oh man, so He's been really really kind meaning up with me that I feel pretty stressed right now So fortunately it actually turned out pretty well had a reasonably good interview was a very nice guy This is a picture outside of the temple of our conversation, and then things got really good This is video footage from what's called the philosophers walk in Kyoto Which is this river that's lined by beautiful cherry trees that were in blossom We got about a million pictures as you can imagine as did everybody else So we're in Kyoto, Japan right now walking down the philosophers path Enjoying the cherry beautiful cherry blossoms. This is a great place for contemplation and for lots of selfies So pretty much the whole path was packed with people but for good reason because it was pretty incredible Like I said at the beginning of this video if you don't like cherry blossoms look away Because here are some more We also got to experience Japanese sushi, which is incredible One morning we walked outside of a training facility where there were sumo wrestlers that were doing their Daily training and then one night we went from Kyoto into Osaka, which is the second biggest city in Japan Which was also gorgeous just a bit rainy out after Japan my wife flew home, and I went down by myself To Thailand it was a pretty crazy Experience it was definitely the most difficult stretch that I've had so far because I wound up with what they call Bangkok Belly the first night I got a flight into Bangkok and then the next morning I was going to Chang Mai, but the place that I got the Airbnb that I booked didn't have air conditioning I didn't realize it at the time that the listings had something like Cooling fan or something and it was literally like a fan in the room And it happened to be about 100 degrees at the time in Bangkok. It was all right, but it wasn't exactly Luxury this is footage from something that you see all over Thailand Which are street markets tons of food tons of clothing Tons of guests and in this case raw meat sitting out So like I said I flew to Chang Mai because Chang Mai is supposed to be the place in Thailand where you had again the center of Buddhist religion there are temples Everywhere in Chang Mai and there were monk chats Which is where the local Buddhist monks are trying to learn English and the way they do that is by speaking to English speakers and tourists who want to talk to them about Buddhism or anything else So naturally that was a perfect opportunity to get a set of interviews What you're seeing right now is what is also ubiquitous in Thailand, which is called the tuk-tuk's which are these Three-wheeled motorcycles that will overcharge you and take you anywhere in the city Even though they greatly overcharge you compared to other transportation you can get it's still dirt cheap So I had three successful interviews while I was in Chang Mai, but I also had two massive failures where I thought I was going to be speaking to monks and For whatever reason the monk chat wasn't where I thought it was wasn't when I thought it was Wasn't going on. This is the first example of that Today I'm going to Wat Phra Dwa Su Kep, which is a temple at Buddhist temple at the top of a mountain. I took an Uber most of the way there, but now there's this throw-boating Line of steps. I'll show you here. I made it up But I when I got up to the top I asked around and people didn't know what I was referencing So whatever site I saw there were monk chats here turned out there wasn't and then I wound up getting lost At this very large Buddhist temple at the top of a mountain in Chang Mai So I kind of got myself lost half intentionally I was looking for this monk tuk up on the temple at the top of this mountain Nobody seemed to know anything about it. I really couldn't speak well enough English to direct me to the place So I went to this meditation center and no talking policy. There wasn't a monk chat there So I'm just kind of exploring now Turns out I'm kind of in a little of nowhere. So if I die You know say hi to everybody for me. I Think I think this path will take me to some kind of Civilization have many thoughts even on my experiences here Just observing not even having a conversation with a monk, but just observing some things so Hopefully I'll get around to talking about those if I don't end up dead in the jungle. We'll see The temples themselves are Absolutely gorgeous This is a picture from what's called the wat su tep Which is supposed to be one of the most sacred sites in Chiang Mai, but I found to my surprise totally to my surprise Actually was very uncomfortable in a lot of these temple locations just because the amount of Wealth and effort that the Thai people put into their idols to their statues To the things that they worship was staggering to me the quality of living in Thailand is fairly low and yet an incomprehensible amount of wealth has been poured into religious worship which seems Not only incompatible with the Buddhist teachings, but it also kind of strikes me as a unfortunate Set of cultural values that I don't agree with Regardless, that's the behind the scenes video for April. So as always Thank you guys so much for your consistent support. I hope you will find these interviews of value So thanks again. We'll see you next month


