I think the noise is probably a real issue. So, you know, the public feedback that the planer got was positive and I don't want to minimize that. You know, I don't live in that mobile home park. I don't live in that area. So I do put a lot of weight on what the people in the area of the neighborhood meeting are saying about it. I am interested at the very least in some potential new conditions in the CUP that Mr. Lockington referenced at least as it relates to delivery hours. You know, if the people who live there 24 hours a day are going to be dealing with the noise, lights, GHGs, if there is an issue at least restricting delivery hours so that there's some peace and quiet between, you know, 1 or 1.30 a.m. and 7 a.m. But again, I'd like to hear from my fellow commissioners. This is just one of those projects. It just reminds me of, you know, Windsor giving up on the natural gas ban that, you know, we're looking at the climate action plan. We're looking at these goals and it just doesn't seem to be going the right direction, even if there may be technical compliance with, you know, things like the MND. Mr. Duggan. Well, I don't want to restate everything that Mr. Peterson has said especially, but I have shared concerns about with the mitigated negative declaration that have been mentioned already. I do think though, as far as it is sort of a, not the most optimal mix of uses here with the mobile home park going to be so close, but I do think in some ways the sound walls of this proposed project are actually going to mitigate the noise away from the mobile home from what's there now. Because right now there's an empty field and a chain link fence as far as I can remember going by the site. So I think in some ways the sound wall is actually going to give them a little bit less of, you know, the loud traffic noise coming from Santa Rosa Avenue. So I think that that's a positive thing. I know that Patty, Cisco and I were both on the commission when the first in and out burger in Santa Rosa was entitled. And I know we had a long discussion about the drive-through and the neighborhood and the neighbors. And I know it's been, you know, they've had some trials and tribulations there, but I know that one of the conditions was that they had these associates come out in the parking lot once the queue got to the certain number of cars to take orders. And every time I drive by there on the highway and you're elevated, you can see those people out there taking the orders of the queues long. So I know that in and out is a good neighbor. They try to work with the information they get from the surroundings. If somebody's got a noise complaint, I think they'll take it seriously and try to work with that. I do kind of have objections to putting something in a conditional use permit saying that if they get a noise complaint they'll restrict their deliveries to these hours because it could be one super sensitive person who's a renter who lives there, complains and then moves and then nobody else has a problem. And yet the corporation in and out is going around trying to, you know, restrict their truck access to certain confined hours because of a sound complaint from one sensitive individual, if that makes sense. So I'm supportive of the project. One thing I'm not crazy about drive-throughs. We all know this from every other drive-through that's come by us. One thing I kind of take more comfort in nowadays. Now that I now have two more modern cars in my personal fleet, they both cut off if you're idling after a certain short amount of time. Both of my cars will, the engines will stop at a stoplight. So I think that's kind of mitigated against some of the greenhouse gases that are from the tailpipes of these cars in the drive-through, but I am in support of the project. The Cheryl Krupke. Yeah, I share the same concerns. I'm uneasy about the MND and like Commissioner Peterson said, I guess I can find an adequate base on the evidence that we're given, but it doesn't necessarily pass the smell test. My biggest concern, like Vice Chair Weeks pointed out, is the traffic study. It's old. We're talking about, it includes something that we're not even considering right now in the residential portion of it. We're talking about a business whose business model is 60% drive-through. And as Commissioner Peterson pointed out, considerably more usage of the drive-through than most other drive-through restaurants. And the traffic study is old and incomplete in my opinion, especially since on, at the last meeting, while I had to recuse myself, but you all approved a general plan amendment and a rezoning for the Yolanda property right across the street from that entrance, which even if they did take into account all the possible development that could happen, that's now changed, right? Because the zoning and the general plan amendment took place. So it doesn't even take that into consideration. And I don't know how exactly that study works, but I mean, if you look at what the property is and what they intend, it's gonna significantly intensify what's there because they're tearing down buildings and building new ones, instead of just building onto vacant land. So I'm very hesitant to support the project because of that. I'm on the fence. I mean, I have nothing against in and out, I have nothing against like drive-through specifically, but if I can't be presented up to date and accurate evidence to make a decision, I can't make a decision. And that's where I'm kind of sitting right now. Wish to call you. Thank you. I can make the necessary findings and find the mitigated neck deck adequately. I understand and I share a lot of the concerns of my fellow commissioners. One thing that I do have a kind of comment around is around, obviously around the dated aspect of the traffic study, but from what I, my understanding was of it was that the traffic study at the time it was made and submitted was in date, yet it was of an appropriate date, yet the fact that it's taken so long to come in front of the commission, that is what's caused this traffic study to be out of date. So if that understanding is correct, I have a hard time putting that onus on the applicant when really the onus is on us, the city, or not processing this application in an entirely manner, if that assumption is correct. I do agree with Commissioner Duggan. I do think that the CMU wall will mitigate the significant amount of the noise that could arise from this development.  I'm trying to go to the cones ahead of what the project specifically. I'll leave it at that for now. Then I will be supporting the project. Thank you. Okay. Well, I definitely had a lot of concerns in terms of the traffic study like others. And obviously my questions were about circulation on the site. If I just take a look at the traffic study issue and the age of it, and the consultant did say this, that the 2017 counts would probably be considerably higher than if we said, let's go back and do another traffic study and it's the time of COVID with lockdowns or power shutoffs, et cetera. So I think I'm not as concerned about the age because of the delay really kind of wasn't their fault. But I also think that we're probably in better standing in really understanding what the traffic flow might actually be than if we, said let's do a new traffic study and we're in the midst of COVID lockdown. So that's how I'm looking at that. It's always counterintuitive to put anything, any new use on San Jose Avenue.  And that's certainly the first thing I thought about with this project. But the main thing that I'm considering is the economic vitality potential of this project. This is obviously, it's a good business. It's a survivable business in these very weird times, whether we like the drive-through aspect or not, we've got lines of cars trying to pick up food from Redwood food bank, et cetera. It's just the times are very, very difficult for any business. And this would be one that would be survivable. Those employees would survive. It would definitely add to our general fund in terms of a vital business that could survive what this particular episode in San Jose history is about. So that's the thing I'm mostly looking at is that value. I agree with Commissioner Duggan. I think the sound wall is gonna protect the neighbors. I think this business model is gonna protect the neighbors. I think that's the thing that I'm seeing is that they have a strong value system about being a good neighbor and adding to the community with donations, et cetera, that there's a long list of ways that they could add to the city. I think the interesting thing as well, because Commissioner Duggan and I were a part of the In-N-Out Burger out off of Steele Lane and all of the concerns that came up with that, it does make sense to me that having one kind of in the middle of the owner park one and the Steele Lane one is probably going to offset some of the worst case scenario we saw with 50 cars. So I think that that makes sense to me. I definitely think there needs to be a traffic navigator out there. And I don't know that I would support a pedestrian connection to the