This video is sponsored by Nebula. Check out the link in the description or stay tuned to learn more. One of the rail networks that first sparked my interest in public transportation was Sydney's. The system is historic, but it's also really unique with its large double-decker multiple unit trains, complex web of rail lines, and its beautiful natural surroundings. You might even say it's like Zurich, but hot. That's not entirely accurate though. Sydney is actually a pretty big city, and it's growing its network in big ways, and transitioning away from the way things have been done in the past. But how does the Sydney trains network work, and how's it laid out? What can we learn from it? Let's dive in and find out. Before I talk about Sydney or the Sydney trains network, I really need to mention the trains themselves. They're really quite unusual in that all of them are double-decker multiple units, which run on 1500 volt DC power and standard gauge tracks. Well, I really like the A and derivative B and NIF sets. The T-set will always have a special place in my heart, as will the unique flippy seats on most of the trains, which allow you to change the direction most seats are facing simply by sliding them over. I also want to mention, as you're probably seeing from the lovely footage, the good folks from Transport Vlog and Tate Set, who graciously provided some of the footage in this video. Any introduction to Sydney inevitably needs to get into the quite crazy geography of the city, which is located on Australia's southeast coast in the state of New South Wales. Sydney's often known as the Harbour City, and this is for good reason. Sydney Harbour is probably the defining geographic feature of the city, and is crossed by the iconic Harbour Bridge, which yes carries trains and is fronted onto by the famous Opera House. Sitting just south of the Opera House is the city centre, or very specifically in Sydney's case, the CBD. Heading west, the harbour gives way to the Paramatta River, which like the main portion of the harbour has numerous inlets and bays on it. To the south of the river west of the CBD, we have the Sydney Olympic Park, which played a central role in the games of 2000. Further west still, we have Paramatta itself, which is being coined locally as Sydney's second CBD, and which provides a large dense node in the city's suburbs, as well as substantial rail connectivity. Now, if you thought Sydney Harbour was the only major water feature of Sydney, you'd be wrong. There's also the Middle Harbour, North Harbour, Botany Bay, and George's River, not to mention the Hawkesbury River to the north, and the Tasman Sea to the east, which many famous beaches like Bondi and Manley face. Sydney itself is also hemmed in by mountains on all sides. Sydney's international travel hub is the Sydney Kingsford Smith Airport, which is Sydney's only major airport and extends out into Botany Bay. Unfortunately, while the location of the airport just seven or so kilometers south of the CBD does make accessing it very convenient, this means it's hemmed in by development on all sides and thus has a curfew. Because of this, as well as broader geographic barriers and trends and growth, Sydney is building a new airport in the sprawling suburban area of western Sydney, known simply, or not so simply, as Western Sydney International Nancy Bird Walton Airport. But you didn't come here for airports, you came here for trains, and so let's look at Sydney's rail network, starting at its main hub, Central, which is located at the south end of the CBD. Central, like many great stations, consists of two main sections. One, a rail terminus for terminating longer distance trains to other parts of New South Wales and other cities in Australia, which is known as Sydney Terminal, and another where suburban trains can through run at the station, though admittedly some suburban trains do still use the terminal as well. Talking about the suburban trains, let's look at the various lines. The T1 North Shore and Western Line is the first line in the system, naturally, and is also the most used. The line at its furthest extents, which only some trips connect to, runs from emu plains and Richmond in the west, south and east of Blacktown where they come together. Further east, the services pass through Parramatta before continuing parallel to the Parramatta River along the main western line, Sydney's most important, into Central at the CBD. This line is six tracks from Stratfield to Sydney. I do have to mention, service patterns do vary a bit from day to day and time to time, so these are mostly just the prevailing patterns. Just north of Central, the T1 enters old tunnels under Sydney's Central Business District, where it passes through the important stations of Town Hall and Winniard, which were influenced by the New York subway. From here, the services continue north across the Harbour Bridge to northern suburban destinations like Chatswood, Gordon and Hornsby. The T1 is a total of 128 km long, which is really long. The T2 inner western Leppington line is the third most used on the system, and for a large part duplicates T1, running from the CBD to Central and then along the main western line. These portions of the T2 stop at all stations, while this portion of the T1 runs express. Now it's worth asking how the T2 actually navigates the CBD, and this happens via what is known as the City Circle, which sounds and operates somewhat like Melbourne's City Loop. The City Circle is a two track line which forms a loop from Central North through Town Hall and Winniard and then east to the Fairy Hub and Light Rail connection at Circular Key, which is actually above grade with boarding from the streets below, which goes to show the quite crazy topography of Central Sydney. That said, the vibe is heard by the fact that on top of the rail station is an elevated expressway. Continuing east, the tracks turn back underground before looping back south and running through St. James and Museum, but not that museum, back to Central. This does enable some changes from one service to another as well. I do have to point out that the signs at some of the CBD stations as well bear a striking resemblance to another railway city. With the two tracks from the Harbour Bridge and the two from each of the directions on the City Circle, the main surface suburban platforms at Central are served by a total of six approach tracks that widen to eight at the platforms. Just to the south, there is an incredibly complex series of flyovers. I'd attempt to explain them in their great complexity, but Tate Set already has a great explainer video that I'd suggest you watch for that. Suffice to say, designing this thing must have been quite of a puzzle, a puzzle which has only become more complex as more infrastructure and lines have been added. Continuing with the T2 along the main western line service splits at Granville where it runs with one branch terminating at Paramatta and another running south. The southern branch continues through Liverpool and Glenfield before turning west onto the south west rail link to Leppington, which opened in 2015. This project created two new stations and a majorly rebuilt Glenfield, resulting in some of the most modern stations on the entire network and a very unique fully greenfield corridor that at least initially was truly surrounded by green fields. T2 is a total of 55 kilometers long. The T3 Bankstown line starts similar to T2, running from the CBD through to Central and then through Redfern, a major shoulder station hub that nearly every route that runs into the CBD also runs through. This would be a great location for a ton of intensification in the future which is happening already, but not at nearly the scale it someday might. From here if the line continues southwest to Sydenham, where it diverges from the larger four-track rail corridor to head west. Like a lot of junctions in Sydney, like the one that carries T2 east of Paramatta, this is a sprawling Y with a footprint not unlike a highway interchange and that reminds me of the dense rail lines around London. Such connectivity has allowed for a lot of service pattern changes over the years, and really makes the system a true network rather than a simple collection of lines. From here the service continues west to serve areas like Dulwich Hill where connections can be made to Sydney's light rail, Belmore and Punchball, before arriving at its namesake, Bankstown. From here the line splits into two branches, one travels west through Chester Hill and Villawood to the main south line alongside the T2, which it travels with to Liverpool, paralleling the South Sydney freight line. A dedicated freight corridor built adjacent to this portion of the Bankstown and main south lines. Traveling north from the split of the Bankstown line, which is unsurprisingly also a Y, we have a short run up to Lidcombe on the main western line, where this service terminates. It should be noted that this connection is once again a Y. This line is a total of 47km long. I should mention that the Bankstown lines days as is are numbered, but we'll discuss that in more detail later. The second most used line in the Sydney Trains Network is the T4 Eastern Suburbs line. This line starts at Bondi Junction, though it was planned to go much further and might still do so someday. Destinations as far south as Kingsford, which are now served by Sydney's light rail, have been planned in the past. From Bondi Junction, which is about 2.5km west of the famous beach, the line runs west via Kings Cross, but not that Kings Cross to the CBD, where it serves the very nicely named Martin Play Station, which has tracks crossing the city's circle just north of St. James. From here, the line continues alongside the others through Town Hall, Central, and Redfern, but on a deeper tunneled alignment. It actually shares part of the lower level at Town Hall with one of the tracks from the city's circle. From Redfern, the T4 continues alongside the Bankstown line, continuing beyond Sydenham through many suburbs to the west and south of the airport. Around Coghra, the line turns west before turning back south and crossing the Georgia's River beyond Penhurst. To the south, the line winds along before splitting in two at Sutherland, with one branch traveling straight east to near the coast in Cronulla, and another which travels south between the Princess Highway and Natural Wooded Area to the suburb of Waterfall, which indeed does have some waterfalls. The T4 is a total of 55km long. The T4 is basically entirely isolated from other lines, and our next line, the T5 Cumberland line, exists entirely as a mash-up of other railway lines. The service starts at Schofields and at Richmond late at night alongside the T1, traveling south to Parramatta before the line makes a big turn south to run alongside the T2 service all the way to its southern terminus at Leppington. The T5 is one of only two lines, which does not enter the CBD and is the least used main service on the network, though this will hopefully change as Parramatta and Western Sydney continue to develop. The T5 is a total of 67km long. Now, you're expecting the T6 to exist, but the bad news is that it does not. The T6 was previously the designation given to the Carlingford Railway line, which split off the main western line at Clyde to head all the way up to Carlingford, which provided some infrequent services. This line has since been closed to passenger service and will be taken over in large part by a new light rail line, which City is a big fan of these days. If you were expecting T7 to be an impressive cross-city jaunt, you'll be disappointed. As much like T6, T7 is quite short. In