And now I leave the floor to Mark Antoine with the Director of the Centre for Energy and Climate at IFRI, and we will have the real challenge tomorrow morning to present the discussion of this session. So you may perhaps summarize a little bit of comments on what you heard. I think Narendra woke us all up, so I'll try to continue in that vein. Now I think in taking a global perspective, let's face it, Narendra, yes, you rightly said we need to talk more with one another, and I think still this is also a place where actually we are talking, and I think that's very important now. Let's face it. There is a very important momentum now. We have John Kerry meeting his Chinese counterpart, Genois, as we speak now, during several days, and then we'll have the Biden-Sijian-Ping meeting at APEC in San Francisco. And so this is unique because there is no major co-development possible unless the Chinese and the Americans don't agree, and this is a momentum for them to agree. So I think we can be expecting that maybe something will happen there. The second point is on what will it happen? Well, I think, and Nicola mentioned it, yes, the U.S. has to do much more on fugitive MEPHIN emissions, dramatically more. It has to ramp up finance in that. And the Chinese need to peak their emissions way before 2030. And actually both could do that. And then, of course, to phase down coal, I think this is possible. And for India, Marina, it's a specific case. You emit one ton of CO2 per inhabitant when the Chinese do approximately 13 or 14, the American 16, and the year the UAE or Saudi Arabia 18. So there's a difference. But it brings me to my second point. We have to rightly discuss hydrocarbons, yes? And our governments understood this also, because I don't know how many phone calls Patrick Pouyene or the Shell CEO got from governments. You know, help me here, help me there. What can you do? But it's a new reality. So they were not going to disappear, and energy security is central also in our country. So what we need to have a discussion on is an orderly transformation of the hydrocarbons. Yes, energy security is wet, but the problem is if it's Iran or Russia that put energy security in the final declaration, everybody understands why, right? So I think this is clear enough new, and the story is the following. We need a predictable, stable oil price that allows consumers to afford the energy, but still to transition the companies and the governments to have the resources to invest in the alternatives. But the problem is we need to have this discussion, and I think the discussion has gone away. There were institutions for that, there were ideas for that, but I think it should be reinvested. And what we also need is that you, for example, India, tell countries here in the Middle East, look, if we look at the map of renewables in the world, we almost see nothing here in this region. How can that be with all the money that you have? And then the second thing that you should also tell, because so far it's been forced, that has been pushing heavily for that, is how come the emerging economies are deprived of liquidity to invest into all these renewables, et cetera, right? If we look at the current financial system, the risk in the emerging economy is much higher than in Europe, it's much higher than in many places where actually the investments are required, right? So this discussion has to be also taken upfront by you, and hopefully there will be greater financial commitments here from countries in the regions towards financing these low-carbon technologies and their deployment. If you allow me just a word or so, I think India and other countries, especially us, and it was ended several times, now we have the objectives, now we know that the technologies work, we know that the cost went down, although they are up again because of interest rate, et cetera. What we need to focus on is value chains. Everyone has to invest into value chains, and here the states will have a major role to play. They have to provide guarantees, et cetera, et cetera, because otherwise it will be very difficult for the scale-up and the day-risking. Last but not least, if you allow me perhaps a word on three years ago, four years ago, everybody was planning for an energy transition with low oil prices, with low gas prices. Well, now we will have a transition with high oil prices. And I think that offers quite some interesting momentum. Of course, everybody's suffering, hence the need to order me, organize all that, but the point is, this is a unique opportunity to accelerate. And I think total energy, correct me if I'm wrong, but you would not be able to commit that much money to renewables which are providing less profits if you didn't have these high oil prices. And countries like here, obviously, would be able to commit less to meet their targets if the oil price was $50. So let's work on this opportunity, I think. And also, let's get out of this binary situation where the North thinks only about itself, the South is demanding and is the victim. I think it's much more complex, but in any case, you're right, we need to work more together.


