it's got to change. It's got to change. Yeah, the big question is, is Joe Biden the right white man to do that? I don't know what turns my stomach more.  I don't know about you, but I would like to choose my president based on their ability to do the job, not their skin color or gender. First of all, what's wrong with white culture?  It appears to just be a broadly generalized stereotype. Correct me if I'm wrong, but I'm pretty sure that the jobs that these women are currently doing were built by white men. The technology they're using all invented by white men. I really hate getting into this because the truth is it's a lot of different people to help build these institutions, but leading them were white men. Sure, there's white men throughout history who have done a lot of evil, but conversely, there's a lot of good that has been done by white men. I'm not making an argument that white men or white people are superior, or anything like that.  This all really just comes down to the principle that you're not supposed to judge people based on their skin color or their gender. This appears to be yet another and a long line of standards being set by the left that apply exclusively to white people. They don't set these standards for any other group of people. For example, so-called cultural appropriation is only ever enforced against whites. Well, it's really interesting because he talked about Anita Hill and how he could have done more, but this is years after. So this delayed apology is a little suspect. So apparently they're talking about sexual assault. I'm confused.     What I can't find is a per capita breakdown on those statistics. If anybody could provide them and post them in the comments, I'd appreciate it. The thing is, the raw numbers are likely to show white males as being the top perpetrators simply because they are the majority in the country. However, if you break that number down based on the per capita representation in the country, I'm guessing that you're going to find white males are underrepresented in those crimes. Why do I say that? Because if you look at the raw crime data, it looks like white males are committing the vast majority of crime in the country, but when you break that down per capita based on their representation, you find that it's actually black males committing over half of all violent crime despite only being 6% of the country. Why isn't anybody asking black culture to change? And in fact, anybody that I've ever seen suggests that gets attacked as a racist. And let me reiterate, in case anybody's confused, I'm not saying this as an attack on black people in this country. I'm only pointing it out because it demonstrates the media's manipulation of data. Actually, I agree with Joan. I can't tell you how much pressure was always put for me to go above and beyond, and I always had to rise to the occasion.  Everyone struggles.  Being a white male didn't stop YouTube from demonetizing my channel and taking away my main source of revenue. She says she had to do quote a lot more and quote work twice as hard based on what measure. It sounds to me like she's just making broad generalizations based on skin color, which I was always taught is wrong. In today's Democrat Party, it's not only acceptable, but it's the bedrock of their increasingly extremist ideology. They don't like white people, and they most definitely do not like white men. You've got Joe Biden as the white grandfather in all of this, the white man saying it's a white man's culture. Okay, it's got to change. I have an idea for how he can change it. Don't run. Hey, I just got a great idea. Why doesn't the white colorless Joan Walsh step down and give her position to a beautiful black woman? What better way to change white woman culture? In fact, I'm going to go ahead and ask her right now.  Would it be acceptable to tell a black man that he shouldn't be running for president based on his skin color? Of course not, but leftists aren't exactly known for their consistency. And his treatment of Anita Hill will remain a huge issue if he does run. Questioning Anita Hill after she accused Clarence Thomas of sexually harassing her? Ah, I see. It's the media trying to rewrite history again. During the confirmation hearings for Supreme Court Justice Clarence Thomas, Anita Hill came forward with sexual harassment claims. Her only evidence at the time was a polygraph test that she herself commissioned. Sound familiar? Other than that, she presented nothing to back up her claims. The outrage seems to be that she wasn't just instantly believed and that anybody questioned her story at all. They claimed that Anita Hill's reputation was under attack, but isn't that exactly what was happening to Clarence Thomas? Did Joe Biden not have a duty to ask her tough questions and not just accept her claims blindly? Her only witness was a California lower court judge who claimed that Anita Hill told her about the harassment. However, it was found that she was lying. The judge claimed to have been in DC when Anita Hill told her about the alleged harassment, but it turned out that she had already actually moved to California before this alleged harassment had even begun. So yeah, it really looks like the media and the Me Too people are attempting to rewrite history as a means of keeping another old white man off the ticket. Pathetically, instead of defending himself, Joe Biden chose to play along in the hopes that they would call off attacks and leave him alone. Why would he ever think that?  I really don't care if Joe Biden runs for president or not. In fact, I really prefer if he's watching, but he should decide not to based on nothing but his skin color and his gender.


Podman Desktop is a developer-oriented user interface that makes all this stuff approachable. On Podman for many years, there was no GUI to work with it, so you had to work with the command line, and that's fine. That's great. You can script things. You can play around with things. Someone like me, I'm more visual. I'm less deep into the lower-level tech. I still want to play with containers and build apps and deploy them, but I maybe don't want to be sitting in the command line all the time. So Podman Desktop makes it very approachable. Podman Desktop also, just like Podman, runs on Linux, Windows, and Mac.


For repeated mail in OVA, we will learn how to enter data in SPSS. We will take the same example. I will show you the three, four slides here, but not the rest because you will have these slides with you to follow the procedure, how we will do in SPSS. But I will after three, four slides take you to the SPSS environment. So this is an example we're going to solve here in this for the repeated mail in OVA. The following data were obtained from a research study examining the effect of sleep deprivation on motor skill performance. Sample of five participants were tested on a motor skill task after 24 hours of sleep deprivation, tested again after 36 hours and tested once more after 48 hours of the deprivation. The dependent variable is the number of errors made on the motor skill task. Do these data indicate that the number of hours of sleep deprivation has a significant effect on motor skill performance? So we have one dependent variable that is the errors on the motor skill task. We have three independent variables of sleep deprivation, which are the deprivation of 24 hours, of 36 hours and of 48 hours. And we have repeated mayor, that is our same participant who we tested on the performance task after 34 hours and 46 hours. So this is the example of one-way repeated mayor in OVA. One-way because we have one independent variable. We need one group of participants on the same scale on three different occasions or under three different conditions. Each person may add on the three different questions or items using the same response scale that involves two variables. So one variable has three levels. We will test all the participants on that. One independent variable, categorical example 24 hours, 36 hours and 48 hours. One dependent variable, that is the number of errors on the motor skill task. And then the number of errors for each condition will appear in the data in the different columns. So in the three columns, the number of errors on the performance task will appear. And that will be the dependent variable. This is the environment of the SPSS. You are pretty familiar with it now. And let's do it in the SPSS now. I'll open a new data file. And this is here. Its data is pretty much easy to enter. You can add the number of participants here. We have four participants who we called A, B, C, D or E. We have the number of errors after the sleep deprivation of 24 hours. After the sleep deprivation of 36 hours, our number of errors on the motor skill task is like this. And then after 48 hours, our number of errors on the motor skill performance task is like this. So again, what will we do? We will go to its variable view. We will give its name in it. After that, the data was of 36 hours. And this is our 24 hours. If we put the number at the beginning, then it doesn't take the number of errors on the SPSS. So we have to follow it on the variable name selectively. So our sleep deprivation of 48 hours is of 36 hours and 24 hours. So we have the data. We will go to Analyze. Everything is there in the lecture PowerPoint. But here you look carefully. We went to Univariate for 2-way Nova. But now we will go to General Linear Model and go to Repeated Measures. We will click it. Here it will say factor. We have to tell it that factor 1. And we can give its name here. Which is sleep deprivation. And we have said that there are 3 levels. So now we will add it. I have given it space in it. So it won't take it from here. We will add it and we will define it. To define it, it has already given you the level of 1, 2, 3 sleep deprivation. We will select 1 by 1. 24 hours, 36 hours and then 48 hours. This is ours. We don't have any subject variable. So what will we do? We will leave the model contrast in the plot. It is not necessary because it is 1-way. So our interaction is not necessary in 1-way. I have definitely told you in the options that check the homogeneity test or descriptive or estimate of effect size. So these 3 things are must. Rest, if you have to go into it, you can do the main effects. LST or Born-Firony, both are fine. Because we have 3 levels now. So it can tell in 3 levels that which one is 2 significantly different. I think that's pretty much it. Only you will go into options. Plots are not necessary. And let the rest of the things stay. And our repeated mayor will be 1-way.


