Welcome everyone, nice to see you in person and online people, nice to not see you too. I'm Justin Cormack, I'm a CTO at Docker and I've been involved in Naturey Project for many years through its different iterations as the original version and then the now V2. Naturey originally was a project that started at Docker but is now a big community effort across all sorts of companies. And this is Steve. So I'm Steve Lasker, I work in Azure and a couple years ago we thought we was important to revive the signing efforts in containers because it was a pretty important effort and this was about two and a half, three, well it was pre-COVID, so it was about three years ago. And we basically got together a bunch of the people across the various clouds and providers and we were like, we need to actually solve the signing problems with the core issues of promotion workflows and things we'll talk about today. So with that, we can jump in. Yeah, so we're gonna talk about a little bit about the goals in Azure V2. We're gonna talk about some of the workflows that people wanted us to support and want us to support. Gonna talk about the kind of supply chain artifacts that people are interested in storing in registries. We're gonna deal with the kind of question of who do you trust and why for signatures and we're gonna go through some of the open issues that are still being resolved and then what the state of the project really is. The goals in Azure V2 have been really to build upon existing fundamentals. We're not trying to radically make things different. We're trying to build things that people understand and know how to use and use existing specs as much as possible but put them together in ways that are really useful for the container ecosystem. So we've been doing lots of work around X509 because a lot of people ask for support for that. We've been a very, I'd say, very customer-driven project. As businesses, we've all been talking to our customers about what they would like in signing and that's really driven the kind of way we've looked at trying to solve the problem. We're looking to really invest in and extend existing services in particular registries. Registries are really important and everyone has them integrated in their workflow and they understand the security properties and things like that so it's very important that we just build on that infrastructure rather than try and replace it so we're just trying to add things in an additive, migratable way and we've been really working on kind of working out what best practice actually looks like. Obviously, all these things are kind of new and you have to make best practice up as you go to some extent and iterate on it but it's very important we feel that and it was one of the problems with kind of Azure V1 that the signatures and the other supply chain artifacts were not really stored with the images. They were stored kind of in a separate sidecar service and that's been a kind of driving point the whole through the V2 is like this integrate supply chain metadata into the image. It's really all about getting integrity from build all the way through to production making it the same image and you understand what's going on happening and people have a lot of workflows where they take say public images like official images moving to private registries or have different dev and staging registries and all those kind of things where people are moving images around that's been really important support again that was one of the problems with Azure V1 was that signatures didn't move with the images and these kind of workflows where you want your images to be in different places for different functions for different production systems so if it become really important we'll talk a bit more about that in a bit as well. So if we think about like signing what exactly does it promise? Sometimes we hear this term well it has to be signed and as long as content is signed I'm fine. Well is that really true? So who is it signed by? Who do you trust of all those things that are signed and who don't you trust and who do you trust and not trust for a particular environment? What you might want in staging is different than production or development or different production environments. Financial services has very different requirements than say gaming so there's very different profiles that you have to think about. So in the concept of who do you trust? If I navigate to evil.com it's a real site it's got random stuff on there but the evil.com is not signed. There is no HTTPS certificate on it and the idea here is that we wanted to be able to make a comparison to how we think about the browser model because there are a lot of analogies here. And the browser model's been very successful. We've got encryption everywhere in a short period of time so it's kind of interesting to look at how this compares to containers and what the differences and similarities are. So in this case there's no cert the browser tells you there's no cert you can kind of navigate through and you can find more information so you kind of make a very easy decision. There's no certificate there's no identity to who this evil.com people are so no cert, no trust, kind of logical. But let's look at some other ones. So my kids are now out of college but my daughter was doing high school research or I don't know if it was high school at the time pre-browser pop-ups. So the only thing on the internet at the time was .com so she went off and did whitehouse.com and was kind of a little surprised about what she found. Next thing I heard in the house was dad, dad, please make it stop, make it stop because pop-ups kept on popping up and every time she closed one another one popped up and it wasn't something that my kids should be seeing. So it turns out that that site is signed it's got a certificate. If you drilled through you'd be able to see it's got a full certificate chain internet security research group like SoundsLegitimate totally is, go through and there's lots of properties on the certificate chain that says like this is a legitimate site. If I go to whitehouse.gov, the real one for what at least my daughter was trying to find and where I was more comfortable with her looking it's also got a certificate and the certificate actually is the same root chain. There isn't any real discernible difference between the two. They're both completely signed. So it's like which one am I supposed to trust there? If I go to microsoft.com there's a search chain there as a company there's some extra information that's popped up that I can do more research on if I so choose. But if I look at the search chain there's a certificate there. It roots up it happens to root up to a different root chain but that doesn't really matter much because there are a lot of software companies and other companies that have a lot of business that they count on right? What is the internet based on? There's various sites out there that it's very important for them to encrypt and have good security models on there. So it's very difficult to discern any of these from any level of difference. So we have different levels of trust and different kind of rules about who you trust. It's not quite the same as the browser model because you're not just trying to authenticate that you just get encryption you're actually trying to make decisions about policies about things like what you put in production. So it's what you put in production on your developer laptop might be very different from what you put in production on a banking site that's serving your end customers. So we need to actually think about how to have rules that let you configure different kind of policies for these different kinds of use case. And they're similar in the same way also, right? Like what I might want to allow is sites that I can browse and do research on are probably different than the filtered sites that I allow my kid to look at. Dev production, very similar things, right? Then browsers have ways to set up safe limits and you can opt in sites that you allow or not and your company can provide group policy on things. It's very much a policy based configuration. We also have different kind of routes and kinds of trust and we know that we really want to make this very configurable for the end user to make a choice. So you might trust Microsoft to sign Excel and Word and nothing else because that's the software you get from Microsoft and you trust the upstream. You might want everything else to come from your own organization certificate. So perhaps you want to have a spiffy setup with ephemeral signatures for your build going back to your route and that's fine. You might want to use Tough which has a trust group per application and it's built through on the application. You might want to use some different mixture of these for different kinds of application. And then another thing we're seeing a lot now is you might want trust, not just based on signatures but on more detailed metadata. You might want to trust things that you've inspected the bit of materials on it and you've made certain choices about what's in the image and whether you're prepared to run an image based on the contents or other kinds of attestation about how it was built, where it was built, who it was built by and we're seeing a lot more of that. So we really want to provide a very flexible, configurable model where you can make these decisions and perhaps change them over time.  