fact, so short that it only has two stations on about 4km of track. The T7 Olympic Park Line indeed is simply a shuttle service from Lidcombe to the Olympic Park, which has a giant station with two tracks, both with Spanish solution platforms, that are used in one direction, allowing massive capacity with Sydney's big trains. This high capacity, as well as a tangle of tracks and flying junctions surrounding the Flemington Maintenance Centre, where the Olympic Park Line meets the main western line, mean that during major events like concerts, services can run frequently direct to and from the CBD, as well as other destinations, which is pretty awesome. With the T8 airport and cell line, we finally get back to really substantial service, and this line starts running from the CBD to Central. South of Central, the T8 almost immediately enters a tunnel, which required modifying the tracks around Central. This service runs south, bypassing the area of Waterloo and stopping at Greensquare and Mascot, which were stations which were built as part of the airport rail link P3 and until a few years ago featured user surcharges which went to the P3 operator, who built and owned the stations themselves, but not the trains or track. The reduction in this high surcharge has really boosted ridership, and Mascot in particular is surrounded by a pretty astounding amount of TOD that is probably among the most of any airport out there. Continuing south, the line features two airport stations, with one at the domestic terminal and one at international, both of which still do have the surcharge. After this, the line continues west through a lower set of platforms at Walleye Creek, where the line provides connections with T4. Walleye Creek is also surrounded by excellent TOD. From here, T8 continues due southwest, passing through numerous suburbs before it eventually arrives at the main self-line, which it runs along, connecting to T2 and T5 at Glenfield, before continuing south to Engelburn, Campbelltown, and MacArthur, where services terminate. Some of the corridors T8 runs on have additional capacity, and thus T8 does run some additional Pico-May services, which bypass the airport and travel via Sydenham. These services supplement T3 services while the T4 runs express from Sydenham to Redfern. T8 is a total of 57 kilometers long. The final line in this system is the T9 Northern Line. This line fully duplicates the T1 from Gordon across the Sydney Harbour Bridge through the CBD, Central, and Redfern, before running express to Burwood and Stratfield, where it diverges to the north to run across the Parramatta River, then through West Ride, Eastwood, and Epping, which we're going to come back to. From here, the line continues north to Terminate at Hornsby. The T9 is a total of 53 kilometers long, and it in particular interacts with a lot of freight trains traveling from the ports out of Sydney, and I'll cover projects designed to help alleviate these interactions in a future video. So, Epping. As it turns out, the Northern Line ended here at one point, looping back on itself, at least for a bit, and that's thanks to a big ol' rail project known as the Epping to Chatswood Rail Link, which was built in the 2000s along with other iconic links we've discussed, like the Southwest Link and the Airport Link. The Epping to Chatswood Rail Link is a rather loopy set of tunnels that leave the aforementioned TOD hub of Chatswood before heading north, before making a giant curve south, and then a giant curve north, stopping at three stations before terminating at Epping. The scale of the whole project is quite impressive, and its stations give me jubilee line extension vibes, but its routing is suboptimal to say the least, in no small part due to the restrictive performance of Sydney's big double-decker EMUs and the difficult geography of the area. Now, naturally, since the line was built quite specifically for Sydney's epic by-level EMUs, it was closed less than 10 years after it first opened, to be converted for use on Sydney's new Metro. Yes, that's right, let's talk about the Metro. Sydney Metro first opened in the middle of 2019 with its northwest line, which connects Chatswood to the suburb of Tallowong via the Epping to Chatswood Rail Link, and a combination of new tunnels and guideways built from scratch as part of the Metro project, alongside pretty opulent new stations, constituting a 36 kilometer line. The Metro features quite attractive automated trains whose blue color contrasts nicely with the warm tones of the suburban sets, although their track gauge and power supply is the same. What distinguishes the Metro are the trains much greater agility, thanks to their lighter weight and single deck, which creates a better power-to-weight ratio and enables steeper climbs into and out of tunnels, as well as operations on modern elevated guideways in suburban areas, as mentioned before. Sydney Metro's trains also feature fully longitudinal seating with three doors on each side of each car, while every station features platform gates on screen doors, as well as level boarding, which is a bit of an issue on Sydney's existing network. Now, the Metro Northwest line is really just an early sign of things to come to the system, and construction is already ongoing on the much more interesting city and southwest leg of the system. Starting from the southwest, the line is taking over the Bankstown line from Bankstown Station East, where the line will be converted for operations with automated trains, as well as with platform gates and level boarding, which will be done with gap fillers, something that's already been done in Hong Kong. Around Sydney, the Metro will dive underground, making one stop at Waterloo before arriving at new platforms beneath Central, which is being totally revamped and expanded, before continuing north to Martin Place, cutting across the CBD to Barrangaroo, and then passing under Sydney Harbour in new board tunnels, making it the first line to do so. From here, the line will make a few stops before surfacing just south of Chatswood to form a single line which runs north-south in a wide west-opening arc. If you want to learn more about all of the works going on to build Sydney Metro, you should check out TransportVlog, which has been covering Sydney Transit, and in particular, Sydney Transit Construction in great detail. As it turns out, there are other Sydney Metro lines, but they're a bit unusual. The Sydney Metro Western Sydney Airport line, yes that's really what it's called, is meant to connect Western Sydney Airport to the rail network, with a new six-stop line north to St. Mary's on the T1, essentially acting as an airport shuttle, at least for now, which feels less compelling than a direct rail link, which could surely have been built given the greenfield status of the airport. There are plans to build a dense urban centre around the airport, which I'm generally skeptical of, given the noisy places airports tend to be, but mascot is pretty great, so I'll give Sydney the benefit of the doubt here. The final line currently moving forward, and under construction on the metro, is Sydney Metro West. This project is essentially a new independent line from the Sydney CBD to Parramatta, that can provide extra capacity and a more direct route between the two when compared to the more congested legacy line. As you've probably noticed throughout the video, Sydney's legacy suburban rail lines are very windy, and top speeds aren't that high. This line is also going to provide additional higher order transit to areas like Piermont and Sydney Olympic Park, which have huge growth potential. That being said, Sydney Metro does make me wonder sometimes. For one, the station in Parramatta won't have the most direct connection with the existing train station. Riders will either need to walk quite some distance, or change at West Mead, which does provide less services, say if you want to go south. At the same time, the city center terminal at Hunter Street, not being a cross-platform transfer with one of the stations on the under construction Sydney Metro, feels like a missed opportunity, given how close together the projects are being built. I'm also not entirely sure that all lines on Sydney Metro are actually being built to be intercapable, and this seems problematic for the potential of future interlining, and is a major strength of the existing train's network. There are also network gaps, such as between Tallowong and Schofields, that are meant to be closed in the future, but might have been best to never have existed in the first place. There are some more macro-scale questions as well. For one, Sydney Metro's lines have some rather large interstation gaps, of several kilometers or more, in a bunch of different places, which is a lot more than the standard one kilometer or so that you tend to see with a lot of new systems. At the same time, despite the push for express service and more direct routes than existing trains' lines, there are somewhat limited top speeds of the metro trains when compared to the suburban EMUs feels like a missed opportunity, to use one of the high-speed metro-style trains that is available these days and is being used in places from London to Delhi. In many ways, as I've said before, from the parkades at suburban stations to the more metro area-scale transportation ambitions, Sydney Metro feels more like an enhanced version of Sydney train's existing model rather than a more local form of rapid transit, but with all of that said, I won't deny how beautiful and impressively high-capacity it is. Interestingly, Zurich and Sydney do have something in common, besides their big double-decker multiple-unit trains, and that's the incorporation of intercity services. In Sydney's case, this is with NSW train link, and this looks very interesting because to a large extent, the trains running on the Central Coast and Newcastle line to the North, the Blue Mountains line to the West, and the South Coast line to the South are the same electrical multiple units you would see in Sydney's main fleet, though fitted out for longer distances. And, as in Zurich, these trains could be used interchangeably with suburban services, which is really cool. What's also really cool is that soon, some of these electrified intercity services will be operating with the very nice new looking NIF sets, which are derived from the A-Sets you see operating on the Sydney Suburban Network. The consistency, both in design standards and performance, naturally makes these longer distant services operating through the suburban lines in Sydney onwards fit in very nicely. Now, there is more rail transit to talk about in Sydney, and that would be the fast-growing and surprisingly extensive Sydney Light Rail Network, but YouTube videos can only be so long, and that kind of specialized content just really doesn't get a ton of traction. So I've actually gone and made an exclusive video on Nebula, dedicated to Sydney's burgeoning light rail system, which replaces its long-remove tram system. Nebula is the streaming award-nominated streaming platform owned by me and my creator friends, featuring over 14,000 titles that you can watch ad-free, including exclusive and early access videos from educational creators like myself, not just bikes, and CityBeautiful. You can get a monthly subscription to Nebula First, low as $3 a month, or get a whole year with a two-month discount. Check out the link in the video description to watch the exclusive right now. So thanks for coming down under with me to check out the Sydney Trains Network, one of my personal favorite suburban rail systems out there, and one that has a very interesting and promising future.


