a very good morning to you. You are watching Enterpreneurship Tuesday, only on Y in the morning on Y2-5-4 channel. My name is Hilda Wadili and for our final interview of the day, this Tuesday, please make sure you do slide into our DM and let us know what you thought about some of the interviews we just had, especially the acrobats and all of you who are hustling, whatever hustle that is, I will tell you one more time. So long as it's putting food on the table, bring us to Enterpreneurship Tuesday and let the world know, all right? So with me in studio for our final interview, I have a physical fitness trainer with me. It goes by the name of Gideon Anoka. But I want him to say good morning to you. Good morning. All right, Gideon.  Yes, yes. What qualifications does somebody need in order to become one? Every qualification, you're supposed to be a professional before you go to this. What do you study? Do you have to do nutrition? What happens? There's a course for fitness that you're supposed to go in school. The certified institution is called American Certified Council on Exercises. It's an S, S school. So from there, when you're certified, it has a lot of things that we cannot talk about. You have kinsiology, we have anatomy, we have everything that is combined. Actually, instead of calling it fitness, it's called doctoring fitness. Doctoring fitness? Yes. Interesting, I like that, doctoring fitness. Yes, because we are like this with the doctors. Just that our industry, most people have, right now is when people are realizing what fitness is. What fitness is? People are now upset to realize it's very important. Before it was just like, will any bouncer?  It was a very wrong thing. And it's a crime, something of doing with a crime. Right now, people are understanding fitness because of the current situation you're living in and the technology as well. Everyone's supposed to work out. Yes. So this is your main hustle, yeah? This is my main hustle and my main thing, my passion actually. So how long have you been doing this? This is my 16th year in the industry. 16th year, no wonder you look like that. Okay, all right, that makes sense. Yes. All right, so let's take, there's some very common questions that people like to ask physical fitness trainers. Especially when it comes to workout and diet. So let me start with the most basic one. On a day-to-day basis. Does gender have any effect on the kind of workout I should do? Like does it matter what kind of exercises I do based on my gender? No, no, no, no. What matters is your body type. Yeah. Body type. Yeah, body type. We have different body type. And as the body type is, that is how the workout will define. So for you, you might have, we have ectomorph, mesomorph, and menomorph. Ectomorph, mesomorph, and endomorph. So the three type of the bodies, it has different workouts. But right now, you'll get someone who has lesser fats and someone who has more fats. Also, it's the fat that determines. The content. Yeah, you know, you have big person and the intermediate and the small one, right? In a layman language. So these three type of people, the bigger person wants to become like a smaller person, or the smaller person wants to become like the biggest person. Then in between these workouts that are crisscrossing here and here, which is an athlete and an athlete. So it depends with an individual when it matters, it's about the body type. It's not about the gender. Okay, okay, okay. So take me through your day-to-day routine. When I wake up in the morning, what should I do first? Should I stretch before I work out? Someone was even asking if you should stretch even after your workout. So I'd just like to understand your routine. Yeah, it's very easy. At least every day do something. And this thing you're doing, even waking up from the bed is a workout. But now when you wake up, just do something small, which is now, you see when your body is sleeping, your body is at a sleep. So when you wake up, some senses in your body are already alert. So what you really need to do to make your body adapt to the day, try and do the stretches. The stretches are very good for you. Stretches. Yes, you need to stretch. Can we see some of these stretches that I can do in a split second when I wake up in the morning? I'll introduce one of my guy I'm using for stretches. Hi, Denise. And it will be better. Hi. Yeah, so will it be here? Is it okay? Yeah, it's okay. And first decide. Okay. So anytime you wake up from your bed, first of all, when you wake up, you don't wake up on your bed like this. You lean on.  So seated, just try to sit. Don't worry, he does everything. So when seated on your bed, that is sitting, right? When you come up straight, that's a stretch already. Okay. Okay. Now hold there for a few seconds and raise your arms up straight, both arms up straight. No, no, no, no. No, no. Yes, yes. Yeah, now this is it.  For how long? For a few seconds, you drop down and release your arms down straight. That's the first stretch. Now, since you stretch only your major stretch, now you need to take it to the side. Take it to the side. Yeah, on the side completely. Wait, wait, one second, before you even go there. You mentioned that waking up like this is not the correct method to wake up. Why? Yeah, yeah, yeah. Because, you know, your body is designed in another way. Your body is not designed in a way you want it to be designed.  Yeah, that is a problem. So when you're sleeping, turn on the side. Okay. Then when you're turning, after turning on your side, step down, now wake up easily. Not like this, you're not working out. So you see. Thank you so much for the clarification. I really needed to know one. All right, all right. Now let's carry on. So now from this one now, you take it side. The simple stretch. This one anyone can do it. You just take it side completely and then you relax to your max, not to his max. Okay. Your max. Yes. Then change the side. You can change side, do the other side. Yeah, that is it. And by stretching, you will feel your obliques stretching. You'll feel your chest is relieved and you'll feel at the same time your leg. Okay. Now you will go back easily there and now you can do a simple stretch. If you can't lift your leg on your bed, you can put your leg there and stretch.  Chest out, knees straight. Knees straight down and face front for the good posture. Without a good posture, you're doing nothing. Posture. Yes, you have to work out in a good posture. So it's not enough to just work out. No, no, no, it's just working out. So from there, you drop it down and you change your leg to the other one. And always when you're doing this one, you take like three to five seconds. You hold for stretch. Okay. Three to five seconds. Yes. Five seconds. Yes. One, two, three, four, five. Four and five seconds. One, two, three, four, and five. Great. Yes, yes. So this is what you do every morning anyway. That's a good stretch. Yeah, easy stretch that anyone can do it. Okay. Okay, so if I have time, for example, yes, I've stretched in amidejim. Yes. And really know what I'm looking for. I just want to feel healthier. You know, it might not really be fat or we're trying to lose weight or anything. I just want to be healthier. What cardio can I do? Can you take us through the routine? Like if I had the time, if I had 30 minutes to work out, what should I do for the first 10 minutes, first five minutes, second 10 minutes? Because I hear there's a breakdown. Yes, there's a breakdown. Yes, can you take us through that breakdown? And a variety of workouts does not matter. What matters is you and what you want. You can have one workout, but change the intensity. Intensity? Yes. For example, I can start with a simple knee-up. Knee-up? A simple knee-up, yeah. This knee-up I'm doing, to you, it might sound as just something useless. But remember, I'm combining so many muscles to do what I'm doing, right? Now from here, if I'm a beginner, I'll do this one. Now assume I'm advanced now on that level. Of course, I started warming up. Now I'm running, okay? Now the intensity of this workout will change when I'll make it more and more and higher. You know, I'll push it a bit higher. Oh, so I'm supposed to be picking up the tempo? Like right now, yeah, you see the tempo is up. Compared to the way we started. All right. That's a workout. So it doesn't matter the variety of workouts you have. And it's a wrong thing that people say we have to must go to the gym. Yes, yes, yes. It's a very wrong thing, and that's a myth. And if you get anyone telling you it's a must go to the gym, that person is not telling you the truth. He's not a fitness trainer. He's promoting the gym. You can work out home. And actually me, I'm an agent of training people living at home. So you're actually good. In the Westlands, I have an office. Yes. So we discourage people to be unfit because they have this notion of gyms or gyms, you know. But us as professionals, we are there to even help you train home. You don't need equipments. You need your only own body to train. So let's talk about bodybuilders just before because wait, wait, no, actually, no. I think I'll finish with that. There is a particular workout that I'm seeing someone asked me about, which was there are some exercises that you can do. This one is for the ladies. That could cause you to grow some assets. Yeah, it's a good question. Don't feel shy about it, just ask. Yes. Yeah, yeah. There is a workout of course combined with the diet. Combined with the diet. So how important is the diet?  Is it enough for me to just constantly work out but eat whatever you want? Emma, what is it? On a beginning level, when you get someone telling you maintain your diet and go to the gym, it's kind of restriction. So to me as a trainer, what I really need to work on your body is you to look good and to be healthy, okay? So despite all those hangovers you're coming with and I can manage your body and I can manage you be fit, then I don't need to put restrictions. But if you want to attain a goal, I need you to separate the two. If you want to attain a goal. Then this goal is about losing or building healthy. Then the diet comes in. Diet plays 100%, gym plays 100%. Leave this myth of 70, 30. So they both matter? Yes, they matter.  