Hello, I'm Casey Shelton and I'm going to be talking to you today about our efforts to implement a reference policy for the SMAC Linux Security Module. SMAC is a mandatory access control security module and it implements a mechanism called simple separation where we simply separate objects and subjects with different arbitrarily defined labels. It's an offspring of the Bell and Lopodula sensitivity, Bible integrity, and it follows very closely classic Linux security policies. Now, if we want to compare SMAC to SC Linux, what we find is that SMAC has fewer entities that it actually is concerned about. SC Linux wants to provide act controls on just about anything you might think might be considered security relevant. SMAC, on the other hand, is simply a subject and object oriented access control system. It doesn't concern itself with things that are not subjects and not objects. This gives SMAC considerably coarser granularity of specification, which tends to make the specification simpler. If, for example, you want to send a UDP packet on SMAC, you have the sending process is the subject, the receiving process is the object, and their single operation, single access check. On SC Linux, if you want to do the same operation, the sending process sends information to the socket, which sends information to the port, which sends information to the transport, sends information to the interface, and that goes back up the stack from the interface to a transport, a port, a socket, and finally to the receiving process, giving you an opportunity to make access control checks or security checks in general at each of these transitions. This is a finer granularity and it has its advantages, but it tends to be a bit more complicated to describe the transition. Now, if we want to compare SMAC to App Armor, what we find is that while SMAC is a complete system implementation, that is, all subjects are controlled by SMAC, all objects are controlled by SMAC, all accesses are controlled by SMAC. Under App Armor, an application may be given a profile to exit and how it behaves with regard to specific path names, but it's not all the objects on the system, it's not all the processes on the system, it's just the ones for which you have created profiles. Now, this has a lot of flexibility to it and has advantages, and if you're only targeting particular things, it's certainly advantageous to be able to do this. But it's a very different mindset from the all subjects and all objects mindset of SMAC. SMAC, as I mentioned, it is accesses between subjects and objects, it's not a privilege system. It does not implement any kind of notion of privilege, simply a matter of, can I do this based on the SMAC policy? Now, SMAC works in conjunction with the Linux capability model in regard to exceptions to the SMAC rules. Administering the SMAC system, for example, requires you have CAPMAC admin, which will allow you to modify the policy configuration or to set SMAC attributes on objects or subjects. CAPMAC override allows you to override the SMAC policy. So, for example, if you have CAPMAC override, you can access objects that you would not be able to otherwise. Now, SMAC is based on a simple rule-based scheme, and the basic rule is that if the labels match, you're allowed access, and if they don't, you don't. Now, there are certain cases here where we need to have exceptions to this. The system defines a set of labels that are used for explicit purposes. The first of these is the star label, which is the asterisk. Any subject can read and write to an object with the star label. Very useful for things like DevNull and DevZero. It has to be used very carefully, very judiciously. Another one is the floor label. The floor label is useful for things like the root of a file system or a system binary. All subjects have read and execute access to objects with the floor label. And, of course, if you have the matching label, you have access to that, too. Now, sometimes you want a mundane label to be able to have some other kind of access to objects with another label. For example, if you have an apple subject and you have an orange object, you can specify that the apple subject can read or execute access to the orange object, thereby allowing you to compare apples and oranges. With subject labels, we have special behaviors for some of the system-defined labels as well. A subject with the hat label is able to read any object on the system or has read access to any object on the system. Useful for things like backups, virus scanners, etc. A subject with the web label, which is an ampersand, is allowed to write to any object. Now, it turns out processes are not allowed to have the web label. This is only used in particular network configurations. Access modes are another important thing. SMAC doesn't introduce much in the way of different access modes over the standard read, write, execute, and append that are common in the Linux system. In general, these are sufficient in order to implement a very reasonable policy. Now, Linux has some access quirks. We find that, based on the file system rules, that you usually need to have read access in order to do a write operation. This has serious implications when you're writing a policy, because if you require read access and write access, then you have a different mindset than if you only require read or only require write. Packet delivery, on the other hand, is a blind write. You can write a UDP packet from one process to another and never even know the other ones there. Signal delivery, we have that as configurable under SMAC, because it can have it either a write or an append operation. If you have it a write operation, then it's the same access control as would be on a packet delivery. If you have it an append, then they're different. And if you want to have a policy that's different for sending a signal than for sending a packet, that can be very useful. And actually, the Tizen system does that. We also have an interesting situation with read locks, because you can have a file open for read and set a read lock, which is the write operation. And although that might seem harmless, it's a covert channel. You can have a side channel attack based on read locks. So we have a separate privilege, if you will, of an access mode, which is lock, and you can have a set that separately. And although read implies lock. Now, we have to be very much aware that because we have some of these access control quirks and because most applications were not written with mandatory access control in mind, that our security model is going to have trouble on occasion dealing with legacy applications, of which we have nothing but. And we need to come up with a threat model because if we don't have a threat model, well, we don't really know whether we've actually achieved anything with our access control policy. So back in the old days, back when mandatory access control was introduced, the threat model was fairly simple. It was that you had a group of people sharing a computer and these people had a variety of clearances and the information they were dealing with had a variety of different sensitivities. And it was imperative that information be segregated by a sensitivity so that users with a particular clearance couldn't see information they weren't cleared for. Today's model is a little bit different. In fact, it's very different. Today's model is we're not worried about the other person using the computer because quite frankly there isn't another person using the computer in most cases. What we're concerned about is the fact that there's this bunch of malicious software out there which is designed to go out and find information that it shouldn't have access to and provide it to some nefarious human being somewhere who's going to buy mink coats or some other items with the value they get from the information. We also have a lot of flawed programs out there, programs that were not written with security in mind, programs that can be convinced to do things that they shouldn't oughtn't. And sometimes you need a malicious program to tweak them and sometimes they're completely exploitable just by accident.  Sometimes we refer to these people as security researchers. Sometimes we refer to them as using other less reputable names. But the threat, the real threat that we have today is software that is capable either intentionally or by accident to get information that you don't want it to have, you don't expect it to have. So there are some complications that we have to deal with. Things like shared directories slash Etsy, which used to be where all of the configuration information was dumped. Some applications you want to have look at the information, sometimes you don't. We've evolved now, Lib has become a repository for configuration information. Some of which is shared, some of which is private to a particular service or application. We have socket-based services, which use the IP protocol security model, which is to say none. They're responsible for doing it, doing any access control they want themselves. We also have dynamic resource creation. You mount a file system, all of a sudden you have a whole lot of new objects. You unmount it, you mount it somewhere else. Same objects, different place. Somebody plugs a camera in, you have a whole new device, a whole new set of access control considerations to worry about. So when you take these things into account, we have policy that we actually have to address not only is a dynamic once up front. We have to make sure that the system is capable of modifying itself and its configuration as it goes along. So now we're going to create a reference policy. We're going to have to make some tough choices here. Because we know that there are things we're not going to be able to do and things that we're going to have to be able to do. And we're going to have to decide how we're going to go about doing things. So the first thing we're going to have to do is choose a use case. We could choose a lamp stack that would be fairly simple, but it wouldn't be very satisfactory as far as a reference policy goes. Reference policy you actually do want to be relatively complete. And since 2023 is the year of the Linux desktop, that makes a desktop a very good choice. We also have to address the fact that reference policies for App Armor and SE Linux are based on desktop systems. They're already in distributions. Desktops are in distributions readily available. So we really have a hard time saying that we're going to do something other than a Linux desktop. So we have some tooling considerations, things that we have to deal with that we're constrained by. First of all, is are we going to use system D? System D is a very powerful tool with a lot of configuration options, but it's also big and unwieldy. So we have to consider whether that's something we want to use. Do we want to use a system generator like Yachto project? Yachto project has certain advantages. It's very useful for a board support project, but it's really kind of difficult to use to do something on the order of a desktop system. And the small distros have a lot of the same problem, things like Alpine. Again, very useful, very small, lesser of a concern. But we don't have all of the advantages that we get if we try to do a full desktop system. We have a reference policy that is less useful and less extensible if we have limited ourselves, constrained ourselves too much by choosing a small distribution. So a large distribution probably does make more sense. So when we look at the big distributions that are readily available, we find that Ubuntu has some real advantages. For one thing, it's commercially supported. Another thing is it's using security module stacking, which is still in development for upstream, but which gives you the very powerful tool of being able to use the out-of-the-box configuration in addition to adding your SMAC reference implementation. Of course, it's free as in beer, which is always a good thing. And really fairly important because we want there to be as few obstacles to adoption as possible. Yes, we looked at Fedora, decided that the RID hat really just does have too much invested in SE Linux for that to really be a viable approach going forward. So on the whole, in the end, Ubuntu seemed to be a pretty clear choice. One of the things that's already been done with SMAC is the notion of a three-domain policy. A three-domain policy is actually a pretty simple notion. It's been used on Tizen, it's been used on an early version of Automated Growth Linux, and it provides a simple mechanism, a simple way to look at the security policy for the system. The three-domain model simply says you've got three kinds of information and three kinds of activities out there. You have the floor information, which is essentially static. Everybody should be able to read it. Nobody is going to be changing it much. It just kind of sits there and everybody can use it. It's safe, but it's just safe there. Then there's system information. This is the system services. The services that the system itself provides. The data that the system needs in order to maintain itself, keep itself running properly. Then there's the user data. The user data is, user might probably be a misnomer for this, but it's close enough. This is the stuff that's outside of the system control or maybe outside of the system control. It's the business logic. It's what the user types in. It's what the user cares about in particular. Now, if there is no user data on the system, you don't need to have any separation. What are you separating out? Well, we trust everything on the system, so why do we need any access control at all? You don't. So that's what's important. That's what we're protecting from everybody else and protecting everybody else from is, in fact, the user data. So we have the three domains. The floor domain, which is essentially static. The system domain, which is all the stuff you have to do in order to make the system work. Then there's the user data, the user domain, which is what the user is in control of and where we expect there to be any malicious activity going on. So when we look at our system, we're going to have to actually have some tools we use in order to actually make determinations about whether we're actually being successful with our security policy implementation. Good news is system D already supports SMAC, so we don't have to worry about how we're actually going to get SMAC running on the system. We have that, but we are going to need to have tools for analyzing our results. And SMAC doesn't have a permissive mode like SC Linux.  