I learned that the ladies in the back are actually from Tsoi San And Tsoi San, to say Ho-sik is Ho-hek Ho-hek Ho-hek Two or three bottles of hair, half of it, half of it, half of it Okay That's okay Welcome everybody to part five of our Chinatown Cheap Beats Hidden Gems series And just when you thought you'd seen it all We celebrate the reopening of our favorite restaurant Witness a fierce battle on dollar dumpling corner Debate over Hong Kong cafes Chase an elusive chicken mushroom dish Attempt to crown a new roast meat king And maybe we finally explain in depth on why we filmed this series Once again, most of this food is under eight dollars So part five, New York, let's go Alright everybody, before we continue with that video We gotta let you know that we are partnering with YAMMYBuy.com On a crazy big Snackathon giveaway livestream On November 9th at 5pm Pacific on their YouTube channel If you guys know about YAMMYBuy.com It is the premier location to get Asian snacks and products, kitchen appliances online We're doing crazy giveaways such as a year long's worth of snacks Giving away kitchen appliances, beauty products, and there's even instant discounts during the livestream All you gotta do is get registered for an account at YAMMYBuy.com To be eligible for these giveaways, listen guys, in life There's a lot of things that you can not control But you can control whether you are there for this livestream and winning things November 9th, 5pm Pacific on their YouTube channel And we are standing in front of the legendary Bokey Yo, they came back after being closed for a few months during the pandemic But let me tell you this, people were waiting for this spot to reopen It's an incredible value, like per dollar ratio People write articles about this spot Bokey on Bayard, let's go And you gotta let him know You can choose, I'll tell you The classic one ton egg noodle that's wine Okay, so now Of course it's vegetables Vegetables, should I give it or should I give it He said get a vegetable, get a mustard green They go out of my yow-toe It's really good here, it's good here Even the vegetables I got out of my yow-toe You know what I love about the older generation? It's like, you're like, yo, what else should I get? And he's like, come on man, stop it You already ordered enough You ordered all the good stuff But I just don't want you to order anymore This is a cheap eat legend Man, everything on this table is under $10 It's actually under $9, except mine is the half duck That was $13 But you can get a quarter duck for $8 Gotta start with the duck Country stew duck This is probably the most flavorful duck You can get in Chinatown almost You know, the skin's not gonna be crispy But it's gonna be flavorful That is so good I'm gonna take one more piece That's it Honestly, I would say the duck is a five out of five That's how good the country stew duck You must get it Andrew, I think you need to go with this Fall with chicken broth I'll probably go with the fish noodle then Wow, this one never seen this dish before Actually, this meat looks incredible The tendon is looking tender Little lemon on top That looks like the whole fun You can't even tell the difference between the tendon and the noodle Like I said, guys, they're basically taking like a gigantic fish cake And made noodle out of it I think this is better than I expected Man, that's really good It's really light I'm always excited when I get to try something new And we are looking at a satay pork chop and pin noodle So that goes on top of this Man, sometimes when you order pork chops They're not as flavorful And they're a little bit too dry This is not any one of those, man It is so good, super flavorful Very thin, but juicy still The pin noodles are more seen in Southeast Asian noodles These definitely have a more organic look than other noodles This is choline dry Yeah, that's called the special combination Because as you can look at the meat, it is the special meat Now, David, there's a soup on the side over here That you can eat it with The noodles are always super al dente So they're not too soft Andra, I always said Out of the taste buds of an 80-year-old Cantonese man Andra, I don't normally do it But for you guys, I'm going, I'm just kidding, slice You win it, I'm going now The fact, I'm going to do this liver piece too I like liver more than kidney That's my opinion I agree with you, bro Kidneys over livers But I don't like either of them Yo, I'm not going to lie I just had to wash it down with a piece of duck All right, here we have the Cambodian Houti When Chujang people went into Cambodia Their culture is mixed with the local culture It's different So this is more of a Cambodian style That's what makes this restaurant so interesting You cannot really box this food in To any one type of cuisine Here we have some appetizers We have the legendary shrimp rolls It's kind of like a thin tofu skin Wrapped around some ground-up shrimp balls Sweet chili sauce on the side They really look a lot like the time we need chicken rolls All this stuff is under $10 Very affordable You could come here and have a feast Appreciate the culture for like under 50 bucks I love everything here I cannot do intestines It's very hard for me, man Bro, come here, you all I can't do it, I can't do it I'm eating my, I'm being you You got it, you take it, you take it, man And last but not least And we have our final round here at Bokey This is the yalchoy This is just a mustard grease That mixture between a little bit of oil, soy sauce And I don't even know what else Sesame oil, so good This is the beef stew rice noodle Give me the tendon, not the intestine You can smell that kind of tomato paste in there And this was obviously has some deep Somewhat western French influence, guys This one was a sleeper This one is fire You cannot miss with that combo Beef, carrots, onion, lock it in I've received a couple of messages People are like, what is your guys's goal with the series Or how many are you gonna do Why do you keep doing these Listen to this, guys Number one, these places need business right now Just to survive and stay afloat Number two, I wanna show the interactions With the older generations That I think it's important Number three, this food is gonna go away There's a chance that it's not really going to continue Unless the kids and the younger generation take it over The fourth reason is that all these dishes They have this deep complex like domino ping pong history That I think it's fascinating to lean into Last but not least, the main reason is Just because it's delicious And I gotta eat lunch Everything here at Bokeh is fire Cheap eats under $10 Get outta here We're standing in front of a very very little known spot That I've never been to before It's called fried dumpling in English But David, the Chinese name that you can read Is Lao Shan Dong These are Shan Dong dumplings Northern style dumplings in Chinatown Are you from Shandong? I'm not the boss, I'm from Shandong Where are you from? I'm from Tianjin How many years have you been here? You've been here for 20 years? 20 years 20 years Coming in at 30 cents each You can get 17 dumplings for $5 Andrew, let me tell you this I just had one In fact, I actually had three I kept eating them and eating them I'm gonna like dumpling number five I don't even know why Pork, a tiny bit of chive A bunch of carbs Soy sauce, man That's a dollar doujiang Alright, this doujiang A little water It's not bad, it got the job done Hey, you know what this is, Andrew? This is some good government eat stuff Dollar dumplings, dollar doujiang Bro, if you need to feed yourself 17 for $5 How many fried dumplings on Moscow street? Onto our next dollar dumpling spot Is we're at Tasty Dumpling They got cheap dumplings here I'm five for 150, about 30 cents each Your boss is from Tianjin Wow, okay I learned that the ladies in the back Are actually from Tuesan In Tuesan, to say whole sick Is whole heck Whole heck Whole heck I got these five They're steaming hot Okay, I would say you got more for your money The style's more Southern These were cooked fresh I would say quality wise I think these are a little bit better Alright guys, David This is the fresh shrimp one These taste like your prototypical Chinatown dumpling Way more chives Pretty solid This noodle dish right here You have sliced cucumber Not a dish you can normally get At just like cheap dumpling spots Sesame noodles Majang is a very Beijing Tianjin thing to use That's Majangmian for real Chili oil with this would be fire though So you guys, let us know Which one you like better Tasty dumpling or fried dumpling But you got to check out both David, our next segment of this cheap eats part five Is gonna be our Hong Kong cafe battle Between the top three mid and HK cafes Which are Gongsik Tong, Cha Chantang, and Cafe HK We got three heavy hitters, Andrew KST is sort of the new kid on the block Cha Chantang has been around for like what?   No No Polo Tao No Polo Tao Forged? No Stop No, yeah Let's go in, that's the baked onion pork chop From Cha Chantang Little onions falling off there, buddy Onion pork chop, very solid The reason I could see people buying that Over the baked pork chop with tomato sauce Is because this lets the pork chop shine Alright, this is the curry fish balls David, this looks very HK Really solid, you guys Listen, Cha Chantang Listen, they specialize in Cha Chantang food At the Cha Chantang David, what is the beauty between Polo Yao Where you just have like a piece of butter Or, you know, the spread butter on here and toasted That's it It's beautiful and it's simplicity Yo, I'll tell you this This is hitting all your sensories It's sweet, crunchy, crispy, buttery Can't beat that I might have to dip that in the curry Wow Not bad, I suggest you do it Last but not least, I have the pork I can ate the lossongtong This one's like a really savory tomato soup The free one has a little bit of meat, a little bit of pork This one is chunky, look at that I think it's fair to say, Andrew, that the borscht you get for free Comes from a different pot You're not getting this for free Look at these pieces of meat Guys, that was Cha Chantang, aka CCT This is the Hong Kong French toast With peanut butter inside Alright, this was good That was good You have the light from both spots Here, in my left hand, I have Cha Chantang Here, I have KST You know, guys, it's not always a competition But you're making me choose between one or the other I'm going with this one We're going in to KST Baked pork chop over rice with tomato sauce It's the fusion between Western and Eastern flavors It's a new take on it, y'all There's like barely