But you're not fit. That's true. Okay? You're very weak, you look like, I don't know what. But you see when you're training and you're having a diet, you're combining the two things in one. That is the best thing you can come up with the results. You see? So it really, they're both having a very good results when it comes to combining. You cannot do one and live one. Okay. Yes. Interesting. What about, is there specific exercises or workouts that I should do at a particular time of the day? Because I can see that one is morning workout. What about lunchtime? If I just wanna stretch or evening, is there a particular workout for times? What you've done, what you've done is not a morning workout. It's a stretch. It is something you can start with any time you want. This is maybe when you was waking up, right? But right now, remember when in the office as well, you stand up from your seat, right? So you have that, the pendiculation stretch, easy. You can pull your legs up. The pendiculation stretch. How does that one look like? The same thing we've been doing right now. So when you stretch, it's a normal stretch. Even you at some point, you don't work out, but you stretch it. So I'm giving you the general thing that someone can benefit from, despite where you are. And now when it comes to working out, that doesn't mean now you've worked out. You need a professional to guide you through. Yes. How important is it for me to have a professional to guide me through? You see, this is the wrong thing people do. I know even you and the friends you have the Mr. Google, right? Yes, yeah, we Google.  And maybe me, I've posted my workouts on YouTube. So you'll go using my workouts.  What I've actually shared my results. I didn't share my story. Okay. So you will start reading my results. You want to become my results, but you do not know the story, right? So a professional is designed to understand your body, is designed to come up with your program and understand even how you're thinking. When you become a personal trainer, you need to understand a client's mind, a client's body. A client's mind. Let's talk about the fitness of the mind. What would you have, I'd like to understand that. As a personal, as a physical trainer, what mind exercise do you also give? No, no, no, no. You see, you cannot achieve your goal if your mind is clogged together and thinking about money and doing the gym, okay? Your body has communication, right? In order for your muscle to respond, there is some information that is sent directly in your mind, okay? And your mind has to respond. But assume you're working out with me, your mind is in Canada. Are we doing something? We're not doing anything. That's true.  For example, I wake up in the morning, I go in my office today, I'm very upset that someone who has messed me up, I'm feeling so confused. So when you come to train with me, I already have your problems in my mind. I know how to tackle you from A to Z. So you actually have some, wow. If you just walk to the gym and start doing some things, that is when you end up with the injuries and start blaming the trainers. Ah, okay. Injury is also the result of stress. You've just gone there with stress. Yeah, you need the coordination of everything for you to attain what you want. It's very simple as that.  Assume you're driving and you're thinking of something at home. Will you concentrate? Definitely not. You won't. Even if you multitask, you won't. Because at some point, you'll be carried out away by what you're thinking. So that is when we say in fitness, you relieve yourself. It is like going somewhere and confess your sins. Then after you confess your sins, I, my God, I forgive you. Interesting, interesting. I would like to understand, when, like for example, those exercises that I was asking you about, the rears, can you just let us know what I can do if I want? If I want, because the person who has asked me is really insisting. Really insisting. Don't worry, I'll give him or her my number so that she can look for me. There's no shortcut. This is a normal squat we do. Normal squats. Normal squats we do. You see, first of all, what matters is posture. Posture. Okay, so just go down. That matters, the posture. And a lot more workout, come up. A lot more workout. We have something like a donkey kickback. Donkey kickback. Yes, so just kneel down. There, like that, and chest out. Now, when you kick, you raise your leg up straight. To that position, you bring it back here. So, donkey kickback. You see, and you alternate. From this leg, you change to another leg. For how long should I be doing this kickback? Now it depends with a client. Oh, the differences, okay. Yes, okay, change your leg. You see, so now when you combine such kind of things and a lot more workouts, these are basics. It will help you, but don't put your mind on you want to only build the important part. As well, put your mind on the whole body. Because you'll never restrict your body from circulating blood. That's true. In every part of it, right? So that is the same thing. You'll never concentrate on one muscle in your body. Okay. Yes. So we're supposed to be all rounded, aren't we? All rounded. You'll never come to me and tell me, I only want to lose abs. And some... If I adapt to that concept, I'm both a trainer. I need to make sure I adapt on helping your full body to concentrate on the parts you want. Okay, these are focused. Yes. But I cannot be in a position to come and come and tell you, you'll only lose abs. That money you wasted. Yes, because you'll never restrict. The parts is not, and I'll repeat this one.  Yes.  You'll never sweat fat. Yes. Interesting. When you work out on intense level, you start breathing out. That's a very common myth, by the way. No, it's a very wrong thing. If I start how to elaborate on how to lose the fat and whatever, I'll go back to books and it will take us time. Another day I arranged for a meeting. Yes. I'll come to explain to people. How to lose fat. I know the ladies would really want to hear that one. When people are told, just run and sweat. Yeah. You lose fat. You're wasting yourself. Oh, yeah. Yes. In fact, the recommended minutes that you're supposed to do in the gym, the beginning minutes is only 20 minutes. 20 minutes. On top of 20 minutes, you're messing up yourself. So you need to do 20 minutes as a warm-up, involve your workouts, and then from there, achieve what you want, but with a professional, not a quack. Okay. Let's set it clear. As a client, before you start training, demand for certification. Certification. Yes, you need to know that person. Yes. Are you a qualified trainer? But you know, most of the people go for the cheap, the quantity. Or they just approach someone they think looks fit or they're in their gym, I want. Wow, this guy has chest and bicep. Yeah. But they train me tomorrow like 10 push-ups. I'm there doing what he's doing. In fact, the hours you're supposed to spend in the gym, it's only 45 minutes. 45 minutes. 45 minutes. Beyond that is? Beyond that, you're wasting, because your body has a point, we say, you push your body towards plateau level. Plateau. Yeah. So when you push your body towards plateau level, now it's not responding, you're tearing away the muscles. Ah. So you're extra burning.  That is the same thing you're supposed to do. And repeat changing the variations, changing the body workout, changing the kind of muscle you're working out. But not to go in the gym from seven to nine, and you start telling people, ah, I train for two hours. If you tell me like that, I'll have to call you in my class and train you, so that you can understand what I'm doing. Amacha. Yes. All right, all right. So where can they find you on social media and your offices? My social media, first of all, I start with my office. I'm based at the end of Rapturon. There's a building called Andrews' Apartment. In Andrews' Apartment, there's my office there. Yes. And then from there, on social media, on Facebook, my name is coaches Gideon Onoka. On Twitter, my name is coaches Gideon Onoka, but Gideon underscore Onoka. On Instagram, coaches Gideon Onoka. And I have a blog. That blog, if you go through, you'll learn so many things. It's GideonOnoka.blogspot.com. My number, if you want to reach me through WhatsApp, 0726, 018, 258. And please, when you look for me, I'm not an instructor. I'm a coach.  Yes. All right, coach Gideon, we get it right. Yes. Okay, are you affordable? Let's talk about your pricing. How do you price it? I'm very, very, very affordable, depending on the level.  Oh, so you do some analysis on your clients so that you can know, I see. Now, what happens is, when we come to prices, it depends with an individual in terms of the health issues. You can come to me, maybe you have high blood pressure, you have diabetes, you have whatever, they kind of work out the complications and whatever. We sit down and go to the doctor, we see to what level, what will it involve. Our price is not just mentioned. Oh, so it depends also on the goals? No, no, yeah, yeah, yeah.  All right, okay, call Gideon, call coaches Gideon. Yes, yes. Thank you so much, Dennis and Gideon, for coming through to Studio Today. And letting us know that you can also earn a living and letting us know also how we can get healthy as much as it is her school and this is what he's been doing for the past 16 years. What are you doing at home? What have you started that is yours? What is your idea? What is your business idea? Let us know, slide into our DM. You have been watching Entrepreneurship Tuesday with myself, Yilda Wadibi and Barry Moses. Please don't go anywhere. You're watching Wage 54 channel. We do this every day from 7 a.m. to 10 a.m. So make sure you do catch up with us. Otherwise, have a good day. Keep warm and carry an umbrella if you're leaving the house. All right, bye-bye.


