Hi, today we're going to be talking about Cerner's journey towards a secure software defined data center. Really there's a little bit of false advertising here because it's really about NFV. Here's our legal notices that we have to flash up. My name is Joe Quent. I work for the Cerner Corporation. That is not the CERN nuclear foundation. It's a healthcare IT company. Over here I also have some co-presenters, Tarun and Manish from Intel and the guy with the nice hair. Hi, I'm Pino de Candia from Iroquura. Today we're going to structure our talk around who is Cerner, what is our requirements. Then we're going to get into IPS and IDS, what that means, which is our virtual network function. Then we're going to get into some use cases, which are the attack vectors. We'll roll into some demo, then we'll get into the nitty-gritty details of the solution. So Cerner, who is Cerner? We are the world's largest publicly traded healthcare IT company. Go ahead. We're in over 30 countries. Our software is found in over 5,000 hospitals used by nearly a half a million physicians. Our software is very similar. Our journey is basically very similar to SAP. We started out as a mainframe, a lab system, and then we've evolved to a Win32 oracle system that we host in our own internal environment. Then as we've moved and migrated to any device anywhere, we are now running on OpenStack and in the cloud. If you've ever been to the doctor's office, which I'm sure most if not everybody has, you have this form called HIPAA. It sounds a bit like a disease, but I promise you that it is not. It's about reasonable safeguards against your personal health information. We call it PHI. What it is is it safeguards around your past, present, and future mental and health conditions as well as any payment information. So what we do is we have to make sure that there's not unintentional disclosure between one doctor's office or somebody else that's trying to get your information. Centers for Medicare and Medicaid services. What these guys do is they actually provide 30% of the United States health care. And as that, they actually provide stricter guidelines than HIPAA. So when we looked at HIPAA, they said reasonable safeguards. Well, CMS for Centers for Medicare and Medicaid services, if you read the Risk Management Handbook Volume 3, Standard 3.2, it's a riveting read. Read it on your plane ride. It'll help you fall asleep. But if you do that, you will find that they say that you can't just use perimeter security such as enterprise firewalls and IPS or intrusion protection and intrusion detection systems.  Let's go ahead. So what is perimeter security? Well, we're not going to try to divulge what we do for our own security, but this is kind of a high-level graphic here. So you have the internet on the far right or far left. And from the internet, we actually provide security tools such as IPS and IDS sitting in between our enterprise network, which is depicted in the top right hand of this graphic, and our open-stack environment. And we use these security tools to prevent unintentional traffic or malicious traffic going from one to the other. John Lambride from the last North America summit gave an excellent presentation on unobtrusive intrusion detection. What this was about was he went into what intrusion detection and prevention is, such as monitoring network or system activities for malicious activities, and then went into how this could be implemented inside of open-stack. It's a fascinating topic, and basically what we've done is we've taken that work as a derivative work and extended that work. So we've looked at what he talked about, what network-based IPS and IDS are, which is basically what you do with that perimeter. It's a device that sits in between networks. Host-based IPS, IDS, runs on your laptop, much like what's running here. And it prevents malicious behavior such as Cryptolocker from taking over your laptop. What I'm going to do now is, as we move forward, we're going to talk about Meadonet and how it's a critical component inside of Neutron, and we're going to get into how this integrates into our solution. Pino? Thanks, Joe. So I'm going to tell you a little bit about Meadonet. Meadonet is a network virtualization solution for containers and virtual machines. So the key points I want you to take away from Meadonet is it's built by Meadocura. It's open source. Open source since late 2014. It's multi-platform. It's overlay-based because we wanted to allow it to work with any standard IP fabric. And we try to get rid of all single points of failure and make it linearly scalable. So that means getting rid of the single points of failure means getting rid of the network nodes in Neutron, essentially. And that means that for Layer 2, Layer 3, and stateful Layer 4 devices like source NAT, firewall as a service, load balancing at Layer 4, we don't use appliances. We do it all in the agent. And so instead of moving flows around to go to appliances where the state is held, we actually push state around the network. And that achieves a linear scalability. I'll show that with some visuals in a second. We believe in using Layer 3 to scale your network. So as you deploy more and more racks, you don't want to have to stretch your Layer 2 for the on-ramp into the cloud. So we use the Layer 3 on-ramp onto the cloud with BGP. And finally, because of how we've built the system, we've pushing essentially Neutron models out to the hypervisor. And having the models at the hypervisor means that we can have deep visibility into what's happening to each and every flow, meaning for each flow, we know exactly what devices it traversed through the Neutron topology. And we can report that so that you can do debugging and troubleshooting in a very easy way. Next slide, please. Next slide. Okay. So here I'm showing a kind of standard Neutron topology. Not used to seeing an edge router. For us at Metocura, we use an edge router that is virtualized so that we can have the virtualized on-ramp. In this slide, I'm just trying to point out the standard Neutron topology has virtual machine port-level firewalls. Those are the ones that you're seeing right above the virtual machines. Then you have virtual routers that have source NAT, firewalls service, load balancing as a service. You have a public network, usually an external provider network. For us, that's also an overlay network. So next slide, please. So that topology, what I want to show you is that in our implementation, we'll be able to do a traversal of that entire topology which had only layer 2 through layer 4 elements, no layer 7 elements like VPN or advanced firewalls. But we can do that all in a single physical hop. So here you're seeing sort of a classic open V-switch architecture but without the open V-switch daemon. We have a flow switch which is the kernel open V-switch module. You have VMs on both sides. The VMs that are circled on the left, a green VM and on the right, a blue VM that is sort of darker. Those are the VMs that you see in the smaller logical topology in the center. And the one on the left is sending a packet that should get to the blue VM on the right. So what happens is just in classic open V-switch, a packet goes via the network channel, a miss packet goes to our agent. Our agent does a flow computation. We actually simulate the entire logical topology that you see in the center. It's as if the middle net agent is kind of thinking about what would a real network do if it got this packet. And it computes the entire, all the transformations that would happen on that packet's headers, computes that and then applies them in one flow rule and installs the flow rule in the flow switch. And so the packet is tunneled over to the destination hypervisor and delivered directly because the tunnel key tells the destination hypervisor where to deliver the packet and all of that without going to any appliances anywhere. So if you have a layer of seven appliances, we'll have to jump around the network, but otherwise we've removed all of the network hops that cause, you might have heard the term, traffic trombones. So I'm going to hand it back to Joe to talk about security. Thank you, Pino. Yes, we're not really into trombones here. I myself am a trumpet player, so we're going to try to remove all trombones out of our entire open stack environment. But first we're going to talk about three different attack vectors. The first attack vector is outside in attack. That means that there's an evildoer outside of our open stack trying to compromise a host within our open stack environment. Based on the discussion that Pino had, which is the traffic actually has to traverse through what's called a Mido net gateway. So before it flows through that Mido net gateway, it flows through the IPS, or then that malicious activity would be flagged and then cut off. And the other attack vector, which is inside out, in the unfortunate case that there's a virtual machine that is compromised within our cloud and trying to do some evil work outside of our cloud, then the traffic has to traverse through the gateway, then through the IPS IDS, and then eventually to the victim, where eventually what would happen is the IPS IDS would catch that traffic and make it so that we would be flagged that we would know that there was something going on inside of our cloud that's causing the problem. So the issue in lies with the implementation or the goodness that it derives from Mido net. So if there's an inside, inside attack vector, what happens is that there's a VM to VM communication. Well, on the left-hand side of this chart, we would see that that traffic never passes through the perimeter IPS IDS because the host that's compromised internally is trying to get to another host or another VM internal and that traffic never passes through. So one of these, an example solution would be, well, route all your traffic through the IPS IDS from the perimeter. Well, now you're sending data from the VM through the Mido net gateway into the IPS IDS where then it would be flagged and then back down through the Mido net gateway into another host. Now, this may seem like it's okay, but it's not really a scalable model. Notice that there is what we call a traffic trombone. All traffic has to go out to that IPS IDS and that's really an undesirable situation. So how do we resolve this? The way we resolve this is by virtualizing the IPS IDS as a network function. So what we do, we take advantage of the Mido net capability of service chaining and what we do is we route the traffic from the, from all VMs through that IPS IDS that would be local. And then as it tries to traverse to another VM, it would be then flagged and caught. Notice this is also a linearly scalable solution because we, as we add additional Nova nodes, then we can add additional VNFs as well. Let's get into what this looks like. We have a demo that Manish is gonna talk about. So you heard a couple of things, right? I mean, you heard about the problem statement that is the need to, the need to have to trombone traffic if you have an edge device that's gonna be doing the traffic inspection and then just the ability to have visibility to east-west