any tomato flavor Super sweet Sweet Almost tastes like a sweet sauce Like a sweet and sour sauce Alright, we're here with Ken Ken, you a local? Yep, local Alright, guys, we're trying the Cha Chantang from KST We're Ken What's your analysis, Cha Chantang? I always prefer the Cha Chantang, you say It's more silky, the one that you get from fruit carts This is a traditional HK style I know, yeah I like the flavors, the hoisin sauce, the sesame This is Ken signing off Signing off The flavor profiles at KST are pretty significantly different from Cha Chantang We have our last and final competitor, Andrew HK Cafe They have a crazy looking pork chop rice right here Yo, this looks very colorful, man Let's dive into it It's fried pork chop Everybody kind of does it different Because, for example, at KST it was grilled pork chop This is fried pork chop with tomato sauce It ain't bad It's not tomato sauce It's a sweet and sour sauce, bro There's tomatoes in there You know why I know there's tomatoes in here? Really This one and this one were very, very different But the same dish, guys Think about it Alright, David Coming up next We have the galay udon This is the curry fish balls from CHK Cafe HK Honestly, Andrew, I was looking at this from afar I had no idea what this was I thought this was a cool buck, guys More flavor because of the onions You get one more bite, guys Just because it's different I'm gonna crown the winner Still the classic Cha Chantang Okay I kind of agree Try all three spots Cha Chantang, KST, HK Cafe And decide for yourself We're trying to go to the Bayer Meat Market Dude, I saw the chicken and mushroom And I knew that that was gonna be one of the best cheapies But they sold out today We're going across here to Yewang David, this spot has been recommended By multiple insiders from the area They're not even serving any other dishes Other than their roast meats It is looking super crispy And so is the Cha Xiu Apparently the best roast meats in Chinatown Let's check it out Two, three, four, five Five, six, seven, eight, nine, ten Okay Five, six, seven, eight There were certain ones You couldn't really get in the combo So I had to get a whole half of the peepod duck And I had to get a half tea-small duck So, you know, they kind of got me on the ducks How much is a... Just like one sambol font? Nine dollars for the... Nine dollars Okay, guys So it's nine dollars for one sambol font Now, nine dollars, you would say Is a little bit more expensive than other spots But let me tell you this I can tell you this right now The quality is here Immediately, we have to start with the premium meats We're talking about the stew duck A five-spice sauce Not a lot of spots carry this Guys, I'm so excited for this I'm dipping it in the Owens juice Got some of that five-spice, slightly sweet Almost like a cinnamon Yeah, that's good Premium meat Wow And we're moving on to our second premium item The peepod duck Yeah, there we go Look at this Mmm, huh? That's good I'm fine I'm gonna have to go one more piece, bro One more Look at that Look how beautiful that is That skin so dark and crispy right there Duck it in, bro This chashu is looking good All right, really super fatty, super moist As we can see, a little bit more authentic More of the brown, oranges color Versus the red color Yes, that's what I needed That's good That's good Shout out to all these spots Let's go into the soy sauce chicken Wow Everything's hitting four out of five right now In my opinion The gherngchong is crazy, too That chicken was good Pork spare ribs I don't really like spare ribs that much It's never the thing that I go for That's good, though, man Got a little bit more spice than usual This is gherngchongkai Ginger scallion chicken Like I said, everything is hitting four to 4.5 out of five So this is the regular roast duck This is a lot of people's favorite Yeah, that was pretty good, too All right, Andrew, last but not least, roast pork I think the whole presentation And the moisture and the juiciness of all the meats It's very high level Man, this is as great I like how the skin's still on Sometimes, you know, when they chop the soy sauce It all falls off I cannot say necessarily either one of these items Was the best one I've ever had, of course But actually, all of them were very, very solid And that's why I'm saying yueh wang for the consistency You guys let us know in the comments down below If you got some different opinion But, man, in my opinion, yueh wang Our next spot is an absolute staple of Chinatown Andrew, of course, we're talking about Chinatown Ice Cream Factory When it comes to Asian flavored ice cream This is the best We are talking about exotic flavors Let's get in there Do you recommend any toppings with the gherngchongkai? I don't really like the gherngchongkai Okay, okay You know what? Let me get the teddy grams So I got the teddy grams on the pumpkin pie Obviously, I'm trying to mimic and replicate a pumpkin pie crust First off, I had to start off with something seasonal The pumpkin pie, the teddy grams I'm trying the ginger one with coconut shreds I've never had ginger ice cream before Straight up, it tastes like pumpkin pie I've never tasted something so creamy And something so gingery at the same time They are able to imitate the flavors Incredibly accurately here at Chinatown Ice Cream Factory You know, pumpkin pie, that's not a traditional Chinese flavor But that is good Alright, I got banana I just had to try banana Because oftentimes banana tastes very artificial In kind of candier ice cream form So I'm interested I have almond cookie right here That is the classic Cantonese almond cookie Pretty dry, goes really well in ice cream Due to the dryness A lot of almond extract This banana ice cream one's really soft Pretty good Alright, Andrew, so this matcha cookie is really interesting Because the original flavor that we're trying to replicate Was not matcha, but matcha cookies And by the way, guys This ice cream will not go to waste Durian ice cream Man, I know Chinatown Ice Cream Factory They do it the best Whoa, huh Bunky, creamy I really like this a lot I'm being dead serious right now This durian ice cream is better than the durian ice cream I had in Malaysia And last but not least, Andrew You have the pandan, the pandan Pandan, you know what it is, guys Very difficult to describe It's like a creamy vanilla coconut flavor Look at that color Looks beautiful You know what's crazy? I could smell that ice cream before I ate it Everything tasted so different Check out Chinatown Ice Cream Factory Here on Bayard And try some flavors that you've never had Second day in a row, Andrew We missed the drop Bro, we struck out We're trying to get the steamed chicken and mushroom dish Next, we have some items From the nice dessert shop in Chinatown Mango mango desserts This is a mango mili crepe This stuff looked beautiful out of the box Alright, man I'm going in on the mango mili crepe Wow, I'm going to get some real mango in there, too Honestly, flavor-wise, it was almost even closer To the old-school Kanto HK wedding cakes Yeah, I know what you mean I was not expecting a mili crepe To taste like the light whipped cream cakes Here we have the durian pancakes Mixed between a crepe and a cream puff No, no That was real durian Durian pancake pillow That's why I call it I would say, listen If you're looking for some really cute desserts in Chinatown Check out Mango Mango While we were waiting for some food I bought this for $3.50 I don't even know what the English name is It just says different cup, different flavor This is something that you can usually only get at the fair Very good It's cooked well, though This spot behind us Pink lady cheese tarts Now, they are serving Japanese cheese tarts These are not based off of Cantonese Dantots, necessarily They are more like almost a cheesecake filling But I don't want to kill on cheesecake either We got to try it This is your shop? Yes Very cool Can I get one of each cheese tart? Do you want any toppings on your purple rice? Do you recommend any? Can I get purple rice on my purple rice? Do you want an more? Yeah I'm getting purple rice on my purple rice I'm going with matcha Of course This is the one that caught my eye That's the original filling cheese The original cheese, pretty good It does kind of taste like a light, sweeter, creamier version of a cheesecake Well, you keep eating it So, I don't know I mean, I'm assuming it's decent I like it Next up, I've got the blueberry Andrew, you've got the chocolate The cheese tart filling Super, super soft and airy and fluffy But then the crust here can crack on you So, it's very crispy So, you're going to try the purple rice? I'm going to try the purple Yeah, the ube You are looking at a purple rice smoothie topped with purple rice I've got the purple rice He's got ube cheesecake That's a purple vise Oh, my favorite one Ube flavored things I'm on it That's my flow Leave me alone I'm going to go I'm going to go home I'm going to eat They sold out again I'm too late Third day While filming this series We bumped into so many people on the street Who were actually following our food crawl And it's great because these videos Are not just a guide to food But a guide to people And we're so touched to see the impact It's had on business owners Who tell us that The first time they got featured in a YouTube video They were smiling and laughing Giving their best performance And we can be honest Sometimes Chinese culture seems inaccessible And introverted So much to the point where A lot of people just disengage But we continue to do our part To be a piece of that bridge That will bring the connection back So with that said Be on the lookout for part six Thank you so much I appreciate that Thank you for watching Thanks Thanks for the support Love your videos I made a joke about yesterday Uh-oh That's what's up She said I was eating churn fun yesterday See, people are doing the crawl right now


And one of the fundamental principles that they were espousing in this video is the concept of no contact and leaving this person alone. So they will miss you and want to reach out to you. And I want everybody to think about this for a moment. You know, this person has just ended a relationship with you and all you have to do is leave them alone and they'll come running back. So the reality is these days there's so much ease of replacement at this concept of just simply leaving someone alone and they'll somehow magically come back will work. Because this is true for men and women alike that what happens is there's going to be a period where they feel a sense of missing you and they might return back.


