So, this is just a little mini workshop preview, but I hope you walk away with some real hand and foot breathing knowledge that you can incorporate into your day-to-day life today. So my name is Junya and I love to breathe because it makes me feel fantastic and it lets me be very, very present and it also is one of the most healing things that I can do in my life, physically, emotionally, mentally, and spiritually. And I believe that 100 years from now this will be preventative medicine of the future. I became enamored with the katharik breath which is basically connecting your inhale and exhale and adding consciousness. So breathing consciously and when I was a medical anthropologist at Howard Medical School working with Dr. John Mack who is the founder of the psychiatric department, and I was able to sit on in his sessions that he did with people that had PTSD, there's some chairs right here, and also people that have had the incomplete experience of being abducted on spaceships. So as a medical anthropologist I was very happy to see that people that have these expansion experiences sometimes can get traumatized and he used katharik breathwork. He didn't use talk therapy, he didn't use hypnotherapy, he used katharik breathwork to help people come more into a center and kind of be in their life again and release their PTSD and I was amazed at that and that really made me go native, meaning that I didn't get abducted on a space ship or I don't recall it but I said you know this is what I really want to learn and I left academia and I started to teach katharik breathwork and now I have my own private practice in Worcester and Boston and it's life changing. So what happens is if you take a conscious breath rather than an unconscious breath is that the prana energy traveling on the breath will immediately come into your body with consciousness and highlight anything in your body that's not moving so much. So this is a higher frequency breath because you're breathing it consciously. So at night time you're also breathing connecting your inhale and exhale but what is missing? Consciousness. So adding consciousness to the breath is an absolute game changer. When you add consciousness to the breath within five minutes of breathing consciously your heart rate variability goes up meaning that the way your heart responds to external and internal circumstances is actually increased which is wonderful. So anybody shooting here for longevity this is the name of the game. So this is my breathwork doing this three times a day for five minutes with a count of five on the inhale five on the exhale we'll be practicing that in a little bit. So these are two workshops that I'm teaching coming up at Falls River Yoga Studio this Friday from six to eight and then on August second at Studio Zenith from three to five that's when you can have a full breathing session a full breathing cycle which is about 50 to 60 minutes long but today you'll have about three five minutes segments where you learn how to breathe and I just need to tune you in a little bit to that what you might experience. The first thing that you experience is feeling a little bit like a French water bottle au gaseuse which means you've got to feel all these bubbles in your system and this is really physiologically speaking and we call that in the katharic breath world tingling so any time you listen to a beautiful Beethoven sonata or you see a beautiful painting or you have really great sex or you will have a million dollars you will have this kind of tingling in your body because you're opening up in your breathing changes and you're connecting your breath and you're becoming conscious of your breath and you're becoming really alive and excited meaning you're going above the breathing threshold the breathing threshold is usually where we keep ourselves is this invisible divisive line that basically lets you breathe hardly next to nothing so you just barely survive so you go through life like this and then somebody will say why are you breathing so much and then you stop breathing even more which is not good and then there you go so that's what we usually do we don't we don't bring consciousness through our breath the only other beings on the planet that breathe consciously except for multidimensional beings like on the planet Sirius is the Sirian citations that breathe consciously all the time sort of like our citations in the ocean that are also conscious breathers dolphins and whales this is why people go swimming with them because literally your whole energy anatomy changes when you start swimming with dolphins because they're conscious breathers their brain never turns off and they're always somewhat breathing consciously so what happens first is again this front energy comes to the place in your body highlighting anything in your body that's kind of tight and not moving so much so anything that is energetically or physiologically or emotionally holding back gets high by this conscious breath and you will feel that when we practice this in a couple of minutes that suddenly like ooh I didn't know my neck was a little tight so suddenly you feel tingling in your neck or you have some digestive stuff immediately you might feel tingling in your digestive tract or in your kidneys or in your head or wherever it is that you experience tension and stress usually so this highlighting of the light force energy on the conscious breath means that it wants to dance with you and it wants to release whatever is holding so let it happen let this tingling happen throughout your body and you will experience also within five minutes your heart going into heart coherence so greater heart rate variability doesn't mean that your heart is nice and static people always say no my heart is peaceful and there's like it should be like like like this well like this is dead so you want things like this you want things like the tennis player going whoosh whoosh whoosh and every time you know with every inhale with every inhale the heart brings in the the sympathetic nervous system gets activated with every exhale the parasympathetic nervous system gets activated so it's wonderful in some way you stimulate your sympathetic nervous system in the other way you're stimulating your parasympathetic nervous system so actually the more the heart can respond to all type stimuli and inside stimuli the healthier you are the less stressed you are the more you are in a meditative centered state so that's great greater heart rate variability and you can reach that five minutes three times a day you have to do this exercise that we're doing today preferably in the morning before you wake up and you have your first cup of coffee so not before you wake up and you wake up and then don't do your to-do list and do this exercise it's nice to sit up straight with your spine you know erect because that way you are able to really inflate your lungs and your torso then before lunch before you have your lunch and then at night time before you sleep and if you feel like you're more anxious throughout the day do it more often right everybody we're going to do the first round and we're going to do it about five minutes and what we're going to do is you don't have to count much but basically you take a deep inhale into your belly and then bring it up to your upper chest the upper chest is like our lungs right and our lungs we use a third of our lungs it's just like our brain we use a third of our brain capacity we have these huge lungs with these alveoli like an upside down tree inside your being and if you really were to fake your lungs you would be it would be a blissful experience 24-7 so now what you're going to feel like because you are more bottom-driller breathing you're not used to really bring up the breath into the valley into the upper chest you might feel possibly a little dizzy but that's okay dizzy just means that there's more oxygen coming into your system and you're breathing out more carbon dioxide which is what you want the second medical physiological benefit is why are you breathing on carbon dioxide guess what it affects your blood acidity within five minutes of breathing like that you will turn from an acidic environment in terms of your blood acidity and all of your acidity in your being into an alkaline basic state which is anybody with acid reflux it's a no-brainer so you breathe like this more oxygen less carbon dioxide more alkalinity yeah and you can be relaxed have your legs uncrossed and what we're going to do is just take a deep inhale and relax on the exhale and we do this for about five minutes any questions before we start flying yes yeah it's good to have you know if you if you're cutting things off like that it's you know you're basically cutting off circulation so having your feet flat on the floor is wonderful you know spine erect is wonderful and then just take a deep inhale relaxing on the exhale and keep on doing it and if you get a little dizzy that's not a problem that's probably in relationship to your birth scenario so this work was in the 1950s called reburthing by Leonard Orr which was the first cathartic breathwork modality here on the planet although yogis have been doing it for centuries by bringing