traffic and be able to secure that. So what we basically did was when the request came in from Cerner, we put together an environment in which we could start doing some of these tests and figure out how we can do that in a manner that's automated and ensure that security is propagated across the data center, right? This is just a snapshot of what the, what the physical configuration looks like. I'm not gonna go into all the details, but what you can see essentially are the things I wanna point out are you see the metronet component over there. That's essentially your virtual switch. You see the security controller. It's called ISC over here. It's an inter-open security controller that we have put together to enable us to orchestrate security virtual functions. You see the virtual IPS components over there. That's from, that's a McAfee IPS at this point in time, but it's a virtual IPS and then the security manager that you see on top. And essentially what you have are the three nodes. And if I go into the demo setup, essentially you have an OSC tenant, an open security controller tenant, which is seen as a, if you think of it as a controller node. And this is just for the demo, right? But it really depends on how you're gonna be deploying it, what the topology looks like within your environment. And where you wanna place that particular control, right? So you can see the OSC tenant has the security controller in place. And you see all the virtual IPS nodes in there, all the virtual IPS instances in there. And the tenant two is essentially, and then you see the two tenants. The tenant one is essentially where you have three web servers sitting behind a load balancer and think of it as a standard web server farm. And tenant two is a compute node as well. But from which we have an attacker sitting in there, from where we will be instantiating some attacks, right? So you see the attacker node over there. What we did was we go through the router onto the, onto tenant one. Why are the load balancer and towards the web servers, right? And it's a basic demo at this point in time. But essentially what we're showing is we do this, the attack goes through. After which we use the open security controller to insert the virtual IPS at that spot so that you're able to make sure that the attack does not go through and you get the, you get any kind of information that relates to a particular attack. So this is the snapshot of the open stack environment. Those are the three tenants we talked about. And this is really the console of the open security controller, right? I mean, we are in the process of developing this. But what you can see is you see the connections into the, into the WIM, the virtual infrastructure. And then you see essentially the ability to define security groups. Those are basically the components that you're going to be securing within your environment. And then you can, you're going to see the element managers. You know, those are kind of the firewall managers, the IPS managers, things like that. And you're able to, to get to a point where you can define where these controls are going to be enabled, where these controls are going to be deployed, and how you're going to be able to deploy them in a manner that's effective, right? So this is more of an automated process. You don't have to run scripts. You don't have to write scripts for the same. But essentially you're able to state a deployment spec that says for this environment, ensure that you're able to deploy these controls in a manner and such that they're positioned in a specific way, right? And it depends on your topology. It depends on how you want to control it, how you want to enforce those controls, right? What you're going to see is now this is just a security manager. You can see there are no events that came up over there when we were, before we started the attack. And we're going to access the web servers. And it's just a standard script, right? So it's a hello world script. You see that it goes through, no problem.  And you know, it's at this point in time, there are no security controls enforced. And it's basically allowed to go through. And then at that, what we're going to do now is essentially going to bind the controls onto what your target environment is. You go in, you enable the IPS. You have two policies, essentially. Command cannot run. Root can run, but we want to be alerted once root is run. And once you go ahead and bind it and you see it's passed, so the policies are now enforced on there. And we go through the process of doing the exact same thing. We go to the attack VM, attack of VM. And we're going to access the web servers, the compute web servers, right? And you do that, you see, before we do that, no alerts, nothing on there. And then we go through the process of saying, hello world. That's allowed to go through. No problem. It goes through.  You can still see the hello world script running over there. So it's been blocked, and it's not been allowed to go through. And this is a control that's been inserted by the security controller, right? And as soon as that happens, you see an alert come up in the security manager. And the very same thing for root attacks, root, right? I mean, it's not prevented. But we want to be alerted every time that's run. So the exact same thing. And you see those alerts came up. The intent of the demo, really, and we tried to do a live demo. We had some technical issues yesterday. And a couple of us just put this together. We put the video together. So the editing is not really the best. But honestly, what we were trying to show is the ability to insert a security function in a manner that's automated into your environment based on your security needs and security policies, right? And this is with an IPS, and it can be done with a firewall. It can be done with a WAF, things like that. And so it can be extended to other security functions as well. So that's kind of like a snapshot of the demo. And we'll go into some more details. We'll go into some architecture details on Meadonet and then some of the architecture details in the security controller. OK. So I'm going to tell you a little bit about how Meadonet software defined networking and service chaining enable Open Security Controller to insert devices, IPSs, between workloads and attackers. But before I do that, I just want to point out that, again, service chaining is just an enabler. If you were to try to use service chaining yourself, you'd still have to take care of virtual machine management, placement on specific compute nodes, failover if that compute node fails, and load balancing of workloads onto service VMs. So all of that is done by the Open Security Controller, which makes the solution really cool. So what I'm showing here is, on your left, you see a workload VM with the standard neutron port level firewall and its network. I'm not showing you the rest of the network, but it's just a regular topology. So you don't have to touch your topology at all. And this is going to be very important. We don't want to have you modify your topology in order to get layer 7 security. Instead, Open Security Controller insists on a layer 2 bump in the wire model. And that means that we can transparently inject the service VM in the path of the traffic. So before anything starts, the Open Security Controller, in a way that Tarun showed during his demo, will deploy service VMs according to your specifications in the UI. So for example, do you want one per rack, one per compute node, and so on. But at this point, I'm going to assume that the service VM is already placed. Just want to point out that the service VM has two networks. On the top, you see a management network. That management network is used for communication from the service VM to the security controller. And a few things are happening here. The service VM can report on traffic, but will also take configuration. And that's what the management network is for. On the bottom, you have a service data network and a port firewall that are just set up automatically by OpenStack. In practice, neither of those is used because we only are using the service data network to get a port, which you can't get without a network in Neutron. So at some point, you decide that a specific VM is part of a workload that should be bound to a specific security policy. Press the button. You say, protect my VMs with this security policy. So what the open security controller will do is it will send a message first to the service VM saying that a specific VLAN is being bound to a security policy. Now, the service VM is ready to protect your workload. The next thing the open security controller does is it does the service chaining. Now, I have two icons there because at the moment, it's a Meadonet-specific API. Not proprietary. It's open source, but it's a Meadonet API for doing service chaining, not the Neutron service chaining spec. So we're going to implement that later, and that's why I have OpenStack in there. That's what we'll eventually do. But after that call, service chaining logic is inserted between the VM and the rest of the topology and between the service VM and its data network so that when traffic arrives from the internet or from another tenant or within the tenant is arriving towards the workload VM, the service chaining logic intercepts the packet and adds a VLAN header that has a tag which signals the policy and has the PCP bit set in order to let the service chaining logic know in what direction the packet was traversing. And we'll use that in a second. Now, the service VM, and usually this is maybe this is a SIN packet. It's not really usually an attack packet. Off the bat, it's usually let through. And the service VM would send the packet right back out of the same port. So you see this is a one-armed appliance. And the service chaining logic at the service VM recognizes, thanks to the PCP bits, that actually the traffic should be re-injected but not just re-injected which direction it's going towards the VM. And hence the packet is put right back where it was. So the packet hasn't been modified. The VLAN tag has been now stripped. So the packet looks exactly like it did before and it went through. So layer 2 bump in the wire model. Now the VM responds, for example, to that flow. And the packet is, again, intercepted by the service chaining logic, redirected with the same policy tag, but PCP bit set to say that this is leaving the VM, going away from the VM. And again, the service VM, it goes through the service VM. And if allowed, returned, intercepted again there. And it continues on its path as if it had never been intercepted. Now at some point in time, the service VM, sorry, the flow is established. So the service VM is just in the path and sees all the packets and is allowing them. And it's important that it continues to see all the traffic. Otherwise it wouldn't be able to block. Attacks can happen at any time in a flow. A flow can look innocent. And then later, there can be an attack injected. So the service VM is the bump in the wire. And then an attack occurs, like that cmd.exe in the URL. And that's recognized by the service VM. The service VM blocks the