To think tech Hawaii. Thanks so much for joining us afternoon for those of you here in Hawaii evening or another time for those of you in other places. But thanks so much for being with us. And thanks so much for supporting think tech, which for 21 years has tried to open up dialogues and difficult conversations. On things that we need to think about and talk about speak up and stand up about. And today to do that we have with us Tina Patterson, very experienced mediator arbitrator entrepreneurial coach and consultant from Germantown Maryland and Ben Davis and Charlottesville Virginia, who has taught at a number of law schools as well as practice in Europe as well as the US. And most recently at Washington Lee School of Law in Virginia. Tina Ben seems like and will pass on Johnny Depp and Amber heard for today. But other than than those two who can fend for themselves. The thing still on people's mind is what went wrong and what we keep finding out more about. In Valde, Texas, and in this country generally. Good question and everybody's mind. What's it going to take. What you know, if I can jump in, I would start out with. A comedy routine of a guy named Eddie Isard. I think it was in 2008 or snow maybe an earlier than that, you know, where he said that whole line that guns don't kill people. People kill people. Okay. And he goes on. Yeah, but the gun helps. The gun helps.  Yeah, you know what I mean. It's like the gun does help. And so I was thinking that the way to go would be really I like to call it the market solution from the market for debt solution which is basically what are the weapons that are used for the mass shooting. I don't care what the state of mind of the particular person was I don't I'm not interested in, you know, a lot of times they kill themselves to. So it says, what was the weapon they use. And then, okay, that's the weapon they use then we bear that weapon. That's it. You know, and I think the single setting the single shooting the manslaughter the murder of one person or something like that. I think we should look at that too but it's basically saying the market for debt is picking these particular weapons. And so we're going to ban them. Now if you happen to own one will pay you back for it or whatever you know to give you some money give you some, give you some coupons the McDonald's I don't know what you know in reverse, but, but, you know, that's the theories and like the market for debt is chosen this weapon. And that's the weapon that therefore we will ban. No, another thing is, you know, raising the age, you got to be 21. I think you have to be 21 here in Virginia to buy liquor.   Oh, man. So, sorry, you have those, you know, and then some people will say, I am but there's heller and there's a second amendment and all that stuff. If you look at the heller decision, it does not say you cannot regulate. Okay, it does not say that it can't regulate. And that's one of the misnomers that the people who want to push the second amendment try to push is that oh you know, no, you know, six, the safer second amendment. Let that would be a first approach. Second approach would be to follow former Justice John Paul Stevens. Let's repeal the second amendment.  But when we're talking about weapons like this now, there you go. That would scare some people and talk about taking away your guns will take away the right that you think you have, you know, and maybe you can get enough votes for that. It's a little harder to do. But just, you know, it just seems like, you know, a couple of options. Now, there's a third option that people are trying to talk about right now, which I find a little weird. So I'm just going to say it, but there are people talking about having those kids and you've all been having some of their parents have open casket. So you can see what an AR-15 can do. And I watched the show on CBS a couple nights ago showing the difference between what a nine millimeter does and what an AR-15 bullet does. AR-15 bullet destroys a body. I mean, they use a kind of gelatin to look like similar to what soft tissue is, you know, so you can see how the two. And, you know, obviously, the first thing that comes to mind is Emmett Till's mom, who decided that Emmett Till would have an open casket and basically was saying to the world, look at what you did to my baby. Now, I just learned that one of the mothers at Sandy Hook did have the governor see the open casket of her son, Noah, to show him just the damage these kinds of guns could do.  One of the worries that I thought the mother said that was really true is that if you show them out, you don't know what's once they're out, you don't know in this internet age what would happen with them, right? In terms of all the craziness that you can imagine in it, but to have the actual legislative people, the people with the legislative or executive power be required to see the kind of damage done to a 10-year-old by these kind of weapons might be something that would work. And that's four ideas, okay. So, I don't know what else to say, but you know those are, I understand why people want to have guns and understand hunters and all that stuff but, you know, if the people killing people are using a certain weapon it seems you need to get rid of that weapon. Whatever the state of mind of the person was killing people. You know, maybe they can, they can use, well, after each other with pencils, you know what I mean? You know, this could cause a lot less damage. I mean, apparently even like, you know, if nine millimeters were kept around, people get wounded by nine millimeter, okay? You know, but their body gets destroyed by these AR-15.  That's, I was listening to somebody who's a trauma surgeon in Philadelphia explained the difference between what come, what these different weapons do, you know? And so, you know, I just, okay, here's, keep it simple, you know, just, we have the dead kids or we have the perpetrator or dead or not, what were the weapons they had, okay? That's on the list. We get rid of those weapons throughout America. So Tina, what do you think people are really willing to consider? Hey, because we know if 88% of the people are saying, yes, there should be extensive background checks. And 67% in a recent poll said, hey, they should ban assault weapons, not just AR-15s, which are most of the weapons used in the recent mass killings and shootings, especially school shootings, but ban assault weapons entirely. And besides those, the red flag laws, those are all alternatives. But what's it going to take when elected officials are still saying, yeah, we don't care what those polls are saying, we can't go against the NRA because we're going to lose our elections at home if we do that. And I actually think, and you touched upon this, but I really think the conversation needs to shift to regulation and what does regulation look like. And I've said this on this show and I can say it now, I am a firearm owner, but I own one as a matter of self-defense. And so when I'm talking about regulation, I'm talking about regulation that is consistent from one state to another. And right now we've got 50 states with 50 different regulations. I can tell you in Maryland what is required in terms of when you make the purchase, the dealer is registered, the purchaser has to fill out paperwork. The first opportunity to purchase a firearm, there's a 30-day period that you have to wait before you can get that firearm. You do undergo a background check and you are fingerprinted. I can't say that for all states and I'm being transparent about that. I can't say that for all states because I don't know about all states. But I can tell you that each state is very different about how that firearm is handled. Then I agree with you. The larger discussion is what should be available to the public knowing that if you suddenly say that assault weapons are not available to the public, there's going to be a black market. And how do you address that? Yes, there's been a lot of discussion regarding assault weapons being used, but the person who shot those folks in South Carolina used a Glock. And he had multiple rounds and he loaded his magazine several times. So I'm not saying not to take the assault weapons out of the public breach. I completely agree with that. I don't know if it's really necessary to have an assault weapon as a public user. The assault weapons were meant for specific intended audience. And unfortunately it's military. It was not meant for taking out a grudge against another individual in your community or whatever. So yes, I get that. But I think for the legislature, it's really the conversation about what can we do in terms of public safety. And it's the consistent regulation. I have a colleague who's been telling me we need federal regulation and he compared it to prohibition. I don't know if that's really the answer because states are going to push back and say, well, yes, you've created this federal regulation. Look at the Second Amendment. I've got a right to bear arms. I can do this. But if the states are consistent and sent all across, we are going to have red flags. We're going to have 30 days. We're going to have the dealers registered. You purchaser are going to have a wait period. And as you mentioned, in Maryland, each firearm that you purchase, once you purchase, I believe it's more than three or four. Your cat, your, your record changes because you're now considered a collector and not just an individual with a couple of firearms. So there's, there's a maintenance. There's, there's, there's a look up after that first purchase. There is a, I believe it's 10 or 15 day waiting period. I'm close enough that I'm near the District of Columbia in Virginia, Virginia, Ben has a very different protocol. So it's a matter of what's concealed, what can you carry is concealed in Maryland, an individual can't be a concealed weapon holder, unless under special circumstances. In Virginia, you can. And in the District of Columbia, how you carry that firearm and how you carry your ammunition varies. So, you know, that's part of the regulatory process that I think we should be talking about. Yes, I don't necessarily agree and I'm not an NRA member by any stretch of the imagination have no interest in being one, but I do think the conversation. We do need to talk about what does regulation look like. And yes, there are, there are hunters who need their firearms for hunting, but that's not what we're talking about. We're talking about deadly force. Yeah, and what I understand is that gun owners as a whole were like, totally in agreement with a number of these things like the background checks and all that, you know, red flag laws, things like that. I saw a presentation today is like, just a survey of gun owners were like 86% were, were in favor of various types of controls being in place on our regulations being put in place with regards to having access to gun. So, I want to ask another question, which is that, you know, there's some who, who benefits from all these guns in being in America, right. Obviously the gun makers. Okay, the gun makers, as an industry, must be making a lot of money.  