Hi guys, this is Christian from Swim2Fly.com Today we're gonna run out to tread water and to stabilize your body on the surface. Many people are asking for this video since many months So I'm gonna make it. So remember before you start to tread water Go where it's comfortable, where it's shallow. You don't need to go as deep. No pressure It's very easy and remember every time you move in the water you have the opposite action from the water For example, if I push my hand this way I will have the water pushing my hand this way so means my body will move the other way If I push my hand down, my body will go ahead. If I push my hands up, my body will go down If I push on the right, I will move on the left. If I push on the left, I will move on the right It's always reaction. You have to use your hand to feel the power of the water inside your hands The first thing is to learn how to feel the power of the water in your hand Start to feel. For example, I fall forward. I want to move back. I will push And then I move. I fall behind. I will pull the water so you don't fall. Try to feel it. I'm here. I fall Pull and you will come back. You fall forward Push behind. Okay You push, you move this way. You pull, you move this way.  All right So when you tread water, you can do it only with your legs, with your hands first. Sorry You don't even need your legs So imagine you are sitting in the water, put the head close to the water. You need to go high It's very hard to tread water when you have the water above your chest here Just very close to your neck is fine and avoid to have big movement like this. Stabilize your body You're here. Start to use your hand in the water one by one You press the water and your legs just imagine you're Biking inside the water, sitting or biking. Don't move your legs much. I'm just using my hand Maintain your head outside the water on the surface of the water Try to target my face. You can feel the camera. All right. Look at my legs a little bit I'm just moving with my legs My hands are stabilizing. So basically the movement is just one by one, one by one Now you can use your legs as well So if you want to use your legs It's very simple It looks like a braised stroke kick. You can use the braised stroke kick You know the frog kick where I'm like this. I kick on the side and I float. That's a braised stroke kick, right? But for the trading water, you can do it one after one After one after one. Instead of double kick Do one by one Actually the both option works. You can do double kick or you can do one by one, but the one by one is usually more effective So let's see how it looks like. I'm in the water. Stabilize myself touching the ground Use my hand and start to kick one by one with your feet pushing the water Sit in the water and push one by one As you can see My hands are moving to stabilize myself and I push one by one. You can stay like this many many many times Or for these people they prefer the braised stroke kick. It's more tiring, but you can also try double kick together And then you maintain, okay?  The more you go up the more it is hard to maintain your body outside Accept to be close to the water. They will be very easy Make a try and let us know your feedback. Thank you


This is T F N N the tiger financial news network Good morning everyone Basel Chapman here on this nine o'clock tiger financial news network market update on this Monday The 14th of August. We're looking at the Dow down 67. Yes. Yes. I did say down so the unusual. I know 35216 the S&P trading right Right now it's down four And I always forget to change the window right there S&P down four I just be making pretty much lower lows and lower highs It's getting to a point where you should have a little bit of a balance But it's struggling and we're looking at the QQQ Same thing up 12 cents at three six six point forty We've been very weak since the 387 point ninety eight high run about the 23rd or fourth of Last month now. This is going to be very interesting. We've got the IWM IWM is much deeper to the downside down two point one one at one eighty eight point ninety Remember it was actually acting quite well But this double top almost within a point of the previous high from months ago It's just fascinating how that happens look at gold gold is down sharp here down ten at nineteen thirty five Remember the 1940s the left side low That's what we were looking at expecting it to be tested got broken so far the day is young But it's under that level right now at nineteen thirty five the dollar. That's the story the dollar was up 49 ticks at one or three point thirty four. Remember one or three point nineteen That was the turn to be in moving average. I said that's going to be the upside target How delivers at that point is going to be important doesn't break out what is broken above it We'll see how that starts out for the week on the close today and looking at bonds USD this is the bonds right now are trading down a half a point at 120 in eight thirty seconds Wow, this is a higher yields. I have to tell you this is beginning to a pretty critical moment in crude oil down Just a little bit down sixty cents at ninety two eighty two point sixty one So with that said this is a very fascinating day in my show coming up the title of nuisance hour I'm going to show a bunch of investors business daily stocks and I'll talk about them because Many times they most of the leaders are in that category. I'll be back in a moment Basil Chapman tiger conditions are coming up


Well, thank you. It's a pleasure to be back here in Trieste. I was only here before once, 24 years ago, but I still remember. I mean, I was here with Alberto Verkhovsky. And of course, like always with Alberto, it was extremely vivid. But that was also the time when I met Sasha Retsnikov. He made a great impression on me. And I'm sure a lot of us miss him dearly. He unfortunately died too young. And another thing that I think it's very hard for me to give a lecture in this room. See, last time when I entered this room, the astronomer Fred Hoyle was speaking. And Abdul Salam was chair. So it's kind of a very high standard. OK, let me say what I want to speak about. I would have loved to be able to speak on the following problem. You have a covering. You have a homeomorphism here that you can lift for some reason here. And you would like to understand a little bit the recurrence property of H tilde in term of H. OK, so this is a covering. And by recurrence property, of course, you could look at fixed point. But I'm not going to look lifting fixed point or periodic point. But I'm going to look rather at the non-wandering point and the chain recurrent point recurrence. Unfortunately, it's difficult to do something for arbitrary covering. But what we can do is something about cyclic covering. OK, there are many reasons why you would like to understand this covering problem. One of them is that it's related to the Poincaré Birkhoff fixed point theorem for analysts. Another reason is about, well, you have the analogous problem trying to lift obri sets for the Lagrangian systems to covering. And this has some consequences on the solution of the Hamilton Jacobi equation on the universal cover or something like that. OK, and in fact, whatever I will say about this homeomorphism case can also apply to the obri set case. Now, I'm going to restrict to the case of cyclic covering. That means that the fiber is z. Or more precisely, I'm going to assume that there is a z action on x tilde, OK? So that I will denote it that way. If x tilde is a point in x tilde and n is in z, I'll denote it by x tilde plus n, OK? That's the action. And the action is, of course, free and proper, OK? And x tilde divided by z is just x. OK, so what kind of result I want to give for this? Maybe I need a, so you see x tilde will, if you have x, which is a compact manifold, x tilde will look like something like that with two n's. And I would like to say something about converging to one end or the other for the iteration of, for the orbit of h tilde n. So maybe for this, the best way is to introduce a function to measure how far you go into one end or the other. So like all infinite cyclic covering on a manifold, this covering x tilde x, in fact, is given by the pullback by some function, OK? So we can find a function into the torus or the circle such that this covering is the pullback is just eta star of the covering of r over t, OK? Like all coverings. The coverings are classified, sorry, into, yes, are classified by homotopic classes of x into the circle, OK? So you get something like that. So I have here t, x, here I have eta, and here I have a lift eta tilde, OK, into r, which satisfies the following property, eta tilde of x tilde plus n is eta tilde of x plus n, OK? Now, let me maybe just state the theorem and then explain things a little bit later on what things mean. So the first theorem, which is a folklore theorem, I mean, it's not so difficult to prove is that suppose the non-wondering set of h tilde is empty. Then for every x tilde in x tilde, so maybe I should say that when I put tilde, it means I am in x tilde. I don't put them, it means I am downstairs. So I'll try to be consistent with that. Sorry? Yeah, x tilde plus n. My tilde, like 2s, my 2s are like 1. My exponential is equal to the log, usually.  So for every x tilde, either eta tilde of h tilde n, x tilde tends to plus infinity, or eta tilde of h tilde n, x tilde tends to minus infinity, OK? So if you don't have non-wondering points, then all points go fly away to either plus infinity or minus infinity, to one end or the other. What about the chain recurrence case? So we have either one of the conditions, OK? So if the chain recurrence is empty, we have one of the following three possibilities, one. The chain recurrence set of h is not connected. So this is the chain recurrence set of h downstairs. It's not connected. Or for every x tilde in x tilde, eta tilde of h tilde n of x tilde goes to plus infinity. 3 for every x tilde in x tilde goes to minus infinity. So in that case, only one of the two possibilities happen. And in fact, the fact that r of h is not connected, by the way we do the proof, because we will show that if it's not connected, we have a kind of good decomposition, dynamic decomposition. Then in that case, in fact, what you can show from Conle's theory is that if in case one, if one happens, then h has a non-trivial factor in x. So this follows from Conle's theory. OK. So let me just state this in the case of the annulus. So the annulus is, this is the case, let's say, 0, 1 cross r. And of course, x tilde, sorry, cross t. And of course, x tilde is 0, 1 cross r. And so this is, as a corollary, we have something which is a theorem which is due to John Frank. So it's a Birkhoff Poincaré version due to John Frank's. OK, and it says the following thing. Suppose h tilde is a lift of h on 0, 1 cross t, preserving orientations, boundaries, and maybe I should add the homotopic to identity. So if the picture now of h tilde is like that, so h tilde, so h tilde moves all points to the left on one side and all points to the right on the other side, then either h has a non-trivial attractor, h has a fixed point. OK, if you try to apply this theorem, in fact, the proof goes like that. You prove a theorem like that one, more or less, in the case of the annulus. And then if you don't have a non-trivial attractor, and now you cannot have these two conditions because the difference on the boundary, then it means that your chain recurrence set is not empty. And in dimension two, you prove that by Brouwer's theorem, plane translation h tilde, not empty, implies h tilde has a fixed point. OK? So now, of course, this is not exactly the Poincare-Berkoff because Poincare-Berkoff proved there are two fixed points, but it's under the condition that h preserve, well, let's say the Lebesgue measure or something like that. OK? Because we remove the condition of preserving the Lebesgue measure, there are cases where we can have only one fixed point, of course.  