Live from the Sands Convention Center, Las Vegas, Nevada, extracting the signal from the noise. It's theCUBE, covering HP Discover 2015. Brought to you by HP. And now your hosts, John Furrier and Dave Vellante. Welcome back everyone, live in Las Vegas for HP Discover, our three days of wall-to-wall coverage. theCUBE, our flagship program. We go out to the events and extract the signal from the noise. I'm John Furrier, my co-host Dave Vellante. Our next guest is Casey Choi, global solutions architect and engineering, global sales with all the customers here to share with us the data from the field. Welcome to theCUBE. Hey, great. Hey, thanks Dave, John, appreciate it. You know, we love doing the CUBE interviews. One of the most fun segments are talking to customers and our people close to the action. You're close to the customers. You're close to all the action. In this transformation, customers have been road mapping out and looking at the past five years. They saw cloud, they see what Amazon's doing. They see the cloud stuff. They obviously see mobile every day. And so up and down the stack is huge change. So I want to focus in on where the levers are. Where do you see with customers? The main innovation levers or technology enablers? Is it cloud? Is it big data? All of the above, what's your view there? And what are you hearing from your customers? Yeah, so it's a great question. And I think the first place I'd start on that, right, is I think we have to realize that, you know, for the first time probably in recorded history, right? We have a confluence of these things happening, right? I think, especially in IT, we're kind of used to seeing kind of linearity around things that hit us. You know, it might be web or it might be social or it might be these sorts of things. But for the first time, we kind of have a perfect storm sort of a situation occurring, right? With what's happening with mobility, what's happening with data. And it's happening fast. It's happening fast. It's non-linear and it's all correlated, right? So first and foremost, I think it's a very challenging environment for IT organizations, especially those that are more traditional in nature. So I'll absolutely reinforce that. And I think, you know, if you talk about technology levers and what's there, I think there's a couple of things. I mean, that we certainly see as a characteristic of those that are capitalizing on this first. I think first and foremost, it's those organizations that realize that all of these things are happening versus I'm going to attack these things serially. Case in point, for example, if you look at what's happening around security, security in and of itself is becoming a big data analytic problem, right? You can't no longer handle security with a bunch of folks looking for screens, looking for action, looking for activities like that. So I think key levers for us right now are really in what I would call what's happening on the application side and certainly big changes around the velocity and the quantity of applications with the quality still being a key component of that. And then the second aspect is really the ability to analyze and make meaning a large volume of information that is being ingested into the organization. So the lever points are really there, whatever technology you use. And then compute's not going down. I mean, it's more and more compute coming on the scene, more storage needed, faster storage. So like there's an engine of our infrastructure. And then the apps are under a lot of pressure to go faster and be more robust. Well, I think what's happening on apps and I think everything centers back on the application, right? And whether you talk about agile or DevOps or whatever terminology you want to use, the fact of the matter is the velocity of the applications driven by demand and that demand could be mobility. It could be in the area of social, whatever you want to look at. The line of business driven, the business has gotten very used to a application cycle that is much more frequent, which has a much higher velocity than what we've been used to. And that pressure is felt throughout the entire ecosystem whether you're talking infrastructure data. So I got to ask you though, business is used to it? Are they getting comfortable with that? Or are they getting sort of forced in that direction? Because most customers I would say that we talk to aren't there yet. I think it's a forcing function and I think there are certainly leaders in that. What we're also seeing is more traditional industries and traditional companies adopting. And I'm seeing this kind of, really the tip of the iceberg on this, really adopting architectures and methodologies that you wouldn't normally find in a traditional, let's say an insurance company or a financial services organization or a retailer who might be a little bit more conservative. They're not going to be a web scale property, but now what we're starting to see is they're adopting the things that have been taught to them by organizations that are digital native, right? Or have really known, none of the vestiges of the old style of IT. So that combination, that traditional middle point is really where I think the key battlegrounds are, right? Is how do you take more traditional transactional systems of record businesses and combine them effectively with what we're starting to see on systems of engagement. So the born in the cloud digital native guys have, they don't have the legacy, right? And they don't have the profits either, but they're not measured by the same KPIs. So, but then you got the large insurance companies, you mentioned financial services manufacturers, 90% of their application portfolio is that legacy. So how do you help them sort of transition from point A where they are today to where they want to be? Yeah, I think you look for good bridge points, right? Into the organization, taking into account things like the tolerance of the organization for the speed and then skill sets, right? That's kind of the other kind of underrated part of this is, it's one thing to have the technology. It's a wholly different thing to have the experience and really the capacity to do this from a skill set perspective. But I think what you look for is, where are those opportunities to really leverage competencies you've already have? So case in point, a lot of organizations have built up deep competencies in what I would call mode one stuff. So let's take SQL for example, right? There's a lot of good bridging capability that you can use to take that SQL native language and use it for non-SQL or these upcoming Hadoop based environments or Cassandra or SQL type environments, right? It's the killer app for Hadoop. So you look for that, right? So we've got some of that within our product sets like in Vertica and we pay a lot of attention to those connectors or those bridges. So what I really look for and try to advise on is really to try to find those points where you can take native tongues, right? And learn a second language quickly around that. So you don't want to go from English to Chinese, but English to Italian might be a little easier, right? So you look for those sorts of, what I would call phonetic bridges and kind of build upon that. So Casey, I got to ask you about business, new style of business. People are all connected with mobile phones. That cat's out of the bag, it's jeans out of the bottle. Undeal, no matter what people say. There's new dynamics, that puts new pressure. So we hear about things like API economy, notification, more and more data is coming in from a threat standpoint. So the consumer experience has changed significantly. And there's been startups come out of the woodwork, new ideas get exploited and driven, grown fast in the cloud. That speaks to this whole new era. Now, if you look at what's powering all that, infrastructure, it's the software, it's the DevOps, it's the orchestration, it's all that operating system like software that makes it all happen. Horizontally and vertically scalable. So I got to ask you, quiz my question. With all this replatforming discussion that you hear in Silicon Valley, we're replatforming the enterprise, we're going to flatten that out. It's kind of a buzzword, but it means something. It means that we're changing the platform bedrock to enable more agile real-time new stuff. So I got to ask you, from an enterprise standpoint, what does that replatforming mean? Because that is the shift to this new style of business where you see some of the stuff that's happening on the consumer business, not just I have a mobile phone, I want to run apps with APIs. It's a completely mindset shift on how to architect with legacy stuff, and personnel. So what does replatforming mean to an enterprise architect or a CIO or CFO or CEO? Yeah, it's a good question, John. I think the term takes on different meanings. I just heard a presentation the other day by IDC, they call it the third platform. The third platform is this combination of things. I think though, in most of the organizations we deal with, unless you're a web native or digital native, or cloud native businesses, you still have to deal with the fact that you've got a long history of customer information files, transactional records, all those things that need to be integrated. And they're at different speeds, right? And so I think the first realization is understanding that they are at different speeds, and in many cases they're going to require different sets of architectures that will be best tuned or optimized for that particular, right? Time is the equalizing factor and all of that. So again, back to, you know, most of the organizations we deal with, it really has to do with, you know, what are the things that you can help us with to kind of bridge old to new? I don't want to throw it all away. I can't throw it all away from a compliancy perspective. I've got a lot of mine. They don't want to take down the performance. They don't want to take it down. So, you know, we look for specific things that are going to allow for that, for that composable capability within that business. So a case in point. It's a building blocks mentality. Building blocks, I mean things like, you know, container technologies or container methodologies are really hot these days, right? The ability to again kind of carry forward things that I've already been doing, do them in a new way, operationalize them for a different velocity, for a different sort of deployment model. And so we're seeing a lot of interest in that. We're seeing a lot of interest in things like, you know, software-defined infrastructure, programmable infrastructure, you know, the days of buying something that was purpose-built to do one thing is no longer and now you want to have something that will, you know, redefine itself based on the load. I find it interesting, you know, it's the thing that we look at as a whole replete for me, it's just a buzzword, but the themes are all the same. I need to be prepared for change fast. So the Lego block, building blocks, SOA, composable, they have a, it flies in my mind. That hangs together, I have no problem with that. And I love it, because it's, it's also leveraged from a cost perspective. No one wants to drop their compute and storage down. They want to actually increase performance, lower cost, and do all this stuff. I mean come on. John, it never goes down frankly. I mean the idea of scaling back, I mean it's a nice concept, but honestly I really haven't seen much of that unless you're going out of business fast with, you know, you know, it really doesn't matter at that moment. Look at containers, right? So I interviewed the CEO of Docker two years ago and they didn't have any outside funding. Well they were repivoting into their new thing and saw, yeah, we get this open source project and then within a year, that's how fast the native apps started to explode. It was almost like a pressure cooker, just the timing of Docker. Containers have been around. Containers