flow. And packets in both directions are stopped. The VM is protected. And then, of course, the service VM will also alarm and send. Depending on what kind of IPS you're using, it will report to the SIM. So well, very briefly, if the service VM fails, there are ways to simply have all traffic stops. But there's a policy that's more lenient. And that it allows that if we can detect that it's failed and the policy is more lenient, meaning it fell open, then MetaNet will just allow the traffic right through, because we don't want to block if the service VM is down. OK, I think it's over to you. So this is Manish now. I'm going to just spend a couple of minutes to talk about what we are doing with our security controller. There was a tech talk about this yesterday. You can find the video on that. But I'm just going to walk through real quick. So the role we're trying to play here is of a software-defined security orchestrator. And there's like four key things we're trying to do for the security function. One is automation and orchestration of the security functions. So you saw an example in this Surner use case where they are trying to do this for the IPS as a bump in the wire. But we can also do this same thing for web application firewall, for any kind of other action firewall and other application delivery controllers and so on. So the idea is you have some kind of a policy that you want to deploy for your security, for your workload, or your infrastructure. And then this is how we're going to do the automation and orchestration. The second part is the coordination of security policy. So it's key to understand that we're not going to start managing the policy, but we're coordinating it with all the security function managers. So you're still going to be interacting. For example, the screen you saw with the demo where the network security manager, which is IPS manager, still manages this policy. But now, as far as coordinating those policies, like which workload, how do you insert all of that? And then the third part is interacting with the virtual infrastructure and the SDN controllers. So you'll see some more details in the next slide on this. But basically, we are trying to get to a point where we can take this orchestration, as far as the security service is concerned, and then interact with the open stack multiple things and also for the SDN controllers. And finally, to do the scale out of security. So in the cloud, scale out for your workload. But then you also want to be scaled out for the security. For example, if you have a web store with 10 VM, and then your auto scaling needs it to go to 1,000 VM. But your policy says that it needs to be protected by a web application firewall. So you need to be able to auto scale your security also. So this is kind of like a very high level. I just spent two minutes on this. It's really on the right bottom you see the virtualization. This is where the open stack layer is. You have the multiple SDN controller examples over there. And then you have on the top, you have the application intent. The applications and also the user intent and the policies. And on the left bottom, you have the security function manager. This is where the IPS manager, next gen firewall, application delivery controller, and so on. And then you have the virtualized security function itself. So this is where the, from multiple vendor, multiple security functions. And the security controller, what it's doing is it's taking the policy or the intent from the top. So you have the UI. You saw some of the screenshots of the UI during the demo. But of course, there is an API, which is a Northbound REST API. So you're actually going to do things like you're describing how you want the security for your workload. So you can deploy. You saw one tenant attacking the other tenant as an example, but you can have multiple multi-tenant, multi-BNF type of policies. And you're just coordinating all these policies using your connectivity to, basically, through the API interfaces. I show the interfaces from the number two to the SFC. So with the SDN controller, if they provide a SFC API, we'll use that. Otherwise, we'll use a lower level API. And then, of course, we're going to use the Neutron SFC. But then also, you have the number three, which is the interaction with the virtual infrastructure itself. And then four is where we do the policy coordination. And five is actually where we are interacting with VNF to get some of the telemetry and other information so we can do auto-scaling and things like that. There's also a control plane channel or agent that we may make it optional, because if the security function manager can do all this, then we might not have to interact with the virtual security function. So that was just a very high-level kind of overview. And you can find more about this project on intel.com forward slash OSC as an open security controller. So I'll let Tharun summarize. So in summary, you saw a couple of things that we really touched upon. We had an enterprise user who had issues in trying to effectively secure East-West traffic. And we saw the components that came into play with the internet providing the SDN layer and with the open security controller being able to orchestrate the security controls in an automated manner. So the challenge, like Joe talked about and what was really stressing about is really two things. Like one was the tromboning of the traffic, which effectively introduces latency into any kind of environment. If you're going to have to go all the way to the edge to any kind of security inspections or security enforcements. And then the East-West traffic, being able to have visibility to that kind of traffic and be able to see it in a manner that you can take decisions on. We have some future work. I mean, so the open security controller is a project that's evolving currently. You will see additional VNFs becoming part of the ecosystem. You'll see additional controllers being part of the ecosystem. And we are also looking at figuring out how this can work effectively with container orchestration as well. So that's some of the future work that's coming in. We'll probably have more updates over the next few months. But if you have any questions on the implementation, on the problem statements, on what we've done, please feel free to ask us or you can always connect with us at a later point in time. We might have a question. So you tied the controller, the security controller, to Neutron or how do you... I think somebody talked about the steering traffic. So how does that tie into either the SDN solution or the Neutron, the native Neutron? Sure, I can explain it. Is it a plug-in or what sort of thing? Yeah, there's multiple ways, but let's talk about the mid-on-net implementation. Right, so the open security controller allows for multiple SDN solutions and for service functions as well. In the case of the SDN solution, we have an interface that's called for the bindings. So essentially, the open security controller has a bit of mid-on-net code that will reinterpret the service chaining in order to bind the service chaining. So the Neutron part, so the open security controller will directly call Neutron to do things like create the management and data network for the service VMs and to launch the service VMs onto that network. But it will call the SDN controller in order to do the binding. Now there could be a generic service chaining plug-in for the Neutron SFC API. However, there are some kinds of things that you can do in the plug-in. So for example, we have the ability to detect the attacker that's behind a source NAT. That's not something that you can do with the Neutron API. So there's still some specific things that the controller can do. And so actually, we're doing that right now where there's a function call there that can unmask the attacker behind a source NAT. And so that's something mid-on-net specific. Yeah, that's actually a good point because the implementation that we have with CERNA, there's a six-tuple implementation where we won't get that level of granular detail where we are able to see source IP, destination IP, source VM name, the destination attacker name, things like that. So we get into a more granular analytical information that can be acted upon with this implementation we have. Maybe I would just add that I think it's likely that you'll see in the future that there will be a Neutron SFC API generic controller that you can use in the open security controller. And that will work just with generic Neutron. When you set up the open security controller to talk to your open stack, you're giving it the open stack API endpoints. And you choose from a dropdown the controller plug-in that you want to use. Did you mention, did I get this right, that mid-on-net or the security solution needs to do some change in their coding to tie back into maybe misunderstood the controller? There's the controller plug-in. That's a Java package that runs on the security controller. And then of course, mid-on-net had to develop service-chaining APIs. And there is an analytics piece, which is we basically have to go back to the flow records to find the flow that has the source net. So when we're doing the unmasking of the attacker that's behind the source net, we have to go to a flow record database. Yeah, but from an integration standpoint, we're getting to a point where we have standard APIs, APIs that you can call, and integration should not require you to fundamentally change any code within the controller. Is that the question? Yeah. For the security solution or vendor? Yes, for use integration to the open security controller. That's correct. Thank you. Thanks for the question. Another question to Pino. Can I enable traffic mirroring with mid-on-net? You mentioned the service-chaining only. Just some strange case. We're working on it. Both in the controller and in mid-on-net. We do have port mirroring in mid-on-net. We have to enable it in the controller plugin. It is absolutely something that we're working on. Yes. Thanks. Hi, so my question is about the fundamentally, if I look back, you're trying to achieve two functions. One is the service-chaining, which is inserting security or service in the telepath. The second is life-cycle management of the security. So if I look at the first path, there are a lot of options which are coming up, right? For example, the OVN would provide some sort of native service-chaining capabilities. If I look at different SDN controllers, they have their own capabilities of how you can insert services, right? So I see sort of a multi-dimensional world there, right? With one more option being added here from your side. And then as far as the life-cycle management is concerned, I would think that many security vendors are gonna do it themselves. And of course, there are different environments, like public clouds where you go, where it's gonna be done in a different way. So I'm just trying to understand that, I mean, I like the idea fundamentally, but I'm just trying to see the ultimate success of this idea in a universe, which is, there's so many options out there. Yeah, so first, the service insertion part is a