That would have failed. Unfortunately, it doesn't actually fail them. So you can't actually tell what path it's going to take in the failure case. SMAC does, however, have a bring up mode. Bring up mode is a little bit different from permissive mode. And what bring up mode does is it reports when access succeeds because of a particular specification. We added that a little bit more in just a little bit here. System D support allows us to write off the bat, identify subjects into particular domains. So we can put system D into a domain. We're going to call that system system D. Why not? Any system service that we want to run with a different label, we can specify that. So we can set the process label on some system service to system something. And user services are already supported in system D because there's a particular service which actually runs an instance of system D for on a user's behest. So we can label that with the user label and say, great, we have a user service now. That's where all our potential emotions stuff is going to happen. And we can also say any services that we want to run as part of that, we can specify explicitly. So we're great. We have the tools. We know we have the tools to actually implement our policy. And when we do this, we're going to want to have some way to determine whether or not what we are going to try is going to work. Snack bring up mode is kind of the answer to permissive mode on SC Linux. But it's very differently oriented. Under no circumstances are you allowed to do things that the rules say you can't. However, what you can do is you can specify the bring up bring up mode and make your mark your rule with the bring up up bring up mode. And this says that when I run the system, if an access is permitted based on this rule, log it. So now I can go out and run the system. And I can look in the log and I can find that in this particular case, a process with the user label access an object with the system D label. And at wanted read access. And here's the file system and the the I know. Unfortunately, that's all available to the security module hook at that point. And here's the name of the process. Ah, so this is the user space system D. And it looked at this particular system defile. Well, I can go look, look that up by I know, find dash item and identify what object it was that is accessing. If I look in my log overall, I can then find all the things that this that this rule allowed that would not have been allowed otherwise. I can then determine what requires access and then I could determine whether or not I want that access to be permitted. And then decide what mitigation I'm going to take in order to allow that to happen. So we come up with an initial rule set that we're going to have our three domains or we're going to have the user domain. We're going to have the system system D and we're going to have the floor. Okay. And what we're going to do is we're going to do complete complete cross access, give everybody access to everybody else and turn on the bring up option. And so anytime I get access to something because of an access control rule. I can find out what object it was and then I can determine whether or not I like that.  Yes, set this in place. Set the system reconfiguration to set these labels and what happens. Well, we run it for a while.  System D has read write access to the floor. The floor actually there's some system processors that get fired off outside of system D. They need read write access to the system D domain and user actually does writing to the floor domain. Oh dear. Well, that's not what we wanted. What did we want? Well, the things that we don't want are cases where when you have two domains, they either they have mutual read write access. Or that or that the more trusted has that the less trusted has more access than the the more trusted. So for example, in this case, we don't want the user domain to have write access to the floor. We don't want that. We need to figure out why why it's doing that. And the system and user domains, they're reading and writing to each other freely. Well, we really don't. It's okay if they both write to each other because they're just sending messages. They're not going to corrupt each other's data. If they have read access. Well, they're not going to corrupt each other's data either. They're just going to look at it. If the user has read write to the system, it can change the files. If the system has read write to the user, that's not such a bad thing because we trust the system more than the user. But what we really don't want to have here is we don't want the user to have read access to the system because they need to communicate in order to use services. And at this point, what we have is a service based system. So what do we need to do? Well, we go look at the logs and find out who's looking at what what objects are being accessed by the user. What is user writing to in the floor domain? Well, we find that there's some pretty simple configuration things that are going to make things a whole lot better.  We can change those and can change the configuration on those so that they have smack labels that are appropriate to the things we're going to use. So we can set the smack label on a device that's only used by the system. And we can set the smack label on a device that's only used by users. These are home directories need to be labeled with the user label so that when we log on the configuration logs that are all set to the right label, the same label as the user. Okay, that's pretty obvious. There's some mount options we can use on file systems to set up the directories by default in a way that makes them better useful for sharing. For example, mounting slash temp with a star label so everybody can write to it. That's pretty simple. And there's some temporary files we can specify. There's a whole temp file configuration mechanism in system D. So we can set things appropriately. So great, you know, we do this, we go through, make a first pass at some of these configuration things. And then what do we get? Well, what we find is that we've solved the user writing to floor problem. So floor is now reading from user and writing to user so that we still need to deal with that. But we still have the problem here that system and user have mutual right access. We haven't addressed that yet. Well, gosh, what's the problem there? Why is this happening? So again, we go go look at the logs and what we discover. I got a little bit ahead of myself what we've got. So when we looked at it, we found there's some some things we could do that would really make things things less complicated as far as who's accessing whom. The first one is we could break out. We if we run the the GNOME user user space window system environment as you in user. A whole lot of the accesses go away. So we'll we create a user gnome label. We'll run that that service as a user service. Eventually we'll do the same with you dev and with debus because debus is communication thing that everybody talks to and you dev is actually very, very focused on devices which not everybody else does. So these things can obviously break out. So what happens then when we break out the user? Well, we take GNOME and run it as part as a user part of the user domain instead of as part of the system. Well, what we get is no less access but a whole lot more arrows. Now this isn't really sad really that satisfactory. What is it that we've missed here? Well, again, go look at the logs. What do we find? Well, we find there there in addition to a lot of other things, there are three primary areas. Where we actually find sharing going on in on a grand scale. These three places slash run var log and var var lib apt. Well, okay, just keep what we find is that system D uses slash run as the place where it wants play everybody to communicate. Var log is another place where you've got logging going on and sharing of logs going on and apt is the application database. So if we can make it so if we could control the sharing on these three directories, we'd also have a big win. So how are we going to do that? Here's the good news smack has a notion of transmuting directories. So transmuting directory has the attribute that if the access control rule that allows access to to the directory includes the transmute mode, then an object created in that directory will get the label of the directory, not the label of the process that created. So in our example here, we have three labels writer one writer two and reader. We're going to put them in a direct transmuting directory labeled shared. Well, if writer one creates a file in that directory, it's going to say, Oh, there's a they've got the T bit here in the in the mode. So when I create the file there, it's going to be labeled shared. Same thing for writer two. So now writer one and writer two can share information in that directory that they couldn't share with each other and they don't have to be able to read each other's information at all. Except for what's in that shared directory. Now reader comes in and he's allowed to read that. We don't give him the transmute because he's not allowed to create anything in there anyway. He can now share information, read information that's shared by writer one and writer two without looking at any of their other information. And it's done in an isolated place. It's easy to track and easy to control. So we're going to do slash run. We're going to mount the file system with the transmute with the transmute option. So it's going to give it the label run. We're going to give transmute read write access to you dev user and no, and they're all going to be able to share information in slash run. Again, it's an isolated place for an isolated purpose. Yes, it's possible to put information in there that you shouldn't. But you shouldn't be using information from there that you're not explicitly looking for. You shouldn't just be be running at looking at arbitrary data and run, you know, should when you go to run, you should be going to look for specific things. That's going to solve. So that's going to solve. Now, what about VAR log? Well, user and user know, hey, they're both using this information as well. So most of the information that's in the GNOME that's provided by the GNOME service that user wants is actually in VAR log. So we're greatly reducing the amount of information that user needs out of GNOME by putting them by making VAR log transmutable and giving it the log label. The application installation database in VAR lib app is maintained by the system and the user is going to access that. Now, you could argue that we really want this to have the floor label transmitting that the floor label doesn't work because that would probably be considered a downgrade under just about anybody's definition manager X control. So you don't really want to do that. But this way we say, okay, now user can check and see, hey, do I need to update my applications and get the answer? Yes, you do. And so it can then invoke the service that's actually going to go out and get the new application, new version of the applications. So now we make those changes and we run the system, we