The key point is that we're not just chasing renewable energy in the form of solar collectors and wind machines. We are devising ever more effective ways of reducing carbon emissions with the goal of getting to net zero. When I say net zero, I mean zero with sequestration making up for whatever residual carbon may be in the environment. We're talking about a radically changed economy technology world, and it has to be the world. This is a world economic forum, and we also need a world environmental forum, a world investment forum where we all work together. And I might say in that respect, as you brought up California and the summit, that sovereignty has a role, but climate change does not recognize sovereignty. It occurs globally, and California has been subject to horrible fires that are among the worst the state has ever had, and they are a forerunner of worst fires to come through global warming, drought, and extreme weather. We saw what happened in the Carolinas. We've seen what happened in Puerto Rico. We see what's happened in Texas and in the Philippines and other places in the world. Climate is going to insert itself all over the globe, and sovereignty is no barrier to the climate. So in that sense, the world has to collaborate, and our climate summit was a collaboration of subnational governments, states, provinces, regions, and some national governments, together with cities, corporation executives, nonprofit representatives. So these are the people that, while the national governments fiddle around with their quantum political excitements, we came together in San Francisco to confront the global threat of warming and drought and mass migrations and starvation and all the other outcomes that we want to forestall. And there was a lot of commitment, increased ambition, and now we have to move that to the next level. And that next level will be fought out in America during the November elections and then afterwards in 2020, and will be also fought out in every country of the world and expressed at the various conference of the parties, at various other interim meetings, but I would say it's time for all hands on deck to recognize the perilous position that citizens of the world are now in and to take the scientifically-based solutions that are available and can be implemented if there is the political will, and that we must generate by climate summits, by meetings such as this, in all other ways that we can mobilize the political will to start getting on the side of nature instead of trying to fight with it because it will ultimately win. Let's delve a little bit deeper into those actions. What are some of the recommendations that have come out of the summit and for local governments or businesses can take to really do their part? As you've said, some nations have pulled back and others have come forward trying to tackle this issue. So what can they do? That's very simple. First, you have to monitor where are you. Each company should know its carbon emissions, what it's doing, and then take steps to reach a zero carbon emission. Of course, that's going to be hard in the case of oil companies, since that carbon is their business. But they too will join with everyone else to forestall the horrific damages that continued climate warming will create. So it's first, understand your emissions, to develop a strategy of reducing them, and number three, make the investments and the decisions to get to the zero emission. You've also talked about, or California has been a first mover. It's been an early adopter. How can we persuade others to join that movement? How can we incentivize them?  It just so happens that carbon emissions are still rising. And they're rising in China, they're rising in India, a lot of other places. And in fact, I think they're rising in California. So we have work to do locally, globally. So it's the same thing. The scientists do the research, they tell us what's happening. The investors and the researchers develop the technologies that we can use to reduce our emissions. And then number three, the academics, the social entrepreneurs, the politicians, the educators all pull together to generate the agreement, the understanding, and the collaboration to get it done. And that's something that's happening all over the world. And this World Economic Forum is a part of that global process. Can you share with us some of the examples of some of the good work that you've seen being done? Well, I just showed California's example that we've set a goal. Not of low carbon, but zero carbon. That's, we gotta get it straight. That's where we have to go. There were many companies that made commitments to reduce their emissions. It's simple to conceptualize. Whatever your emissions are, lower them and aim toward zero emissions. Now in some places that's virtually impossible, but there are technologies. There are alternative practices. And the people that came there made hundreds of commitments that are on the web page that will indicate what those are. You talked about the power of technology. Here at the World Economic Forum, we talk about the fourth industrial revolution. How drones, AI, artificial intelligence are gonna revolutionize the way that we live and we work. What impact will that have on climate change? And what do you see the solution that we can also harness from there? Well, first of all, revolutionize through AI and all the other technologies. The revolution could also be extinction.  And we ought to recognize that. It's not just nuclear warheads of which Russia and the US have over 7,000 each that can deliver mass destruction in a matter of hours. And we have eight other countries that are in various other positions of destruction. But bio-error or bioterrorism, bio-experimentation, that's a big risk. And all the industrial means of progress have as their negative corollary emissions. So we have to transform our technologies from destruction to construction, to construct a viable, benign path instead of the malign descent into greater climate disruption. So yeah, AI is just speeding everything up. And the problem is technology is moving faster than human insight or human wisdom. It's not enough to build a more powerful toy or a more powerful set of algorithms. We have to develop and reward the human wisdom to exercise restraint and proper balancing of what we deploy. And that really makes the whole question of human survival an open question. So nothing is more important than to deal with this topic. You talked about how technology can be harnessed. But also how can you ensure or what are the tools that we can use to make sure that this transformation that's happening is inclusive? You talked about a lot of people coming at the table and the fact that you're trying to leverage this engagement that's happening. But how can we ensure while we're building these new infrastructure that they're diverse? Well, one thing, the army is very inclusive and it's a killing machine. That's what it's, so inclusion is good. But we want to get the goal in the right direction. So we want everyone on board, but we want the ship sailing in the right direction. Right now the ship is sailing in the wrong direction. And sometimes it's not diverse, sometimes it is. But what is most important is that we control our technology. And we recognize the perils and start pulling back from the abyss. And as we do that, greater equality, greater inclusion has to be part of our educational, business, and whole social policy. But the key point, there's social inequality. But then there's moving to destruction. So we've got to keep our eye on the main threat as we open up our social roles and opportunities to the widest array of human beings. That is a very stark reality that you've painted for us. Well, that is the reality. Most of the people want to lull you. Want you to feel that you just had a nice cookie or you'll have a nice little dinner tonight, so it's okay. But I'm here to tell you it's not okay. We're on a path that is ultimately destructive. That will lead to mass famines, agricultural decline in productivity, and migrations like you've never seen before. That is, if we don't listen to the lessons of the scientists of the Paris Agreement of the San Francisco Climate Action Summit. We are being given the information to pull back from the brink and go in a more positive direction. So that, my message is not one of fear, but one of awakening and clarity. Seeing where we are and seeing that we have the tools, the technology to move in a sustainable direction and getting all of our institutions moving in that direction. That's the goal and because it involves everything, it does get, it's hard to talk about it. It's also hard to execute on it. So what do you believe is preventing leaders from hearing that call or taking action on it? The world works because of fossil fuel. The prosperity, the population, the technology, all that came out of coal, oil, and gas. And now we're being asked to ultimately eliminate all three of those. That's not something we get too easily. Our habits are based on fossil fuel. We have to transform to renewable, sustainable kind of economy and technology. So that's just not easy. And because it's a sophisticated idea, it's not one that is easily presented in the world of political discussion. So it challenges the creativity of leaders and educators and scientists to put the truth out there again and again and again. And that's what we're doing and that's what we have to do. Yesterday, Al Gore said that the maximum political will falls kind of short of the minimum that's necessary for us to reach 21. That's another way of saying what I've been saying. Exactly. So there is a lot of people who agree with you. Then what is your call to action then for the citizens, people like myself? What can we do to help you? Vote out all the climate deniers at the first possible opportunity. Anybody who says climate change is unreal or a hoax, vote for their opponent. That's the first thing to do. State, local, national. Secondly, inform yourself as best you can of what the current science is telling us.  Because we can live more sustainably in what we do, what we buy, and how we live. So we can all be a part of the solution. You also said that there's some solutions that we can do. And then you've presented us with this urgent call for action. What are some of the exponential solutions that you want others to take on? You've talked about what California is doing. What are the others, like in civil society, that they can do also to be part of that? Well, unfortunately, a lot of this is dependent on government leadership. You or I can't do anything about the buildup of nuclear weapons and their use. That ultimately decides, that's Mr. Putin, Mr. Trump, Mr. Chi, and all the other seven countries that have nuclear weapons. Well, with climate change, we need, for example, a price on carbon. Only the government can do that. But business can help, and business are in the private sector. So we're in a situation where it's not your local school board. It's not your local recycling center. We are talking about a all-inclusive globalized threat. So we do have to look to our leaders, in the churches, in the schools and universities, in politics, in the military. Those people at the top are going to have to lead the way. And we, munchkins at the bottom, are going to have to do what we can. But we're very dependent on the big shots. I'm sorry to say, as a minor big shot myself, I can tell you, we got to do it. We have to do everything we can, and we're not. So we're setting a very bad example for the non-big shots. You're coming to the term of your limit on January 7th.  