housing that crossing there would be, I think extremely difficult to manage, but so I am in support of the project. I can find the MND adequate and I just think that the value that this business could bring to us is very, very high. And it's concerning with the greenhouse gas, things of how many cars are in line for shots or whatever. It's like, I don't know, when you get to our climate action plan update, I think there's going to be a lot to discuss what's the reality of what we're doing in our cars in a pandemic versus what the ideal is and how do we deal with our climate issues? I think it's going to be very complicated. So with that, Commissioner Peterson, would you like to say anything else? I appreciate the perspective from my fellow commissioners and certainly helps. Again, my difficulty is just those assumptions in the traffic study. And again, the greenhouse gases, I get it, but it really, really strains credibility here. So I'm having a hard time getting to where I need to be to make the findings. Okay. And if I may, Chair Siscoe, this is Ashley Crocker. I just wanted to address a couple comments regarding the adequacy of the mitigated negative declaration. And I wanted to point out some of this discussion has been about the level of service analysis. And that analysis was provided for informational purposes and for operational standards. And I just wanted to remind the commission that the level of service analysis is no longer required by CEQA. In fact, we are now bound by the vehicle miles traveled analysis. And this project was screened out of the VMT analysis due to its proximity to San Rosa Avenue. So just in terms of speaking from legal adequacy of the document, I wanted to address that the level of service would not be a reason to find the document legally inadequate as we do rely on VMT. And then similarly, I understand the GHG concerns and I just will reiterate what I said before in that compliance with the checklist and the certified climate action plan is legal standard in the state of the law today. And that is what methodology was applied here in this mitigated negative declaration. So I just want to put that out there and completely respect your opinions, but I wanted to clarify that on the record. Thank you. Here, Cisco, this is Bill Rose. And if I may just add a couple of thoughts here. I think as Miss Crocker just said, what we believe we've provided is a legally compliant CEQA document. And I know that sometimes that might still lead a little bit to be desired. And it's absolutely the commission's prerogative to act accordingly, but that is the staff position. I want to just make one other note. In addition to that, we look at all of the different policies, relevant policies in the general plan. And there's certainly an economic vitality component to this project. And so that was a central component to the staff analysis. So again, the commission certainly has a prerogative to move forward accordingly with what you feel is appropriate, but that was a key consideration with staff as well. And hence the recommendation that we concluded with. So I just wanted to add that. Okay, thank you. Mr. O'Crufkey, do you have anything else you'd like to say? I think just based off of the curriculum my other commissioners have said, as well as the comments from Miss Crocker and Miss Rose. It'll be, I can uneasily support the project. It's not a home run for me, but I think I could find, I can make the necessary findings to support the project. Okay. All right. Anything else, Commissioner Peterson, before we take the vote? Yeah, just to clarify, I appreciate the feedback from Deputy Director Rose and Council Crocker. So let me refine my comments here. So I will accept the GHG as a section as adequate, looking at page 93 of the final MND. Is it SSEPU guidelines within one half mile of an existing major transit stop? It's within a quarter mile, means that it is less than a significant transportation impact, even though for all the sort of induced demand traffic issues that we've already discussed, I will accept that as adequate. Okay, great. So with that, the MND resolution as corrected was moved by Commissioner Duggan and seconded by Commissioner Carter. And Mr. Maloney, you wanna take our votes? He has one moment. Sure. This is for the first resolution, I'm gonna get a negative declaration. Commissioner Carter. Aye. Commissioner Duggan. Aye. Commissioner Calia. Aye. Commissioner Krepke. Aye. Commissioner Peterson. Aye. Vice Chair Weeks. Aye. Chair Siscoe. Aye. And so that resolution passes with seven ayes. And next we move to our conditional use permit resolution, it will also need to be corrected with the APN number. Commissioner Duggan, would you like to do that again since you're an expert at it now? Why not, yes. I'll move a resolution of the planning commission of the city of Santa Rosa making findings and determinations and approving a conditional use permit for the construction and operation of a restaurant with counterordering, drive-through service and extended hours of operation located at 2532 Santa Rosa Avenue and 325 Yolanda Avenue, assessor's parcel number 044-041-010, file number PRJ18-086 and wait for the reading. Okay, and the second, Commissioner Calia. Okay, so the conditional use permit was moved as corrected by Commissioner Duggan, seconded by Commissioner Calia. Any other discussion? Okay, then Mr. Maloney, would you take our vote? This is for the conditional use permit, Commissioner Carter. Aye. Commissioner Duggan. Aye. Commissioner Calia. Aye. Commissioner Krepke. Aye. Commissioner Peterson. Aye. Vice Chair Weeks. Aye. And Chair Siscoe. Aye. And so the conditional use permit resolution also passes with seven ayes. And I believe that concludes this item and we can adjourn our meeting to our February 11th meeting. So I'll close the meeting. And thanks everybody and see you soon. Okay, bye. Thank you.


We're here with Rob today, and he's going to talk all about his new goblin veerman army I know I'm confused as well I immediately when he said to talk about an army I went to grab all my goblins, and then you remind me this This is sci-fi. Yeah, and as yet. I can't do an entire army. You've not yet got there No, I mean I can dream and try and convince one is to do it But no, so I've I've got the next best thing in my opinion, which is fairy goblins Which are the veerman? Yep, that is essentially what they are isn't it. Yeah I mean you can tell by the fact that I've taken up almost an entire tabletop that I clearly have a predilection for horde armies And the veerman are probably Maybe apart from the plague are probably the biggest horde arm unless you want to sacrifice loads of gcps soldiers They're probably the one where you most need the numbers of troops Yeah You somehow always managed to make us look bad by picking the army that needs the most models to be painted I've always managed to paint them all well before we've even finished building ours I mean, that's my main intention is to make everyone else look bad But no, I mean I did I did cheat slightly By the fact that I did sort of take part in some of the beta testing and things like that for For firefight, so I built this army originally actually as a dead zone strike team And then slowly over a couple of months actually built it up. So it was kind of However many points this is basically to give me all the options I could possibly need for a firefight force Excellent. And do you have a favorite model out of what you've built and painted so far? That that's actually a really tough one. So I do obviously you've got the things like the Tunner, which is a great model really easy to put together the mutant rat fiend Which has made the move from kings of war into space because I'm sure they have Mutated rats in space as well. But I think actually my my favorite one might be one the little veerman troops because why did I took some of the Heads from the racking for kings of war because they actually mix in quite well And then did this one guy here just casually shooting up into the sky hoping for the best Maybe trying to shoot an enforcer intercepted down or something like that So I think weirdly he's my favorite just because It's so weird It's the great thing about the racking and veerman in the same way as goblins, isn't it? They just have so much character that you can do fun models like that.  