And then there's another group that I could say which would be maybe the prisons, make money off of guns because with guns you have crime and with crime and get people put in prison and then they're more prison, you know, I mean, and then you know there are publicly owned companies that own prisons, you know, and, and so one of the things that I thought about is this, you know, all of these folks have an interest in keeping lots of guns going. And in working on the political system to make it look like the NRA, but it's really themselves kind of keeping this gun thing going, you know, it kind of reminds me of the opioid situation where you have now Walgreens is paying some enormous amount of various states and you have the folks who had what is that pharmaceutical company, the Sackler families trying to negotiate a settlement with regard, and you know, there are these various, you know, drug stores that you know, and I'm looking at all these people paying money and it was like nobody, you know, nobody was looking at the opioid horrendous for I mean 20, 30 years I think it's been going on this opiate at least 10 of this incredible opioid crisis, and everybody was making money off of it you know, and even though places were being decimated, you know, and so I feel the same kind of things going on here, we're watching all these things happen where people are decimating people are making money. And one thing the United States is you know they say never get between a person and their money right in the United States and they will push it to to. So they could just consider these kids and you value you know a cost to do a business on, you know, which I think is horrible. But if you're at the head of some of these companies, especially if you're publicly owned, where the only thing that you are concerned with is maximizing shareholder value, as the law requires you to do. You know you push whatever buttons you can to make sure that you can keep making a profit. You know, there's no morality in any of that. Then that's interesting you've mentioned that. And sorry, I'm going to just say this. You bring up a good point and since 2016, the cost of a firearm has increased in some cases it's increased by 50%. A firearm can cost anywhere from a couple of $100 to several thousand dollars. And the munition at one point in 2021 as well as in 2020, there was a shortage. And, and the cost has gone up as well so whether it's a hollow point bullet or or not that the cost has gone up so yes there's money to be made. And surprisingly, we have some of them, the firearms that you're speaking of, are not manufactured unless they're manufactured outside of the US. And again the intended market was initially to be law enforcement and military. And Chuck, I'll stop. Okay, well that's a really interesting thought. What if you took the toxic tort theory that's been applied to everything from asbestos to tobacco to dangerous products to pesticides. And he said okay, we're going to require manufacturers to put in an amount of money that can find Berg the 911 compensation arbitrator. Determines is appropriate and also the BP oil spill distribution manager and arbitrator determines is appropriate. And you guys are going to have to fund that so that all the victims of gun violence, who will be compensated, according to what our legal standard customarily does in these kinds of cases. I think they'll make a difference. But it's basically an insurance scheme okay. We're self funded by the gun makers and maybe the dealers and all that stuff for the, the, I guess, downstream risks of what the business that they're doing. So, the couple thoughts that come to mind. The point is, I understand that when they were trying to get the idea of teachers having guns in school, the schools insurance companies told them they're going to lose their insurance. So, the insurance companies, and doing their actuarial analysis of what's going on. We're like that's not a risk we're willing to cover as part of the insurance schemes that we have. So, which I think you're asking for is basically self funding insurance, basically by the manufacturer. Okay. And that's it. That's that that that could happen. But I have a very cynical view. So, I have a view of remember those pension funds that all those companies were supposed to have for all those workers and then they went bankrupt and lo and behold it's found out that the pension fund wasn't really there and these people got 5 cents on the dollar and you know that's what I worry about the self funding thing is that you, you'll get a CEO who when it comes to the crunch is going to go this way as opposed to that way with the money. And we find out that the actual pool is empty. And that might be to have a, I don't know if they do this is to have a firearms tax, right, that specific to firearms and maybe those already. And that would be to create a fund that would be something like a social security. That vision in a pool of pile of money at the federal level, sort of like the super fun kind of things there's things like that, where that basically with finance, the downside risks of these firearms. But I do want to say that, in a way, the concern that I just have is that you're basically putting in a system that tolerates a certain amount of death by these acts that happen. By having a compensation scheme there. And so that's where I kind of have a, I mean it's great to pay people off give a million dollars to the parents and one of these kids and you valid yeah okay fine but the kid is gone, you know, and, and somebody's loved one is gone.  There's a loss there to you know that what happened, I know people don't think of it that way but somebody was a brother, a sister or somebody is the losses that there's a loss on the victim side to and I'm not minimizing them I'm just trying to say that this is death that's you know, and I'm just in my, that's the thing that worries me about sort of, you know, self funding or government pool to pay for the death we allow to happen, you know, in our society I just. So that's my hesitation but I defer to Tina. Oh my goodness, don't defer to me your, your argument was well stated, I'm not certain I agree that we're funding. That we're actually encouraging death, but I do like the idea Chuck of having some type of funding, either, whether it's for education or something. I just, I don't know what it is as you were talking Chuck, I think, and the reason I mentioned the 2016 timeframe is because there's been an uptick, and the number of these acts, but underlying all of this is the, I think that's the bigger issue that we have to talk about and maybe that's where the funding, if this fund was set up is to address what what is it that's making the person say you know what I'm so angry, I'm going to go and get whatever, and I'm going to go to the school or to the supermarket incident was racially motivated so we know that has a lot to do with it, but what is it that is giving people license that they think that this is the avenue that they need to pursue and the past. We saw this but it wasn't commonplace that what I'm concerned about is it is becoming so commonplace that people are suddenly going to be numbed by and just say oh another incident and and not take action not feel outraged not feel the sense of saying we've got to talk about regulation we've got to talk about the underlying factors here. Yeah. And that leads to a balancing. Yeah, Ben as you pointed out. On one side you've got a risk that the funds may not come together they may not be sufficient. But on the other hand, we look at the size of this industry and its resources. And you look at the examples from other toxic tort situations asbestos tobacco and others, even in the opioid situation. If the impact is sufficiently major and substantial and the risk financially is. That industry that controls that dangerous product and the access to it and the utility of it for abusive purposes destructive purposes. Maybe they're in the position to work with the other elements of society and to be more receptive to regulation that's going to limit their financial risk and exposure. What's the downside right. If you don't put financial risks in there. We know what happens. Yeah. And you've got the financial risk of the industry and the NRA having a huge portion of our elected federal and state officials use as an excuse. We can't impose gun regulation because we'll lose our elections because the lobbies and the voter blocks are too strong. Show that's not the case. And I think there is a federal liability shield for gun manufacturers that got put in place, which shows that you know their solution was, hey, we're not liable right you know they're laying off the risk completely to to society. And the government was willing to go along with that, which is another comment on sort of the valuation of of death, you know that the government's going to shield these businesses. Probably on the vision that they're keeping jobs right you know the old jobs are. But I mean you can you can do a lot of evil on that job with that job. You know, I mean slavery was a full employment thing you know I am sorry to say it like that but you see it's a cynical. Yeah, and if you look at, and we're out of time for today but you look at the 288 incidents in this recent time period in the US, and you measure those against other countries. One with eight, one was six one with five, and nobody else has more than two in a time period. So, how you justify that doesn't make any sense, unless you start to impose the legal and financial consequences on the industry. And on the users of that industry. And that's being done with the opioids why not with guns. Yeah, thanks everyone for joining us. Thanks for your provocative thoughts and ideas. We look for questions. Come back and join us in a couple of weeks and send us your questions and your thoughts and we'll take those up to take care everyone have a good week and a good weekend. Thank you so much for watching Think Tech Hawaii. If you like what we do, please like us and click the subscribe button on YouTube and the follow button on Vimeo. You can also follow us on Facebook, Instagram, Twitter and LinkedIn and donate to us at thinktechhawaii.com. Mahalo.


Hey everybody, I'm Lance Coyke, and today we're going to talk about something that you need to think about before you just take a high-intensity interval training class. So, I've talked about it before, especially in my previous video, we talked about the difference between high-intensity interval training and long-distance running, and how they're both really effective for making you fitter and losing weight and all sorts of good stuff. Now, I wouldn't recommend high-intensity interval training for everybody. Specifically, if you have chronic injuries that are set off by technique changes, high-intensity interval training is probably a really bad idea for you. A very common example is somebody has CrossFit recommended to them by somebody that they really trust and who has done very well with it. But maybe this other person has, you know, they sit a lot at work and they frequently have low back pain and, you know, maybe they have a low back flare-up once or twice a year. So, if you throw them into a higher-intensity CrossFit, again, not again, but I want to throw this out there, not every CrossFit is like this. You should still consider progressively ramping yourself up. But if you just throw yourself into a really high-intensity interval training kind of scenario, then it is likely that your body will just adopt the position where it can be most effective to accomplish the task. So, if the task is to just get a workout done, then you're not going to be thinking about how well you're doing it. You're not going to be thinking about your technique or your form very well.  You're just going to be thinking about accomplishing this goal. And so, when I get really fatigued, I'm generally going to avoid if, even if you start by doing things really well, those muscles will get fatigued and your body will shift its mechanism for doing this exercise. A common example, even if you're squatting and your knees are really well aligned with your feet and your hip, you're not sending torque through your knee. You know, if you do a 20 rep set of your 20 rep maximum weight, by the end of that, your knees are going to start caving it. You're going to start collapsing because the muscles that support those knees staying in line with the hip, they start to get tired. Okay, that's a really simple example. Another one really, really common deadlifting. When you get, you know, toward rep eight of a 10 rep set of deadlifts, it's really difficult to maintain the right position. It's hard to keep the tension on your glutes when you lock the bar out. And so instead, what people do is they shut those glutes off and they just arch their back to finish the lift, right? And so doing that, putting undue stress on the low back, it's going to make it more sensitive and it's going to make it more likely that something bad happens to it. So if you are really prone to these things, maybe you don't have a very strong athletic background. Maybe you didn't play a whole lot out in the yard or play sports when you were a younger kid. Then I would caution you to go into a high intensity interval training with, you know, with not your blinders on, right? You need to be able to say, hey, maybe this exercise right now or this environment right now is not right for me. Maybe I need to get fit and then this will be a little bit better of a situation for me. Or if you're just really good at not succumbing to the peer pressure that is group exercise. I know I am not that person, but maybe you can say, hey, I understand that right now this is fun and I can tell that my technique is changing. So I should start to slow down a little bit. I should take it a little bit easier. Even though I know that physically my body could complete this, maybe that's not right for me right now.