What's next for you? The world is not my oyster, or anyone else's oyster.  So what am I going to do? Ask me on January 7th. I got a lot to do. I have 174 proposed pieces of legislation. So the work is not done. What? So the work is not done. It's not done? No. Tomorrow afternoon I'll be signing or vetoing bills into the wee hours of the night. So California, there's a lot to do. And I've got about 100 days to do it. So I'm going to use every, but there'll be a lot of things. There'll be many, I'll have a few surprises before we're finished. So on that note, I'd like to open up the floor for any questions we might have in the room. Just please state your name and the organization you're with. Thank you. Thank you for your time. So I'm Catherine Chaney and I work for DevX. We're a media platform focused on international development. And my question for you is what message you have for donors and NGOs working on climate finance? Because despite growing recognition as was the focus of your summit, national actors can really drive change on climate. A lot of the funding is still going to the national governments. So I'm just curious what message you have on financing for climate change and how can it actually start to go to the subnational actors? Well, all the subnational leaders, political leaders, have to encourage the business leaders, the financial leaders, to make the appropriate investments in renewable energy and lower polluting technologies and low carbon activities of one kind or another. So you have to go where the money is, which are in the hedge funds, the banks, pension funds. And we can do something. California has some pension funds. We have hundreds of billions of dollars. I think there's an area there where we can encourage the investment priorities to include resiliency and finance in the lesser developed worlds where they're very short of the capital. Unfortunately, the world spending a trillion on weapons and military, we wouldn't have to divert too much of that to get the necessary investment and meet the $100 billion goal that we need for fulfilling the Paris Agreement. But there's just a certain amount of diversion from where we ought to go. And I think our pension funds and our companies can play an important role. Thank you and one follow-up to that. I wonder if you could expand on the under two coalition that you co-founded. And I think one of the things that could help drive progress in terms of funding going to subnational actors is when those subnational actors come together in networks. So can you just talk about the under two coalition and lessons learned, what worked, what didn't, and if you think that's a good model moving forward? Well, under two is probably not good. Well, to the extent that under two includes private sector people, companies, they can certainly invest in sustainable programs that can affect through our countries. As far as its states and cities, many of the political leaders have influence on their pension funds. So there's massive sums of money there that could focus more on necessary sustainable investments. So that's something we can do. And the third thing is that cities and states can be isolated. And by being part of the under two coalition, they come together to see the progress that their colleagues are making and that they're part of a much larger movement committed to under two degrees centigrade. That is the movement of the under two. Our grand national leaders are not making that commitment operational as of this moment. There's a stall, a slackening of effort. So the under two groups can in their own nations build the political will and the support and take the action that they're allowed legally in their own states and cities. Building regulations, electric chargers in cities. There's a lot of things that recycling, better use of water. So individual cities and states can take their own effort and take their own action and then by becoming more aware of what others are doing can keep committed. Because it's very easy to get discouraged. If you look at what's happening, you could say, well, we're never going to get it done. So that's why it's so important for a climate action summit to demonstrate. Yes, there are very serious people doing serious things to come to terms and to minimize carbon emissions. So that solidarity aspect is critical as part of the mission of the under two coalition. Hi, Governor. Mattie Stanislaus, World Resources Institute, Circle Economy Fellow. In addressing the gap in NDC's optimizing circle economy, which essentially means to reduce the tremendous explosion of raw materials, as viewed as one of the top levers of addressing the gap. Can you tell me whether that came up at all in the summit and whether there's any possibility of building that into carbon trading schemes? Well, first of all, the carbon trading schemes are themselves subject to controversy. California has a cap and trade along with Quebec, and the other carbon trading schemes are rather minimal, except for the EU, which is now raising their carbon price, I'm told, to 20, 25 euros a ton. So that's good. In terms of the circular economy, while I just banned plastic straws, that's a very little step, but we're moving in the direction of recognizing that once use is not acceptable. And I think that is really a product of government regulation. The government's saying no, they'll shall not do that, and they'll shall recycle. So I think that's a matter of government authority following political belief and consensus, adopting rules to bring us closer to a circular economy and to avoid the massive waste. I mean, if you walk down the street here, you see all these big trucks and all the cookies and cups and chairs and plastic and all the rest of it. I wonder, how in the world can we ever make this a circular economy? How can we ever get to zero emission? I think that's a topic that's worth reflecting on, but it's quite daunting just right where we are to get this in a zero carbon position. And the recycling effort is very important. And all we can do is adopt goals, 2030, zero waste or 70% waste, whatever it is. Each jurisdiction has to set a goal. Then they've got to count, they've got to measure what's going on, and they have to set a goal to make things better. This is the goal. The trouble is, even as you talk about world economic forum, it's about economics.  And I have to say, it's the ecology. It's the ecology.  I'll say, wise, interdependent human being, it's the ecology. And by that, I mean, it's the interactive pattern of all the species and materials in circulation that we have to make work. And the economy is a more linear subset of the overall ecology. And it's narrow and destructive, if not tamed and structured within the rules of nature, the rules of habitat, the rules of multiple species diversity, as well as human diversity. So we have a big job to go from the world economic forum to the world human forum, to the world nature human forum. So even our language is very biased and oriented toward money, toward return on investment. You even meet people, young people who say, what's my R, what is it, REI? ROI. What's the ROI? So they're brainwashed already that maybe learning, I said to somebody, why don't you study English or literature? So what's the ROI in that? So we have a lot of discovery and learning and dissemination of clearer ideas about what it takes to survive, to sustain, to create true prosperity. And there's a superficial prosperity and we got a lot of it, but it is not a sustainable prosperity and therefore it's actually false unless we move it into a sustainable frame. On that note, this call for a higher purpose. I'd like to thank you, Governor Brown, for joining us. Thank you. And I'd like to thank our audience online for joining us. Thank you. Good. Remember, it's the ecology, not just the economy.


For East Africa and Kenya in particular radicalization. Not just radicalization internally with Kenya but also cross-border radicalization and particularly from Somali n espoma katilisha kat As you may have heard, of course, there was an attack at the Ducey Hotel in January on the 15th. And of course, what came to mind was if they were not using conventional weapons, because the question about a chemical attack is not if, but when it will happen. So this radical elements around East Africa and in Kenya really are the greatest threat to the region. The academia has been involved largely in reaching out to the chemical, the chemical players in Kenya and in East Africa particularly Somalia. And this has not only covered talking to the academics who deal with chemicals on a day-to-day basis, but they've also reached out to industry and taught them best practices in terms of how to protect their facilities that deal with chemicals. However, they have also talked to the informal sector, which is very large in Kenya and in Somalia. They have talked to them about these dual use chemicals and how to keep them safe away from the hands of these radicalized elements in the region. They have also gone a long way in trying to talk to the fast responders on how do they actually deal with incidences where we have a chemical attack, so that they are always prepared to respond. And finally, the academia has gone a long way in talking to the people who actually trade in chemicals, especially the suppliers of chemicals and informing them that some of the chemicals that they are supplying could be benign in nature, but of course combined with other things can actually be very dangerous weapons. The law enforcers of course will not work in a vacuum. They work in an environment that involves people who they are protecting. Now their job becomes hard if the people they are protecting are not aware of some of the dangers that chemicals would actually result in. And working with Kenya Chemical Society we bring together not just academics but industry players and we are in interaction with the cottage industry. We are in contact with the farmers for example who are dealing with fertilizers and all sorts of chemicals that would actually be weaponized. So law enforcement in this case can benefit from these interactions where we bring them together with the other community that we are in interaction with and they can also now give their perspective on how to approach trying to minimize the use of chemicals being used to attack the populations in Kenya or in East Africa. Also in our engagements with the law enforcement we've come into conversations with them in terms of how can we help them in terms of disseminating information that they think is not so sensitive and will not cause a security risk to our members and the industry at large.


