That hope sign in the background is going to be ironic for this video. I'm actually not sure about the wisdom of filming this or not. I'm really not sure if it's going to go up online or not. If you're watching this, you obviously know what decision I made. Hello, my beautiful internet friends. Welcome back to Sunday. We're going to talk about something pretty challenging today, a difficult subject for a lot of people. So let me start off by saying, first of all, definitely a trigger warning. If you have any issues with suicide or depression or anything along those lines, and today is not a day to hear about stuff like this or hear someone talk about it, please navigate away. I will put a link to an adorable video of puppies in the description down below that you can watch instead of this video. Secondly, I need you to know that I am okay, that I do have help, and that I'm going to make it. But I wanted to tell you honestly about where I am and about what being suicidal looks like for me. Why? I think it's kind of important to talk about for a couple different reasons. First of all, it helps me. Second of all, it might help you. But lastly, or thirdly, I don't think thirdly is a word. I don't think that being suicidal always looks like what it's portrayed as in the media. I don't personally feel like I fall into the box of what being suicidal looks like, right? And so from the outside, it would be very difficult to recognize. So I wanted to share my experience today and that's pretty much what I'm going to be doing and just talking from my perspective. Carrying on. You guys know things have not been super awesome lately. Struggling with staying alive is not a new thing for me. It's been on and off for the last eight years. I've had significant issues with depression and anxiety and post-traumatic stress disorder and just feeling like there is absolutely no reason to stay on the planet anymore. For extended periods of time, but I've always found a way to hold on. I've always found a way to make it through. That feeling has definitely become overwhelming again lately. I think it's probably triggered in part by a lot of setback, but also it seems to be how my brain works sometimes. I haven't yet figured out a way to fix it. If that's even possible. I don't know if it's possible. So the last few weeks have been really dark. It's so weird to sit here and smell out the camera and say that I spent a lot of many days actively trying to distract myself from wanting to quit life. But I do. I also have a really happy life, a very happy marriage, amazing friendships, a great family. And I spend chunks of many days thinking about how I just can't be here anymore.  And when I'm around the vast majority of people, I know it doesn't appear that way. I'm engaging. I can carry on conversations. I smile. I laugh. I'm interested in other people's lives sincerely. Like that's not a joke. That I'm not faking it. But then there's just like incredible emptiness. And the second that I am not, that the on button in me is impressed, I am just dead inside often. We often hear about like the signs and symptoms of someone dealing with depression or suicide. And there are things like withdrawing from activities that you love and giving away possessions and things like that. Those have never been indications for me ever. I would say almost the opposite have been indications. I try to get like more involved in things. I try to do more things I like. I try to like, you know, become more engaged. Maybe I pull away from people. But I think I'm a really good example. I didn't think I was gonna get emotional at all in this video. Why it's important to check on your friends who struggle and ask them how they're really doing? Because I think I could fake just about anybody out right now and like always. The other thing about being suicidal that I feel like is not well represented is that it's almost always talked about like feeling worthless. Like your life is so meaningless or like people don't care about you. You don't feel love or you don't feel like you matter. You feel, you know, worthless. I don't feel that way. I don't feel that way at all. And I'm incredibly lucky and grateful not to. I know that I have a lot of value. I like who I am. I work on becoming a better person every day. But I put a lot of work into myself and I'm proud of the person that I am. And I like I said, I love the people around me and I know that so many of them genuinely love me. They really care. I have people in my life that would pick up the phone if I ever called and needed them. I don't presently struggle with a lack of feeling loved or like I'm worthy of life. I almost feel the opposite. I feel like I could go through life bringing a lot of value to other people but always feeling broken. Always always feeling like this rock in my chest. Always feeling like it wasn't enough and always feeling so very sad at the bottom of all of it. My worry is that it will never change and what happens in the moments that things get really, really dark. I almost get tunnel vision. My therapist talks about it like a funnel.   In the minutes when things get crazy dark for me, I find it nearly impossible to believe that anything will ever get better, that I will ever feel differently than I feel in that moment because I have so much experience feeling that way.  At the end of the day, I'm always going to be empty. I'm always going to feel this brokenness and I don't want to deal with that forever. And a lot of people have these like visions or fantasies of what would fix the problems in their lives. Like Brian, for instance, really likes fancy cars like super cars and if he could have like one or two and we were financially stable and didn't have to worry about money and he could just like take care of his super car and me and the puppies and the kitties. That would be his perfect life. He sees that and he's like, I would be perfectly happy. Now, what are the issues in that life? Of course there would be, but to him in moments like when he said, he's like, I'm sad or upset because of this, this would fix it. I don't have that. I can envision literally the perfect life where I have everything that I've ever wanted where I can impact people and achieve things and do literally like the biggest things that I could picture and I could see that happening and I can't picture it without that feeling. And so I begin to question like, what am I doing here? Do I really want any of this? If I'm always gonna carry around this darkness and this sense that like at the end of the day, everything is meaningless at the end of the day, I will never feel okay. And that feeling itself is kind of hard to quantify, but it's almost like a physical emptiness in my chest. Like I'm not really living my life. Like I'm not really here. That emptiness, that darkness feels like it's whispering the truth to me that nothing is really worth anything and nothing really matters. And then it's always gonna hurt. Here's where this video gets a little more uplifting because it's been dark for a little while now, hasn't it? In those moments, it's not about convincing me that that feeling is wrong because there's not a lot of great cognitive thinking going on. I have learned that the most important thing in those times is to distract myself. In the past week, for instance, I was kind of spiraling fast.  I need to get out of the house. Like I have to go. I'm gonna go work at a coffee shop. And even though I didn't feel like doing that even though I didn't want to do that, I literally like made myself go through the steps of like packing things into my backpack and like getting in the car and driving to the coffee shop and sitting there to work because I knew that like even just a change of location might jar me out of that mindset just enough to give me to the end of that day and things might be better the next day. Other times it's calling someone just to have a conversation. Maybe not about anything serious. Sometimes it is to have a very serious conversation about what I'm feeling. Sometimes it's taking the dogs outside. Sometimes it's literally anything to like just get my mind doing something different to distract myself because otherwise I will keep spiraling and that's when things get really dangerous. Something else that I found is really, really important is to find people who don't overreact. When I express how I'm feeling, what I mean by that is it's really important to take people seriously when they say that they're suicidal or they're struggling to stay alive or they're super depressed and don't know what to do. Like it's important to listen to be there and to take those words seriously. But for me, when I've expressed that to people and their reaction is to be like, oh my God, I'm so sorry. Like what can I do?  So I no longer get the help that I need in that moment if that makes sense. So I have people in my life now that I can text like, hey, I really feel like clip jumping today because that's a joke I have with a lot of my friends and depending on the wording in the situation in the day you have every right to feel that way. And instead of like calling the police or like calling me and being like, oh my God, whatever they might you know, give me a call and check in or send me a message back being like, hey, I really get it. I understand maybe I've been there myself but don't go clip jumping, you know. And the reason for that is because we've had conversations where I'm like, hey, I don't need you to panic when I talk about this. Sometimes I just need to talk about it. And so two things if you struggle with these kinds of thoughts and feelings I would say that it's important to talk to people in your life and then kind of set down guidelines of what you need in those moments. I mean, do you need someone to panic on your behalf? Honestly, does that help you? Cause I think it does for some people or do you need someone to just be quiet and listen? What helps you and then communicate that to them in advance that when you get to those places they can give you what you need because it can be really hard to hear someone say like I'm thinking about killing myself. If I heard that from someone who hadn't told me how they wanted me to respond, I would definitely feel lost. I'd try to do like whatever I could but giving people around you context on what helps is really important. And if you are on the receiving end of that if you've heard someone say that to you I think it's important at least in my personal opinion. This is just my experience. I'm not a professional to not panic and to not make it about you. It can be extremely affecting to hear someone say that it can feel like maybe you're not doing enough as a spouse, as a parent, as a friend, but that's not what it's about. I promise you that is not what it is about. It is not a personal failing of yours or of theirs. So listen, ask how you can help but try your best not to make it about you. Try your best not to completely panic and try your best to be present in that moment