Welcome back, everyone, to theCUBE's live coverage here in beautiful Vancouver. I'm John Furrier with Rob Stratche. Breaking down all the action here on theCUBE, we've got two great guests talking about OpenSSF. Not SSL, my mind goes there immediately. Get two great guests. Omar Carr, Arastham, general manager of OpenSSF, and Brian Bellendorf, CTO of OpenSSF, CUBE alumni, great to have you guys on. Thanks for coming on theCUBE. I know you got a keynote to give. Top of the hour. Thanks for coming on, appreciate it. All right, the security foundation is super important. Funded, up and running. I saw your talk at CloudNative SecureCon. Security's top of mind. Security and AI are like the two hot major pistons pushing a lot of change in open source. We're feeling it everywhere. Obviously AI will get laid, but security right now is top of mind. What's on the agenda for SSF? Who's involved, who's funding it, what's happening? Well, the openSSF.org website has all of our great funders, the premier members all the way down to some of our public sector friends as well. We're interested in really ensuring that our software supply chain is secure for the benefit of the public good, and that's our mission statement. As we look forward, there's a number of initiatives that we have underway to help ensure that we realize that goal. We've made a number of great accomplishments over the last few months, and I'll probably turn to Brian for some specific details because this is day 10, and I don't know everything yet. What's just on the history? When was it founded? What's the starting point? How long has it been in existence? Brian, did you want to check that? Sure, so the project really got to start in 2020 as it coming together of a whole bunch of initiatives that kind of touched on the security of open source code and the software supply chain after things like the SolarWinds hack, that sort of thing. And then in 2021, we pivoted to kind of a funded operation to allow us to go and be a bit more bold about our initiatives, tell the world about it, but organize ourselves into broader themes. And we looked like geniuses because a few months later, Log4J had a little bit of a problem that ruined a whole lot of people's winter holidays, but that really helps crystallize for us what we had to go out there and do in terms of, I mean, try to find the next Log4J would be perfect, you can't do that, but you can go, what are the risks out there and how do we address those risks and drain risk from the open source ecosystem as a whole? Making software secure the North Star, get the mission, what are some of the challenges you guys are addressing right now? What's on the plate? What's the current goals? What are you guys doing right now? What's the priorities? So some of the areas that I would like to see the organization lean in and some of the areas where we've had some great progress, I think Alpha Omega has done some great work and the idea behind Alpha Omega is that we catch both the most used open source programs on the Alpha side and then we raise tide on security issues on the Omega side and they've made some great strides in some of the automated scanning work that they've done, as well as providing grants through the Alpha side for organizations like the Python Foundation in order to secure supply chain. I think we've also done a bunch of great work when it comes to SIGStore, to S-bombs, to areas such as that which will provide the base foundation and structure to allow us to do more secure things. S-bombs on their own aren't going to fix our problems, but they give us telemetry. We did it all day yesterday actually. That's going to come. Do you work across with other organizations like the CD Foundation had their discussion of CD events yesterday, for instance? How does that tie into what OpenSSF is doing? Brian, did you want to? Sure. So organizationally, there's a lot of overlap. Obviously, being all of us in the Linux Foundation really helps at the staff level. We share a lot of knowledge and understanding of who folks are, but there's actually on the ground a lot of developers who are part of each community who bring ties with them, right? So, for example, there's a tough TUF, which is the unified framework for security that has been a CNCF and a CDF project, and that is something that SigStore builds on top of and solves the references to try to pull together these different aspects of security in the software supply chain. So, CDF as like the home for continuous delivery is critical to that part of the software development life cycle. Lots of other pieces to come together, but that is actually one organization in particular that we work closely with. Yeah. I think a big piece of it, I think to your point, was trying to make sure that S-bombs just don't become a checkbox. Yes, I've done it because, I mean, having lived in that world on the IT side myself and built out SAS-delivered product, you start to look at the supply chain that you have in the S-bom, and as soon as you've gone and produced it, it's out of date, like an hour later or a day later at a minimum. It really, it cannot be, I mean, there are lots of regulations that are being proposed out there for hardening the software supply chain from various governments, and all of them put at the