very easy answer, because as you can see here, and Pino described a little bit of that, like how we're doing a mostly a plugin, right? So if tomorrow, if there's a Neutron or any API, because you're just providing the intent from the top on how you want to insert those security functions, and that we can use so that part we're not really trying to do, we're just gonna use whatever's available. So now, your second question about security orchestration, that's a very interesting question. I don't have a slide here, but yesterday I did the Tech Talk, more detail on this, where I show that we want to do this, so we're already working with the security VNF vendors. So we're working some of the industry leading security VNF vendors, and one of the challenges that they're seeing is, they have this barrier of entry, right? The same thing that you described, they have to do many, too many integration with all these different permutation and combination of the security, for the virtual infrastructure, where you have to do with opens tag, with different flavors of SDN. Sometimes you have to do even with the different flavors of service insertion options, right? You can do bump in the wire, you can do simple service insertion, or you can do the actual SFC, like advanced SFC with network service header and all that, right? So we're trying to make it easier for them to integrate with all these different environments, and we're also gonna go work on additional integrations with other cloud, and so we have some integration with vSphere NSX, but also going to work more into container as a service, and we have not done any work for any of the public offering, or like, for example, Azure or Google Compute or any of that, but it might be something if we need to, we might do it in the future, but at least right now it's not on the paper, but the main function for us is to be able to provide an integration point and also a security control point where you can have this across multiple data center for multiple VNFs, and so kind of building this as sort of something with the understander. So eventually we want to take it as a open source project. Yeah, I think the key issue that you heard was the multiple integration points, right? I mean, so I mean, for an SDN vendor, if you can provide a single integration point with which they can access multiple VNFs, I think we're making life easier for everyone, and vice versa, right? So for a VNF vendor, one integration point wherein all of a sudden they integrate into multiple SDNs, multiple SFCs, that's basically the problem that we're trying to solve, and it's an issue that we've seen with Enterprise and things like that, but they want to do this in an automated manner, and that's essentially what we're trying to get to. Maybe I'll add a point. We've spoken to other vendors of security appliances and load balancers, and generally they don't want to build a controller. It's quite an investment to build this orchestration, and actually then we have discussions, well, are you going to build the orchestration? Should I? I'm providing the service chaining. Who should do that? Because each of us, I want to focus on SDN. This orchestrator is not really my specialty, and likewise, the security provider, the load balancer provider, their specialty isn't to provide this kind of orchestration either. So then we see that some of the vendors have developed heat templates to deploy their appliances, but it's not as flexible and dynamic as this kind of orchestration. Thank you. You're welcome. Thank you. Do we have any more questions? You do. Can you go into a little detail on how you monitor the health of the McAfee IPS, since it's in transparent mode? Sure, actually it's very basic right now. So at the moment we are just monitoring the interface being up. So that's at the level of the hypervisor. So what we have in the works is to actually do things like ARP or other kinds of health check. But right now it's very basic. There's just the interface being up and seeing traffic through it. It's very difficult, I know. What about load balancing if there's multiple IPSs? Is that something that... It's not a current capability. It's not a current capability, but that's part of our service chaining, sort of on our service chaining road map to be able to choose. So we have layer four load balancing in Meadonet. It's stateful. This is not layer four in that you're not actually modifying the packets.  But it has to be stateful so that you keep going through the same thing. So we've clearly thought a lot about it, but we haven't started working on it. And this is a project in its infancy, to be honest. I mean it's really something we started effectively moving into testing and integration about three or four months back probably. So I mean we're still in our early stages with this. Thanks. Thank you. Okay, no more questions? Thank you so much for your time and attention. Appreciate it. You guys have a good day. Thanks everyone.


All right. Good morning everyone. Welcome to the decentralized internet and privacy dev room here at FOSDEM 2018. My name is Tristan Nito. I'm a French citizen. My email address, which is a decentralized protocol which I encourage you to use, is tristanatnito.com. I work for a company, a French company, a French startup called Cozy Cloud. Well, I'm here to welcome you and introduce the day. The day is in two parts. The first part is focusing on decentralized internet. And the next one is more related to privacy. We will see that actually it's the two sides of the same coin. They have a lot in common, and this is why the organizers have suggested that we merge the two tracks in the same day and in the same room. I will discuss today the relationship between code and architecture. First, a few words to introduce myself. I have spent 17 years with the Mozilla project. I was a Netscape employee when it started in 1998. That's really, well, we'll celebrate in two months, next month we're going to celebrate the 20 years of the Mozilla project. I think I went to FOSDEM the first time in 2002. When I left Mozilla, I wrote a book called Surveillance. It's only in French for the moment about decentralization and privacy and the role of free software in all of this. And now I am with Cozy.io, Cozy Cloud, which is a personal cloud, free and open source software version of it, to empower people and give them more privacy with their personal data. I will go through with my slides with important people, in my opinion, in our fight. The first one is Lawrence Lessig, famous for creative commons and other things, who famously said back in 1999, which is, well, old enough to be interesting, that code is law. What he meant by that is that developers and programmers, the people who write the software, decide what the software is going to do. That's obvious. But because digital technologies are taking over the world, and because, well, as Mark Andreessen said, software is eating the world, the people who write the software actually decide what the ordinary users will be able to do with the things they buy and use in their everyday life. So another person I like to talk about is Spider-Man, who obviously said that with great power comes great responsibility. As we write software, we have the responsibility to decide for other people what they can and cannot do, which makes us actually writing the law, or we decide what people can and cannot do. Another person which I have to mention, of course, is Edward Snowden. So Snowden has said a lot of things and has, as a whistleblower, given literally thousands of documents to reporters to talk about it. But if you had to sum up really what Snowden is about, is that because we give all of our data to a few very large Internet companies, we actually make economically possible mass surveillance. The NSA wants to have an eye on everybody on Earth. That's their wireless dream, but they can't do that because it's too expensive. But if we equip many of these people with smartphones, and every people with their smartphones store their data within the hands of Google and Apple, then suddenly it becomes economically feasible to do mass surveillance on half of the planet. It's still expensive, but they do have big budgets, and it's a lot easier than tracking every one of us. So centralization is a very dangerous thing because of that. Someone who's less famous is Mitch Kapoor. Mitch Kapoor is known for proprietary software, initially Lotus123. He invented it, he made quite a big pile of money in a process, but he's a great guy. He was a founder of the EFF, Electronic Frontier Foundation. He was also very helpful in the birth of the Mozilla Foundation. He actually gave quite a bit of money, his personal money, to help the Mozilla Foundation take off in the early days. And Mike said architecture is politics, and really if code is law, architecture is politics. The way we design systems is actually decided how they work and who is in power. If we centralize everything, we're deciding that a handful of people control what everybody else is doing. If we decentralize, we empower people locally to do what they want. This is why decentralization matters. Centralizing data is concentrating power in the hands of a few corporations. And if we realize that we are centralizing more and more data and software is eating again and again the world and that technology is everywhere and is going to be worse tomorrow than today, then we need to make sure that technology is decentralized and is open source so that people have the power and not just a handful of very large corporations. We can invent a better world and actually we already started. As I said, Mozilla is going to celebrate its 20th birthday this year. So it's not a new idea, it works. I don't know if you've tried the latest iterations of Firefox, but it's amazing. It has done amazing progress. Of course, GNU Linux, even from the data center to your pockets and smart phones, the kernel has done wonders and Wikipedia because well, Wikipedia. And this was just the beginning. We need to make sure this continues. And this is why the work that we do today, meeting together, discussing the interest of decentralization and privacy is really important. And today what we are going to discuss are these many aspects? How can we measure decentralization as you probably have heard of? You can only change what you can actually measure. And so we need to measure if we are making progress or not. We need to create decentralization technologies. We will need to build privacy-improving technologies. We need to fund because of course, you know, it's easier when you have money and a business model or at least funding. We need to encourage people to use these technologies in order to make an impact. And overall, we need to create a movement of people that want to decentralize the Internet and want to make tools that enable privacy. So this is one of my favorite slides ever. It's up to us to build the GNU Internet, which is decentralized and private. And this is what I encourage you today by attending these sessions. Let's build the decentralized and private by design Internet that the people need and want. Thank you very much.