The curtain is slowly coming down on the ICC Cricket World Cup in India with a semi-final set to ball off on Wednesday with the home team taking on 2019 beaten finalist New Zealand at the Wankit Stadium. India dominated the preliminary stage finishing with maximum 18 points from their nine matches while New Zealand snatched the fourth and final semi-final place by beating Sri Lanka last Thursday to end a four-match loss streak. South Africa was second above Australia both with 14 points but the Proteus had a superior net run rate, they clashed in semi-final two on Thursday. Now both Rohit Sharma and Kane Williamson spoke ahead of Wednesday's first semi-final. I don't think there's so much time to think about it. The focus is on the game, what we have in hand tomorrow. I seriously have no time to think about my journey, what it has been in the past, probably after 19 November I'll think about it but right now it's just business and pure business of getting the job done for the team. We know it's going to be a really tough challenge, there are a side that's been playing extremely well but we also know come finals time everything starts again and it's all about the day. So for us as a team it's very much the focus on our cricket again and we've played some good cricket throughout, we've had a couple of narrow losses and a few wins along the way which have put us in this position we're in so we're excited, we're challenging. Alright joining us this afternoon to discuss the tournament is cricket analyst Fazir Mohamed. Good afternoon Faz, how are you? Good afternoon Ryan, not too bad. Alright so we'll start by talking about this mouth-watering match-up, India vs New Zealand at home, India I'm thinking a sold out crowd, India in all of its element, can they win this title for a sixth time? Well certainly everything has been going their way, they've been absolutely dominant and if you go purely on form and the quality of their players they've got a fantastic bowling attack, quality fast bowlers, quality spinners, a strong batting line-up, indeed they've been strengthened with the loss of Haridic Pandya with Mohamed Shammi coming into the line-up as another pace spade, it's really difficult to see New Zealand getting the better of India but we're now at the knockout stage after what five and a half weeks of this marathon league table and this is where a piece of brilliance can make all the difference and I think of course the the form horses are Indian no question about it but sympathy will probably be with New Zealand because they've lost the last two finals, the last one a heartbreaking loss to England at loads and you just get the sense that if they could get it all together things go their way and maybe India for some reason are off the boil then New Zealand might have a chance so yes there'll be an element of sympathy for New Zealand but I think when you look at the way India played so far it's very difficult to look past them getting into the final. Yeah personally I think India feeds off the crowd, they feast on the crowd, you know they get their momentum their energy from the crowd support but a lot of analysts and you know critics saying that maybe that can work against India's favour the pressure from the crowd. What do you stand on that you know statement fast? I don't see that really impacting on them negatively because you're talking about a team that is supremely confident almost arrogant with it and that is what you get when you talk about a champion team also and this is probably where the pressure comes in. India had a poor record since the 2011 World Cup which they hosted when they beat Sri Lanka in the final. Since then they've yet to lift an ICC trophy and that is hanging on their nexus the monkey on their back whichever analogy you'd like to use and that may create some pressure. I don't really think that the fans will create that sense of anticipation to the extent that the players will get nervous. I think they are mindful of their own record over the last 12 years and they want to put it right this time around. However again as I said New Zealand they've been in every 50 over World Cup final in the last four tournaments going back to 2007 the last two finals they are no pushovers and even if in the end everything points towards India I think if New Zealand do prevail which will be a shock result it wouldn't be because of the pressure of the home support. Yeah reports have stated in Mumbai it's wise to bowl second but then you have to think about due because that's a factor that would change your decision. How important will this toss be to the teams to ensure that they come out on the winning end? I think if you're a quality team you go with whatever happens because when you start to fall into that trap that you have to win the toss you have to win the toss. If you lose then you create even more pressure on yourself. If you're a quality team you will prevail whatever the circumstance and yes it may be a situation where with a lot of dew a lot of moisture in the atmosphere at night whoever