top. We've got to have S-bombs, got to have S-bombs, because the biggest perception is we don't know what we're running in this infrastructure, and when the log for shell breach hit, governments didn't know when they were done, right, in remediating. A lot of them still aren't done because they don't know where it's been compiled as some jar file somewhere. So an S-bomb in theory, even if it just listed the components that are inside would have that value. But even just that listing isn't enough. You want to know are there outstanding CVEs that aren't yet addressed? Are there gaps in the build process that, you know, that could lead to problems not just like log for J, but colors JS and left pad and some of these other supply chain attacks that we've seen over time, so. Brian, that's a great point. Oh, go ahead. No, my apologies. I was just going to add to that. If some of the more advanced things that we want to do in terms of supply chain security, if you don't have the visibility as to what went into the recipe, you're, and to your point, it's all point in time. We were discussing this with some other colleagues yesterday, and I used an example of, hey, an S-bomb's like a speedometer, and our colleagues said it's even worse. It's a picture of a speedometer. Exactly. I saw the pie example too was a good one on stage, but picture of pie, what flavor is it? I don't know. So this brings up the point about data. So I love, I think S-bomb is probably one of the most important concepts that's on the table right now for the industry. It's super valuable. Everyone can see the concept. I get it. What are the critical factors it needs to solve? Is the data observability? Is it marrying it in real time? Is it automation? Is it, it means is it a data problem? What is the problem space to solve the S-bomb? So there's no, by the regulation first. I think too much regulation will slow it down and anchor it and drag it slowly, but what's the core problem space? Because this is super valuable. So I think if we zoom out, and apologies, I've been in security for 20 years, and a lot of these are sometimes rehashed ideas in my opinion. Yeah, okay. If we look back to the sans top 20, or I guess this is now known the CIS top 20, number one has been asset management for the last three decades. If we extend that thinking to our assets no longer being servers and laptops and network kit, but also software assets, that is what the S-bomb seeks to address. Do I have a good inventory of the things that are going into my end product? Provided that, I think once we establish that that's important, which is an important beach head, having consistency in terms of the format, as Brian was saying, to say S-bomb, yes, but what format? What metadata should it contain? Is it going to contain my compiler flags? Is it going to tell me about how my compiler was built? All of these things matter when it comes to security. So I think S-bomb and establishing that as important is the first part of the journey. But then talking about how that evolves and how the data structures are supported through operational process. Now I know I have log for J. Now what, what do I do? Do I turn everything off? Brian, what do you think? I think you said it entirely correctly. I think there's a term that we're starting to float out there called S-bomb liquidity, which is really, how do we make sure that this metadata, through the software supply chain, captures as many of the different artifacts and aspects of its build, not just for reproducibility, but for verifiability and ultimately to be able to audit those kinds of processes, to be able to build dashboards that show you green, yellow, and red, like where are my problem areas? And I think if we do that, we can turn up, here are the open source components that are underutilized, under-resourced, vastly overutilized, but under-resourced, right? That I think log for J caught a lot of people by surprise because they had no idea that they were running it. Can we find those things that appear like problem areas and decide, okay, if we spend 100K to do a third party audit of that component, we then drain billions of dollars of risk out of the whole system. So S-bombs are key, but it's a structure, it's a vehicle, we've got to fill that with something. It's got to move from a mechanism to something more, I don't want to say organism based, like something more dynamic that could adapt to changing conditions, to whether it's data or some environment. That's the feeling we're hearing from people is that, how do you talk about that? Because software, they just want to write software.  Security's got to be somebody else's problem, right? You know, like we pay insurance companies to worry about keeping our homes from burning down or something like that. It's like the rough mental bath that people, most people do, and they'd rather somebody else did it. I think what we're realizing now, especially in the open source space, is security is everyone's problem, but if you don't have the tools to measure it, you don't have the tools to know where the problem areas are or to know when you're improving, you're obviously going to try to write it off and push it to somebody else. If we can build those tools. Are you guys in triage mode right now?  