gather up the logs, and we discover that in order to make this system work, having broken out D-Bus and Udev from System D, 22 rules are required in order to create this active three domain system. Now, that's not very many. 22 rules are really about enough. You can pretty much understand them, especially when you can go in and say, all right. So, for example, user, user doing it right about the red ones right up here over there. I can look at that and I can say, all right, user and user no. Okay, they read write execute user no my user read write execute. And I'm going to have to look at that some more. But now I can look at the look at the accesses that are actually required. I can run the system with this set of rules and actually have something that that I think makes sense. Now, okay, looking at this, this graph is kind of unpleasant. So we can look at it graphically. Well, looking at it graphically, what do we see? Well, we see that the only processes that the only processes that can write it right onto the floor are the system D processes. Okay, that's good. That's exactly what we want. In fact, if there's if there's anything that is important, that is it. We have user no user and user no. And they can write they can both write to system D. Neither of them can read from system D. So, okay, that's that's pretty good. Now D bus. We may we probably have a little bit more to do. Well, wait a minute. No, he's only reading. He's reading from people from domains to other domains are reading from him. Nobody else is writing to him. He's fine. Okay, same with you dev. People are things are getting read out of there. We look over here at user and user no. And we see they have mutual read write. Well, they're both users. So we're going to have we're going to have come look at that more. All right. So, but on the whole, we look at this when we say that looks like something that I can explain. I can explain why it is. I think that I've got six got an improved security solution here. Now we have to actually step back and remember that we have implicit access from the floor domain. Because everybody can read the floor domain. We don't have to have a rule to set that up. The good news is that we when we look at it, the dotted red dotted red arrows, we see that this really doesn't provide anything. Let's give us any any kind of security concern. The only place that might have security concern is system D being able to read and write to floor. But that's okay. That just implies that it's able to update files in their end system is the one we want doing that anyway. Okay, so that's we're okay here at this point. Now we have to bring in privilege. I say now we have to bring in privilege. Well, we've got the dashed arrows here as well as the dotted arrows here and it's starting to get to be a bit of an eye chart. And we need to be a very concerned about these. All right, because these are privileged accesses that will circumvent the SMAC policy. But now what we see here is we have a system D bus is writing to floor. We want to look into that. Maybe we don't want that to happen. We see that D bus is writing to system D. Again, we might want to system D is reading from D bus floor is reading from D bus. We'll want to look at those. Okay, so floor is also reading from user. We're not so sure about we're happy about that. Udev is writing to floor and users writing to floor using privilege. You're not sure we want we really like that we're going to have to look into that further. And Nome and user are still rewrite access. So there's some particular things we're going to need to track down on this, but still on the whole, the most important access is here. If we ignore privilege are okay. And we think we can look at the things that are being done with privilege and see what we can do about those. See what's most important. And now we bring in the shared data, of course, the that we talked about earlier on that the apt don't the apt label. That's just fine. Yeah, users reading it system D is writing to it. There's no debt flow there. The log is all shared within the user domain between user and user Nome. They both have rewrite access to it. They have rewrite access to each other anyway. And the run domain, the run label. Well, this is all D bus. This is all D bus communications. And although that's something we need to look at carefully. It isn't what we don't. We expect that that's exactly what it's supposed to do. And that's just how it's doing it. So we need to be careful about that and how you D bus is actually used. Can we declare victory? Yeah, not quite. We're pretty close. But we have to resolve things like LD dot SO dot cash, which gets updated by system D by system D processes all the time. And that changes label of system D, which means anything that wants to look at that cash has to be able to look at system D process objects. Generally, that's not necessary, but it lives in Etsy. So that's a little bit complicated. We haven't addressed IP network configuration at all. Which actually turns out to be fairly straightforward. We want to set the mount option for slash run in system D, because it doesn't do that yet. We don't need a mechanism for labeling home directories and we don't want to do what I see Linux does, which is every time it boots, checks and sees if the labels on the file system might be corrupt and relabel everything. We don't want to have to know the label of everything all the time. And we really want to reduce the use of CAPMAC override. There's just too much of that. Things we want to consider again when we look at the data, when we look at the what comes up, how did they bring up? Okay. Do we want to break out? That might actually reduce some of the share some of the rewrite ambiguity that we've been careful to try and carefully trying to avoid. A bunch of other services, modem manager, network manager, account deamon, we may break those out just because they're otherwise isolated and not in the sharing that they do with other domains is actually pretty well under control. And do we want to consolidate user and user gnome because they have mutual rewrite access anyway? Well, there's a couple of things that gnome does that user doesn't gnome is going to have some privileged accesses. So if we have privileged accesses that we want to carefully guard having that as its own domain might still make sense. And of course we have if we're going to get this into a distribution, we've got some work to do there. First off, we need to get their buy in. Second off, we need to make some enhancements to systemd. Nothing major. The patch here, patch there, some of the configuration on slash run, for example, creating an option to initialize the network labeling. Also, minor patches. Systemd configuration, there's a whole bunch of it, setting up, setting process labels to get to start services with, including the user service. Again, that's a small matter of configuration. UDF configuration, not big, but very, very important. And there's some smack user space code, library, and a couple of utilities that we really would want to have on the distribution. Again, not hard, well understood technology, just has to get done. So with that, I want to thank you. I'm Casey, CaseyHeltherCA.com. If you have any interest in participating in this effort or convincing on the effort or telling me better ways to go about doing things, I'm perfectly happy to hear about it. And hope to be working with more of you forward, working forward on this. Actually, we should never get to this slide. That's the Intel logo. Thank you very much.


So as one example of what we've named colligative properties, we can look at how the freezing point of a mixture or a solution changes with the concentration of that solution. So as a reminder, this is what, let me finish leaving this diagram, but this is what the temperature composition phase diagram looks like for, in this case it's relatively proportional for sucrose and water. So if I have sucrose on this side, water on this side, I form a eutectic at a relatively low concentration of sucrose in water, and we have this sort of phase diagram. The important point for right now is to observe that this melting point of sucrose, when I add in a little bit of water, the melting point decreases, it becomes lower. Likewise, when I look at the melting point of pure water, zero degrees Celsius, when I dissolve a little bit of sucrose, that multi-point decreases. So in both directions, as I move from pure substance to solution, the freezing point decreases. That's a very generic or general phenomenon. We saw that same sort of behavior for the magnesium-calcium phase diagram, for the lead and tin phase diagram. Nearly every case will show this sort of behavior. So the behavior that's that general, there must be some fundamental reason behind it, and indeed we can identify what that is. The origin of this behavior comes from the fact that as I move from pure solvent to dissolving something in it, I'm going to lower the chemical potential of the solvent. Let me remind you why we know that's true. We've seen previously that if I want to calculate the chemical potential of some substance in a mixture, chemical potential in the solution is related to the chemical potential in the pure liquid by this term RT log of the activity of the substance. And let me sketch what that looks like as a graph. If I plot the chemical potential as a function, in this case, since we want to talk about solidifying or melting a substance as I change the temperature, I'll make this axis be temperature. So remember that what happens to the chemical potential, which is the same thing as the molar free energy, the chemical potential of anything is the partial molar Gibbs free energy. So the Gibbs free energy drops as the temperature increases proportionally to the entropy, like we've talked about when we talked about Gibbs free energy. So there's chemical potential, let's say, of the solid phase. As I heat the solid up, its chemical potential drops. The same thing is true of the liquid. So here's chemical potential of the liquid phase, of the pure liquid phase. And I've drawn that as a steeper curve because the entropy of the liquid is a larger value than the entropy of the solid. So it's falling more quickly than the chemical potential of the solid does. So now think about what happens when I convert this liquid into a solution. I take my pure sucrose or maybe pure water and dissolve a little bit of something into it and make a solution. So as I, if the substance I'm talking about is water, this is the chemical potential of pure water. If I dissolve something in that water to make a sugar water solution or some other solution, the activity of the water will decrease. So in a solution, the activity will be less than one in a solution. It's less active than the pure solvent. So the log of that number that's less than one, that's going to be a negative number. So this entire quantity is negative. So the thing that I'm adding to the chemical potential of the liquid is a negative number. So the chemical potential of the solution is going to be shifted downward relative to the chemical potential of the pure liquid. So before I draw that curve, let me point out how we identify the melting point on these curves. This point where the solid and liquid curves cross, that's the temperature at which the chemical potentials are equal to one another. So that would be the melting point, temperature of fusion. I'll put a superscript zero or a circle on that melting point because that's for the pure liquid, for the substance in its standard state in the pure form, that's the melting point. What we're interested in is why does the melting point decrease as we form a solution. When we form a solution and the chemical potential decreases, then this curve is going to be shifted downward. It's going to have the same shape but just shifted downward. And what that means is the point where these two curves cross is going to shift to a lower value of the temperature. So this melting point or fusion temperature in the solution is less than the melting point of the temperature of fusion in the pure solvent. So qualitatively we understand now anytime, regardless of whether I'm starting with pure sucrose and I make it impure, I've lowered the sucrose's activity. If I start with pure water and I dissolve some sucrose in it, I've made the water less pure and I've lowered its activity. Anytime I lower the activity, I'm going to lower the chemical potential and that's what causes the melting point to decrease in both of these directions. So at least qualitatively, now we understand why dissolving a solute into a solvent will decrease the freezing point. The next step will be to take that a little further and examine this equation and see if we're going to understand quantitatively how much that freezing point will decrease as I prepare a solution.