is batting second might have it a lot easier but we've seen through this world cup the quality teams going up against that conventional wisdom and prevailing and yes there would have been some luck along the way as well. So I don't think either Kane Williamson or Roy Sharma especially will be too preoccupied with how the toss goes. Yes they'll want to win it because they'll want to gain an earlier advantage as possible but if you start going down that rabbit hole of believing that you need to bat second you need to chase or even the reverse then that could work against you. I think these two teams are far too experienced far too professional to allow that to happen. Yes as you alluded to the fact that the Indians have come up short in a couple of world white ball tournaments in recent cycles. We know there are nine and all at the moment at home in India but a lot of people have felt that as a tournament team they have fallen short in the past decade in some tournaments that they were expected to win. Would they have shelved that issue based on what we've seen so far in this tournament? Not yet Lance because there are too much still to play and that's it you know it's all like the guy on Amazon Warriors over a couple of CPL seasons winning every match in sight only to lose the final and that's really what it's all about. We've seen that happen with many teams Sri Lanka went through a period where they got consecutive finals 2009 World T20, 2007-50 over World Cup, 2011 World Cup which India won, 2012 World T20 which the West Indies won and they couldn't get over the line until 2014 in Bangladesh where they won the World T20 crown. So yes that is a significant element and that to me Lance is the essence of a world championship this long-winded table of everyone playing everyone for 45 matches over five weeks that's really designed for television revenue and to eliminate the possibility of a major upset because Australia for example lost their first two matches they won the next seven but had it been a group stage of four you never know what could happen but this is what the authorities want they won the big guns in the final they won the television revenue because we all remember the disaster of India and Pakistan getting knocked out early in 2007 in the Caribbean but again that doesn't preclude either New Zealand or if India do prevail whoever they face in the final getting the better of them and I think that's what is really the essence of a world championship to have that element of a knockout and the element of a surprise. Yeah and the fact is that the other semifinal comes up on Thursday as well which looks to be a grouping match for me Australia against South Africa because both are are very very solid teams. Do you think given the fact that India are 9-0 going to the semis there are a lot of people who like to see their teams in a format like this lose a match early in the in the tournament just to you know get that law of average issue out of the way because it would be colossal a colossal disappointment for the home fans if India should get to this point or even in the final and lose. Absolutely and you're quite right everybody said you know you must have a bad match in you somewhere yes that's it and get it out of the way early so that it doesn't happen in the semifinals or the final well they've had a few indifferent moments they were dismissed relatively cheaply by England and then they fought back well with their bowlers but again it's their all wrong strength lads and again I think that because it's a knockout I think that's where the element comes in because you know it's win or go home and because it's India playing in India it's the Diwali period they've just had the festival of lights on Sunday it's a a time of real celebration in India so there is that sense of expectation and yes as much as people might try to to minimize it and no doubt the supreme professionals are somehow able to block it out that element of the elimination brings about that that bit of edge and it can result in strange things happening because it is that knockout state but again the way they've played you even if you you think that they they lose Rohit Sharma and KL Rahul early that they've got enough resources to get enough runs on the board that their bowlers can defend. Tremendous as far as their roster is concerned Farz no question about that too many match winners for me not to pick them to win I'd pick them from before the tournament started to be champions here having said that in their impressive nine wins that they have had in the tournament so far New Zealand probably ran them one of the closest matches that they played I think they won with about 12 balls to spare which in ODI cricket is is reasonably comfortable but it was a game that you know hung in the balance for for some point and you already referenced New Zealand's really really solid history in this tournament. Two finals backed about the last two tournaments they've played five of the last six semifinals so New Zealand has always been a tough deep