That same software company might produce images or project, project or company might produce images that you do want to use in production as well. So the same signing authority in that case won't let you differentiate dev to production. There might be some other claims or metadata that you want to make sure is available as well. That claims a metadata, you want to make sure it's signed because this guy Justin over here might make some claim about something. Doesn't mean that you actually trust his decision.  So this one's kind of interesting. So this is where we think about, and this is how I think in some ways in Notary V1 the environment wasn't mature enough. This was several years ago at this point. And in Notary V2 we've learned. If we look at what workflows customers are trying to do is they're trying to bring the content into an environment they trust. So in this case, we basically have these two companies, there's this small software vendor called Wabbit Networks and they produce this net monitor image. Intentionally a small company you haven't necessarily heard of unless you watch Bugs Bunny.  So in this case, they're trying to pull some public image and they can deploy it on their node. Maybe they should want to check the signature first to see if it's really from a company they trust before they deploy it. So in that case it was a little reversed. But what we also see is the customers that are trying to do this have security expectations. And this was the interesting thing is, been at Microsoft a while, I've been working on enterprise customers for a long time is the containers are just the latest tech. They have a set of security bars that they want where things are signed, things are in vNets, especially in clouds, right? When you're on prem, you're on vNets. When you're in the cloud, they want to simulate those environments. If I've got a vNet around my production environment or even my dev environment, how do I go and get all this new information like S-bombs or claims or scan results if those are outside of that environment, right? They're blocked. That's the vNet barrier there. Yeah, we're seeing much more of a trend that people really want to control what comes into their production environments. They want to gate everything first. They don't want to pull in uncontrolled ways. They want to basically pull and gate, which is partly why we need the signatures attached and all the metadata attached to the artifact so that you can bring it all into the environment, vet it sort of at entry points and then basically use it safely from then on. Yeah, I mean, it's great to pull, like having the internet as the source of content, awesome. Do you really want to pull something from the internet directly into your production environment, right? Like, who's got a refrigerator at home or in their hotel? We keep things close. When you want something to eat or drink, you want to make sure it's there. You go and replenish it, but there's nothing much difference between the technology and what we do in many other real-world scenarios. So everybody's got a fridge in their environment where they're storing their images and all their artifacts. And for each one of those environments, they probably have another registry. So they have a registry, whether it's one shared or different. And then that content that's coming from various sources, they're not, they could pull it into each environment, but what we've also seen is many of these customers are setting up what they call golden images or other registries where they're keeping that content they depend on. And then all of those different teams and those different environments are promoting that within their workflow. So, and there's multiple companies, right? This is not, people aren't using just one project or one company, there's multiple out there. And they want to be able to look to some third parties necessarily to, hey, is there some clearinghouse for some of this? So this is where Docker Hub can come in really well and they've had this historic model for there's a certain set of content you can get from Docker Hub that they've put effort into to make sure it can be trusted content. And then there is the open space for all kinds of other things that you can discover as well, but there's a differentiation there. So in this case, the small company Web at Networks can publish their stuff to Docker Hub. Notice there's a single signature there because it comes from them. And notice it's not just the container image, but it's the signatures, it's the claims, it's the scan results, it's other metadata that they want to make available. There's a subset of that content on Docker Hub that they will say is trusted content. They've done some extra effort, whether they built it or scanned it or done some policy on it and said, look, we've taken some special look at this and this content is different and therefore it gets a Docker Hub signature. There's other content that isn't certified by them or trusted, right? It could just be out there for discoverability purposes. The whole idea here is that Acre Rockets can consume content from multiple registries. We see lots of public registries popping up all the time. How can a company configure what that policy is? So in this case, what we've set up is there's a trust policy that says they actually don't trust Web at Networks because they don't know who they are, but they trust Docker Hub. And they trust a couple other vendors as well. So this is a way that they can choose what content they will allow in to their environment. And then as they scan that, provide the policies they want for their company, they could sign it with their own signature. Now they can say everything in my environment must be signed with Acre Rockets, let's say. You can basically configure policies like per environment in different ways. So you can say which keys you trust and we're integrating with admission control and all types of things that are gatekeeper and other policy managers. So you can basically configure those policies which are in the demo. Yeah, again, the ideas we're leaning into what's available today. So the signatures are associated with, we've basically got a model here where we have kind of separated signatures so that you can assign, you can reference the artifact that they sign. We make sure that you can have multiple signatures on objects in case you want that kind of workflow. Signatures move around with the artifact, you can, we sign, basically, we don't require you to pull the entire object to check the signature, we could just check the hash or the manifest hash. And you can have a whole different sets of artifacts attached to S-bombs and scan results and any claims, annotations, anything else you want. I mean, the model we did with signatures to be able to support to attach the workflows is we wanna be able to put things in a registry that a registry doesn't even know it's a signature, it doesn't care. So we can associate anything because if you look at your deployment scripts, they probably say like net monitor colon V1 or net monitor even with a digest. How do you find out the S-bomb for that thing? How do you find out the scan or the signature? You actually, your deployment files have a named reference so we wanted to build on that capability. So why don't we just jump into some demos now? And let's see here. All right, so every good demo starts with a Docker build. So we'll just come over here and I'm just building an image from in this case a Git repo, right? So nothing special, just kind of the standard baseline there. And then we'll do a standard Docker push, right? Nothing magic. The point here is that I'm building and pushing to a private registry.  