it to the west he brought it to the west and from that many different cathartic breathwork modalities came to the United States to Europe one of them is mine art of natural breathing holotrophic breathwork transformational breath vibration method you name it they're all very very similar if you go out there to find a practitioner all I ask you is that people have worked with this for at least five years because it's powerful work they'll have to know what the breath is doing when they work with you individually so nowadays it becomes like an exercise fat this is not an exercise but this is very powerful medicine that heals on deep emotional levels as well as physiological levels so it's it's we're just touching it and scratching the surface with our little exercises now but when you come for the breathwork in the workshops you will see the power of this application that you will go through a full breathing cycle yes I have a quick question is there anything we can do this wrong no no no and do we inhale through nose what we're going to do is it's not wrong to use the nose but it will just activate your upper energy vortexes what we want to do is go through the mouth because you get more air and through your mouth and so deep inhale through the mouth and then relaxing on the exhale so you basically dumping your exhale I'll show you and just to let you know you can't do it wrong this is the foundational breath if you are coming to me for a full breathing cycle and session your breath will go to 50 different breathing patterns so depending on what goes on inside you're in a landscape and emotions your breath will change depending on what goes on with your sensations in your body your breath will change depending on what goes on in the outside environment your breath will change it's kind of like your heart that's why you get greater heart rate variability when you're breathing like that yeah so it's not advisable to do this in a car or you're always walking around shopping at you know shawls or wherever you're shopping at because pretty soon you'll be feeling like you're walking on LSD you know it's a very powerful conscious kind of drug that you're dealing with when you're breathing like that and but for five minutes it's wonderful three times a day I can let you lose like this so do not try this on your own for one hour because it's like trying to fly a plane without a license you need to know yourself if you come to me for private session I have ten foundational private sessions on the breath therapist and it looks at your birth scenario it looks at your whole biography each each session is a different session by the end of those ten session I can let you lose and you can breathe on your own for the rest of your life because then you know but I have to watch you for about five times to see how you can optimize your breath how you're holding your breath what is your inhale and exhale doing because the way you breathe right now is the way you live your life when you change the way you breathe you change everything about your life absolutely everything your relationships your work everything yeah I forceps birth so I used to go through life very very unconsciously when I came to cathartic breath work with and I think five breathing session I breathed out all the chemical anesthesia that was left in my body from my mother taking huge amounts of drugs and her birth which is actually still lodged in our cellular memories that's why it's so important to talk to I was talking to central Vermont hospital a couple weeks ago with a big group of women that were in the birthing field and working with conscious birth so your birth scenario is still in you unconsciously and you can release that by working with this cathartic breath work which is absolutely wonderful and it will change your life yeah so now we're going to fly a little bit so what we're going to do is for first you're going to watch me please come in as quickly as you can because we're getting already into the experiential stuff so you there's a share right here all right perfect so first you're gonna watch me and remember this is only a foundational breath so you can't do it wrong because you're always breathing with relationship to what is going on in the outside environment and inside but for now you're using this foundational breath and I'm going to show you how to breathe this foundational breath when I go like this I want everybody to sort of copy me yeah so for this I can actually stand up so you can see me better and you can all remain sitting nobody has their legs crossed great put your hands maybe on your on your on your thighs and here we go so I'm going to start breathing into my belly into my upper chest deep inhale relax on the exhale and then sit down once I get going because I will start to feel a little bit more and livened so sitting helps here we go everybody all your lungs to be inflated yes you don't have to synchronize just go for it little bit more gentle man right here on the other chest go for it you are the one that can do it right and dump your exhale don't hold your exhale don't control it again as soon as your inhale is done you exhale and you pick up the inhale again that's right beautiful little more deep on the upper chest deeper deep on going in fairly soon beautiful little deeper on the inhale excellent open your arms little deeper little deeper go back into the breathing river little deeper take some effort that's right and you try to really yarn and he showed a little bit more effort on your inhale you really want to take a full inhale that's good good keep on going yes that's good even more on your inhale beautiful keep on going in painting all those long wings like an angel don't focus on your yarn you're oxygen so you want to have even more in a beautiful keep on going yes keep on going you can't say don't worry you're sitting in a chair yes four-head wrinkles right here yes little bit more little bit more in here lead back if you can look at me be back yes more in here more in here on the orange shirt keep on going for everyone this is one more minute and your heart will get get around heart rate will come into natural heart who here is keep on going don't stretch don't stretch the orange shirt keep on breathing is that you feel more meditated more centered through the mouth you might already have something going keep on going that's you keep on going yes don't stop good yes nice in the picture in the back more on the inhale more energy on the inhale yes so we're already still missing half a minute but just by this four and a half minutes everything has changed sympathetic and parasympathetic nervous system have changed they are much more equal your heart rate variability has become much greater there's more tingling in your body you probably perceive the colors much more intensely that's what you want the tingling energy is your ticket to health that means more oxygen more prana awesome so remember the tingles the prana energy goes first where you need it the most so head chest legs is probably where you needed the most if you do this for five more minutes you will feel your whole core start to vibrate and buzz and eventually the whole body will start to vibrate and release major amounts of whatever is stored in your tissue as whole back and tension so it's a huge healing process yes so the first five minutes of breathing like that your periphery is usually starting to tingle your hands and your feet give it five more minutes it's your lower arms your lower legs give it five more minutes it's the rest of your body everywhere vibration and tingling and people will also have states of bliss conscious bliss that they experiencing with this so it's a kind of modality although if you do have a complete experiences from the past usually half the room is laughing hysterically and the other half is crying so that's totally fine it's a cathartic process catharsis and greed means the breathing out of demons and dragons so that's wonderful it's a clearing of the whole energy and you do this three times a day your expansion in your upper chest will increase so your spaciousness in the upper chest where you're breathing where your lungs are will increase and you probably get rid of all the gunk and flamb and everything in your lungs so it's taken to health for you and yes the inhale is where the sympathetic nervous system gets activated where we are for Jane a little bit the exhale we're not efforting at all I have a lot of people that are long distance runners that I work with and they say oh my god I need to usually run 40 minutes to have my endorphins release in my brain like that to feel this high and they're getting it within 10 minutes and they're not doing anything just greening because when you're running and doing yoga you're bleeding away about 80% of your energy so this means you're going way above the breathing pressure very quickly because you're not doing any physical movement if you ever depressed this is great to do or you're feeling kind of low or whatever it's better than going for that sugar spec you just sit at your office desk and you do five minutes of this you'll feel a marked change in your whole consciousness your awareness everything