Internal Revenue Service IRS tax news, dirty dozen. IRS warns individuals to stay clear of shady tax preparers, offers tips on carefully choosing tax professionals. It is definitely good advice to stay away from shady tax preparers. Unless of course it's a really hot day, in which case some shade might be well appreciated. Although, although even then, finding a tax preparer with some A, C would even be better.   Because, because although the shade can be used to hide dirt, the shade itself is not the actual dirt, right? It's just like hiding the dirt. The dirt is the dirt.  It's, it's not the actual house's fault. The house is not the actual, you can't blame the structure of the house for the dirt that keeps coming out of it. But honestly, calling something shady doesn't seem like strong enough language these days. I'm telling you, I mean, I used to think people understood euphemistic language, but I'm starting to think the lack of clear language is causing a lot of problems.  It's that people can no longer derive actual meaning from what's being said due to unclear language. My name is Horace, and I'm a red-tailed hawk. In our world, I do have the body of a hawk, but while fronting, I consider myself a therian. You see, you see, that's what I'm talking about. Like this lovely young lady's problem is not that she's a snowflake, scared and unaccepting of words, resulting in society needing to restrict or change language. Her problem is that language has become ambiguous to the point of useless, resulting in her somehow being able to fall into the usually quite narrowly scientifically defined category of red-tailed hawk. You see, that usually doesn't happen because the definitions are at least a little bit more clear than that. And I don't blame her. I don't blame her. Like if someone told my impressionable young mind as I was following like a red-tailed hawk in awe that I could be one, I mean, I'm sure I would have died trying to fly off a building by now. However, back in the day at a time when elders knew how to scientifically categorize when I as a child made a wild claim of being like a hawk or a squirrel or whatever, I was quickly informed of the incongruity with such a claim to reality. I mean, for example, like I was told, like red-tailed hawks have wings, they have wings. Now, it is true one could be deformed and if you cut off the wings, yes, it would still be a red-tailed hawk, although a very unhappy one. But as a general rule, yes, hawks have wings, the wings spanning approximately four feet. Also, red-tailed hawks mass is around 795 to 1,224 grams. And they usually have yellow legs and feet and red-tailed hawks have a tail. They have a tail, right? I mean, and then like given the proper definition and characteristics of a red-tailed hawk clearly defined, I was forced to confront reality and conclude I was not, in fact, a red-tailed hawk. Yeah, how, whatever, anyway, however, one thing is for sure, when dealing with important topics and seeking clear actionable advice, what you really want to hear is an intro that goes something like this. My name is Joe Biden. I'm Dr. Joe Biden's husband and I ate Chinese ice cream chocolate chip. I came down because I heard there was chocolate chip ice cream. By the way, I have a whole refrigerator full upstairs. I think I'm kidding. I'm not. Honestly, where am I? Is this planet Earth? This cannot be going on here. This can't be right. IR 2023-59, March 27, 2023, Washington. The Internal Revenue Service today continued the dirty dozen series by cautioning taxpayers to avoid unscrupulous tax return preparers and provided important tips to find the right tax professional. People should be careful of shady tax professionals and watch out for common warning signs, including charging a fee based on the size of the refund. Now, at first glance, you might say, hey, why is that a bad practice? Because if they have the fee that's tied to the refund, that kind of aligns our interests in some format because I want as big a refund as possible as well. And if they're getting paid based on a bigger refund, their incentives are lined up with mine. And you also might think, hey, look, that's similar to other situations like lawyers, for example, taking on a case that will possibly be contingent upon whether they win or not in terms of their fees with regards to winning a case or something like that. However, with tax return preparation, you could see how that might lead to kind of a fraudulent type of situation because oftentimes you can have a situation where you file a return that's quite aggressive, if not fraudulent in the claims being taken to increase the amount of the refund. But when the IRS comes back and asks questions at a future point in time, they're going to come back to the taxpayer and it could be likely in a fraud situation or a scamming situation that the person that helped you prepare the tax return will be basically gone by that point in time, right? Because the IRS is a slow-moving type of machine. It's a self-reporting type of system. So the fact that you got a refund in the short run does not mean that you're not on the hook to be audited at least three years out into the future if not beyond that point in time. And by that point in time, it's going to be all you. The person that helped you prepare the tax return might be gone. So your interests aren't aligned by just trying to get the best or biggest refund. You want to get the biggest legal refund because you're on the hook for the liability for the most part if the IRS comes back and then charges you not only the tax, but the penalties and interests that are imposed on top of that, not to mention the time and effort to go in and go through like an audit situation. Okay, so some quote, ghost end quote tax preparers refuse to sign the tax return or ask people to sign a blank return. These are all common warning signs and people should always rely on a trusted tax professional and the IRS offers a variety of resources to help. So when you talk to a tax professional, you might start to think people often do that the tax professional is somehow the person on the hook as if you're talking to the IRS themselves as if if you get approval from a tax professional, that means you're not on the hook for taking an incorrect position on your tax return. That's not the case. The tax professional is acting kind of as your agent in some degree, but you are ultimately on the hook for any decisions being made. Although the tax professional is required generally if they're a paid professional to be putting their information on the tax return so that they have some kind of recourse and if they refuse to do that, that is clearly of course another warning sign of a scammy situation. Quote, most tax professionals offer excellent advice and can rely and can really help people navigate complex tax issues. But we continue to see instances where taxpayers are quote ghosted in quote by unscrupulous tax preparers with bad advice who quickly disappear in quote said IRS commissioner, Danny Warfell quote. We encourage taxpayers to check out the tools and resources available to them to ensure they find the right tax professional for their needs and quote unscrupulous tax return preparers, Mark Day 6 of the IRS's annual dirty dozen campaign. A list of 12 scams and schemes that put taxpayers in the tax professional community at risk of losing money, personal information, data and more. Some items on the dirty dozen are new while others are reemerging. While the dirty dozen is not a legal document or a formal list of agencies enforcement priorities, it is intended to alert taxpayers and the tax professional community about various scams and schemes. Working together as the security summit, the IRS state tax agencies in the nation's tax industry, including tax professionals, have taken numerous steps since 2015 to warn people about common scams and schemes during tax season and beyond that can increase the risk of identity theft. And since then, of course, scamming and scheming has almost disappeared from the face of the earth. They're so effective at it. Hold on a second. Well, whatever. It's still good advice. The security summit initiative is committed to protecting taxpayers' businesses and the tax system from scammers and identity thieves. Choose carefully which credentials of tax return preparers. Choose wisely, as they said in the Indiana Jones movie, or you turn into a pillar of dust or something. Taxpayers should choose a tax preparer as carefully as they choose a doctor or lawyer. After all, the tax preparer is entrusted with sensitive personal and financial information. So don't be choosing like the equivalent of Dr. Fauci for your tax preparation or you'll be sorting through deception after deception. You want to do a little bit more research. So while there are different types of tax preparers with varying levels of credentials and qualifications, there are constants when it comes to finding a preparer. A taxpayer's individual needs will determine which kind of preparer is best for them. Taxpayers are ultimately responsible for all the information on their income tax return, regardless of who prepares the return. Tax professionals are required to have an IRS preparer tax identification number, otherwise known as a P-10 to prepare federal tax returns. The IRS offers resources for taxpayers to educate themselves on types of preparers. Representation rights as well as a directory of federal tax return preparers with credentials and select qualifications. There's a link to that directory here. This directory can help taxpayers find a return preparer with specific qualifications to fit their needs. The directory is searchable and sortable. Don't get ghosted. Avoid shady or self-serving tax professionals. Most tax return preparers provide outstanding and professional service. Unfortunately, there are also some unethical tax preparers that should be avoided at all costs. A major red flag or sign is when the tax preparer is unwilling to sign the dotted line. Avoid these quote ghost end quote preparers who will prepare a tax return but refuse to sign or include their IRS preparer tax identification number, clear sign of a problem because they're not standing by their own position. The fact that they do sign something does not mean that they are on the hook and you are off the hook if there's a problem, but it does mean at least they're put in their name to the advice that they have given and what not in the preparation they have done. So not signing the return could mean the preparer may be looking to make a quick profit by promising a big refund or charging fees based on the size of the refund. This leaves the taxpayer vulnerable and on the hook for any misinformation on the return. So again, no matter what happens, the IRS is a slow-moving machine. The fact that you got a refund, this is where the scam comes in. It's a short-term type of thing. They take the refund, they take their portion of the fees and then they leave and you're still on the hook because the IRS oftentimes is going to be double-checking with audits in the future. That's how they check things typically. So if you get in an audit situation, then you end up paying the tax anyways and penalties and fees and going through a painful and ugly situation. So taxpayers should never sign a blank or incomplete return. Shady tax preparers may ask for a cash-only payment without providing a receipt. Invent false income to try to get their clients more tax credits. So that would be the earned income tax credit actually goes up as income goes up. So that's one of the scammy type of things that they might try to do, which seems counterintuitive at first and the complexity of the child tax or sometimes the child tax credit, but mainly the earned income tax credit is why they target that one. Claim fake deductions to boost the size of the refund, direct refunds into their bank account, not the taxpayers' account. That's really bad. Taxpayers can report preparer misconduct to the IRS using form 14157, complaint tax return preparer. There's a link to that here. If a taxpayer suspects a tax return preparer filed or changed their tax return without their consent, they should file form 14157, a tax return preparer fraud or misconduct affidavit. Make a difference. Report fraud, scams and schemes.  