How do you guys take us through the day in the life of like, you guys get on zooms or meetings, like, is it like, tomatoes at each other? It's like, let's do this problem.  Weirdest starting point, what's the strategy? How do you guys look at what to take on? First, is there a playbook? Take us through that. Yeah, I mean, that's a great question. I think a lot of it today, and this is why we've got such a great board of directors. A lot of it comes from both the people producing software, the people consuming software, the other foundations, and we get input from everybody. And we then use our industry knowledge as well as their input in order to synthesize what the order of operations are. Now, prior to me coming on, I think Brian did some amazing work with the mobilization plan to help ratify some of that. Did you want to cover off those priorities? I think it's best understood by being kind of a mix of bottoms up and top down. Bottoms up, like every open source community, it's kind of driven by those who show up, right? And the people who want to work on interesting stuff have shown up and brought us SIGStore and Salsa and something called the Best Practices Working Group. In fact, that work is kind of organized thematically into a bunch of different areas we have under the tack. And then the top down overlay on that is when Logfriar Shell hit the White House asked us, these are some cute experiments. What are you actually doing to solve these problems? So what will it take? So that's when we developed the mobilization plan which said, top down, here's minimum viable product offerings in 10 different directions that we think, again, drain risk out of the software ecosystem, not just open source, but everybody's software. And that's been a useful guide to think about what areas should we go into next, where could we pull some resources to tackle this or that. We'll be updating that plan. We're also building an overarching architecture, if you will, for how these disparate pieces really fit together into the tool chains of the world. In fact, one example of this is GitHub has recently adopted something called NPM Providence, which pulls together SIGStore, Salsa, and a few other pieces to allow you to have full, verifiable traceability for your NPM package back to the root. How are you guys enabling the cross-connect with research? We're seeing, at RSA, we covered a lot of Independence, MITRE has a group in Cambridge, Massachusetts. They're funded, nonprofit, to go in and look at a lot of the securities kind of in the battlefield of what's happening. Try to get the data. Are they involved? I know Amazon's involved. You have the big cloud players. Now you've got other companies that discover here that are called end users. Like, I mean, I guess they're called end users. But they're companies too. They're deploying open source. What's the makeup of the key personas and how do you guys thread for the folks watching that might be independent research, academic too? So one, I mean, as Brian mentioned, being an open source organization, more participants the better. We welcome participants helping along and helping to guide our decisions and helping to provide us input. Personally, the way that I categorize the different actors in our use cases, I think of people producing software such as the Googles and the Microsofts and the Amazons of the world. I think about, you call them end users, we have an end user work group with the Citibanks and the JPMorgans. And the capital ones of the world. I think about our public sector as well. Our governments are deeply involved with ensuring that the direction they're providing their citizens be they domestically here in the U.S., I know we're in Vancouver, or abroad, North America, or abroad, they want to seek input because they recognize that this can only be done through public-private partnership. And then last but not least is the research, be it from academia or peer security researchers in their classical sense. I think we do need to take on input from all these stakeholders. So you're open for business for anyone, basically. Pardon me? You're open for business for anyone to come in. We're open for business. And I think the ideal state that I would like to get to, and I think Brian as well, to achieve that goal of securing our supply chain for the greater good is I want to get out of mosquito swatting. And I want to get to the point that we have the proverbial citronella lamps everywhere. And by that I mean actually ensuring security software that's secure by design. I identify as a software engineer that's been doing security for 20 years. I'm inherently lazy. I want the defaults to be secure. I want it to be very difficult to be insecure. And for anyone that's tried to use the Borrowchecker in Rust, this is the perfect example of that. But I want to enable that more broadly so things like memory safety are just there. We don't have to think about it. The Cloud Infrastructure Code has proven that developers can program the infrastructure. This is super valuable and it's a great initiative. For the last minute we have left, could you guys share real quick, a plug each of you for what you're looking for, audience out there, what you're looking for in terms of support, engagement, put a pitch in or a plug for the organization. What