to beat in the ODI World Cup and I think India would be mistaken if they look past them tomorrow which I don't think they will anyway. Absolutely I can't imagine that India wouldn't by any way shape or form look past New Zealand I think that they they've they've got their number because it doesn't work that way just have to look back to 2019 and the semifinals of that tournament in the United Kingdom the fact of the matter is as you said quite correctly five of the last six they were in the first two semifinals when the Western is one in 75 and 79 so so yes they may not be your glamour team but look at their performances and yes they only have a champion trophy from the year 2000 in Kenya to show for it when Chris Cain's had a really starring performance in the final but it's the sum of their parts Ratchan Ravindra, King Williamson, so many players Darryl Mitchell and so many others who have risen to the occasion every so often will this be the big moment trend bold and and so many others in their bowling lineup to really produce the sort of performance that could silence the Indian crowd the Indian audience in the same way that the West Indies did in 2016. Yeah and just before you go Faiz a quick comment on the South Africa Australia second semifinal on Thursday that looks to be a tough one. It is I would really like to see South Africa get to the final because of the way they fought the way they played their cricket but Australia when you reach this stage I mean they started badly they had the leeway to recover they're on a winning streak they're accustomed they'll remind South Africa of those choke moments in two semifinals already so psychologically it's ready for South Africa to put that behind them. I almost want to say South Africa and that I will say South Africa because I think they've shown a greater level of intensity this time around so I'll go South Africa. All right Faiz well what's for sure is we have two exciting matches coming up and we look forward to talking again after the results. Thank you so much. Take care. All right Faizir Muhammad there from sweet sweet Trinidad and Tobago let's take a quick break we'll be right back.


Copper is a valuable metal and has been extensively mined for thousands of years. Some of the uses of copper metal include piping, heat sinks in computers to stop them from overheating, cabling, ship building and as roof coverings. Pure copper metal is rarely found. Usually the copper is found in an ore. Ores contain copper metal but also other minerals. If the ore contains lots of copper metal it is a high grade ore. If it contains low amounts of copper metal it is a low grade ore. There is more low grade ore than high grade ore. But low grade ores can contain less than 1% of copper metal. Unfortunately, due to the extensive mining of copper ore, what you think is happening to the amount of copper metal that's available for making the previously mentioned products. Pause, think and continue when ready. The answer is the amount of copper metal being produced from ores is decreasing. We need ways of extracting copper from any type of ore, whether it's low grade or not. There are two extraction methods that are being used and that we will continue to use in the future. These include wire leaching and phyto mining. Wire leaching is a method of extracting copper metal using bacteria. Some bacteria can live off the energy provided by breaking weak copper sulfur bonds found in ores and replacing them with stronger bonds. When the bacteria break the bond between the copper metal and the ore, what do you think happens? Pause, think and continue. The correct answer is that when the copper sulfur bond is broken, it releases copper metal. The key advantage to this process of producing copper is that it's very energy efficient. Traditionally, copper can be extracted from their ores using electrolysis or by heating them. This requires huge amounts of energy and also releases greenhouse gases like carbon dioxide. The main disadvantage of this method of producing copper is that it's very slow. The other method is phyto mining. Some plants have the ability to extract the copper by growing them on soils that contain a low grade ore. The plants take up the copper and store it inside. Once plants do this, the copper is locked up in the plant. Here's a challenge. How might we unlock the metal from the plants once they are harvested? Pause, think and continue when ready. If you burn the plant, you are left with ashes. Burning adds oxygen to the plant, so all of the carbon and hydrogen are converted to carbon dioxide gas and water vapor, leaving the metallic minerals as solid oxides in the ash, which is where you'll find the copper. Did you get it right? The advantage of this process is that any land that is contaminated with low grade copper can have plants grown on them to extract the copper compounds from the ash. The key disadvantage of this process is that copper produced still isn't pure. This means it needs electrolysis to purify it, and that's not an energy efficient process.