I think they're not quite as not quite as cheeky Yeah, not quite as cheeky. They are more angry Um, but I think yeah, you can have a bit of fun with them and do some different things So yeah, the racking heads just because I'm gonna have so many spread out that actually some of the weapons so for example the I can never get it the right way around this is like when Ronnie calls night Crawlers night stalkers or the way around is the night Stalkers I'm gonna say the stalkers the ones that are normally the the stabby ones So I use some of the weapons from the the racking on those just to give them a bit more variety as well But yeah, the two kits really combine very nicely. Yeah, they're perfectly matched, don't they? Yeah But just go through Roughly what it is you've you've got built together all together then Yeah, I mean so other than just a lot of rats. Yeah, I mean that that's mainly what it is I mean, I've got so obviously got the tunneller at the back Um, I would quite like to do another tunneller with the extra transport So at the minute I've only got the one section, but you can extend them to make them carry more rats And I love the idea in the rules that they kind of a rupt up out of the ground and then all the rats spill out So I don't know if For those people who've read first strike There's a great bit in that where all the rats that are coming out all the tunnel runners Start coming out of the ground as well and start going towards the enemy Um, so yeah, and probably need to expand that one. But yeah, you've got the tunneller. You've got the mutant rat fiend You've got three tunnel runners here the rumbler Then obviously you've got a lot of different crawlers and stalkers. So all the way around they are Like I said, because it's a horde army I tend to get run them in like groups of 10 because you can add extra ones Although they're normally five you can expand them up to 10 and then you can add terrors to them as well There's like drones. So they're pretty useful particularly for they The assaulting ones to kind of give them a bit of extra oomph I've got lots of nightmares here the big dudes With a range of different weapons kind of from the two-handed drills to the The spitters and another drill there to heavy drill as well I've got the new claw pack leader. It's pretty cool the dead zone one And then just a couple of leaders and then some Bin rats as my son calls them these ones at the front But yeah, I think I don't think I could run all this at once So I probably need to perfect it and have a look and I'm hoping to use this A northern kings event that's coming up in july actually. So I'll probably take well Yeah, I probably will take for him and actually These are the ones I've played the most with Yeah, it's always nice having a larger army than you actually need isn't it? And then you can you can mix it up depending on the scenario, but also it means you don't get bored of Playing the same stuff all the time. Yeah, you can you can mix and match Yeah, exactly. And it and it's absolutely brilliant obviously for dead zone because I've got so I've got every Poss part of my brood mother weirdly. I've got every combination of them you can have So yeah, it's been really good to play them in dead zone as well and try different things with that But yeah, I think gives me a bit of wiggle room when I realize okay. Well, maybe this isn't quite working I've got the three leaders now with the pat leader so I can use some more of the command options, but Yeah, I've really enjoyed sort of putting these together This was actually the first Large-scale sci-fi army I've ever done. So I've never played any of the other games um, so for me, this was really great and it was A sort of really weird experience to kind of go. Oh, wow. Hang on wait a minute I've painted 40 models here because I'm used to kings of war and it's not just one horde That's almost my entire troops. So weird not trying to stick them all to one base. Yeah Yeah, yeah, I just kind of pop them off all the time. But yeah kind of coming from a background of doing goblins where uh, you know A horde of 40 goblins is where the 125 points or something It was quite refreshing actually to come to this and go. Oh, I can actually do an army in Well, I mean a couple of them and then tie here. So, uh, yeah, I've really enjoyed it and I think Kind of working on some new stuff now as well. Excellent. Well, thank you very much, Rob My pleasure always are happy to talk about rats More happy to talk about goblins, but I'm sure we'll get you back for some gold goblin talk at some point soon Is that a promise? Absolutely. Okay good. I'll come back in that case. Cheers


次の話は、ピジネアジュンの最後の話です。私は非常に慣れています。みなさん、私はマサノリ・オーヤマンです。マサノリはマサルです。私はデータベースエンジニアです。特にポーセスキューウェイです。私は常にカスタマーに質問して、アドバイスを与えます。私はデータベースセキュリティに関して、新のフュージャル、プロセスキューウェイを紹介します。私の興味は、パラクエルです。大きなフュージャルのプロセスキューウェイは9.6です。マサシコスターの提供は、新のフュージャルのプロセスキューウェイは9.6です。私はパラクエルのプロセスキューウェイに連繫しました。PG Conf Azureというサービスのプロセスキューウェイです。私もこのプロセスキューウェイのプロセスキューウェイを紹介します。もし、このプロセスキューウェイに関して、このプロセスキューウェイを紹介します。私は一番興味がありました。私はハドリップエンジニアのNTTデータエンジニアです。I managed big Hadoop cluster which consists 1,000 nodes and has 200 petabyte data in the cluster.I am sometimes surprised by the difference of post SQL Hadoop.I think post SQL is more precision software than Hadoop.It catches my interest.Ok, about NDT.I am a member of NDT,Nippon telegraph and telephone compilation.NDT is the biggest telecom company in Japan.NDT OS Center is offering total support service such as a support desk introduction and maintenance of OSS products to these group companies.We also developing OSS products and related tools.We deal with roughly 60 OSS products.Ok, this is today's agenda.First, I will talk about the introduction of today's presentation.Then, I will talk about these two sections.Database security requirements and how to apply to post SQL.In the first section, I pick out the requirements related to database from PCI DSS.In the second section, I try to apply these requirements to post SQL.And I will talk about post SQL auditing tool developed by us.Ok, let's talk about the introduction.Let me talk about the stance in Japan.Japanese government aim to implement an action plan for strengthening the security of credit card transaction by 2020.For example, make business operators for the search information confirmed to their PCI DSS.And multilayered measures are introduced by retailers dealing with issue transactions.So, some of our customers we choose post SQL have a credit card information.Sometimes we are asked how to confirm to PCI DSS by them.Do you know PCI DSS?PCI DSS is chapter of payment card industry data security standard.It is one of the famous security standard in the world.It is promoted by these measure credit card companies.This is outline of PCI DSS.PCI DSS consist of disturb sections. Each section has some detailed requirements.Then these rules instruct you how to build and operate credit card system.PCI DSS is the requirement of whole system and operations.So, if you want to confirm your database to PCI DSS.Please think about how to apply this requirement to it.There is one question.I am not a security expert or PCI DSS expert.So, the explain of this presentation is not necessary correct.If you have to confirm your system to PCI DSS.Please consult PCI DSS expert called QSW.Okay, let's talk about database security requirements.Please consider these four categories from PCI DSS requirements.Keep your database secure,data encryption and key management.User identification,authentication,authorization,identity management,audit.Keep your database secure.PCI DSS requirements 2 and 6 says.Don't use a default user account and password.Don't use unnecessary modules,function,protocols.Admin control access has to be encrypted.Use latest software version.Okay, there is not difficult.Traditional or basic security practice important.Okay, next,data encryption and key management.PCI DSS requirement 3 says.Pan,primary account number,must be unreadable or encrypted.Pan is typically called credit card number,this one.The card number must be irreversibly unreadable or must be irreversibly encrypted with enough strong encryption.A method of unreadable is one way hash or punctuation.If you want to encrypt the card number,you must use strong encryption with key management process.PCI DSS says the encryption considered enough strong is AES or RSA etc.This requirement is frequently updated.So you should check the PCI DSS grocery and look for the section of strong cryptography.PCI DSS also says encryption key management.The card number must be encrypted by data encrypting key.Then data encrypting key must be encrypted by key encrypting key.So this is called a two-tier encryption. These keys are replaced in a certain period and must be stored separately.Of course,the access of key must be restricted and must be stored in the first location.And you must audit the status of using these keys.The detail of this is written as requirements 3.5,3.6.You can see that next user identification,authentication,authorization,identity management.PCI DSS requirements 7 and 8 tell about identification,authentication,authentication,identity management.Identification.PCI DSS says all user must be identified by unique user ID.It does not allow to share a single user account with several people because each user must take the brain for explaining their actions.authentication.In addition to assigning a unique ID,all user must be also authenticated by the following method.Password,TokenDevice,Biometrics.PCI DSS also instructs some password policies.Require minimum length of at least 7 characters.Change password at least once every 90 days and so on.PC requirement 8.2.All user ID is restricted access to least pre-page necessary to perform job responsibilities.identity management.Identification,authentication,authorization are managed by several policies.There is a