OK? And I mean, it seems that you go around like that, but if you go to the universal cover, you can have it in the other way. OK, you can have only one fixed point in that case. OK, now let me come back and state what is a non-wondering set, prove quickly theorem one, and explain how to do for theorem two. So the non-wondering set, so let me just take a dynamical system on some topological space. I say that z is non-wondering if for every u neighborhood of z, there exist n larger than 1 such that gn of u intersect u again. OK? So this is the usual picture. OK, maybe you don't intersect, but after some time, you come back and intersect. OK, so the set of non-wondering point is denoted by omega of g. It is always closed. If you pick up some point z in z, then the set of omega limit points, so these are limit points of g and z as n tends to plus infinity. So this set is always contained in omega g. Therefore, if z is compact, omega g is not empty. But if z is not compact, it's not difficult to give an example where the non-wondering set is empty. Take, for example, a translation on a line. OK, and now let me come to the first theorem. So I will denote by omega h tilde as a set of non-wondering point of h. So I suppose it's empty. OK, so this is the proof of the first theorem. Now, if I look at the set of points of this map, in fact, because of this type of thing here, it's proper. So the inverse image of an interval is always compact. So I know that the set of, let's say, y tilde such that eta y tilde is between minus a and a is compact for every a finite. Therefore, if I start with an orbit of some point and I assume that the non-wondering set is empty, the limit points for h tilde and of z tilde. There are no limit points. So this implies that eta tilde of h tilde n of z tilde goes to plus infinity in absolute value. OK, it cannot be bounded along some infinite subsequence. OK, now what I have to do is to show how to remove the absolute value to go either to plus infinity or minus infinity. And this is a standard and easy argument. Let me remind you how it goes. The main point is that if you look at eta tilde of h tilde of z tilde minus eta tilde of z tilde, in fact, this is a function defined on x. Oh, sorry, x tilde here, I should say. It's not z, it's x. OK, on x. Because if you just try to compute eta tilde of h tilde of x tilde plus n minus eta tilde of x tilde, I forgot to say that I am assuming, of course, that h tilde commutes with translation. OK, for example, if it's homotopic to identity, there is other case where the action of h tilde is h tilde of x plus n is x tilde minus n. OK, it's a homomorphism, so it might be one or the other. OK, so if I just try to compute that, I get here h tilde of x tilde plus n to which I apply eta tilde. And therefore, I get here eta tilde h tilde x tilde plus n minus eta tilde x tilde plus n. So it's indeed a map on x. And therefore, it is bounded. It's a continuous map on x, and therefore it is bounded. So I can find, if I put soup of eta tilde of h tilde x tilde minus eta tilde of x tilde, it's equal to some m, which is finite. OK, soup over all x tilde here. Now, if I fix x tilde and assume that n is such that, for all little n bigger than large n, we have, well, eta tilde of h n tilde x is larger than 2m. OK, because it goes to infinity in absolute value, I can assume that from some n on. OK, and now if you look at, you try to look at the distance between this point and this one. OK, this is always less than m, because here you just replace the x tilde by h n of x tilde. OK, so if you look here for n large at 2 consecutive integers, the difference is at most m, and the distance to 0 is at least 2m. So this implies that eta tilde h n tilde plus 1 x tilde, and eta tilde h tilde n x tilde have all the same sign for n, little n larger than big n. OK, so you get the convergence. OK, now I want to prove the second theorem. So let me remind you what is the chain recurrence set. So let me get back to the dynamical system here. And for this, I also need a metric delta, metric defining topology of delta. So things depend on this metric now. And let me remind you that the chain is a sequence with at least two elements. I mean, if it's only a point, it's a point, it's not a chain. And we say that the chain like that is an epsilon g delta chain. So it depends on epsilon, g, and delta. If for every i equals 0 up to n minus 1, the distance of g of zi to zi plus 1 is less than epsilon. OK, and then you say, so you say also that the chain z0 zn is from z to z prime. If you start at z and you end at z prime, OK? So z is chain recurrent for g and also delta. Depends on the metric. I'll make some comment on that. If for every epsilon, there exists a chain starting at z and ending at z, which is epsilon g delta chain. So the set of chain recurrent point is denoted by delta. Now it depends on the metric delta. In fact, it only depends on the uniformity class of the metric delta. So if z is compact, it does not depend on delta. But if z is not compact, it does depend on delta. So in my setting here of x tilde and x, I'm going to use the chain recurrent for both the lift and the map on x. Therefore, I have to tell you what is the metric essentially on x tilde. But what I do is I put a Riemannian metric on x and take a distance on x associated Riemannian distance. And on x tilde, pull back Riemannian metric. And then take the distance associated to Riemannian distance associated to Riemannian metric, I should say.  So x tilde plus n, y tilde plus n, is equal to the distance of x tilde to y delta. It's invariant by translation on the cover. And also it has the following property if x, well, OK. The distance between two points in x, which are projection of two points in x tilde, is the infimum for n and z of the distance of x tilde to y tilde plus n. OK. And the infimum is at n. So these are going to be the metrics that I'm going to use in this situation, x tilde x. Now I have to give you a good way to understand the chain recurrence set. And for this, I'm going to tell you about the Pajot barrier. So this was introduced a few years ago by Pierre Pajot. So it has appeared in topology and its application. So let me get back to a general dynamical system and introduce the barrier. First, I defined an action between two points in the following way. P sub delta from z to z prime is the distance of g of z to z prime. OK. And for a chain, I propagate this to chain. There are several ways to propagate it. You could take the sum of the PD, but here we are going to take the maximum of PD of zi zi plus 1, i equals 0 to n minus 1. OK. And this is maximum i equals 0 to n minus 1 of the distance of g of zi to zi plus 1. OK. And if you have two points, you define the Pajot barrier between the two points in the following way. So the Pajot barrier, while it depends on delta, of course, and on g, but from z to z prime, is the infimum of the little p delta of chains for arbitrary chains starting at z and ending at z prime. OK. So it is not difficult to see that p delta of zi is 0, if and only if z is a chain recurrent point. OK. But this is kind of a very nice, quantitative way to understand the chain recurrent set. Let me tell you what are the properties of p delta. So first one is it's always non-negative. And it is less than the distance of g of z to z prime because you have always a chain from z to z prime, which is just two points. Note that this implies that p delta of z to g of z is always 0. So you can kind of think of this as some way to measure if you are along the same orbit or not. It's not exactly that because you have this infimum and all these things, but it's kind of that. OK. And the other properties, the second one is the ultrametric property. OK, this is because to go from z to z double prime, you get an infimum, including all chains, going from z to z prime and z prime to z double prime. And then you, let me just make sure I don't forget any property. No. And then when you give a definition like that, of course, it does not seem clear at all that it is continuous in z, z prime. But it is indeed the case because you have the following things. p delta of z prime of z z prime minus p delta of z z double prime is less than the distance of z to z prime. This is quite easy because if you have a chain that goes from z to z prime, you can deviate it into a chain to z double prime by just changing the last moment. And if you look at the difference between the p, little p delta of the chains, you see that it's bounded by this quantity. Delta of z prime, z double prime. Thank you. And here it's the same thing for the first one but with a little twist. No, I cannot make p delta of z z prime small because that would mean that I am very close to the chain recurrence set. Going from z to z prime with small chains is this big indication. Sometime I cannot. It cannot be 0. p of z z is not always 0. So you have to be careful about that.  And now I'm telling you it's continuous in the first variable. And here you have to take g because if you do the argument at the beginning, you see that's what you need to do. So note that it is continuous. It is uniformly continuous. If g is uniformly continuous. Now let me just say a few things now in the case of my covering. I will have two barriers, a barrier downstairs on x. OK, now the distance are fixed. I'm not going to mention. But so I have p of x, y on x and p tilde of x tilde y tilde on x tilde. So I have to compare these two barriers. It's not difficult to see that p of pi of x tilde of the projection, pi of y tilde, is less than p tilde of x tilde y tilde. But in fact, you can also get, because you can always lift the chain downstairs to a chain upstairs with the same p. You get that in fact p of pi x tilde pi y tilde is equal to the infimum over n in z of p tilde x tilde y tilde plus n. So this suggests to introduce kind of three functions. OK? So if I look at p of x, x is 0, and I pick some point x tilde over x, I can attain the infimum either at 0 or at n larger than 1 or n less than minus 1. So this suggests to introduce the three function. Rho tilde plus of x tilde is the infimum of p of tilde of x tilde x tilde plus n, n larger than 1. Rho tilde 0 of x tilde is just p tilde of x tilde x tilde. OK? And the last one is rho tilde minus x tilde is the infimum for n minus 1 of p tilde of x tilde x tilde plus n. OK? Now it is not difficult because of the property. In fact, I should have said here that p tilde of x tilde plus n, y tilde plus n is the same as p tilde of x tilde y tilde. It is not difficult to see that these functions are, in fact, functions which are defined on x. Because if you add the same k here, it doesn't change anything. OK? Moreover, because as I said, the barrier is continuous, is uniformly continuous if the homeomorphism is, h tilde as a lift of h is uniformly continuous. Therefore, the barrier is uniformly continuous, and this function r continues. And infimum is not necessarily continuous, but in that case, it is the case. And so I have these three functions, rho plus, rho 0, and rho minus, which are defined on x. And what happens is that the chain recurrence set is precisely rho 0 plus equals 0, union rho 0 equals 0, union rho minus equals 0, but rho 0 equals 0. It means that the point above, any point above, is in the chain recurrence set of h tilde. So in fact, this is the projection of r of h tilde. So I have written my chain recurrence set below as the three sets, one which is the projection of the chain recurrence set. They are all closed because the function are continuous. And here is where the z property comes in. You can prove that rho plus equals 0, intersected with rho minus equals 0, is included in rho 0 equals 0. OK? So if you make the hypothesis that rho h tilde is empty, you get a decomposition in two disjoint sets. And it's completely natural decomposition from the dynamics. So either you get the decomposition or one of them is empty. So in fact, if rho 0 equals 0 is empty, then you have conversions for every x tilde in x tilde. You can show that eta of h tilde n of x tilde goes to minus infinity. And if rho minus is empty, it's opposite. OK? So this gives you exactly the theorem I mentioned. I'll stop here.