So I wanna start with just a very simple sign and verify. Now, I'll use a test cert here that we can generate. It's a self-signed cert. Just, we'll just start here, we'll show where we can have a remote sign cert here in a minute. But I just got an X519 cert, wherever you might have gotten it from. Now I can sign because I've, if I look closely, notice I've said default. So when I generated, I've actually set it up so that I can sign with that key by default. I happen to, so I mentioned the key and I'm just saying notation sign, the image or any artifact that I'm referencing. This happens to be a container image, the net monitor V1 image. And it comes back, it's like, okay, it's signed. It's literally that simple. It's based on a notation client and a registry. I can see what has been, actually, let me clear this. Get this at the top of the monitor. If I look at what's associated with the net monitor image, because that's what's in my deployment chart. That's the only information I know. So let me ask the registry, is there anything else related to that? So we have this ORAS client, OCI Registry of Storage. And it can discover what is associated with that reference. And I can use a tag or a digest. And it comes back and says, hey, that image has an ordinary V2 signature hanging off of it. Now, if I want to verify that container image, I just say notation verify, pass it the path. And of course it fails, because we haven't, we've got to fail by default policy because this is a self-signed cert. We don't know anything about it. We haven't set it up in our environment. So we actually need to configure that we actually want to use the certificate. So we say cert add. This is what the interaction is now. We will have more of trust or policies coming this month. And I can now, now I've configured that that's what I want. Now, if I say notation verify, of course it'll pass because I've said that's what I want to be allowed in this particular environment. So the idea is your private keys should be kept private. This is kind of the model. Yeah, most people don't really want to keep their private keys on their laptops and things like that. So one of the really strong asks we had was that for most, almost everyone really wants to keep signing keys in hardware, which means in some sense remote it might be as remote as a UB key or the TPM on your machine, or it might be actually in a cloud provider key storage or somewhere else that's not basically on the file system accessible to the client. So it's really important that we support that use case because pretty much everyone wants keys in hardware for everything nowadays. And this is where we just wanted to lean into the infrastructure that our customers already have. We've already got a lot of infrastructure here. We want to leverage it. That's their security bar. So the model is you keep your private keys private. You might have access to sign them and those key providers have lots of logging to know who signed them. But you can't, you don't have the rights to take the private key out and put it on the internet. You can do signing and it's locked down to nodes in a machine or certain environments. And these can be ephemeral keys and things that are generated through Spiffy or something like that as well. So they might just be a key that's generated just for that signature. Exactly. So the next part is, well, there's lots of key vault providers out there. So there's lots of signing services out there. We don't want notation to have to track every one of those. We don't want anybody who wants to write a key vault provider, sorry, a plugin to have to come to the notary maintainers and like, can I please check this into your source code? There should be a specification that says, here's how you write one. So that's what we've set up and we've basically, it doesn't even matter what language you write it in because it just does binary calls and does standard and standard out to get the information to it. So really nice, it doesn't require you to even use, in this case we use go for the notation client. And as you want to rev those, you can completely build it all on your own. You can completely keep it all on your own. You can service it and nobody has to know about it outside of whoever's doing it. So let's take a look at how we can do that here. So what we've got is, we've happened to write one for Azure Key Vault. AWS is writing theirs. We want to get one for Hashi Key Vault as an example. We haven't had a chance to do that yet. So if somebody wants to write one, that would be great. I've already configured that with a Azure Key Vault provider. Again, anybody can write one. And I'm just gonna, I need to get the key ID. Now, this is the path that when it's doing a remote signing, what should it use? Now, in this case I happen to be using Azure Key Vault. You can use whatever you want. And then it comes back and it gives you the key ID. So if I say key ID, if I spell it right, it's just a path. And most key vault providers have some kind of way to reference it. And then I'm just gonna say, let's go add that name to the notary config. I've said, this is the name of it, the key. And by the way, I'm using a particular plugin name. So there are no to route. When I say sign of that name, route it to that plugin or it to do all the heavy lifting. If I look at the key list, we point out that we've been gotten used to very wide monitors at home. So we probably need to rethink about how we format that output. But then I can just simply say, no different than I did with the self sign key, I'm now doing a sign with a key that we got locked up in a key vault. I don't have any access to other than to do sign. I just reference it by name. And when I configured it, it notices that name, uses that plugin, so go route it over there. And now I've got my signature set up. And if I look at the list of keys associated with that image, right? That's the only reference I have is net monitor V1. It will go and say, well, I actually have two signatures now. Now, then it's a matter of, well, which one do I want to allow? It's up to you for what policy you would configure. So we can see there's our net monitor and then there will be a hash of the different type, artifact types, in this case, it's signatures, will show when we have S-bombs and so forth in a minute. Okay, so that's remote signing. So if you notice the simplicity of signing with a local cert and signing with a remote cert, it's still just notation sign, notation verify, but you're configuring where you want those to come from. Now, that's great. I can do that on my laptop, but I don't think we're running too many workloads probably from our laptop. Maybe some ML scenarios. I mean, that's not completely true, but there's definitely some. How do I get this into some kind of production or other environments? And this is where we wanted to integrate with the existing systems. So we've got a Kubernetes cluster here and I've got two namespaces. I've made it very... Try security, wanna... Yeah, there's a security and a not-secured namespace. We're gonna leverage the policy managers, in this case, Gatekeeper, and we've got a project we call Radify, which knows how to read those references and do validations, could do validations on signatures, could do validations on S-bombs. It's a completely pluggable model. So let's go and jump in there. All right, so we're gonna create the two namespaces. So that's simple. And then we're gonna take that public image we're gonna run an nginx image from Docker Hub, right? So, and we're running it in the not-secured namespace, so surprise, surprise, it works. And then we can see our pod running. But now I wanna lock down that secured namespace, right? We wanna be able to say that only things running in that, should be allowed to be running that namespace that are actually signed by a key that I'm configuring. And I happen to have that public key stored in a key vault in this case.  