The House of Representatives has condemned the insistent attacks by bandits and communities in Cardona State, urging the Federal Ministry of Humanitarian Affairs, Disaster Management and Social Development, and the National Emergency Management Agency, as well as other relevant agencies, to immediately provide relief materials to the affected victims in Zangokataaf local government area. The House also urges the federal government to immediately deploy more military personnel and intelligence operatives to assist and complement the operations of the Safe Heaven Risk Task Force in Zangokataaf and other LGA's in the southern part of Cardona State. Furthermore, it urged the government to establish a military command battalion or brigade in Zangokataaf. Thank you.


Your masculinity is no longer required. Masculinity is optional. It was born out of necessity, but it is no longer a necessity for 90% of us. We didn't make this choice ourselves. We didn't choose this personally, but our role as men is outsourced to small groups of men. And a lot of it is automated and done by machines. You can work to become stronger and faster and more competent. You can get a black belt. You can acquire enough tactical and firearm skills to be comfortable and to thrive in a war zone, but most of you will probably never use them. When I talk about the tactical virtues and the perimeter, I tell men to imagine what would you guys need from each other right now if the zombies attack? And I think that's an easy way to realize what, you know, how men judge each other in the past. When you had to survive, but the reality is the zombies are not coming or they're probably not coming.  And it seems like it should, but it never does. It keeps limping along like a drunk that should have passed out hours ago. And it may keep limping along and getting dumber and more annoying for the rest of your life. It is possible, even likely, that no one will ever need you to step up and be a man. Today, if you want to be better at being a man, it's because you believe that being good at being a man is better. Because you believe that becoming better at being a man is the best way to become the best possible version of yourself. Because you believe in your own potential, because you believe that you can rise, life in this empire is easy. The way of men is hard. Becoming better at being a man means making your life harder for men to become the best possible versions of themselves. They need resistance. Pressure is required. And eventually I realize that this pressure really has to come from other men. Masculinity is a muscle and to some extent muscle defines us. We get more of its stock without doing anything at all. And if we don't use it, it atrophies. But if we do apply resistance, it gets better. It becomes more powerful, more beautiful in accordance with the nature of what it is. And personally, I can't think of anything more beautiful, more right than seeing a man rise. And seeing him overcome resistance and become what he is. To see him become heroic. To see him do something that he didn't know that he could do. To see his force is hard and nerve and sinew. To serve his term long after they are gone. And to hold on when there is nothing in him, except the will that says, hold on. I mean, I can't think of anything better than that. I can't think of anything higher. That's religious, that's spiritual to me. To seek resistance, to work, to become better at being a man. I believe that that is a higher path. No one was telling me that I had to do that. No one was forcing me to do it. I went out and found a group of men to hold me accountable to that ideal because society does not care. It makes people uncomfortable, actually. And most people would prefer it if you just learned to love yourself just the way you are, whatever that is. But my point here is that the way of men is a choice. Masculinity is a philosophical value. It may not be a necessity, but it can continue to be a noble ideal. All right, when the way of men first came out, a philosophy professor came to me and he said,


The Uncharted series has become synonymous with the term cinematic game, being designed as an interactive version of Indiana Jones with us playing the role of protagonist. However, it draws from a lot more than just Spielberg's classic franchise. Take Uncharted 3, this opening bar brawl that breaks into a bathroom seems reminiscent of a similar scene in Casino Royale. This chase sequence through the city streets of Yemen shares the intense pacing and cinematography of the rooftop chase in the Bourne Ultimatum, and the level inside a cab-sized ship comes straight out of the movie Poseidon. This goes without mentioning that the general thematic overlay of the story was influenced heavily by Lawrence of Arabia. Naughty Dog, to their credit, do an incredible job of lifting many of these cinematic inspirations and melding it with interesting gameplay, creating a pulsating sense of adventure that they describe as an active cinematic experience. However, Uncharted borrows more than just specific scenes, themes and scenarios from cinema, but many of its more general properties. Cut scenes are filmed with the same cinematic flair, set pieces drive much of the pacing of the whole game, and it also uses a fractured version of the three-act structure that has become standard in modern cinema. Chase sequences, dynamic camera composition, cuts, and in-media-sres openings like in Uncharted 2 all play a role to make it feel cinematic. So we see not just thematic inspiration, but mechanical adaptation when it comes to defining what a cinematic game is. Uncharted was far from the first game to be overtly inspired by cinema though, with the moniker for most cinematically inclined designer going to Hideo Kojima. Much like Uncharted, Metal Gear Solid's cinematic inspirations are obvious from the outset. In interviews regarding the many influences of the Metal Gear series, Hideo Kojima cited the guns of Navarone, The Great Escape, and the protagonist of Escape from New York, Snake Pliskin. Each of his games draw from different source material, with Metal Gear Solid 1 being the most infiltration heavy. Metal Gear Solid 2 took on a much more meta dimension, invoking classics like 2001 and Space Odyssey to tell a subversive tale of postmodern inversions. Metal Gear Solid 3 is a love letter to James Bond, Mission Impossible, and Rambo, and everything from the lovably cheesy opening title song Snake Eater, to the snappy dialogue between Big Boss and Paramedic as they muse about classical cinema show Kojima and his team's love and appreciation for film. Again though, let's look past the surface level inspirations. The Metal Gear series is notorious for having extended cutscenes, once more directly lifting the cinematic language to do its storytelling. The opening of Metal Gear Solid 1 has the credits rolling on screen as you play it, replicating a convention of cinema, and the shifting camera angles off the game, whether it be when you turn around a corner or literally adopting the first person view, show some of the mechanics of the cinematic craft. Once more, we see both thematic and mechanical inspiration being drawn from the cinematic art form, and the Metal Gear series is one of the most beloved franchises because of this. The strength of cinema is that it can generate tightly defined emotional experiences, inventing a framed reality as it were, and leverage tools like camera angles, cuts, and cinematic composition techniques to convey themes and ideas. The saying is show, don't tell, and much of the greatest cinema can communicate its ideas without even saying a single word. The strength of games though comes from the fact that it is an interactive medium, with the expression of preference being do, don't show. You see the central conflict here, cinema leverages precise authorship, whereas games are ostensibly interactive, and so in many senses, simply replicating cinematic techniques can be counterproductive. Metal Gear Solid 4 was a fantastic game, but one of the most enduring criticisms offered were the absurdly bloated cutscenes, taking agency out of the player's hands for sometimes hours at a time. QuickTime events became very popular for a while, thanks to games like Shenmue, which are instances where the player effectively taps a button to do something interesting. Again though, these are widely condemned in gaming for removing player agency. Finally, camera techniques and cuts are somewhat constrained in their use in gaming, because ultimately, games need to be playable and functional. However, cinematic techniques can be used to enhance gameplay and storytelling, and so drawing inspiration from cinema can actually be transformative. In Joseph Maselli's book, The Five Seas of Cinematography, he cites camera angles, cuts, continuity, close-ups, and composition as the central tools of the cinematic language. And we can see how games leverage different forms of this vernacular. Fixed camera angles and cuts in Silent Hill actually heighten the sense of tension in the game. The original God of War had fixed camera angles that frame the action perfectly to make you feel a part of an epic cinematic adventure. Devil May Cry, on the other hand, has a controllable camera, making you the cameraman of sorts in a quasi-Kurosawa samurai film. Shadow of the Colossus uses wide shots to create a sense of awe and disempowerment in the face of a vast, unknowable world, and close shots are pervasive in games like The Last of Us to create a sense of intimate character. Cuts are used not just in horror games, but also games like Thirty Flights of Loving, which uses this filmic technique to destabilize their sense of space and time. Playing with time is something that was explored with movies like Memento and Pulp Fiction, and games have also tried their hand with these techniques. Whether it be the stylized detective game Return of the Oberdin or the disjointed narrative in a game like Her Story, single shots are seen as some of the most technically difficult to accomplish in cinema. But games are actually leveraging this technique now. Hellblade uses a single shot to reinforce its theme about how people suffering from psychosis view themselves from the outside, creating a kind of disassociation. And the latest God of War uses a