To report an abusive tax scheme or a tax return preparer, people should mail or fax completed form 14242, report suspected abusive tax promotions or preparers. There's a link to that here. And any supporting materials to the IRS Lead Development Center in the Office of Promoter Investigations. There's an email address you can check out. Alternatively, taxpayers and tax practitioners may send this information to the IRS whistleblower office for possible monetary reward. Woo, there's an incentive. How much? How much do I get? Put the bounty on these people's heads, dang it. Put the bounty out, crying out. For more information, see abusive tax schemes and abusive tax returns preparers. So there's links to all this stuff here. There'll be a link to this in the description.


It is. So I put the recording on and we'll start. I think others may well join us. In fact, they're doing so even as we speak, which is great. So welcome to the AI in Big Topic Monthly Sessions. I'm Paul Z. Jackson, and this is the first brain tank session, which we're hoping will run through the year. Not every month will intersperse it with book club meetings and maybe other things as well. And the idea of the brain tank is to explore what's the future of applied improvisation. What is applied improvisation. Who are the people who are doing it. Where might it sit in academic departments if we had to place it somewhere academically, does it belong to theater or psychology or business studies or something else again. What research would we like to see done into applied improvisation if we were able to inspire researchers in the way that for example positive psychology has done so successfully. What's the ambition of practitioners of applied improvisation for applied improvisation in the world. What I hope we can do today is some scoping and some framework setting, get some of the ideas onto the table. We have a panel, a very distinguished guest panel who I'll introduce in a moment. In the meantime, we're also inviting everyone who's participating to join in with discussions in breakout rooms which will do from time to time and in cleanery. And we're also going to aim to document the discussions that we have. So we're recording this which is one form of document, but also written documentation. There's a Google Doc, which I will share with you if you didn't see it before. And as you have seen, Jeannie has already started supplementing the documentation with notes in chat. So we'll be able to save those and keep them too. You're all invited to participate in both of those documents as well if you want to. So in the chat just write anything you want as we go along questions comments, wise observations. And in the Google Doc, which is aiming to be a little bit more substantial perhaps than a chat, then you can put comments on the pieces that people write. We've written the first piece to get things started. And there's three or four people have commented on that, including both of the panelists. And there's an invitation for you not just to comment on what other people write but to write the piece yourself if you're inspired to do so. And I'll very briefly introduce the two panelists. Jeannie's already mentioned that there's something she might like to write. So one panelist is Jeannie Lamin. Hello, Jeannie. We'll say hello. Good morning every good afternoon morning evening wherever you are in the world. Hello. Hello. And other panelists is Kat Coppett. Hello everyone. You did faster than I could introduce you. I'm a New Yorker at heart. It's splendid. So contributions welcome throughout both written and spoken. And today we're going to look at what I'm calling the three waves which will describe and discuss soon. And you can see a preview of that in the Google Doc if you open that up. It's the topic of that first piece. Let's start with a chat question for everybody, which is this what is applied improvisation in your view. For example, how would you describe it to yourself, or to a potential client or an academic researcher, or somebody who was wondering what is applied organization. Well done. Very astute. Put that in the chat. Some of them have to say, what am I dog practical experiential application of social science research. Wow, there's a good hefty definition straight in there from Nancy. Applying improvisational meta skills to work life. Philosophical implications of meta skills. People having fun practicing skills and learning the attitudes. Yeah, taking the skills and mindsets of on stage improv and applying them to off stage environments that's quite similar to the definition that the applied improvisation network has been using for around 20 years. Certainly not the last word in it. Spontaneous action guided by intuition. I'm not livious. An upvote. Okay, so keep putting those ideas in there. And I'm going to invite genie and cat to say what their definitions are, they may have written them there but maybe to expand on a little bit or how you would describe it to yourself or to clients or to academic researchers does it change. If you describe it to different people. Okay, let's go first. I'm sure I will go first. So I would. I think in private applied improvisation is taking the improvisational mindset which is a beautiful quirk of human evolution. And then taking that mindset and putting it out into the world intentionally in a range of applications and those can be academic contest those can or contest absolutely academia is often a contest. So academic context, you know, social justice in training and facilitation. So, and with that, I think that there's a degree of intentionality. So one of the things for me that makes improv applied is the direct intention to, or have the ability to respond in that way to a situation. And that's not a super succinct definition. It doesn't need to be at this point. I don't think there's any specific particular merit in a definition that we're going to have a range of them and different descriptions perhaps for different contexts. Katz what's your definition or description. Yeah, improvisation. Yeah, I mean I think we're sort of we've sort of I said what Libya said I think that's a good succinct definition that we are, at least the way it grew up is that we are taking the tools and exercises and mindsets of improvisational theater and applying them to context other than creating shows and performances on stage for an audience. What I love about sort of what we're doing now is I remember you and I Paul having a conversation once where we realized well, maybe it's the other way around maybe performance improv is just another application, maybe it's just a subset of applied improvisation, where we're taking those tools and mindsets and applying it to performance, instead of applying it to having a good conversation or to generating creative ideas. Yeah, I think that's how I talk about it. And, and yeah, well stop there for now. Yeah. Okay, as I remember those conversations and I think in the end that's where it would be nice to end up where there's improvisation, whatever that is. And it's applied to all sorts of contexts and arenas including theater, comedy, jazz, coaching management and cooking, sports, wherever life in its complexity arises, and that the difficulty of getting to that is that we're so familiar with it most of us at the theater theater context which as I put in the article has become very much a thing, a product and well known for that. And so it's obscured this actually much larger area where improvisation occurs. I know there's something else in there Paul that you're talking about, which is, you know, this, this concept that we are, we say very sort of casually or at least we say it, some of us say, you know we're improvising all the time. And now we're just going to do it deliberately or do it consciously but I'm not really sure that's true. I think most of the time we're not improvising most of the time we're sort of following these habitual scripts and ways of doing things that are pretty reified and pretty, pretty scripted, you know, I drive the same way to work. I have the same conversation with my mother, every single time, you know, my, my husband annoys me in a certain way and then I respond in a certain way and he responds to me and they're like how are we having this conversation again. And we get stuck. And I, so I think there's a way that, as Jeannie says being deliberately applying these rules of improvisation can help us break open some things and get out of some patterns get unstuck. Maybe that's the end of that sense. Yes. In a sense there's no point in saying we're improvising all the time, because then there's nothing to contrast it with. Yeah, or relating everything to one particular metaphor. So you can also take a fractal view where within any circumstance we can focus in further on it and see even if it's a scripted event that there could be improvisation happening within a scripted thing so actors for example with a script performing a show, they make it fresh each time through responding newly to the specific things that happening on that occasion with that audience with how a line is offered to them. So it's not necessarily an either or. Jeannie, do you want to do? Yeah, well two thoughts come to mind is that one Gil from Frana's doll. I think I'm not sure if I'm saying his name correctly but he is at the insight meditation center and he describes meditation as an observation deck for the brain. And I love that as a description for improv, because I think it's this great way to kind of see this amazing tool that we have and play with what is possible, because of it and and that leads me to patterns because I think those same patterns we can kind of fall into like the well rutted wagon tracks of, you know, thought are the same things that make it possible to improvise and see new patterns and make connections and bring things back so it's this this duality of mindset