Yeah, okay. I have some slides basically I didn't expect it to talk about this right now But yeah, but I will still do anyway. It's kind of surprising So as I said, I just said I made a very rough slide to give you some ideas and the challenges we have some background is that in Google we kind of develop a lot of Internal stats to connect to the kernel performances traditionally we implemented the stats that are in the kernel in the C group of the system and the stats are for the runtime performances for containers for jobs that are running in the Container and we exported these stats to the user space by the C group file system So there's a stat the two properties that important is that stats are different defined as implemented in the kernel and What they're tightly integrated with a C group subsystem? So the motivation for this problem is that we want to migrate our internal stats in patients Into a BPF based Implantations so then can so can easily be extended and changed from the user space and allow faster iterations for the stats The there's some high-levels ideas to solve it to do this migration to really mean that it's pretty simple We have have this we have a tube BPF program to set a BPF program actually Why is for collection the basically I think of a that's a tracing program that the collector stats and then put into a map And then we have another set of our programs that extract the data from the map and export it to the user space There's a high level idea Let's talk first talk about the part of the exploitation the data exploitation from the kernel to the user space One important usage for the is to have a iterator BPF iterator program that to read the data from the map and Export it to the user space So we need a slight extension to the ether link so a program can Can can attach to the target and then we can create a link to the eater program And this link is actually primatized by the C group ID single name whatever and then we ping this eater link into the BPL file system so we can export this data through a Hierarchical way in the file system So every you and open the permission of the file to be readable by non-later users So anyone could read the file and when reading the file the BPA for eater program will dump the stats to the users who read it This is pretty much a simple design but however, there's a problem in that design is that because non-private users non-later users they can create a C groups And the while they are creating a C group they still want to be able to read the stats of their C groups But the BPA for this call is actually restricted to router users So the non-later users, even if they can create a C group, they cannot create a eater links or Png the links in the file system because the privileged operations So which means that they have no way to create the BPA of basis stats of files without the help from a privileged process or demons So just a short illustration is that the The last two steps the attaching and the pinning will require privileges. So the non-later users Drops running the container. They cannot do this. They will not get the stats of files automatically So to solve this some ideas that's already had the first idea is that we can have a dedicated a demon that to implement maybe an service interface and then when the C group When they come when the job run when the jobs want to create a C group They can send a request to the service and to say that hey, I'm creating a C group Can you pinning attaching and pinning to create this BPA basis stats file for me? And then We can we can get the stats by reading the files But this idea is not liked by our container runtime team the reason is that so we want to add a code in their demons and This will add the overhead and they have to implement this service for them and the second problem is that the Demons will not be highly available. It could crash at any time Which means that it crashes if you mean for you can create a C group But they may not to guarantee to have the corresponding stats files So that's our two problems and not like to buy the container runtime Just have some questions. Um, I was just gonna I was gonna let you get your next idea But that's fine. Um, we've had the same request as well. And this was also rejected because the The run the person running the BPF program. This is like a nested environment, right? Like it's so in our case. There was nested Docker environments, right? They have they have Kubernetes running the insight Kubernetes first for whatever reason And so there was really just no way that the team that manages the nested Instance could talk to the, you know, some root demon. They just think they were firewall There was no they didn't want to have anything to do with each other. So but yeah, yeah You don't need if you just give the right permission to the directory in a secret directory And is there anyone could create a directory in that parent directory and then that will create a So it's creating the secret but then what about how does the group Manages the permissions when somebody finally like move the processes around so because process is a file I think you need to like write the PID or something in Some implementation details is that when the container is created or runtime We will bind the mount a root will bind the mount a C group directory to the Inside of the container and then give the right permission to the directory and then you can Whatever you can do whatever inside your mounted C group directory and then that will give you You can do anything and though the we system our system doesn't track whatever you do So it's and if I recall the C group is a C group fs is a single mount, right? So there's only one instance in the whole Right system. So when you bind mount you still like all of the containers still see the same C group, right? Like you have a You have a C group name space as we will be do the isolation Group name spacing Not right now, but So basically it already has some isolation as a group and then we allow Our goal is to allow the arbitrary the number of users to create the C group So it has a flexibility to managing their processes running the container in whatever way to for the resource control. That's a go Yeah, so there's a mismatch between the C group capabilities and the BPF capability right now we provide basically That's a problem So the this is a general architecture of how this goes just the job creating a C groups and then asking the previous demon to say create the stats for me and then The privileges diamond will do is attaching pinning creator files Not okay and in the previous slide that it will do loading to or not We can assume that loading is Down at the boot time the kernel can do that and then what you do is just really in the kernel So but in the case that I was mentioning where they have nested pods and doctors and things They would want to also load programs from the from the nested thing, right? so so even that is like You would I guess if you were to do this you'd have to sort of pass the program through to the privilege demon and It was sort of a no-go Okay So the runtime team doesn't like this idea because they don't want the logic sitting there And and you don't want to run an extra team in just because you want to do this dance Yes, right, right exactly exactly So Continuing this we have a second idea basically How about this if we don't have this demon can we actually implement this demon at the bpl program So the so the the method here is that we can deploy a bpl program, uh, which monitors the C group events like creation and deletion And then the the program which monitors that will create the stats files Uh, uh, once it have a monitored detected events So there are need some extensions for uh for this for this idea is that we first We need to have a sleepable trace program points Because the operations that you do in your program is to do attaching and pinning this bpl for this course They will sleepable they will sleep So we need to have is a sleepable trace Program a three point program that to monitor the events and then to do the operation We also need to insert the sleepable trace points for in inside the C group code basically to attach to the Would be at the hook at the C group creation and deletion And we also need to enable link create the bpl for pins this course To allow it to for allow them for the sleepable trace point bpl pro so the The the the the solution here is like this. We don't have the demon, but we can deploy a program Probably by the kernel at early boot time Which monitors the C group events and then when you detect the C group creation The program will create this bpl of fs files and it could be readable by the jobs. So we don't have a demon So this was this is the same solution we came to by the way And we also use this we are also talking about Using this for checking signatures as well of those bpl programs So we can talk about it more. I think in the In the in the nested case, yeah, it is because they're well It's more like Too much container Yes, basically, but I'm Thinking that maybe signal migration or other stuff we also need to monitor But it's more complicated than just a simple creation deletion. Is it is it because you're trying to Restrict the C group stuff they can do or are you trying to Maybe miss this. So so in my case, it's like they want to load a bpf program Yeah, right and so when when they do the load you want to make sure that they're not doing something with that program That would be sort of outside their bounds of permissions Like like reading maps or whatever, right? It's certain helper calls, right? It's sort of more fine grain than And sort of just cat bpf It's like Yeah But that's this is slightly different in this case we we want to have some statistics files appear, right? So although ideally it would have been the some some unprivileged logic to have like Do some bpf system calls it ends up at that policy angle when you want to read maps there But here it is just like the only sort of permission issue we ran into when we were doing this was that there is this program That it's in the helper it tries to do a bpf syscall And this program could be triggered in an in a task context that is an unprivileged context The helper goes into the same sort of pathway as the syscall like would normally do So ob spin and then that that that track and then I think how I did a check if you're calling from within a bpf program That has been loaded from a privilege context, right? You wouldn't do the the privilege check there I was I was thinking that we need to do the syscall path from the bpf program Or we could create some helpers that would create links in the kernel But I think the syscall is working fine for us now. Yeah