Hello, everyone. Everyone settled in. I'm the only person standing between you and lunch. So we'll get started. I believe 1.15 is lunchtime. I'm Shree Tumidi, and I'm a product manager at Pivotal, working on both open source and proprietary identity products, and currently working in the capacity of a senior manager of product management. And you can follow me on Twitter at Shree Tumidi. So today, we are here to discuss new features that have been introduced in UAA in the past couple of months, and also where we are going with UAA. I mean, I believe every one of you by now has heard about, like, STO and Kubernetes, and are basically trying to understand where does identity fit into all of this. So I'm hoping I can cover some of that today. So the agenda is to basically not throw new features at you, but just first of all, give you an overview of UAA, followed by new features, talk about Kubernetes, STO, and then some roadmap-related things followed by Q&A. So we'll get started. There's a lot on this slide. So I want you to read bottom to top. Any time we think about IAM and we are dealing with a cloud platform, there are two aspects to IAM, or identity and access management IAM for short. One is on the platform front, because we have to make sure that the right personas and the right systems have access to the platform and what that means. And the platform itself is made up of different things. And it's layers of things. So at the lowest level, you have Bosch, which is the infrastructure orchestration layer. It helps Cloud Foundry be multi-cloud. And we have to think about when operators come into Bosch, what is the security experience we want? Making sure that they, whoever is coming in, is proving their identity and is only able to do things that they are allowed to do. If you move one layer further, then you have Kubernetes, which is the new thing on the foundation front. So if you've heard about CFCR, which is a Cloud Foundry container runtime, it's essentially Bosch-managed Kubernetes. So you can deploy on-demand Kubernetes clusters. But then obviously, we have to think about, again, who's allowed to perform those operations? Who's allowed to create clusters? Who's allowed to push workloads to the cluster? And then we have the on-demand brokers, which provide a standard interface for how services are exposed in this ecosystem. So again, IAM for those. And then you move up one layer further. We have the core Cloud Foundry components, which make Cloud Foundry what it is. So we have the core container runtime, which is Diego routing. Routing has its own API and container networking for East-West traffic, logging, and then finally a Cloud Controller API, which exposes these things to operators and developers. So we are talking about a lot of things here that need to be secured. But the core aspect here is we need to perform identity and access management in a standard manner. But it doesn't end there. Because now, as customers, the whole point of creating a platform and deploying it on-premise or using it from the Cloud is that you want to push workloads. So we have to think about workload IAM or app IAM. I'm going to be using the term workload as a way to represent any kind of application or API or task or function that you plan on running in the Cloud. So that's what workload IAM is. But again, there are two classifications there. You are going to have apps or workloads which run on the Cloud. It could be running within a Kubernetes cluster, or it could be running in Cloud Foundry, or these could be external. I mean, the reality in any enterprise is that things are not running in one kind of environment. They are not running in isolation. You are always dealing with hybrid environments. So you have applications which are in your managed Cloud. But then you also have applications and services which are outside that perimeter. So we want to follow the model of zero trust. Like trust nothing, have explicit policy in place for identity and access management. So from that point of view, when we set out to solve the identity challenge, the one thing that we thought about was, let's create a standards-based approach to doing this. There are already standards out there for how identity is expressed, how users authenticate, how identity information and claims are propagated across trust domains. So that's where UAA comes in. So what UAA is doing is it is abstracting out everything identity-related. And it is providing you a standards-based approach to consuming identity and access-related functionality. So on the far right side, you have users in an enterprise who could be in Active Directory, which is LDAP, or it could be a federated identity store. So it could be SAML or OpenID Connect. But now think about a platform operator experience or an app operator or app developer experience. Do you want to go and learn all those protocols that I hope not? I mean, if you look at the SAML spec, it's probably like 30 pages long. And by the time you're done with it, you will ask yourself, why did I go through it? And what exactly am I supposed to implement? So what we want to do is provide you a standard interface and do basically proxying of protocols so that you do not have to know about all the different protocols that exist out there. So SAML being the oldest one, but then we have OpenID Connect-based identity providers as well. So what we give as a standard authentication and authorization interface or identity interface to platform and apps is actually OAuth and OpenID Connect. It is a much newer standard and I would say a much more lightweight standard in terms of expressing identity and performing authentication and authorization. So I'm pretty sure you all are familiar with JWT, which is the JSON web token. It is a way to propagate identity. And it's pretty much a standard set in OpenID Connect. So if you are using OpenID Connect, the token format is always JWT. But OAuth does not specify that because it deals mainly with access, not the identity. So to sum it all up, what UAA is really doing for you is it is providing a standards-based identity both at a platform level as well as at your app level, be it internal apps or external apps. Some basic concepts about UAA before we get into all the features and road map. Users in UAA can come in two shapes. One is they could be internal or they could be external. So when I say external, these are your existing user stores. So it could be like an LDAP, SAML, or an OpenID Connect compliant identity provider. Now another big puzzle piece is permissions. OK, I'm a user. I prove my identity. But what am I allowed to do? So that is something that we govern via something called as groups. So users get associated with groups. And applications also get associated with groups. So this is a confusing part. Is applications get associated with groups wherein if a user is acting through an application, the application is only allowed to do things which are set at an app level as a permission. So a typical example, say, for example, you have Facebook and you want to use your Facebook account to log into some news website or something. The first thing that will pop up is, hey, do you want this website to receive your profile? But then do you want this website to receive your friend list? But then you get to check the boxes. I want to allow probably profile information, but not the ability to access all my friends. I hope not after the Facebook debacle. So basically, you will see that you are setting access at a user level as well as the application level. And both of them together govern what a user is allowed to do in a given application context. Finally, in any organization, access is driven through groups. So a user gets access to applications based on the groups they are in. So that is a very typical way of performing access management in an enterprise. So a UAA supports this model wherein UAA groups can be derived or mapped to external groups. So it gives you another layer of sort of defining your application-specific roles or permissions. And as I mentioned before, UAA can also connect to LDAP, SAML, or OpenID Connect-based providers. So this is just like a very basic flow of everyone here is familiar with the CF command line interface. And this is just to show, OK, I talked about identity, did a lot of hand-waving around protocols, but what's really happening at the ground level. As an app developer, when you access the CFCLI, the very first thing you have to do is you have to log in. And you provide your username and password. That is actually something which the CFCLI, as a client, passes on to UAA so that UAA can, first of all, authenticate the user. And then it also validates the identity of the CFCLI itself so that it knows that the request has been made by a trusted application. So once it has done all of that authentication and validation of the client, it generates a token, which is a JWT format. And it throws it to the CFCLI. And then the CFCLI is essentially a very thin application. It doesn't have basically any kind of heavy backend or anything. It is interacting with the Cloud Controller API. So what the CFCLI does is it takes the token and say, for example, you want to do a listing of the applications in your space. It is going to call the V2Apps endpoint. But when it does that, it is actually going to pass the token that it received from UAA. And that is what tells CAPI, or Cloud Controller API, what the identity of the user is. So when Cloud Controller API receives the token, it actually validates the token before it does further processing and provides an app listing. So there is some complexity that I've left out of this picture, which is a Cloud Controller does its own authorization, which is based on spaces and orgs. And so that is done after the token validation is successful. So new features wise, the first thing or the most important thing that we've done in the past few months is we've added Google Authenticator support. I'm pretty sure you all are familiar with the Google Authenticator app, which generates one-time codes, which is based on the TOTP or the time-based one-time password. So from a UAA perspective, we are looking at two personas. One is the administrator persona, and one is the end user persona. So this end user could be a developer or an app end user. It could be any user who is accessing an application protected by UAA. From an admin perspective, what they do is if they want to enable multi-factor authentication, you would do so at an identity zone level. So identity zone is a tenant in UAA. So when you deploy UAA, you get a default identity zone, but you can create more tenants or identity zones. So MFA can be, or Google Authenticator, which is a form of MFA, it can be turned on at an identity zone level. Administrators can also reset users' MFA. So in case of a lost device or a compromised device, an administrator can go in and reset the user's status so that they can re-enroll for MFA. On the user front, there are a few things that happen. So users' experience is driven either by an application they access or a command line interface. So let's drive home the use case with the CFCLI. So for example, you access the CFCLI, the very first thing you do is you have to log in, right? You enter your username and password, but authentication is not complete at that time because the administrator has turned on MFA at the identity zone level, right? So at that time, there is an in-line registration that a user has to perform with Google Authenticator. So you basically scan the QR code with the Google Authenticator app and you are set to generate one-time passwords. So next step you do is... So this is the UI flow wherein the UI is going to prompt you for, hey, enter the Google Authenticator code. If it is the Cli, the Cli will provide an additional prompt for username, password, and the one-time code. So unless you enter the one-time code, you won't be able to access whatever you set out to access. So it could be an app listing or you could be accessing a web application. The token will not be generated until the MFA is complete. So this exists today in preview mode. There is one last thing that we are working on from a MFA perspective is encryption at rest for the credentials. So that's something that we'll provide in the next release and then it will be generally available. So what about the future use cases with MFA? One thing that has come up repeatedly is step-up authentication for users. So a lot of the times we've heard that I don't want to generate, I don't want to enable MFA for the whole user community. At the end of the day, it introduces friction in the login experience and you would rather do it on a need basis. And depending on whether you are doing really privileged actions within a system, right? So we would like to do step-up authentication for users so that we don't enable it for all the users. So again, taking like the Cloud Foundry example, we could potentially turn on MFA in the future only for administrators, but not necessarily for all the developers.  