have been around a while, right? What about the timing of that? Yeah, I think it's the open source nature of it. I mean, look at what's happening in cloud and what's happening around things like OpenStack, right? Once that gets out into the community and you get that force and nature starting to happen, and again, driven by a, you know, because not one company's going to be able to do it all, right, but you get that developer community, the open source community active on it, and I think that's what really was a kicker on this, right? It's something, a concept that's been around a long time but now it's got mass. So I'm a customer, pretend I'm a customer for a minute. Okay. I'm scared. That kind of speed radically shifts how I have to do business. I can get fired, I have, I might have, investment, I mean there's a huge amount of cognitive dissonance I might have. So that's the pressure I'm under. I have all the pressure from the business units, not just to run IT, but like, to actually drive top line revenue. I got to get these workloads, I got new apps coming, and now I know native apps, so all this change is making me scared. How do you prepare, how do you talk to me as a customer or are those kinds of customers? I don't mean scared as in like a wimpy kind of way. I mean like the reality is, there's a lot of pressure. There's a lot of pressure, there's a lot of risk, there's a lot of new things, right? Let's face it, even for us, there's a lot of new things there. You know, it's a great question and maybe the way I'll answer it is, I think what you look for is, what are your fast success points, right? We all hear about fast fail. I look for, from an advisory perspective, what are the things that we can get done that show strong progressive capability? Have strong return on investment or business outcome valuation versus let's say doing that next upgrade, right? Or doing that next thing, IT for IT's sake. So, I would say the key aspect here is, look for those things that have measurable impact. Even though it may not be the biggest project, let's look for those things and that can iterate and build on each other. So again, we talked a little bit about it earlier in the discussion, right? I mean, looking for things that are bridged things to the next era. And then look for outside help. Look for counsel, look for those things that have already gone before you, right? And utilize that as much as you possibly can. Reference architecture, success stories, outcomes, and we can help there, right? So I think that's one of the things that we try to leverage as much as we can. Do you see, I mean, what's the bell curve look like? Do you see? So, I see a lot of customers a lot. There's a handful that really are driving for change. There's top-down leadership. They're forcing essentially their people to get comfortable with change. There's a way it is today. It's going to change, get comfortable with that. We're going to go from a situation that you talked about insurance before, where they would roll out a new app, take a year, longer to roll out a new app. Now they're conceiving an application on Monday and it's out, you know, in 10 days. Right, right.  What do you see as that bell curve? What percent of the customers, you know, got feel, are really in a position to take advantage of these changes and how can HP accelerate that? I think like with any sort of tumultuous change like this, you know, you are going to have a natural distribution of this. I would say, you know, so it's going to follow, you know, traditional bell curve, early adopters. I think, though, what we're starting to see more and more of is the middle has access to things that, you know, traditionally, let's say 10 years ago, was really off limits, right? Or it was hard to find.  So I actually see an interesting dynamic happening here, right, which I think, whereas before you had these organizations that had deep resources, deep pockets, deep capability, I actually see the curve shifting a little bit more to the right, at least in the sense that I think the accessibility to what's out there, in terms of the pervasiveness of the expertise, preformed applications, preformed tools. And again, you know, you've got the ability of spinning up things a heck of a lot quicker than where we were before. So the barriers to entry for that are lower now. So in that sense, I think I do see more innovation coming from more of that fat center, if you will. And if you look at what's starting to happen is, you know, you're not only seeing a lot of great startup activity, but you're seeing traditional businesses, you know, realizing and taking a lead and starting to, you know, really get a handle around how do I run at a different speed? And as that realization around that second piece comes into play, I actually see a lot more activity there than what we've traditionally focused on with more leaders. Yeah. Particularly, there's another segmentation which is, you know, size of companies. Like the point being smaller mid-sized companies who didn't have the resources before and now have access to them, that underscores the narrative for the larger companies who might be sitting back saying, hey, stock price is up, we're making tons of dough, we're throwing off a lot of cash. And what's really interesting about this, Dave, is you find companies that, again, you know, I'm not going to name names here, but organizations where you go, all of a sudden they're in a business that is a really strong adjacency, but maybe two years ago they weren't doing it all. You know, so like an insurance company, you know, a couple of years ago we were talking about process efficiency, right? How do I get claims paid quicker? How do I reduce my cost on that? How do I get my EOB statement to look better? You know, these sorts of things? And now all of a sudden you've got organizations that are like, oh, wait a minute here, we've got historical data, we've got intellectual property, we've got trend analytics, we've got these things that can be repurposed in a way that takes us into a business vector that is completely different from what we were saying. And again, these are happening, you know, in organizations that realize that, hey, it's a different business, but it's really adjacent to what we've been doing, right? And now what they've set themselves up for is a very, very, again, different velocity model for that. And again, it's been exciting to work with those because they're coming from all sectors, but again, I would say we're starting to see a lot of, you know, you always look for the startups at this end, and then you've got the established companies, but I'm actually really bullish on what we're starting to see from that. Well, and even if historically, that company had the data and even the tools to analyze that data, their approach would have been, okay, let's order some servers, let's order some storage, let's wait, let's have a development throw the code over the fence to the infrastructure guys, that's changing. It's totally changing. Now you consume it as a service, right? And you can consume it in the way that you want to buy and pay for it, right? And we're seeing that across the entire service spectrum. It shouldn't be any different with what we're seeing in information services and, you know, outcome-based services and so forth. So it doesn't surprise me at all. And again, the way that the procurement is happening, right, and how it wants to be procured and the business model for it, it's as different as the technology changing under it. Who would have thought that spinning media was going to start to go out of vogue within literally a year, year and a half, and it is, right? And so it's similar. I'm glad you say it's next, spinning disk. Glad you're saying that. A lot of people don't realize, HV is one of the few companies who is sort of putting forth this vision of an all-flash data service. Yeah, exactly. That's an example. So you're not protecting the past from the future, which is great.  It's good to see that. And again, I think we've taken a kind of a visionary lead there, and honestly, it doesn't take a lot to figure out that getting things to go faster, like having an all-flash data center, that's a good thing, right? And when everything, like I said, where speed is the common denominator, it's a major factor. And obviously that low latency feeds into the whole API mobile piece. So Casey, my final question for you before we break on the segment is, love your energy and vision because we agree the confluence and first time in history kind of sound by, that's exactly what's happening in many areas. One thing that's a first time in history moment that's going on now that we didn't talk about, I want to get your thoughts to close the segment is, for the first time in the history of modern business in the world, you can actually measure everything. That's technically in theory. That's true. You could actually instrument your entire business end to end. Absolutely. Not like even advertising. Yeah. And mobile devices. Right. The end points are changing. The internet of things. So this is kind of a, I mean, that's profound that if you think about it, you could actually measure everything. So it's not so much the data. It's what do you do with the data? What to look at? This is changing. So what's your thoughts on that? So we can get into a long, moral and ethical discussion about this kind, but you know, as a technology guy right now. Look at three minutes. We've got three minutes. Yeah, I think you're right. There's some privacy issues, of course, but I mean. I think the capability is there, right? I think the thing that will change and change rapidly over the next, you know, probably a few months at the rate we're going in is what I would call the breaks and the variability in that. You know, the capability is there, but just like any road, there are parts where it's a little rough or it's not complete. I think that completeness is really kind of what we're driving for as well, right? Which is, and again, taking moral and ethical things out of the equation, what we're really looking for is how do we ensure that some of the things that we've been doing around things like sensing and monitoring, which is a part of IT, it's not just IT anymore. It's a complete supply chain ecosystem in the end, right? It's from the device you wear to how it then communicates to a device you have in your bag to then how it communicates to your services, so forth. So, you know, our focus has really been, again, and I see where we can add a lot of value from the HP perspective is, you know, from instrumentation to the monitoring to the correlation to the analytic piece. We're one of the few around that kind of has elements of that, right? In its totality. And not to say that it's perfect, but what it does give us, I think, is an appreciation and a vision for, you know, where the breaks might happen and how do we smooth out the road and how do we complete that last mile and so forth, so. Well, I bring it up because it's certainly provocative and intoxicating at some level, so think about the moral and business aspects of that data. Maybe that's a whole nother segment of itself. That's a whole day show. Yeah, you can get another. We can do a whole innovation. You can get another. We can do a whole day cube on just that concept. But it is something that kind of telegraphs what's coming. Sure. From a management perspective and from technology. So, I mean, I want to get your thoughts appreciated. Casey Choi, thank you for joining us on the cube. Thank you guys, appreciate it. We are here live at HP Discover. In fact, you're interested in all flash data center we just talked about. There's actually a crowd chat happening right now with all the influencers with the new executive Minish Goyal on crowdchat.net slash all flash. Or go to hpdiscover.socialour. Engagements site and hub for your experience, keynotes and chats are there as well. This is the cube. We'll be right back after this short break.