I don't have them deployed everywhere. If it's public software, like Microsoft, we're signing our content, then that public key will be available and you can curl that into your environment. We need to clean up some of the key format conversion stuff. There's a little too many pipings going on here, but suffice to say, I just needed to get a public key into an environment variable. So then I'm just gonna take, I'm gonna do a helm chart for ratify and I'm gonna give it the public key that I want it to secure. So I'm just doing a helm install and then I'm saying, you know, there's our registry credits set up, but basically here is the public key that I want you to use. Then I'm gonna create a constraint. The constraint says I wanna take the namespace secured and apply this ratify constraint to it. So that's starting to glue the connection there. So I just got this config file and then I'll apply that to the cluster. Just apply this constraint which locks down that namespace. So now if I try to run that nginx image in that secured namespace, forbidden, right? The failure that you want, right? This is the good failures here. Okay, so great, we've locked that down. Can I run anything in there? Well, remember, we signed our net monitor image with two keys. We signed it with a self-signed private key, which it goes, whatever, because I've configured that cluster to use the active rockets or the web networks key in this case. So there is a key that I've set up only allow stuff that's signed with that key and so it was scheduled and life is good. Now, we talked about the promotion workflow. What if I do want to run the nginx image in that environment? Should I just allow anything that's unsigned if it equals nginx? Well, how does that, is that really what I want to? I want to constantly pull updates from Docker Hub and deploy it. Well, there was a hundred different connections that could be down, having nothing to do with Docker Hub between that point. There could be a security update to nginx that might actually not work for my environment. Remember, SolarWinds was an update that got applied. It wasn't software that was bad to begin with. So I'll pull, we'll simulate that import workflow. So I'm going to pull the nginx image and we'll then scan it. So we're basically just looking at it to see if we think this is okay to run in a production environment based on criteria around scanning. And it'll take a look and it's going to run against the dependencies and whatever, this is a point in time. Vulnerabilities are discovered on things that are already shipped. So I only know what I know today. So there's a set of issues, but effectively it is the best thing that we have today. It's like, okay, I'm making that decision to be able to promote it. Now, I'm actually going to do something a little interesting here is I'm actually going to take the output of that scan and I'm actually going to save it to nginx scan. Okay, I forgot the .json file. So I'll have to, I'll remember how to fix that. So it'll save it as nginx scan, not .json, it should have been, but I forgot to do that. So now I'm going to tag that image so that it is going to be set up for the registry that I want to deploy from. I don't want to deploy from Docker Hub. I want to import from Docker Hub into my environment. I've scanned it, it's good. And then I'm going to push to my private registry, right? We're doing that promotion workflow. And then I'm also, and I'll remember to fix this. I'm also going, so it's doing its push, it's all good. So now I've got the container image in my private registry, almost. We've been good, lucky with the wifi so far. We're going to show how duplicated images are, or we're going to show de-duping. So it'll finish it up again, but it'll show that those layers already exist now. So give it a second. We're not being lucky with the wifi. There we go, see, right? So it just has to do the item potency thing and finish up the last piece, come on. There we go. Okay. So the image is there, but remember, I also want to associate that nginx scan file that I forgot to put .json on, that's why I was just fixing there. I'm going to push that up also. So this I'm using the RS client, and basically I want to push to the nginx repo. I'm going to name it SnickScan v1, and the subject is that net, sorry, the nginx121.6 image. So when I push that up, I'm now saying, hey, please store that scan result with the image as well. Going to sign, come on internet. There we go. So now I'm going to sign that image. So now I've actually got two things that I've associated with it, right? We've got the scan result and the signature. So now if I do an RS discover, again, take the nginx image, the tag, and that's the only name reference I know, what else is hanging off of that? And you see that now I've got the SnickScan and the signature, both, right? So that's kind of nice. I can now have my objects together. The only instance that I have here is a registry and the notation in Norris clients. Okay, so now I can get back to, I do want to run that nginx image. So now I can say, run nginx, I'm naming it nginx, but notice I'm pulling it from my private registry that has been signed with the key that I trust because I've done the verification on that workflow and it's often scheduled, right? That's kind of the beauty of it. That's basically it. So cool, let's kind of think about that for a second. So we have several different tools that we were using. In this case, we were signing and we were generating scan results. We want all of that information to be promoted. Remember that animation we did where we said we want to take the public stuff, put it into our private registries because that starts to get inside of our environment. We've secured it and we can promote it. Well, I want to show one more quick one here where if I want to copy that content from one registry to another, this Aura's client doesn't know anything about scan results, doesn't know anything about signatures. It just says copy things from this named reference in Web at Networks to Acme Rockets. And because it can read those references, it doesn't need to know what they are. They just know that here's a bunch of things that are associated and I'm going to copy them across. So we'll just finish that up. Again, fun with this. Bring these go on. Okay, I'll come back and show that in a second. So, go on. So yeah, so we've got policy and management for our environment. You can configure which keys you trust for our environment and it's just integrated with normal tools such as Gatekeeper or other, many other tools available, whichever tools you're using today to do that. So where we are really, we're finishing up release candidate one this month. Microsoft is shipping a load of example sign things that you can test right now. We'll be starting to ship Docker official images signed with us shortly as well. So there'll be more tests, but if you want some test images now and I'll see one will be compatible with future format. So it should be good to test going on. There's more links there to give you some information. We have to, we're a software company as Microsoft. We need to ship our software with signatures and S-bombs, the executive order in the US and all kinds of other things. We wanna make sure we can start testing this workflow. So that's kind of some stuff that's available there. Yeah, go ahead. Yeah, we're finalizing the specs at the moment just trying to put things together. And we've got a alpha release working towards the RC and we've shown the things that some of the key vault providers and some of these other example stuffs. There's more going on with AWS is doing work on there. Key signing provider, as I said, we're working on getting the official images signed and things so you can kind of test this all out and provide actual workable useful workflows to start with. So it's just, it's okay. So the copy was done. Let me just kind of do one more. So we were able to just let that sink in there for a second. We're gonna be able to copy that graph from one registry to another. And so notice I'm now said, hey, Aura's discover what's on the Acme Rockets Registry for what I copied. So it will give us that list. It didn't finish yet. Sorry, slightly. It's traveling across the pond. There we go. Okay, so and now you can see that I actually didn't clear out my previous demo because there's actually two of them. So I ran the demo once before too. So you can kind of see it. That's even more important. Like that was emptied before.  And of course there's filtering commands and so forth. So you can copy the subset if you want.  We're looking at additional work on identities. Not everyone has an X509 infrastructure. Lots of larger companies do and lots of software publishing organizations do but individual developers generally don't. So we're looking at support for SSH keys and policy around which identities you trust for what. There's kind of a lot of options there. Still lots of work to do on that. We're looking at things like inline signatures for when we are originating content with signatures straight off. But this is all designed to be extensible framework that supports lots of different use cases. So come along and tell us what your use cases are, what you need. And just the idea there is the same way that we want policies on the son because we want policies on different identity types. So that's what you kind of see in there. And there's all the links. The wall of links. Yes. So I think we... I think we're kind of at time. Thank you. Appreciate it. I don't know we have... I think we've run out of time so we haven't got questions now but we'll be around. We'll be around in the hall and you'll find us on Slack on our info that's here and we're happy. We'd love to hear more of your info. So thank you.