where I like the drum that you're beating eventually when you're good drama you feel like the drum is beating you the breath will breathe you eventually and it becomes extremely effortless but that is a little while intercession yeah yeah wonderful yes robbing clean lane vibration absolutely and also a little of the same in my chest which is interesting because I've broken every bone in my chest yes over 20 years ago yeah so that's where it goes first yeah any injuries any kind of physiological accidents that you have left over remnants from cellulose the breath will go first there the conscious brother start to heal it even back injuries I have people come that have gone to acupuncture chiropractic everything to breathing sessions gone it's powerful physiologically as well as emotionally and spiritually yes yes and you know if you were to do this regularly yes you can if you were to do this regularly this is the ticket to into your brain and into your nervous system so do calm down your nervous system and to get you out of fight or flight or any kind of anxiety this is the ticket to it it's amazing yeah yeah that's that's why some of you feel it here as well because usually people with anxiety disorder that I see as private lines this is where it's at it is amazing it is amazing so in the five minutes you're scratching the surface now when you go longer than five minutes that was your question the gentleman back there you getting into emotional like psychospirical territory and that's wonderful as well but that's a whole different ballgame which is why you can come to these workshops and they're wonderful and I'll talk more in depth of what your experience will be when you do 450 minutes of this and it's also incredible so typically with people that hold their brother my husband is one of them you would always you know he's like a martial artist or you do that kind of chigo I'm like no no just relax just dump it just like skiing down the mountain and eventually say what are you telling me I'm doing it because you have that pattern of controlling the exhale and I was basically asking him to change a major pattern in his life that was related to relaxing and why is it possible to let life come to you and you don't always have to orchestrate every single minute of your life and you have a good cathartic breathing therapist after 10 sessions you're on your own and you have this for the rest of your life and it is a ticket to longevity because even myself I have so many emotional holdbacks you know I think oh I'm doing really great I'm everything is fine you know I'm just perfect you know and then I lie down for my breathing fashion and within 10 minutes like I'm balling my eyes out because we always operate on the surface kind of mask what we present to the outside world mentality we barely learn to check off in with our inner landscape so this is like an inner journey for you to discover like oh you know how like I didn't know I was doing that and and look at that I'm really sensitive over here and I'm seeing all these angels and guardians and spirit things that way you know so that's a nice nice benefit of the cathartic breakthrough it opens up levels of consciousness into the more deeper aspects of the cathartic breath emotional things will come up that are part of cellular memories from the past so our birth scenario can get triggered so you what you're feeling might not necessarily be what you're feeling right now it might be an incomplete experience coming up from the past to get released so when you're holding positions in yoga you're bleeding away about 80% of your energy because you're holding positions physically that's why we're lying down when we're lying down we're not moving unless involuntarily releasing things and you can fill yourself completely with 100% prana so incorporating in yoga practice probably not it's its own kind of modality yeah but nice thought your heart responds to the outside and stimulus the last thing you want is for your heart to not do these little skips and whatever it is doing every time it does skips and things like that it's like yay and then you sit down and breathe for five minutes and the reason we don't breathe is why do you think we don't breathe because we have we learn the first time we come as babies onto this planet and many of you were born in the 50s and 60s and possibly 40s and how do you come in as birth and then you start screaming right it's not the most wonderful thing not like the Hawaiian indigenous people birthing their babies in the ocean where the baby gets to like you know rest and take its own breath and umbilical cords get slowly dislodged you know when the when the pulsation stops and no trauma with the first breath but most of us have that and as a result of that transitioning scenario we get scared but in cathartic breath where you will release that you don't only do it two times a day or one time a day it's nice you'll have some nice effects but you really need to do it like brushing your teeth if you do this three times a day for five minutes this have all have an effect for the first three days for four hours afterwards you will feel more centered and present and alive and then for weeks after that so you do you keep on doing this for a month you'll have the effects longer and longer it's amazing yeah so there's a lot of involuntary movements that can happen at the beginning when you first start to clear your house yeah yes okay so I couldn't I can't stop yeah you can't stop I know you're still doing it that's great that means your body wants it yeah that means you're ready for it in your body wants it yes absolutely yes I'm just curious if you ever work with addicts in recovery absolutely absolutely yeah and it's it's amazing it's very very helpful because they get out of their personality and their personal kind of stuff and they get into the trans personal and the trans person means basically the realm of spirit and consciousness and when you are like a study stuff graph the psychiatrist that invented a holotrophic breathwork he worked with non rehabilitatable prisoners in California and he did catholic breathwork with them and within like two sessions or something they were like is there woodworking here do we have yoga what can we do to is a library and these are people that were completely uninterested and so it really works on the inside of your essence as well yeah yes so if you have more questions we go for another round we have 10 more minutes left and we go for any more questions before yes that's why it's literally a using kind of modality the the gentleman that I studied from Leonard or was termed as modality rebirthing way back 20 years ago he's now in his 80s he doesn't look one day over 60 and his energy is incredible he still teaches huge corporate catholic breathworks in Brazil all over the planet and he swears by this he gives himself a breathing session every day like once a day you know for an hour that's it and he's fabulous you know I'm we're all creatures of habit so I have to admit I do two breathing sessions a week but when when I hit an impasse either emotionally or physically in my life I had intense plantar fasciitis some years ago and I did a cold water breathing session and it took two cold water breathing sessions to breathe all the plantar fasciitis was gone that's usually six weeks cold water cold water there is in the 10 sessions there's a cold water breathing session where you are as submerged in the top with your head out breathing in cold water because it's extremely catalyzing and wonderful for your system and it's you breathe out any kind of late disease processes so it's a very powerful way of releasing any kind of physiological constrictions see bodies in cold water yes your body and your head is out leading and your breathing yeah that's in the 10 sessions that's not true for the workshop yeah so here we go again what can we say it's nice when you start this five three times a day for five minutes it's nice if you have a little affirmation so we can say right now I'm alive and I thrive till I'm five how is that that's a great affirmation for your body to do that before you start breathing in the five minutes or you can also say with every conscious breath I am extremely optimally healthy and alive yeah so you do one affirmation and you don't have to keep on doing that just do it once and then you breathe yeah so it sets you can tell somebody to open their eyes and do we need to have our eyes open when you are doing the 15 minutes no you don't and right now you don't either you don't have to your eyes open my tendency is for the five minutes when you have your eyes closed a lot of the internal thought processes start to happen yeah so when you keep your eyes open it's just better to just sense your breath feel your breath don't be intellectual about this just as you're breathing see and feel into all the sensations that come up in your body yeah and you can do it too yay so here we go we go for another five minutes that will be the second time just to let you know you might have a very different experience the second time round but if you still have tension in the same area as chances are very 90% that the breath will go