Here at University Housing, we're excitedly preparing for your arrival this fall. We're putting many changes into place to make your on-campus living experience an exciting and safe time, allowing you to make friendships and memories that will last a lifetime. Your health and safety are at the forefront of every decision that we're making here at University Housing. We've reduced the overall density of our residence halls, providing more private rooms and limiting others to just double occupancy. We've reconfigured lobbies in common room areas to promote and encourage social distancing. Visual reminders of the importance of social distancing will be found throughout our halls. Our building services team members have been working diligently to clean and disinfect every area of our residence halls. Hightouch areas will be cleaned and disinfected multiple times daily. Keeping our living areas clean and safe will be a shared responsibility and we know that students will do their part well here. We've re-looked, re-imagined and re-engineered our move-in process by adding more time slots to our online move-in reservation system. We all play an important part in keeping the University of Arkansas healthy, like staying home when you're sick, washing our hands often, wearing face coverings, socially distancing from others, using hand sanitizer, and reporting to Pat Walker Health Center when you're not feeling well. We all want a healthy environment here in University Housing. And we all want your experience here to be the best. We hope you're as excited as we are. See you soon!


Actor Muda Dineshi He Has Passed Away Former Mubango actor Muda Dineshi He Has Passed Away, his family confirmed in a statement on Thursday evening. The actor, known for his role as Endolomo Mukwapo on the popular soapy, passed away on Thursday. No further details about his death are known at this time. It is with great sadness we announce the passing of Muda Dineshi He On July 1, 2020 He was our brother, uncle, father, mentor, role model, and actor. He will be sorely missed by his family and close friends, the statement read. The family asked for privacy to mourn. Neshi he captured the heart of Mzansi with his roles on Jacob's Cross, Egoli, Squizzes, and Generations, the legacy. He acted in several international projects including the ITV drama Wild At Heart. Just days before his passing, Neshi he took to Twitter to gush over his children, calling them the loves of his life. Neshi his death sent shockwaves across the industry and saw a flood of tributes on social media.


The Nigerian Communications Commission, NCC, has clarified that foreigners who are not staying in Nigeria for up to two years do not need a national identification number NIN to register their SIM cards. The regulatory body exempted foreigners transitioning through or residing in Nigeria for less than 24 months in its revised national identity policy for SIM card registration. The NTC said persons in this category need to prove that they will be residing in Nigeria for less than two years. However, NIN is compulsory for foreigners who have legal residency, who have lived in Nigeria for two years and above.


I'd like to thank everybody that's joining today. Welcome to today's CNTF webinar. And the title is Gain Confidence in Compliance, Advanced Image Scanning with Harbor, which is a CNTF project. I'm Alex Ellis. I'm the director of OpenFaz and I'm also a cloud native ambassador in the Cambridge area in the UK. I'll be moderating today's webinar and we'd just like to welcome our presenters. So warm welcome to Michael Michael, who's director of product management at VMware and a core maintainer of the Harbor project. Also like to, I'd also like to give a warm welcome to Liz Rice, VP of open source engineering at Aqua Security. And she's also the TOC chair for the CNTF. Hi. Hello for coming. Hello everyone. Thank you Alex for the welcome. So we've got a few housekeeping items. Before we get started. So during the webinar, you're not able to talk as an attendee. So it's a little bit different to a normal Zoom call. There is a Q&A box though and we'd like you to use that to drop in any questions that you have and we'll try and answer them as we see fit throughout the talk. Now this is an official CNTF webinar. So as such, we are abiding by the CNTF code of conduct. So we just ask you, please do not add anything in the chat questions that would be in violation of that code of conduct. Basically, it can be summed up like this. Please be respectful of all your fellow participants and presenters. And with that, I'll hand over to Michael and Liz to kick off the presentation. Absolutely. Thank you, Alex. And hello everybody and welcome to the Harbor webinar. I know that it's pretty late for some of you folks in European and Asia time zones. So thank you for attending. Today, Liz and I are gonna talk a little bit about security and compliance with Harbor as it reflects to the images that you guys are using in production for your cloud native applications. So let's get started here. So, you know, one of the most important things that I want everybody to be aware of is that there was a study that basically outlined that the top 10 most popular Docker images each contain at least any vulnerabilities. Think about that for a second. That number is astounding with the proliferation of Docker images and cloud native applications today. That means that you're producing as enterprises and as users more and more images every day. More, some of those applications are running in production. Some of them are running in public clouds. Some of them are running at the edge of your data centers. So it is super important to make sure that the applications that you're running there in production do not contain any vulnerabilities. And that's where Harbor, Agua and Ankor come into the rescue here with some of the work that we're gonna showcase today.  There's obviously a lot of registries out there. Most of the public cloud providers do provide their own. You could also use anything else like Docker engine, for example, but it's very important to think about what are the key capabilities you're looking for out of your own registry and why a tool like Harbor might really fit that purpose. So let's get started here. The first and most important reason why you might wanna run your own registry is security and compliance. You want a comprehensive policy that you can define, understand and be also be able to apply it across the board. You may have registry and data ownership issues. So you might wanna co-locate your data near your applications or even within your own data center. And most importantly, you wanna bring in the identity federation that you're already using within your organization so that you don't have to have a separate identity and a separate user store for your registry. So what are some of the features that come out of this umbrella? You could have things like vulnerability scanning that will assess your images for vulnerabilities and give you a report back saying if you're vulnerable, that's a varied of those vulnerabilities and if there are any possible remediations. You might want to see the exceptions. So there are certain situations where there might be a vulnerability and there's no fix for it yet. So what do you do? Do you halt your production images or do you identify different way to still be able to keep your applications in production until a remediation is available? You might want image signing, trust that an image is coming from the source that it's coming from. There's quotas and retention that allow you to prevent end users from running away and populating multiples of terabytes of storage in your registry. And then going down the path of identity federation and user store, having identity federation with tools like OIDC and LDAP and having role-based access control on the back end is what's going to enable your end users to not only bring their own identity within Harbor or any of your own registries, but also be able to use that with tools like doc client and the help client. And last but not least in the isolation and multi-tenancy space, you wanna be able to have multiple organizations within your company that have their own access to the registry and they're isolated from each other, either because of compliance reasons or because of data sovereignty or because they're simply different business units. At the infrastructure layer, you might wanna be able to deploy on an infrastructure whether that's private, public, hosted or the edge, the topic of data locality comes back again here.  On a scale and control perspective, you wanna be able to have not only control access to artifacts, this is where you get to authenticate and authorize who should have access to your cloud native artifacts that includes your Docker images and your home charts. You might wanna be able to replicate the resources based on your business needs whether that's replication to the edge, across data centers or even to the public cloud. And some of those capabilities that Harbor brings into the picture is, we allow you to replicate your artifacts to a multitude of other tools like another instance of Harbor, the Docker registry, Docker Hub, Huawei Cloud, AWS, Azure, GCP, Alibaba Cloud. So pretty much every popular public cloud out there, Harbor can integrate with and you can replicate the resources there. And last, it's all about automation extensibility. As enterprises and users, you have made a ton of investments in products and services within your own data center. You wanna register that we're coming and be able to be plug and play with those existing investments so that everything just works. So what are some of the key capabilities that come out of that? You want integration with logging. So you can push your logs to an Elk stack or Splunk for example, you want web hooks. So your CI CD pipelines can be well integrated with the registry so that as images are built, you can push them to the registry. You can make sure they get scanned for vulnerabilities and then maybe notify when they're ready to be pushed to production or possibly to a Kubernetes cluster. You wanna rest API. So everything can talk with each other in a unified manner. And last but not least is robot accounts. You wanna be able to have specialized accounts that are used for automation to basically be able to integrate your registry with these other tools. So what is Harbor? Harbor is a cloud native computing foundation incubating project. Today we have almost nine and a half thousand stars on GitHub. And in a nutshell, we're an open source container image registry that secures images with role-based access control. We scan images for vulnerabilities and then we sign images as trusted. So we deliver security and compliance to your organization. We have very high performance and scalability. We are interoperable with some of the other existing investments you have in your infrastructure and we provide you with a consistent image management for Kubernetes. From an architecture perspective, some of the things I mentioned earlier are really depicted here. On the right, we have all our replicated registry providers where Harbor allows you to replicate both in and out to all of the public cloud providers out there. We have multiple storage capabilities at the data access layer and the entire architecture of Harbor is componentized such that you were able to scale and meet the demands of our end users while at the same time, giving you the ability to work and interact with Harbor with the tools of your choice. So you can interact using our web portal or API. You can use the kubelet in a Kubernetes environment to be able to push, pull down your artifacts from Harbor. Also the Helm client works as well as the Docker and Rotary client. And today we're also going to concentrate a little bit about this green box right here on the right, which is the newly created scan providers that allow you to scan your images that are residing in Harbor using third-party pluggable scanners. So let's go back and review a little bit about the Harbor 1.9 release that came out a couple of weeks ago. Our key theme of the release was advancing multi-tenancy with key enterprise features. So what did we do there? We added image retention. So now you can go into a project and specify whether certain images should go away after nine months or after three months. So you get to define what your compliance policy is and allow Harbor to basically implement a policy in the form of retention. So that you also don't get filled up from a storage perspective. We also