But if not, you want to turn it on only for administrators, you could do so in the future, not right now. Another feature that we've added is OpenID Connect Session Management. So that's a handful. Basically, at its heart, what we are providing is a single logout for applications. So let me give you sort of like a simplistic picture of this first. You have multiple apps that a user is accessing. So if you work with SAML and single logout, it's a very similar kind of a flow. If a user logs out of one application, you want to log the user out of all the applications. So how do you achieve something like that? So there is a spec out there called OpenID Connect Session Management, and it provides a way for achieving that using JavaScript. So when a user initiates a logout at an application, this happens today. The top part happens today. The application invokes like a logout endpoint on UAA. UAA session is cleaned up, and in case you were using some other SAML identity provider behind the scenes, we will invoke the single logout on the SAML side as well, and your session will be cleared. What did not exist previously was how do other apps get notification that application logout has happened? So what happens is the other apps, or pretty much all the apps who are using this particular JavaScript library, repeatedly check for the state of the session on the UAA front end. So this is the mind-bending part of the protocol, which is there is something called as HTML5 post message so that when you use that mode, the network traffic, there is not a lot of traffic going back and forth between the app and UAA, because with HTML5 post message, you can, within the browser and a trusted domain, you can check for UAA session without actually invoking the backend. So the app invokes like a check session endpoint on UAA, and then the session state in this case will be propagated to the app and the apps like some other app has initiated logout. So this app would know immediately that, hey, logout has been initiated, so I need to logout as well. So that's how we achieve single logout. So all of this is open source. We've introduced a new library. It's called UAA Singular, and it has been NPM packaged as well, so it's easy to sort of bring into your JavaScript apps, and it works only for single page applications. So if you're using an implicit client or an implicit flow, you can use this library for single logout. Okay. So UAA and Kubernetes. From a UAA perspective, what we set out to achieve was platform IAM for Kubernetes. So in Kubernetes, there is already the concept of a user or a service account, but if you want to sort of bring your own enterprise identity, how do you do that in a consistent manner? So what Kubernetes exposes is open ID connect interface. So with Kubernetes, if you are an open ID connect compliant identity provider, then you can plug in that identity provider into Kubernetes. So this works really well for UAA because UAA is an open ID connect compliant identity provider, but the benefit of UAA is that it does not support just open ID connect, but it can sort of federate over to like a SAML or it could federate over to Active Directory, just simple Active Directory as well. So with UAA, you basically get the benefits of, hey, like there is a consistent way to do IAM across Cloud Foundry and Kubernetes with UAA, and the UAA interface to Kubernetes is open ID connect. So how do you achieve this? So the way we tested this was with MiniCube and we'll provide all of this information separately as well as a doc article, but what you do is first of all, you need to tell Kubernetes what the identity provider is. So UAA supports something called as the OIDC discovery protocol through which a relying party like Kubernetes can discover metadata about UAA. So you need to specify the issuer URL, which is the UAA base URL forward slash OAuth token. You need to specify username claim. In this case, the username flows in the jot as user underscore name. So you need to map that. You also need to map your group's claim and I'll get into the detail of that, but in case of UAA, all the permissions and groups flow in scopes. So there is a scope field in the jot token, so you need to map that to scope. And then finally, there are two other things. What is the client ID? So you need to set up a client for a Kubernetes cluster in UAA and in this case I've called the client MiniCube and a groups prefix. So on the Kubernetes front, it allows you to introduce like a namespace for all the groups that you are propagating to Kubernetes. So I've used the groups prefix of OIDC. So on the coop config side, what you have to do is you have to specify a client ID, a client secret, the ID token, the issuer URL, and an optional refresh token. So one question that we've gotten repeatedly is, hey, like should I use the access token or the ID token because they both look very similar in UAA because they both are jot and the answer is you can use anyone. You can use an ID token or an access token, but please make sure that you do the mapping right because an ID token doesn't contain a scope's claim. It can contain external groups' claims. So you need to do the mapping right. So finally, like if UAA is asserting on an identity, the next step is what can the identity do in Kubernetes? So in Kubernetes, there is a role model already established. It's in place. Kubernetes supports different kinds of authorization. In an enterprise, the highly recommended system is role-based access control, which is simple, easy to understand, and gives you a lot of visibility into your access. So on the Kubernetes front, if you use the cluster binding command, cluster role binding command, you will be able to map a cluster role to a group of the user. So over here, I'm saying that if there is a user group of org admin, then make them a cluster admin in Kubernetes. So once this cluster role binding is in place, everyone who logs in and has a group membership of org one admin, they will be able to go in and perform operations as a cluster administrator. So you could do this at a user level also, or you could do it at a group level. So individually, I could go in and basically say that Sri gets to be a cluster admin as opposed to a group membership. But again, that model does not scale. You want to do this at a group level. The next thing is, so we talked about platform IAM with Kubernetes, what about app IAM? And what do we do today? So how UAA today is used to secure apps is you can create multiple tenants in UAA and you can use that identity zone or tenant to secure your apps, right? So like Pivotal has written their own service broker for UAA. It is called the Pivotal single sign-on service, but so have other foundation members like GE and SAP. So they also have like their own service brokers. But this approach works really well if your app framework supports OAuth and OpenID Connect on the client side. So if you've used Spring Boot, Spring Boot inherently uses Spring Security and it provides you a way to perform OAuth and OpenID Connect based authentication in a very easy way because you just use annotations and you're good to go. So if you're using a service broker, the service broker is basically creating tenants. You can onboard identity providers like SAML identity provider and others. You can perform group mappings. And on the developer side, as a developer, you can use Spring Boot to basically integrate with UAA and get security for your apps. Where it does not work well is obviously if you are not using Spring Boot, then you need to bring your own OAuth library or OpenID Connect library which is fine. It is still a standard. But then your application developers have to understand what is OAuth and OpenID Connect and what are the best practices. So this is where we are looking at STO as a means of getting basically polyglot app IAM without the need for app developers to code in security into the applications. So this is a very, very high level diagram. Like there is a lot more to STO. There are a lot of components out there.  There is pilot mixer and auth piece. But this is a simplistic representation. We don't have a lot of time to cover everything here. So we have UAA. So UAA is identity provider and identity proxy and its job is to assert identities and any other subjects. It could be a system or an app as well. In STO's model, the way it achieves polyglot capabilities is via a sidecar. And that sidecar is, as the name suggests, sits next to your application and it intercepts the traffic that is coming to your application and performs some common things. And one of the common things being security so that your app developer doesn't have to care about security related things. So with respect to identity and STO, what we want to do is a few things. One is STO by itself provides MTLS. So it provides mutual TLS between apps and services. So there is MTLS communication already in there. So we don't have to do much about that. But the community is right now working on a few things. There is the end user authentication features being added. What that means is you can write a declarative policy which says that, hey, I want to secure this application with Active Directory and I want to allow only certain users who are in a certain group to come in and access the application or the API. If you were to do it in the old way, then you would have to basically write some code in your application to achieve that. But with STO, you just write a policy. So if you look on the right side, we tested the Jot Validation Policy. So if you're familiar with the STO command line tool, it's very straightforward. I mean, there are only two things. You can either create a policy or delete a policy. So you do like a STO CTL create and I've created a Jot Validation Policy here. And with respect to a Jot Validation, you need to specify the issuer, the audience, and the keys URI so that the Jot can be validated. So this is an example of a policy. So there are other policies which STO supports like authorization. So STO supports like role-based access at service and method level. So what that means is if you have a REST API and you want to secure all your GETs and you want to allow a certain persona to perform GETs but not posts. So you could do method level security. You could do that today with spring security if you use like pre-authorized filters, but STO just makes it much easier and makes it policy-driven. So our hope is that we can bring more of STO capabilities into the platform, into our platform, both on Cloud Foundry and the Cloud Native Experience as well as in the Kubernetes Experience, the CFCR. I just want to do a quick time check here. Okay, so we only have one minute and I have two slides. So I'll get through it fast. So roadmap. So I'm pretty sure like you all are using UAA today and a lot of feedback that we've gotten from like our big customers, right? Like I'm talking big banks and retail and we have all kinds of customers is that they don't like this approach of like UAA being shipped in every deployment and UAA being shipped in different layers. So Bosch has its own UAA. When you deploy or do a CF deployment you get another UAA. Now there is going to be CF container runtime and it's going to have its own UAA. Where does it end? Now we will introduce functions and does it get its own UAA? It becomes a nightmare in terms of like managing all these UAAs at an enterprise scale. So what we would like to do is at least on the open source front basically start with like a reference architecture of how to run a shared IAM service. Now shared IAM service is not just UAA but it involves like other security services like CredHub which is for credential management and permissions as well which is another project that we've kicked off in incubation and it deals with fine grain authorization. So there are two dimensions to this solving creating a shared IAM service. One is the product dimension that having a common UAA across platform and all aspects of the platform and for apps as well and being able to do that across foundations. So a typical sort of like a Cloud Foundry customer is going to not have one foundation but like multiple foundations because they want to have like a disaster recovery setup but also they want to get multi-region support, right? So in those situations if you were to have a shared IAM layer which is resilient then you are basically able to reduce your operational burden, right, of being able to replicate the same configuration in so many places. So that's where this reference architecture is going to help you out. So what we want to do as the UAA team in this case is test out these different configurations and provide that reference architecture and one of the biggest things we have to do is pick a persistence layer which are layers because we have to be multi-cloud so we cannot just pick like Google's like distributed database and expect customers who don't want to use say Google and want to use Microsoft. So we want to provide like options. This, I'm going to share these slides so I'm not getting to the details of these but this is what the team is working on right now. We are doing, we are extending our OpenID Connect support so today we support OpenID Connect via the UI and we are adding a native support as well wherein we can collect the username and password and pass it on to the OpenID Connect provider. On the interface front, we want to revamp our UI and we also want to revamp our CLI. There is a lot of improvements that we could do there and we would like to get into that. Finally, there has a lot that has happened since I last presented at the summit and now there have been a lot of communities that have gotten kicked off around security. It's not just Cloud Foundry anymore, there is Kubernetes out there, there is STO and recently we kicked off another, I would call it a working group. It's called SAFE, SAFE Access for Everyone and the charter for this group is Authorization Interop. Today, there is only one standard for authorization which is Zakamal, it works, but it doesn't work also, it's very heavy and what we have set out to do is first of all, figure out what providing a reference architecture again for authorization in a hybrid environment and what that means and basically go from there and see if we want to create a standard around it. Questions? Yes, yeah, okay. So the question was what are the reporting capabilities that exist in UAA today? So in UAA, we have audit events that get generated for all administrative and access and so those events can be streamed via Syslog. So in Cloud Foundry, there is a component called Logurgator which is able to sort of stream out all the events not just from UAA but from other system components as well and you can then have like a SIEM product like Splunk or some other product wherein you can do correlation and you can have reporting there but out of the box, we do not provide any reporting capabilities, so to speak. You can plug in your own reporting into UAA through the Syslog channel. Does that answer? Okay, awesome. Any other questions? Rajesh? Yeah. So the question is like, is the reference architecture on the roadmap or are we asking for feedback right now? So it's on the roadmap because we want to test out what we propose and make sure that it can work at enterprise scale and it can work in a multi-cloud environment. So the point of creating a reference architecture in the open source is to help the community but then we would like to take that reference architecture on the pivotal side and sort of weave that into our enterprise offering so that pivotal customers in this case just get that support out of the box. Sure. So the question is not all apps are in the cloud. It's a hybrid environment. So do we need to use the same service? The answer is it depends because if those applications have to interact with apps and APIs on the platform, there should be some trust set up because they all either are trusting common token server like UAA or UAA is capable of performing a token exchange with a provider that the external apps trust. So and we support both the models. So one of the goals of the shared IAM service is to be able to provide that service to apps off the platform also. And we do that today with the service that we provide as part of pivotal. But since we use standards, nothing is stopping the external app developers from leveraging the same server as long as you can talk the standard or you can use the token exchange to get a compliant token to make a downstream call. Okay. Thank you everyone. First coming time.