The all-progressive Congress, APC's consensus candidate for the House of Representatives Speaker and Deputy Speaker Tajuddin Abbas and Honourable Benjamin Kalu have been unveiled to members-elect. The unveiling took place at a meeting of the House joint tax in Abuja. Speaking at the ceremony, the speakership candidate Tajuddin Abbas said his nomination is based on competence. Abbas appealed for patience, noting that by next week there will be an official declaration where his 16-point agenda will be unveiled. I feel elated, I feel inspired because I believe if the party is going to use competence as a statistic, I am the right person to actually be picked. So the fact that they did what I expect them to do, I feel very elated, I feel very satisfied. We are in the process. We have reached out to so many, I will continue reaching out to all of them. Before the end of next week, I assure you all the candidates, all the contestants will reach out to them, we will beg them, we will ask them to come on board so that we can work for the good of the instrument. Also speaking on his nomination, Benjamin Kalu, the party had taken an inclusive step by choosing him. The party has started the strategy for the 2027 election by making sure that they have a foot in the south eastern region. What they have done with this nomination is in the spirit of inclusion. The south east is going to feel the power of cohesion and national loyalty is going to be driven by virtue of this that has taken place. It was a wise decision to include the southeasterners in the structure of government that is being formed. As you know, it is the responsibility of a ruling party to set up the architecture of government in order to achieve the set national objectives. And I'm sure by making sure that everybody embraces that national objective, will help them achieve it faster and this architecture that is being displayed now is all inclusive architecture and my people in the south east are delighted that they've been considered and that would change the dynamics come 2027. Updates


Hey, Steve McFarney here in the beautiful sunny Olds, Alberta. Love this hot weather. 2020 Grand Cherokee Laredo Altitude Package. Again, the Altitude can be the black rims, black riding. This one's got the blind spot detection lane warning. 8.4 screen. P6. Park sensors. Regular feels all it takes. That's all you need in regular. This is awesome. Back-up camera. Trailer tow. Back-up sensors. So you're ready for your new Jeep. You're going to go where? Sunny Olds, Alberta at Mountain View Dodge. And you can see me, Steve McFarney. Have a great day.


Your personal brand is how other people remember you. It's how you want to be perceived by other people. Like when you walk into a room, how do you want people to think about you? What do you want them to think about you? What do you want them to think about you when you've left the room? What do you want them to say about you when you're not there? What do you want people to think when they see you, when you show up? How do you want them to communicate about you in a consistent way? Well, that's what your personal brand is. It's how you consistently show up whether you are there or not. If you don't have a message that's going out to other people when you're not there, then you don't have a brand.


Over 61 Aushebab militants and foreign nationals were killed and Aushebab equipment destroyed in an explosion at a village in southern Somalia. The National Army confirmed this in the statement on Tuesday, saying they conducted a swipe operation in the area. The blast went off inside a house at Allah Hotel Village located at about 285 km from the capital Mogadishu. Reports indicate that the material stored at the 11 room house exploded late on Monday, killing at least 61 militants including 6 foreign nationals.


Personal Finance PowerPoint Presentation Social Security and Taxes Prepare to get financially fit by practicing personal finance Support Accounting Instruction by clicking the link below giving you a free month membership to all of the content on our website broken out by category, further broken out by course Each course then organized in a logical, reasonable fashion making it much more easy to find what you need than can be done on a YouTube page We also include added resources such as Excel practice problems PDF files and more like QuickBooks backup files when applicable So once again click the link below for a free month membership to our website and all the content on it In prior sections we've been talking about investment goals, strategies tools, we're honing them down in current sections in prior presentations to the specific goal of retirement planning Quick recap on the types of income people might have in their retirement years to be living on We have the employer pension plans we've talked about in prior presentations We're including here the 401k plans for example public pension plans which we're going to include in that category things like a 403b the public pension plans being similar you can think of them as to the employer pension plans but for those working in the public sector for the government for example We also are going to include in this category the benefit programs government benefit programs such as the big one being social security which we're talking about now We've got the personal retirement plans which could include IRAS and other accounts we have saving for retirement and annuities in a specific tool that we might talk about more for retirement planting Most of this information comes from Investopedia It's social security taxable We're focusing in on that taxability component of the benefit programs Social Security This by Melissa Horton updated August 15th, 2022 Remember that as we think about social security planning we usually have two sides to it One, us putting money into social security usually in the form of payroll taxes and two, getting the benefits at the point of retirement and we're often thinking how much will the benefits be how can we maximize the benefits and taxes are always a complicating factor in our decision making process so we want to have an understanding of the general tax implications so we can work that into our planning So is social security taxable? Most Americans it is that is a majority of those who receive social security benefits pay income tax on up to half or even 85% of that money because their combined income from social security and other sources pushes them above the very low thresholds for taxes to kick in So when we're talking about taxes it could be a little confusing because you got taxed with payroll taxes when you paid into social security that's not what we're talking about here because we're talking about income taxes so when you paid the taxes that was a social security or payroll tax now you're thinking about getting the money back from the social security benefits whether that be income to you in the form of an income tax so when you fill out the income tax to the IRS everything is income in general unless they say otherwise this is kind of like a benefit program so you think maybe they would say exception not taxable and they basically have a phase out threshold that is put in place so the general question or the easiest way to think about it is to say that well up to 85% will be taxable if you have a significant amount of income remembering that income taxes are a progressive tax meaning your tax brackets go up as you get more income so as you have a higher income threshold you also have this phase out that happens with whether or not you have to include social security as income income being bad for taxes right because if you have to claim income on the taxes then you might have to pay taxes on the income so we might have to claim up to 85% as income if we have total income that's fairly high or above a certain fairly low threshold would be the general bottom line and then you can get into the details in terms of when the phase out actually happens okay but there are three strategies