because I found that that is really helpful to be on the receiving end of. Final thing, a recent development in my life. My counselor and I were talking about this because I talked to her honestly about what's going on and she told me that it's important to know about actual resources in your area, like 24 hour resources because what I always had in my head is that like if I ever got to the point where I thought I was actually going to kill myself that if I called 911, they would immediately like put me in a site hold for 72 hours like that's not something that I want. And so I thought that was like the only option like either call my counselor if it's work hours and she's going to answer if the help that I need is beyond talking to a friend or that I would like go to a hospital or call in 911 and then be like in a site hospital, right? Like I thought those were the only two paths possible and she was like, no, absolutely not. There are places you can go where there are 24 hour counselors available. So now I have a list of those places in my area. Find what resources there are for you. There's also these cool apps that are remotely sponsored. I'll link one below that I've used that help you in those moments. Help you remember what to do like what your personal safety plan is like who you're going to call when you feel that way which are really helpful because again you're not really thinking that straight when your mind gets that dark place. That's my experience. It feels very exposing to talk about that but I also think it's something that needs to be talked about more often because I have rarely run into someone who will have an honest conversation with me who has reached adulthood who hasn't struggled thinking about suicide at least one day in their life. It's way more common than we think it is and it's a serious thing but you can absolutely find what works for you find help for it and find a way through it. I'm in that dark place right now. It's not just because I'm having lots of issues with my life. It's not just because I'm in physical pain. It's because my brain does this anyways and those issues probably exacerbate it. I need you guys to know that I honestly will be okay. I'm not going anywhere. I know what to do in those dark moments and I will continue to do that even if in the moment it feels completely futile and helpless and hopeless because I know that there always is hope as that sign and this tattoo say I am not going to give up and I will continue to put more pieces of help in place if things ever get more serious and I would encourage you to do the same thing and just a word of reminder if you know people who struggle with this sort of thing check on them. It doesn't always look like what you think it looks like when someone is struggling with suicidal thoughts or deep dark depression. Sometimes they look incredibly functional. So thanks for listening guys. I really appreciate it. Let me know your thoughts and your reactions in the comment section down below. I kind of feel like this is in vain to say after I just express all that but please don't worry about me too much. I truly will be alright.  So thank you for your words. You really help me. A huge thank you as always.  I appreciate you guys so, so, so very much. Thank you. I love you guys. I'm thinking of you and I'll see you in the next video. Bye guys.


like i don't do this for the money um i wish i did and that's why i treat it like a job like i treat it like a job because i want it to be a job okay so i also wanted to add into this video about um my upload schedule like my goal is always three videos a week but honestly um i want to not have pressure on me so it might be two videos a week hi guys good morning it is a seven ten a.m it's a little earlier than that because my clock is fast but i'm gonna head to the raw juice bar in Orlando guys i don't know why after i had that initial first like raw green juice which if you're not following me on instagram you wouldn't know that because i was a little bit more active on instagram i'll talk about that a little later into this little video this little impromptu video because i have literally nothing else to post for this week so i'm gonna go get my juice and then we're gonna do like a little car chat juice vlog i guess um my hair's looking wild because i got out of cycle bar and yeah anyway gonna get on the road to get the juice the place opens at 7 30 which is good because that gives me just enough time to like you know finish everything get ready and then drive over there this place is like really close to my work so it's really convenient as well um so yeah i'm just gonna head over there now i just wanted to start out the video and say hey hair still looking a little crazy here because it's still a little damp from my sweat but um got the green juice this one is um the green goddess version and it has kale apple pineapple um to cleanse and purify your body and this stuff is like kind of expensive not gonna lie that's why i actually like drink it and stuff they made them yesterday they were all out of the um green and lean apparently that one sells out fast which i'm kind of glad i got to try it but i'm gonna try this one i'm a little nervous but it's fine it's probably like similar to the other one yeah it's pretty similar it's just a little bit sweeter because it has the pineapple in there honestly i kind of like this one better and you can taste the apple too so this is really good kind of wanted to talk to you guys about like my feelings on youtube because i'm kind of just like burned out in a way and partly it is because like i'm just views or not is like where i'd want them even though if you scroll back on my videos some of them a lot of them are doing a lot better so that's good but also a lot of people are like unsubbing so it's just a little like disheartening but it's fine that's youtube that's life um so it is what it is but it just like is discouraging and like it makes you go like oh why like but whatever you know maybe it's because most of those people um came from my adoption stuff and i don't really do adoption stuff maybe it's because of like some commentary like the video i made about the staffers i never really thought i would get that this far as i have on youtube so like it's really good um that i have but i don't know i just wanted to like open up and like share my thoughts because um i want to shift my mindset on this channel i want to shift it to like not caring as much you know like yes i do partly for the money but i need to like reset and get the mindset that i had a while ago when i had 7 000 subscribers of because like i love doing this and i don't want to like get boggled down um just because of like numbers because i never in a million years thought i would even get a viral video i could have never imagined that for myself so like that really randomly happened it happened in a really good time too not gonna lie because like i was you know going through sad time with like you know the pandemic the all of the things going on in the world pretty much boys you know so i'm like like when my channel blew up was really really good so the timing was perfect so it's almost like i felt like i really needed that um but i never once expected to get to where i am now so i guess if like i get down to like 37 like that's more than i ever could have dreamed of but you know it's just like i want to be open with you guys i want to just say it how it is like this sucks man like i don't know what i have to do and i wanted to bring up this topic too i miss youtube the way it used to be with like the saturated cool fun intros like that's what made me love videography and it's not like i couldn't do that now but it's just not in style and like you know this this whole like i think it was like ever since imma chamberlain hit the internet it was just like this whole like different vibe shifted on the internet and i don't like it like i'm just flat out say like i like the bright colorful saturated good videography like does this take a lot of effort no but i i liked having working on a video and like having it be like cool angles and have someone like film me like i think that's awesome like i think that's so fun and like i'm not gonna do that for like no one to watch it like let's be real so i just i don't know and youtube now i mean i guess i watch a lot of commentary because i'm genuinely interested but i wish there was like better people to like watch like i don't know like who's out there like i i mean i watch commentary because i find them interesting in like what they have to say and i think this is where like it's shifting into i think this is why podcasts have gotten just so big because of listening to things in the car because i listen to podcasts in the car like i don't listen to music anymore um pretty much which i mean is kind of weird but i like podcasts i like listening to people talk instead of like music i don't know why it's just i've gotten into that guys this one's really good i like this one a lot better than the other one and there's a cool tesla parking behind me so yeah my thoughts are i have youtube burnout and um that's why this week's episodes episodes these week this week's uploads have kind of just been a little bit sparse um because i don't know i'm just like tired and um we had company in town as you guys know but i still worked but my aunt was still here and we were like busy and doing things and like i don't know i'm just tired i was just kind of tired from that and i'm still kind of tired from that so that's why i just wanted to break and then like you know every time i just open up the app it's just like oh the subs are like feels like it's dwindling down and i'm like okay whatever because there's nothing i can do about that but i want to know who you guys watch because like right now i watch a couple family vloggers i know hate me unsub for me whatever um i watch gretchen garrity i like her but half of these people like are just like unrelatable because like i can't spend the money they spend like even though i'm here like with a juice that costs like way too much money these things are expensive these things cost like 11 dollars at least i had that coupon for a dollar off but like at least it's good for me too so i'm not gonna complain man the juice bar be hoppin let's take gretchen for example like i love her channel i think she's really positive and i like listening to her talk everything i love her podcast but like how can she like spend so much money like i'm like whoa girl social media must be great for you it's like i'm over here like barely making it i mean no i'm lucky to make anything online like i know most people don't so i should just be grateful for what i have which i am grateful like i'm not saying that i'm ungrateful but i'm just like letting letting it out because again i want to shift my mindset about this channel i want it to be real i want to tell you guys how i'm feeling you know like i want to be like your companion in your car