user ID of the retired person.Lockout the user ID,which is made a long password 5 times,etc.Four details place the requirement 8.1.OK,last.Audit.PCI DSS requirements 10 tell about audit.Prevent must be audited,especially to audit all operations of administrators.It is important because it prevents an inside crime.However generally this is difficult.Audit logs must be output following information.To audit and protect the audit logs is also important.So you should record who and when access the audit logs and protect it from in-built changes.OK,we have looked at the requirement that PCI DSS require to database.Next,let's look at how this requirement can be adapted to process query from following categories.Keep your database secure.First,don't use post-agress account and change 5,4,3,2,4.Next,use OpenSSL connection with PSQA.Four details,please see this one.Explain all OpenSSL.PJHP Conf is the configuration file of access control.Update binaries to latest minor versions.I say again,traditional or base security process are important.OK,next,data encryption and key management.Postsql has encryption module called PGCrypt.PGCrypt is a good module,good encryption module.Today,I don't talk about PGCrypt deeply for describe this manual.However,there is a difficulty to apply PCI DSS to process query.If you want to confirm to PCI DSS,you have to manage tutorial key encryption by yourself.This makes application development hard.If you think that this program is critical,please consult the process vendors.It seems to me that process query need TDE transparent data encryption and KMS key management service.Today,I don't talk about describe TDE and KMS.But,I think we should start discussion that how to realize TDE and KMS in process query committees.OK?KMS,can I ask question also?Yeah,yes,yes,yes.Between yours and speakers understanding.Yeah,that's why I'm just taking permission.You mentioned key management services,right?This is something already offered as hardware security module,right?One of the systems commonly in financial domain.So,I don't think so oracle,even oracle has this thing,right?They have TDE,but they don't have KMS,right?So,I would like to hear about TDE as we go along.But for KMS,I have this point,I just want to say that.And frankly speaking,nobody would like to use database KMS,right?So,they not only go for hardware.And that hardware is produced normally by KLS or CSNATO or something like that.So,just one point.Yes,I'm taking with KMS.Yeah.Use identification,authentication,authentication and identity management.These are the following important things.Don't use supervisor.Apply PCIDs as password for Z.Manage each user ID.For details and extracts.First,don't use supervisor.Supervisor can do everything.For example,create user,create table,change,prepare,etc.So,but this is not allowed by PCIDsbecause all user ID must be restricted to list pre-pagenecesite to perform job responsibilities.Regarding how to restrict also ID.Please see these manuals.However,some useful SQL functions need to specify the pre-page.For example,create all-time event trigger.Create polling developer.Create table space.Create table functions.We have no choice but to use supervisor.So,I think supervisor must be audited fully.Next,password policy.PCIDs require some password policy.You can use password check module in process SQLand set the expiration date.Please see the manuals.However,these password policies cannot be implemented in process SQL.So,in small tractor,8.2.5 do not allow a new passwordthat is the same as any of the list for password used.8.2.6 set password for first time useand change immediately after the first use.So,I think we need to use the actual service.In that case.Next,manage each user ID.Delete or lockout user ID according to PCID SSrequirements.Use drop role to delete user IDand use alter role with no login to lockout user ID.However,to perform the following requirementit's hard only in process SQL.Lockout in active user ID within 90 daysand require the userand lockout the user through repeated access attemptafter not more than 6 attemptsand require the user to reauthenticateif a session has been idle more than 50 minutes.So,I think we should use object service too.Possess SQL can use LDAP authentication.Today,I introduce the following object serviceApache DS and Apache directory study.Apache DS is a directory service software.Apache directory study is GUI console of directory service.I have not used these software in the production servicebut I think these are nice identity management too.Apache DS has rich password policy configuration,rich lockout policy configurationand can output authentication roleswhich is used for law auditing.Apache DS can execute authenticationand management user ID of process SQLbut there are some attention.Apache DS cannot create user account in process SQLso,you should create a process SQL user accountthen register them to the Apache DS.Apache DS and Apache directory studyyou cannot control the editauthorization process SQL.so,you need to load into process SQLto edit authorization of process SQLlast auditwe can use process SQL server rolefor auditingif you can use these parametersif you set these parametersprocess SQL server roleoutput this event required by apache DSthe access to all the roles should beoutput by OS modulefor example,auditdwhich is relaxed auditing toois good too for this processif you set logline prefixserver role can output the following informationfor description,we see the manualsbut object nameor object IDoutputed by server roleit cause difficulty to auditI will explain on the next slideand to protect all the logsuse syslog to send it another serverand use auditdwhich is introduced previous slidePossess SQL server role has some difficultyto apply pshids to process SQLfirst,server role output the SQLwithout change and do notoutput the information of object nameso,some SQLs are difficult to auditfor example,do statementdo statement can execute SQLor a procedural languagein this dollar quoted materialso,you can execute this SQL worldthis is the output of server roleif we want to know about SQLaccess to important tailit is hard to searchnext,the log side is bigbecause server role does not haveuseful role filtersso,server role output all tables rolesnext,super user canchange server roleserver role settings easilyso,server role is hard to confirmto recommend 10.2.2because server roleconfiguration are aided easily by super usersuper user can change these parametersserver role is running or stoppedso,super user can makeserver role setting to auditin effective without anyone noticingnext,cannot divide a rolenext,cannot divide a rolefor auditing into a rolefor operatingtypically,an audit role containsconfidential informationbecause they are the same as contentsin the databaseso,only userswho have a job related needcan read or draw filesfor example,oiltersbut,server roles are important to operationor process SQLdatabase operators oftenread that filesso,two output rolesto audit with server roleis undesirableso,we should use pg auditinstead of server role for auditingpg audit is developed bysecond quadrant and crunch datathis is role and URLyou can use it easilyby installing and setting parameterssetting pg audit toshared preload libraries in process SQLconfpg audit can reduce audit log sizeset class nameto audit pg audit log parameterin processqa.confif you set pg audit to readonly,this SQLselect values are outputtedif you set writeonly,this SQLoutputted,installed,update,readfor example,if you setpg audit logs to write,dgaand miss,thensqq execute,this SQLbeginselectupdate commitso,this isoutput of the logsit does not outputtedthe log size is suppressed to a minimumyou need itpg audit can outputobject name related to SQLif you set pg audit to readthen executethis SQL,that is explainedprevious,pg audit outputtable name is outputted withschema nameso,to search SQLaccessing to important table iseasilyok,I think you can understand pg auditis good for auditinghowever,it cannot coverthe two pg audit requirements yetfirst,superuser can changepg audit setting easilyjust like server log settingspg audit configurationedited easilyby supervisorbecause pg audit configurationin processquery.confnextcannot divide server loginto pg audit logpg audit log outputwith server logjust like server logthis calls thatdatabase operatorsorder logsthis is undesirableso,I think thatsuperuser mustnot be able to changeaudit setting easilyand divide a server loginto a pg audit logok,so we forkedthe pg audit and add some newfuturesentity audit centerpg audittoday called entity pg auditentity pg audit enhancementpointthisstarting processquery is neededto change audit settingentity pg auditconfig fileis divided fromprocessquery.confso,superuser have tostart processqueryto change entity pg audit configurationthat is noteasy in thepg audit configuration environmentso,superuser cannotchange entity pg auditconfig configurationeasilydivide a server loginto an audit logpg audit can send alog management server by syslogrich log filterpg audit has someuseful log filterso,the log siteis suppressed to minimumI will explain theseweatherI touch