Hi everyone, a big welcome or welcome back to my channel. So today we're going to be talking about all of the books that I read in September and I read some really good books in September. As autumn arrived, I found myself reading some more classics, some more magical reads, some slightly darker reads. We have a range of genres, a range of ratings. As always, I would love to know if you've read any of these books or what else you have been reading. Chat to me down below in the comments about anything you'd like. Let's get into the books. The first book I read in September was George Eliot's Silas Marner. This is a Victorian novel that tells a story of a solitary man who lives alone after he is exiled from his previous community when he is accused of thievery. He is bitter and private until a young orphan girl turns up on his doorstep. So believe it or not, I have not read much George Eliot before as much as I love Victorian classics. I had read this one before technically in my first year of university, but at the time we were made to read so much so quickly that I barely remembered it.  There's just something about reading Victorian novels when it feels all autumnal, isn't there? I know it's not just me. I loved everything about this. It is a pretty short novel and I found it to be so perfect and well-paced and clearly crafted. I loved the examination of rural life in here. It is pointed and critical and humorous and affectionate. I loved learning about our protagonist. I loved seeing his journey throughout, his development from shutting himself down and away at the beginning to inevitably but also willingly evolving with everything that happens around him. I love the side characters and the side plots and how everything knitted together so perfectly making this such a great little contained story. There's highs, there's lows, there's some drama, there's some tenderness. It has a very sweet ending. This is everything you'd want it to be. It really draws you in and keeps you there as you read. Such a delightful story. Can't wait to read more George Eliot and in the end, I gave this one 4.5 stars. Next up in September, I picked up The Wildermint by Richard Powers. Another really, really good one. It came out at the end of September. I was kindly sent this copy by the publisher. It is currently on the shortlist for the Booker Prize. It follows a story of a man and astrobiologist named Theo who searches for life on other planets. Theo is navigating how best to singularly bring up his son who is having a lot of problems at school and just with life generally, including being deeply affected by the destructive nature of humans and the decline of our world. So this is my first Richard Powers novel. I never did actually get round to reading the over story, the hype a couple of years ago, kind of overwhelmed me. But this, wow. This is such a perfect novel and such a me novel. This is character focused and intimate and inward looking, but it is also massively universal and mind bogglingly philosophical. The themes in here of crisis and natural beauty and love were all explored so brilliantly, so cleverly. And the central relationship in here between Theo and his son is just glorious and heart-wrenching. Some of the dialogue in here is so stunning. This book just did so much and it was the perfect length. It didn't need to be any longer. It touched my heart. It made me cry. It made me think. It did everything that a great novel should, really. It was just such an immersive and powerful reading experience. I think this one is going to stick with me for a while. I'm going to be recommending it to people left, right, and center. Of course, I gave this one five stars. Next up, I read Lie With Me by Philippe Besson, translated by Molly Ringwald. Originally written in French and set in France, this short novel tells the story of two teenage boys in the 1980s and their romantic relationship. So I'd had this book on my shelves for quite a while. I think the publisher sent it to me randomly. I didn't request it.  It was a bit of a random pick, but I'm really pleased that I did. This is a very simple but very effective novel. It is coming of age. It is an exploration of first love and sexual awakening. It explores heartbreak and the passing of time. There are no gimmicks in here. It is just very clear heartfelt writing. Very true to life experiences. I found this to be totally believable, totally relatable, and totally readable. It was one of those reading experiences where you just have those moments of total clarity where you're like, yes, that's it. I have felt that. A really great little book. Overall, I would definitely recommend it if it's your kind of thing. You can probably fly through it in one or two sittings. And in the end, I gave this one four stars. Next up, I read Arty and the Blue Gods by Jaspinda Belan. This is a new upper middle grade novel that I was kindly sent this copy of by the publisher. It tells the story of a young girl named Arty who lives alone on a Scottish island with her temperamental aunt. Her only comforts are her books and her fox friend until one day a boy washes up on the shore. Arty then finds out that she has been lied to about who she is and she embarks on a journey of self-discovery. So I first read Jaspinda Belan when I read Tamarind and the Star of Ishta last year and absolutely fell in love. That novel was so magical and so heartfelt and that was exactly what I was going for in picking up this one. Broadly, this is what I got. So I love Jaspinda Belan's common themes of homecoming and belonging and self-identity. They are central to this novel and they are wonderful. I loved the journey Arty went on to find out who she really was. I was definitely intrigued as I read to unravel the whole mystery. It's also worth noting that the settings in here are lush. The moody, windy, magical Scottish island is painted so well. Unfortunately, I didn't love this one quite as much as I loved Tamarind for some reason. It just didn't touch me in the same way. I also thought there were some issues with the pacing in particular, but it was still really lovely. Definitely one I'd recommend if you like quick, sweet, magical feeling novels or children's fiction. So in the end, I gave this one three stars. Next up in September, I read The Fortune Men by Nadefa Mohamed. This is a historical literary novel that was long listed for the Booker Prize. I was kindly sent this copy by the publisher set in Cardiff, Wales in the 1950s. This one tells the story of a black Somali man who is accused of a murder he didn't commit. So there were a lot of good things in here. I loved the premise and the setting, the idea of exploring Somali culture within Wales at this time. And this book's strength was definitely building up a picture of these different families and these different locations in Cardiff. The mix of different cultures in here and different ways of life were really brilliant. I loved the sense of place in here. Unfortunately, I didn't connect with this book as much as I hoped I would. The whole trial and justice storyline didn't hook me as much as I hoped it would, which was honestly quite surprising to me. I just never really felt invested in these characters' stories. The whole thing didn't really have an impact on me like I thought it would. It felt like there was something stopping me getting there. So overall, I don't think this is a bad book. I definitely enjoyed aspects of it. I can totally see why people are enjoying it. But for me, I just didn't love it. So in the end, I gave it three stars. Next up, I read Single Window by Daniel Sluman. This is a new contemporary poetry collection that I was kindly sent a copy of by the publisher Nine Arches Press. It came out at the end of September and it primarily explores the experiences of Daniel and his wife, Emily, one, an amputee with chronic pain and the other suffering from Crohn's disease in Fibro, myalgia. The poems detail the year of 2016 when the two were unable to move and were confined to their home. I was so excited for this collection. I was intrigued as soon as I read the premise and let me tell you, I loved this. This was just what I hoped it would be. Reading the first-hand experiences of the fear and isolation experienced by disabled people in Britain today was shocking and eye-opening. These poems are so vulnerable and so intimate. I almost felt personally trusted as I read this collection. The collection also features photographs throughout taken by Daniel and Emily at this time, both of themselves and of their home and this was so effective. It added a whole extra layer of authenticity and intimacy to the collection. Themes of isolation and confinement are something that we can all relate to on some level at this point in time. And I really think that having these experiences with the pandemic recently really made me be able to appreciate this collection more than I ever would have been able to before. Also, I just want to point out that on a craftsmanship level, these poems are lush. Some are very striking, some are much more tender. I really loved the playing around with structure. Some of the imagery is a chef's kiss. This is so great. So unlike anything I've read in poetry before, I would definitely recommend this to anyone who loves contemporary poetry. I will definitely be keeping an eye out for more poetry by Daniel Sluman in the future. And in the end, I gave this one 4.5 stars. Next up, I read The Dragon Republic by R.F. Kwan. This is the second book in a historical fantasy series inspired by military Chinese history. I read the first book in this series last month. Broadly, it tells the story of a young woman, a war orphan named Rin, who, despite all the odds, passes a test and gets to attend the most elite military training school in the empire. Here, Rin discovers her lethal and unearthly power for shamanism, and the whole time, the peace of the Nican Empire is growing more and more unstable. So I'm not going to talk about the details of this book too much because I don't want to spoil anybody. He wasn't started the series yet, but here are my general thoughts. The first book was okay. I liked a lot about it. Some odd choices were made. Ultimately, I think it ended up where it needed to be. If you want to hear more of my thoughts on the first book, go and check out my summer recent reads video. I will leave it linked around. I decided to stick with the series because I'd heard from many people, including my husband, that the second and third installments in this series improved. Thankfully, I did find this to be the case here. So I liked this book. It felt like a good step up. We got to know some of the characters a bit better. It felt like the scope widened, the stakes heightened. If you like military fantasy and you enjoy the more political and strategic elements that some fantasy have, then you should really enjoy this. This wasn't amazing. There were definitely issues. This isn't the best fantasy series I have read by any stretch. My main issue with these books is definitely the character development and the connection to the characters. That's lacking somewhat. That being said, I am enjoying the ride here. I'm enjoying being in this world and just being swept along. I'm currently reading the final installment in this series. So you will be able to hear my final thoughts in my next recent reads video. But until then, I gave this one 3.5 stars. Next up in September, I read Keeping the House by Tice Sin. This is another new literary novel. This one came out last month. Thank you to the publisher for sending me this copy. Revolving around the London heroin trade, this one tells a story of three generations of the same Turkish Cypriot family, specifically the women who keep the family business and the family generally afloat. So this was another big anticipated release of mine. I was so excited about this whole thing. And I did find this book to be so unique and clever and immersive. The thing I loved most about this novel was definitely the world that was created. You get a real sense of time and place in here. You get a real sense of the community and the families and their homes. Some of the descriptions in here of people or food or smells are so stark and specific. You really feel like you're there. I loved the prose in here as well. It is quite