there and start to tingle and vibrate you okay here we go so deep inhale relaxing on the exhale here we go everybody in there you can do that on your own speed but when your inhale is filling up your upper chest go for pick up the new inhale so don't have long gaps there's a little gap and a little gap to inhale in the exhale beautiful putting on the inhale bring your awareness into your inner body yes and just breathe normally again just become aware of what is tingling and what is not what is vibrating what is not yes that's nice slowing down breathing still now and then a deeper in here you can breathe from the top of your crown of your head and all of my energy anatomy is tingling the way I know that is by all these goosebumps on the outside and inside of my being goosebumps is wonderful you want goosebumps and those goosebumps will eventually translate into tingling throughout your whole being that's what you want this is your work rate right this is the way to live your life from a much more expanded state just within five minutes wow so amazing that's great good fabulous ladies and gents will go around again so I'm experiencing tingling in my upper arm tingling throughout my legs tillie tingling in my head and I feel pretty darn good our bodies are mirrors for our minds and emotions so you have this wonderful tools so about 80 to 85% of our physical symptoms are emotionally cost so we hold back our emotions all the time so there's very few venues for our modern society to get into a cathartic multi experiential kind of breathing release so it's it's wonderful to feel and feeling more healing translates more energy through laughter other people through crying other people through feeling angry you know so anything that has been put under the rug comes up from the rug fairly quickly so your connection between your implicit and explicit memory you unconscious and your conscious gets much more transparent which is what we want because that way you get healthy longer you don't have to carry around all these psychosomatic things that will eventually be expressed with your body that should be expressed with your emotions happiness at the same time but my rug is being with him and relaxation and tingling and happiness it's a great beautiful that's wonderful yeah that's your first right fabulous yeah I felt tingling further up in my legs and I also cut like a runner's crap and I felt pain in my neck and my chest yes so that happens when there is residual tightness and what happens like I said the graph highlights anything that is already sort of tight so it goes there and highlights if you were to breathe longer that would release yeah on every emotional mental physical and spiritual you say the dates again yes I have one is on August 4th Sunday at studio Zenith from 3 to 5 and the other one is this Friday at a Paul's River yoga studio beautiful space as well from 6 to 8 that's a north field north field falls route 12 and five minutes away from Markelia very close it's fabulous yeah please come and you can come to both what a concept you'll be levitating when I work with when I work with people that are above 70 you know normally you know some people that are not so much into exercise they can't lift up their arm for a long time when they start to do cathartic breath where they're lying down and suddenly their arms will lift off by themselves and start to levitate for the entire session without any kind of effort it was this midwife that was birthing her third child and her two children were around her her husband was behind her in a birthing tub she was pulling out the baby by herself the baby was breathing underwater and she disconnected the umbilical cord after 15 minutes the baby baby was breathing underwater come in here there was no crying there was no trauma involved so as a result of being born in gravity you know we have this fontanella up here on the top of our crown chakra which usually when you're not born through gravity but in water sticks open so there's a little bit of a soft spot here that the baby has which is our connection to the cosmos and when you start to do breath work and you release your birth scenario all the bones in your head and in your body will start to reconfigure themselves and become more pliable and subtle again it's pretty cool and I have two offices one in Worcester and one in Boston so if you need more private work because you're dealing with it some kind of issue that might not be resolved in a group reading session we can come for private sessions as well


Hello, good morning and welcome. Very pleased to see people in person as opposed to on the other side of some amorphous internet screen. We're gonna talk about the software factory today, some supply chain fun, and yeah, thank you for coming to my talk in advance. So, Cuban let's supply chain security, the software factory, AKA who is afraid of the big bad supply chain. Hi, I'm Andy, I'm from Control Plane. We are a cloud native security consultancy. We have audit, pentest, and engineering capabilities, and I have a wonderful team. I've done lots of development, that's kind of where the background comes from. Security is a steep passion, and operations of course is necessary as the strong baseline on which to build solid security engineering practices. I am very lucky to have had the opportunity to write sans sec 584, attacking and defending containers and Kubernetes. With my preeminent co-author, Mr. Michael Hasenblas, I have written the book Hacking Kubernetes. It has gone into print today. It will be available on the ebook by the end of the week. It's already available on Early Access, and yeah, huge thanks to Michael. It is a step-by-step guide to attacking, defending, and ultimately securely deploying Kubernetes for regulated environments and everywhere else. And today, we are going to talk about the supply chain. What is it? Why is it a problem? Then we will look concretely at how to attack a couple of different supply chains, specifically at install time for a package, and secondarily, if I can get malicious code running in your Kubernetes clusters, what can I do? We will look at signing. Signing is the fated mechanism by which to fix all these things. Signing is easy, verification is hard, and finally, draw everything together with the software factory pattern. The panacea, potentially not, but certainly a useful advancement in our journey. There has been so much chat about the supply chain already at KubeCon. There was a supply chain security con on Monday. Six security, or tag security, as they are now, ran the security day yesterday. And there's so much going on in the ecosystem right now. We're really moving forward after a difficult, I guess, kind of a few years of stasis as we build out new package managers and kind of since OCI existed. So there is a lot here. I will be referencing other talks throughout. So what is a supply chain? It is anything that we depend upon. In a military context, this could be the individual nuts and bolts that go into your aircraft carriers. You're collectively, pharmaceutically, it is how we get drugs from a factory into a person without them dying from some sort of contamination on the way, same for food. Manufacturing is your kind of just-in-time Toyota-style manufacturing and software. Software is built of other pieces of software, and each of them has an independent supply chain. As a consumer, it is beyond our direct control. We have to have that trust in the previous steps. And finally, it is reliant on trust, which is never a solid thing on which to base, and so something we need to look at in depth. So for a software supply chain, any code that ends up running in production is part of the supply chain. What could possibly go wrong? We ask ourselves potentially a lot. We rely upon our producers to have done things sensibly, and we can't necessarily always validate those things that they have done. So as we move into this post bare metal, sort of cloud-native renaissance future, everything is defined as software that extends from, of course, the applications that have always been software, but the infrastructure is now programmable. Our security is now defined, and the same with policy as code. It's reproducible, it's statically analyzable, and this is really useful for us because it ensures reproducibility. It gives us the advantage of being able to test things in all sorts of different dimensions and domains. And it means that with consistency, we can apply the same style and type of controls to each of those things. So static analysis and linting is a fine example. In the Kubernetes world, everything is declarative, and therefore we can define what a good baseline state looks like and test it. So from a software factory perspective, we're potentially building anything and everything software. What could that be? Well, various different examples here. Artifacts, the actual deployment into clouds that we're doing into some of those platforms, all the way through infrastructure, and especially our security and NFRs. Importantly, if we are going to use full build automation for all of these things, which of course we should do, segregation of the build servers becomes important because the