where on the one hand it's how we behave every day and then I like the term deliberate cat as a way to kind of then turn that so that it's not so you're putting the pattern on a new context. Yeah. Thank you. So I'm going to do starter thoughts and going to invite everyone to join a breakout room with four or five people in your room and have a look at this as a question. The definitions that you came up with or the ones that you liked that you read. What do these different descriptions have in common, and what are some of the significant differences between one and another. Once you have your conversation and build on each other's ideas in a time honored improvisational way, what might be worth adding if we begin to extend those descriptions or definitions. So can we come up with a more rounded thorough interesting different exciting description of what this applied improvisation is, you'll get an invitation to a room. And if you accept the invitation you'll be beamed into the room. I'm sure you're all zoom veterans after a year of doing this. So if anyone is left behind or not sure what to do. I'll be here for a moment to guide that. And then I will join one of the rooms. And let's have 10 minute conversation see where that takes us, and we'll meet back together in 10 minutes time. Before we get sent away is there somewhere where we would like people to capture their excellent definitions. Yes, so in line with what I was saying earlier about chat. If you chat within the private room within the breakout room that remains private to you but you can cut and paste it, and then bring it back to the plenary. So that would be a really good thing to do, because that will help us with the documentation, but we'll take spontaneous additions when we return as well. So here come the invitations. See you in 10 minutes. Colin not clear how to use zoom rooms. Welcome back. We had good conversations, and we'd like to hear what you said, or what you wrote or both. I always have the impression of the change back to the main room as being the old vaudeville stage hook. There and then, you know, even though we see it coming as it's like magic. Yes. I find zooms be like magic even now after a year of sitting with it. So ask is the world ready for the definition of AI. Well, we think it might be ready to start hearing at least some descriptions, maybe rather even than definitions. So let's start with that room that had Nancy, Robert, Livia and Amy. And I'm starting because Nancy has put in some of the chat that was created in that room. Do you want to elaborate on that Nancy or anyone else who was in that room. Sure, live have my Livia have my back here as I know clear definition, but one of my favorite things in the world is talking to fellow creatives as we explore both the the creative consciousness and cognition. We talked about it being. We talked about an intuition being a part of our knowing that rarely sees the light of day, and that has a wonderful way of showing up on in improv. We talked about Paul added that, you know, we all have it as humans, indeed adaptation is what humans do. And play and creativity. It's about, but however, AI is about creating those aha moments that allow one to have a conscious appreciation for what just happened, you know, and experiencing their delight and it being a revelatory experience. We talked about how it increases our agency and, and we appreciated. How did genie say at the beginning, well rusted wagon tracks of thought and action, you know that, you know, we, we appreciated cats comment about, you know, maybe we don't improvise all the time we get into, you know, we are deeply piloted and habitual in our, in our actions so improv takes us out of that out of the ruts or at least, at least allows us to see them. What else Olivia what did I. I think you did a lover. When we love by Venn diagrams to your where we're trying to put diagrams on the way to turn this into a proper white paper or think piece that can go out to the to the journals. So Cimo and has put something in chat as well. So let's go to Cimo's group, which was Cimo Matt cats and Colin. Have you more things to put in the chat or things to talk to us about. It's cat group. It's Collins group. Okay, I so I think it's just that the general kind of conversation came around of are we are we all are we all talking about the same thing. Are we putting labels on things that are actually now creating barriers. And so therefore just by using one word are we creating a barrier, particularly when people know it from a certain perspective. And so it becomes this thing, but actually, and it's maybe it's just a set of ingredients. And so that the question of them put in the chat was well, are we being just recipe followers, or are we being chefs. And so it's, it's an interesting one thing well, I know we're trying to label things, but is it serving us, rather than thinking well what can we can we kind of get some granularity to this, rather than going, oh it's this, this is what it is rather than so just break it down. Again, you probably that the way I think about it and talk to other people is talking about co creation collaboration communication and trust. That's just the way I fan by encountering it the way to communicate the layers. So it's just an interesting one of what, what are we, what are we describing. I don't even have a joined up view. How do we expect it to communicate to other people. What was one of the questions that prompted this gathering is how do we use the words are these the words to use. Simo will now answer the question, definitively. Like based on what I'm doing with my clients. It seems like improv improvisation is one of the tools or improvisational mindset or improve meta skills or whatever you like to call them. They are one area of tools that I use, but they are also other areas that like, you know, there are lots of other tool kits that I use so I'm kind of not calling myself an applied improviser. You know, towards the clients.  So I'm kind of designing a different communication situations for my clients, like helping them to design them to work well. So, and I use improvisation as a mindset as a trainer, and also as one of the tool kits. I can say that all I'm, that is all I'm doing I'm not. You know, if I face my clients I'm not saying that I'm an applied improviser. I'm doing applied improvisation with you. That's one of the tools I use. I'm sure within the network there's a real range of what we say we're doing particularly in relation to mentioning the improvisation word or the improv word, which was the start of the article in the Google Doc is the associations people already have with some of these words. And I use the word improvisation with the client with clients. But only as a one tool. So this is it's on the plate that the improvisation is a very important offering also but it's only one of one of them. Thanks Seema. And the other group right to Elena, Jeannie and Nick, things to add in chat or in plenary discussion. I, you know, I think that we, I think these conversations loop and sometimes I'm interested in. I think we have a lot of conversations within the applied improv network and my guess is outside of it as well that are false dichotomies. It's interesting to me how often we as improvisers get hooked by either or conversations and you know, failure conversations or yes and conversations or this one about is, you know, is it should we call ourselves applied improvisers or not. And I think sometimes we should talk explicitly about improv and the value of applied improv of improvisation. And sometimes we should not. And I think the question as I as we often say to our clients is it's the right question to ask. I don't think there's always the right one right answer to that question, but it's a really good important question to ask. When is it valuable to explicitly reference improvisation or improvisational theater. As a tool or that that's where the tool is coming from or as a, I'm avoiding the word metaphor but as a sort of example or image or touchstone or touch point explicitly. What's the value of that and when is it not when is that a distraction or a barrier and I think they're really clear situations where both want one or the other is true. We might not all agree on exactly each situation but I think that's a question we should always be asking ourselves as consultants and trainers and coaches. Thank you cat. Robert, and then right so invited share screen. I go back to to my very basic my first applied improvisation workshop that I set out to get calling on all the businesses in Atlanta, two responses that sat there one person now this goes way back and and one of the responses was I'm Robert well I got a team building program called team building was improvisation I'd like you to send a couple people. I'm not here click. And another who was Dr Ed Metcalf who was the senior trainer for IBM Corporation. I'm Robert low team building with improvisation.  What. Yeah, well yes so here's in the details he says you want to know why I said, yes. So quickly well yes sir. What's the meaning of the term enthusiasm well no sir I don't know where it comes from it's etymology and within theos God expression of the God within he says I don't know who you are. I don't know what you've got, but you've got enthusiasm and I want my people to get it. So that's my bottom line and has been my bottom line forever. And my other bottom line is that we don't know who we're dealing with until the day that we get there. Whatever we think we do not know who we're dealing with until the gathering has been made. And our first job is to understand that as much as we can.  And then we can begin as people say there's so many different ways we can describe this, what we're planning on doing what we're going to do is what happens when we arrive. And that's the baseline for all this. So, as far as the title general overall wonderful. I tell people hey you know you know improv comedy right yeah still people have you know if you heard about applied improvisation. What's that. So that's always the conversation. Thank, thank you Robert. I would like to make point for the, this brain tank that it's not just the question of when and what we say to clients or conversely clients there's there is this thing called applied improvisation that it's of interest to us as a, as a community. And there's all sorts of things that we might say about it or might choose not to say about it at different times. So bright Sue and Eleanor we're both interested to come in right to first and Eleanor. And I just share a document and that's a picture I just draw a moment ago. And I can give a overload of my understanding input, then down or in fiction something like that, and then I draw a comparison between input and then and current and past 30 years, a situation. Like my understanding are very personal like improv is equal to then down or in fiction, or spontaneous spontaneity. So improv and people has a misunderstanding is only comedy because in the past 30 years and it has a movement, who's like she has the boss comments boss. It's a very narrow kind of understanding and but he has very deep cultural impact in a lot of people. So this comedy approach. Of course now we know also we have the legitimate see it or improv and doing long form or like improv LA doing a wonderful wonderful different genres out there and improv. John Stonnier has a important product in that and of course we know this is all about theater and we know AI has much more application in other areas. And from here I draw a comparison to then and a lot of people learn then through mindfulness through two major movements and BS are co buzzing moment and or UK version and BCT started in 1990s and and this kind of approach also has is limitation and one interesting word is Mac mindfulness. A little bit like big Mac and McDonald's something like that. So like, you know, a lot of companies now using mindfulness to enhance their productivity, but they don't value that diversity or their respect.  