See there are some details basically we need to grant permission To the syscall helpers Because it's calling a task in a task context not from a interoper context So when the the permission there's a permission check in the bpf syscall That's the checks the current tasks permission to say I might allow to Create a direct trace in the file in the directory or something like that. Uh, so we also need to Do some modification in the permission check In the bpf syscall some details here, but I didn't list in the slides just to show the High-level architecture just just to like recap the flow a little bit right because I was unstructured There's a bpf program that is attached to a trace point in the kernel Right this this trace point can get Gets triggered by like a when a process an unprivileged processor. It's a cgroup The bpf program then does a syscall a bpf syscall from within the program itself And this ends up running although this is like Code that has been loaded by a privileged program It is running sort of in an unprivileged context in a current where the current itself is unprivileged So you can't create directories you can't do syscalls and these checks are the ones that have to be modified Exactly, exactly. So we that's why we need also need some modification in the permission check here This is the second idea and how does this interact with the cgroup namespaces? It's an independent issue Yeah, I mean you I guess you can just map it to like in your bpf file system in a different way, but yeah This is all the stats file exported through the bpf file system So what we what we are planning to do is to bind the mount a sub directory into the container We don't have a namespace for the bpf file system. So it doesn't have the same level of Isolation as the cgroups But here a bind amount could give us some some level of protection isolation here So Well, you have different mounts for a bpf file system if you want to right? Uh, yeah, we can mount multiple times I think I maybe missed something. So are you are you trying to like Pull links from privileged into this unprivileged cgroup? Is that one way to think of it? You can say that we I what I want to do is actually to Allow some unprivileged Stuff that to the unprivileged users for example creating these files Or this files. I think creating the stats files could be pretty safe to for unprivileged users to read So then I'm just trying to get my head around this So then when you like there's a syscall to do that right to create the file Right, and then you're saying you'd have a bpf program run there and do the permissions check At that point no no no no no the I have a program that calls the bpf syscall But inside the bpf syscall it has a permission check That's only allowed for previous users But at the core site of the bpf syscall you are in the unprivileged context So in that way you need to say that when you permission check you need to say that Okay, if it's called from a inside the bpf program, and then I want to allow it for our own previous users So you're kind of circumventing the syscall permission check by doing a bpf call that then does the syscall Only if it's called from inside the bpf program in the kernel context, right? I get it now Right right right right So if if you are going to modify the syscall permission checks to allow special case for bpf Maybe it's cleaner to just do like bpf says create link bpf says Optipen and like they will reuse the code, but we'll skip the check There's no actual like syscall like they will just be calling the sysbpf the way that If I understand correctly the way that syscall bpf program type does it just calls directly into it doesn't do syscall It's calls into bpf sysbpf, but it's not a syscall. It's just a function at this point Yeah, I understand but like permission checks are one we still go through this like multiplexer of commands and all this stuff. So like Should we have the helpers? Well, you have like this switch, right? Is it map create is it this no? Oh in that sense. Yes. So like instead of doing this like and pretending like we are doing syscall We can like have every command as a separate thing and like it will Potentially work slightly different in bpf context if it's called from bpf I think we can do something it will save it will save the demux only but Big deal Well, now that like we are working in like a different security Domain sort of I don't know that might be a little bit masterful. Just an idea. I know. Yeah But you're basically saying that we don't need to enable all the functionality from there, right? I remember correctly Disable Like when we do this Inside of it. There is no current check, right? No, this is no nothing. I know this part this part will be fine. Yeah, this is fine. This is fine. Yes It's only the syscall.c In the bpf this is a Global scuttle. So it's only this one, right? Yeah, those are this one. It's only this one And this is the capability check If you bypass these two lines Yes, so once you Want to go in here like here there's no no no no no one going to check that all should go through that works We'll come back Then you don't have to limit it to like a syscall program type, right? Like you can do it from everything like where it kind of makes sense sleepable Yeah, right So part of the change was actually to extend this call helpers to the sleepable trace points And then you need to insert the trace sleeper trace points into the c-group code and then And then be careful if you want to insert it into a sleepable context not in an atomic context Can I continue? Yeah There are maybe something I want to talk about is related to this idea There is a notion it's called demon nest container engine in the container world Um, it's a concept in the container world because that it allows the spawning container Demon nest container engine allows spawning containers without the help of preva Demons what do we actually do here in the previous slides is that so we dedicate the demons? Operations into a sleepable trace points to do it inside the kernel at the bpl program So the open question I want to ask you here Maybe some discussion possibly putting some discussion is that Can we do more operations to dedicate to the bpl sleepable trace points? This may be helpful for the uh for the move over demon nest container engines But that's not a point the key point for this talk, but what would be the example Yeah, I was also wondering the same I don't know. I'm just because this what I did in the last slide reminds me of this notion Just to say but people who are familiar with this demon nest container engines if they have some ideas Could bring this up and then probably we can do but if no, then should be fine Yeah, I think the answer is Why not? Yeah, we certainly can especially there will be like sleepable Events inside the kernel and there you will do all sorts of stuff like creating directors loading programs Peeling etc, but what would be this container management like operations you'll be like killing tasks Sure, why not we have a way to send the signal already so we can't kill stuff But yeah, I I don't know yet I'm just calling out to say if people have some ideas could bring this up And then maybe we can we can do something with a sleepable trace point to accommodate Yeah, this is not the end of the stuff if anyone I think the main thing to check is The main thing to look for is like Explain what are the benefits of the demon less container engine right and that would be That would be a catalyst for figuring out what operations need to be done I could say that it will make the demon for this for managing the containers a thing And they will reduce the the required privileges operations less so which Potentially improve the security in the system And that's the at least that should be that's something that's a demon less container is Is that they're talking about Yeah for better security potentially better security I would say I Maybe I'm just being slow, but I I don't get why how this demon less You you have a less operations performed in a privileged the context in user space and got it. Okay But the user space has a the unprivileged user space has a larger surface now to interact directly and That might be a that's the tradeoff there from a security perspective You have a monolith or trusted monolith demon that you that you sort of That you know the security properties often you sort of have some guarantees and the other case you have these individual user space these unprivileged bits but like I don't know the surface may increase We have to think about it a little bit more carefully from a security perspective at least I do see other benefits there like what what we know that where where demons would end up consuming more memory and stuff there, right? So Security angle we need to think a little bit more. Yeah, this is just a this is just a Question that's I I don't have a clear answer. I just raise this up. Yeah Okay, I'll go on There may be another possibility I was just thinking over the last weekend is that since the root problem is the privileged requirement for link create and the pinning Can we actually enable it for just for unprivileged users? That was of all the problems because we can have this runtime container runtime to do this but how What I'm thinking is that actually can we implement a fine grained access control list for these BPF assist corporations more specifically we may I'm thinking can we actually to enable these two operations as a per Program per operation basis as they just grant this link create and object opinion to the C group starts eater and Stats eater links So we can just have a better control over what the unprivileged users can do And then if we allow these two operations for the non-reusers, they can do it by themselves Basically just modify the user space part not inside the kernel part I was thinking I don't know if this is possible is that maybe we can implement such a policy engine using LSM BPF to have this fine grained policy to For better control because I do think as the the unprivileged BPF scuttle is a big hammer So why why not to like do full entry? What's the concern? I don't know. I think as the scuttle was there was just uh For I'm kind of a very conservative person I think we should do allow some operations, but for majority of them should be disabled. I don't know. It's my opinion I don't know how the upstream community would take this but Some discussions maybe I guess like for the for the BPF file system itself, right? I mean, it has its own dedicated permissions. So potentially just could allow it Right, right, right Yeah, like right now everything is under this big hammer like disabled unprivileged But the file system has all information checks pretty So