quirky and humorous, but also very frank and eye-opening. While this book did have many, many strengths, I didn't fully fall in love with it. Similarly to In The Fortune Men, actually, I think this is down to the characters. While I found some moments about them to be fascinating, I didn't feel particularly invested in them or in their individual stories. More so, I was interested in the wider general story surrounding this topic, if that makes any sense. Either way, I did think this was fab. Definitely want to watch. I think tons of people would really enjoy this. So in the end, I gave it 3.5 stars. The penultimate book that I read in September was Winter Recipes from the Collective by Louise Gluck. This is a new poetry collection that I was kindly sent a gorgeous copy of by the publisher. It's due to come out on the 30th of October. So it's quite hard to describe what this book is about without saying that it's simply about life with all of its joy and despair with the aging process and death ultimately coming at the end. I had never read any Louise Gluck before, despite her being such a celebrated, acclaimed poet. I am so pleased that I picked up this collection because Louise Gluck is a true artist. The poems in here were truly sublime, so beautiful and very haunting. I read beforehand that this collection is reminiscent of chamber music being told through a chorus of different voices and you definitely get that sense while you're reading. There are a lot of experiences that contributed to this collection and the whole thing just feels so authentic and relatable and really touching. The poems in here felt quite traditional in their style and that really, really worked for me. Really impressed with this one. I will definitely be reading more of Louise Gluck's poetry in the future and in the end I gave this one four stars. And the final book that I read in September was Burnt Coat by Sarah Hall. Another new novel, believe it or not, this one just came out on the 7th of October. This is a proof copy. This one tells the story of an old, celebrated sculptor named Edith who was coming towards the end of her life. Throughout, she reflects on her childhood, her relationship with her mother and the time when she brought a new lover into her studio during a lockdown for the first time. So you may or may not know that I am a massive Sarah Hall fan. She is a Cumbrian author. She comes from the Lake District like myself and her writing is just beautiful. I fell in love with her when I read Haweswater a few years ago. I was so excited to hear that she was bringing out this new book and boy, this was stunning. This whole setup is like a dream to me. I love novels that are reflective. I love novels that explore family and childhood and memories and how all of this shapes us. I love novels that explore desire and romantic love. I loved the structure in here, a flitting between Edith's present and different times in her past getting to piece together more and more about her life as I read. The exploration of the central relationship in here within the context of a lockdown was so heart-wrenching and touching. The writing in here is also beautiful all the way through really, but there are also some specific wow moments that just took my breath away. And just the whole atmosphere that was created in here, the moody settings, the exploration of isolation and connection and passion, the haziness of memories, the pain and loss of remembering. Yeah, this was really, really good. I can't wait for more people to read this one. Sarah Hall is such a great writer. In the end, I gave this one five stars. So there we have all of the books that I read in September. I think this was a really good mix. I really hope you enjoyed hearing me chat about all of them. As I said at the beginning of the video, I would love to know if you've read any of them, how did you find them? A big thank you as always for watching and listening and saying hi, if you do say hi, it really makes my day. I hope you're all doing really well and I look forward to seeing you in my next video. Bye everyone.


I'm Zach. I'm a research scientist at ChainGuard. This is Marina. Hi, I'm a PhD candidate at NYU. And today we are here to rant about why not all that's signed is secure. And so the subtitle of this talk is Verify the Right Way with Tough and Sig Store. So we're going to talk about some cool existing technologies. We're going to talk about how in theory they can be used together really nicely. And then we are going to ask you all in the audience to help make that integration nice and smooth and easy to adopt for everyone. So the problem that we're dealing with is that people love to sign things. People love to talk about once you've signed things, OK, they're secure, right? And the short answer, you might be able to infer from the fact that a phrase that has a question, no, I don't believe that necessarily, just because something is signed, it is secure. And in particular, signatures are only going to be helpful when you verify them correctly. What correctly means is going to totally depend on your use case. And so we're going to work through a couple of different use cases. But one really obvious example of an anti-pattern that I have seen in the wild is people verify that something is signed, but not to check at all who signed it. And you can imagine how that could go poorly. So what are we going to talk about today to actually fix that? We want to enable flexible and smart policy enforcement. Policy is how you check those signatures. And when you check those signatures correctly, you're going to get a lot of value out of that. So we say flexible because different settings have different needs.  Different parties are signing those the way you figure out who's supposed to be signing what is going to be different. But we're going to use existing secure solutions that have kind of worked all the way through all the kinks. They're going to protect you against sorts of attacks that maybe you didn't even know were going to be a problem. And so by using these off the shelf solutions, you're going to get protection in a way that something cobbled together without that theory is going to lack. And then we're going to kind of work through a couple of different examples. We're going to work through sort of the open source package repository setting. How are you signing in that environment, especially if the signatures are coming from people all around the world who maybe you're not going to be able to ship them all UBIC keys. And we're going to talk about internal container registries inside of an organization. And then I think from that, you're going to be able to interpolate to a whole bunch of different settings with, again, the same building blocks. So we have our obligatory collage of headlines slide. If you've been at this conference for the past two days, odds are pretty good that you've heard someone say the word software supply chain security. It's in the news a lot. But fundamentally, all of these problems boil down to someone is trying to run some software. And it's not the software that they thought that we're running. And they get an unpleasant surprise for it. And so we're getting interest from the government. We're getting interest in the news media when attacks happen. We're getting academic interest. And so these things are important. And so the next question is, does signing software, the subject of this talk, does it help? And people, armchair opinionists on sites with orange headers like to talk about, oh, just sign the software. And then it'll be secure. You're having all these vulnerabilities because you're not signing the software. And I think there's a little bit more nuance that we need for that. So I think signing software is part of the solution. If you download software from the right place, but it's not what it's intended, those kinds of attacks are things that signing software can help with. So compromised accounts, compromised build processes, even compromises of the package repositories themselves, we can deal with that by signing software. It's not going to stop all attacks. It's not going to stop normal vulnerabilities if someone published software honestly and they just made a mistake. That's how would a signature help with that? It's not going to defend against underhanded contributions. So I send a PR to a project that looks safe, but actually introduces a really bad vulnerability. It's not going to defend against me going and threatening an open source maintainer with a hammer until they publish the Bitcoin miner in place of their NPM package. But in situations where you know who's supposed to be signing a package, we are going to be able to help with the kinds of compromise mentioned on the previous slides. And that's a really big if. We're going to come back to that later. It's doing a lot of heavy lifting there. So Sigstore, in the talk title, really exciting technology. We're not going to have time, unfortunately, to do a deep dive into how it works. But the high level overview is that it enables really easy signing of software for containers and for other software as well. And it enables workflows without key management. So for a long time, we've known that people struggle to manage long-lived signing keys. I'm sure some of the folks in this room have a GPG key on a hard drive in a basement or a garage that is unencrypted. And they don't know how to access anymore. Key management is really, really hard. And this has been validated in the academic literature. There's a lot of usability research on this. Some people, it works great for them. And we're not coming for your guns. We're not coming for your GPG keys either. But we do want to enable workflows for folks who don't want to be managing keys but are comfortable managing single sign-on identities. So I have last count eight GPG keys that I've used at various points in my lifetime that I no longer have access to. My Gmail account I made when I was, well, I'm not going to date myself. But I made it at an earlier stage in my life. And it was many years ago. And it has remained compromise-free since then. And I've put all my eggs in one basket. And then I watched that basket really, really carefully. And we're not advocating for single points of failures. And we're going to talk about policies later on that prevent bottlenecking too much on a single point of failure. But we are saying a lot of people have a much easier time managing a single sign-on identity, like your Google account, your Microsoft account, your GitHub account. Then they do a GPG key pair.  And so Sigstore has a nice feature where I can be running a job in GitHub actions and I can get a certificate issued that identifies the build job as the build job that it's running. So it can say I'm running the official NPM build job and then sign off on the software artifacts. And now you're convinced that the artifact produced is the output of this known job. So identity much easier for humans, much easier for machines. And then finally, Sigstore brings in an element of transparency. What do we mean by transparency? It means that we post all of the activity in a big public log so we can detect misbehavior. So if Sigstore itself is misbehaving, we'll be able to notice that. If Sigstore is issuing certificates in my name to someone else, I can get a text message alert if I set up a nerdy script to do that. But just like when someone logs into your Amazon account, you get a text message. So Sigstore's transparency kind of, we're doing some centralization here, which is scary, especially to a lot of people who are used to the 90s cipherpunk kind of model of crypto as decentralized everything. So we're doing some centralization, but I think to mitigate the impact of that, we're asking the central parties to be fully transparent in everything we do so we can double check them. So how does it work? Again, we're gonna skim, this is not the point of this talk, I would love to talk your ear off afterwards about the details of these components. But there's a few components. One is Fulcio, which is a certificate authority. And it's going to issue short-lived certificates in exchange for OIDC credentials. So think like log in with Facebook. So you basically log into this certificate authority and it gives you a certificate that's gonna last only about 10 minutes. And then there's a log called Recor, which is gonna give you a timestamp on that signature so you can know that it happened during that short validity period. And then it's gonna record some metadata about the signature itself. And then finally there's a client called Cosign, which is really useful in a cloud native context for sticking those signatures in OCI registries and kind of tying these components together. Okay, so you've got your sigstore, you're doing the signing, let's talk, how does verification work?  