or when you're making food or whatever because that's what i like to watch and i would want someone to also do that you know what i mean i don't know if i'm making any sense but the youtube burnout is real i don't know like who are the good content creators now because like i get at alisha and remi and mia they've all they are still like produced content for the internet but they've kind of like you know moved on like i've moved on so i don't know what are you guys are watching i can't watch like university vlogs or college vlogs because like i'm not in college anymore so i don't know what is out there guys like also i know this is like changing subjects really quick i've been reading so many books and um i read all three of rachel hollis's books which i know don't come for me i know she's kind of controversial and like i mean even though she's controversial it doesn't mean like i can't take stuff from her book you know what i mean and i got it on amazon so i don't know if she gets any like kickback from that but i wanted to read her book because so many other people have and like now since like i feel like i'm a better reader and i can read faster so i just wanted to like read her books so i did um and they were like they're really helpful i like them so again i don't know your opinion on her but um i like her books like i can say that and i read them all and they were enjoyable they were not hard reads to be honest so that's good this one is so good oh my gosh so um this is also another side note the lady that was like serving the juice to me and my cycle bar instructor she was like even though it's like weird it's not like the best tasting thing because okay after i had my first green juice i was like in love with it in a weird way like i didn't necessarily like does starbucks taste better yes but i couldn't stop thinking about this and it was just so good and like i felt good after and it tasted like good and bad at the same time i'm not gonna lie but both of the people that i've like told about green juice they're like you're thinking that because your body likes it it's almost craving like the nutrients and everything that comes from this that's why you like it even though it doesn't taste that good because your body likes it you know what i mean so anyway that's it going off way left field from the conversation about like youtube and like all that but i'm gonna steer away from that again because i got this new book and it's called thank god for bitcoin i'm gonna start reading it today probably the creation corruption and redemption of money so hopefully this is good like i just saw a girl post on instagram so i'm like oh i kind of want to read that like i want to know about the bitcoin so i'm gonna read that and um what else do i want to say yeah i just miss the old youtube that's pretty much what i'm saying and i miss you know being able to like click beta video and like get a lot of views well a lot of views for me um and yeah like i just don't really know what else to say i am gonna try to change my mindset about youtube and do it just because i like to do it not because and i never did it for anyone else but like i think i was so focused on you know revenue and um like subscribers um because i always have been focused on that and i kind of forgot like why i started doing it you know like i got wrapped up in the numbers as people say which is important but like as you guys know like this isn't my primary source of income by any means i'm very lucky but this is not like i don't do this for the money um i wish i did and that's why i treat it like a job like i treat it like a job because i want it to be a job um but i don't want to like lose sight and i don't want to get boggled down just because of like some numbers because you know okay so the last thing i wanted to talk about i want to talk about raw vegan or bad vegan i was thinking raw because i'm drinking like the raw juice here um bad vegan is on netflix it's like a series and it is so good guys like you need to go watch it the lady that got taken advantage of sarma she does not like the ending i don't like the ending either because like i was super super confused but overall like the story and the message it's about like another scammer and stuff so it's just so good i highly recommend you watch it and like you know she inspires you to get like raw juice like this um because she was like super healthy and like vegan and everything even if i wanted to start eating healthier um i don't think i would be like full on vegan because like i still buy like leather products and i will never like give up meat but i wanted but i want to like incorporate more things like this into my diet because i think it's beneficial just all around and i like it again this looks like so good i know i've like said that 500 times but i think that is gonna be it for this video that's kind of just what i wanted to say that i'm kind of like bummed about youtube but i'm working on changing my mindset about it because i don't want it to be a place of like negativity and stuff i want it to be like fun and you know just a place to hang out so anyway give this video a thumbs up if you enjoyed it at all don't forget to subscribe and i'll see you guys in my next video bye


Well, we have the pleasure of having Misha Peters come and talk about the open VST hypervisor in the wild There'll be there'll be time for a question and answer. It's at the end So please hold your questions until then and we'll leave a few minutes at the end with that. Thank you It's a little bit weird that you're introducing me though Being the guy that's written it all and some other people here. So good morning. Welcome. I like the intimate Room that I'm in. It's really nice And so I'm gonna talk about the the bees the hypervisor open bees the hypervisor that I'm using for open bees the Amsterdam First I have to apologize. I'm presenting this from a Mac I was not planning to but I'm flying to the US and I don't like to take my personal notebook into the US So that's why I'm using on my word notebook. This is my personal notebook so that you know And a little bit about me I Started way back when at excess roll ice being the Netherlands When it was like this in the in the picture And since then I started working for for vendors So I worked for for companies like like blue coat and foundry that people might know And also started around that time with free BSD Later on added open BSD to to the mix and when Mike started working on the on the hypervisor. I thought oh, this is great. So let's let's do that So I'm gonna talk about how it all started the setup the things that I've Seen what users are experiencing so hopefully you get a good picture of What's going on and I've doing some hosting in call location since 99 as a little bit out-of-hand hobby That that snowballed But what about you? So who's using open BSD? Cool Who's using VMM VMD? Who's an open BSD Amsterdam? Yeah, all right. Cool. That's that's pretty good. Awesome So how did it all begin? I? Was always using Forms of segmentation or virtualization I'm always looking for something that was running on the BSD's properly or useful So I'm I started with jails still using jails. I really like jails Then came be high for me at least I do like be high I think it's a little bit too complex So I was very happy when Mike started working on on VMM VMD, and I just moved everything Since I'm not running any Linux VMs anyway, so that helped The other thing is What I noticed on my call location site was that a lot of people were moving to the cloud So a lot of people would just leave Remove their hardware. So I had some rec space left. I have some hardware left. I had spare IP space IPv4 space I must say And I also always wanted to have a domain with something BSD And I think Hessler has taken a lot of the cool ones and probably some others here in the room Okay, and then thought Amsterdam came along. Oh, okay, maybe I can do something with open bsd.amsterdam So that and also wanted to find a way to actually contribute back to the community I'm not a C coder or or coder that much. I'm a spaghetti scripter So I can get things done but not in a very structured fashion And I also wanted to see and and and help out a little bit how far we can actually Take this thing and where things were were breaking So that's how it all started. So on the on the right hand side, you see a picture of some of the machines that we're using and Domain for shits and giggles. So I registered it last year in June And that's when the whole are a pro actually March and that's when the whole thing Started kicking off. So where is it? It is in Amsterdam It's actually in a data center in Amsterdam. I don't live there, but all the hardware is there It's in the access role data center, which is KPN these days And it's all running primarily on del R6 tends connected to a foundry switch connected to a foundry router I worked for foundry. So I have a love relationship with foundry. I get the CLI I've tried juniper doesn't really stick And I buy these things on on eBay. So it doesn't really cost a lot of money So it it started on Twitter. I started talking a little bit with people on Twitter say, hey What what can we do? Would you would you host a VM? And the first machine I brought online Which was some of the spare hardware that I had it's a box with with a gig of RAM There's still some VMs running there And this was actually one of the first let's say official tweets that I send out And I also wanted to know what people were willing to pay. So I Send out a poll on Twitter and say, hey, what are you willing to pay for a VM that looks like this? So a lot of people are around the five euro this in euros five euro mark and I went, okay, that's that's fine So started building VMs Based on that. So they're five euros a month and of the donation or of the the yearly fee I donate five euros to the OpenBSD foundation ten euros. Sorry Then I was able to get rid of some VMs that I was running on this machine that I brought online And this was actually the machine that kickstarted the whole thing This was able to take 50 VMs On it and out of that came the first donation to the OpenBSD foundation, which I thought was really cool And we I was able to donate 400 euros based on the first I think first month of running this So a little bit of the statistics so you know where we where we are The last donation was 370 euros 850 last year 1700 year to date total of 3,500 euros I'm running eight hosts. I still count the first one even though it's it's Doesn't really I want to move them. There's only 10 VMs currently running on there But it I still count it and there's roughly 280 VMs so we had some renewals already and what I'm seeing is that the amount of renewals Are the amount of people that don't renew actually get replenished by people that get a VM So it's pretty stable and I really want to break through the 300 no idea why but it's this mental thing that I want to get So what do you get? You get an opinionated VM if you've