entity pg auditconfigation filefor nextexplanationsentity pg audit configurationfile consists of thesesectionsoutput,option and rulein output sectionyou can set loggeryou use server logor syslogoption sectionyou can set somemisconfigationin rule sectionyou can set filter rulewho describewith the readmeok,firstrestarting processqueryis needed to change audit settingsentity pg audit hasonly two parametersin processquery conespeciallyentity pg audit lawentity pg audit haspg audit config file parameterwhich indicatespg audit config file pathother pg audit settingsin pg audit.conffilebecauseonly the auditbecause only the audithas better be able toedit processquery.confedit pg audit.conffor examplethe order log intoaudit user accountthisthen edit pg audit.conffileand change permissionssuper userfor examplepostgres usercannot changeaudit settingsnext,dividea server log into an audit logentity pg auditentity pg audit canexport to server log or sys logthis setting in output sectionif you sendthe audit logto a log management serveronly audit canaccess audit log filewhich log filterentity pg audit hasthese filtersthis setting inrule sectionfor exampleif you sendthe audit log to server user accountonly only server user accountthe log outputin addition to thisif you sendthe audit log to app user accountand object nameto myschema audit tablefor examplemyschema audit tableonly the SQLaccessing by super user 1and the SQLaccessing to myschema audit tableby app user 1are outputtedso the log sizeis suppressed to minimumby entity pg auditI explainthis example use casethere are post SQLprimary serverprimary serveraccessaccessaccessof OLTP applicationfrom application userand secondary serveraccessof analysis applicationfrom VR userdb operatordb administrator executeeach management taskfor OLTPap entitypg auditon the outputread and write SQLaccessing to important tablebecause to minimum to the log sizefor analysisap entitypg audit outputread SQLaccessingto all tablesfor operating taskand administration taskentity pg audit outputall SQLthis log sendsend to theoiter log management serverby syslogfor example frontdauditormanagethe logsoiter manage this entitypg audit configuration filesoiter management isentity pg audit configuration filesand executeaudit taskbyfor exampleelastic searchok,finally,lap-upprocessql canconfirm to pshitts byfollowing thingsset basic configurationuse pgcryptouse adddictory serviceuse entitypg auditand I think processqlshould be betterto implement tdkms apito realize operationof processql resultand realize operationof processql resultsuperizartin pageok,thank you for listening my presentationsir,that should bein the database,right?or it should be a feature provided by databaseor even when usingpgcrypto for exampleinputing your dataand at the same time you're talking aboutauditing and loggingdon't you think your sensitive information is going to getlogged at the very same timeso don't you thinkit should be rather left to the application to encrypt the dataand send the encrypteddata back to the databaseso instead of making itall databases responsibilitydo you think to achievepcigssvery important that application also sharessome responsibilityinstead of databasemaking encrypting the databasesorry databasedoing the encryption of sensitivefield for example if I call apgcrypto function with mycredit card informationand that query is gettinglogged or if I haveaccess to pgstat activityI can see the credit card informationeven thoughthe database is encryptedif I have access to the logor if I have access to pgstat activityI can still see the credit card informationso don't you thinkit is more important to encrypt thedata in the applicationand not loador expect too much out of the database itselfsorryI'm not good at Englishpleasepleaseyeah we have several waysto do things outso we can have an applicationlevel and encryptionbut also databaselevel and encryptionso people's PCI doesn't saythat everything has to be donedo you think KMS is somethingthat should be expectedor do you think there is somethingthat has to beor encrypting sensitive fieldsparticularly do you think that has to beoffloaded to the databaseand application sends an encryptedtailor to be insertedin a column which storesmaybe a large textto dataso you only store encrypted credit cardnumber and notand don't call the pg groupthe function will encrypt itin the databasethe application server hasthat informationthen they have to see a referenceyou should be okaylike no no nonot really encrypt somethingbefore doing that particular operationI can control and I can change thelogging level of my applicationjust for that particular operationand then we do that in the databasecan't you do that in the databaseno because the database has toshow all the operations going onyou can't really mask thatin such a kind of a maskingI'm not sure aboutin first placebut we can do some kind ofasking where thesequence that you writecan you mask itbasicallyI have done PCI compliancefor many applicationsand passedand I can share some experiencefirst of alldatabasethe number one thing is thatofcourse you don't have thatin the combined format availablethat's called trackyour plan and your expiry when combinedthen together they become a trackand that should not be storedthis is the problemthis is basically the extra clausewhat they are complaining PCI guysso we put that in databasethen PCI guys came in and they saidno no district is thatand then we kept them separatelyand then if I'm allowed to talkwe were using oraclename as Imissing the namesomesome transparenttransparent data encryptionoracle data worldoracle data world is somethingthat's like TDE is likeis something you guys are talkingbasically on applicationdoing it on application levelwas very dangerous in factit's a dangerous propositionwe are running an applicationwe really cannot afford to do thisthing every now and thenso we need a very super fast mechanismso what they were suggestingis like on the application sidenot only you get slowerso rather than by the wayPCI just relaxes itit's not like PCI saying that you cannotstore the cardyes you have to store the card numberthat span and expiry in separate fieldsand your if your database is securewith the passwordand everybody is getting in the machinegetting everythingand by the wayI go forward we are logging thetranslation to financial donationthey are logged with all the informationand that data is getting in there as wellso it's not only the customer datathe transition that is also in thereI can see that as welland as far as your serversso I guess both are thingsthe KMS should be therefor if you are going for somethingI guess something similar totransparent retention which Oracle hasthis is something goodbut eventually what we learnedover the timewe didn't go fortransparent retention frankly becausethe clients cannot afford thatit was way expensiveand PCI relaxes this thingand you just keep both things separateand you don't have to print them in the logsas a gentleman was mentioningso you have to control thatin database logs everyone mentionedhow does the database knowthat this SQL is going to contain the track dataso it has no way to figure it outsoI guess encryption of logsand by the way all these PCI guysif you arefirst of all the logs should not beopen at any given point in timeand if you are opening it you are writing a concernor something like that soone thing I likewe should be doingsome transparent retentionbecause it has to be donerightother than that I think KMSpart I guessthat's a very stableor you would sayknown standard in the industry thatthey would use hardwarebased solutions for thatbecause of the load that softwarereally cannot handle so that's afirmware based solutionso my two sense are thatwe should be having something likethat is something missing I guessit's very expensiveby the way they are selling this featureit's telling everyoneinitially when we were doingI remember PCI we didn't know too muchand we were likeand the software was running in the banksand we were having an argument in the bankoh your application is so poorit doesn't want to encrypt the datawhat should I dookay buy this softwareand this software was heavy to expensiveso it is somethingit is very important I guessif we don't have it we should have itwhat I havekey for ityeah I want tothisyou want to yeahyeah for the pgsaucejust a very quick questionyou mentioned about a modified version ofpg audit that you guys havemodified forI was justare you planning tosubmit those back to the originalbecause you found it rightare you planning on doing that orsowesaidpg audit ishere in Githubwe open source codeand we plan to mergeoriginal pg auditso second ground andI'm sorry toask me this because I justtried that url and I was getting afour of four on it so I thought maybeit's a permission issue because Idid not see that sourceprobably I'm missing something here butthat's the context behind the questionthat url does not openfor youthe github we are sayingyeah the chip we take outyes open sourceI wasn't able to open thatit is open sourceyesmy question to both of youdo you have any plan of making itin code or adding it as