Wa kabama na chanao, mwiai y11 hwa, kwentu na naihaka 2 mahi na kwa 1 niye, designated hwiai y21 mahi kuya kwa y11 gandinek mahi nwiai hasto nyama na mahi y11 hwa kwenu nukara kwa kwenu y11 hwa, ukee kta kiputi kwa seno kwa na sepa nikahavu mwe nARKo y11 nengia but we don't want to have all these showing up or maybe we don't want to have one particular item showing up so we want to customise this and make it better for a custom experience for our customer maybe we want to remove particular items for our editor or a subscriber whatever user privilege they have we're able to actually edit this what I'm going to do is I'm actually going to start up a plugin where I'm going to write all this code that we're going here so I'm going to go into my local installation and then I'm going to just open up folder and I'll just call it edit editor editor's guide maybe I don't want this to conflict so I'll drop this in my editor and then I'll set up the file so I'll call this editor's guide dot php and then next is I'll start up our php file and put in the requirements that what press or classic press has okay so the first thing we'll do is write a plugin name call it editor's guide then we'll give it a plugin author with Lawrence and then of course we'll give it a plugin URI and then cool I'll just correct this and then I'll do the sample author and then I'll add a description saying that this plugin edits the menu or edit has and then the next thing that we'll do is we're going to add a version and then we'll start writing our code so 1010 so we'll save this and then I'm going to go into my administration area in the plugins and I'm going to activate our our plugin so I'll find it here then activate it and of course it starts so I found an interesting article online written by a code potent who is a really big about boosting classic press and he talks about how to add a custom utility plugin for your website he goes into detail of how to explain it and you can actually just go to code potent.com to see that so he has also some code snippets of how you can begin and how you can namespace your file and then go ahead to start on it and what you need to do so I would encourage you to go and read that article it would help you figure out a couple of things especially if you have conflicts with your plugin so the first thing that we're going to do in our code as we go back here is we're going to tap into our admin hook which is we're going to add an action and use the default classic press or WordPress setting so we're going to look for admin menu which is our hook and we're going to add a function that we're going to call remove editor settings so I'll just remove editor settings and then we're going to start up that function right here and the first thing that we'll do is that we're going to just test out with one page and we're going to remove so what we're going to do is we're going to use the remove menu we'll move menu function and I'll show you this because it works for all the same so whenever you go to each of these links I just need you to look down here you'll see what we're talking about when you go to the dashboard we see that it's an index.php now if we go to post we see it has edit.php if we go to the media upload.php same for pages edit but it has a post type of page comments is edit dash comments of php themes.php users tools and settings so let's just try out with tools and see how we can remove that so when you go back to your code all you need to do is just add your quotes and say tools.php is what I want to actually remove so at the end we terminate this function and then the next thing we are going to do is just cross talk if this is right yeah so when we save this and go back and reload our plugin in here we see that we no longer have tools section right here in our plugin so the next thing that I'm going to do is I can actually just go ahead and say I will move also the settings which is options.general.php I'll just duplicate this line and make it for options.general.php so if I save this robot reload page we see that we don't have the settings so this is quite important as we go to the next step so you can actually make sure that all these are not even visible if you're going to use a customised system and you can write your own you can write your own menus like I've shared in the video there's a video that if you look up in the information link or if you look in the notes below this video you'll see the link that I've put there you can create your own custom post types and create your own custom menus and that will allow you to have a particular experience as a custom software for WordPress however we can look this up and say maybe we only want this particular function we want this to run only if the user is an editor so we should allow administrators to actually have all those options but we should remove all these options for the editor so there is a function in WordPress which is called current current user can so the capability is usually the person so if you say this person is an editor so what we're going to do is make this a condition and say if the current user is an editor then we should run this particular function so we're going to add the functionality this particular functionality to our to our function so we go to this and add and then we'll just move all these options and move them up so that when we go back to our browser and reload we see that we have the tools and settings right here however if we open up this incognito and go to login as an editor let's click in login so we have our editor as a user just quickly find it in the password so when you login as an editor we actually see we don't have some of those let me just use the post item to make it more obvious so what I'm going to do is here add this extra link and just change this to edit.php and click save if I go back right now in our editor here if I reload we actually don't have posts for our editor so the only thing they can do is work with pages and media so you're able to customize a classic press or WordPress for yourself and use it in your daily and give a particular experience for your users so thank you for watching I'll be sharing more of these little tricks for you keep watching the channel if you like the video please give it a thumbs up subscribe if you haven't don't forget to click that bell so that you get notified when my new video is out enjoy yourself


It's about 12.12, so we'll get started in a minute or so. First of all, welcome. Welcome back to Morrison. It's wonderful to see you here. And a big welcome to Jake Skeets, who's joining us from Oklahoma. A brief thanks to our sponsors, the library as always, to the Arts Research Center. And I want to stress that due to a partnership with them, Jake's actually going to be giving a public craft talk this afternoon at 4 p.m. So if you're able to join us then, Jake will be speaking in the Mod Fife Room in Wheeler 315. I'll mention that again at the end. And thanks to Pegasus Books. Callie is joining us over there. If you haven't a copy of Jake's book, Eyes Bottle Dark with a Mouthful of Flowers, it's really, really exceptional. And you can pick one up over there. And I think Jake will have time to sign afterwards. Lastly, if you could silence your cell phones before we start. So the title Eyes Bottle Dark with a Mouthful of Flowers arrests us. That image, without its context, which I'll try not to spoil, is a little hard to see. There's a face implied, and eyes, and a mouth. But they blur beneath the strangeness of Bottle Dark, the centrist flowers. These elements are in tension with each other, the man-made and the natural. And that tension lands in the human face. The image also sets up a subtle circuit between sight of the bottles and speech of flowers. A post-industrial dark is perceived, but flowers emerge from the mouth. This kind of compression, boundary crossing, and beauty are the syntax of Skeets' book. Some sections are just a few words long, and again and again we see people composed of or turning into landscape. In a poem of passion, his veins burst elk black, or later lightning leaks from lip. But landscapes signifies also, as it always does, the toll of history. In Skeets' poems, this means the train, the truck wrecks, the train crushes, the racist violence, the alcoholism that manifests as the tangible effects of a continuous history of native genocide. In Eyes Bottle Dark, these take on the structuring force of an origin myth. An uncle's fate is refracted throughout the book in many forms. And the litany of the alcoholic dead, bitten by exposure, weaves into the desert they perish in. Woven also into the landscape this book so sensitively tracks is language. Sometimes this manifests as in love poem, as a rapturous word intoxication, an exultation in rich associations. You sip from the delta near my tongue, ossuary deepens at the clavicle. But as this line hints, language is not static, but an agent, an event, in Skeets' poetry. Ossuary deepens, or elsewhere, letters spill out. And the book's interest in dismemberment, decomposition, and wrecking extends also to its thinking about the gap between speech and writing. It's letters, not words, that spill out. Later, the letter T vibrates in the cottonwoods. And in a small poem, which I think I can find here, a small poem, dogs' maul remains like white space does. Notice the whiteness of that space. And yet this breaking apart so often feels like freedom in Skeets' poetry. Alcohol soaks almost every scene of intimacy. And still the language of those moments is breathtaking, elliptical, precisely felt, tender. So make no mistake, the content of this book is tragic. Bottlecap eyes. Despite and because of this, its poems are ecstatic, its images fugitive and mysterious, flowers in the mouth. It's a book that braids elegy and love, remains permeable to others and the world, despite its wounds, and convinces itself and us in poem after poem of the transcendence, however brief, of beautiful speaking. Please join me in welcoming Jake Skeets. Thank you. That was a great introduction. I wish I could catalog or archive the kinds of introductions I hear, because that was really great. Thank you. Humble to be here. Hello. I'm Jake. And I'm honored to be here at this podium. I recognize it from all the YouTube videos I watched when I was learning how to write poetry, coming into poetry. So it's honored to sort of be here. And I'll be reading some poems for you all today. To start, I think I want to read actually some new work. And then I'll transition into the book and then I'll end with some more new work. This one is called Blue Bark. Blue Bark. Wasps formed in a dawn elsewhere from bird or waterlands where pine primordial, where topsoil cribbed mud black mist. Its first skies more blue bark. An everlasting body against the brush. From it appeared the first beetles and a grazing dawn. Burned against cedar water. The brush a lesser yellow all stick and shell. Abalone or corn seed dry sung. Another shell appeared and another. So that poem is in a, I guess, erasure, erasure poem, found poem that I took from sort of general history of Navajo people.  So I just went through and sort of took out phrases and words, sort of recreated in a way that feels more authentically Navajo than not. This one's called Coming Across a Horned Toad. When I saw a horned toad watch a wildfire on juniper, its eyes mattered a pitch and smoldered open.  