Appalachian Wireless and Samsung proudly introduce Black November all month long. Get the Samsung Galaxy S9 for just a penny. The Galaxy S9 Plus just $99.99 and the Note 9 just $249.99. Black Friday all month long at Appalachian Wireless. To your agreement required, see store for details. We had over 17 churches combined to make up one church to serve the community dinner here in Pike County. We actually sent 4,600 meals delivered that day and we had several hundred to eat in at the expo. You know the city of Papua was really gracious volunteering the expo for us and that was a big help. The day of the event we had over 30 churches at any given time they're serving along with miscellaneous volunteers. We were looking at approximately 350 volunteers throughout the day.


Oh, we waited too. Uh, are you waiting until marriage to have sex? You are. Is waiting for marriage really just purity culture? Is your relationship destined for disaster because you didn't move in with the person before you got married? How far is too far physically? All this and more in today's video. Stay tuned till the last video I'm gonna respond to today because I think it has some of the most relevant application for us. Without further ado, let's dive in. This video is made possible by the Daily Disciple Club on Patreon to support my mission of equipping people to follow Gia's daily. Join Patreon today. So I was really sad for this couple because I once was this couple and then I saw this couple. Oh, we waited too. I didn't know they're like the regret of abstinence. The regret of true love waits. The regret of not just having sex. Okay, so personally I would not make a video like the one that she was reacting to. It was just kind of weird and cringy. It's like, why are you doing those dance? Like you're just trying to get clout basically trying to get people's attention. I get you're excited, but I don't know. To me, I'm like, you can verbalize it in a different way than making that video. But it's fine. Whatever. Make the video that you want to make. That's cool. Now she's making fun of this couple for waiting because it isn't worth it and it won't be that good and it will actually be awful. Actually could be awful. And I think a lot of this comes out from the mentality of purity culture. Like they were told if you wait, if you wait for marriage, then you'll have this great fulfilling relationship and all the things that come from that. And then when they have these expectations, they go into these unbiblical expectations. They go into waiting and they're kind of this pragmatic. Oh, well, if we wait, if we put it off for now, we'll get this jackpot at the end of the rainbow. But then they didn't experience that.  And I get that. That's one of the lies of purity culture. But I think it's important that we define what is and isn't purity culture as we're talking about saving ourselves from marriage. Because I see a lot of evangelicals and atheists and people that are now deconstructing Christians say, oh, you know, purity culture, it's all these kind of outdated ethics from the Bible saying that you need to, you know, wait for sex when you're married and all this. And I'm like, hey, that's not actually like maybe you can call that purity culture, but that's just traditional biblical ethics. That's actually in the Bible. To me as a Christian, when I talk about purity culture and some of the negative things that come with that, I'm talking about things that are extra biblical, the things that were do's and don'ts that were promoted to bolster your relationship or that you have this kind of great relationship in the end.  And I'm like, that's not biblical. That's not why we, why we wait. And also this kind of shaming that was accompanied with purity culture, this lack of redemption and an understanding of Christ redemption. I'm like, yeah, I don't want any of that. That's not biblical. That's not good. But then we look at the Bible and we see, okay, hey, look, we're supposed to flee sexual immorality. So God actually does have a standard. So for the Christian, there's this twofold perspective. It's that we are commanded by God to flee sexual immorality, but at the same time, we have all fallen into sin and all have become impure and in our need of Christ redemption. So whether you've waited for intimacy your whole life, or maybe you've stumbled in the past and have encountered Christ redemption for both groups, it's important that we understand that our motivation here is key. Why are we seeking to honor God with our sexuality? Are you doing it because you think it's your ticket to secure future blessings? Or maybe getting God's good books? Or maybe even contribute to your own salvation? It won't. So why do we pursue the things of God? I often think of a criminal who stands before a judge after committing many, many crimes. The judge, as he's about to sentence this man, comes from his chair, takes off his robe, and says, I will take this man's punishment. That is what Jesus did for us. And that is why we live out of love for him after the grace and mercy that he showed us. Now coming back from the analogy, as Christians, we live with the Holy Spirit dwelling inside of us with God's power and presence in our lives that enable us to walk in love and obedience towards God. So further, how do we understand what is purity culture and what are actually the true right and good commands of God? Well, explore the scriptures. Take God at his word. Also, here are two additional resources that will help you understand purity culture in light of biblical truth. The first is a book, which I do not have. Let me go get it. Okay, I got it here. So it's called Pure by Dan and Sarah. I don't know if that's how you pronounce it, but why the Bible's plan for sexuality isn't outdated, irrelevant, or oppressive. This is a solid read. And also a video that I did on I Kiss Dating Goodbye, one of the most controversial Christian dating books in history that many believe set the groundwork for purity culture. You're going to want to watch it. You should live together before you get married, definitely. And you should also live together before you get engaged. That first year living together is very important. I recommend you live together for at least a year before getting engaged. It takes time to build up the foundation. And then when you do get married, you already have a fantastic relationship. Man, these relationship gurus on social media are so funny to me. Like, it's like he says it with such authority. And you know, you need to, even before getting engaged, you need to move in with this person. The second you meet this person, you should move in with them because then you can build that foundation. It's like, bro, you can build a foundation outside of moving in together. And yet, and you ever think that those things that come with moving in together might be a distraction from actually building a real foundation? Okay, but beyond that, people often quote the statistic. It says that people who cohabitate before marriage have a 50% higher divorce rate than those who don't. For some folks, statistics might be very convincing and they're like, oh my goodness, the statistic indicates thus this is how I should conduct my life. As Christians, and as a Christian personally, I don't really put that much weight in statistics. I don't use them as the guide for my life. As Christians, we should be people of the word, not people of kind of evaluating these pragmatic statistics. Because today, the statistic says, don't move in with your partner, otherwise you're gonna get divorced. But what about tomorrow when it says, move in with your partner, and you know, you're gonna have a great life? It's like, oh well, am I just, is this my new master now? Am I gonna do whatever the statistic dictates? I hope not. And look, it's nice when statistics back up biblical truth, but that doesn't mean that we, you know, all of a sudden biblical truth is more authoritative now that some guy's statistic says it is. Look, people can espouse many different pragmatic reasons for wanting to move in together. We're saving money. We're building the foundation of a relationship. We gotta see if we're compatible. But honestly, a lot of the conversation around this topic makes me feel very icky. Let me explain. Have you ever heard the phrase, you can't buy a car unless you've test-driven it? And people apply that to this context? It's nasty. It's objectifying. It's like, oh, I don't want to be with you unless I know that I'll get what I need from you. It's like, oh, that's so weird. The focus is personal sexual gratification. I need to make sure I get what I need out of this relationship. And if I can't, then I don't want it. It's about me. It's not giving. It's not selfless. It's not sacrificial. It's selfish, which is the exact opposite way that the Bible talks about marital sexuality. Take a look at 1 Corinthians 7. Now people say it's risky not to move in with the person first because you don't know if you're going to, you know, mesh together and, you know, ultimately you don't want it to be hard. That's what this whole thing is about. It's about avoiding hard things, avoiding responsibility, avoiding commitment before you know that it's going to be what you want it to be. But all the while we're perverting God's design for sexuality in order to not make it too hard or uncomfortable on ourselves. But that's not the deal. That's not the design. Husbands were created to love their wives as Christ loved the church. And likewise, wives are called to love their husbands as the church loves Christ. And when we look to Christ, he was the perfect example of a self-giving sacrificial love asking nothing in return because we had nothing to offer. And so in this waiting period before you're married, yeah, it's tough to wait. It's tough to be patient. And yes, you're going to make mistakes, but ultimately we look back at the Holy Spirit inside of us. They're giving us His power and His presence in our life that we can overcome temptation. God would give us a way out of temptation. We just need to look to Him for that strength. Okay, so you met at church. You've been dating for six months. Are you waiting until marriage to have sex? You are. I'm glad someone said it. This is a pretty good analogy of what the world does when they see Christians living out their faith. They laugh because it's funny to them. They don't understand it. It doesn't make any sense. Why would you wait when you could receive this kind of instant gratification to get what you need to fulfill these desires within you? It doesn't make any sense to them. This idea of denying yourself, picking up your cross and following Christ doesn't make sense to a yet to be transformed heart. In the midst of that though, I found it to be helpful to clarify, hey, I'm not doing this just so I'm a good person or to somehow earn my way to heaven because often that's what people associate with waiting for marriage. And maybe that is some people that are waiting for marriage their perspective. This makes me such a good person or this is going to earn me favor with God. It's like, no, that's not the reason I'm doing it. I want to honor God because He died for me because He loved me even in my sin and He