an extensionwhich is in the codecontrib or four extensionsso what happens is becausemost of these features that areavailable in as comparedthey are normallythere is some sort of a chat going onsomewhere where they are being pitchedon the codethe issue is that it can normally takea longer period of timefor that description to beover becausetremendously all across the globethey keep pitching in with variousrequirements and somebody could suggestchange this or somebody could suggestI don't like this it should be thisfrom that so that kind ofa description normally takessometimes it goes over years and yearsso oncethat discussion is overit is added to the code distributionso that is somewhereon the middleI am not sure when it will be overbut there are many othersuch extensions which are stillavailable ason the source extensionbut they are not on the code distributionso it comes very soonhopefullyand I actually reallyI appreciate the partthat you were able tochange this for yourselfbecause of force it opens upand you were able to do thatand you were still keeping it as open sourceso that somebody else can make for the changesand but another good ideawould be toget a patch on top of itand submit it to the original repositoryso that anybodybecause I was not aware of thisI only got to know about it todayI wasn't aware of any such feature setor any pending patch anywhereso one of the ideas would be to go aheadand create a code requestand submit to a patch thereto the original repositoryof course the original developerswhich isof course we have the second partwe have a discussion around itand if people like itit will get mergedand when that extension gets mergedwith the poster skill code distributionthose pages will be thereand this will not helpI hopeI was able to explainbecause there is some companyin the boardand we canwalk togetherwe shouldwe should presentthe original codeso personallymy preferences areanything that we developany feature setorthe best way to go forwardis if you contributeto the communityso that it is availablefor the general classesand when there are any changesof course people, other people can do thatpromoting your own forththere is one way to do itkeeping your open source is another way to do itbut then if it has contributedback to the boardthat's a general benefitwe are thinking the samebut actually becausewe have a requirementright nowso I don't think we can get this featurein the board as soon as it takesseveral yearsso that means we needkind of a four projectkind of a two projectwhich is not in the boardso it takes timetwo, three is maybe waitingmaking these toolsand then gradually we putsome features in the boardatleast you know likein the contrarythat's the best wayjust from that pointa recent exampleyou would know about the table soundthat remains as an extensionso quite an extended period of timewe've been using thatas part of another productand we were distributing itas part of that particular productand it wasn't part of thePPG LogicalEPG Logical is another exampleit has moved really fasterthen a lot of other extensionsand I would love to see a lot of other great extensionsmoved as fast as PG LogicalI can understand that there was a certain demandfor PG Logical and that's why it won't passit had a portionso it really made senseto keep contributingbut thenthe other aspect is as much importantas creating those featuresto the original productyesI would really appreciateand I really appreciate thatactually modified it


So we had this super computing event here in Denver and you're wearing a red hat right now this is a red hat day what's going on? Yeah so I'm John Masters, Chief Arm Architect at Red Hat and today's kind of an important day for us here at Red Hat because we just shipped Red Hat Enterprise Linux for ARM after seven years of research and development and activity that's led up to this day so it's a huge milestone for us and it's not the end it's the beginning of a multi-year journey that we call our multi-architecture future so we work across many different architectures at this point and ARM is one of them. So Red Hat Enterprise Linux launched, what does it mean to have all this launched? Well what does it bring? So Red Hat Enterprise Linux is our flagship Linux distribution that targets the enterprise and what it does is it brings a common experience across many different architectures that customers choose to run so if you install Red Hat Enterprise Linux for ARM you're getting the same experience that you would get say on you know one of the incumbent architectures like x86 whether that's Intel or AMD or power or or system Z for mainframe so you get the same you get the same experience yeah that's the that's the key so if you look over here there was maybe you can go back one slide so you are standing right there with the Qualcomm Centric 2400 what are you running on? Yeah so there's a couple of things we're showcasing in the booth here we are showcasing a system we launched today which is actually an HPE system that we launched in collaboration with Cavium and it's called the Apollo 70 and what it is we'll come around here and I'll show you what this is is a two socket yeah I will yeah this is a this is a two socket 64-bit ARM server so when I say two sockets what I mean is these these are this is one machine so it's not like an embedded device where you know these might be two different computers or something like that these are two sockets of one machine so each socket has up to 32 cores and each processor each socket has up to four threads per core so in in one configuration that could be up to 128 threads per socket times two so 256 threads if you want to configure it that way now in HPC a lot of people don't don't configure their machines that way they they really want to get the maximum single threaded performance so they'll probably turn off the multi-threading feature and they'll instead go with the 28 or 32 core configuration but then you double that so you're looking at 56 or 64 cores that they can use in one machine and these are very very high-end cores these are comparable to the other architectures out there whether that's 686 or other architectures so in fact this particular platform the selling point is not only is it very close to the performance you see on other architectures in terms of memory throughput it's actually 33% better than the the incumbent solutions so there's a compelling reason for customers to be interested and that's what drove our launch today as HPE announced the Apollo 70 we also co-launched the Enterprise Linux product and now as I mentioned before the Enterprise Linux product targets 10 different I think I hinted this to you separately but this this product targets 10 different micro architectures so in fact more over time but right now it runs on 10 different implementations of the ARM architecture and that's for many many different vendors so companies like Cavium here and then also other companies like Qualcomm and the video I was playing in the background here is actually a demonstration well I guess a little repeat in a second the video you're going to see behind me is actually taken from the Qualcomm Centric product launch last week and Centric is targeting a similar set of market customers and what we were showcasing with with with Qualcomm was that our ARM story is really a multi-vendor story right whether it's Cavium whether it's Qualcomm whether it's the company that was formerly may come or applied micro and now is called Denver project holdings it doesn't really matter which company you're working with because you're going to get the same experience and each company will have an opportunity to differentiate and add value of their own and so Cavium with this two sockets system here is is really bringing a certain set of characteristics and then Qualcomm with their single socket solution is targeting a similar set of customers maybe with different workloads and what we did at the launch last week there is we showcase this technology we have called RDO which is used to stand for Red Hat distribution of OpenStack and now it's a it really just goes by RDO and it's a community project to enable OpenStack across different architectures and in a Red Hat distribution friendly way so it runs on Fedora it runs on rel it runs on other compatible operating systems and what I was doing here is I was showcasing that when you're on an ARM machine this happened to be a century it could have been a Thunder X2 the Cavium platform but when you're on one of these ARM server platforms not only can you run rel but then you can start to enable the other technologies so here we're running a an OpenStack cluster in a box and I was showcasing that you know here you can see this video I'm going into the the management console here and I'm just showcasing you see by click instances here and then I say rel7 demo and I say you know I want to create a rel7 instance and I click on rel7 for okay and I just I just launch it and then in a few moments the video will show you show me you know logging into that machine and configuring it and here we go I'm going to ping it this VM