been on on the website. That's what you what you see you get an opinionated VM So initially that meant I decide the install sets I pre-configure a couple of things and it's running OpenBSD VM on OpenBSD I'm not going to give you a Linux VM or or anything else. It's an OpenBSD VM Now with 6.6 coming and sys upgrade. I'm gonna let go of the install sets I'm just gonna install everything so you don't have any issues there I heard Theo yelling at a couple of people on are not heard saw Theo yelling on the mailing list if you want to I also asked that question To exclude certain sets from the sys upgrades a process and you went don't do that Okay But what do you actually get so you get? 512 mega RAM 50 gig disks IPv4 assigned via DGP even though it's a static IP address that's assigned to your VM And you get an IPv6 subnet slash 56 that is statically assigned during the whole install process And what I've noticed during doing this. I'm very used to just assign my router as the gateway And so I started adding v6 addresses On the gateway and then all of a sudden. Well, I cannot hold more any v6 routes That's annoying. So what I started doing was actually the host is the gateway for all the VMs in regards to v6 so v4 still goes to The router itself because all the VMs are in a slash 24 I'm thinking about changing it because I'm hitting some snacks with bridge and I had some interesting discussions already with some people but that's something that I'm Considering or at least investigating if there's a way around it But personally, I do like layer 2 is Blake in the room Sorry, I do like layer 2 It's easy Anyway, so what does the setup look like? I try to use as much in base as possible. So it does influence Some of the design decisions that we've done That I've done So this is pretty much the list. So I'm using pearl How I deploy so I've written it deploy script in pearl Using VMM VMD, of course the HPD auto install site Scripts during the auto install process HDB to serve the sets and then sensors D And I mentioned this specifically because I figured something annoying out which I'll mention later To keep track of the of the discs primarily and of course vi So what I'm doing with pearl is I started with a very nasty script Because when I when I announce, hey, you can now get a VM I had this this half baked form and I had some information in there and I threw it in a file And I went, okay, so how do I actually get all these files instead of doing this manually? So I built really nasty pearl script and yes, you can debate if you can write nice pearl. That's fine but what the the pearl script does it will Maintain and create VM.com it will maintain and create the HPD.com It creates an install.com for every single VM. So every VM is a fresh install. It's not a clone of an image I've also noticed some other quirks. So it also maintains do as comms now And it's responsible for the user creation as well as the the VM creation So as soon as I run that all these things happen and have some some flows how that how that works So the VM of comms if you're familiar with it, I assign a switch a bridge I always assign an owner to a VM so you can connect to the console yourself. You can stop it. You can start it You get a disk and I also assign a static Mac address that Pearl script creates because with that I then assign the v4 address. Let's say statically The dhpd.com Similar so I have that same static Mac address I assign an IP address and I also say that It's now auto install. So as soon as I start I boot up that that VM I must say that when it's a new VM. I also have a boot line here So it boots from bsd.rd So then the auto install knows that it has to kick in Then I have an auto install script for every single VM that I built again based on the Mac address So if you provide me with your your host name, I put that in The v6 addresses are assigned your username that you provided your SSH key I cut and paste in there and then these sets here That will probably go away and this will be plus set plus sites Star moving forward And because of that I have to do continue anyway. Yes verification. Yes So that's then what the VM is being being built on Then I'm using site tgc to actually Do some pre-configuration that makes it easier for you makes it easier for me So it sets the install URL to cdn.openbsd.org and it also changes the The clock is it a format or a method or how do you call that clock the the hardware? Okay, the source of the time counter of the current, okay and The reason why we're doing this is because the default is i8 3 Okay, cool. So I'm setting this because there are some synchronization. Let's say challenges Within the VM in regards to to the clock And then I set ntpd and also I turn off the sound demon because well, you don't really need it So that's in the in the site File then I'm using htpd on one of my hosts to actually serve all the all the sets and every single host has an htpd running for The install files. So every single host has its own little little world in regards to that The reason why I wanted to mention sensors is that a lot of the examples that you see you actually Get like if disk fails then run this command in the sensor d.com. I figured out Luckily only one disk failed that that doesn't work. You actually need to Call a script out of sensor d in order to actually get any action out of it So I either an email that's being sent or whatever the action might be so I luckily call that Quite quickly so I was able to replace the disk without any problems But then I started digging into the whole sensor d in the config and how that works So I so this is now the way that I'm using it. So the command is on top sensor d.com It it calls a script with a bunch of parameters that are also there And then it sends me an email saying hey disk is okay at boot and when the disk fails It sends me this is not okay. So I know to replace it So how do I actually deploy it's not fully automated There are still some manual steps that are there and Currently that that works for me. So as I mentioned every host has its own little world that it exists in so I have a Convigoration for a specific host. So I define the prefix of a Mac address Mac address that they use IP address IPv6 address Where all the the file should go And what the default setup is for a VM? So how much memory disk if it's one disk two discs what the image format is what bridge They they need to use or or uplink need to use and so on so based on this I just have a single script that I copy to all the hosts and then based on the Convigration it knows what to do and what the what the defaults are. I Thought it was a good idea at the time so the flow in itself is I have a Contact form on our website So you put all your information in there that sends me an email in in rightly Formatted I put that in a text file So I look hey which VM ID is still available if it's full I take a different host I paste that in and then I run the deploy script. I restart the chip PD I reload VMD to actually take the new configuration and then I start the VM and I hit a Because pixie's not working And I think Philip does a whole talk about how he packer eyes this But as I said, I like to use a lot of things in base and and for me just hitting a and waiting for it to finish It's fine. I can probably wrap it around expect or or do something else But it's for me this works and I don't have to deploy like tens or twenty VMs a day It's it's one or two max roughly In average. So this what the what the contact form looks like you can select if you want to have 512 Mega memory 1 gig How much this space you need? What the what the image format is I default now to Kiko key cow to So that I save a little bit on the on disk space, especially if I move it And then based on this I put everything in the in the in the text file Which roughly looks like this. So it's just Quoted text that I just push into pearl or that pearl parses so that it knows what to do When I then run deploy deploy the PL it creates the the install file it creates a user Creates the at least that's what I'm seeing. It also does a do as in the dhp But these are the things that I'm most interested about if the The user it could be that the user existed already So then I have to fix that or something filled with the with the image creation And if you select that you want more disk space it will create two disks here or two images here and Once the whole install is done. I run it again and that script also removes the install.com file Then I do VM control reloads. I restart dhpd and then I start the VM and as I mentioned I hit it So what did we find during this whole process? One of the things is that very early on The owner of a VM always had to be in group wheel now personally. I don't find that a problem There's there's this unauthorized section in the upgrade manual that says if you don't have access to the console you can do this We don't recommend it and then yeah, people can just do that. That's not a problem And then people went. Ah, no, you cannot do this. You have to have console and yada yada. So I went, okay Right, what can we do? Is there a way that I can define another user group? Or another group where I can assign users so that they these users can look at Their VM instead of adding everybody to wheel which I thought was not a good idea So right thought that was a good idea and he really quickly managed to to put that in so from then on I used VMD underscore VMD users to put all the the users in so they can actually Control their own VM instead of asking me The other thing that is quite interesting if you're starting doing anything with with virtual machines is you need a tap interface By default and there's four So if you run more than four you need to create your tap interface and this this was initially a head scratcher Why is it not working because it wasn't really clear that it was failing on on an interface So on every new host that I deploy I run this this for loop that just creates up to 50 tap interfaces So I always have enough because an average Host runs Around 40 VMs because that's another thing that we that I discovered quite quickly is that if you especially on older hardware If you add more VMs weird things happen this interface bridge Memory So on the Dell R6 10s. We are using only up to 40 VMs and that works reasonably well Another thing is people were supplying me with a SSH key, but I didn't want to send them a password over email saying hey, this is your root password I One way that I wanted to do this and from an automation perspective is I wanted to do this during the auto install So what I've been doing is actually I generate a Random password with Jot. Thank you Roman for that And then I added to the authorized keys at the end as a comment So that as soon as you log in with your SSH key You just look into that file and you have your root password and the password of your user I thought it was clever. I was very happy to see that Reich also thought it was clever So he borrowed that idea But there's