It leaves horizon suddenly, mountain carried into tongue, its memory veins dusk, bone spur, its moon trail touchlets, another cathedral, another paint coat cracking, another, another. It has a tin can for sky, settled in open prism, a prism between storm platelets and a god. I see still clouds over valley dirt afternoons in December when evening turns a dark shore, everything tall through the pinions. I take notes because it comes black, comes lunar, because the ash altered in spilled morning, because blooms, breathing, a white tree, ropesets, a river's winded teeth, placid silver and ankle deep. Under another holy sky of black dirt, I hear the morning shell blue and there a horned toad, its skin, its flat time, its spine, an arrowhead, pollen, sleet rain. It sings, mouthing a prayer, be holy somewhere. So we'll turn to the book. Some context. This poem mentions two places. So the first is Winderock, Arizona, which is the capital of the Navajo Nation, where I come from. And it also mentions a town called Drunktown, also known as Gallup, New Mexico, which I consider my hometown. And it's the primary setting of Eyes, Bottle, Dark. Let there be coal. One, a father hands a sledgehammer to two boys outside Winderock. The older goes first, rams a rail spike into the core, it sparks. No light comes, just dust cloud, glitter black. The boys load the coal. Inside them, a generator station opens its eye. A father sips coal slurry from a Styrofoam cup, careful not to burn. Two, train tracks and mines split Gallup in two. Men spit coal tracks rise like a spine when Drunktown kneels to the east. Three, spider woman cries her stories, coiled and warped and wool. The rug now hung in a San Francisco or Swedish hotel.  Four, this is a retelling of the creation story, where Navajo people journeyed four worlds and God declared, let there be coal. Some Navajo people say there are actually five worlds. Some say six. A boy busting up coal in Wenderock asks his dad, when do we leave for the next one? His dad sits his coffee down to hit the boy. Coal doesn't bust itself. Drunktown. Indian, Eden, open tooth bone brews this town split into. Clocks ring out as train horns. Each hour hand drags into a screech. Iron, steel, iron. The minute hand runs its fingers through the outcrops. Drunktown. Drunk is the punch. Town, a gasp. In between the letters are boots crushing tumbleweeds. A tractor tire backing over a man's skull.  Go for the fowl with 30 seconds left. Hug their sons after high school graduation. Open a keg. Stab my uncle 47 times behind a liquor store. A bar called Eddie's sits at the end of the world. By the tracks, drunk men get some sleep. My father's uncle tries to get some under long bed truck. The truck backs up to go home. I arrange my father's boarding school soap bones on white space and call it a poem. Like my father, I come upon death staggering into the house with beer on the breath. Mule deer splintered in barbed tendon. Gray highway veins narrow. Push, pull under teal and red heels. A man is drunk staggering into northbound lanes. Dollar bills for his index and ring fingers. Sands glitter with broken bottles. Greens, deep blues, clears and golds. This place is white cone. Greasewood, sanders, white water, red springs, crystal, chenlit, naslini, Indian wells and all muddy roads lead from Gallup. The sky places an arm under near heels. On the shoulder, dark gray, almost blue, bleeds into greens. Blue greens, turquoise into hazy blue. Pure blue. No gray or gold or oil black seeped through. If I stare long enough, I see my uncle in a mirror. The bottle caps we use for eyes. An owl has a skeleton of three letters. O, twists into L. The burrowing owl burrows under dead cactus. Feathers fall on horseweed and skull bone, blown open. So on the cover of Eyes, What a Dark, as it was mentioned, is an Avedon portrait. So Richard Avedon was traveling the western states in the 70s for his book in the American West where the goal or the project was taking images and portraits of people in odd jobs or what he considered odd jobs. So he took photographs of people working in the circus, of beekeepers, grave diggers, miners. And he traveled through Gallup in Mexico. And they actually took this picture there. And the subject is actually my uncle, Benson James. And the picture was taken on June of 1979 in Gallup. An Avedon sort of labeled the occupation of Benson a drifter. But unfortunately a year later, 1980, Benson was actually murdered in Gallup. And so in 1985, when the book was done, Avedon and his team sent a signed copy of the collection to my family. And they received it sort of five years after his death. And they had no idea that he had done this or no idea that Benson had given permission. So they were kind of just like confused that this book sort of showed up five years later of the picture of someone they had lost. And the image sort of took central focus as I was revising Eyes Bottle Dark. The book would have looked entirely different had I not come across it again as returning back home to the reservation and seeing it again for the first time as like an adult. So the book shifted at that moment. So this book, this poem sort of is in response to the photograph. Oh. Drifter. Drift. To drift is to be carried by a current of air or water, but men are not the teeth of their verbs. They pry nouns open with a belt buckle to take a sip. Drifter. A drifter carried by a current of air or water makes his way from one place to another. See vagabond. See transient. See drunk. See a man with shoulder length hair.  See his lips. How still. How horizon. How sunset. A train. Passing through. I try to hug him through the spine. Left on the white space, his face becomes a mirror if I stare long enough. My face charcoaled, pursed, squinting at the camera. Train horn punch shatters the mirror, frees him from the page. My uncle leaps from the dust storm. Sandburst shiver and outflow get at water coughed up. A snake contorts spackled, dark puddle lilac licked by heavy sun off smog sits. Gustrack did up with cold fronts. He sees his body like a dead one. Then as a mirror unbroken, thin as mosquito wing. Clouds glutton rain and tongues rope spun. Best put as desire, as marrow coiled in spine. As question marks unbuttoned, so letters spill out. Wasp eye corners heavy as wind unfurl into him. Gulp on parche, knots into sediments. Legs warp, diamonds wheel among cactus. Lightning leaks from lip.  Virga carried on its back. He turns him on his back before joints explode and into dust. Alkaline, fungi, wild carrot roots, sewn in strata, collect again on teeth. After party. We tank down beer. Eyelids lower and lower. He lets me feel beneath his basketball shorts. Sorrel feels along his thigh. Burrows in our bellies heavy and heavy from rolling rock and blue ribbon. Aluminum ghost coaxes his kiss. Candle left lit. He mouths the neck and lip of another bottle. Rifle cold. My tongue coils on the trigger before its click. Corn beetles scatter out, no longer his bones. Love poem, you stand by your car, man in meadow, now deep white. Slow teeth, slow ice. Fellow night footprints follow through stiff with each crunch in the snow. Frost crystals on my tongue. Your cheekbone cold against my face, a whirring rock, marrow deep. I open the word and crawl inside its spine. Barbed wire, a turbine with dark belly, coil hierarchy. What word, you ask? Your body a cloud flattened in my hand. Your body coiled with mine. Air snakes over ribcage, cracks into powder. I say thorn. I say mouth. Desire is criminal. You being here is criminal. You sip from the delta near my tongue, ossuary deepens at the clavicle. Eyes stutter open, limbs crepuscular over the bed frame. I watch you shower after tributaries, confluence, mineral stains.  Bent wasp hums behind your throats. In the iris, orange whispers into deep yellow slather. Uranium corrodes to spalling black. Speckles on hired horn.  Torso woven with sweat chocks down to bone. Skin can be too loud sometimes. You have the night's bristle. Yolk noose from pinumbra.  Admire black water in your hair. Before you go, I unburry the jaw. You swallow frozen sand. I say you can go now. You can go now. So I'm going to switch over to read some new work. Just so that there's a nice balance. Over the summer I read at the Institute of American Indian Arts and I sort of mentioned there that I would stop or retire from reading from Eyes Bottle Dark. But I keep getting invitations to read from it. It's carried so well for the past few years. It was, you know, published in 2019. I finished it in 2018. So it's been, what, four years now that I sort of been carrying it with me. And it's actually pretty difficult to sort of move into the book over and over again.  And so it's interesting to sort of move in and out of it. And so it takes a lot of work to sort of do that work. So this new book that I'm working on I feel like is a sequel to it. But one that is more rooted in, you know, not things that are not as dark. Sort of this more becoming, learning how to become yourself and learning things like desire all over again. So I'll read just a few more from this new work and I'll switch back to the book. This one is called A Man Called After Dark. One, he crosses night, a field of wild antenna, fireweed and shedscale calling me through television static. His name is After Dark. He calls to me with the sounds of wet alligator juniper tells me my name with the beak break of a crow cocking its head to the south. The dirt beneath has teeth, long lead plant and salt bush, circuits of roots and stem gnarled from the mouth. Two, the man has mercury in his name, his head sky thick, not yet cloud nor rain. His skull is a shelf for white candles, an unlocked gun box, a half full fifth of dark matter, a late evening gnatsung, sweet as dark soil and wooftail. His frame mountaintops the meadow sleep grass as he carries into his pit the smoke of belt burn and nectarines and me. I will learn to love him so erosive it eats through the canyon like pink water. Three, the field stands taller when he turns key to engine and tells me he dances too many sorrows out the open windows of train cars. Jackrabbit's ash and model at the hem sewn with a sunken back road of flesh and hill slope. He drives off dusts the horizon as if chancel, as if sunrise, as if all of it, all its beauty. He said my name, this one I have to prepare for because it takes lots of reading. He said my name. He said my name is really a kiln, a hall of groundwater because a mouth can open into hot vapor. He said my name is actually a riverbed. He said to make of my name a choking of cracked ice. He said to say my name is old water in a ditch. He said to make of my name a peach tree on fire, a palm of pollen. He said my name is really an aquifer, an astrophil, an orchestra of damp tarps and a sheep corral, a downed pole in rock springs. He said my name is as tall as a smokestack. He said my name has a tendency to cause a draft to be a touch of tequila. He said my name is really splintered reed, heavy blue mornings in June. He said to make of my name wildfire smoke. He said to say my name is a rumor, the low beams of a pickup. He said my name is really a sermon of locusts, boulder rust in a river gorge. He said to make of my name a desert garden. He said my name is the one pink evening when you whisper your name to the moon and it whispers back a monsoon. This one is called Anthropocene a Dictionary, and it uses some Navajo in it, but the translation, I think, is implied. Anthropocene a Dictionary. The bech berun, sheep corral, juniper beams caught charcoal in the late summer morning, night still pooled in hoof prints, deer panicked, run from water, olje bena adenidine, moonlight. Perched above the town, drowned in orange and streetlamp, the road back home dips with the earth, shines black in the