Technically you could map the content of the file if you have permissions without going with the BPF sis call If you have permissions on the file with the ft the ft implements an mmap operation, right? So the it's just the BPF sis calls scuttle sort of ends up in the middle Adding an extra check whereas you could get the contents of You then you need to get the file descriptor In order to get the file descriptor you need to another BPF sis call get a reference and get a reference is also Part of the BPF sis call. Can you not just open the file and get the ft like a normal thing? I Believe yeah, you get a reference basically calling through the BPF sis call. Okay so this was I this was The forum I had this discussion and I'm not going to quote the person but like yes We we thought that you could already mmap as an unprivileged user if you had permissions on the file Part yeah, so what would we try it? Follow all the standard file system style So if there is an fd if you got an fd you like do everything with it So like so here the only like deviation from this model will be link create because link create itself creates an fd But I think like This is scuttle is there realistically only because of the well Spectrum of down stuff and it makes sense to think realistically only for loading Because loading program is what creates all of the security issues like If I think on the lot if it that's the only thing that stays under the under this is scuttle like everything else Potentially can be removed at least I don't see how Like what harm it will do Yeah, no, yeah, that's that's separate that that that's this admin forever. That should also stay Otherwise you can read them from I don't know different names Yes, yeah, yeah, I mean I mean the other operations like look up update like Ops pin, I think all of this is fine Especially like Ops pin object because they go through the file permissions like bffs has all the normal stuff So like x-races control like doesn't buy anything realistically link create is interesting Because link create is actually attaching so actually attaching is Like yeah, you would have you'd got to have an fd of the program to attach it somewhere so You expose the Yeah, but you need to write permissions there. So that's the difference like so you have file system So file system doing all of usl checks already whereas link create doesn't have like extra like it's just like Final you only got to have an fd So, um, I just want to mention I have something very similar to this one have lsm to control who can do this bpf like Probably cover that later, but like Just I think it's a good idea to and it could be very powerful in like other other Other metrics The other thing Like like for for example where we could also Attach some of the Operations to I mean like as you mentioned like given there's the file system You have all the permissions. This should probably be independent of the unprolished this detail, but if you have other stuff we could also um Add this somehow under some Final-grain lockdown policy for example if we wanted to write I mean there's also room for that where you can say okay With a given cap setting you can have this set of applications where you want to grant this but others not in the same Yeah, yeah Like a like a final-grain lockdown thing right like I mean similar what we have with the Right to the to to to user space to modify to to modify a program code. This is also under lockdown right now, right? But I mean Just to just to extend on that idea it would also be possible even though But probably not through the lockdown like lockdown but not lockdown Yeah, yeah, exactly Uses does it create like a so this is I I'm not the expert here So I'm asking people who do some bit of hardware security. I'm learning in this area But can you like use map writes in the kernel memory space is an unprivileged user to Like do some cache collisions and create a scope cache based side channel like a probe flush prime probe attack somewhere or like Or a flush tree or like some one of these cache attacks Well, you can of course like it's arbitrary code, right? Like that's why it's unprivileged disabled. That's why this is control is that Like cash is just one of the things right so like it's the first thing like specter. We want is what you describe me Yeah, I mean I'm saying like if you give map access like the oh just map access Yes, just just look up updates into map. Correct. Yes. Is it is it doesn't take the user into an address space that they wouldn't normally have access to Now they have sort of write access to that is to that to that location It's not executable. So in that sense, it's just memory like if you did like a map with a lock You'll get exactly the same stuff. It's just the region of memory So it's not But like the specter Well case a lot is different That's unrelated to that You need these things to form like an attack uh and explore there, right? But they're the same as in map, right? So like yeah, you could do it with a lock and you get the memory So how is it different? Like not related to bpf at all just like any kind of memory It's a memory No, what i'm saying is like they yeah, I I I need to I need to See where this is allocated like can you share some like where this Is it it's in the it's in the kernel it's not in the kernel text section, right? This is all vmalloc So it doesn't matter came out like a vmalloc. It's memory, right? It's a data memory. It's not executable So like it's same stuff as any other memory But you need a bft, right? Yes, I'm still I'm still don't see the concern like it's a memory like it's there are plenty of ways to get the same memory so like I don't see how like Allow on privilege like look up updates into the map would Do anything more than like existing just a map anonymous memory Same stuff I'm going to give you an answer and I try to find out what the question Okay, so I I mean you you would also need your bpf program crafted in such a way and I have permissions to load that right and if you don't and The only thing you probably do is like causing cash trashing, but okay. I think we diverge in a lot Yeah, I would say I want to I want to just mention that I also attempted to have this developer patch for mmappable task local storages Partly because of this reason, but anyway just one Head of architecture is that so we have this policy engine inside the kernel and then so the job can directly create the signal files could read the stats simple The third approach, yeah, this is the third approach Not not to circumvent the privileges, but to give a fine control over the Privileges Yeah, this is unprivileged. So grant the Creating of the files the privilege to create the files. Yeah This is sort of so I present a team summary. I presented I proposed three ideas The first is not okay I have a dedicated demon and the second is that using a sleepable trace points and the third is that so we give we develop a Fine-grained the policy engines to grant permissions some permissions to the unprivileged users. That's a three approaches here This is for only for the exporter parts There are not a part for the collection part because that's also needs some work That the C group stats is often hierarchical The stats that we collected often aggregated over the C group sub trace because for example, you have a job That's how well the container engine will create a top level C group and under this root of C group The our jobs could create a child C groups to do resource control But the stats we exported are often aggregated over these the child C groups and exported as the top level C groups So actually this is the collection side was worked by my colleague usri afman Uh, he's saying that it's almost a code of complete, but still testing Hopefully get some rfc patches posted in the mailing list soon Some idea is that the idea for the collection is that so we will be extending the our stats Our stat is the infrastructure that built in the call of C groups for collecting the C group stats And it's basically a framework allows the each controller in the C group to extend Basically this defines How do you flush the stats and then how do you? Aggregate to these stats. So we Use this idea is that we want to plug in after discussion with the Is the maintainers in the bpf office hours is that we want to plug in it's a bpf into our stats So we will introduce a new program type for the our stat flush a flasher the flasher is a Is that can attach to a C group subsystem and defines the logic for how to aggregate the stats across cpu's and hierarchies and then how How do you do the flushing? I don't have much details Until we see usri's rfc patches Yeah, still working almost code complete by testing The last the final bits for this work is that the the storage is for these stats So currently we put all the stats in the hash map. This is the workable hash map is indexed by the C group IDs, it's unique. So we put the stats there But it would be desirable if we can make the C group local storage to be usable In our cases because we believe that would be probably faster than hash map I Actually not quite get it because this question was raised by usri. I think it's a secret currently In my understanding my understanding is secret local storage used for network right now only used for network is not generically usable by Tracing or other program types. I don't know if that's a case that case probably that's what I mean I think what You're trying to refer here is like why not a secret local storage can only have a one-to-one mapping So each program bpf program can only one use can only use one secret local storage So at the low time if the bpf program is associated with Is a secret local storage a for example, it cannot use any other secret local storage, but Think about soccer local storage right a bpf program can use more than One one soccer local storage Okay, I think I don't know whether anyone remember that in a early discussion when we try to extend the Current secret local storage The program and the secret local storage has a one-to-one mapping. So that was one of the things bought out But in tars local storage soccer local storage, there's no Dislimitation, okay, I think that's I don't know why the secret I think I think what what um When secret local storage created is more like a sad local storage That's why the the whole design I think I think secret local storage was implemented first Right, and I forgot why And the one that are like two most there is secret local storage and they shared something And that's how it stayed but I don't think there is any like fundamental reason why it cannot be right Yeah, I think we can definitely extend the Tars local storage or soccer local storage idea to to the secret also I mean