probably and this also started Before do as was there because now you could also potentially say well this user gets Set up into do as with a no pass and then you can do whatever you want So that would be another way that I would probably maybe do that today Another thing was in beginning Was stopping VMs was a little bit of an issue If you stop everything in one go, it's not a good idea So I was trying to actually emulate like like normal shutdown. So what I've done is I parsed VM control through a for loop with org looking at all the machines that were started And then would stop them and wait for 30 seconds to stop the other one Now you can just do that with VM control stop a W so it would Stop all and it will wait for that VM to be stopped in most cases that works really really well Another interesting challenge is actually Starting VMs. So I'm doing something similar, but instead of using stop. I'm using start When it was a clean shutdown of the host I use 30 seconds if it crashed I use 90 or more Because what is really bad is if you have two Worst more VMs that are going through an FS check That will slow things down dramatically and it's not pleasant for the VMs that have started So I do Hopefully I can see if it was a clean shutdown or not But then when it wasn't not I use 90 seconds Another interesting one Especially in the beginning I saw that a lot of VMs were were disappearing so they would have connectivity and then all of a sudden connectivity would would go away or You could not reach it anymore. So I Claudio pointed me to RQ sys control That by default sits on 50 Now in normal environments and just for your machine in a layer 2 network It's not usually a big of a problem But since I'm pushing a slash 24 onto a host with 40 VMs That becomes a little bit of a problem. So we saw a lot of drops and I started playing a little bit with the numbers. I've started with 512 and I still had drops I did 756 still had drops So I increased it to 2024 and it seemed that that is solving a lot of the connectivity issues that we've been noticing So what are users experiencing because this is a little bit on on the on the side that I've been Stumbling into things but on the user side. There's of course also quirks and things that we had to get used to So in some cases and this all depends on how Or how the VM boots and what stage it boots and what was happening on the host, but sometimes the the VM gets a little bit skewed from The clock hurts of the host and when that is a little bit off you get a lot of clock drift within the VM so one way and The way that that Paul is is fixing this is he looks at the the clock drift Of the VM and if it's too far It just reboots the machine to see if it's a little bit closer now with 40 VMs or 50 I thought that was not such a good idea So I fixed it like very rudimentary where I suggest people just to put our date in in cron In general this works. Well, some VMs Have to screw this a little bit lower And I have one user running alpine and he's just yeah, he's on his own you have to he has to sync his clock every every second Another thing is that I got a lot of questions about was there's a high interrupt on The CPU within the VM and I have a page on the website with all the known. Let's say challenges issues and this is So I'm using some of the information that might give me it's like an accounting Error, but I did get some question. Oh, hey, what's going on? I don't have anything started It's something wrong with the host. So I started compiling that list of things And there's also links in my presentation that point to explanations of Mike or Reich about some of the things that we've seen So when I Managed to figure out this RQ thing a lot of the connectivity problems went away and it was great And then all of a sudden on a Friday No idea why I started getting connectivity issues again, and it wasn't just one host It was all of them including my own without not too many VMs running and I've been scratching my head since But one great way of fixing this is just either Ping from cron so the tricky is the tricky part is that as soon as it's it's gone You have to start some connectivity from within the VM to the outside world So the way that you can do that is either do it in cron every five minutes, but at the moment it's it's Pretty bad that that doesn't even help anymore So what I've started doing was just starting T-mux with ping minus I to my gateway and for now That seems to solve the problem a little bit But that's a yeah, that's a hatch scratcher Another thing that we've seen is a VM can become unresponsive So nothing to do with connectivity But it would either consume a lot of CP resources And a VM control stop would not work. It would just be hanging in in stopping mode So every once in a while if I see it I fix it for for for the user But sometimes I get an email from someone say I cannot reach my VM. Can you do something and okay? so I need to figure out a way that That user they can run VM control stop, but they should also be able to just kill that And I thought about doing something with kill and then you go, okay Yeah, root and then do as so the way that I worked around it was with P kill Because what you can do you can actually define the let's say the string or the process Specifically that you can kill So that's why I said the pearl script now also Manages do as comms So this part is in in the do us this configuration and this is then what you can use and run as a user so you can just Kill your own VM if need be Because I have all that information And I think some people have already used it So my wish list what I would like to see in the in the future is working PXE That will save me from hitting a um Last clock drift no clock drift. There's there's things that are that are possible there Another thing that I would like to do is move away from from bridge So either looking at switch or layer three And we had some interesting discussions already in the last couple of days around that One of the things that I would like to do is automate more So the whole flow of getting that email putting it into a file starting the VM I would like to to do that more automated so I can Get that VM deployed a lot quicker and I really want to hit that 300 just for my own fun, I would say so I do want to thank a couple of people because I could not do this without especially Mike and Reich and Carlos and Stefan and Claudio and Jasper and Ori um So these are the main committers and contributors to VMM VMD And we figured out yesterday that there's around 47 people that actually made commits to VMM VMD So that's that's quite impressive. And I also want to thank roman for the artwork for pushing for helping for Getting the word out Wearing the t-shirt to get it with Reich and some and and and Fred and of course You the users that are actually getting a VM on on the platform and see how far we can drive this thing So that is my talk Thank you very much And this is without background image. So it's a little bit easier to read any questions This one's dead.  Hello. Hi. Thank you for the talk What is do Have you considered giving a prefix to a vm or I have seen in the config that you are basically giving a vm One ipv6 address No prefix a prefix and is it slash 64 or was it 56? Yeah, uh, but that's to the host not to the not to the vm. No, that's to the vm. Oh, okay, okay That's generous and I I do of course Generate already a slash 28 But the the host has a 56 Okay, sorry vm vm Yes host has 40 56 prefixes I Do have any private network options or do you think about adding the possibility of building a vpc? For a customer to have two vm's in the private network. Yes Um or more obviously. Yeah, I I thought about that I had Of all the people that are running a vm. I had that question once Um, I also had that question if there could be two vm's active standby active active So I've been thinking about either adding a second interface or adding a sacred network segment so I can run carp or Thinking about it, but the nice thing is not a lot of people ask for it. So I don't have to think about it too hard Yeah Yes So any plans to oops any plans to add any other Locations like new data centers or anything? I don't have the domain. So No, it's the the the nice thing is Uh, I think someone said hey, this is a great idea. I want to do this in London And then he worked on the numbers and he went oh, I cannot really do this Um benefit that I have is since I I do hosting and co-location. I have rec space. I have IP space Uh, I have traffic So a lot of the costs are already carried by my own company Otherwise, this would not really be a available business model With only five euro vm's You then have to also do like the The 20 euro a month vm's then then it could potentially work, but I think what I but I personally like about the product it's it's Community from the community for the community. So I don't make any money of this I don't want to make any money of this. It's it's self-sustaining To an extent I guess And because of all the money that that came out of out of a host I bought the new server and then that machine bought for or paid for the the other machines So it's it's it's self-sustaining And I think adding a new location regardless where that would be Probably would not work economically Okay. Thank you again for great service You're welcome So this this is a bit like Testbed for the technology, right? That's how it started There's there's a disclaimer there that that it's it's an active development things break But people don't read So there's also dns running in there and there's email environments running in there So there's I think there's even some people that are running production type services on this and I go Okay Great so now but yeah one two five scale for let's say if someone is more interested in okay, I AWS doesn't support officially open bsd and here is someone who gives a really nice environment for this Then from one to five How would you rate the production readiness of this? Enterprise I would say try it And then if you like it pay it Um I run all my production environment in in vmm and vmd as well Um, I I suffer from some of the quirks that that that the whole platform is suffering from um, but for me it works right because The my own company is also a hobby project. I don't have to make a lot of money out of it um, but if if especially if you do something with payments I would not do that if it's a website or forum or our internal communication platform Probably yeah, there's ways around to to work around the connectivity issues that that's not really a problem Do you collect some data about the uh, let's say average uptimes of these vms because you said they Can become unresponsive or stuff like that. So I don't know if vmctl shows data like this, but Maybe you could do some nice graphs or whatever um, so if I um Get any telemetry out of the vms uptime and things like that um No, I don't I do get some telemetry out of the host um In regards to cpu load and and traffic Um, but nothing