sirens, it's sails or it's wings. Driving through the mountain pass, dolly mountain bluebird swings out from swollen branches. I never see those anymore, someone says. Dios, wind, wind, more of it, more wind as in to come up. Plastic bags, driftwood defense line. N'hitsui, evening, somewhere northward, fire twists around the shrublands, sky dipped in smoke, twilight. There is a word for this, someone says. De diethlid, they burned it. Codelia, we did this. So I'll just read two more for you. Buffalo grass, barely mourning pink curtains, drape an open window, roaches scatter, the letter T vibrating in cottonwoods, his hair horsetail and snakeweed. I siphoned doubt from his throats for the buffalo grass. Seep Willow Antler, press against the memory of the first man I saw naked, his tongue a mosquito, whispering its name, a hymn on mosquitoes, my cheek. The things we see the other do collapse words into yucca bone, the Navajo word for eye hardens into the word for war. And I'll end with this poem here. The book starts out with a phrase in Denet that reads, Codon, Hojol, Donlay, which can be translated loosely. There's something like from here there will be beauty again. And I wanted to frame it as such because, again, the book is one that deals a lot of things that you don't necessarily want to remember. And I wanted to end with this one because it deals a lot with beauty. And I actually borrow several lines from the poet, D.A. Powell. When I read this line, we all are beautiful at least once. I sort of fell in love with poetry all over again. So I have a big, I just love that poem. I love that line. So I borrowed it, as his poets do. And I feel like it's a nice way to sort of end a collection like this where you're hopeful, end with the idea of hope. And I feel like the second book is sort of the continuance of that idea. So this poem is called In the Fields. In the Fields with Lines from D.A. Powell. We unyoke owl pellets for marrow in desert meadow.  He, still a boy dug from cactus skull, undresses into bark beetles. He unlearns how to hold a fist with my hand, bursts into dandelion seeds. We all are beautiful at least once. Mudwater puddles along enamel, eye teeth blossom into osprey. Our bones dampen like snow melt under squirrel grass. We could be boys together, finally, as milk vetch, tumbleweed, and sticker bush. We can be beautiful again beneath the sumac, yarrow, and bitter water. Yeah, thank you so much for having me here. Oh my god, thank you, Jake. That was really, really special.  And I don't know, I was struck even in the book by your love poems, but I really think some of those, your depictions of intimacy, some of the most stirring I've heard. So thank you. Thank you all for being here. We have books for sale, courtesy of Pegasus, and I think Jake may be so kind as to sign them if you're interested. One more thanks to the library, to Amber specifically, but to the support they offer this program, to the Arts Research Center, who Laura is here, and a reminder that Jake will be reading, giving a craft talk at 4 p.m. this afternoon in Wheeler 315. There's also, in closing, a email sign-up sheet if you wanna hear, stay in touch about Lunch Poems events. And you can revisit this event soon and all our past events on our YouTube channel. All right, so thank you by books, support the poets, and here Jake's craft talk this afternoon.


Hello and welcome to the International Daily Roundup by People's Dispatch, where we bring you some of the major news developments from across the world, our headlines. Trump announces shutting down of immigration in the name of combating the pandemic, Chile's teachers and school staffers protest for weeks to reopen schools during outbreak, Indian leftist organizations protest government move to extend working hours, Benjamin Netanyahu and Benny Gantz in Israel form a unity government with the Root and US oil prices take the freefall go to minus levels for the first time ever. We begin with our daily update on the COVID-19 pandemic. The number of cases around the world has crossed, reached close to 2.5 million as of today afternoon GMT. More than 655,000 of them have recovered and around 171,000 people have died so far. US President Donald Trump stated earlier today that his administration is planning a temporary ban on all immigration in response to the coronavirus outbreak in the country. The move was announced over his Twitter handle where he said that his decision to pass a presidential order is taken to prevent further outbreak and supposedly save US jobs. The US is the worst affected nation with the pandemic with close to 800,000 reported infections so far. Many in the opposition Democratic Party and movements across the country have condemned such a move as an attempted shifting attention away from the supposed inefficiency of the government. They said that Trump is completing his longstanding policy measure of an immigration ban under the guise of a public health and fiscal crisis. The Chilean school teachers union, CPC, has rejected the government's decision to resume schools in May despite the pandemic. On Sunday, President Sebastian Pinera on a national television network announced measures to resume social and economic activities in the country. This is despite the growing number of COVID-19 cases in Chile with more than 10,000 infections reported so far. The president ordered the return of public sector workers to their workplaces starting this week. He also announced a resumption of schools from next week. Mario Aguilar, the president of the CPC rejected a decision and said that it threatens the health of millions of students, teachers and school staffers. He pointed out that the president's decision is because of the pressure put on him by corporate lobbies. According to the CPC, this decision jeopardizes 3.6 million students and more than 400,000 workers in the public education sector. Aguilar called on the parents and student representatives to not send the students to school until the state guarantees that there is no risk of the coronavirus cases increasing. Leftist groups in India have taken out a nationwide protest while practicing physical distancing measures as the countrywide lockdown completes one month. India has reported more than 18,000 cases so far with close to 600 deaths. A countrywide lockdown has been in place since March 21st and was extended to May 3rd recently. The call for the protest was made by the Centre of Indian Trade Unions or CITU, a major trade union confederation in India, along with allied groups such as the Democratic Youth Federation of India, the Students' Federation of India and the All India Democratic Women's Association. The protest was triggered by the recent move of the right-wing Narendra Modi government to increase working hours from 8 per day to 12 as the country's under lockdown. The demands of the protest included urgent distribution of protective gear to medical and healthcare professionals working on the front lines and the immediate halting of retrenchments in the country. The protest also called for the government to take immediate action to mitigate the rise of sudden increase in domestic abuse, direct cash transfers of 7,500 rupees or approximately 100 dollars for the poor, arranging food and shelter for migrant casual workers stranded in different parts of the country and measures to ensure agricultural production without any loss to farmers. Protesters were seen participating by holding placards and signs raising these demands from inside their homes and posting it on social media. In our in-focus section today, we spoke to Manuel Fonseca, a member of the Frantepathia Grante and a medical practitioner about the COVID-19 outbreak in Argentina. Hi, and welcome to People's Dispatch. Today, we are joined by Manuel Fonseca, who is a general internist from Argentina. He is a militant of the health movement Irma Carica, and he is also a militant of the Frente Patria Grande. He will be joining us today to discuss the COVID crisis in Argentina. How is this playing out? What measures the government is taking? And without further ado, thank you. Muchas gracias, Manuel. Primero, ¿Cómo es la situación general en Argentina? Con la crisis de COVID, número de casos, todo eso, se puede juntarnos. Bueno, al día de la fecha, en el total del territorio del país, presentamos poco más de 2,500 casos confirmados de coronavirus, 2,571, para ser específicos. Son 115 las muertes y del total de casos confirmados, la mayoría sigue siendo de casos importados o de casos de contactos estrechos de esos primeros casos importados. Está creciendo el contagio comunitario, pero todavía es minoritario en comparación con estos que han venido de afuera. La tasa de reproducción o la velocidad de contagio todavía está dentro de los escenarios más optimistas que ha planteado el gobierno desde el momento de las medidas más fuertes. Ya llevamos casi un mes de el aislamiento social preventivo y obligatorio, que fue la primera medida más dura, la llamada cuarentena social, que desde el 20 de marzo nos tiene a todos un poco en nuestros solares. Bueno, a mí me toca hacer médico y trabajar en el sistema de salud de la provincia de Buenos Aires, que es la provincia más grande de nuestro país. El balance que hacemos como trabajadores de estas primeras semanas de esta situación tan complicada en el país es que evidentemente las medidas del gobierno nacional han sido muy efectivas, en un primer parámetro que es la velocidad de los contagios y de haber podido hasta ahora cumplir con el objetivo que están mencionados de aplanar la curva, y también en un segundo aspecto muy importante que es el de preparar al sistema de salud de la mejor manera para las semanas que se nos vienen, que seguramente van a ser las más difíciles por distintas razones que tienen que ver con la circulación local, con los climáticos y la superposición con otras enfermedades y con el hecho de que todavía como todos sabemos no hay tratamiento efectivo para este virus, bueno, que la situación nos agarre de la mejor manera. Nosotros también valoramos muy positivamente el hecho de que estas medidas de cuarentena hayan sido acompañadas con otro tipo de medidas del orden de lo social. Saben que no es lo mismo hacer un aislamiento social en los casos como por ejemplo me toca a mí o a muchas personas que trabajamos en el ámbito público que es teniendo un salario fijo y todos los meses cobrando nuestro suelo que más del 40% de la población de la Argentina que no percibe un salario fijo y que vive de lo que produce todos los días. El Gobierno ha tomado medidas para reforzar las jubilaciones mínimas, que son los jubilados que menos dinero perciben por mes y también ha tomado medidas para reforzar las generaciones universales por hijo, que es una medida justamente como lo dice su palabra universal en nuestro país que abarca a todas las familias que tienen niños pequeños y también ha tomado una segunda medida que es la de otorgar un beneficio económico extraordinario a todas las personas que no se encuentran registradas o en un empleo formal o en otro beneficio del Estado como los que recién mencioné que son más o menos unas 8 millones de personas. Es decir que con política y con una incección económica se está intentando contener lo que sería de otra manera un agravamiento de la situación económica y social de la Argentina que ya era grave antes de que arranque la pandemia y que un poco hemos tenido el suerte de heredar de los últimos años de gobierno neoliberal del presidente y de la alianza gobernante anterior. In our next story Israeli Prime Minister Benjamin Netanyahu and his former political rival Benny Gantz