Using a tool of mindfulness, which is not good, or people talking about killing a cow my for it without pain and that's totally wrong. And of course we know that it's much more and compassion sealer and etc like that and. And I will stop right here. Thank you very much. We'll return to some of the, these perceptions in a moment when we talk about the three waves before we do that and I was there something that you did to add. Thank you yeah I was just wanting to add to what cat said about that how much context matters and when we use certain words and terms and both I would say for talking to clients but also what we do to ourselves and to the community. I feel that that it sometimes does really help and sometimes doesn't help to use the wording that are very familiar to us but not very familiar to people who have never experienced it and then have all sorts of assumptions and create their own idea of what we will do with what's happening and what kind of prerequisites people should bring, which we always try to emphasis like all you need to do is show up and everything else we do together. And you don't need to be a certain personality to you make use of the principles of improvisation, but that sometimes is, once people start to have their own assumptions about what improvisation is about it's really hard to bring them back to like play zero or like corner one or whatever you call it, and then just be open minded with it and my other experience is that it's sometimes a lot easier to do something than to talk about it and explain what improv is and like, you know it's like this knows not like that and then people are getting confused and so often what we do is in particularly when either we're talking to friends or with people or even in a call with the client before like in a first setting up something call is just like let's do something and then you experience like a show don't tell and that to me is much more helpful than then talking about it and trying to get on the same plate and not being sure whether you ever get there. There are certainly things that can only be experienced and not not known by reading about them, you can read about riding bicycles doesn't give you the experience of riding a bicycle and improvisation is in that category somehow. So a few things about the three waves to give a sense of a possible. Possible ways of thinking about what it is we're doing as the applied improvisation network or as applied improvisers, and certainly it seems to have some resonance with what right to was sharing about how improvisation has been perceived. This is what I've written about in the Google Doc so some of you I know have read that and started commenting on it very grateful for that. And I know genie might write about wave zero which precedes the wave one that I'm describing. I'm not going to say everything that's in the article because you can read that a couple of additional comments, but wave one, which is the practice of improv comedy or improv theater. And the possibility that some people get more from that than things that are useful for the theater so they notice that it's good for their life in some way or other prompts their confidence or their creativity, or gives them some ideas that they may take outside, but the primary purpose within wave one is, you do improvisation theater you go on the stage with it or you choose not to go on the stage with it. And my additional comment is that I think is still the dominant and main wave that is out there in the world so it's what all the improvisation theaters do and they're training people to be improvisers. That's probably what happens more than anything else and is often many people's roots into improvisation. And wave two happens when the people who've noticed that there's all these other benefits or byproducts or other good things that happen when people improvise theatrically start to make that the topic of what they are then teaching usually still in the form of workshops and courses, but the courses are now called confidence or creativity or teamwork. And we see all these words appearing as typical of wave to where the focus is not on doing improvisation on stage or even necessarily using the stage activities and range of concepts. There's two branches of that there's a branch where you're still doing theatrical things, but saying as well as that you could see these applying elsewhere. And I think that's where some of the big corporate improvisation performing companies have gone. In city, you know of them because of their comedic and theatrical and televisual expressions but you'll go there to learn these other things because they've got the credibility, but they'll still teach you within the fairly traditional theatrical based format, or there's the other branch within that which I think is more what I do where I'm not necessarily telling people that it's improvisation I might be to go back to the discussion we had before. There's no theater in what I'm teaching at all sort of detached from that and I'm no longer working with theater even though that was where I first worked with improvisation. And both of those branches of wave to I think around with us now both healthy and both have lots more possibilities in them. And then there's wave three, which is less formulated, certainly my conception of it but is maybe the most exciting and has the most potential, which is improvisation is this thing in and of itself, that we can experience, apply, talk about characterise conceptualize and experience in all sorts of forms, and make that conscious and coherent to. And my favorite example of that as a product or service is genie's quest, where there's some workshopping does happen but that's not really the essence of it. So the quest is where you go out on your own, usually or maybe with somebody else if you choose to, and you have a deliberately improvisational experience in the world. And that is the thing. And then you might reflect and share and talk about that too, in order to get a coherent view of it. Those I think are three distinctive enough waves, and that we're all operating somewhere in a tradition of one or more of those waves. And I'm going to question in the chat and invite you into some rooms to see what you make of that. So the questions are, where did you come in. In your entrance to improvisation was it theatrical entrance or organizational entrance or research or, or something else. What's the potential for applied improvisation. If each of those waves continues to develop and express itself. So see yourself being in the mix, ideally, perhaps in relation to where you are now, not expecting you to answer all those questions. They're prompt questions that might be interesting for your discussion. If there's something else that's more striking to you or more important to talk about then by all means do that. And then we'll share some findings before we wrap up shortly after the hour maybe between the hour and 15 past for today's session. So let's have another 10 minutes in groups. I've refreshed the groups so you can meet some different people. Here come your invitations. Welcome back. So what did you talk about, particularly interested if it was about the potential, or where you see yourself with this thing called applied improvisation. What documents in what what have you put in this email. Oh, I found the schema. Giovanni skill my sister score who has researched our base methods. And they use in organizations and this nine grade version. It's not what I use I've done my own version in finish that's more about applied improvisation but but the basic idea of the nine grade is that we are working at second or third wave. There's also the application areas that are more common or more rare. And one of the most usable applications are like entertainment like in the end of seminar day we are doing the values improvisation we are displaying the values in scenes and we are displaying things we are kind of using to display information like in an entertainment kind of purpose. And also there are like trainings like who are trained like you can train in pro skills communication skills. And you can do team building customer service and that's that's that's the next level of like that's very common. And then if you think of like leadership skills and and blah blah blah they are skill sets and blah blah blah. But I think that if you think of the right top that that's transferred like cultural transformation.  So, so it's I think many of you have done it but I think this is a lovely nine grade because it shows us that they are also lots of ways to apply whatever our definition of apply apply improvisation is, or some people say art based methods. Yeah, I don't. I do include the humanitarian work some of that that I am and members have done. Belina's idea of using improvisation to change the world. And Robert was talking about being a walk up comedian he does improvisation improvises with people in the community as he walks around with them. I definitely want to bring in cat and genie because cat wrote that she came from theater and then studied management and organizations and genie said she left from that one wave one to wave three. Maybe you could say a little bit each about that and then see what other people would like to comment on cat. Sure. Yeah, so I went from traditional theater conservatory acting conservatory to improvisation, because to become a better actor, actually, and there was a real split in New York City between traditional theater and improv. So improv was not respected at all, but I was in a theater company and someone came to do an improv workshop because they had some connection, and the, the improv teacher said you you're good at this, because I was following her directions I was a good student right I wasn't funny or anything. And she was able to say to me, she was able to make sense to me to give me a positive path towards saying what my acting teachers were unable to say in a positive way. They would say don't think, or you're too smart to be an actor, all of these ways of trying to get me to not censor myself, right or not hyper intellectual eyes. And she was able to say things like yes and or be spontaneous or