So if I start to just give a historical overview of secondary structure prediction, the idea is that for a number of alpha helices or so, I can just plot the residues. This small diagram is called sequence logo. It's interesting and they look cute. The idea is that the most common residue is going to flow to the top here, and the more common it is, the larger the letter it is. I also measure the information context. So if a particular position always has alanine, I'm going to draw that one very tall. But this means that based on the residues, if I see a long stretch of residues that are lots of alanine and lots of leucine, and it's roughly 20 units long, it's likely an alpha helix. There are better methods for it, but the first approximation. We can do the same thing for beta sheets. You see here that there is a slightly different pattern here, valines in particular. Valines don't like to be an alpha helix as much. It's harder to predict beta strands, mostly because the alpha helix is a very local structure. It's local in sequence. It's going to be 20 residues next to each other. While a single beta, I can predict a single beta strand, but that strand has to form a beta sheet together with strands that might be very far away in sequence. So this is much harder. Predicting the secondary structure when it's beta sheet involves some sort of long range interactions. Harder to design the prediction algorithm, but today it largely has been cracked. The book in particular goes through quite a lot of detail of a beautiful algorithm called two-fasman. So what two-and-fasman did, when I was your age, I spent probably three lectures in the class understanding this. So they looked at podium structures and average propensities, and if we accept that one residue should never break a helix, but if we take the average of say three or four adjacent residues, and if those four residues virtually always occur in helix, we can calculate what is the running average likelihood of something being either a helix or a sheet or a turn. And then we compare those. And as long as the helix gets the higher score than the beta sheet, we predict helix. But at some point, when the beta sheet is higher, we turn over and say, ah, now we form the beta sheet. The idea with two-fasman is that they're using all the information that we've talked about previously in the class, free energies, probabilities of forming turn. It was a beautiful method. It was the first bioinformatics method. The only problem is that it's quite labor-intensive to sit and do all these diagrams. You can do it. You can even do it in Excel. The reason we don't do it is that it's crappy. I'm sorry. I'm a physicist. I love two-fasman, but they might, at best, get something like 40%, 50% accuracy and secondary structure prediction. Even a very simple modern bioinformatics method would get 60% and modern ones based on multiple sequence alignments get instantly 80% and the state of the art is 90%. I think this, too, tells you something that how much the field has developed that I don't even think it's worth the time to teach you the simple physics-based method anymore.


While we believe that entry-level laptops deserve as much attention as their more expensive siblings, we'll try to keep this review of the Lenovo IdeaPad one short and simple. Design-wise, it's very similar to the Lenovo V15 and IdeaPad 3 laptops, utilizing the same plastic chassis. It doesn't result in the best durability as both the lid and the base are flexy.  On the other hand, the laptop is light, weighing only 1.58 kilograms and having a profile of 17.9 millimeters, so the portability is here. Another bonus is the thin bezel around the lid, which still managed to fit an HD webcam and a manual privacy shutter. We're surprised to see a fingerprint reader at this price point, even if it's optional. The keyboard is clicky, despite the travel being a bit short. The touchpad is covered in mylar, so it's smooth. Unfortunately, we have to mention the bends around the keyboard, especially if you're typing harshly. On the sides, the input output is split between the left and right. On the left, you've got a power plug, a single USB Type-A 3.2 Generation 1 port, an HDMI 1.4B port, one USB Type-C 3.2 Generation 1 port, and an audio jack. Switch to the right, there's a USB 2.0 port and an SD card reader. Since this is a budget machine, it comes with a full HD TN panel. Keep in mind that there are IPS versions available as well, and you should probably choose one of them. The TN panel has poor viewing angles and a low contrast ratio, so dark images appear washed out. The brightness is low, too, at 231 nits. If you want to make things better, get our display profiles from the link in