essentially you you have a ponder in the secret data structure Like socket and tars already has Okay, that's the last bits of this pipeline, um, thank you everyone. I take a lot of time and uh, Generally a lot of discussions So one more question. Thank you So, uh, I just want to ask so we try to convince the cgroup maintainers to take that directly into cgroup fs so Do you think we should try that again? I do think that's going to simplify a lot of the stuff I know maybe the challenge is not so So good, but do you think we still give it another try? I I can try I can try But but I I do think that as I said, uh, in my own opinion is that the last two approaches the Policy engine and the city for trade points both have their pros and cons Uh, I just want to get an opinion from everyone in the community to say which one Is cgroup local storage performance wise a little bit faster than like other local storages because we avoid like searching for for this So that might be what we can create another secret generic secret Yeah, yeah, okay That's all um, I recently hit a problem not exactly cgroup, but but it's also uh about the unprivileged is like So the program Used to be working. Okay. It has a it has the bpf and ccm in privilege and then So that demon is trying to read the map or Did it update update something or look up something from the map and one day that demon maintenance started using the user name space and then And everything's Broke it cannot even read the map. So is it a particular reason we cannot support user name space in in the people at church church I think so far it was mostly paranoia like security paranoia Mainly the paranoia in in this case like userness doesn't will not we cannot Be a different route like userness is still a fake route from everything bpf point of view Even if you're rude inside the userness, you still unprivileged You're still just a normal process from like anything bpf related So that's scuttle is the main point, but it's kind of orthogonal to userness What we discussed just just before like allowing map of uh Update and look ups based on fd only without requiring like privileged says it mean probably would solve that that issue Because like once you have the map of d you can just like go and update it right was like being unprivileged process But they they may not do they may not only only do they update a map Right, they may they may want to create a map or things and then suddenly they switch the user name space and everything broke so Yeah Is creating a map it's creating a map and putting it into a map of a map a safe operation to do for like pretty much anyone Or actually you will have a view of the map in the map, right? So you can you can still control that okay Well creating the map probably also should be fine for unprivileged like there are like Other checks there right so the main thing was creating a map the main issue is that it's locked right So we might need like ipc check for ipc lock stuff capability cap ipc or Whichever one is it? But that was the Mem log right? Yeah, but that's gone right? Yes, so now you have to Anyway, yeah, so map create might be tricky not to like directly to unprivileged but need to think more like how to Make sure that unprivileged user cannot dose the system So that's the only thing like once the map is created like look up update delete all fine but Like map because of max entries like what we can do like whatever Different max entries some other limits, but the mcg should really be the answer Did anyone try to implement policies with the bpf lsm for the bpf syscall itself? I think Robert has a question so I try to implement a policy for Adding a new element to the map but Because when I use that the bpf map security uke it was not Precise When you try to do bpf to map least they also tries to get the map right permission And this was not Good if you just want to protect the update Can you can you repeat what you mean like update is the right? So So the when you do the update that you ask for right permission, but bpf tool just to iterate over the maps also ask for the right permission So when I when I try to deny the the right bpf tool Stopped that the map for which the permission was denied. I don't know. Maybe maybe it could be a so bug or Yeah, if you have a chance, please follow up with that. I mean, maybe it can be fixed I don't know bpf tool probably runs as root and then you're denying root the permission to read To like write or some to the map and then bpf tool sort of there is an iteration that breaks like it sees an error When it tries to read that map and bpf tool assumes that hey, I should have access So there's some tooling that needs to be updated to understand that I don't have an access I have a permission error. I just just continue iterating on that But there's no problem with the lsm hook in particular, right? You were able to implement the policy that prevents updates for a certain map this dialogue So and understand that the bpf tool need the right permission when you do bpf tool map update element But not when you just need to list list them up So when I it was just leasing a map bpf tool map list and I had I wanted to deny Right and bpf tool stopped at that etc the map where I denied And so I didn't continue to to show the other maps after yeah, that's a tooling issue, right? It's not an lsm hook issue Yeah, it could be could be could be that Or I don't know. Maybe yeah, so it could be how the bpf map is implemented because it is the one that Um Generated the permission I actually think it's a tooling issue It shouldn't be on the like the map It just stops iteration at that map where it sees the access is denied So you need to probably add a check that says if error equal to e minus e perm continue or something like that Right because it doesn't expect right now by policy that maps will be denied access to while iterating on the maps Yeah, you should be able just to to list them It'll be good to see the snippet of the code actually when you present your lsm stuff. It's easier. Okay. Yeah We still have a few minutes Any more questions or comments? All right. Yeah, thanks. Thanks a lot So break for so we'll do we'll do a break right now. So uh for how long?


We are down at Frankie's free-range meat and I'm excited to show you guys our new product It's essentially a meal replacement bar I know a lot of you guys were buying our pemmican and a pemmican which is a mixture of Dried beef and beef tallow is a great survival food because it doesn't go bad it tastes pretty good and It encapsulates complete nutrition the problem with our pemmican was we just weren't able to produce enough of it So Frankie boy was thinking about whey powders milk powders and a bunch of other different high-quality Nutritious animal-based foods. So this bar is only five ingredients.  Yeah, but you know, we've tried those products We've tried New Zealand products and the New Zealand products don't only taste better They're likely better for you as well and guys this bar taste like ice cream Literally like ice cream out of every survival food I've imagined from a taste perspective a nutrition perspective a storage perspective Nothing is going to beat this. It is perfect from a macro nutrient perspective It is 80% of your calories from fat 20% from protein and these are the ratios that would have occurred Naturally in our indigenous diets. This is a half pound bar. Correct. How many calories was this? It's 1400 so This would feed a woman or child for a day definitely if you were a man You probably have one and a half bars. These were three different formulations for the bar The middle one is the one I'm holding here That's the one that's going to work out the speckles in it or the vanilla and Guys, I mean it this literally tastes like ice cream I would eat this bar all day every day as my only source of nutrition. It's so tasty. You don't have to prepare anything So what did you think when I first brought this idea to you? You thought I was nuts, right? I was I was excited to experiment with tallow so we're using grass-fed wagyu tallow that we render ourselves and It was challenged culinarily, but this bar is not only five ingredients, but it's five minimally processed ingredients So some bars, you know if they're using a protein isolate It's it's heavily processed or even the sweetener. We're using raw manuka honey salt vanilla beans Those are not processed at all. The tallow is just rendered beef fat and then the way is a concentrate So it's just drive away. It's not an isolate. So it's as clean as you could be culinarily and Taste-wise the grass-fed tallow Combined with that vanilla and milk. It really does taste Yeah, you have like the nuttiness and the butterscotch flavor and you can taste the grass. This is from New Zealand You can taste grass and yeah, it's kind of cool that all the ingredients are from New Zealand It just kind of all came together naturally, but it really does make the best bar Yeah, so the reason the pemmican was priced so high is because you know the beef is expensive But this is something that's going to be a much lower price point that people can definitely stock up on And we're gonna try to produce this in a much larger quantity, right? It's very labor-intensive to dry beef, but way product Way powder is much easier for us to produce So it's lower cost and higher production tested on the two-year-old and the nine month old They're both warrior bar fans in my wife. He doesn't really like rendered tallow She was able to tolerate this so it does have a texture similar to other energy bars, but it's it's just a better product so as you guys know milk in general is a very nutritionally complete product and Weigh protein is no exception the difference between milk and weight protein is The weight protein doesn't really have the fat soluble vitamins But the water soluble vitamins the B vitamins the amino acids the minerals are much more concentrated And that's actually a good thing because the beef at the tallow has the corresponding fat soluble vitamins that you're missing By not having the fat from the milk So this bar is definitely Nutritionally complete you're getting plenty of water soluble vitamins fat soluble vitamins minerals a ton of calcium The only real things you're missing in this are iron, you know, which people would argue You don't really need a lot of and you don't want a lot of Magnesium and copper which can be obtained by quality plant foods and maybe we'll even do you know a chocolate flavor of this bar Where we do incorporate, you know, some of that chocolate for the magnesium and the copper that mineral content and the preformed omega-3s EPA and DHA But if you're consuming high-quality grass-fed foods your body can convert the ala the alpha