you can use place some retirement income in Roth IRAs withdraw taxable income before retiring or purchase an annuity to limit the amount of tax you pay on social security benefits so this kind of goes into total tax planning as well as the social security so remember your goal in retirement is to be paying less taxes you would like to use our goal from a tax perspective but the question would be well in retirement if you just had all your money and like a savings account or something like that you would think that when you pull the money out it wouldn't be taxable because it got taxed when you earned it when you put money into the savings account into the bank but most people have most of their money actually in something like a 401k plan which got a tax deferral for it up until the point they take it out so when you take the money out of a 401k plan then it's usually subject to taxes if you're living on say like a hundred thousand dollars just for an even number and you pull all of it out of a 401k plan it might all be subject to tax and because you'll have a high taxable income that would also mean that like 85% of your social security benefits would most likely be taxed as well that you would be receiving but if you can live on whatever you're going to live on like a hundred thousand or whatever and you can get some of that money out of non-taxable accounts because you didn't get the tax benefit when you put it in such as Roth IRAs like if you put money into a Roth IRA then you still get a tax benefit from it but it's not taxable when you take the money out so if you can take 50,000 out of a normal IRA that's taxable and 50,000 out of a Roth IRA you would expect that you would have less taxable income and that could also have an impact on whether or not your social security is going to be taxed when you think about those limits as well so that's a general tax planning strategy we would like to be living on whatever we need to live on in retirement and we would like to be spreading out the income from the sources that we're getting to lower the income on a year by year basis so we can be in those lower tax brackets at retirement age okay how much of social security income is taxable social security payments have been subject to taxation above certain income limits since 1983 no inflation adjustments have been made to those limits since then so most people who receive social security benefits have other sources of income pay some taxes on the benefits so notice they didn't increase these limits these thresholds for inflation and therefore the limits are fairly low at this point in time because the time value of money has gone up and they haven't adjusted them however, regardless of income no taxpayer has all their social security benefits taxed the top level is 85% of total benefits so the easy answer to the question is you might be paying income taxes up to 85% that's not the tax rate that's the amount that you would have to include in income which would then be subject to taxes dependent upon whatever tax bracket you are in so the easy answer would be up to 85% of your social security could be subject to tax if you have any significant income because the thresholds are fairly low because they haven't been increased for inflation and then when you get into the weeds in terms of where that threshold is and what happens if your income is below the threshold and how much you would pay and so on so here's how the Internal Revenue Service IRS calculates how much is taxable so the calculation begins with your adjusted gross income that's basically your AGI adjusted above the line deductions which are the more kind of rare deductions or the Schedule 1 deductions you might call them on page 1 of the 1040 typically from Social Security and all other sources then may include wages self-employed earnings interest dividends required minimum distributions so the amount from the IRAs and stuff that are subject to taxes qualified retirement accounts and other taxable income tax exempt interest is then added it isn't taxed but it goes into the calculation so you're trying to figure this calculation to determine if you have to pay taxes on it you've got to include the tax exempt interest there for that calculation if that total exceeds the minimum taxable levels then at least half of your Social Security benefits will be considered taxable so you would think that often times many people will clear that which would mean that half of your Social Security tax that you receive would be subject to tax that's not the tax that's how much you would have to include an income which would then be taxed at your normal tax rates so you must then take the standard or itemized deduction to arrive at your net income the amount you owe depends on previously where that number lands in the federal income tax tables individual tax rate of benefits will be subject to tax if you file a federal tax return as an individual or your combined gross income from all sources is as follows $25,000 to $34,000 if you may have to pay income tax up to 50% of your benefits so again that's a fairly low threshold because they haven't increased it with inflation more than $34,000 up to 85% of your benefit may be taxable so the IRS has a worksheet that can be used to calculate your total income tax due if your Social Security benefits when you complete this exercise in arithmetic you will find that your taxable income has increased by up to 50% of the amount you receive from Social Security if your gross income exceeds $25,000 for an individual or $32,000 for a couple the tax percentage rises to 85% of your Social Security payment if your combined income exceeds $34,000 for an individual or $44,000 for a couple many basically married then married filing joint job for example say you were an individual taxpayer who received the average amount of Social Security about $18,000 you also had $20,000 in other income add the two together and you have a gross income of about $38,000 however your combined income is computed as only $29,000 other income plus half your Social Security benefits that's within the $25,000 to $34,000 range for a tax of 50% of your benefits so half of the difference between that income and the $25,000 threshold is your taxable amount $28,000 minus $25,000 equals $3,000, $3,000 divided by $2 is $1,500 the calculation can become more complicated for taxpayers with different forms of income so we got the Medicare taxes for couples who file a joint return your benefits will be taxable if you and your spouse have combined income as follows from $32,000 or to $44,000 you may have to pay income tax on up to 50% of your benefits more than $44,000 up to 85% of your benefits may be taxable for example say you are a semi-retired couple following filing jointly and have a combined Social Security benefit of $26,000 you also have $30,000 in combined other income add two together and you have a gross income of $56,000 your combined income for Social Security is $43,000 other income plus half of your Social Security benefits this combined income falls into the $32,000 to $44,000 range meaning that half the difference between the income and the threshold is computed at 50% to get your amount taxable $43,000 minus $32,000 equals $11,000 $11,000 divided by two is $5,500 so Social Security benefits tax tool the IRS being the IRS the straightforward example above may not apply to you the IRS's interactive tax assistance that's the ITA will lead you through the possible complications and calculate what part of your income is taxable IRS notice 703 describes tax rules for benefits so again the easy answer would be well up to 85% of your income could be subject to tax if your income is above a certain threshold once you start getting below the threshold it gets a little bit confusing to calculate the tax of course and I would highly recommend software as well tax software can be useful to kind of run scenarios if you don't have access to the tax software you can visit the IRS website and look at the resources there as well