I'm going to configure it and play with this instance and then you'll see behind me you'll see some more of that in a moment but the the fundamental point is now that we have rel it's the enabler to all of the layered technologies that we have as a Red Hat portfolio and so you're going to see Red Hat engaged in all these communities enabling technologies like RDO and then as these technologies get enabled when there's the customer demand and the right market conditions then they can become products and that's always based on what our customers are asking for and the timing the customers are asking for because you can't ship everything on one day but as I said we do have builds of all of these layered technologies that run on top of a rel foundation across every architecture so this is a work you've been working on this stuff we've been doing videos for a bunch of years yeah I've wanted to make this video for a long time and for example HP has done the moon shot and then they were doing something before Apollo also yes yes so everything is leading up to something yes something is happening something special right now I think so I think the the the problem we have in the industry is that well the challenge we have is that everybody's optimized around a common solution they already have the timeline yeah yeah you can jump into the timeline so yeah you can see here the you know 2011 we start the team in March and then we have a series of tech technology milestones here as we work on on our enterprise group our early access program dev previews leading up to our product launch and so you asked me about you know what sort of why have we had these different technologies up to this day and and how is it that we we we've taken so long perhaps to to to see arm server adoption at at scale and I think the reason is that the industry is optimized around a certain way of operating that it has for years so you know a two socket system with a certain level of performance and so on and I believe for a long time that we have to give customers that same experience with arm really as a as a as a as you know planting a planting a flag and saying you know this technology is ready and you can run your workloads on it and that's something I've pushed the arm vendors to do because it's not my place to go and create the market but I give them feedback on on how I see technology being used and I think that requires a certain level of performance and it requires a certain level of capability that we didn't see there in some of the early platforms now perversely I think there's an opportunity in the future for some of those other concepts to really take hold now that we have a two socket server system that's at a high level of performance that's got more than a terabyte of memory and all of these features we're able to go back to some of these folks and say well sure you can run that if you want but maybe you don't actually need to have that high level of performance because maybe all you're trying to do is attach a workload accelerator to your machine a GPU or something else and really old maybe all it's doing is spending its time marshalling data to and from the CPU or rather to and from memory CPU may not be doing much work and so these platforms that we've announced over the past week or the market has announced and then that run rel what they do is they show the industry that arm is not a toy arm is a mainstream server it's able to run real workloads and then what you're going to see is you're going to see a level of adoption I think as people realize okay I could run a workload on this and then they're going to look at it and they're going to say well maybe I don't need to run every workload on a high end core maybe I can run it on a smaller core so maybe the technologies that you mentioned in the past like moonshot I think they were just ahead of their time they're not a bad idea in fact they're a good idea it varies really depending on the the the environment and I'll give you one more example if I'm building at scale I may actually look at a technology that's kind of win-peer core like you mentioned the moonshot platform which I think is a good platform and you might look at it and say well I have I have all these different cartridges and each one has a lot of cost associated with having memory and other features and I may get a cost saving by simply going for that two socket model because that's how I've built all of my existing infrastructure so I think that's what we're going to see first but then over time as some of these new technologies take hold you're going to see ways that we can in some sense return to some of these other ideas all right so so you're giving people a lot and letting them scale down exactly I think that's how the industry works because as I said the industry is is used to working one way and so we have to give it what it what it expects and what it thinks it wants and then what I think is going to happen over time you know the the joke with Apple was always that you know Apple would give you exactly what you know they thought you wanted right well they're in a position in the market where they're able to do this with technologies I think the arm vendors are not yet there so what they have to do is establish a beach head and establish themselves in the market as you know not wimpy cell phone processors but really high-end capable machines and they're going to do that with some of these designs they're all able to run the same OS so from a red hat point of view our customers were able to have the same experience whether they choose to adopt on arm or x86 or power or you know system Z the main frame and in fact what you're going to see over time is you're going to see new market potential because the purpose of this is not to be subtractive or simply to replace you know a power or an x86 or a mainframe machine there wouldn't really be much of a point to that the reason we're involved here is we see opportunity or our customers rather see opportunity in new emerging markets so HBC is always an interesting space because everyone is looking for innovative designs you know Moore's law is basically dying and as a result you're not getting that performance increase year on year so the the national labs and others in the the HBC ecosystem are saying you know what we're going to do is we're going to try arm because we think that gives us a path in addition to the other technologies out there to try new and novel approaches but then what you're going to see as a result of the traction the arm is getting is I think greater adoption in other areas that are new business growth for red hat that includes edge computing that includes IOT and that includes telco and we see a lot of interest from the telco community right now they'll be to take platforms like this one maybe not optimized for a telco environment but they'll be able to take these mainstream platforms that can run well and they'll be able to build some very interesting solutions with that and then they'll be able to go back to these OEMs and these vendors and maybe drive some solutions that are more tailored to the the problem space that they're operating in and what's the business model at the Red Hat how does it work so Red Hat's business model is very simple it's a subscription based model so customers do not buy rel customers buy a subscription and then they're able to choose which version of the operating system they want to install now on arm it's fairly straightforward because there is only the version that we launched today but over time you could see a model in which it's essentially similar to the other architectures where a customer has a subscription that means they have access to the Red Hat technologies and then they choose the release amongst an available set of releases that they want to install based on their environment so for example on x86 we have customers that are not even yet running rel 7 because they've got established setups that are running and they don't want to disturb them and so the part of the value of the subscription is that they're able to get support on older versions of the operating system and the same thing would be true here over time but it's key to point out that customers don't pay for rel as buying a boxed product customers buy into a collaborative model in which they pay a subscription and what they get is this kind of investment that drives a lot of the technologies that we're building here right support it's exactly you're you're you could you could look at it that you're taking out the insurance policy right we build some wonderful technologies but you know you've seen over the past few years you've seen you know some some security exploits have happened in the industry and and other kinds of issues that come up and what red hat is is the part of the value of red hat subscriptions is that we get ahead of all of these things and we address them ahead of time and we roll them out to customers in a way that's consumable when they need it and the other thing that we do actually is we work very heavily in upstreams so I mentioned technologies