privilege afforded to a security-based build server or perhaps something that's going and rotating certificates in networking appliances, et cetera, that should probably be so isolated, segregated, and on its own managed network that it's not visible to a lot of the rest of the organization. So supply chain, everything is software. We compose software of other pieces of software and we rely upon our producers for safety. This is correct and nonviolent in the classic sense. What does that mean? Well, if we have a supply chain here with Bob in the middle, Bob, as you see, delivers Alice's code to Charlie. If Bob drops malware and implant some malicious software which does not perform the highest and best use of the infrastructure that it's on, perhaps, it's very difficult to detect. And this process of malicious supply chain insertion is something that we've seen happen more and more and increasingly becomes the new attack surface. Supply chains are very long and difficult to secure because not all of the events occurring in the supply chain are even visible to us. And when we say the new software security frontier, we're actually talking back to reflections on trusting trust, to the seminal paper on malicious compilers that build malware into that outputs. So there we are. We must essentially trust everything in a supply chain and this is where things get really difficult because if we don't trust each and every step, that's the insertion point at which stage potentially some malicious code is inserted into a compiled artifact. Very difficult to detect because you have to, perhaps reverse engineer or decompile the thing in order to understand if there's a malicious side effect from the implant, as we'll call it. There we go. The reflection on trusting trust, Mr. Thompson himself. Okay, so let's look at how to attack a supply chain. The book features an archetypal eight-bit adversary. This is Captain Hashtag and his many guises. This malicious adversary wants to run his code in our production systems. It's really that simple. It doesn't matter if that's crypto mining or popping a reverse shell, which we'll look at in a moment. Or in fact, just adding ourselves or adding our infrastructure to a command and control network. So we can use that at a later point, perhaps bounce other malicious traffic through it, we use it for something like a watering hole attack where you surface or you host malicious code on somebody else's infrastructure and so it becomes essentially a wide and recursive game. What has happened recently in the danger zone, we have had the Reval Gang attack the colonial pipeline for a provider. We've seen SolarWinds, which is kind of the canonical example at this point because the impact was so wide. When we have a highly privileged piece of software like a server monitoring agent or observability and security, those kind of tools generally need a lot of access to the underlying system. That's because necessarily they're performing a task on behalf of humans. And instead of having a human go in, kind of check the process table every so often, we have something else to do that monitoring for us. That kind of highly privileged software, if attacked, of course, then has complete control of the underlying system and can perform sort of behavioral obfuscation and kind of hide what it's actually doing. In the SolarWinds case, that was by using very similar debug style out network messages to the underlying product but just to a maliciously hosted DNS server and running command and control that way. The network effect of this, because one provider is attacked and that piece of software is installed in 50, 100, 1,000 places, it becomes a huge amplification of maliciousness perhaps. What else have we seen? CodeCov, that was attacking a CI build. And the point here as SolarWinds was, is that CI is highly privileged and therefore the software factory makes some sense as I will attempt to convince you of. Notably here, the last one as well, XcodeGhost was a concrete implementation of the reflections on the trusting trust issue which was a compiler that, it was a backdoor version of Xcode and it would compile artifacts with a command and control botnet client in it. So anybody who compiled an artifact with this and distributed it was then putting their consumers onto a botnet inadvertently. Tag security, one of my favorite places to hang out, has this useful catalog of supply chain compromises. The groups are a lot of the attacks that we've seen in the past years into Caspers. As we can see, source code is the preeminent attack path here. That means getting someone else's code into, well, getting malicious code into somebody else's repository, but hot on its heels, developer tooling. We'll look at how this works with a demo in a bit. Publishing infrastructure. At that point, of course, this is our CI CD systems. This might be, well, in fact, the next group, trust and signing as well. Getting into the publishing infrastructure and either changing the source code just before it's built. That was the SolarWinds style attack. It becomes very difficult to determine what occurred there because the compiler takes in trusted inputs on the assumption that the build server is secure. When we consider what a build server does, it's remote code execution as a service. It's running on behalf of developers in order to save them from the job of manually packaging their bits and shuffling them off somewhere else. It's necessarily highly privileged. Therein lies the attraction for an attacker. When we look at trust and signing, often that is also a function of the build server. Those keys will be available or there'll be a signing endpoint that the build server has permission to push artifacts to and receive signatures in return like a KMS system. Again, it's the process of being on the build server and in control of its behaviors that opens up these types of attacks. And of course, we can chain them together. Negligence makes an appearance. Notably, that's for a PyPy typoscoting attack. PyPy is the process of taking something like event stream with a hyphen in the middle, copying that package to event stream without the hyphen. And when developers are happily just manually defining their dependencies on the command line, both of them resolve. And the attacker keeps the malicious typoscotted secondary package up to date and then at some point decides once it's got 100,000 installs a week to add their own piece of malicious code, maybe as a transitive dependency. So it's not clear to the original package and therein lie the problems. Fortunately, the manifestations that we've seen of this so far are generally looking for crypto wallets. If they start looking for SSH keys and GPG keys, your AWS credentials, then we might see these kind of things taken a little bit more seriously. So how do we attack? Well, we can get into a developer's machine. The end user device, if it has a specific endpoint protection, may detect some of this, probably not. It's legitimate that we're using our credentials. Getting into the source repository, well, that makes some sense. It does leave a trail, of course, because we have everything as a merkle tree in Git and that means that we can't rewrite that history unless we're forced pushing. So once the attack is in there, as long as the repository has suitable, sensible branch protections, we'll be able to detect it at a later stage. The build infrastructure, of course, we've been talking about this. Hosted build infrastructure still suffers the same problems. It's a question of access and we'll look at how to detect compromises of build infrastructure as we progress or we go into the trusted supply chain. We move backwards from what the developers doing in their repository and we say, okay, well, you're putting in this dependency. I'll attack that dependency or that dependency is pulling in yet another dependency. That's where we'll start. Any of these things can run code and if we consider where we might want to put that code, it doesn't matter. We can put it into the test suite. A test suite while it may be exercising the underlying code also has the ability to just dump environment variables, read things from disk, push off the DNS servers. We've also got the potential for command control even if we're restricting what we allow into our organization, places like GitHub and Docker Hub, image registries, we can publish to those as well. So even running air gap to offline infrastructure poses some sort of problem without being very strict and I say air gap in the cloud sense, very strict and doing things like running split horizon DNS. So really just keeping this code out of production is the first line of defense. Finally, of course, we can actually attack for runtime environment, which is to say, well, everybody is using, for example, Debian or Ubuntu, let's attack one of the common packages in there. Fortunately, that is significantly more difficult because we have a lot more eyes on that code. Open source has a variance of how many people are taking the supply chain security seriously and fortunately, there's been a lot of effort put into things like reproducible builds and of course, the fact that there are a lot of trusted