on on on individual vms uptime that that's that's an interesting one. Yeah Yeah So martin otain, let's get cracking on agent x Thank you. Sure five minutes I have some questions for you about this thing Okay No, no not really. I'm just want to make a uh, uh statement here because like, uh, whenever this vmd VMM thing started And when mike shocked me the first lines of d message and back in a bar in berlin at some point I think I was thinking it would be so nice and excuse me for the word to have some cloud kind of thing That runs on an open vst hypervisor because all this cloud stuff is unavoidable these days and We ported open bst to most of these platforms and then you still run on a shitty linux or well, maybe on a free bst, but It if I cannot trust the hypervisor when Yeah, one is it and then but not just doing this for testing really run a cloud like platform opinionated vms or something like this and then Later you just showed up and did it And it helps us so much because of these things. I mean these features We get many feature requests for things that are weird or pointless, but from you it really helps moving forward And so we need more projects like this Really, we need people who whatever do something similar and this happens deploying vgp routers from open bst or whatever just doing something like this and And then actually you're the one who proved that you can run the stuff in production to us develop us. Yeah That's pretty amazing. So my my cutos for this year publicly. Absolutely So economically, it's a great way to do this do this in other cities things right Hi Do you use or would you use? vms open bsd vms on other people's computers as a user Would I use vmm on other people's computer? What do you mean? Like, you know, you host vms and you have users that use them. Would you or do you personally use vms? Which are hosted on computers controlled by Other people. I actually I don't I don't host. I don't know any other Environment where you can do that where you can actually have a vm on open bsd vmm Somewhere else, but would you if I provided you with the vmm? Would you actively use it depends how much it is? If it was free, sure Okay, sure. I'm dutch of course free Okay, and another question about virtualization open bsd Was up until a few years ago completely against any kind virtualization and even then, you know, you need some kind of contra naysist Conturnation If you run it on your own hosts you own, but now we see the the open bsd moving in another direction And you know hosting providing vmms Can you explain a bit a change in the in the politics that would not really be a question I can answer but Mike maybe If you start turning an orphan on again The whole topic of how vmm vmd started is probably A topic that they talked that we should have later because we're almost out of time and it's going to take much longer than two minutes But i'm happy to have that conversation with you or indeed anybody that's in attendance If you'd like to know more about the platform how we built it what our goals were the history around it I'm absolutely happy to do that just find me later later today tomorrow. I'll be around But it probably will take more time than what we have now So happy to talk about it later. And there's some good talks already online that you did. Yep One more It's not not really related to the open bsd vmm part of things, but do you do anything with Do you do anything with with reverse dns, uh either v4 v6? Sorry say again. Do you do anything with reverse dns? Absolutely. Yes. I I need to because there's people running their mill environment On open bsd. Amsterdam. So yes, yeah Not by default That can be something that i'm considering But currently it's just fire off an email or put it in the the note field in the contact forms Hey, just put reverse dns to this domain and i'll i'll fix it. It's uh, it's it's not a big deal But not a lot of people actually request it Yeah, yes exact. That's what's my reaction as well. Why not? But yeah Oh, actually, I have someone that doesn't have a domain So they they said, yeah, I know I want to do something with mail, but I don't have a domain Okay, I can give you a host on on open bsd. Amsterdam. Oh, great. Let's encrypt done. So yeah That's also an option. You can all the uh, you can also have a host name dot open bsd. Amsterdam I would be happy to reverse that into your vm as well. Not a problem Thank you very much. Thank you


Shrestha IT, a company based in Belgam where we build and secure networks. I am also a network engineer, family with a varied wide of interest in unique systems as well as networking and security. So as with any network, few of the challenges with respect to networks of micro small medium enterprises in tier 2 and tier 3 cities are some of the challenges which I have given here. One is you have these elements of fishing links which are greatly circulated in the network. Then you have malware which is basically ransomware. Apart from that threat vectors which are primarily used for transferring of fines which can again propagate stuff in the network. So it is pretty similar to what you have in any other network but this is kind of compounded by another element which is primarily is there in the tier 2, tier 3 networks of MSMEs is primarily a concept called as a flat network. So what is basically a flat network? A flat network is a network where the communication between nodes or clients or computers is not segmented. So each computer can speak to one another without any kind of limitations for that matter and that also has its own share of problems. One of the reasons why also this kind of a topology is chosen is because of there is a low cost barrier to it. Anyone can set up a flat network without having to put expensive hardware or having any kind of technical know how in order to put it. So here is a simple example of a flat network. As you can see the computers or the servers which are there or all part of the network can communicate with one another without any kind of restrictions to it. So what this also does is primarily kind of apart from the good traffic it also gives an ecosystem for the bad traffic as well with respect to property. Examples of a flat network typically you are running a network at home, you have wireless you are running a flat network for that matter. A SOHO office, 100 plus networks which we serve in tier 2, tier 3 cities. Now you mix this with ignorance with respect to security hygiene where if I have to give a few examples user would have an antivirus installed on the system but the antivirus is either not updated or the license has expired. Another example which you can point out is pendrives which get connected to the systems basically the antivirus would pop up and the user would instead of having the scan complete user would click on cancel. So thereby you know primarily to save time but actually having a consequence of malware or bad data coming into the system of the network. Another thing which we have found very commonly is everybody is logged in as an administrative user. So there is no privileges per se with respect to restrictions on the system level and lastly is basically the lack of IT processes. So here is an example of a phishing email which one of the customers we have received and I have primarily removed the stuff with respect to the email details. So if you had clicked on any one of those links in that email this is what you would have seen which is nothing but a phishing email and not something by Microsoft for that matter. Before I actually go into the solution side of things I will probably give a just a small primer with respect to DNS. Before I do that how many people have worked or have an experience with respect to configuring a DNS server? How many people know how DNS works? That's probably a fair bit. So I will just skip through this slide. So what you have is basically a computer at the very left of the slide which is basically where a user is accessing a let's say a web resource or a website on the computer it could be a mobile device and the request is for an IP address that is a resolution from the name to an IP and this is something which is done by something called as a recursive DNS resolver. Generically this is the job of an ISP the ISP so when you connect to an internet connection the ISP gives you a DNS server IP which is what does the recursion with respect to getting an IP with respect to the resource. But it's a lost start these days and I'll come to that where ISPs have actually outsourced this to various cloud providers. You have Google <IP_ADDRESS>.8 you have Cloudflare <IP_ADDRESS>.1 and you also have the Quad 9 which is <IP_ADDRESS>.9. So these are basically what gets used by everyone primarily for the for the policy of security as well as you know the resolution is also fast. So my focus is primarily on the recursive DNS aspect so I'm not going to go into the details with respect to the authoritative DNS or the root DNS for that matter. So the security element which probably I am proposing is on the recursive side of things. Also another option with respect to people who are running their own recursive DNS servers would ideally be using something like open source software which is bind or unbound or power DNS which at this point I'll probably get back to a little while later. So how does a DNS firewall help? So if you look at from a threat intelligence perspective or even if you look at from a security perspective everything begins with a DNS query. So it be it good traffic or be it bad traffic everything starts with a DNS query. So having a kind of a mechanism with which you can filter bad DNS traffic right without even it going in other layers adds a lot of value from the network security hygiene perspective. So primarily it sets a differentiated route there is a firewall which actually gave that pop up as well. So there is a set of differentiated route for the DNS queries. Most importantly for the MSME networks that we have primarily deployed this it's it's cheap defense right without having to invest in a full-fledged firewall or without having the capabilities of having the budget for a something like a PF sense for that matter. This adds a lot of value because this is typically just goes on something like a Raspberry Pi right. So low cost barrier with respect to the economic side of things and pretty simple to implement once you get it right. Having said that I'd like to highlight it on multiple times that security is primarily a you know multi-tied approach. So I'm in no way I'm suggesting that just putting this thing in your network is going to secure it. So this is one of the key elements that can actually go in your network defense for that matter. So what you have is basically a vendor neutral distributed format or it's actually not a protocol yet it's hopefully it should be there is a there is a draft that is published on the IPF website since I've been for the last four to five years but this is one of the underrated topics on the DNS side