so your spousal survivor disability and SSI benefits taxable or spousal survivor disability and SSI benefits taxable follow the same general rules as the social security program for retirees except for supplemental security income that's the SSI spousal benefits if you don't have social security benefits but collect spousal social security benefits based on your marital partner's benefits the rules are the same as for other social security recipients if your income is above 25,000 then you will owe taxes on up to 50% of the benefit amount the percentage rises to 85% if your income is above 34,000 survivor benefits survivor benefits paid to children are rarely taxed because few children have other income that reaches the taxable ranges the parents or guardians who receive the benefits on behalf of the children do not have to report them as part of their income disability benefits social security disability benefits follow the same rules on taxation as the social security retiree program benefits are taxable if the recipients gross income is above a certain level the current threshold is 25,000 dollars for an individual and 32,000 dollars for a couple filing jointly SSI benefits SSI is not social security it's a needs based program meaning it's social security is kind of like a benefit program for everyone and not just a welfare program so there's kind of a question with these programs again it used to be that you would think of them all as safety net programs for people that need the safety net kind of a welfare program but now social security is being more of like a program that everybody is going to have access to and so you got to kind of keep in your mind these days what kind of program is a welfare or safety net program and these other programs that are kind of shifting to be applicable for everybody so a needs based program for people who are blind disabled or age 65 and older SSI benefits are not taxable therefore and you would think okay that seems reasonable paying taxes on social security you should get a social security benefit statement so how do you know to pay taxes well clearly if you're then filing for social security you're going to get a form SSA a 1099 type of form about your taxes if you're trying to plan for when you should be claiming social security how much you're going to be receiving and so on then of course you're projecting into the future so you'd have to determine how much you think you're going to get and then you can say well how much is going to be taxable what's going to be the tax implications and you can think well if I have significant income over a fairly low threshold then 85% of the social security benefits will be subject to tax if you're below that then you can try to get more into the weeds in terms of how much of it will be taxable to project to determine what the best strategy would be with regards to social security planning so each January detailing your benefits as you get that in January in a tax season and you can use it to determine whether you owe federal income tax on your benefits so the information is available online if you enroll on the social security website if you owe taxes on your social security benefits you can make quarterly estimated tax payments to the IRS or have federal taxes withheld from your payouts before you receive them so if you're going to owe taxes on them and you want it to be as easy as possible you might try to have withholdings withheld from your social security or if that's a big source of your income and you need to pay your taxes then you have to actually pay the IRS quarterly payments it's a little bit difficult often times when people are saving for retirement for income taxes because if you've worked your entire life and the money was just taken out of your wages before you even received it in the form of withholdings to pay your taxes it can be a little bit of a shock for a lot of people that are now receiving money from things like 401k plans or IRS which are subject to tax when you take the money out of your social security which might be subject to tax to then plan a little bit more to figure out that you have to actually make estimated tax payments to avoid penalties and interest or possibly have withholdings on the distributions that are being given to you in that way so it's a little bit different than the employee or situation for many people so state taxes on social security 12 states taxed social security benefits in some cases check with me if you live in one of these states so you've got Colorado, Connecticut, Kansas Minnesota, Missouri, Montana Nebraska, New Mexico, Rhode Island Utah, Vermont and West Virginia taxed social security as with the federal tax how these agencies taxed social security varies by income and other criteria three ways to avoid taxes on benefits so how can I not pay taxes is the question legally, legally the simplest way to keep your social security benefits free from income tax is to keep your total combined income below the threshold to pay tax so this gets into normal tax strategies for retirement we want to keep our taxable income low as possible it's not the same thing to talk about how much money we're going to be living on how much we're going to consume and how much is subject to taxes because we might have some of our retirement earnings in accounts that aren't subject to taxes if I just had money in the bank account it's not subject to taxes but I can still take it out of the bank account and use it but if it's under an umbrella of an IRA or a 401 K traditional at least then if I take the money out it will be subject to taxes because I got a tax benefit so we would like to be able to take some of our money that we're going to consume out of tax free areas that aren't subject to tax like Roth IRAs or something like that and some of the money out of tax accounts so that our income is fairly low and if we can get a low enough under the threshold to be subject to tax for social security we might be able to pay less taxes on social security due to not having to include as much in income from the social security distributions however this may not be a realistic goal for everyone so there are three ways to limit the taxes that you owe so clearly this is a fairly low limit so if you make a significant amount of money you're not going to be able to get your income below these fairly low thresholds place retirement income in the Roth IRAs so again it be if you had some money in a Roth IRA that could be beneficial for pulling it out the taxes withdrawal tax income before retiring purchase and annuity so an annuity is going to mean that you buy an investment that's going to that's going to pay out periodically like yearly let's say and therefore now you've spread out the money that you're going to get over a long period of time and therefore you're going to have less taxable income on a year to year basis would be kind of a general idea so place some retirement income in Roth accounts contributions to a Roth IRA or Roth 401k are made with after tax dollars so you're not getting the tax upfront the tax break up front but rather you're getting a tax benefit as it grows and it's not subject to tax when you take it out it's kind of the reverse of a standard IRA or 401k so this means they're not subject to taxation when the funds are withdrawn thus the distribution from your Roth IRA are tax free provided that they're taken after you turn 59 and a half and have had the account for five or more years as a result the Roth payout won't affect your taxable income calculation and won't increase the tax you owe on your social security benefits distributions taken from a traditional IRA or traditional 401k plan on the other hand are taxable the Roth advantage makes it wise to consider a mix of regular and Roth retirement accounts well before retirement age so you'd like to start thinking about this in terms of well how am I going to pull my money out so I can live on a good amount while still having only part of it taxable possibly because you're pulling