the description. On the other hand, the sound setup is better, despite the speakers being on the bottom, with no significant deviations across the entire frequency range. Only 2 per 100 people watching this video are subscribers. If you decide to just start following us, we'll be able to reinvest more in our laboratory, thus making even more helpful videos for you. Thank you, you're awesome. Since the laptop is AMD-powered, you get to pick 2 Athlon CPUs, a Ryzen 3 and a Ryzen 5. We tested the Ryzen 3 model, and it does decently well, offering good performance for web browsing, playing videos, and other light tasks. The Radeon 610M IGPU is pretty good as well, as it can handle eSports titles with ease, as well as other games, including GTA V, which is still very popular. Here you can see how it runs at normal settings. For more benchmark videos of the Radeon 610M or any GPU for that matter, check out the Laptop Media Benchmarks channel. With the Ryzen 3, you don't need the craziest cooling setup, so one heat pipe and one fan are enough. It still keeps all four cores running at around 3.5 GHz, even after 15 minutes of testing. It's nice to see that the chip runs very cool as well. Comfort is great as well, with a low amount of noise and a base temperature of only 36.1°C. Something pretty weird about the laptop, it has the same battery results in both the web browsing and the video playback benchmark, lasting for 9 hours and 10 minutes of either web browsing or video playback, really thorough power management from Lenovo. Despite the standard 15.6-inch form factor, which usually leaves room for Sodium slots on the inside, here we have up to 16 GB of soldered LPDDR5 memory. Storage-wise, there's one M2 slot, which supports Generation 4 drives, but sadly runs them at Generation 3 speeds. In any case, we'll leave our teardown video linked below. The Lenovo Ideapad one is one of the cheapest Lenovo laptops out there, and while the durability and the TN display leave a lot to be desired, the performance that it offers is good while bringing a fingerprint reader and an SD card reader, which is rare to see even a laptop of this price. For more information about the Lenovo Ideapad one, check out our detailed review on laptopmedia.com.


Hey, I'm Jack. I'm from the United States. I just finished the 120 hour course and Honestly, I have nothing but good things to say about it. It's uh, I came in thinking it was just gonna be Grammar and punctuation that I learned in middle school, but it actually turned out to be a lot more than just grammar It teaches you how to teach to a variety of students not just young people Many people have been studying the Language for a while and they need different resources and it tells you the material that will allow you to teach to them most effectively and for them to get the most out of what you are teaching and Like I said, it's just it's a lot more than just grammar. It it does go over grammar and verb conjugation and stuff like that, but it definitely is a lot of teaching you how to be a teacher and It's really awesome because it makes you feel more prepared to go out into the world and share your knowledge with people and experience different cultures and help them learn the language that Seems easy to you, but probably it's just very difficult for them. So it's been an awesome experience like I said nothing bad to say and Really enjoyed it


I'm going back. I've got combat. Yeah, or good. I'll just delay a bit Yeah, I'm just gonna stay behind No, I don't worry don't need to I Might cross get sat let them open on me then need we do the cheap shop gouge or cheap shop here on roguepin And we go burn freeze.  I'm crossing. I don't sap priest. Okay No, no, no, just don't just let them set me That me just wait just wait we cheap shop rogue and go priest. Okay.  You can dance.   Rogue cheap shot me. He's dancing me. I just pierced We're gonna rebuild them anymore. Just stay on priest. Okay. I'm fine. I'm gonna favorite here resist Miss kick won't burn Lining there He will fear. Okay. I'm lining. He missed he missed it the spelling priest getting the shield Got it. I can't get a field man. Why can't I ever get field? I'm gonna go fit gage on me. I can't fit he doesn't have fear for 10. Maybe I can get in there No, I can't I'll keep rogue Yeah, I'll try You gauge me gage may try definitely it's short is short.  So it's not the worst There's an eye here if you want it. Maybe I take it. I got him. I got him. I got him. He's coming out now. I Arranged it. Arranged it.  You can stay on priest a bit maybe burning priest Got one burn one more button Rogues to open that plan different. Yeah. Yeah Yeah, if you guys rogue I'm coming. I'm coming.  I just for priest.