added project coders. So now you can define a quota across a single project that will take into account the sharing of resources between layers and different repositories and allow you to basically implement that quota so that your end user teams have a maximum storage capacity for Harbor. We also added the WebCook events for CI CD integration. So I mentioned that earlier as well. It's very important to have a tool like Harbor that can integrate very well with other existing investments and CI CD is one of the major investments in a cloud-native world. So being able to have WebCook events that can talk to CI CD system is super, super critical. And in 1.9, we extended on our replication investments that we had with Harbor 1.8, adding replication integration with AWS, Azure, GCP, and Alibaba Cloud. And the last major feature that we added in 1.9 is this concept of the CVE exception policies that I mentioned earlier. This allows you to have created an exception policy so that certain CVEs can be ignored for Harbor for a small period of time so that it gives you the ability to remediate them in the right way for your enterprise. Let's take a look at Harbor 1.10 that's currently in progress. Our goal is to actually ship 1.10 at or near QBCon US, our big cloud-native conference that's coming up in late November. Now our theme here is about security and compliance. And you'll notice that most of the features that we're creating here are around enabling capabilities around security and compliance. So the first one that we're creating is called immutable images and repositories. This gives the ability to our project administrator to define certain images and repositories as immutable. What that does is it allows you to tag, for example, Redis version 2.5 as immutable so that no other user can go and update that image. You can create a new version of Redis. You can go to 3.0, for example, or you can create a new tag. But the actual combination of repository and tag is immutable so that you as the operator can feel confident that the image that your CI CD pipeline created is also the same image that's signed and will be made available for download by your developers as they push the application to production. We're also adding OpenID Connect group support. So now you'll be able to define a group as a member of a Harbor project and all the identities that belong to the group inherit the same permissions in Harbor. So that makes it easier for you to manage your organization within Harbor. Also adding a new role in Harbor for a role-based access control called a limited guest. And this is a role that's super popular with end users that are using Harbor in a multi-tenant environment where each tenant can belong to a different organization and you sometimes don't want each tenant to know about each other. So think of a hoster that's basically deployed Harbor, has made Harbor available to their end users and they don't want Pepsi, the company, to know that Coca-Cola, the company, is also a member of the same group. So a limited guest role allows you to still be able to use Harbor as a guest but not be able to see any other guests that are part of the same project. We're also adding some more features around the CLI secret and robot accounts to give them a little bit more functionality. But now we're going to the diamond of this release and that's the implementation of what we call the interrogation service. Think of this as a service that allows an end user to interrogate all the images that are living in Harbor and assess their security posture. The first implementation of that is the pluggable out of three scanners and we're super excited that both Aqua, Encore, and HP all of them came in and are contributing in this effort to create our first scanners which is 3D by Aqua and Encore Enterprise, Encore Engine and Enterprise. So I'm going to turn it over to Liz here to talk a little bit about vulnerabilities and compliance. Great, thank you very much, Michael. Yeah, so these pluggable scanners are all about helping you find vulnerabilities in the container images that you're using or planning to use. So I thought it might be worth just diving a little bit into what we're talking about here with these vulnerabilities. Got a few logos here. These are the kind of rock stars of, sorry, can we go back one, thanks. These are the kind of rock stars of the vulnerability world. Things like Heartbleed, ShellShop, Dirty Cow, Meltdown, you've probably heard of them. They're critical vulnerabilities that an attacker can take advantage of. When we're talking about vulnerabilities, these are software flaws that attackers know how to exploit and they can use them to do something bad, unexpected inside your deployment. Now, these are the kind of super critical ones or a handful of super critical ones, so famous they get their own logos, but these are just the tip of the iceberg. Thousands of vulnerabilities get discovered every year. Some of them much, much less important, but nevertheless, you want to use a scanner to find out what is inside your images. All right, so if we go to the next slide. When we're talking about a container image, the code inside it kind of comes in three parts. There's the application code that you're writing yourselves, that your developers are writing bespoke code. Then there are potentially some dependencies that you're pulling in doing something like app get install as part of an image build. These dependencies are managed by package managers. The package manager depends on the distribution of the links distribution inside the image. And these dependencies can have vulnerabilities in them. And also there's the base image itself. So when you're running your Docker build, it starts from a base image, and that could already have some of these packages contained within it. So the image scanner is looking at dependencies wherever they've come from the base image or in dependencies that have been added through a package manager. What these won't find is vulnerabilities that you might write to bad coding practices in your own applications. Scanners know about publicly, what published vulnerabilities that exist in third-party dependencies. Well, mostly talking about packages, operating system packages, I will mention application language packages shortly as well. All right, so not all scanners will give you the same result. If you run two different scanners on the same container image, there's a very high chance you'll see some differences. They almost certainly all will start with what's called the NVD, the National Vulnerability Database. And this is a central database showing which versions of which system packages have which vulnerabilities. So that's a kind of baseline that I think all scanners will use as one data source. But in addition, you really need to be looking at the security advisory information from the particular distribution of Linux that your image uses. Because that will tell you whether or not the distribution has patched that particular package for that vulnerability. So a version that looks as though it should, it may be vulnerable according to the NVD, it's actually been patched by the distribution. It's not actually vulnerable. And if the scanner doesn't know to look at that advisory, it would give you a false positive. Additionally, there's some other sources like vendors, Nginx and MongoDB, for example, publish their own security advisory information. And the more of these sources you pull in, the more accurate your data. Plus some scanners will have feeds from, direct from security researchers adding additional accuracy into their feeds. So basically the more of these sources that a scanner is using and the more up-to-date the data is that it's pulling from those sources, then the more likely it is that the scanner is accurate and that it will reduce the number of false positives which is a real problem for scanners. In addition, some scanners will have different functionality available like for example, supporting, looking for vulnerabilities in language packages. Things like Node or Java or Python or Ruby or published security advisories but not all scanners are able to give you the results from that. Some scanners will look for things like sensitive data inside your container images. They may also look for things like malware. Some scanners will also support Windows containers as well as Linux containers. So the range of functionality that you get from different scanners it is different and there are differences in accuracy. You have options in terms of open source scanners like Trivi, like Ankor. There are free scanners out there. There are commercial scanners out there and you may as an enterprise want to look at a commercial scanner if you're interested in some of this additional functionality. Sometimes additional sources are only available commercially as these additional data sources and of course you might want to be paying for support. So there are differences in the scanners that are available. You probably have choices that you're making on your projects about which scanner you want to use and what we've been doing by working with the Harbor team is making it so that you can plug the scanner of your choice into the Harbor registry. So the way this works is to have a scanner adapter for each different type of scanner. Harbor today supports scanning with the Clare vulnerability scanner and we're adding in support for both Ankor and AQUA's commercial and open source scanner options. And then that scanner API that we've added is available for other scanners to write an adapter. So this is a generic interface that any scanner can plug into Harbor. As you can see from the diagram, the Harbor API can initiate a scan. It can use the configuration to pick or to establish which scanner it should be using based on the project because you can configure a different scanner for different projects. It launches asynchronous jobs which will then communicate over the scanner API with the appropriate adapter which will kick off the scan and retrieve the scan results later. Those scan results we've defined a standard Harbor format for if you like so that scan results can be compared and displayed in the Harbor UI. There's a question about that Liz. I don't know if you can take it. Daniel Mendes has said, will app scanning from Trivi still work in Harbor in terms of reporting? And what he's specifically asking about is scanning MPM modules, particularly in a distro less container that doesn't have a package manager? Yes, is the answer to that. I think there's no reason why those results shouldn't also be displayed. Haven't absolutely, I can't say I've tested it but I'm pretty confident that is gonna work. There was one for Michael while we were just at this pause and we had a question about is notary used for signing images? Yes, we're using notary for signing images and actually one of the things that we're working on is figure out how to actually sign these images so that they can also be replicated while maintaining their signing signature. So we're working with the bigger community in the OCI team to make that capability a reality. And with that, is there a way that you can have a sliding retention window for the policies you were talking about? For example, James Weaver would like to know could you retain the last three images? Yes, absolutely. Great, thank you, I'll give it back over to you guys. All right, so I think the last thing to add about this is really that we've defined this generic scanner API. So if we move on to the next slide you'll see how very simple it is. It's an asynchronous API where we can request metadata from a scanner which allows Harvard to find out what capabilities the scanner has. That kind of leads into some of the future roadmap that I think Michael will be talking about shortly. You can make a request for a scan with this post scan to say which artifact, which container image you want to start scanning. And then you use a GET request to retrieve the report from the scanner adapter. And then that scanner adapter will be making either API calls or executable calls depending on the particular scanner to execute that scan and return the results to Harvard in this standardized format. So I think this is now demo time, Michael. Absolutely, Alex, is there any more questions that you might be able to answer now before we actually get into the demo? Yeah, I do think there are a few questions that we've got. So a couple of people have asked how frequently are the vulnerability definitions updated? So that's one of them that we've got from a couple of people. So that will