would you like to share to the audience? We'll start at the moment, I'll go with you first. We can only build secure software for the greater good if we're all participating. So I'd encourage everyone to participate. OpenSSF.org is where you can find more information about how to participate. Brian, what would you add? Brian, lay it down. I'd say to all the developers out there, we've got a tremendous number of resources on the OpenSSF website that you can use to be a better developer, to write more secure code, come and consume it, and to all of their bosses out there, give your developers the time and opportunity to do that. I know adding features, fixing bugs or priorities, but you've got to pay off the technical debt, you've got to do the hard security work, or you'll be the next log for shelf. This is a super important initiative. I mean, security has to have the guardrails. They've got to make the developers more productive. Everyone's shifting left as we're talking about at KubeCon and CloudNativeCon, Rob, so it's a good time. Yes, yeah, no, I think this is great, and I think it's, like you said, it has to get out of the swatting mosquitoes aspect of it. And I think this is great that you're putting a roadmap, basically, together to help these companies get there, so. Yeah, thanks for coming on. Brian, real quick, I know you've got a keynote, you're going to walk to it right now. What's it going to be on? Obviously, security, give a quick plug for the talk you're giving. It's about baking security and the defaults and the tools that developers use. How do we make it so when a developer falls out of bed, they do it securely? Awesome. Oh, great to meet you, Brian. Great to see you, Kube. Well, I'm nice to hear. This is the Kube coverage in beautiful Vancouver. Our view at our office is beautiful. We showed you the shot. We're looking at the ocean and the mountains. It's beautiful. This is the Kube getting all the action here at the open source summit 23. Thanks for watching. We'll be right back.


Can you guys hear me? Okay, if you intend to follow the demo, please come and grab a USB key. There's a VM, a background file in one of the folders. And the other folder has background and virtual box installers for the different platforms, okay? So at the top, at the root in the USB key, you're going to see the two folders, one with the background file and the VM, and the other with installers for your platform for background and virtual box. And I'm afraid we run out of keys, so if you can, if you can pass them around once you're finished installing. And essentially what you need to do is from the USB copy the two folders to your laptop. And in one of those folders, you're going to find the installers for virtual box and background for your platform. And in the other folder, you're going to find the VM and the background file that you need to start the demonstration. So I'm going to give everybody five minutes to get ready. And since we only have 40 minutes, I'm going to start in exactly five minutes, okay? So if you need assistance with the VM, installing the VM, please raise your hand. There's three or four people in the room that can assist you, okay? So to the people in the last row, is that a good size for the terminal? Can you read the perfect? No, we are out of keys, but we are going to be passing them around. And essentially once you have the VM and the virtual box and background installed, you just need to change the directory to where you put the VM and the background file and do background up and background SSH. And it's going to send you into the SSH to the VM. And you're ready to go. Essentially you should get something like this, okay? Thank you. One more key here. So again, in that USB key, there's two folders, one with the VM and the background file and the other with the virtual box and background installers for the different platforms, for windows, mac, linux. One USB key here available. Here you go. Again, if you need help with the VM, raise your hand and there's people around here who will be able to help you. So okay, let's get going. Again, if you need help installing the VM and the background and virtual box, raise your hands and James and the other group of people will go around and help you. This is the agenda for today. And essentially, we're going to cover the three use cases that were implemented in this integration between Nova, Neutral, and Designate. And those three cases are shown there. I'm really not going to go over the slides themselves a lot. I'm just going to show you the agenda. We're going to review some two or three slides and then we are going to be showing how this thing works in the VM. That's why it's important for you to have the VM. And essentially, the first thing that I would like you to do is if you are ready, create an instance. And these are the commands that you need to execute, essentially. You need to export to the environment the credentials to access the OpenStack APIs. Do a Neutral List. In that Neutral List, so essentially you do also OpenRC User 1. Once you do that, please do a Neutral List. You're going to see that that user has three networks. For this first example, we're going to use Tenant1 Network. So essentially, you need to do a boot command. You need to specify the