of things which one can leverage. So what it does is it allows you just like any other firewall it allows you to set policies based on who is asking the question or where that question is going to right. To add to this you can integrate something called as threat intelligence feeds so and then it becomes a full blown firewall and there are a lot of providers available which are open source as well as proprietary which can plug in into your DNS firewall giving you a greater leverage and for that matter the three primary DNS software which is available as an open source option one is bind. So bind version 9.10 greater onwards basically supports this power DNS also has this unbound just I think a few days back there is a patch that has gone into the main source code where response policy zones is basically going to be available unbound as well. So just like any firewall for that matter the working of a DNS firewall is very similar there is basically something called as a condition is met and then you have a action for it. So you have a trigger and then an action gets called. So I'll probably give a demo of a couple of examples as well. So the first one let's say for example Q name that stands for query name. So if the query name is this specific DNS record then you can have an action where you can say that okay I want to drop it or I can I want to give a response back to the client machine saying that this is a non-existing domain so the NX domain stands for non-existing domain. Before I actually give you a demo let me go through a sample DNS zone file so that you understand the integrities of how this gets integrated. Instead of going through the whole thing I'll probably just concentrate on the last three lines of the image. So what you have there is basically these are called as resource records. So in this case what I'm what we are saying is webmail.instaping.in is pointing to the IP address <IP_ADDRESS>. The second one is again a resource called as www.instaping.in which is pointing to IP address <IP_ADDRESS>.22 right. That's how basically DNS works right. Now here is an example of a DNS response policy zone file. So in the case of response policy zone file again it is a zone file the structure is a little bit different. So here you can see that there are a list of DNS records. Now here these DNS records I am not authoritative to it right. It is just my recursive DNS server which I am I'm going to give these records in the recursive DNS server and I'm going to say CNAME dot. Dot means NX domain right. So what I'm trying to say is it's like null root it's like dev null. So if I want to send it to something like a recycle bin let's say a DNS query this is what it would entail. So in any kind of open source DNS software you would have to include this zone file and entail the software saying that here is a zone file and here are the resource records inside it and I want you to primarily respond to it right. Instead of going upper in the chain to find out what is the actual IP address of that record I want you to find get it locally and given NX domain answer in this case right. And then you include basically saying that this is a response policy zone. What I'll do is I'll probably show you a small demo of this right. So I'll probably pause it every now and then. So what I'm doing is basically I'm saying big yes I will try to do that. Does that help? Let me run through it so that you get an idea about it. So basically I have opened a terminal here and I'm typing a command which is big. So big is basically available on Unix and Linux systems which basically allows you to query a DNS record. So I'm saying dig at the rate <IP_ADDRESS> which is local host which is my self system that is the same system itself for the resource record which is Google.com right. And what I see now here as an output is basically the answer where Google IP address of Google is 216, 58.197.46 right. So I got the answer where the recursive DNS resolver actually went up the chain found out what is the IP address of Google.com and gave it back to me. Any questions here? So now what I'm doing is basically I have this response policy zone right. So in one of the response policies zone the zone file which I have generated the format which I showed you I think couple of slides back. I am searching for a string called as PayPal right. So I've run a what you call a command line argument where it says which it says that grep PayPal in this specific zone file just to actually demo you what will happen if I request a resource which is a phishing link. Yes zone file is on my machine. So I'm running this recursive DNS resolver on my machine itself. Actually this is a video so I'm not doing it right now but this is something which I recorded where I put the recursive DNS server on my machine. So you could actually do this if you don't want to do this for your network you could also do it only for your system itself. So it need not be that the requirement is that you have to only do this for if you have a network. So now what I'm doing is I'm saying dig accurate local host and the resource record is one of the phishing links one of the DNS domain names which is nothing but a phishing link right. It is PayPal dash account dot o g s p y dot net. The word PayPal itself basically can fool a lot of people who are not in the from the technical side of things where they would look at PayPal and they would say okay this is PayPal let me log in right. So now what this does is because the recursive DNS resolver which I have has a record for this specific DNS and I've said respond back with nx domain. When you ask that question it doesn't give you an answer it gives you nx domain so it doesn't give an IP even though on the internet this record might be resolved. So the next thing what I do is I actually run this against the Google's Quad 8 recursive DNS resolver and you will see that it actually responds which means that people who would access that link right you will see that it has given those IPs right. So the query that I gave here was dig at the rate 8 dot 8 dot 8 dot 8 that same domain name which is a phishing domain and you're getting a response there which means that anyone who is using Google DNS for that matter at this point of time accesses that link and is probably not aware that this is a phishing link right. So to populate with respect to what you might already have with respect to a DNS response policy zones what we primarily did was we looked into the reputation feeds. So there are a lot of reputation feeds URL houses one spam house is another power site security or you can also create your own feeds there are a lot of repetition providers which are primarily having this data in an open source format where you can actually do a pull every every now and then and it's basically just a URL which you download and then put populate this records inside a zone file and your network will now not resolve those DNS requests. So some of the lessons what we after doing this for 100 plus networks is one of the things which we realized was a lot of false positives going in it the data the zone files that you populate needs to be in a pristine manner with respect to not having to you know having put something which is legitimate domain name for that matter or a DNS record. Monitoring and analysis is primarily at the log file level so you are typically tailing the log file to see what kind of request is getting blocked for that matter. You can also integrate something like an ELK stack which can give you pretty graphs and you know charts for that matter. So if there is one takeaway that I'd like to point out people here is even if you are running a network or not or even if you would be interested in doing something like this for your home network is primarily run a recursive DNS resolver even on your laptops with response policy zones and that adds a lot of value with respect to stopping malware or or phishing link or anything for that matter at the DNS level itself. So you could do that by having a simple so if you're running Linux or Unix you just put bind or open your power DNS or unbound you could also use something like a pi hole. So pi hole is a project which is on technically but if I have to even before I go there pi hole is not response policy zones.  Future challenges there is this new protocol which exists called as DOH that is DNS over HTTPS and there is a lot of noise with respect to DOH for that matter where there are people who want DOH and there are people who do not want DOH now from my perspective very importantly it is biased because I run a recursive DNS resolver for customers you know 100 plus networks for that matter so definitely I will not want DOH for that matter but as a user DOH as a protocol which is RFC 8484 is extremely important and it is a great step forward the problem lies with the way it is getting implemented by Mozilla right so if you don't know what is happening in that space so if you are running a Mozilla Firefox browser even though you might be having a recursive DNS resolver or you are part of a corporate network which has your internal DNS mapped right it will all stop working probably pretty soon in India as well starting October DOH gets rolled out for all users in the US which means which means that any DNS query that you are making will go to Cloudflare right again I do not have anything against Cloudflare because I have a lot of friends in it but the question becomes on one side you have DOH which says it is privacy and then and on the other side you have centralization which is going to a private company so that is something that is a challenge if you're using response policy zones but my message to you as well as to probably Mozilla is to step away from DOH in the way it is getting implemented probably take a much saner way of doing it the way Google is doing where now there is a way to actually block DOH if you're running an enterprise network where you don't want the all your traffic all your DNS traffic to go to let's say Cloudflare for that matter but it's actually still something which is not yet clear right so there has been a lot of you know couple of malware which is actually has you know started using DOH as a transport mechanism where it is now purely hidden inside the DNS over HTTPS stream right and that's pretty much a challenge for that matter here are the references I the slides are already there on the website for that matter but I think I'll also tweak it out and I would be happy to take any questions or comments so how why it is important to do the blocking as part of DNS itself are there other ways to achieve this right so there are multiple ways to do it I mean the traditional ways to put a full-fledged firewall which will act at the different layers of the network stack for that matter but then the problem that we have seen with respect to let's say for example PF Sense right PF Sense is basically a packet filter coming from the Unix world which you just put it on a simple box and you put it in a network