depend on the scanner and the way that it retrieves its information and also to some extent on how the adapter interacts with the scanner. So for example, for Trivi, Trivi updates all its data sources every 24 hours. And at the moment, every time, it's quite clever. I'm just gonna go off on a little diversion here in Trivi because I think this is interesting. Trivi stores its vulnerability data in Git repositories. So after the initial download of data, which happens through an init container in the adapter, so that downloads the data as soon as you configure the Trivi scanner. But after that, every time you run Trivi, it does a check with Git, just does a Git pull to update the latest set of results. I'm sure other vulnerability scanners will work on different schedules. That's kind of one of the things to look at. Interestingly, some of the data sources themselves are updated on different frequencies. So for example, Red Hat have two different sources of security advisory information, one of which includes information about unfixed vulnerabilities, in other words, vulnerabilities for which no fix is yet available. And that is updated more, or a vulnerability will get into that data source. It seems several days before it then results in the kind of official data source called Oval, which includes only the information about the fixed or won't fix vulnerabilities. So I've gone on to a little rant there, but my aside was really to say it's not just about how frequently the scanner updates its data, it's also about how up to date the data is that it's pulling from. That's great to know. I guess the last question maybe we can take before we get the demo is, Piotr is interested in CVS S3.0, is there support for that? I believe it is 3.0. If I don't quote me 100% certainty on that, but I think it is 3.0. Okay, great. Thank you. And by the way, all of the scanners that we have are configurable, both the batteries included, which is clear, as well as trivia and alcohol can be configured in terms of how often you wanna refresh that database that they have internally for basically tracking vulnerabilities. Excellent. So let's take a look at the demo here. Let's show you guys some items, but feel free to ask questions and so go along. And Alex, let me know if there's something that the folks wanna see. So the first thing I'm gonna show you guys is this concept of compliance and security policy that Harbor has and how that can be defined within Harbor and applied across the board for your container image registry. So the first item here that I have that I wanna show you guys is the concept of the CV white list. This is where we allow an enterprise and a user to come in and define certain CVs that can be ignored either for a period of time or indefinitely because either vulnerability doesn't exist, sorry, vulnerability solution doesn't exist, or you wanna wait a small period of time to test it before you apply. So you as the project administrator, you get to define the level of risk that you're comfortable for the CVs and the images that your organization is publishing for your cloud native applications. And Harbor allows you to just do that. So I can come in very easily and define this globally at the Harbor configuration or I can define this at the project level. And as I mentioned earlier, you get to set the expiration as well. The next thing that I wanna show you guys is the vulnerability database here. It indicates when the database was last updated and this is for Claire, which is the built-in vulnerability scanning that comes with Harbor. And you also get to define a schedule. So if you want all your images to be scanned hourly, daily, weekly, you get to define how you want your compliance policy to be set and Harbor will execute it. Now, if you go to an individual project within Harbor under the configuration of the project, you get to define how you want this project to behave from a compliance standpoint. So the first thing is you get to define whether you want content trust to be applied. So that means only verified images can be pulled down. So if an image is not signed, no user will be able to pull that and run it in production. You can also define whether you want vulnerable images to run. So you define, again, your level of risk and your level of comfort. So for me, I could say that if any image has medium or higher severity vulnerability, don't allow it to ever be deployed. In addition to that schedule, that Harbor can dictate around scanning your images. You can also scan images on demand, which you'll do in a second, but you can also set it so that images can be scanned automatically every time So every time there's a new image that comes into Harbor from your CI CD pipeline, it can be immediately scanned for vulnerabilities and the policies above can be set immediately. And again, the last item here is the CV white list that you mentioned earlier. So I can either choose to accept the system white list. I can create a project white list which can start from the system one. I can even add my own CV. So I have a CV here that I opened and I can copy that and enter these details here. And now I instructed Harbor to ignore these two CVs from the system. And obviously I can choose an expiration time as well. And this gives me enough time, enough comfort to go and figure out the right way to remediate these vulnerabilities, test my images before I push them out to production. So let's go now and show you some of the new stuff that we started creating. Under the configuration tab of the main project settings of Harbor, there's a new page called scanners. And here you can define and add your own scanner. And like Liz mentioned earlier, this is an open specification. Anyone, any company that has their own scanner and they would like to extend Harbor's capabilities by adding their pluggable scanner into Harbor, they can implement our API interface, we'll work with them, and then you'll be able to add the scanner to your Harbor instance. Now we have Claire, which is the default that the battery is included with Harbor, but we also have introduced 3V and Encore here as our pluggable scanner. So if I actually extend this here, I see that 3V is developed by Aqua Security. I see the endpoint URL for 3V. And I also see the mining types that 3V can consume and produce. This is the contract between Harbor and the pluggable scanner that Liz mentioned earlier, that kind of identifies how do we talk to that scanner? We give it an OCI image manifest that describes the container images that they need to scan. And then we get back this vulnerability report that basically tells you what CV is that scanner found for your images and their severities and other details that are very specific to the scanning results. And similarly, the Encore adapter also has the same kind of contract and the same kind of capabilities that 3V has as well. So you get to see the version, the distributor, the mine types and the URI where Encore is deployed. And both of them, all three scanners in this case are in a healthy stage. So I'm gonna tell you about something cool that I set up here. So a lot of you have images out there in public clouds. Maybe they're in any of the big public cloud providers. Maybe they're in Docker Hub. And maybe you want to have Harbor bring those images into Harbor and be able to apply these strict compliance and policy that we talked about in terms of scanning and remediation and policy. And then your developers can actually start utilizing those images to run them in production. So having that extra set of control and having Harbor kind of bring these images into Harbor, apply your compliance needs is super important. So what I did is I went ahead and set up some replications. So I have a Docker Hub account and I went ahead and pulled down images from my Docker Hub and put them into different projects that I have set up for Clare, Encore and 3V. So now I get to pull the images on a periodic schedule or manually and then have Harbor do its thing by basically going ahead and scanning these images for vulnerabilities. Let's go ahead now and see what our projects look like. So I have my HR business department here and the same images are scanned by Encore, Clare and 3V just to show you the differences. So like Liz mentioned, no other scanners are created equal. Some scanners pay specific attention to different areas. So this up to you and your own business needs and your compliance needs to identify the right scanner based on the workloads that you have and you can apply that scanner on a per project basis. Actually in the future, we will enable you to run multiple scanners in the same project. So you can get consolidated results from multiple entry paths. So let's take a look at the HR business team for Encore. If I take a look at that and look at this new scanner tab that we have here, you'll notice that the default scanner here is Encore. It is in a healthy state. We have some of the same details that I showed you earlier in the scanner API. So when we go back to our repository, I can go into any of these images that have created in this organizational unit. And I can see here all the different vulnerabilities that have been discovered by Encore in this case. So I can click on the actual tag and I can both see graphical view of my images. And when I see this, I'm saying, oh my God, this image is super, super vulnerable. Look at how many CVEs exist for my application. So I can scan it again on demand. So I can extract the Encore engine in this case to go ahead and re-scan my image just in case something has changed. Obviously nothing has changed here, so I'm getting back the same results. So I wanna show you guys now some of the differences. So if we look at Encore, we have 74 highs and two eight mediums. So I go to the next scanner in this case, it's Claire and click on the same project. Notice that the numbers are different. This is not anything else, but to show you that different scanners have different priorities and they scan different for different things. And similarly, if we go to 3D and we go again to the same image, you'll notice here that this specific scanner has also a different set of CVEs being reported. If we allow you eventually to run the combination of all the scanners, you're gonna get this comprehensive view of your scanning results. Now, one of the things that Lisa mentioned earlier was this way that you build your images with dependencies and packages. So if you actually go to the build history here of Harbor, you'll notice here that we give you a rundown of what happened in the Docker commands in the Docker file that basically built your image. So you can see that actually someone tried to do upget update or yum install and update everything that they have in their image. And when did that happen? So look at the dates here. The dates are important because it tells you how the history of both the creation of these packages, but also how many vulnerabilities could have existed since then. And similarly, when I do get the result back from all of my vulnerabilities, I can expand on any one of them and I get some additional details in terms of the high level description of the vulnerability. And I can even click on the CDE here and it will take me to the actual spot where the CDE exists. Now let's talk about one final thing here in our demo. In many situations, you have Kubernetes clusters or Docker compute instances running at the edge but in various smaller parts of your data center. And in some of those situations, you may not have the compute bandwidth to go and implement a solution that includes full-blown scanning either because you don't have the computer, the memory, or the storage resources. So what can Harbor do for you? You can set up a central project within Harbor that will scan all of your images for vulnerabilities and you can use any of our three plug-able scanners that you have available for use in Harbor.  