reached an agreement to form a unity government in Israel in the wake of the COVID-19 outbreak in the country. The deal for a coalition government was agreed upon yesterday after intense negotiations in the days following March 2 where the third general election in less than a year threw up a split toward it yet again. As per the agreement, Netanyahu will serve as the prime minister for the first 18 months followed by Gantz for the same period of time. The new government will serve an emergency role in the first 6 months. Plans for a long-term unity government are also being discussed. Gantz will serve as Israel's defense minister during Netanyahu's tenure as prime minister. His Blue and White Alliance party will also get key cabinet portfolios including the important foreign affairs ministry. Both Gantz's party and Netanyahu's liquid will be allotted an equal number of portfolios. Netanyahu will chair key judicial appointments despite his upcoming trial in the three corruption cases. The agreement also stipulates that the unity government will not introduce any new laws related to the pandemic in the first 6 months of emergency rule. However, plans to continue and extend the illegal occupation of Palestinian lands will continue. Netanyahu intends to go ahead beginning from July 1 with the annexation of the occupied Jordan Valley. The news of the unity government formation was met with grave concern by Palestinian leaders. Hana Nasravi, a senior Palestinian Liberation Organization official said that Palestinians can expect very serious challenging days ahead. Palestinian Prime Minister Mohammad Chattay wanted that the formation of what he called an annexation government in Israel is the end to the two-state solution. Crude oil prices for the month of May in the US fell to minus $37 per barrel on Monday, the lowest ever in history before recovering to US$1.10 today which is also the last day for trading for the month of May. The fall is attributed to growing fear among the producers that existing demands will vanish once global strategic reserves are filled to their capacity. The prices for June fell to almost $21 US. The prices of Brent Crude used for global pricing were still hovering around US$26 yesterday. This may cause a complete shutdown of oil production in the US which is currently the world's largest producer. According to reports, the rigged production in the US has already come down by 35% in the last few weeks owing to the crashing oil prices which makes production in the US unsustainable. The average cost of production per barrel crude shale in the US is around $23. The companies need double this amount to break even. President Donald Trump stated earlier today that he may consider blocking the import of oil from Saudi Arabia to save the domestic producers after some Republican congressmen made this demand. That's all we have in the International Daily Roundup. To know more about these stories, visit our website peoplesdispatch.org and follow us on Facebook, Twitter and Instagram. Thanks for watching. Let's get started.


Hi, this is Stu Miniman of wikibon.org here with SiliconANGLE TV's continuous coverage of EMC's VSpecs launch and joining me today to talk about the channel in VSpecs are Colin McNamara from Nexus and Don Hoppick from Ingram. Guys, welcome to theCUBE. Thank you. It's your first time in theCUBE. This is where we look to extract information and share it with the audience. First, Colin, can you tell us a little bit about your background and what brings you here? So my background, 15 years in technology from a range of networking solutions, storage solutions, virtualization. I direct the data center practice at a company called Nexus, an integrator. What brings me here today is we've been working together with EMC and Ingram to kind of productize a lot of these spec-based solutions and been very excited about how VSpecs can change our business and change our customer's business. Great, Don? Don Hoppick, I've been with Ingram Micro for 14 years and I lead our data center storage business unit. It's our advanced computing division and lead a team of 30 people that are focused on this market. Okay, so you're the distributor and Nexus is one of your bars? That's correct. How long is the relationship going on there? About four years. Four years now, I believe? Yes, four years. Okay, great. So Colin, Colin, let me throw it back to you. You've worked with Cisco UCS for quite a long time. Absolutely. Can you talk a little bit to kind of the evolution that you've seen and what does this announcement mean for how you deliver products to customers? Well, it's kind of interesting. You know, it was actually me and Scott Lowe were the first people outside of Cisco to get briefed in on UCS and it signaled a change in how every Cisco partner went to market. It used to be about route switch and phones. But it really triggered an evolution of this multi-manufacturer product set that had frankly a bit of drama in the compute space. So how it's changed over the past couple of years, you know, VC company came out and tried to answer a problem of how to productize a solution to make it simple, consumable by the channel sales force as well as the customers. Obviously there's other manufacturers that create similar solutions out there. What I'm really excited about with the VSpecs launch is it provides a middle ground. You know, over the past decade and a half of helping customers design their Cisco technology as well as other storage and systems technology. We've really centered around the reference architecture. Have a centered point of discussion allows us to say, okay, we know this works for this amount of users to this scale. Let's take this as a starting point and add in new requirements. You know, VSpecs allows us to continue selling and designing solutions in ways that we've all been comfortable with selling. So just to follow up on that Colin, it sounds like you really started from the network side of things and expanded into a full data center offering. Is that fair? Yeah. So has your kind of network methodology had an impact on how you design things? Well, oddly enough, engineering is engineering. Okay. Right, so simple thoughts like drawing things, planning, capturing requirements and designing to those requirements I think are our core tenants. There's been a notion, especially before 1999, 2000, I think voice over IP put a lot of network engineers in the position of having to learn uncomfortable and different things. And that trend has been continued over this past decade with server storage virtualization, big data and analytics. I think that, to answer your question though, I take a lot of the fundamental skills I've learned in network architecture and design and apply them to system storage and virtualization architecture and design. Great. So, Don, could you comment on kind of EMC's maturity in the channel space? They've been a long way in four years. All right. And a couple iterations of rules of engagement have helped and ultimately it's best for their business. I think that this is going to be truly a launchpad for the year of the channel like Greg mentioned, Greg Ambulos. How much engagement did you have with EMC from the V-SPEC's architecture? We've been working with them for approximately six months and ultimately we did announce Ingle Micro V bundle, which is reference architecture last year in May. So we worked with that same core group. This is kind of phase two as far as we're concerned. We helped prove out kind of a beta type phase. So it's technically been going on for about a year and a half. Good, Colin. Did you want to comment on EMC in the channel? You know, it's been an evolution. So I think every EMC as a storage vendor is incredibly relevant. It has great products, a wide range of product lines. In the past, I had the direct model and now for EMC to be successful in the long term, I believe they have to really partner with Cisco. Now Cisco's success has been hinged upon their channel model. They have to make that turn and over the past couple years, it's been hard for EMC to do it, but they're making very tough strides. Sometimes baby steps, sometimes large steps like V-SPECs. So Colin, it's my understanding that Nexus really focuses on Cisco for the compute standpoint. Does Ingram don just do Cisco or did you support multiple compute platforms? You support multiple, yeah. So I guess one of the questions I have looking at this announcement is, Cisco was here, they were on stage. Do you have any kind of thought or feedback as to where you see the other compute platforms fitting into this architecture? Well, Ingram micro supports multiple compute platforms, but at the same time I agree with Colin and how EMC needs to leverage Cisco. That's a key. Well, in my opinion, if you look at, what's the problem we're trying to solve here? We're trying to decrease the time to market, lower the risk of design and frankly, make sure that what we design with our customers or manufacturing partners in our vars actually works. And if you look at the Cisco solutions with the virtualization partners as well as with the EMC, it works very well, right? So anything that can help drive the discussion to that, I think it's good for everyone involved. Okay, great. One of the other things we talked about a little bit earlier off camera was really, maturity of how fast we can get these solutions to market, how we design them. Colin, could you share a little bit of, how do we go from gathering those customer requirements to implementing fast? What do you see going on in the marketplace? Well, there's been a move in the market to reference based solutions around server storage and virtualization. It creates a less confusion in the design cycle. Anytime you can distribute information and educate everyone involved, whether it be the customer, the manufacturer, or the VAR on to, here's how things plug together and we know that it works. What it provides is a centered point of discussion where when you come into a design meeting, you're not arguing about how theoretically things could go together. You're saying, okay, we're gonna use this as a starting point. Now we're gonna capture all these requirements and really get to solving the problem quicker. For a VAR it solves problems of shortens the sales cycle. And for the customers, it solves a very specific problem of making sure that the infrastructure that they design isn't a science project. Okay, so yeah, absolutely. A key trend in the marketplace. EMC's playing a strong role here. Others in the market are also delivering these solutions and competing in this marketplace is really gonna help everyone. Absolutely. So, Don, where does the distributor's role, how has your role really changed with kind of these new solutions versus what you did maybe just a couple short years ago? I think it validates our role. Okay. We still do what we do. We support our partners. We're aligning our strengths with our partners and making sure that we're listening to the voice of the end customer and trying to solve those problems. Okay, what's the effect been on your staffing of Ingram? With this announcement? Yeah, I'm saying just over this trend of convergence. Is the skill set changing, the relationships to the vendors, where you add value into the chain and where you charge, is that affected? Sure, yeah, we're adding more and more value. We're investing more and more in this. I'm just a little, like, where's the new value that you gain from this kind of technology? Well, for example, with our Ingram Micro Training Academy, we do Cisco, Citrix, Microsoft, VMware certifications