linolyneic acid into EPA and DHA and in the case of this bar since it is made with really high quality ingredients and it will correct the omega Ratios in your diet your body can perform, you know the metabolic enzymatic processes that are required to do that So this is the manuka honey Raw cold pressed manuka. This is just what we're using right now I mean we might not use the same brand, but if you guys haven't had manuka honey from New Zealand, it's really delicious The UMF stuff to my understanding from what I've experimented with it doesn't really matter that much But you know, that's one of the reasons manuka honey is so priced You know once this factor goes up which has to do with antioxidants and stuff This stuff can get really really expensive like 70 89 dollars for a jar this size That's the salt that we used for this, but we're gonna source a New Zealand salt So this is available for you guys right now We're gonna have a few hundred of them for this weekend and we're gonna try to ramp up production in the future Right now it's available in that form, you know with everything going on in the world all this craziness My goal was to bring you guys a non perishable survival food. That's affordable that we can produce in mass So that's the goal here. That's what we're doing Let me know if there's any other flavors you guys would like to see and I was thinking of doing like a bar that was just You know tallow and whey, but honestly it didn't taste too good and from a survival perspective You know, I'm not really sure if if people want to really keep with those super strict dietary restrictions So not only does a bar made from only whey and fat not tastes good. It's like super bland. It's not great It's also not nearly as nutritious as this and it's not gonna give you as much energy as this So, thank you guys for joining us today. This is gonna be available on Frankie's free range meat calm I will link the product down below in the description See you guys soon. We're gonna do a live stream later on Frank to final


Hi everyone Joe for jazby's case breaks calm coming at you with 2019 Panini select football team all addition a China Exclusive five box tiered a random team break number three from jazby's case breaks calm There are the tiered teams right there. We're looking for these dragon scale parallels, which look really sharp Now the first we only sold ten spots the first seven spots sold have a chance at the early birds So let's do that first in a different dice roll, and then we'll do the dice roll for the teams All right, so four times two Three and good luck fourth and final time Eric Eric J you are the early bird that catches the delicious delicious worm All right, so there you go now. Let's do oh and Jason you get the last bottom mojo star next to your name Let's keep track of that all right Let's grab the tiered teams And let's do a new let's get some new dice here Let's roll it and randomize names and teams six times four to two one two three four five and six six then final time after six we got Tim down to Eric listen new tab here and For the tiered teams six times and six and final time after six It's my got my raiders up there down to the Jags group Now if you want to trade remember you have to trade the entire group of teams not you can't split them up All right, so Tim with my raiders, and you also have the bills and Vikings in your group Ryan with the Broncos Bangles Colts Eric with your early bird spot Niners Ravens Chargers Zach with the Patriots Steelers Lions Derek with the Cardinals Falcons Dolphins Eric S with the Cowboys Chiefs Panther Saints Jason last bottom Mojo Redskins Rams Bucks Nathaniel Seahawks Titans Packers Ray with the Giants Browns Texans and Eric with the Jags Eagles Bears and Jets. Let's order these alphabetically by team And here are the five boxes right there remember Kind of put that little X and little squigglies right there. So you know, they're all from the same case All right, any trades or should we just roll? All right TWC trade window closed. Let's print. Let's rip Not print try that again Random team. I guess it's TRT tiered random team number three. I do like these tiers I'm not a fan of the clear packaging, but We'll have to we'll have to make do We've got Drew Brees Benny Snell Jr. to 88 That those are the dragon scales they look really sharp Benny Snell Jr. to 88 Patriots Steelers Lions Convo Zach With that Got a Randall Cobb 82 out of 88 For the Cowboys that'll be for Eric Hunter Renfro 70 out of 88 for my Raiders that will be for Or the Raiders on my list here Tim Tyler the Raiders So I might as well just leave up this Drew Brees as well. This goes to the Saints And that's the Cowboys Sheeps Panther Saints combo for Eric S and we've got a nice Lamar Jackson There it is coming into focus right there nice Lamar Jackson for the Ravens That's for the early bird spot Eric J with that field level. That's the shortest of the Prince and its silver Nice start You should slide the card in the back out first There's the Deshaun Watson silver for the Texans That's for Rae No, I've Quinn and Williams held in slow play The dragon scales 43 out of 88 will Greer Panthers Eric S We got dad Prescott Cowboys Eric S 58 out of 88 and It's Tyler Tyreek Hill field level 87 out of 88 field level dragon scale I think the field level dragon scales look the sharpest Chiefs Eric S with the Cowboys Chiefs Panther Saints combo good group Right there and thanks Quinn and Williams for your help. That'll be for the Jets. That's gonna go to Eric J Zach Paul in the house saying there's one left in the eight box revolution nice Let's get that on the schedule won't be until a little bit later tonight.  So we don't have to wait for tomorrow. All right. There is Devo Samuel Niners Eric J early bird group. We've got a Josh Allen Jaguars edition that will be for Eric J 65 out of 88. That's right Eric. You did win Congrats, maybe it might be lagging behind a little bit, but yes, congratulations. Delaney Walker 67 out of 88 Titans That'll be for Nathaniel Murphy And we've got an Adam Thielen 37 out of 88 field level dragon scale Vikings Tim Tyler with the Vikings Sammy Walkins will go to Eric S. Oh nice Josh Jacobs field level silver Maritas Tim Tyler you got Terry McLauren Dragon scale redskins Jason on the board 49 out of 88 Frank Gore Buffalo Bills Buffalo Goes to Tim and the Raiders Bills Vikings combo nice 86 out of 88 and There's Devin Singletary another bill there you go Tim Field level Devin Singletary dragon scale 34 out of 88 and there's Johnny Unitus concourse Colts Ryan Redmond. All right one more box to go And then we'll be moving on to Chronicles pick your team three. We've got a silver Alexander Madison field level Again Vikings Tim Tyler Raiders Bills Vikings hitting nicely. We've got Mitchell Trebisky three out of 88 Dragon scale. No, we have not seen any miles Sanders dragon scale Jason Jaspie He's on the lookout for those and that'll be for who where's the bear is that on my list? Ah Eric J with the Jaguars Eagles Bears Jets combo behind Minshew is Michael Thomas 23 out of 88 Saints That'll be for Eric S and there's Khalil Mack 54 out of 88 for the Bears Again, that's a field level. That's the shortest of the Prince and it's a dragon scale Eric J And the last card here Gardner Minshew Jaguars Eric J There you go boys and girls another nice tiered random team break in the book. That was number three I think we have one more left and that'll be happening with I think Nick later tonight Thanks for watching Joe for Jespeys case breaks comm. I'll see you next time for the next break. Bye. Bye


Ladies and gentlemen a pleasant good afternoon. On behalf of our team taking part in this dynamic conference we wish to thank the government of Argentina for hosting this forum in beautiful Buenos Aires and the ITU for this opportunity to address this gathering. It is with great pleasure that the Commonwealth of the Bahamas participates in this historic World Telecommunications Development Conference, ICT for sustainable development goals. Mr. Chairman the Bahamas is committed to upholding and achieving the sustainable development goals which have been identified as being achievable through the use of ICTs among them ending poverty, ensuring inclusive and equitable quality education and promoting lifelong learning opportunities for all, empowering all women and girls and building resilient infrastructure while promoting inclusive and sustainable industrialization and fostering innovation. The Bahamas is now actively engaged in a process of examining and educating itself on ways to use technology to improve opportunities for the social and economic inclusion of persons as a part of its strategy to creating an ICT enabled smart Bahamas. It was in partnership with the ITU that the island of New Providence was declared a smart island the first in the western hemisphere. That vision has been expanded to a smart archipelago. We recognize that in a smart Bahamas the use of ICTs and cutting edge technology will contribute to an improved quality of life for our citizens and indeed the world. Efficiency of operation and services and competitiveness. We are also aware that the economic, social, environmental and cultural needs of present and future generations can be achieved through such measures. The Bahamas remains committed to the development of sustainable and resilient communities through focused attention aimed at finding innovative avenues in the creation of resilient infrastructure. The need to establish effective emergency communication and build resiliency has become more apparent as the Bahamas in the Caribbean region are confronted with a myriad of issues including climate change, rising sea levels and increased frequency and ferocity of seasonal storms and other weather systems. The need for ICTs to ensure a rapid response capability in times of disasters is clear. The Bahamas is aware that ICTs are critical to both survival and sustainable development. Our nation is currently in the process of ensuring that one of our southeast in islands devastated by Hurricane Irma is rebuilt as a green island with special emphasis being placed on the delivery of quality communication at all levels. As the Bahamas seeks to make transformational strides within its borders, our desires to also contribute to development of this critical sector on the stage. And so the Bahamas has pledged itself to service in this community of nations and offers itself as a candidate for the Council of the ITU in the next plenipotentiary in October of 2018. We commend to your candidature for consideration and look forward for continuing our engagement with you and these and other meetings on issues affecting the development of the telecommunication sector. Muchas gracias.