So now you can have a cache of your images available locally to where your compute applications are running and you don't have to scan them there because you trust the Harbor scan them up in your main data center. So now if links go down because links always go down, you don't always have 100% internet of the edge, your applications are not impacted because you have a cache of your images locally in the Harbor instance. So that's a good way to implement your security policy and have Harbor basically establish its compliance. So Michael, we have a question about how this all sort of fits into the bigger picture. So somebody's asking, what if you had different environments and you wanted to promote the images through from death where you're okay with the vulnerabilities to staging where it gets a bit tighter and then in production you want zero highs, let's say. Can you do that? Yes, absolutely. And that's actually one of the major reasons why if you look at the projects, each configuration of the policy is on a project basis. So you could have a project for your death test, a project for your sandbox and a project for your production. And each of them could have a different level of risk and a different threshold for the vulnerabilities. So you could set up your death test as low and your sandbox as medium and your production, sorry, the reverse. So you can set up your production to be lower above. So anything, any vulnerability of any severity never to be deployed in production. And then you can set up your death test to be on highs, which means only high vulnerabilities are prevented. Okay, that's really helpful. We have about 15 minutes left just for the speakers. There's another question that's similar to this is how could you actually integrate Harbor into your CI CD pipeline and what kind of feedback could you expect in something like Jenkins, for example? Yeah, absolutely. So Harbor can be integrated very well in the CI CD pipeline as the target repository for your images. So as you build your images, you start from source code and you build some container images, Harbor can become the target and the repository where you store them. And then you can use some of the key capabilities of Harbor to both not only tag your images, but define them as immutable or basically define the policy based on your project and your organizational needs. And then on the backend, Harbor has this concept of web hooks that you mentioned earlier that allows you to get callbacks when certain actions happen in Harbor. So for example, when you get a new scan and you get some new vulnerabilities, you can get back a web hook or what I think a new web hook now when your storage code is exceeded, you're gonna get back a web hook that's gonna tell you, hey, you run out of storage. That's why you'll push to the Harbor repository is failing. So now you can integrate your CI CD pipeline with some of these web hooks which can drive additional actions. One action example that I can think of is let's say you started from source code, you build an image, your CI CD pipeline pushed that image into Harbor. Once Harbor has verified its security posture, we can send back a web hook and letting you know that your image is free and clear, it's clean, go ahead and deploy it into production. And your CI CD pipeline can execute the last step which is push that image to Kubernetes. Okay, so if you had a joint job that it built it and deployed it all in one job, is there some kind of text feedback you get when you try to push the image or does the image push and then it gets scanned? So you have to query Harbor to know. Yeah, you didn't have to query Harbor to know or listen for the web hook to identify what the scanning results were in that case if you have like a singular job. But what actually adding, this actually brings up a cool topic. In the future, one of the things that we wanna do is we wanna integrate some Sonobuy so that we can actually establish and assess the images that you're running in production if they have vulnerabilities. So an image that you pushed yesterday, today my new CV might come up and but you don't know about it because your image is already running in production. So we wanna basically integrate with additional tools to be able to assess the security posture of your running images. And that's actually where additional tools like Aqua and Ankor come in that can actually help you that. So Liz do you wanna talk a little bit about how Aqua can help you maintain your security posture for your images running in production on Kubernetes? Yeah, exactly. And it is a very good point that you could have many hundreds or thousands of container instances that you discover have a vulnerability because a new vulnerability has been disclosed and the scanner tells you which images. So with a tool like Aqua, we can very easily identify for you the running instances of a container that are affected by a particular vulnerability so that you can then take action. You would typically want to rebuild the image with the fixed version of whatever the package is that's been affected and then deploy new versions but tools like Aqua and I'm sure other security tools as well that can help you identify whether you have running containers that were instantiated from vulnerable images. One thing you want to avoid doing because I have seen well, at least one company that was trying an approach where they were saying we're going to vulnerability scan inside your running containers which is a pretty inefficient way of going about it. You only have one image you may have many, many, many instances of that image. Absolutely. Thank you, Liz. If there's no more questions, we can go back to the deck and we'll probably have a couple of minutes at the end for additional questions. All right, going back to the deck. So you've seen the demo now, you've told you that you're going to have a lot of images that in your production, pre-production you're producing more and more images as enterprises and they're going to have a lot of vulnerabilities. So come and use hardware because we can help you in addition with our plug-able scanners to assess your security posture. But the journey doesn't end there. We have a very long roadmap with hardware in terms of the investment ideas that we want to make and some of the key capabilities that we want to bring to our users to you guys. So from a management perspective, we want to build a Kubernetes operator that allows you to create an HA installation of hardware on top of Kubernetes that includes everything called our dependent components, a very scalable hardware instance. I mentioned earlier that we want to do some sign-in policy replication because signed images today cannot be replicated because the signature of the signed image is tied to the instance of the registry that you're deploying them from. We want to add additional investments into metadata management so it can make it easier for you to manage your hardware registry. Obviously, preference scale is something to do continuously improving and we have a few of our customers of hardware that are having thousands and thousands of images in production today consuming terabytes of storage. And observability, everybody's new cool password. We want to continue improving on the metrics and health APIs that hardware provides for you so that you can integrate hardware well with other tools and products in your cloud-native environment. On the topic of image distribution, I talked earlier about how we want to make it easy for you to push images down to the edge so that you can scan them once and then have a cache locally available for your workloads to use. We want to add two new investments there around proxy cache and peer-to-peer distribution so that images can land where you need them faster and with less network resources being used. On the extensibility part, this is a huge initiative of us. We're going to continue enhancing our webhook support or continue enhancing the interrogation service. You're going to see more scanners in addition to Aqua and Anchor come into Harbor, giving you choice and freedom to pick the scanner that meets your needs. And lastly, we're going to be very engaged and we already started with the OCI, the Open Container Initiative around artifact management and conformance. So that Harbor will be able to store more than container images and home charts. We're going to start thinking about how we support Sina bundles, OPAs, operators, everything that you need in terms of artifacts for your cloud-native needs, we're going to figure out a way to support you. If you want to get in contact with our community, I want to tell you one thing, we're thriving. We have 9,500 GitHub stars today, over 200 contributors, 30,000 plus downloads of Harbor and almost 3,000 folks. And if you notice here on the bottom left, the top chart is the contributing developers and the bottom one is the contributing companies. The red line is when we donated Harbor to the CNCF. Ever since then, we have experienced this explosive growth both from a contribution perspective of companies and developers who have 20 plus product implementations, a ton of contributing organizations, including our newly added partners in Angkor and Aqua, and we have 300 plus community members that are engaged with the Harbor community. If you want to reach us and collaborate with us, here's the different ways that you can do that. We're on CNCF lists, we're on Slack. We have a Twitter account and we have regularly scheduled Zoom meetings that are both friendly for Asia and EU as well as for the United States. And we have a demo instance of Harbor, always available and running. It's demo.coharvard.io. Feel free to go and check it out and take it for a spin. Thank you, Michael. Liz, did you have anything else to finish with? I think Michael has covered it all very well and I'll just say we've been very pleased and excited to be able to contribute this whole pluggable scanner's item into Harbor. So I think it's an advantage for both the open source community and end users and vendors to be able to collaborate in this kind of way. Yeah, a huge shout out to the Angkor team, the HP team and the Aqua team for kind of helping us bring that vision to reality and doing a lot of the heavy lifting and enabling that capability. So you guys have been great. And we will have a huge presence at Cubicon. So we will have a lunch and learn with Joe Beta. So feel free to sign up and get some lunch and get the real hands-on experience on Harbor. Great, so thank you to both for a very awesome presentation. We have had questions throughout the talk. I know not everybody has had as a complete answer as they'd like. I would encourage you, I don't know, Michael, if you can go back to the previous slide with the Slack. This would be a great place for people to go and ask really technical questions. One of the things though was, can you just compare it very quickly to Quay from Red Hat? So that comparison would not be quick. Obviously Quay is a great product in this ecosystem as well. There's positives, pluses and minuses across both products. Feel free to come and find us on the CMTF Slack channel and we can kind of give you, based on your needs, some of the pros and cons of each of the different tools. And in a lot of ways, we're very similar to Quay. So if you tell us what you're looking for in terms of the needs of your enterprise, we can kind of give you a more fair comparison of the different tools. Yeah, Daniel had a question relating to that as well. And he was saying that are there ever signing flows that will be supported in the future other than Notary? Because it seems like OpenShift may not support Notary currently. Yeah, so that's exactly what I was mentioning earlier, that we're working on the OCI team to figure out what the signing solution is to be moving forward. On the Notary topic, there was a PR out there that kind of got the community a little bit buzzed about, should notary be archived. That's not going to happen. Notary is not going anywhere. It's heavily used. It's maintained. And we're going to work to figure out how to best utilize Notary in this new world of replicating assets to different areas. I think that's a really good answer to that question. The only other thing that I think you may have answered is, I mean, if you have one harbor instance, is there secure and authenticated registry for each tenant, or is there still an element of that being shared? So we can only authenticate with a single identity federation provider. So for example, if you're using LDAP, we can only authenticate with LDAP. But if you want to have a multi-tenant environment where each tenant brings their own identity specifically, you basically can create your own IDP and then have that federated for different identity providers. So you're basically creating a double hop in your identity federation. Tools like, for example, Auth0 enable that very easy. Fantastic, great. Well, if anybody wants to know anything more, this is a great slide. It's got all of the stuff you need to know. Thank you to the presenters and everybody that came today. Thank you, Alice, for moderating. This has been awesome. Thank you, Alex. You're welcome. Thanks everyone for taking the time with us, Jay. Have a good day. Bye-bye.