for our customers and for our partners and their customers. Are you, in your training, do you kind of cut across silos for some of these converge solutions? That's something that we've been looking to do with VBlock and obviously there'll be an opportunity here. So we're looking at, can we provide certification training, another level of partnership with VSpecs versus right now, the barrier to entry is very low. Okay. Colin, did you have a comment on that? Yeah, it's interesting. You talked about the cross turning of engineers. What's necessary to deliver a solution today is not having the best storage guy, the best virtualization guy, the best compute guy, the best network engineer, the best voice engineer. To be able to deliver, you know, VDI VXI is actually so much interest and actually movement with our customers right now. If you want to change the way the person experiences a phone that is video that does virtual desktop, you change their endpoint experience. You have to have engineers that can design across the spectrum. So a lot of the investments that I made Nexus has been making in our staff, and we have 464 employees, 250 of which are technical, has been sending many swarms of engineers to training to become bilingual, to be aware of these cross platform solutions. Having a partner like Ingram with their training facilities and their support has been key and critical to our success in this. And I think it's key and critical for a partner to be able to utilize to sell V blocks, to sell V specs, but really to solve the next problem that our customer is trying to solve right now. So Don, last question I have for you is, do you see this as incremental revenue for what you're doing? You've done some of these pieces. How does this help you grow your business? I think there's going to be incremental revenue because it helps us to penetrate the customers, our customers, our partner's sales force, and get more people that are focused on attaching to what they know well. So where their strengths are, they can pull along more opportunity and solve more problems. So Colin, my final question for you is, this is first iteration, kind of 1.0 V specs. What do you see as really the white space in the marketplace? What's the opportunities to kind of mature this solution? What are customers telling you that they need to be able to adopt technology faster and be more lean and efficient? Well, right now, are the discussions from the customers supporting a couple key initiatives? One, bring your own device, the ability. If you look at the partners that EMC has chosen in here, there's a wide range of partners that can support this. You know, the other side of it being that VDI, VXI play, what I was talking to Wendy at Cisco about this, what I'd love to see evolved out of this is a larger reference architecture which takes into account those components on the end. The network and wireless connectivity in the middle. Because reality, we always have to remember the solution isn't just the thing in the data center. It's everything that's necessary to solve the problem. So I would hope to see these reference architectures expanded to take into account the entire solution necessary to deliver these. Okay. Any final notes, Don? That's good for me. Colin, do you have a random sports thing for us to talk about? I'd say boom goes dynamite. All right, so Colin and Don, thank you so much for joining us. We will be back shortly with SiliconANGLE TV's continuing coverage of EMC's V-specs launch.


Our first caller is Johan from Florida. Hey Johan, how can we help you? Hey guys, how you doing? Good. How are you doing yourselves? Good, good. So actually the thing is that I'm calling because I happen to have some shoulder discomfort every single time I've been doing bench presses or the like. And it's gotten to the point where I can't even sleep right or whenever I try to do a bench press, whether I do a shoulder press or whatever, it really, really starts to hurt on both of my shoulders. So it's been really getting to me because this has happened before. I ended up just waiting it out. But I was doing aesthetic and then it came back and I was right at the end of aesthetic when that came back. So I decided just to take it slow and went back to anabolic right now. But it's still ongoing. And as I was telling you, I can't sleep that well anymore right now due to this comfort. OK, that's a pretty common issue. Before we get into details, I'm going to ask you a couple other questions. Before we do that, it is common for people to have shoulder issues, shoulder mobility issues. I do want to know where the shoulder pain is. It's usually either in the front of the shoulder or behind, kind of behind the shoulder. Where do you feel your shoulder pain? Right in the front. OK, so very common, OK? So typically that's bicep tendon inflammation. So the bicep tendon runs over the front of the humerus. That's the top of the arm. And you'll start to get inflammation there and then you'll start to get pain right on the front of the shoulder. And this is a result of poor function in the shoulder. So more presses will actually cause more problems. Now what a lot of people do is they stop pressing and then the pain goes away and they think that's the solution. That doesn't solve the root cause. What you're doing is you're just avoiding movement that bothers you, which is OK to relieve the pain, but it doesn't solve any of the issues at all. So a couple of things we need to do. Number one, let's work on some bicep flexibility. So static stretches for the bicep. That's still not going to solve the problem though. What we need to work on is the mid-back muscles that pull the shoulder blades back and down. And also work on some basic shoulder mobility movements you'll find in a program like Maps Prime Pro. Like an example would be a shoulder dislocate or handcuffs with rotation or even the wall test in Maps Prime. Work on those things because here's the deal, especially common exercises like bench presses and rows and overhead presses. You should be able to perform them without pain. So it's almost never the case where somebody's body just isn't made for those exercises. Usually their body just isn't moving right for those exercises. Yohan, did you listen to the most recent episode that we did on how to improve your bench press? Yes, yes I did. OK, yeah, we addressed some good stuff in there. So we talked about some of the suspension trainer W's. I know I talked about inside there. So a lot of those priming movements I think are going to benefit you. But back to the bicep, I mean, you have to know how to static stretch a bicep, first of all. I don't know if we've even taught that on the channel, have we taught a bicep stretch? Yeah, no, I don't think so. I mean, it's a good one to add to the list.  Actually, in fact, if you did some static stretching on your biceps right before you bench press, I guarantee you probably already feel relief just from doing that. My protocol would be, right, a bicep stretches the opposite of what it would be contracted. So if you contract it, and it looks like I know we're on YouTube, right? So if it looks like this, you open up and you completely rotate the opposite way. I hope we zoomed in on your bicep when you did that. Damn! Look at that. That's right, that's no pump, Sal. That's what it looks like. That's crazy. And you push-ups in the bathroom. This is super common, though, is the point. Like, this is actually something that I would, it was a limiting factor for me with bench. You'd inevitably get up to that point. You'd start to feel pain either in the front or the back of the shoulder. And so this is where I started to put more emphasis on mobility work and also rotational work to get my shoulder to track better and to be able to feel more secure and stabilized. And so, you know, to get yourself back into that mentality of trying to really stabilize, protect, and build strength around and support around your shoulders, everything. OK. All right, perfect. So again, prime before your lifts, work on shoulder mobility. Do some static stretches of your bicep. Do you have prime or prime pro? I only have prime right now. I've been doing some of the static stretches with that, with the wall test. Doug, send him over prime pro, so he's got that, too. But yeah, I would take some of the advice that we did in that bench press episode, because I believe we address all mobility, stability stuff for the shoulder. The only thing we didn't, we didn't address bicep stretching. So that needs to be something that becomes like a protocol for you before you start any of your lifting is get a good stretch on that bicep, and then I would do all the shoulder stability work, and then go into it. And like Sal said, it should feel better right away just from doing that. But it doesn't end there. You've got to keep addressing that. OK, thank you guys so much for you to appreciate that. No problem. Thanks for calling, John. Yeah, I think here's the big challenge with pain with people and exercises. Two things. Either one, they start to decide that this exercise just isn't for me. I've heard many times people say things like, avoid it. Yeah, oh, I can't bench, or I can't squat, or I can't whatever because of this particular pain. That's a problem because you never solve the issue. And it's a fundamental movement. Pressing horizontally across your body is a pretty fundamental movement. And then the second issue is that people will wait for the pain to go away, either by maybe they are doing some mobility work or by avoiding the exercise, pain goes away and they think the problem is solved. It's actually not solved. The pain might have gone away, but you still have the issue and the pain will come back. Or they treat those mobility drills like an intensified exercise. And they overdo it. And a lot of times, exaggerating the inflammation of it. And so there is a bit of a healing process to that as well. But you really have to figure out like that sweet spot of like it's a continual thing. It's a frequency thing with less intensity. Well, the other mistake they make is they lack the correct intent when they do mobility stuff. So one of the challenges I felt that we've always had with creating Prime and Prime Pro as this virtual program and not being there to coach it is getting people to understand the intent. Like you could do a handcuff with rotation and it could be like whatever type of, and not even be hard, just kind of go through the motion. And then you could do it and you'll break a sweat doing five reps doing it because the intent is completely different. So you have to understand when you're trying to gain a greater range of motion, you have to be challenging those in ranges of motion and connecting to those muscles that do that and that there's a lot of intent there. And if you don't understand how to do that and you just watch a video, you just kind of go through the movements. And I do wanna add to that within reason, right? So just like when you work out, you're not trying to go to failure and you're not trying to go beyond a particular limit.  So don't go beyond that. It's your threshold. Don't go beyond that. Play within your particular edges of pain. So I'm connecting. Oh, that's a little too far. Let's back off a little bit and then slowly work from there. But I tell you what, this front shoulder pain issue from bench pressing. I mean, at one point, this was like, I actually loved it when clients would come with me with that problem because- You needed to release it right away. Right away. It was almost like an easy fix, that particular issue.