It gives you back Nginx at a particular hash and then it also will give you a signature. And then you verify that signature and life is good, right? Well, what if the container registry is evil? Then they can give you a signature and the signature could come from someone with the, I guess, app's name, evil hacker. And then you verify it just, that's not how we wanna be verifying these signatures. So we need a policy of some sort. A verification policy helps us interpret the signatures. They answer the question, what do I mean when I sign something? So again, people talk about sign your container image. What does it mean to sign the container image? Did you dump all the layers in hex dump and check each byte? Probably not. What you're really claiming when you sign something is much more specific than that. And so being explicit about what you mean when you're signing something, instead of having a signature just be over an artifact, you make a claim. That helps us compile policies that make a little bit more sense. So we'll give some examples of that. Yeah, so the simplest is exactly that, what I told you not to do, is this idea of a universal signer. There's one person you trust and if they sign a particular binary, then we trust the binary. There are more sophisticated, I guess ideas that we can check when we're having a verification policy. One is an idea of ownership. Package P came from Alice who happens to be, I happen to know, and again, we'll get into how we know that. But I happen to know that Alice is the maintainer of React or whatever. She made package P and she signs it and she asserts that she owns it and that that source is good. So we can also do assertions about build integrity. So machine M built a particular artifact, but what's extra powerful is when you combine both of these notions together. So the idea is that your trusted build machine would sign a claim like I built package P from source code S and Alice says I audited the source code S and then if you trust Alice, these two things together give you a much more powerful claim than either of them on their own. So policies are good. How do you get a policy? So you may recognize some of these figures from the previous slide and we're gonna go through a pretty similar exercise. Okay, so I'm gonna go request the latest nginx image. It's gonna give me a signature and the image at a particular digest. And then I go back to the container registry and I say by the way, who's supposed to sign that container? And the container registry says, oh, Marina Moore and then I verify it and life is good. That could go wrong in much the same way that it could go wrong the last time. So same thing, except now the signature is coming from the aptly named evil hacker. I say by the way, who's supposed to sign that container and the container registry says, oh, evil hacker of course. And then I verify boom check and that's not life is not good in this situation. So we have to use some slightly more sophisticated technologies to help us with that and that's where I'm gonna turn it over to Marina. Great, thanks. So yeah, so as those previous examples showed, you have to know what you're running and the context in which you're running it and this context tells you who it is that's supposed to sign each thing and you have to be able to get this context from a secure source, a source that's separate from where you're getting the image and the signature so that it actually provides an additional layer of verification. And so I'm gonna talk a bit about this project called the update framework or tough, which is a project that really focuses on this idea of secure distribution. It can be used to securely distribute not just signatures of artifacts, but who is supposed to sign these artifacts and it can be used for these kinds of trust relationships and this framework has this additional property of compromised resilience. So even if any single key or single even a single repository in the system is compromised, there are ways to recover or prevent these attacks. And also I think we're gonna very briefly cover in Kodo which really covers those combinations and I can help you talk about more detailed relationships about what happens in your entire supply chain, not just the distribution step, but going back from the distribution step, who actually built your software, who tested it, how do we know who's supposed to build it and who's supposed to test it, putting all that stuff together into a single place where you can check all the steps in the supply chain to make sure they're done by the proper people and then distribute information about who's supposed to sign those in a secure fashion. So as with Sigstore, unfortunately, this is also not a in depth tough talk. So a lot of the details about how this stuff we're gonna talk about works will not be in this slide or in this particular presentation. We have lots of great content on the tough website including in the talk listed there if you're interested in the low level details about how tough achieves these properties we're gonna talk about. We're gonna focus today just on kind of what those principles are. Yeah, tough is a CNCF graduated project. It was originally based on some peer-reviewed academic research by my advisor, Justin Capos. It's used in production by organizations like Fuchsia, Datadog, various automotive OEMs and many others. And it's based on a few principles to really achieve these security properties. These principles include separation of responsibility meaning that we can achieve that compromise resilience. So that if any one thing is compromised it only compromises the particular responsibilities of the entity and no entities have too much responsibility. So I do have multi-signature trust which we'll get into in a minute and explicit and implicit revocation to make sure that all parties in the system can be revoked if they're compromised and of course secure recovery when a compromise happens. So the first property we'll talk about is delegations. So you can have a centralized entity you kind of be rude of trust for the system if you will. So in the case of a organization like PyPI which is the Python packaging index the thing that posts Python packages that are downloaded by PIP and other installers. You can have it can control the space of packages that are uploaded to PyPI and you can say okay but I know that the NumPy package is owned by Alice and Alice should be the only person uploading the NumPy package. So Alice has permission specifically for a NumPy package but no other package on PyPI. And the Sci-Fi package on the other hand Bob is trusted to upload this package. Bob is trusted to this package and nothing else. And you can do more complicated relationships list of course multiple packages for a person separate namespaces all those kinds of things. Tuft also includes explicit revocation so if any entity so say we have in this example we have open SSLs this version 1.0.1 which we think is totally fine and then something changes right we learned that there's some issues with this version of a piece of software. We can respond to this vulnerability by explicitly roking trust in that version of the package but leaving the trust in future versions of the package. This includes a couple of additional this is done using the metadata system in Tuft but it really ensures that you can explicitly say when a version of the package is now has a vulnerability or you learn more about it it can be explicitly revoked and it won't be used anymore. And every client will know that they have a version of the index that's up to date and lists these like outdated packages as deleted. We also have implicit revocation. All keys, nothing is good forever so any key in the system has a lifetime and so if it's lost or stolen or it's lost or stolen without you knowing it still has an eventual expiration. So there's kind of a limit of time in which an attacker can take advantage of a lost key. And this helps with undetected compromises and make sure that people kind of keep track of the keys that they have. We also have signature thresholds in Tuft. This is one of the really powerful ways we achieve this compromised resilience is that you can have one package and you have to make sure that multiple different parties the test that they are okay with this particular version of the package. So you have lots of different people side of the same package. For example, you can have a developer and a security team. So you say this developer team wrote the package this security team checked it. Therefore we trust it and we won't trust it if either of these signatures is missing. And finally, we have one remaining issue with Tuft which is how are we gonna loop this back into our tough and sick store combination which is that how do you detect if a key is used by an attacker? So if someone manages to get your key without your knowledge, how do you know that that key was used on Tuft? And are you seeing the same signatures on these packages as everybody else is seeing? And this is where you really need this property of auditability. So as you guessed, this is where tough and sick store can come together. This is actually already supported today. You can include, you can upload tough metadata to the RECOR transparency log in sick store to get this auditability where you know not just that this is the tough metadata that you're seeing but it's the same tough metadata that everybody else is seeing for this particular package. And this allows you to audit the use of so any signer in the system can audit every time their key is used. And you can also ensure that you have global consistency. And if you have like one particular vulnerable target they know that they're seeing the same version of the Tuft repository as every other user of the system. Even in the event of a key compromise or any other change to the system. So now we're gonna talk a little bit about what this looks like in practice and what does this actually give you. So I kind of ground this in some more concrete things rather than these high level security ideas. This particular example is still in the realm of design docs and good ideas but we'll go into some other ones that are a little bit farther along in a minute. So say you're at a company that has a container registry for all the images that you make that you wanna give to your customers. And so if you can do this combination of tough metadata stored in Sigstore and then upload all of that metadata to OCI you can create like a fixed policy because you know as an internal company that your dev team should sign every image. So you can say, okay, we're gonna create this tough metadata that says this is the team that are trusted for these images. You know those particular keys that are made. And we also know that this image should be built by GitHub Actions. So that can be an additional signature that goes onto the image and you know the workload ID for that and you can say that's the ID that should be signing those images. And for free you get, because you're using tough you get this revocation property. If any of your developers lose their key if you change your GitHub Actions workload ID or switch from GitHub Actions to some other service entirely you can revoke and you can change the keys. You also get freshness which makes so you can make sure that everyone is seeing the most up-to-date set of images at any given time. And you can enforce all this policy that you would find in like a Kubernetes admission controller or other intake system. Another idea of how you can combine these systems that this one is a little bit more far along which is the idea that you have a public package repository. Someone like PyPI, NPM, RubyGems all those folks. And instead of the versus the other in this previous slide, you know your dev