maintainers who are known individuals in those domains. So in sort of order of difficulty, it's certainly the most difficult. We have had Salsa released recently which is a supply chain security framework. It does base a lot of its assumptions on the fact that your build server is not already compromised. If it is, a lot of these things fall down, but this is an example of various places you can attack a build. Obviously, if we bypass the code review or we don't have four eyes, as in a secondary individual merging code, there's potential for any old junk to be committed. We can compromise source control. Of course, again, we're leaving some evidence for what we've done there. Modified after source control, but that's a bit more interesting. That's our SolarWinds style attack. Compromise the build platform. Again, we're in a very difficult situation when trusted infrastructure is compromised. Bad dependencies, yes, bypassing CIC deals together. So just pushing straight into a package registry. Arguably you could do that by getting onto the build server and exploiting those credentials. You generally need a network route to do that, of course. And yeah, bypassing, compromising and bad packages. Okay, so let's put some meat on these bones. If we have an application dependency that we install from the internet onto our device in the process of building software, perfectly legitimate use, we can potentially have that run malware. And I'll give you a quick example here. Let me see, game over approaching. So, how are we doing? Let's make that simpler. Right, so what we've got here is an MPM package. And as you can see in the package itself, it's an MPM malicious implant example and we have this marvelous pre-install hook. This means that before the package does anything, it runs arbitrary code. Who's looking after that code when it's pushed into MPM? It's not us, that's for sure. So hypothetically, we're just pulling a package, especially if we're looking at something that's been typosquotted, we might expect this to be legitimate. And we'll just do an MPM install in our local directory. And this is my example script. What can we do? Well, we've got the permissions of the user running the script here. These are, I mean, yes, we could do a denial of wallet attack on someone's laptop, that's probably not very sensible, but these are bits of credentials, truncated bits and credentials for my SSH directory and my cloud providers. And this is a very real concern. Operations engineers may have innumerable different Kubernetes clusters listed in their Kube config. So this is a very difficult thing to protect against. There's no malware detection, there's no antivirus that will stop and install performing local file system actions. That's the point, that's what it's there to do. So that is the first attempt. What can we actually do here? Well, 2FA really is the defense. There's a reason that we put passwords and things, that we have Yubiquis and we have physical auth tokens, because otherwise these things are very easy to exfiltrate. Plain text credentials, yes, of course. Crypto wallets really are the main target of all of these attacks at the moment. So if you have money in them, I'm sure you know how to look after them and air gap developments. Okay, let's look at a different demo now in Kubernetes itself. So the principle here is that I, as an attacker, have managed to get you to run something in production that contains my code. There's a few ways to do this. It could be an Easter egg style attack where it requires some form of trigger, maybe that's the time and date, maybe it's an identifier in the cluster itself. And the idea is that I sit on the internet with an open port that's linked through to my machine. I get the malicious image, and actually there's a wonderful way to do this with an app called DockerScan, that will trojanize applications just by messing with the LD preload. So you can't even see the thing happening in the container itself. In the containers file system startup, it's metadata in the OCI image. And so what this does is when the container starts, it fires a reverse shell, and it's called a reverse shell because you're going back to an attacker controlled endpoint from inside the infrastructure back out. So it punches through firewalls of course, because if you have internet access, you're just going to resolve a host and port combination. And then I'm listening on the other end. Let's have a look at how this works. In order to get the reverse shell, this is a prayer to the wifi gods, incidentally. In order to get the reverse shell, we use something called ngrok, which is just free TCP forwarding. So that's opening a tunnel. What we've got here is a local listener. So that's just running Ncat here locally. And that won't do anything until we have done this. So what we're going to do here is just create a pod. That pod is running this reverse shell to the resolved IP of the ngrok tunnel that we've just opened. This is the joy of having bash in your containers, because you've got this virtual dev TCP endpoint that we can use for nefarious activities such as this. Then we do a dynamic rewrite. So let's enable hostpids. Let's make ourselves privileged. And with those two things, we can either remount the host file system into the container, or we can nsenter the host namespaces. And let's, obviously in this situation, I am privileged and that I already have the capacity to very slowly potentially deploy to the cluster. Let's see if that actually does everything. Yes, eventually. Okay, so let's run this. It will spit out the YAML that it runs as well. And you can see because this is a public IP, people are scanning this range and somebody's just tried to connect to my laptop. Oh, wonderful. And terminated this command doesn't look good. Okay, so that's halfway there because there's new lines, nice. There we go. So what have we done? We've just dynamically created a reverse shell to the endpoint that we've created here. We have lubbed a privileged security context in and enabled hostpids. And there we go, there's the reverse shell. So what does this mean? Well, I'm now inside a container in your infrastructure because you ran a thing that I hid a backdoor in, essentially. And from here, of course, we've got the canonical what is available. Let's map, well, we know that we're, we know that we're in a privileged container because dev is unmasked. We can see all the things in here. And because we can use DF to see where Etsy host is mounted in by the container runtime, that's leaked the name of the underlying disk. And then we can remount that into, whoops, it's a daisy. Draughts. Okay, I'm just gonna do that again for the sake of actually finishing that demo because I managed to close the window. So if I just delete that deployment and then rerun the shell catcher. So that's now opening another public IP and port combination. Then I'll rerun this and I expect that also to, there we go. And that then fires this. Okay, so as we were, we can see, let's remount this into amount endpoint. And then we can see, so that's the host file system. And from here, we can do whatever we like. We can go and exfiltrate thing. We can pull the authorized key, well, we can pull any private keys that are sat in the host file system. We can add our own keys into authorized keys if we want to get there.  It's game over for that node. Without node authorization, it's game over for the cluster. And if there are any privileged workload integrations, it might be game over for the cloud account. Okay, so that's what happened. We went outbound to the developers, sorry, to the, so from my machine, I created that public socket. I ran the implant, which then connected back to it. And then I've got essentially a command control session, a reverse shell into the victim. The point here is that we do not want, under any circumstances, that to happen. There are ways around this. We've got things like Trivi to scan our images, which should prevent some of these things. Of course, we need somebody to detect a malicious image in the first place. Obviously we want security context. Let's build time behavioral analysis that we can do. And the EBPF, of course, is the buzzword and the thing that will help us to do that. Okay, so let's move on into the last section of the software factory, looking at policy and attestation. As we've said, signing is the easy part. Verification is more difficult. Mike and Tim from Citibank did a great demo, yes, the old Monday actually, a supply chain security con with a modern implementation of the reflections on trusting trust attack that is going into the build server and swapping things out. And looking at how we can use cosine, which is part of the stick store suite of tools to protect against that. Yes, and that demo is, there we go, Sloan's loading, that demo is available. I think the videos for that will be out in a couple of weeks and well worth a watch. Okay, so looking at all those problems, how do we fix them? Signing is the way. We take a public and private key pair, we use some data and we create a signature that can then be revalidated at related dates with the public key. In terms of build server attestation and security, we