give me exercises rather than just talk to me about what I shouldn't be doing. So that's how I found improv, and then cut to three or four years later, my students started to say. I wish my boss knew about this yes and thing, or I wish my team could collaborate and support ourselves, the way my classmates do, and they brought me into organizations to start teaching, I guess, wave to right in their organizations and I was like, I'm a starving actor. You have money. Very attractive prospect, right, but I really felt that some level uncomfortable about it I was like, I don't want to be selling snake oil what do I know about organizational development. I don't know that this is useful. So I went back and got a masters in organizational psychology. And that's a longer story but very quickly I was like, Oh, there are things that I take for granted, coming from a world of theater, coming from a world of globalization that people are starving for right there's something that people just don't get. So of course we're a value. I'll go one more step and then I'll hand it to Jeannie that it then took me a whole other couple of years out in the world of my clients saying it to me over and over again for me really to get the ways in which what we're doing I guess this is the wave three revelation that it wasn't a metaphor. That when we said, you know, like improvisation that we weren't it wasn't a metaphor we were saying like what you need to do the things you need to do in life to collaborate better to communicate better to listen more to be more present to make your partner look good are exactly the things you have to do offstage. And what we were talking about in our group was there are many, many different paths to that. Meditation and mindfulness. You know, there are all sorts of ways to get to that what it makes improvisational theater, unique, or special, or especially good, I think, is that it's like this giant gym full of exercise equipment. We have collectively built just a lot, a lot and a lot a lot a lot of exercises to help build those muscles in different ways. We have a very rich activity basket. Very rich. Right. So people talk about all of those muscles or mindsets that they want to develop. We've got something for that. Yeah, we'll come in future sessions maybe to how some of those are better or not so well used. But I think it's really nice set of points and how I've just written in the chat that theater is often a metaphor. It's like we're on stage even though we're not the improvisation is the actual thing. That's a really good distinction. Jeannie, you're muted. I love hearing everybody's origin stories. So I was in high school I had an audition like Olivia. I don't know if yours but we have a similar kind of impetus in that I auditioned for a play and didn't get cast and I was kind of crushed in the way that you can only be crushed when you're 16. I was at the yellow pages and started calling, you know, different improv schools, because I was going to show them. And second city told me I would have to take teen classes which I thought I'd rather kind of eat glass than do that. And I called IO and I actually talked to Sharna and she said well come in and try it and you can see how it works. And so I went in and when I was at IO. I was like it was before improv became a commodity in the way that it became in Chicago and it was, it was just a much different thing and so now I look back and I don't know how I was courageous enough to be like 16 years old with a bunch of, you know, adults doing improv but there you have it and then I decided that if I wanted to represent human experience it was a much better thing to do to get more experience and so I studied anthropology and archaeology and then went into historic preservation I kind of left. You know I went into improv because I thought it would teach me to be funny. But what I discovered there was that it taught me how to live. And when I went into my work. I would kind of, you know, I was presenting at a conference I'm like well let's do a play instead of a panel discussion. Of course you're all going to wear giant photo murals on your head where you're going to represent different works of modern architecture and compete in a bachelor competition and I just kind of left into these things and then when I discovered kind of the applied improv network I was like oh right this is what I've been doing. Now I have a name for it and and then when I encountered the quest. I became fascinated by it as a way to, you know what is this improvisational mindset, and then how do you break apart the components of the improvisational mindset. And what does it mean to take that out into the world not just for like a few hours, but for a few days a few months and entire life. And kind of digging more into the roots of improv and latching on to its roots as what I see in, you know, Chicago and North America as a tool for social change, and really wanting to like, what would it look like if we all had this resilient spontaneous wonderful self to access and what magic and good could we bring into our own lives on the lives of others on a small scale but then also on a global scale. Thank you, Jeannie. And there are roots before it became improvers of commodity and they are in social change and it's in some ways come back full circle through the AIM and other other activists. Just a few minutes to go. What else would anyone like to say either in chat or in verbal communication with the whole group. Amy, and hello Suzanne. I was really delighted with what I heard at the beginning of the conversation when I don't know it was the kind of going back and forth between what Kat and Jeannie said about, we say, oh we're improvising all the time and that phrase never sat well with me I didn't understand why until now. No we're not. We're just, we're in automatic mode most of the time because it's just easier. And that what Jeannie said about that we had to do this with deliberately consciously at times I think you had a different word Jeannie. And that just was really satisfying to me I mean yeah and that's why it can sometimes feel scary or hard or effortful for people at times because they've got to get out of the automatic brain and just make different choices. So that just I'm just thank you for that insight that connection. Thank you Amy. Right to talk a lot about comedy but also I wanted to get the credit to the comedy as well and about exposure about improv. And like who's right is anyway and you give exposure to millions people and I meet a lot of people who actually got to know improv through who's right anyway. And the theater can reach hundreds, hundreds of people, but more shop can reach only dozens of people and really limited in terms of scale. So I still have just value and out there, the more people we can get them interested in in improv and the better chance we can get them deep more into the improv. Okay. Yeah. Many of our roots are from there. And I love theater improvisational comedy, long form improvisation. And at the same time I think it can be distinguished conceptually and usefully from improvisation in some other applications. So both and not an either or to go back earlier to our conversation with people waving there. Gene and Robert, Robert then genie. Very quickly on the idea of we always are improvising. I grew up in a ghetto wise gang run neighborhood in the 1950s in Southern California, and didn't know until maybe two years ago that I was improvising in order to get there I had to be aware of everything around me, not knowing what to expect from a given moment. And so I think that improv has brought that back. And I also respect what people are saying, because it's so easy to get into the ruts into the wagon wheel ruts I love that term. Something about consciousness be more alive responsive to circumstance in different ways, adapting to change these are these are certainly things we'll be talking about, genie. This was just something that occurred in reading some of the comments and talking about rules and kind of learning and one thing is is that I like building blocks as a term rather than rules because it also speaks to the assembly like nature of what the different ways we express improvisation but then also it makes me think about artificial intelligence and machine learning in that, you know, there's there's this information that comes in and then. It creates rules and then those rules then learn and then it goes on and you know I am by as anyone listening to it would know not an expert in machine learning but play can be a very deliberate tool for helping machines learn. And I think we're at this fascinating thing where we're, we're both. I don't know I think that these these two fascinating ways of externalizing our thought and putting it out into the world are kind of coming together at this really interesting intersection. Thank you for raising the other AI. That's right. We'll continue in some parallel. So we'll finish in a moment, but there's an invitation that we also continue with more meetings of the brain tank. That's the BR AI and tank, which will be, thank you very much, which will be here in a month's time. It's the first, that's the second something of the month second Tuesday of the month is when the big topics are happening. We'll be notified in the AI and newsletters on the Facebook page and in the LinkedIn page so you'll you'll see them there. Thank you so much for coming. And there's also an invitation to keep writing. We've got one Google Doc so far but we can obviously extend that to sections and chapters if the writing explodes in a way that it might. It's a great way to think about how to incorporate the chat from the session itself into the documentation to so that we get a sort of rich depth to the discussion and we can read back on what we've already created and then take it on further month by month and see what we make of applied improvisation in the world. So thank you all very much indeed for being here this time. We'll see you again, no doubt, soon. What a wonderful gathering. Thank you so much. I'll stop the recording. Yeah.