bled and He sacrificed Himself for me. And that is why I want to give my life to Him in service to Him. And yeah, I'm not perfect. Yeah, I stumble. Yeah, I make mistakes. Yeah, I'm not a good guy. But by God's grace, I'm seeking to live for Him every day. And yeah, some people might not get it and they'll make fun of you for it. But what are we called to do as Christians to turn the other cheek to love them even though they mock us because look at what our Savior went through. What we were going through is nothing compared to what He went through on our behalf. So the least we can do is love these people graciously and try to exemplify the sacrificial love that God has for us. Are you guys... Can you do other stuff or...? You can't... Oh, I f***ing love you. She goes... Sorry, if you're not religious, I'm sorry if this doesn't resonate with you. Okay, so just to be straight up with you guys, I don't think this is a good mentality for us to have as Christians to be like, oh yeah, we're not... Do we're saving that for marriage but we can get pretty close to the line if you know what I mean? It's like, that's just... No, like that's not honoring to God. Like, how... Why are we trying to get as close to the line of sin as possible basically just for our own pleasure and enjoyment? It's like, hey, we're called to flee sexual immorality, to be wise. Why are we going across these lines so close to the line just because we think we're going to get something from it or because we think we're cool or sneaky or something? It's like, no, it's not worth it. Boundaries are definitely important in relationships and you should have that conversation with your partner and maybe even mentors or parents in your life to say, hey, what's wise here? How can we best honor the Lord in this? Not because you think you make a good person or earn your way to heaven or because then you're going to be deserving of this wonderful relationship down the road. It's like, no, we do it now because we want to honor God because we know it's going to be challenging. We know it's going to be tough that even when we get married it's not going to be perfect just because we did it the right way but we honor God regardless. Okay, last thing and I need you to listen to me. If you've had this video playing on in the background you haven't really been paying attention. If you haven't heard anything I've said up until this point, listen to this. Don't let your sexual sin separate you from God.  Let's say you made a mistake. You sinned sexually. Whether that's pornography whether that's sleeping with somebody whatever that looks like. Don't let that put a border and a wall between you and God. Confess it now and he is faithful and just to forgive us our sins and cleanse us of all unrighteousness.  God bless, friends.


Hey everyone, welcome back to figure fantasy. So we have your impressionism and new one is codes in color matching We will start with hard and let's see my lineup Okay, so here is the first lineup if you need a second lineup, you just have to swap Rie for Sakura at the back, but I'll be I'll be going with the first line up first We will see how this does Okay, so the key here is Taking out plain milk within 11 seconds making sure that Lafayette is behind Yuna The deal that much damage So that we can take him out in 11 seconds So again take note if you want an A option to this lineup you can swap Sakura for Rie with the same position. So there you go Okay, three star clears and we're off to the next Okay, so the last one would be torment and let's see my lineup. Okay guys So this is our final lineup for the final match Did a lot of combinations but stuck with this one because I think so far this has Only clear out of the lineups that I tried out So far our objective here is to make sure that your front line is actually staying alive and can deal damage so timely heals there and So far we need five seconds more To do it and we have it guys So by the way if you have problems with this lineup Just do it again because RNG also plays a big part in this one. So thank you guys. Stay safe. Take care This is the warden and I'm out of here


A 20 year old woman that was stabbed Friday while walking in downtown Bemidji is now reported to be in fair condition. According to the police report, the woman was stabbed nine times. That includes three times in the neck and once in the left breast. The victim is currently at the Sanford Trauma Center in Fargo. Court documents state she identified her attacker to both the police and the doctor. A person reported to the police that a woman matching the suspect's description was walking down the street, however it was determined to be a different woman who was then arrested for an outstanding warrant in an unrelated matter. Anyone with information about the stabbing is asked to call the Bemidji Police Department at<PHONE_NUMBER>. If you've enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland Public Television.


This is a video to show you how to simply extend two data cables with a cable coupler. These inline joiners are great for extending a patch lead or a quick extension. Simply take two data cable plugins and plug in to extend. Ensure you hear a distinct click for a good connection. For further assistance or a free survey, please email or call on the details below and click like and subscribe if you have enjoyed this video.


This paper provides a comprehensive review of hydrological drought frequency analysis methods. It discusses the use of various statistical distributions such as the Weibull, Gumbel, Loved Pearson III, Loved Logistic, Loved Normal, Pareto, Rayleigh, and Loved Normal distributions. Additionally, the authors present a detailed description of the method of ordinary moments and the method of linear moments, which can be used to estimate the parameters of these distributions. Finally, they evaluate the performance of each distribution by calculating the relative mean error and relative absolute error. This paper will be useful for hydrologists who wish to analyze hydrological droughts using frequency analysis methods. This article was authored by Christian Gabriel Onghell in Cornell, Iolinka.


This is stock number 9T26B. We are here at Summit Automotive in Fond du Lac, Wisconsin, your new and used car headquarters. Today we are checking out this ultra clean 2014 Kia Sol. This vehicle has the plus package and it has the 2 liter 4 cylinder dual overhead cam motor which pumps out 164 horsepower. From this HD video you will be able to tell that this car is extremely clean all the way around. Latte brown is the color. We shoot all of our videos in 1080p so if you have HD capabilities on your computer tablet or smartphone device turn them on right now because it is like you're right here looking at the vehicle with me and definitely your best way to check out the vehicle before seeing it in person. It comes with the factory alloy rims. These are 17-inch rims and they have Kumho Sol as 215.5 R17 tires on them with about half the tread left on those tires. Front wheel disc brakes looks like the brakes in the front are pretty new. Didn't see any dents or dings on the driver's side fender. The headlight lenses are nice and clear. I didn't see any dents or dings on that hood. It is in excellent condition and the whole front bumper is in really great shape all the way around. Passengers side fender is in nice shape as well no dents or dings and the passenger side rim has no scuffs or scrapes. As you go down this side of the car take note that there are no dents there are no dings and how reflective and mirror like that paint is really a cool looking color on the sole and really really well taken care of. I didn't see any dents or dings anywhere on this car and uh yeah it's pretty clean. Back rim is in excellent condition and the back tires have just as much tread as those front tires. As we come around to the back of the vehicle you can see just how clean the rear bumper is. No dents or dings or cracks on that. The rear gate is in excellent condition as well as the sunshade there and you get a little bit of storage underneath.  It's actually a really light gate to get up really easy. Down this side of the car nice that the sun came out you can see that color a little bit better. Very clean on this side no dents or dings and for full disclosure this back rim is in excellent shape as well. Down the rest of the side of the car no dents no dings no scuffs no scrapes has the built in directional signals inside you get the umber black with the yellow stitching interior cloth seats really like the yellow stitching makes it pop factory floor mats stability control power windows power locks and power mirrors as we hop inside the car here you can see that this one has 33,992 miles you got an outside temperature display as well instrument cluster is very nice and clean steering wheel is in great shape no major scuffs or scrapes or wear on it and you got cruise controls on the right bluetooth and audio controls on the left comes with an AM FM and Sirius XM radio capabilities factory um climate control down there has an aux and a usb jack right there and it does have an automatic shifter has the yellow stitching on there as well passenger seat and floor mat are in nice shape no rips or tears on that this car has never been smoked in smells very very clean and the headliner is in excellent condition you do to get a compass mirror with the home link buttons on the bottom of the mirror kind of hard to see with how bright it is but they are right there and we'll take a quick look at the back seats and then we will check out under the hood back seats are just as clean as the front seats there are no rips there are no tears back here it does have the latch child safety system carpeting is very clean back here these seats do fold down for extra storage and we'll take a quick look under the hood I would personally like to thank you for checking out the video today hopefully from this HD video you will have been able to tell just how clean this Kia Soul is all the way around inside and out under the hood we have the two-liter four-cylinder dual overhead cam motor 164 horsepower engine bays very clean runs very smooth this car has been fully safe and inspected by our service shop has a fresh oil and filter change all the fluids have been checked and topped off the car has been gone through mechanically 100% and is 100% ready to go you probably won't find a cleaner soul than this one and to see more pictures of this car or one of our other 450 new and used cars trucks SUVs minivans wranglers you name it we got to go to our website www.summitauto.com full pictures and descriptions of every single vehicle from two locations all at summitauto.com and if you'd like to check out more HD videos you can go to youtube.com slash summit auto remember to like subscribe and share on this video and all the videos that you see there in fact in a second you'll see a link to subscribe to our youtube channel on your left a link to more used inventory videos like this one on your right if you have not been to our website on the bottom a link to this vehicle on our website click those check us out and we really look forward to helping with this super clean 2014 Kia Soul plus package thanks again