plug it in the network and all your traffic will technically incoming and outgoing ingress ingress is basically that but that requires an investment of a machine right that requires primarily that barrier from an economical standpoint so a lot of businesses that we cater to as I said there is a large scale ignorance with respect to security hygiene so putting a full-fledged firewall there becomes a big barrier but at the same time we want to make sure that the ecosystem is is improving from from that level so this becomes one of the key elements which can actually solve a number of problems right where where the phishing links and and and let's say malware which is there in the network does not get propagated because it gets stopped at the DNS and it's always good to have multi-layered approach right so even in PF Sense you have the same mechanism of running a DNS respond policy I hope that answer it is not it is it it's one of the things that you can do from a from a network person say let's say for example let me put it the other way around you're running a home network I don't think many of you would be interested to run a full-fledged firewall in your home right because of the barrier because you have to you know put a machine there or a box there and and manage it and maintain it right so this becomes a good incentive to have some layer of security apart from other layers which you may probably or you should be invested in can you take the mic what about ip tables ip tables is primarily going to look at the from the ip layer so it is not going to do at the DNS layer so you can pretty much configure a firewall in ip tables for that matter but it is all looking at ingress and outgrace of ip's that is ip addresses in the network coming in and going out and whether connections are established not established or whether you want to block certain kind of protocols going out and stuff like that but it will not do at the DNS layer okay thank you maybe to add to that ip's would would not be so dynamic DNS is intended to be dynamic right if it changes then you're blocking basically an old ip right absolutely in fact to add to that there is another layer that you can actually go into so a lot of these reputation feeds have data which is built on passive DNS right passive DNS is basically let's say there is a there is a domain name and it has an ip x they look at on that x that same x ip address how many other domains are there right and if those are legitimate domains if they are not then they get added to the reputation feed so that's how you can actually have a dynamic layer of blocking at the DNS layer is what my great presentation good insights so just to build on that same question right so every host you have the firewall either ip tables or windows firewall and if you're able to your rules to control traffic on port 53 you you're still controlling the DNS calls that are going out to different entities that your application deals with right or and beyond that what are the DNS firewall or for what advantage does it have a lot of advantages in fact just to point out say for example it is just the traffic which you are controlling which is going out you're not controlling whether let's say abc.com should be blocked right there is no what you call a condition and a trigger and an action which is that okay say for example here are the list of domain names which are malicious and I want in ip tables to block them right one you can do that technically but it is going to be a very intensive affair with respect to whatever machine you would be running so it is not scalable at all to remove a rule from that to remove a domain name from that is going to be a massive job I forgot to add one element to it so say for example I have a network where I've set up a recursive DNS server and I have configured the response policy zones and I have put reputation feeds in it right say for example now I have 100 plus networks where I want this to be implemented I configure this as a master DNS server configure rest of them as slave they'll pull all data from here without me having to do anything at all in the sense that without having to reconfigure the same thing again and again so you're using technically that is not part of response policy zones that is part of the DNS system the ecosystem where you have a master and a slave and you have these zone transfers right I hope that answers I'm going to go back to DOH so I mean we've been reading about this DOH is bad don't do this you know a lot of backlash Mozilla has three questions isn't it actually good that Mozilla is allowing you to do DOH one it's encrypted it's no longer plain text that means if you're on a telco network nobody can monitor your monetize your DNS usage anymore right because in STTPS that's the only way they could have monetized it by accessing what DNS queries do you make that was one second take an example UK or recently it happened in Kazakhstan where they are actually now blocking ISY ISPs right DOH allows you to overcome that because you are no longer going to get blocked by your ISP on some content content is free on the internet point number three you can always disable it in network TRR mode you really don't have to enable it or last point that you made you're an enterprise you can't make a DOH by yourself change the network TRR URI implement your own STTPS DNS resolver that works right excellent questions thanks for bringing these questions while I'll go one by one so one is when you say so from my perspective apart from the noise that is happening on the internet DOH as a protocol is absolutely great right RFC 8484 is fantastic but there existed DOT before DOH so you add DNS over TLS right we should have given you the same thing but for some reason that has been shelled and suddenly the project is DOH that is number one question is not on whether DOH is good or bad that's not what I am debating for I am debating am I fine with all my DNS queries going to cloud that I am not going to your ISP and some other data monetization organization no but there is a different way to probably solve that problem right it may not be necessarily having said that there is also a mechanism now where you can disable DOH at the DNS recursive resolver so they have come out with a canary domain used as application net yeah so if I put it in my response policy zones and say that this is nx domain right DOH gets disabled for every client in the network so this is a new development that has come probably because of the backlash having said that it is there are too many moving parts let's say for example if I want to run my own DOH trusted recursive resolver the TRR right I have to adhere to Firefox policies with respect to a lot of things and there is no clarity on that at this point of time my way of going forward would have been assuming that that is an option exists for enterprise networks having a very valid case with respect to blocking or having internal DNS resource records would have been a greater way of going forward rather than implementing it at a user level and then saying okay we are also going to work on it but not now you are going to ask one more question please okay maybe it's going to go tangential so I'll stop there and probably speak with you later sure when browser steps in to do all these things you know where they are now trying to protect user privacy at DNS level as well doesn't it ring the same bell what OCSPs did for CA certs as well and where you basically what the browsers of the world are trying to say that let us take matter in our own hands and give tools and leverages which actually benefit the user at the end of the day as said this is slightly tangential because now we are talking about a philosophy here with a bit of technology but maybe you could add a comment on that wouldn't that be good still if you look at from that perspective I think any kind of centralization is not good that is how I would look at it as a user not from a business perspective for that matter I'm old school I love the decentralization of things where the way DNS works at this point is great it is scalable I have never seen DNS failing for that matter for all the time that I've used internet because of the distributed nature of DNS right I've never seen it failing at all right so now changing it to making it centralized saying that on one part we want users to be secure and then sending it to a private company who says that we are not going to who has a background with respect to promoting content with respect to fortune for that matter I mean we are talking about a political that's the that's the reason why I'm wearing a T-shirt where it says that there are nine layers so there are two layers which is on the political side as well financial side and then there is a technical side maybe it depends on which layer we are talking about I hope that answers thanks another thing that I would like to add this again a personal opinion cloud fair versus my ISP which is located in my country this is and my ISP is in my country I may have legal avenues to either safeguard my privacy in my own country whereas in cloud fair which is based in US even though we say DOH would offer privacy against my ISP but I don't have legal avenues to really follow up with them I'm not using the word but so cloud fair or any other ISP provider which is in let's say UK or US they may be subject to their own legal law like national security letters wherein they cannot talk about disclosures so again this is my personal opinion so this to add to this so there was I think somebody was talking about I'm sorry I'm forgetting the name of the ISP is about NSA right and stuff like that so now you have made everything centralized right so now there is only one place that anyone has to go to get all the DNS records which anyone is accessing instead of the distributed nature right you guys keep saying this that you know like it's gonna go to cloud fair it is going to cloud no you realize it's default you can change that question is at the let's from a browser level you can change that I agree so here okay let me give you an example no I mean it's like say 8.8.8 is bad I mean change it it's not tough I agree but here is here is a viewpoint which I'll give you let's take the situation with respect to the kind of markets that we are serving on technical so when a pop-up comes on firefuck which says that hey secure pass browsing click okay this is exactly what primarily what free basics movement started out on facebook where we want to you know we want we want we are taking internet to the rural public support this and then a reply went to try without having an understanding of what exactly is internet and what part of internet was getting served so I think now take your perspective there and you think and say do you think users understand what is happening here you and me can change it but do you think the kind of enterprise customers or you know layman people who are using the internet will understand what is happening behind