Good morning. I can't see all of you, but I think I hope you were at good parties last night. I heard they were great I saw seeing pictures on on my WeChat group in my team Hello, good morning. My name is Subbu Alam Raju. I haven't had coffee this morning So I'll try to speak loud and and stay energized looking at all of you. I know it's a last day of the summit and Keystone is probably not the most exciting thing happening in cloud. It is probably the most boring projects that you may consider And if it is boring, I wouldn't talk about it. I'm sure you wouldn't be here and and and so So I'm going to spend some time on what we how we use Keystone at eBay What have we we've been doing to make it to make it really work for our cloud And the reason and why we took the approaches we took The hard work for this talk was done by two of my colleagues Davi Ding And who is the the lead for our IAS layer And and thanks to who's leading the identity and access management Project at eBay and these guys could not be here. So I Took over that the talk and I did do my best in in giving you a Staying truthful to the topic So why Keystone at the center of the universe? I think what has been happening In at eBay and I'm sure it's happening throughout the industry is that Control plane is getting more and more important than data plane If you go to the traditional enterprise maybe five years ago, you know, it's all about Filing tickets and spinning of VMs and then you forget about control plane after that things are running Now we are getting to a time where Actions are happening. The cloud is changing very often The traffic on the cloud is increasing on the control plane apis are getting more and more important because Availability security and provisioning all these things are happening programmatically And to make this work at scale You need a rock solid control plane and that's the realization a lot of us Have come to in the last few years. That's why you see folks time a lot on ha for the control plane more than the data plane So What is our what does our universe look like before I actually talk about that I want to make a couple of disclaimers one is that The stuff we did is somewhat dated we Some of the stuff we did is based on Havana of open stack And we upgraded later on similarly Some of the enhancements that we made to keystone for identity index management are still internal We have not yet been able to commit the blueprints and then push up steam Hope to get that process started Soon the team is still busy Getting up to Getting productizing that that those are the features we did. So that's my disclaimer So what does our universe look like? as I said before The control plane is is extremely important for our business at ebay. For example, a developer can come to a cloud and say hey Deploy my new app with this C name Make it available everywhere and that action takes about 30 minutes. The code is running everywhere That means A lot of provisioning access activities that happen throughout the control plane not just the compute open stack layer But other platforms that exist So I want to go over how our universe looks like Why keystone is getting more and more central to what we do We have this notion of availability zones. This is pretty standard in every In every cloud deployment today and all of us most of us have More than one deployment of open stack And we took this very seriously in the sense in our deployment in our data centers We have a number of these availability zones Each of these zones are Totally decoupled from one another Each az is a full open stack deployment So we have done the complete automation of the of the cloud itself So that I could once the the metal is provisioned once the network is racked and cabled I can use some scripts to bring up a new az And the idea of an az is a coarse grained fault domain That is if something goes wrong with one az it is not impacting another az so that is a promise we try to maintain For for the business So if a an application wants to be available and easily into failures They are expected to provision across multiple availability zones So that's it's earlier. We used to think of a rack or a half rack as a fault domain Now we have moved away to a much larger coarse grained Fault domain, which is in availability zone. So when you have these multiple availability zones Where can I find the cloud? Is it a common question? Like should I which endpoint should I use? What is the protocol to use? How do I log in? Do my credentials work everywhere What is where like now you have many many services in in our service catalog and you have to know the endpoints to use them And and a lot of provisioning activities happen across az Because they when they are multiple azs you want to deploy code Spread the code around Application around that means you are orchestrating Whether it's load balancers or dns or provisioning You're spanning these operations across the globe And across all of azs And you want to keep that consistency and you want to maintain users and roles Consistently across all these azs and those are the problems that we started with lately last year The second complication that that adds To this is the notion of a vpc We are promise our fundamental principle of cloud building clouded ebay is to Treat infrastructure as a shared resource and not a dedicated resource That means whether you have dev test workloads or Or a production workloads of different kinds even when we say production There are different kinds of production for different with different policies and and and expectations So we modeled we borrowed this term called virtual private cloud from amazon way back in 2012 But we went beyond Amazon's definition of vpc which is amazon's definition was It's a it's an isolated segmented network Network segmented zone within amazon's public cloud infrastructure But we go beyond that and define policies of who can do what where And whether a person can do these actions and and are not those policies we define Uh in the context of a vpc. We don't have many of these vpcs There are about 10 vpcs, but but they are all have the same services. So When we launch a service a feature and it's there for dev. It's there for prod. It's there for everything It's not that we launched the devs some some feature for dev only and something for prod only that we want to maintain that consistency So that when somebody builds a platform that's running on cloud infrastructure Want to make sure that they get the same expectations if it works through some apis in for dev test mode. It has to work Provided you have the right policy you confirm to the policy in production So that's that's how we approached cloud And they have different out and access policies For example, if i'm doing dev test, I might just use a single factor authentication, which is my corp login and password But if i'm using a a mission critical application that is That is important for the business that change may have to may need two factor authentication So it's not we have to do that support and more over there are cases where They are machines doing operations. It's not it's not a human being So your corp credentials are two factor authentication don't even work So we need to support all that flavor of use cases when you have This is such a multi-tenant cloud infrastructure And what's make even more interesting is that I think some of you who attended ebay talks before A new should know this is that we have taken an approach where our apis are open for all our developers And and we want to make sure that there is one way to do authentication for all cloud services not Five different ways because first of all, it's not secure if you everyone is collecting credentials And you want to make sure there's one entry point for Authentication one way to generate tokens one way to revoke them consistent policy and So as we started adding more and more platforms on top of our basic cloud primitives, which is compute storage and a network we My started migrating Other platforms onto the same model. So we have arrived at this model cause a tested control plane Which is the set of apis services You use on the site for provisioning software deployment monitoring and remediation So all the apis the complete life cycle of operations that you do for cloud Are part of this tested control plane and and they are apis for provisioning like the like the pass layers We have built homegrown accessor service for different use cases like you know elastic search and and and Caching and things like that Some of these may end up in open source. Some of these may not we are still going through developing development and and production productizing the those services these kubernetes we are investing in kubernetes as a layer as a cluster management layer on top of open stack primitives And that too needs credentials and and have a consistent policy of access control And there are a ton of other homegrown cloud services that we have in every way And there is headless access people that don't have their machines operating With the cloud infrastructure of the with the apis. So all these layers exist above Around our keystone infrastructure So our control plane started with the three four services three years ago. Now it's it has many many services It doesn't even fit in half a rack anymore It includes object block computer network and and all these other services And in addition we have services below the the cloud which are operational services They also need the same kind of things like who can create networks Who can onboard networks who can provision hypervisors who can decline her for hypervisors Who can evict hypervisors the whole bunch of tools and operators using it? So again, we want to make sure there's a consistent policy and Of identity and access management So that has led to this model that this this realization about about a year and a half ago that We got to have keystone as that center of our universe As which is has to be global That means if I create tokens in one place I need to be able to use the tokens everywhere I should have one set of policies that are governed and managed in one way And they should be only one entry point for authentication and access control for the cloud not five different ways of authentication It should be available That means because every operation in the cloud Is using is authenticated Except the part of getting token itself You want to make sure that I didn't I am itself is available globally and it's secure for obvious reasons Without actually managing users because we are still not managing users There are other systems in the company that manage users. There's corp held up. There are other held up systems that are managed By other teams that have their own policies of how they store and rotate passwords and all that We don't want to get into the business of doing all that work. We still want them to do the work Same thing for two-factor authentication We don't manage two-factor authentication, but there are systems that manage two-factor authentication So without actually managing users we want to have I am built in ad ebay And we have untested cloud users And we have semi-trusted cloud services in the control plane. So we want to address all the use cases. That's how we started That's how the keystone became So so important in our in our in our stack. In fact, if you please so is down cloud halts Every every part of cloud halts. I mean VMs keep keep working, but how good is it if you can't change it? So we did three three important changes to the changes to the Wave we deployed deployed cloud. For example, when we started our initial open stack deployment, there was one we didn't care One one az we didn't care much But as the number grew over time This project became these activities became very very important. So the three things are a global keystone And the notion of a tested control plane Then the second fact authentication And the third is a set notion of api keys Those are as I said before extensions that we made in-house. They are not public. They are not yet being contributed upstream We are