can also sign each individual build step. Now this gets difficult because we need to know that the inputs and the outputs stay consistent. If we're performing a transpilation or compilation step in the middle, then we're just signing the fact that a build step occurred. This is better than nothing, but still there are constraints to what you can do. InToto is the facto tool to do this. It's integrated and detect on chains at this point and there's a lot of work ongoing in there as well. We can also sign container images. So we've got those individual signatures for the build stages that creates an artifact. That artifact is then trusted in inverted commas and we can then go and sign the thing. So again, we can revalidate that at a later date and six-door and notary v2 are the emergent forerunners in this space to effectively sign our artifacts. Recall as a transparency log operates in the same way as the let's encrypt style of certificate transparency log where all our metadata is put somewhere public so that anybody can revalidate it at the later stage and be sure that it was us doing the thing to the artifact. There's all sorts of different parts of six-door. The maintainers have just started a company around this as well. They have a booth here somewhere. They are called Chain Guard and Well Worth Conversation. And I've got a quote from Mike himself here. Software does not compromise itself. It's humans that are the problem and if companies don't publicly provide transparency into what is inside their compiled artifact, so what happened in the build? This is the software bill of materials that again, there is a lot of conversation about this week. If, I mean, perhaps it's the one I need to say, but if you've got nothing to hide, you've got nothing to fear or something around that. Ultimately, we want to know if somebody ships us a binary artifact with a compromised packaging because we want to upgrade that when there's a zero-day released for a dependency that's packaged and deployed in our systems, we deserve to know so we can take remediative action. Okay, so underpinning all of these things is a question of identity. Spliffy and other CNCF projects is ephemeral workload identity. This gives us, it signs a certificate containing metadata about a process. And with a very short expiration, that can be used as the root of trust of signing. It can be used as an identity. Istio uses this concept for mutual TLS for workload identity. And it's incredibly powerful. All of these projects are kind of being smushed together in this concept of a software factory in order to give us, and in Toto Golang is, again, another integration in order to give us this kind of end-to-end signing. And this takes us to the software factory. So what is this? It is building pipelines that build other pipelines so that our DevOps is strong. That is Bertha, the 1980s children's TV show in the UK. And it means that we have a strong baseline of DevOps skills, if you like, and the ability to stand up new infrastructure very quickly, aggressive automation, and it welcomes signing approaches. So there's lots of different moving parts. It is a large, complex, not intractable problem with a lot of different organizations working to deliver a sort of canonical implementation. The Department of Defense is one of those organizations. They have built a reference design. It doesn't come with an implementation. It's a white paper, so a control plane and colleagues at Citibank and the tax security supply chain working group are looking to build out a concrete implementation based upon these things. And of course, underpinning everything is this concept of rigorous automation. The reference architecture, I apologize for the slow image loading on these. Okay, so what we're looking at here is a subdivision of different trust domains and in the bottom corner, we've got the source control and in the bottom green box, we see an identity attester that is a privileged process that is looking at metadata about processes running on the same system in order to uniquely identify it, attest to its identity and then provide that as the root of identity with which to mint a certificate. I'm sure there's a nice image there. Okay, so the trick here, oh, all right, so just to roll back slightly. So different views on the software factory architecture here. What we're looking at here is a Kubernetes system running Tecton, the distributed build system that's actually underpinning Jenkins X2, I think they've moved onto it. There is an assumption here that the cluster is secured, that the infrastructure, that the SREs, that people with access to it, it's all locked down. Once that assumption is valid, then we see we have Tecton here which is able to perform these individual task runs which are our build steps. Tecton chains ensures that the steps are run, generates that signature and pushes it out to the signature store and recall. So again, that's the public transparency log and an evidence lake of some description. And then we see we have also got our signing key in order to get that S-vid. And at the top we have Spire, which is that workload identity, it's that dynamic attestation which mints certificates for us to use in signing. None of this solves the problem of compromised build infrastructure. So how do we fix malicious SREs or underlying maybe the supply chain attack against our hosting provider? The trick is to run it twice in different places. This is already done by the Intoto project which supports, well, Intoto supports this. This is how our operating systems build packages, globally distributed builds. The idea being if one of those builds is compromised and we have reproducibility for all the artifacts that we build, we compare the hashes and if the hashes don't line up, something's changed. That might be non-determinism in the build, that might be the introduction of temporal data or change of locale so things are ordered differently on disk, they go into a compressed artifact and they have a different order and so it's a different hash. But on the assumption that those things are normalized and we actually have full reproducibility of the artifacts that we build, this is the de facto mechanism by which to detect compromised build infrastructure. Going all the way back to the software factory pattern, the software factory should be able to build itself, it should be able to recover from disaster effectively and it should be able to build other types of pipeline very effectively as well. Once that level of automation and sort of rigor has been achieved, this becomes a natural extension. Up until that point, there is a lot of work, it's difficult to front load this kind of effort and I'm not gonna try and say that it's not but once we have that solid baseline, the evidence lake becomes a comparative place where we can essentially detect signals of compromise in a way that's very difficult to do otherwise as we've seen. The six store group have put together this and Dan Lawrence is here as well, put together an excellent white paper if you'd like to read more on that. That is the end, that is Captain Hashjack and thank you very much for your attention.


Thank you. Hi everyone I'm Philippo and my here with Tomasso my friend and partner We came from Italy and we are very excited to be here because this is our first blender conference and you know I'm on this stage and it's enough Today we will talk about architecture visualization the process behind an office project so we'll explore the connection between blender and other softwares and why we use blender and Explore so the relation that we have with our partners architects designers and engineers and we want to show you some of our renders compared to Some photos of the real building. I mean in the real world So first a few words about us We are both for freelancer the artist with different background Tomasso is a graphic designer and I'm an interior designer in 2021-2022 we joined this studio both a patron and partners of group of building an Italian architectural studio working in Italy between two in Milan and in China as well and There with the studio. We had the opportunity to make our first office project that was Uptown to you know, we made the first render for uptown in 2021 and Since then as you can see we made many projects many outfits projects with the studio mentioned before and with other clients At the beginning many people obviously ask that's why we use blender and not all the common software for Visualization so we had many reasons and I think you know what for example blender is free open source And it is a great community. Maybe the greatest. I hope so A free software is a great factor not only for professionals But also for students or beginners who just wanted to learn something about a 3d graphic Open source. You know better than me. I don't have to say anything Community is one of the most important point because I see community like a bridge between us between artists blender artist and I know that Every time somewhere in the world. There is someone like me ready to give me advice feedback or just support and it's amazing Blender has a huge community and we are very grateful to all the people make it