single shot through the entire game, seamlessly transitioning from cutscenes to gameplay to create a powerful, immersive trance. Much like gaming, cinema sought after legitimacy for the longest time, and it took a fair while for that to happen. Starting out as a derivative form of photography and theater, cinema commenced as kinetoscopes with no story, then moved into action scenes, silent films, and then feature land formats with birth of a nation. It wasn't until the golden years of cinema, dating around the 1930s, where we had seminal films like Citizen Kane, Gone with the Wind, and Casablanca that the potential of the medium finally shone through. People realized you could convey powerful biographical surveys, emotional themes, and pulsating action all at once, finally establishing it as a viable art form. In the post-war era, cheaper production, portable cameras, and a growing diversity of filmmakers led to even deeper thematic content. Through directors like Desika, Kurosawa, Godard, and Bergman, cinema evolved from being about no story and superficial emotions to broader thematic emotions that encompass the wide range of human experience. If this sounds familiar, this seems to mirror how most art forms evolve. Video games are often dismissed as children's playthings, and have yet to establish themselves in the eyes of many of the public, much like what cinema and then later television and comic books would struggle with. In his famous dragon speech, Chris Crawford implored developers to create wider thematic content than just fun engagement and challenge. And now, with the proliferation of indie games, a lower barrier to entry in game design, and more diverse crowds enjoying gaming, we are getting more rich thematic experiences in conjunction with more conventionally gamey games. Some argue we are still waiting for our citizen cane to truly establish what the medium is capable of, whereas others claim we have already had our equivalent. It just exists in the guise of great gameplay, like in Tetris or chess. In his GDC talk, cinematic games are dead, long-lived cinematic games. Matthew Weiss presents what he sees as the history of cinematic influence in games and where it needs to go in the future. The well runs much deeper than Naughty Dog and Hideo Kojima, with old licensed properties like E.T. and Tron having gaming equivalents in the early days. However, much like how games based on movies tend to be horrible to this day, lots of these games were just cash grabs, which has replicated the themes of the movies without considering unique interactive adaptation. We then are games like Dragon Slayer and Dragon Slayer, which looked literally like animated movies, but the interactivity was so minimal, so it has to be irrelevant. They functioned more like choose-your-own-adventure books, with very little in the way of traditional mechanics. Finally, we got fully realized worlds and myths and the cinematic aspirations of games like Metal Gear Solid and Resident Evil. Ultimately though, he argues that we need to adapt the world, themes and ideas of cinema to the gaming interface, preserving its best elements, but transferring its meaning into interactivity when possible. Further on this topic, in his talk, Narrative Mechanics, Daniel Bowen articulates how the relationship between passive observing and interactivity has evolved over time, with movies being fully passive, games like Tetris being fully interactive, but games like Dragon Slayer and Otherworld and Pac-Man having more hybrid structures. Games ever since the introduction of cutscenes have relied on the crotch of non-interactivity to convey their stories, instead of using interactivity itself to convey meaning. He then articulates how a game like Virtua Fighter functions like interactive cinematography, as the story comes from the mechanics of the fight the player is participating in, blending storytelling and gameplay. How do we use interactivity to create cinematic gameplay, though? If we take the example of a fighting game, we can see the mechanical contrivances modern fighters use to create more cinematic play. As we mentioned, the rounds, mechanics and context all create a kind of dramatic play space for a cinematic fight to take place. Tekken 7 has a slow motion mechanic that slows down the end of fights, highlighting a John Woo-esque kind of moment right at the climactic sequence. Additionally, it has a mechanic called Rage that gives the person losing additional damage, keeping the fight tense until the end. This is no different to rubber banding mechanics used in racing games to increase the dramatic tension of a race. Now we begin to see how game designers can use systems and design to reconcile the divide between authorship and agency that we identified as fundamentally conflicting between cinema and games. If we take an uncharted set piece, we see how the dynamics of player constrained by the pacing, the world design, enemy placements and tension. And if the player wavers too far from the script, it's a proverbial yell of cut every time you die. You can think of the act of play as a kind of performance for someone else who is watching the game. The famous train sequence in Uncharted 2 is perhaps one of the greatest set pieces in gaming and what it does is have the player go on a looping track until certain actions or reaching a certain location triggers a new sequence of the level. Each play through is slightly different but the possibility space is still tightly defined so the overall impression of the level comes across as similarly pre-authored. What does this all have to do with cinema, you ask? Well, the point of cinematic gaming as far as I see it is to leverage the tools of game design to create the illusion of agency and authorship all at once and having that fit into a thematic structural or mechanical analogy to the cinematic medium. Set pieces work brilliantly because they constrain the play space tightly. Boss battles feel naturally cinematic because they usually have escalating stages and a precise set of actions you need to do to succeed. Escape sequences, chase sequences and time constrained platforming all feel cinematic because everything feels tightly coordinated with the whims of the designers. Take the style system of Devil May Cry 3. It rewards you with points for playing like a creative trickster, switching up weapons and combos and what this does is effectively make you a stunt actor and cinematographer. If you take the framing of the first boss fight with your brother Virgil, the slow movement at the start gives way to a frenetic pace by the end and the cutscenes that play afterwards highlight the continuity more publicly. Virgil seems straight out of a samurai movie whereas Dante seems more at home in a John Woo film with his absurd improvisational antics and dishonorable gunplay. Other games adapt different conventions of cinematic genres. The slow motion gunplay of Hong Kong cinema can be seen in Max Payne's bullet time mechanic and the improvisational fight scenes of a Jackie Chan film can be seen in the fights of the Yakuza series. Again, the systems and framing of all these games incentivize players to play a particular way, getting the fights to feel pre-authored even though they preserve a sense of agency. However, we can also try managing things in the back end of games to further reconcile this divide. Alien Isolation is a lovingly crafted homage to Ridley Scott's seminal films which pits you against a singular xenomorph as it stalks you around a station. To adapt the movie to a game, the designers used an AI director in the background that observed the tension of the player based on proximity variables to manage when the alien would appear. The future of cinematic games will most likely involve AI directors and procedural AI tools to create more dynamic cinematic experiences. Reimagining the cinematic art form in an interactive medium might seem daunting but it's clear there is still much we can learn from cinema. Take The Last of Us. Its cinematic influences are equally as obvious as uncharted. The father and child relationship in the road and the nature reclamation post-apocalyptic trope popularized by I Am Legend. However, the designers of The Last of Us also cited eco as an inspiration and this shows fairly clearly in the bond they try to establish between Joel and Ellie. One chapter in particular, the Winter Chapter, highlights how games can draw from both the cinematic and gaming languages to create an emergent experience that is more than the sum of its parts. This chapter has you switch between Joel and Ellie as they try to find one another whilst being hunted by cannibals. The violence you invoke as Joel is a metaphor for the love he now bears for Ellie and the stealth sections as Ellie highlights the disempowerment she feels in this harsh world. However, the cinematic interludes that punctuate this section only enhance the meanings conveyed by interactivity by framing the stakes, resolving the dissonance, switching between their perspectives and ultimately showing how they come together. The chapter feels like a virtuoso performance that blends games, cinema and television to create something that is both derivative but utterly unique. Ultimately, my argument is that we should view interactivity and the cinematic language as tools we can use to craft unique experiences, all while recognizing the inherent strengths of both mediums. When we say a game is cinematic, I don't think it just means theme mechanics or remediation, but also the implicit recognition that the arts are blended in some sense. We also don't have to be constrained by the limits of cinema either, and we can devise new templates and frameworks that work with the unique language of interactivity. Regardless, in the same way that cinema evolved from a pure mechanics base to an emotional medium, then to one that generated an incredible array of complex themes, games shared this progression as an art form. Every art form borrows from the past when it tries to explore what its unique language is, but what establishes an art form as unique is what it can do using its own internal vernacular. However, blending the arts and borrowing from the past also gives us hybrid experiences and puts an emphasis less so on the medium and more on what artists can communicate.