we have to work. We have some work to do on those respects So let me go over The how of of these these features and then I can open for questions The design that we used for keystone is fairly straightforward as I said before when before we thought about this we had multiple we had already launched a couple of availability zones and There are already users and projects and whatnot On those in those availability zones you is using its own keystone instance That means we had to work out a a model where We can migrate the data without impacting our our existing users and projects and their resources That took in fact the longest time in in this process So the design was fairly straightforward and and and and repeatable At the at the bottom of the picture you see the you see the databases which are mysql instances and The way we set up is that we have And number of these availability zones each has a load balancer. Sorry a mysql cluster And we use Galera to to replicate certain tables Across globally now there are there are some trade-offs in this process the first issue was We started with the assumption that We only need These two tables like users and roles Let's see what happens. We start digging through the code and looking at all the dependencies and and We wanted to set a design constraint that we don't want to touch tokens We want to leave the tokens where they are and see if it works and then we went it went into the code and realized Oh crap There is tokens everywhere and and it's uh It's so strongly a couple such that you have to replicate tokens and there are why tokens are a problem because As you access control plane Not every client is smart enough to cash tokens So they just forget about They just ignore what they have right now and they create a new token every time and they do try to do something And so there's a lot of traffic for example, uh recent peak we had was about 8 million tokens in a single day And we were surprised. Oh, this is this was not expected. We were not expecting that much traffic on the control plane These were fresh tokens minted on a given day That was a peak recently and that's been growing over month over month Since we launched early this year So each mysql cluster Has a load balancer whip and on top of which we have a dns We use a commercial product for for for the for the dns entries So they have a dns whip but And then on top of that we have the clusters of keystone servers in each in each az And and the dns is configured such that if an az is looking for mysql It'll find the the nearest which is the local Keystone whip it'll it'll do the reads and writes from that And and the model repeats on top of The keystone they have a load balancer whip and then another dns entry So from the user's point of view, there is one single entry point We may add more azs or remove azs the user doesn't see all that we can fail over the user doesn't get impacted All the user sees is one global entry point for for for keystone So that it makes it easy for him for the user to discover Use the same token everywhere In every az Now the trade-offs are here is that obviously the the writes Because uh galera is a multi master Replication system which is using certification based rights rights take longer there's a penalty for rights because the rights have to be Propagated everywhere you look for conflicts And then decide to commit or roll back so right cost increases, but Reads don't go through the same penalty because they are they are read locally from the local databases So that's a trade-off. That's a billet we bit knowing well into the picture Uh early early in the process. So as of recently If I look at the stat the state traffic trends, uh, I I removed the graphs because they were not They were showing too much data than I wanted to They were about 10 to take new tokens per second on average That's that's the kind of traffic we are getting now and the peak was up to 100 tokens per second And so initially we had some surprises and like keystone getting down and all that So we we had to figure out and put some great limits and and and so on so on to ensure that we have The keystone is surviving the traffic The right latencies are high It is not ideal and we have to Think of ways to improve that part of it is also dependent on the underlying infrastructure, whether it's The LDAP or two factor authentication system So the cost overall cost is high and also the galera cost is they're adding up The read latencies if you directly go to keystone, it's about 200 milliseconds right now We started with pki we say very naive choice because we were upgrading from falsemon and we didn't change the configuration to use pki z And that realized oh crap. These tokens are getting longer and longer And we had use cases using sift and they are exchanging tokens and the and if you're exchanging a one kf a object You have ton of metadata with the request because of the token size So we went and switched to pki z. It was a very simple straight forward config change Which dropped the the token size to by 60 percent Which was awesome, but I think the most ideal situation is to have ephemeral tokens That that you don't need to replicate so that we get higher right latencies And also galera becomes much cooler system because if you take tokens out The number of writes that happened for users and projects is much much less traffic wise critical down to Many many times in terms of the traffic to the keystone itself so That that somehow that blueprint never happened in the in the community And there's also a great talk the other day I think by an engineer from ibm on the types of tokens and the new kind of token That are coming in in keystone We might take a look at it and and see if we can Reduce The right latencies and make the system more more resilient because when you have millions of tokens getting created every day we have also worry about purging the tokens without freezing the database So initial at our initial returns where we had some incidents where The script to purge the tokens kicks up and then keeps on froze because the entire table was locked And so we had to figure out we had to actually patch keystone to Make move the data of yesterday's like previous day's tokens to a different table and then restart started the fresh table So that the cleaner operations don't impact keystone and these some of these changes We couldn't get to the community in time because these were incidents happening like Then and there we had to fix those things Hopefully we'll submit some of those patches upstream The other I mean this another interesting point I think some a lot of you probably know this if you are using keystone and open stack for a while is is that you know the more ages you add The more cloud services you add The tokens get a bigger and bigger and why is that? Because every with every age you have a set of URLs in your service catalog If you have 10 services in each age and you have 10 ages you have 100 URLs in that in the so your catalog is growing Which is which is and we have a lot more services getting Added to the cloud. This is not just open stack. We have the entire provision deploying monitor immediate services in the control plane All using keystone for that identity and access management. So this became a humongous problem It's pretty dumb if you think of it because why would you want to put a catalog in the in the in the token? And so we ended up patching keystone To reduce the token size to somewhat manageable levels Now we had a point it's around 2k We don't care about Catalog in the token anymore. We had to patch some parts of open stack to to get that The the next the next topic I want to touch upon is is two fact authentication. I think I think it is pretty clear that today if you are using Anything that is important You got you got to use two fact authentication not single fact authentication is no longer The right way to do things we came to this realization late last year And and keystone unfortunately was not where it needs to be there were blueprints from 2012 and so on but I think there was no activity around it and this is a bit somewhat Surprising given that a lot of enterprises are using open stack And they're using keystone the fact that uh two fact authentication doesn't exist This is I think is a shame on us All of us so we started looking at options to do two fact authentication And in order to simplify the policy We look we went back to how we create vpcs and projects and all that so in our model a vpc is nothing but a label So when you create a project in a in keystone Uh, we put a label on it the label says no you are market ebay marketplace production or you are Dev or you are something so that label is a is a text sting label And that label tells all the policies so once once I get a request Based on the project. I know what vpc you are you belong to and what policies apply to you throughout open stack deployment so, uh We define the policy let's say x vpc requires two fact authentication or y vpc does not require two fact authentication based on that We can enforce it completely It is entirely dynamic and configuration configuration event that means as an operator We can change the policy overnight and gets rolled out fairly quickly through our config management system And the challenge that we had when we thought about two fact authentication is how do you keep All your client libraries work with work with Work with keystone because if you add a new extension suddenly you have Python Swift client or some other client would start breaking because it doesn't know how to authenticate itself with keystone So we decided to overload the syntax of V2 tokens API To for second fact authentication So as far as the user is concerned the user still submits His username and and his password the password is typically, you know, if you're using rsa It's typically your your pin like a four or six digit pin followed by a changing ever changing Identifier, so you submit that And and and in the background because we know which project we are trying to authenticate to We know that you need two fact authentication and we would enforce we would check with the with the backend system for validation It's fairly straightforward as far as the user is concerned as we had to figure out like maintain make sure the compatibility is there and So token validation is also very compatible. There's no change that you have to make to support do two fact authentication I think the the yucky part of this exercise was Resync as you know some of the two fact authentication systems like rsa They have this weird Resync protocol. It's not a standard. You have to call up an it guy. Hey, my token is not working. What should I do? You would say read your Number and then he would resync. So we had to do some clever extensions on open stack Sorry keystone to support that extension so that The portals in adb that use keystone for authentication. They they can they can prompt the user. Hey, you have to Wait for the next 36 60 seconds. Give me your new token and then you would recent it So we build those extensions It would be