some of the money out of a Roth instead of the traditional so the blend will give you greater flexibility to manage withdrawals from each account and minimize the taxes you owe on your social security benefits a similar effect can be achieved by managing your withdrawals from conventional savings, money market or other tax sheltered accounts so if you have a lot of money in your traditional IRA then you might just have a lot of other money that is in other accounts just a normal savings account or any kind of retirement tax shelter kind of area savings plan like a 401k Roth, 401k IRA Roth IRA or anything when you take that money out it might be subject to capital gains because you might have gains when you earn money on stocks and stuff but it's not going to be subject to taxes just because you took it out which is another nice balancing factor that you can have against the distributions made from your taxable accounts like a 401k taxable income before retirement another way to minimize your taxable income when drawing social security is to maximize or at least increase your taxable income in the years before you begin to receive benefits this means you could withdraw funds a little early or take distributions in tax jargon from your tax sheltered retirement accounts such as IRAs or 401ks you can make penalty free distributions after age 59 and a half this means you avoid being dinged for making these withdrawals too early but you must still pay income tax on the amount you withdraw so since the withdrawals are taxable unless they're from a Roth account they must be planned carefully with an eye on the other taxes you will pay that year the goal is to pay less tax by making more withdrawals during the pre-social security period than you would after you begin to draw benefits that's going to get a little bit more complex right you're trying to say I'm going to try to pull money out so that I have the money before the social security benefits kind of kick in and if I can plan it out properly maybe I can get my income below the threshold so my social security benefits are less of them are taxed would be the example there but those thresholds you got to be careful with that because those thresholds are fairly low and you still have tax consequences of the 401k plan and if you're trying to take the money out early that complicates things as well because you want to avoid penalties and interest for taking the money out early so that requires considering the total tax bite from withdrawals social security benefits and other sources be mindful too that at age 72 you're required to take RMDs that's the required distributions from these accounts so you need to plan for those mandatory withdrawals meaning the IRS to force you to take money out of a 401k or an IRA even if you don't need it at that point in time because they want to force you to pay taxes on the income so you want to plan for that beforehand so that you can try to limit the amount of money you're going to take out on a per year basis hopefully putting you into a lower tax bracket so this strategy has another benefit by using these distributions to boost your income when you're retired or nearing retirement you might be able to delay applying the social security benefits which will increase the size of the payment so purchase and annuity a qualified longevity annuity contract QLAC is a deferred annuity funded with an investment from a qualified retirement plan or an IRA so now we can buy like an annuity so it's going to be a series of payments that we're going to receive periodically into the future QL these are the longevity annuity contract provide monthly payments for life and are sheltered from stock market downturns so one of the benefits of an annuity is you've made a deal to get set payments no matter what so it's not subject to the whims of the market so much so as long as the annuity complies with the IRS requirements it is exempt from the RMD so that's the required mandatory distribution until payouts begin after the specified annuity starting date so by limiting distributions and thus taxable income during retirement QLACs the annuity can help minimize the tax bite taken from your social security benefits under the current rules an individual can spend 25% or $135,000 whichever is less of a retirement savings account or an IRA to buy a QLAC with a single premium the longer an individual lives the longer the QLAC pays out so clearly if you buy an annuity so if you're able to basically get the money into the annuity now that's going to have an impact on your required minimum distributions and the annuity generally is going to be for life so when they give you the annuity take into consideration your life expectancy so then you have this idea that obviously if you have an annuity the longer you live the better that deal will be because you're going to keep getting payments so if you have someone dependent on you that you think well anyways you want to have a longer life so the QLAC income can be deferred until age 85 a spouse or someone else can be a joint annuitant meaning that both named individuals can be deferred regardless of how long they live remember that a QLAC shouldn't be bought only to minimize taxes on social security benefits retirement annuities have advantages and disadvantages that should be weighed carefully preferably with help from a retirement advisor so you want to take into consideration your full picture not just looking at one factor which is going to include your longevity finances, your current income what other required minimum distributions and so on and so forth how do I determine if my social security is taxable add up your gross income for the year include social security if you have little or no income besides your social security you won't owe taxes on it however if you're an individual filer with at least $25,000 in gross income including social security for the year then up to 50% of your social security benefits may be taxable for a couple filing jointly the minimum is $32,000 if your gross income is $34,000 or more or a couple's income is $44,000 or more did I say that right it was income is $34,000 or more or a couple's income is $44,000 or more then up to 85% may be taxable what percentage of social security is taxable as an individual your social security is not taxable if your total income for the year is below $25,000 half of it is taxable if your income is in the $25,000 to $34,000 range if your income is higher up to 85% of your benefits may be taxable if you and your spouse filed jointly your old taxes on half of your benefits if your joint income is in $32,000 to $44,000 range if your income exceeds that then up to 85% is taxable do I have to pay state taxes on social security 38 states did not impose taxes on social security benefits the other 12 tax some recipients under some circumstances does social security income count as income yes but you can minimize the amount you owe each year by making wise moves before and after you retire consider investing some of your retirement savings in a Roth account to shield your withdrawals from income tax take out some retirement money after your 59 and a half but before you retire to pay for expected taxes on your social security before you begin receiving benefit payments you might also talk to a financial planner about a retirement annuity at what age is social security no longer taxed social security is taxable based on your total income not age however the taxable income varies from 0 to 85% depending on your total income what's the bottom line most advice on social security benefits focuses on when you should start taking the benefits that of course is another factor we talked about earlier the short answer is to wait until your age 70 to maximize the amount that you get still another consideration is how to prevent your social security benefits from taking a big tax bite out of your overall retirement income the answer is to plan well in advance to minimize your overall tax burden during your retirement years