Once we landed on deck in Kuwait, then we can start doing what we call joint limited technical inspections, kind of getting a better understanding of what's the condition of the vehicles and what corrective maintenance and preventative maintenance needs to be done. Once that was complete, the tanks were fully operational and mission capable, we started our range operations. The reason why the tank platoons in Kuwait is to do our semi-annual crew qualifications and our section qualifications to maintain crew readiness and armored lethality across the Mew. This exercise is important because it allows us to stay proficient as tank crews and stay relevant with our qualifications and this particular exercise is very important because it gives the Mew a different capability and a different way to employ tank platoons in the future. Tanks are important for the Mew because it brings direct armored firepower.  A tank is on the ground with you and it's there when you need it all the time.


What's up guys? Okay, so I'm Willow Blue for somewhat obvious reasons, and I care about both movement of people and objects through space and time as well as movements of people through society and ideologies. Coincidentally, this ignite also includes references to movement if you know what I mean, so mind your sensitivities. This is an infograph of one month of my life. If you average the number of miles between these different cities that I visit and average them over the course, the number of hours in a year, I am currently moving at 10.5 miles per hour. This means that I am really good at packing bags. I can go for three weeks without doing laundry and without checking bags, and that's what I'm going to tell you about today. If it... there we go. Okay, so big picture in time. You first need to figure out how you're getting to where you're going, huh? I really like Hitmonk because it does a visualization of that. I also use a cell phone app called TouchCal so that I don't book coffee with a friend who's going to be halfway across the globe. It's also important to know where you're going to stay.  They give me the creeps, so I stay with friends or sweeties and barring that in a new city. I would do Airbnb or couch surfing and make new friends. Then you have to figure out how you're going to get to these places. The open government has done beautiful things for transit maps in the US. Ufi is great for Europe and Germany, and Uber is totally posh if you want to call a black car generally anywhere from the same app. You'll see that all of those assume an internet connection.   You just say rocket ship, and the driver says, ah, hackers, and takes you to where you need to be. Don't count on that, and instead cash your maps or draw yourself one, and get a SIM card as soon as humanly possible. Any civilized airport will have a SIM card vending machine. You can stash these in your GSM-enabled phone. And I like to store these in a sorted folder along with the transit card of the city that's associated with. I also have a friend who does this with ziplock bags. You can also store it with the cash associated with that country. As soon as you get that SIM card, which you should usually use a spoofed ID with, because sometimes they'll tie your ID to the data you're getting, tether your tech don't connect to sketchy open Wi-Fi, except for MIT, or totally fine, and use data and encrypt that data as much as you possibly can. So OTR, PGP, etc. Also encrypt your hard drive just straight up. You can even mail yourself your hard drive. Your dwindling rights are even less present when you cross over borders. The cords that you're using bring extra, and I like to keep mine with binder clips and then clip them onto my bag. That way I can tell when something is missing, which is super important when you're three cities into a seven-city trip, and suddenly you're out of all of your Android cables. Bad news, bears. To keep sane, keeping your teens is super important. You can pack jump ropes or TRX bands or resistance or whatever else. Also, pack frivolous things like comic books so that you're not just working and traveling. You have to keep something going. I like to pair socks with underwear and an undershirt. Roll that up and put it set of those in a dress shirt along with a pair of pants. That way I don't get laundry all over everything, and I don't have to think about my outfit when I'm super hungover. Those things should go into your rolling bag.  Embarrassing but true. Speaking of, I always opt out. TSA, this is a whole hour-long talk, is not only effective, they're also non-consensual and invasive. I have the luxury of having my physicality match my mentality. Not all of my friends are this lucky to be what we call cis, and when you are getting patted down, that's a huge invasion. So that means that I do what is called soft packing when I go through TSA, which is where you have a flaccid phallus.  That way I, who am emotionally unattached to these things, can have a conversation with the TSA agent about their policy and process before one of my dear friends has to go through this whole thing. That is how I pack. Have fun on your travels.