Good morning folks, Steve Rhodes coming to you live from the shores of sunny Delray Beach, Florida. This is your Lebanon update and we've got a slightly mixed bag out there. That mix is coming from the Dow, the old US indices trading to the downside. It's off about 37.1 tenth a percent. Otherwise, the other US indices are trading to the upside. Now the S&P is basically flat up two points, one tenth for the Nasdaq 117 points, nine points for the Russell that's a half a percent, one and a half percent for the Summai is 54 points there. Trends up one percent. The gold is up four bucks, that's two percent, two tenths or a percent. Silver is up 48 cents, that's two percent there. Lights we crude is off seven pennies. Natural gas up three cents, trade out at 287 and the 30-year treasury, four ticks to the upside, 128.01. Let's take a look at what all that means. By looking at that nine panel market update chart, we begin with the ES mini. What we have here is your good old fashion consolidation with inside profile levels. The bottom of that profile are support 43.62, resistance up at 44.75. Spot volatility still remains below, it's 50-day, exponential moving average, still rising but below the 50-day and therefore it is really the wind is at the sales and it gives an edge to the buyers of the bulls out there. The NQ does have a teeny sequential top out there and prices consolidating with inside its daily profile. Now that daily profile range, we've got two different levels, we use the black background charts right here and that's up at the resistance is up at 15.370 and support is down at 14.950. Now, if you look closely, I'll just simply expand out the chart, you'll see that there is a new weekly profile that is attempting to form. This profile is above the prior profile, that's a bullish signal from a weekly standpoint. This profile is wrapping around the prior daily profile out there, so we could be looking at just a further consolidation continuing. Now, if price would have closed below 14.950, we would say price would make a run for the 14.840 level, 18.845, I'll get it out, 14.845 is the bottom of the profile on the white background charts of the Ninja Trader charts out there. So that becomes a real key area of support. That's if we see a close below 14.950, if you take a look at the US dollar index found support at a prior swing point, trade them up profile suggests a change in trend to the upside. We've got a new profile attempting to form inside of gold, 192560 being support, 1956 being resistance. Folks, stay tuned for the Trader Zed Show, but if you're up to start your Monday, please have a magnificent one. We'll look forward to speaking with you again soon. Take care now.


Ladies and gentlemen, welcome to Articulate. It is Jake explaining words of my choosing to Paul. He cannot say the word. He cannot say words that rhyme with the word. And he cannot draw the word or make sounds. He has to describe them.  Ready to go? Yes. Off you go. OK, if you want to, you've got passwords for websites. But if you want to make it more secure, you add this in. A to the PS? I don't know. So you log in, you get an SMS or something, and that's called? Oh, two-factor. TwoFA? Yes, yes, you said it. OK, the fans of Vim really hate this text editor. Fans of Vim. Emax? Yep, thank you. OK, on a joypad, you've got the analog sticks, but you've got another thing there to do directional stuff. The D-pad. D-pad. Ha. Thank you, Serma. OK, so at the end of a line, you will sometimes leave some punctuation. If you're doing an array, you can miss one of these out on the last item, but I like to leave them in there. A comma? Yeah, but it's kind of just hanging around there, isn't it? It's sort of like. The trailing comma. Almost. It's kind of like sort of hanging off the edge there, isn't it? It's just sort of. I have no idea what this is. So if you were sort of holding on to a cliff edge, you would describe it as like, well, I'm really doing this thing. I mean. OK, so it's got two syllables. The first syllable is something like an American would say if they're not wanting to properly swear. So they'll say this. Oh, man. This is not a good explanation, I'll be honest with you. OK, a comic book character in the UK as a Scottish comic. He's desperate. Dan. Right. Dangling. Thank you very much. Excellent. Oh, wow. Dangling comma. So you've you've you can call these in JavaScript. Functions. Yes, but but sometimes sometimes you just do that straight away. And immediately invoked function. Yes, yes, excellent. Thank you very much. OK, so in we have a.window you've got the window variable. You've got the self variable. A new standard was made to join together. What level this thank you very much. All right, so if you were, say, in the late 90s and you really wanted some music but didn't want to pay for it, you would use this. Software. Kazar. Oh, nearly. Keep naming them. Oh, what was it called? Oh, no, it begins with an S. No, OK, so if you had a very short sleep, what would it be? And Napster. Excellent. Thank you. All right, so we've got Chrome, but like if you want to use the nightly, it's called this. Canary. Yep, excellent. So if you're starting a project with a set of files, you would call it this. It's also the name of a CSS framework. All the sites look the same because they all use this set of CSS. Bookstrap. Correct. OK, so we Blink came from WebKit, but WebKit came from Conqueror. And what was the? .html. Yes, absolutely. And we're out. Oh, wow, some of those are absolutely. I'm like miles away, but I could basically hear you sweating. Oh, so I was really struggling with the dangling comma. I just couldn't. I couldn't think of any of the. I thought I took you into Lintas. I've called it. I call it the trailing comma. Yeah, I call it trailing comma, but dangling comma works as well. Yeah, that's that was a good one. I looked it up. That's that's what that's what the rule in pretty is called. I'm just saying. Oh, fair enough. Just saying. Fair enough. Today I learned. Well, chaps, well done. OK, we're going to play another game of charades. Sirma is going to be describing to Jake as always. He's not allowed to make any kind of noise, draw words or letters in the air or now the letters or any of that kind of stuff. He has to say completely silent and describe the word of my choosing to Jake. I've sent the word across to Sirma, but he hasn't seen it yet. So he's about to see it for the first time. Try and describe it for one of a better term to Jake and Jake's going to try and guess it. Let's get ready, gentlemen. Are you ready for? Yeah, yeah, yeah. OK, on your marks. Get set. Let's go. You're welcome. I just disappointed Sirma. Two words. First word string. Yo, yo. Spiral. Circle. Web. Web. Second word. Web bundle. Web package. Oh, web. So it's like build. Web, web builder. It's not a bundle of web. Web tools. Web, web builder. Web construction. So. Web construct. Keep going. Web construction. Web constructor. Web builder. What are you doing?  You need to work on that. That's your fault, Sirma, not mine. That's great. I can insult him, and he can't even talk back. He's like, Sirma, you're really bad at this. You're dreadful. OK, so we've got it. Are we doing back or but? But second word. Second word is. More versions of the word but, I think he's going for it. Web bottom. I mean, I only know the rude words apart from web.   Really not getting this. So we've got. OK, so we're talking, right? We've got a big old web arse. A web arsenal. A web arse.  I'm not enjoying myself right now. What would be an American way of saying arse?  Right, what's he doing?  Web assimilate three syllables. Web architecture.   I don't know.  I'm not having fun anymore. This was fun before.  Wait, wait, he's got it. No, I don't. I've got web assem. I'm kind of like repeating what you're saying. Web assembly. Yes. No. That was, I hate everything because that's so obvious now. An emotional low point or high point, depending on who you are. I would like to say well done, but I think well done, Surma. We'll leave it there. OK, so it's time for a Wikipedia race. The idea is fairly straightforward. I start Surma and Jake off on one particular page of Wikipedia. And I give them another page that they have to get through by clicking on the links around Wikipedia. So the starting point that they have here is the Chrome disambiguation page on Wikipedia. So this is the Chrome page. So if you just type Chrome into Wikipedia, it'll ask you which Chrome you're talking about. And that's where they're starting. They don't know where they're headed yet. I haven't told them. But you'll be able to see on screen both of their browsers. And the idea is the first one to get to the target page wins. Does that all make sense? Are you happy? Are you clear? I'm not happy, but it is clear. I was going to say are you clear? Not necessarily happy. All right, the page that you are going to go to, and I'll be obviously watching along, and all the best to you both. The page that you need to get to is Empire State Building. Oh, thanks, mate. Oh, OK. OK, right. I've got a plan. So it's straight into the browser. Yeah, yeah. So you can take a look at it. Yeah, OK. And you're allowed to search, apparently. Yes, Control-F is allowed. Yes. OK. All right, so Empire State Building, right? Yeah, Empire State Building. So if I remember correctly, the Empire State Building is in New York. It is. United States. Serma's got a great plan here. Yeah, well, I'm trying to do the same thing. Serma has arrived. Oh, mate. That was good work. OK, from Margaret Hamilton. Your target page is Arctic Monkeys, the band. Arctic Monkeys. Oh, my word. Interesting first choice there by Paul. Ah! Come on. We