great if we can actually as a Standardize this model because I think this is very important to fact authentication for all of us This has been going on we have been this has been in production for about six months We use we have enabled it for certain vpcs not all vpcs yet because the back end is also Not heavily scalable. You want to make sure it's it holds the traffic the the third extension we did Which to api to keystone is what is called as api key? I think the idea is fairly straightforward and well known In older and more mature cloud platforms like aws So the idea of api key is to support headless use cases headless use cases when a user is not Presently interacting with with apis through some portals or cli is there's probably some code that you have In running in a vm it's running in maybe a form of vms And those vms need to do something with a control plane. It could be let's say getting data in and out of shift Or you have you're creating Vms because you want to flex up something A flex up a pool of a cluster of vms So we had to support the headless use cases But putting your cop credentials in and distributing in and vms is a dumb idea because you're leaking credentials everywhere And two factor authentication doesn't work because they are time sensitive so we had to think of a ways to See solve this Without increasing the exposure of of cloud in terms of security is concerned. It's a very we had to make Several iterations. I think the lightest iteration is going to prod Just now to make it more and more secure to reduce attack vectors So the more the principle was raised is very straightforward as a user. You would use an api to create a secret an id and a secret And use that id and secret in place of your actual credentials and you can create as many of these credentials as you like these are in effect temporary throw away credentials And you would though you could rework the as a user you could rework those credentials anytime So let's say I deployed an app And there's a 500 vm app and I pushed the credentials Into that those class that cluster of vms and I can decide if I Something happened I can rework as a user All the talk all the api the keys that I I minted for my project and everything is good back to normal So that is the principle we used amazon has some features like this I believe hp at one point had something something like this as well in their helion distribution But I don't think these ever made it to the The upstream yet and that's something that we need to work on The the the model as I said is a very straightforward I think the challenge was that how do you make how do you reduce the surface vector apologies the diagram is not very well formatted for this size of the screen Because of the way the browsers behaved in when I was doing the screen capture The idea is that when you let's say I have project p1 and I want to use an api key and I want to make sure that You can use that key pair that id and secret only in that context and not not use it everywhere Because if you let it use be used everywhere You'd if it such as things like two factor authentication. Just imagine. I'm so lazy. I don't want to carry my RSA pin And I find this feature. Oh, I could mint a temporary credentials. I could Put that and start using this key pair And use it until they expire. So I'm actually bypassing Two factor authentication policy. So we want to make sure it's very restricted So we wanted to we did it to took an approach where You can only operate in a limited context And with a certain limited roles And not use it broadly So you still have to go back to your two factor authentication if you want to do something something bigger And this is you limited for programmatic use cases only in certain when the source and destination are well known So the way it works is that you log into the key see keystone. You have certain roles. You belong to certain groups You have your auth token and then you say hey, give me a new id and secret And at that time you can choose to grant some of the roles you already have if you have role a and b You can say I want to grant role a For this use case and I want to grant role b for this use case But if I don't have role c, I cannot grant the role c for either of my tokens So I'm basically creating a subset of my abilities When I create the api key and then I can set an expiry And if the expiry is not set A default kicks in that's something that we as administrators set sets expiry And I could also choose a scope where from where am I going to use this? Because again, this is this is to ensure that this can't be widely used So the default policy is that if you are doing operations if you have a dev project And if you're operating in dev resources, you would use it You can't take the same and use it in a different context different let's say for prod use cases So Optionally you could you could limit even further limit your operations to let's say I want to use this for this subnet Or this set of ip's So you further restrict the the scope of The keys and then the outcomes is an api key Which is an id and secret with an expiry minted on it And then I can use that in place of user id and password anywhere with every open stack api fairly straightforward once the token is created api is again Straightforward you specify a source project optionally if not it is default to the current project It's an expiry You give an optional set of roles as a subset of the roles that you already have And similarly a set of groups and optionally set of ip addresses And if you don't give any of this they default to the your vpc current vpc And then again in the implementation we have several checks and balances to make sure that your authentication is fairly bounded That means you can't get out of things and you don't that you're not allowed to do So if the color source for example, if the token is minted with a set of ip addresses And you're not coming from that ip addresses. We block you If if you are using from a different vpc The token doesn't work If you are using from in a different project. It doesn't work. So it's fairly limited We still this does not take away the need for Need for using, you know, key management systems for distributing keys and all that this will increase in secrets You still need to do that This is just one extra knob That that that we added to keystone Uh As I said, uh, we have never we have not committed any of these extra enhancements to upstream and We are working on figuring out the Submitting blueprints and and code summits Uh to upstream and the reason why we want to do this is actually it's not just because it's cool because it's open source But the main thing is that we want to make sure that Open stack becomes a that's just standard set of apis for anything that is cloud related for instance Our kubernetes journey Is relying on open stack heavily and we want to make sure The code that we write to provision and manage kubernetes clusters on open stack Can work with standard apis and not does not require proprietary extensions that are epa specific or some other company specific That's the reason we want to we want to take this code out and and get some consensus in getting these features out I think that's my last slide Uh, we have I think ample time for a Q&A in about five minutes Thank you. Yeah, please go ahead So, um early on you mentioned that you had a global keystone So is is that a logically global in terms of how you manage the service catalog or is it actually a distributed? implementation and The second part of the question is that in the tokens you mentioned that obviously between the different availability zones That the tokens would get very large and I wasn't quite sure exactly what you did to to reduce that or how to manage the Um, the the size of the service catalogs is that were in the tokens or how you managed access to the data That was in the service catalogs and where they use endpoint filtering to To you know limit the size of those things to what people actually needed sure So the first question was about Is is the what does it mean by global keystone? So to take a step back we have this notion of azscope services and global services in our in our cloud And keystone is one of the global scoped services or the most services are azscope services When we say something global it is still distributed deployed in multiple availability zones independently managed But since keystone is stateful We may ensure there's a global replication and a global address address for the customer. So it is a distributed system Okay, and you manage the replication. We manage the replication through through galera at the bottom of the stack Okay, so data is so if I create a project Let's say it gets created on the on the az on the left side And then you might the read might go later on here and you would read it So the same projects and roles and everywhere exist if I go to horizon Which is the dashboard we use and I would see all my projects from everywhere Right, and do you expect all the same roles everywhere in every available? Yes, we expect the same roles everywhere Okay, so that because otherwise it becomes a mess and and Coming to the second question, which is how did you deal with the the catalog size with keystone? So we actually patched keystone as well as some of the python client libraries Uh patch keystone to remove the catalog completely From from token, right, which is easy and then we ran through several tests to see what breaks And then fixed patched the things that broke to not depend on the on the on the catalog So you did sort of like a lazy evaluation or a lazy look up for what you would need Absolutely sort of service cataloging. Absolutely, which I think is the right thing to do because yeah I mean You can always go back and ask a there's an api to get catalog You get it and use it instead of carrying it everywhere, which is pretty heavy. Yeah. Yeah. Okay. Cool. Thanks Yes, please I can't I don't have the breakdown of whether how much of his headless are or not I think we we actually we've Because we have the cloud is open for everybody and we ended up spanning Sometime not a whole lot to figure out who these users are This this happens because clients they get some code some live client library in java or python and they start using it without thinking of caching tokens and they're using tokens for certain duration and that was That continue continues to be one of the main reasons that the tokens are so many tokens get generated and they also use cases that are Shockly with sessions So you log in you do something and you log out So when you somebody logs in someone the same thing so That is another driver for No, these are ebay users we have Our keystone managers say Everybody in our company every developer every every PM every employee has can log into keystone and do things on On the cloud. So it's it's potentially thousands of users. I think when I last checked It was we had six seven thousand users in keystone and hundreds of thousands of projects Again, it depends on the policy. Yes for for some cases. Yes any other question. Thank you