possible. I mean I think about all Places where we can share our artworks like a better artist or Blender Italia and so on Blender is an only one software so we can do everything with Blender, you know With other industry standard software We need at least two softwares to complete the job with Blender This is not true of course or sometimes I prefer to use something else to a specific work For example Photoshop for post-production or the venture is all for editing video But if I want I can do everything with the same software with Blender Blender is perfectly custom-is-able Yes Blender is open source as I said before but the most simply we can modify Blender with add-ons. We had many add-ons too many add-ons to Create the perfect tool for our specific job and I think I fall in love with all add-ons creators Thank you for your work So you know something about us, you know something About why we choose Blender for architectural visualization now let's start with the project we want to show you We divided the presentation in three parts The first one is about our first project uptown with the comparison between renders and the photos The second part is about our first full CGI scene and in the third part we want to show you we use two Projects to explain how we start from rendering to complete the job with other communication services So let's begin with the first uptown is a residential project located in the twin hills in Italy then the design of the building start in 2019 we made the first render in 2021 and Now the construction of the buildings is almost finished so we can see our render come to life and it's very fantastic we made exterior views and interiors with 11 whole apartments and when we Started the project we had this Nothing only stones rubbles and dust now seriously architects gave us to the drawing or 3d be model mood references and material samples specially material samples are very important because architects and designer gave a great importance to The aspect of the color the design in general of the building of course so we needed to recreate Materials perfectly we take care about the colors textures and how the samples react to the light in order to recreate materials in the best way and This year when we saw for the the first time The photos of the building we were quite happy because we think we did we did it in the right way This is the first render we made in 2021 the general render and below the the photo Took on September. Thank you and as you can see in your end there are a lot of post-production because at the time We had not powerful computer. We had not Experiencing huge scene management or in this kind of world so we After we tried our best and after uptown We improved our skills and techniques in architectural visualization and we set ourselves a target that was a full CGI scene So one year later we arrived to the next project That's very got the 17 or 24 Always a residential project in Italy with a beautiful C view You see below we made always exteriors and interiors and this time we made also two animations for this project we split the workflow between me and Tom Maso I Worked on the main building and Tom Maso worked on the environment the hill behind the building near houses streets and so on About the main building I started modeling From our 3d beam model making adjustments and adding details I worked not only close to the building but also on the place in front of it the pool private gardens underground box is and Making views of all of it for architects During the process we I use I used some blender tools very useful for us like Asset browser we use it especially to import furniture in interiors and it is there a great tool to organize your 3d stuff your 3d assets in general and We think that it can increase your speed of creating a scene other tool very important our light groups we introduce in the scene as Our lamps or point lamps as objects with emissive material and we match them so in compositing we have the best control for any single light in the scene and We we used to create at least three different light versions of the same render you can see in the video and That's it now. I'm finished my presentation and it's up to Tommy So thanks, Philippo for the introduction as the video behind me is finishing two quick words about me as Philippo said I'm a graphic designer and a freelancer 3d artist. I joined the both a patron and partners studio with the Philippo and as Philippo said Varigotti was our first attempt to do a full CGI scene in order to be able to Play freely with the cameras and choose the best angles for all the All the renders so as Philippo said before for this project. I was in charge for the environment part of the scene and Surrounding our main building. There are two Hold houses that we needed to recreate in order to have a full CGI scene Actually, we never went to Varigotti. We weren't able to inspect the place in real life So we we used what we had we had photos Luckily, there's a photographer that's collaborating with the studio.  I think many of you already know it or already used it. It's a blender. G's I don't I don't want to dive deep Inside the technical stuff of a blender G's but you can extrapolate the height data from satellite and Yes, so we imported the the hill behind the project for the shading part. We made a simple Mixed material using a PBR sets of texture and then we scattered some trees and plants Have the hill We used a vintage system because we use the particle system drive By weight paint at the time we were a bit scared about geometry nodes. So don't judge us and Then for the shading part of the to surrounding buildings We wanted them to feel a bit more aged than our main building because you know there are there since quite a lot of time and So we used a lot of decals in order to emulate leaks and the damaged part of the walls and to Give them a more aged feeling and that lead us to be able to create The shots that we want in the Exterior and this lead us to the last part of our presentation we had two more projects that we want to show you and With these two project we want to Show you what we can do that can go beyond some simple exterior or interior renders that can complete an architectural project the first of the two last project is Bella Vista this is another residential project located in the Turin Hills As you can see in the render behind me This is a quite particular layout for this project once it was a restaurant with two separate structures and in the future There will be two separate and Independent houses as you can see in the render one with a more modern style and one with a more contemporary style and Following the same schemes of our project of other projects. We made exterior and interior views Modeling the whole project following cut drawings and For this project we were able to inspect the the real-life location. So we were able to took some photos. We Touched the grass of the real location and we were able to recreate it In the best way and with the client we decided to take a little step further with this project because the client needed a Branding part for this project because he wanted the project to have a bold personality so we came up with the logo Bella Vista and At that point we came back to Blender To do some render mock-ups of the printing and commercial stuff that we were designing So we were able to show the clients the The printing stuff before they were actually printed out Clients was happy. So we were happy to last but not least The last project we want to show you is garden in town. This is another project developed with the buffer petron and partner studio This one is located in Milan As before we made the exterior and interior views modeling some whole apartments inside the Complex, this is a quite huge residential complex located in Milan and as you can see behind me we made Exterior and interior views but at one point our boss came to us and asked if it was possible to try to push the project a bit further and Try to create some kind of interactive experience with the project To let the architects and maybe some clients Let them explore the project. So at that point we put our hands inside the Unreal Engine 5 and At that point Blender became our asset drawer where we came back to Blender to make adjustments to optimize the 3d meshes in order to Get them ready to be imported inside the Unreal Engine and then we start to make some kind of experiments following things that we saw online Some kind of furniture configurators or interactive experience with an architectural project and so with these experiments we We were trying to recreate something that we we saw online and Yeah, I think that we nailed it a bit and So at this point I think we are Finishing our presentation and currently running out of time. So as some renders Playing behind me, we wanted to say a huge thank you to everybody that came here today We hope that you find our presentation enjoyable We want to thank you the Blender Foundation for these incredible events and last but not least a huge Thank you to our studio the Buffer Petronian Partners studio that Let us work on this beautiful project and let us be here today. So Thank you everybody