like open stack and staff and and even virtualization things that we don't yet have a comprehensive portfolio for on the arm architecture but what's happening is we're engineering these and we're taking those that the investment that's coming in through subscriptions and we're driving the upstream development of open source and then as a result of that we're able to offer that to customers in a way that's consumable consumable by them because a customer really doesn't want to sit there and figure out every single way to build open stack and get it working what a customer wants is to come to us and say you guys are the experts you make this work for me because I've got a workload I actually want to run I don't really care about the rest of it I want you to solve that problem for me and that's the value that red hat offers by getting upstream by developing these technologies as we have done for the last seven years on arm that's led to rel today and then over time we will enable these layered offerings that bring even more value to customers and all these guys that red hat the sum of them here right yeah top-end guys that you work working with some of them yeah that's right I think I can I trying to point out some of my colleagues here but there's a gentleman here in a suit with glasses Jan Fisher he's in our product marketing organization and he owns the multi-architecture product marketing so he's been involved with the arm offering and also with the power nine release we had last week because we do have a multi-architecture strategy now so it's not just about you know arm it's not just about x86 it's really about having a multi-architecture future so Jan's been very heavily involved and very very grateful for the work he's put in and he certainly has helped to organize this year supercomputing presence which I think is going very well we have a great virtual reality demo here as well and more beyond beyond those of us who are here we've got some folks here for you know public sector government customers and all the kinds of folks you would expect to be at supercomputing we also have a very large team of heroes inside red hat who have made this happen and one of them for example Brendan Conaboy he and I were the original creators of the arm team so I was the one pushing to make the team and then what what happened was my VP Tim who has been amazingly supportive the whole time and really it does take that kind of support to to let you do this for seven years you know Tim I Tim said to me in his office I showed him a beagle board actually one the small arm can embedded boards and I told him it was a small 32-bit board I said this will be a server one day we went through all the reasons why we'll get there and we need to be a 64 bit architecture because we don't care about 32 bit we need standardized platforms all the things that we eventually built together with Arm and the others but I'm walking Tim through this and he said well this is great technology sounds good you've got the the right ideas here this this could go somewhere let's let's do it but he said John you know your time optimistic you know I'm a I'm a good technologist I think but sometimes I I imagine that amazing amounts of stuff can be done in in very little time and so my colleague Brendan was brought in to help me with that and Brendan is a fabulous technical guy he really understands what's going on but even more than that he really understands from having run many projects in our embedded engineering organization he really understood how to drive things to completion over time so I would come up with these sort of technical ideas and concepts and he would then help us to execute those with the team that we had we had a small team to start with so it was very crucial to have someone to kind of be the task master and keep things going and then over time it's expanded so now there are not not just ten people working on arm as it was in early 2011 but now there are I like to say 10,000 people working on arm inside Red Hat because everyone's involved in arm on some level and in fact every time we build software inside Red Hat it is built for every architecture at the same time so there's there's no longer any notion of an architecture being special every architecture is the same internally and so so and you've always been pushing arm pushing the industry pushing the narrow everybody towards this goal this vision of the meeting you had seven years ago maybe kind of like it's important role yeah well I wrote a an email in 2011 and in that email to the team is a there's a loud speaker behind me so I'm gonna just repeat this in a second actually when I'm okay all right well I'll say it again so so we start the team in March March first 2011 and so when we start the team I sent a welcome email to everybody and I realized what I thought would be the things we'd have to solve so standardized platform standardized boot architecture standardized SOC's all the things that Red Hat needs because we can't play with arm as an embedded business model that's not what we do we have to have one common operating system that runs across every system so I itemized all the sorts of things that we would need to solve and then we worked out how are we going to do it and so this is what led to the creation of groups like the enterprise group inside lanaro and the enterprise group inside lanaro we started by four of us myself and three friends from other companies HP arm and and one other and we got together and we basically drove the creation of these different industry efforts and then for example the some of the server standards you know I wrote the first version of the SBBR which is the boot requirements from servers myself and now arm has a whole bunch of people that work on this and some great friends at army there's some amazing friends of mine at arm there they work on evolving the SPSA and they've actually recently announced a program called server ready which is a validation program that really allows you to say something is an arm server and not an embedded device so we came up with a lot of concepts early on for how this would play out over time and what I do every year actually is I send this email that I sent to the team in 2011 I send it out as a kind of happy birthday email and we go through kind of where we are and actually it's amazing how you know I'm not a I don't think I have a magic perception of how the industry works but I think if you've been around long enough you can tell the sorts of things that are going to be needed and it's been quite interesting to see how it's played out I haven't been a hundred percent right but I've been very close on a lot of things because you know we know how enterprise works we know how we have to address it and we've been able to give some really strong guidance to the arm vendors it's up to them to go and build the technology and make the market but we've been very very engaged and you know I regard them all as family in that sense and I'll tell you one other thing that's been very very rewarding for me and I think for the company is co-engineering so on some other architectures I've seen in the industry you know kind of the engineering happens within one company and then they engage upstream and then they get engaged with the Linux vendors and so on and that works pretty well but in the arm case what we've been able to do is get involved during the silicon design and during the early days of the design of these platforms even during the bring up so for every single arm server chip you you've ever seen pretty much I was there in the lab when it first came back from the fab helping with the bring up helping to get operating system software running of course standard Linux kernels and so on but also making sure that rel was running very early on and really building up a relationship with all these companies and it culminated in this program we have with HPE called the Comanche program the Comanche collaborators that was our code name for the engineering platform that became the system that HPE announced today the Apollo 70 but the the collaboration that we've had with HPE has been a little bit unique compared to some other platforms where we've actually worked in partnership with HPE with Melanox with the national labs we've all had very early silicon we've all been working out the bugs together and what it means is we're building a much more capable platform as a result because by the time it ships we have done a lot of battle testing ahead of time and right here some beautiful hardware let's have let's have the whole arm service thing happen right now you know it's seven years of my life as I was saying a lot today it's been a similar amount of time for a lot of people actually in the industry and we always thought it would be a ten-year journey so what I'm looking forward to now now that rel's there is building the next wave and the next wave is when it gets really interesting customers building deployments customers having good experiences and then customers asking for higher layered products that go on top of the rel foundation