team, you know the people who are supposed to be creating the images versus these public package repositories anyone on the internet can upload to them. And so the policy looks a little bit different. So you can have this default policy that's created by the package repository where they just map packages to the person who has the account on PyPI or any other service and say I know that this account is tied to this. And so we can create a policy that says that this image has to come in the account associated with that package. And in this case, another kind of addition that you can use in this case is that you can use those SigStore signatures, the short-lived keys easy to manage that we talked about before. You can use those in the place of a long-term key pair within the tough system to make it easier for the developers. And so you have this default policy and you can also in addition to the default policy because again, this default policy if like any random person on the internet can create an account of PyPI and then upload packages, you might want to have an option for a more paranoid policy. So security vendors or companies or anybody else can create a separate policy for more paranoid users that allow this particular trusted uploaders and even creates that map between those trusted uploaders and the packages that they're known to maintain. And so you can kind of have a subset of everything on PyPI that's part of your trusted policy. And you can enforce this in your package manager and PIP or anything else as well as having like layers on top of that to make sure that you can use your specific allow list. And for free, as before you get this revocation, curation and freshness that comes with tough. And in addition, you get this protection from repository compromise because all of these signatures are done by developers and not by the package repository, which means that even if the package repository is compromised the malicious users won't install a malicious package because it's signed by the wrong people. And there's all kinds of other places you can use this combination of tough and sick store. You can see places like app stores which have some particular use cases in that there are no entrusted developers, which is a little bit different than the public package repositories because there's like a smaller set of folks who have the particular accounts to be a trusted developer in these app stores. You could have more curated package repositories that have additional signatures from security teams and really exclude those other kind of packages from anyone on the internet and just say these are the packages that we actually trust and our list of packages or policy will only include those trusted books. And finally, there's the case of a single product updater. So like your operating system update or any application update which can mitigate the compromise of a distribution server. So this kind of man in the middle which is I think auto corrected there. No, sorry, that's Mimi, which was a check. One of the headlines was there was a chat app which is popular in China called Mimi and they had their CDN basically owned and then the attacker substituted in place of Mimi, the normal chat app, they had an evil version of that instead. So it's an example of a mid-owned, but anyway. Yes. So yeah, so that's some other places that we can use this combination. And now we have a lot more details, a lot more future work. So this is kind of where we're hoping that all of you can come in. There's some additional pieces here that we need to finish solving and make better and really want to prove the usability of this that this is an obvious way to do it. And then doing updates and distribution the correct way should be the easiest way so that all of our software can be more secure. So things in this category include revocation and things that end up on a transparency log, how do these things get deleted and changed, scalability. There's a lot of pieces of both stuff and six-storey that have interesting scalability challenges, especially as you look at these really huge public package repositories. How do you, some of the particular roles in Tuff, like the snapshot role, which I didn't go over, but it has a list of every package, right, which scales linearly. So ways to do that in a more clever way. We have in-band key rotation. So making, so the delegation structure is great for saying this particular package should be signed by this person. But what if this person leaves the team or wants to switch it off to some other developer? How can we do that in-band without having to involve these volunteer repository administrators who don't have time to respond every time someone wants to change their key? What do we do when we have post-quantum broken encryption from post-quantum algorithms? How do we change every signing algorithm? One of the, as many of you may be aware, when quantum computers become a reality, signing algorithms are one of the critical pieces of internet infrastructure that will be broken. So how do we design these systems in a way that if and when that happens, we can quickly respond and keep everything secure. And then, of course, there's the shifting left, signing everything from the source all the way to this distribution. So right now, this is a lot focused on distribution. How do we incorporate more with projects like Nintendo and others to get this all the way back to the source? And then there's this whole usability piece of it, really simplifying the setup of these tough repositories. And we have a couple of really cool ideas about how to do that, including creating kind of a public good shared tough route that can be used by, especially all of these public software repositories so that they don't have to have the infrastructure and the teams to actually manage this themselves. You have one centralized place for all of the public open source things on the internet. And of course, in TOTA, which I mentioned before, but I think integrating the entire software supply chain security into this is gonna be a key piece. If you wanna get involved, we would love to hear from you. This is links to various projects within Tuff and Sigstore. You can get involved, including Slack to chat with us. Also, if you are on the end user side, rather than this side, and would like to see how this can work in your system, we would love to chat with you about how we can make that happen. So yeah, and there's a QR code for feedback. And we'd love to see any questions, thanks. All right, yeah, we did leave, I think almost 10 minutes for questions, so we'll take that. I think I saw your hand first. Go for it. Yeah, so the question was, have there been discussions with Linux OS package repositories, basically? So you're talking about Apt, RPM, and so on. The short answer is, it hasn't been an area of focus, largely because I think the problems are much bigger for community-operated package repositories, where you have developers coming and going. And so while, I think there's a fair argument that package signing inside of Linux distributions has a number of issues, they're in a much better position at the moment than most, you know, than like PyPI, where they have enabled GPG signing for 10, 15 years, and the adoption is low, low single digits.  Again, there are some issues, I think there are things we could learn from the Tough Project and bring into those implementations, but for the most part, they're in a better situation because they have a small number of trusted developers who can then manage keys. So the revocation story could be better, especially with some of this implicit revocation and so on, but it hasn't been the most active area of focus. It's certainly something I think that's on the Tough Project's radar, and it's a place we'd love to have conversations. I'll take a moment to plug in the open SSF. There is a working group called Securing Software Repositories, which has been convening a number of folks from various package repositories. We have the best representation from language, ecosystem libraries, or package repositories like PyPI, NPM, and so on, but we have some representation. There's someone from Gen2, someone from Homebrew, and so as we're kind of scaling that up, we'd love to hear more. So I guess the short answer is if you have a friendly Debian maintainer you'd like to send to that working group, I think we could benefit a lot from having more voices in that room. I think I saw a hand over here. Yes. Yeah, so there's a couple of reasons. So, oh yeah, sorry. So the question is about deleting transactions from a record log, and one of the main kind of, there's a couple of use cases here that have to do with this. Some of them have to do with privacy concerns or other reasons for deletion. And also the other question is if a package has a known vulnerability, what do you do to make it clear that this entry in the log is not the one that you want to be using, there's a future entry, that's the one that's better. So there's kind of two angles on that. Sure, so yeah, the question is about the scalability issues and if we can highlight a couple of those. Yeah, so I didn't want to get too much into the weeds I guess I can do that now about the tough scalability thing. So, tough has four different, what we call roles in tough that provide different specific things as part of that separation of responsibilities. One of those roles in tough is responsible for the consistency of the tough repository. This is, we call it the snapshot role because it has a snapshot of the current state of signatures and artifacts that are currently in the repository. And this makes sure that any signature that changes anything that's removed is then incorporated in this snapshot. However, the way that's done in tough today, which there are proposals to change this of course, but is that you list the every metadata file and version number that's in the repository. Which if you have a lot of artifacts, something in the millions of artifacts in your repository that lists can actually get fairly long and become noticeable when it comes to downloading things. And so we're looking at various more clever ways to store that than a linear list, like trees to make it a log in instead. But there's some security properties that we want to maintain while doing just the challenge. I don't know if there's any others you want to talk about. Yeah, that's the big one that comes to mind. And then grab us offline if you want to hear the gory details. When it comes to sigstore scalability concerns, some of those are around revocation. And this is something we see in the web PKI is that revocation is actually quite tricky because the scale is so massive. When you're maintaining a certificate revocation list for the entire web, that winds up getting too big to distribute to all of the sort of interested clients. And so similarly in Sigstore, if we have a revocation solution that sort of bottlenecked on that central party, then a revocation list, the scalability problems become pretty immense there. There's other concerns like, as one log for every sort of related universe of, one log that covers both NPM uploads and PIPI uploads and maybe down the road, Debian and every OCI registry in the world. You start to run into challenges here, so can we maintain some separate namespaces and have them roll up into one log because you benefit from scale in security here. Having sort of one central place means it's only one thing that you're gonna have to monitor. So that scale is good, but it comes with challenges of course when it relates to, is that log going to be able to handle the volume of traffic that it experiences? And so far it's been fine and there are some plans to sort of shard that out and they're going along quite well. But if Sigstore is as successful as the project as we hope it is, then that's gonna become a big issue pretty soon. That's a good question. So the question is, if there's a plan to create a public good tough instance. So this is definitely something that we are interested in. I think we even have some potential interest in folks who can actually host it, but I don't wanna promise anything on behalf of folks hosting it until it's a little bit farther along. All right, and that's probably gonna have to be the last question. All right, thank you everyone.