must have it. OK. I see. Why do some of these not have links? This is really annoying me. I'm not even sure what it would be classed as. This is so upsetting. I haven't even left them. I'm thinking. OK, Paul has made it at least across the ocean. Yeah, I'm stuck on. I have also. OK, I am now going to. The Beatles? That's close, but not quite it. I know. I'm thinking if I can find points of. Where are they from, Arctic Monkeys? Are they Sheffield? I don't know. Yes, they are. Oh, that's some very generous information sharing from Jake's side there. It was another than it helps me, because I'm stuck. I'm stuck, I'm stuck, I'm stuck. We have arrived at Sting also in terms of music. I know, I know, and I'm still desperately trying to think. So I have some famous. In the meantime, Jake has arrived in Sheffield, but it doesn't seem to be very helpful. Come on, I mean. Spice Girls, also another good shot. Again, I'm just hoping that somebody somewhere is going to reference the Arctic Monkeys from one of these famous musicians. I mean, the Spice Girls are infamously inspired. Why does the Sheffield? You got it. I was like, why does the Sheffield page not list the bands from Sheffield? Like, there's loads of good bands on Sheffield and clearly not on quite the right Sheffield page. For what's worth, mate? You can't get to Sheffield from the Arctic Monkeys, mate. You just click it. There you go. See, and now I'm on the proper Sheffield page. I bet it's like... I bet the Arctic Monkeys... There they are. Ah! What? That was good knowledge.   It is time for a checkulate. Gentlemen, are you ready? I'm already sweating. I'll take that as a yes. I'm already in game mode. I'm just concentrating. All right.  On your marks, get set, explain. OK. Oh, oh, Serma. This is, if you did brain surgery on something to... And then the second word would be a kind of bird. A kind of bird, flies at night and it's known for rotating its head all the way round. An owl. Right, that's the second word. The first one would be brain surgery to kind of... Oh, the lobotomised owl. Yes. OK, it's the standard's body. W3C. Correct. OK, it's a really old programming language from like 1950s, 1960s. It's the kind of thing you think of mainframes. Coreball. Correct. This one would be an old way of connecting to a monitor to a PC, for example. Oh, VGA? Slightly newer. DVI. Right, now expand it to what you'd actually call it. It is a DVI what? Plug, socket, cable. Keep going. Yes, there you go, DVI cable. DVI cable. Oh, Surma! Right, an old way of archiving that you'd have done on Windows. A WinRafit. Yes, brilliant. OK, yeah. Right, the standard that you write all your markup in. Yeah. But then add a letter on the front that's, again, a little bit on the older end. The standard that I write all my markup in? So what do you write your markup in? What do you write your markup in? VS Code. No, as in... Text. Yeah, but what's it actually known as? The standard for writing. You've got JavaScript, CSS, and... Common mark. JavaScript, CSS, and what? JavaScript, CSS, and HTML. Right, put another letter on the front. XHTML. Another one. Keep going. It makes it exciting and moving and... Oh, DHTML. DHTML. Perfect, perfect. Right, now you know what you do, thing and thing and thing, and that's really annoying. So there's a new operator that lets you just check. Oh, no! And it's a question mark. It's the Nullish coalescing operator? Yes! Brilliant. OK, Apple have a connector of this type with a... Lightning. Keep going, another one. Oh, a Thunderbolt. Perfect. OK, going back to the standard's body, there's a different layers of readiness for specs. Editors draft, there's perfect recommendation. That's it. Excellent. Right, the one that's up from Uno is... Duo. Brilliant. And... Well done. Well done. Oh! You did very, very, very well with those. There were some lucky stabs in the dark there, like with Koval and whatever. Like, I was expecting to have to list like a ton of all programming languages, but yeah, that was... I think DHTML was surprisingly difficult to land. Yeah, I was thinking about SHTML and all of that. Yeah. But you crushed it with...  I was very... That was very... I've never heard of it. What is that? I need to go on... Do I need to Google that? I'm not sure. It's a CSS selector. Star plus star is called the lobotomized owl. Today I learned... Ladies and gentlemen, we have another Wikipedia race coming up right now. Ah, good shaps. Ready? Yes. Your target page is Standard Deviation. Standard Deviation.  Right, I was hoping there'll be something about mathematics, but there isn't. So let's go with JavaScript. Math and... Ah, I see. We're doing exactly the same thing. There's code samples. Very helpful to find other mathematics-related articles. Yeah, but it's not really helping because they're not linked to the word math or math. I mean, that would be... Oh, no! All right, I'm going to try... I see both participants are engaging in wild control effing. Yeah, this is hard. We have arrived at Java, which is not that big of a... I went to Java and then I came back because I really am struggling. Hang on, I've got to go to Standard Deviation, right? Jake has arrived at Lua, which is also a questionable choice at this point. Reading about the syntax of Lua. Ah. Ah, we are slowly abstracting from concrete languages to abstract concepts. Maybe, maybe this is the way to go to... Why is...  This is it. I'm in the Department of Computer and Science University of Cambridge. It's my duty to say, who knows? Paul... Whatever! Paul is still comparing languages... OK, OK, OK. OK, I thought you got it then. Um, no. Have you... Ah, looking for the word math and the article about math and L. That's... Yeah, but that was fine. I've gone to Mathematics, Standard. Oh, come on. How do you not have Standard Deviation in Math... That is a good question. Maybe something worth editing on the Wikipedia page. Oh, we have arrived. Bazaar statistics, that seems like it's very close. The pressure is on for Jake. Standard Deviation! Where's my mouse cursor? Yes! Oh, that was... No! Such a close call, but it was just fast enough to deny Jake his only chance at winning. Yes!   Oh, I'm so happy I denied you the victory. I mean... Oh, finally. Tough, good fight, good fight, good fight. I think this one is complete rubbish. So you have to get to the Wikipedia page, landfill, off you go. Ah, rubbish? Yes. Okay. Okay, I'm going to go with... I am just like impressed at how quickly some of my moves around pages. I can see why I just lost this terribly. Okay. What are your strategies? I'm trying to... Oh, I'm not telling that. I'm not gonna... Well, that makes me a very boring video. Let's all just sit here in silence until one of you finds the page. I'm trying to go via agriculture. But for some reason... Oh, yes. There is no dedicated link. Landfill, got there. What? Oh, I'm so happy with that. Tell me your path. How did you do it? Tell me your path. Okay. Let's go backwards. I'm gonna have to rewind this. I'm actually quite pleased with this path that I went through. I went to 2.0, went to JavaScript library, to JavaScript, to V8, the JavaScript engine, figuring garbage collection. No way that worked. Oh! So that then led me to the disambiguation, because it has a disambiguation click at the top. So I went to the disambiguation page, the top one, garbage collection or waste collection is part of municipal waste management. Brilliant, great. So then I went to the waste collection and there is landfill. That's incredible. That is a path I would not have thought would ever work. So you deserve that win. That was what it was. Yeah, it was absolutely amazing. I unbelievably chuffed with that one. Yes! Well done. So we have been filming these little interstitial videos all day and we are running out of ideas and patience. So we've come up with a final game. A final game and what we're going to do is we're going to see how long we can not blink for. Was that the correct grammar to use? Not really. But the words were all there. You just have to make them work for yourself. Don't blink any of us for as long as possible. If we miss a little mini blink, then, you know, I'm sure everybody will hold us to the high standards of honesty that we expect from ourselves here. Absolutely. I'm trying to get in a quarter of blinks.  I wonder if the same thing applies to blinking. If you hyper blink, you get... There's going to be somebody out there who's going, that's the worst thing to do. They've all completely sabotaged our own attempts.  Yeah, that's not helping. Are you ready? I think so. Yes, I'm ready. Three, two, one, go. Oh, I kind of went for a huge eye open at the start there, which I feel like I might have... I blinked. Well, you've got to be pretty sure it's something. Yeah. Well, my eye is twitching. Moving your eyes is fine. This is really hard. Oh, you would think this would be easier than this, but my eyes are like properly stinging now. I just enjoy watching your frozen faces staring into the camera. The light is drying out your eyes as well. It is, because obviously to film this, we've got a huge... Well, I've got a huge light right there. It's like, oh, I blinked, I blinked. I've still not blinked yet. I think I haven't, anyway. Oh, yeah. That was the nicest blink I've ever had. Unless I'm much mistaken. I don't think I blinked there throughout. I'll be interested to... I might just watch that back for myself at some point. It turns out that you have a recording that you can re-watch on loop of you. I'm just blown away. This might be one of the most uncomfortable gifts we can make. Just staring and judging. Well, we're definitely out of ideas then, so... Yeah. Yeah, that's enough from us.