image, the flavor, and the network that you're going to be using for this boot. And as you can see, the VM starts really, really quickly. So again, those are the commands. Essentially, you're pulling out of Nova the information. You need to boot the instance. And then you're booting the instance using the Network1 Network. I think we need some help with the VM on this side of the room. So what we did during Mitaka, during this pass cycle, essentially was, in reality, was very simple. We added attributes to three neutral resources. We added attributes to ports. And essentially what we did is that in Mitaka now, ports have a new attribute associated to them, which is the DNS name attribute. And essentially what you do with that attribute is that you assign a valid DNS label to your ports. We also added an attribute named DNS Domain to your networks. So with a combination of ports, DNS name plus a network DNS domain, essentially we take that information, we put it together, and we push it to the external DNS service. And in this case, in this example, the external DNS service being designated. And the third attribute, the third neutral resource where we added attribute was floating IPs. And in the case of floating IPs, we added both a DNS name and a DNS domain attribute to floating IPs. And with those two together, again, we put them together and we push the information to the external DNS service based on how you configure the integration between neutral and designated. So the first example, the first use case that we implemented was one in which we create a port, and then when we associate a floating IP to that port, the ports, DNS name and the network's DNS domain are going to be pushed to the external DNS service with the floating IP address that was associated to that port. Okay? So the picture looks a little bit like this. And here I'm showing the complete integration between Nova, Neutron and Designate because on top of adding attributes to Neutron, to Neutron resources, the other thing that we modified was the way that Nova allocates network resources to instances. And essentially what we did is that when Nova is creating an instance and it's allocating network resources for the instance, it's going to use the instance's host name and it's going to assign that host name to the ports associated to that instance, the ports that are created by Nova for that instance. It's important to mention that when we say the instance's host name is not the same thing as the instance's display name. The instance's host name is a sanitized version of the name that the user gave to the instance to the instance's display name. It's a sanitized version, sanitized to be useful as a valid DNS label. So essentially what happens is that Nova creates a VM. During the VM creation, Nova creates a port and associates the instance's host name to the DNS name of the ports being created. So in the middle of the slide, what we essentially are seeing is the result of that port creation. And as you can see, the port gets a DNS name with the sanitized version of the VM highlighted in red. And then the port has a new attribute also called DNS assignment, which essentially shows the DNS characteristics of that port. And those characteristics being the host name, the IP address associated to that host name, and the fully qualified domain name, which is the instances plus... the instance's host name plus the domain name. So let's find out... So let's put... Now a list. So let's look at our instance that it's active and running. So let's find the port associated to that instance by Nova. Let's do a port list, filtering by the instance's device ID. And now let's do a port show for that port. And as you can see, we actually got the DNS name attribute associated to that port by Nova, and we got the DNS assignment. So now let's create a floating IP with that port. We are going to associate to that floating IP the port that we just created. And we just created the floating IP. Shoot, I forgot a step, which is for the network. Let's delete that floating IP. So in order to push the DNS information to designate, to the external DNS service, what you need is that the port has a DNS name attribute associated to it, and also you need that network that port is running on. It needs a DNS domain associated to it. So that's a step that we didn't do. So let's do it again. So let's do net update. We're going to take the network that we are using for that instance, and we are going to associate a DNS domain to that network. And the example we are using is mydomain.org. So the network was associated. Another step that you need to take, obviously the domain needs to exist already in the external DNS service. So you would need to type something like that, open the stack zone, create your email address, and the name of the domain. My-domain.org. In my case, I already did that, so that's already configured in designate. So the very next step would be to create the floating IP with the port associated to it. What happens when you forget a step in a live demo? So we are going to attempt our boot again. So our instance is up and running. Let's find the port that was associated to it. Let's create a floating IP. And then we should do a record set list. And as you can see, the floating IP information was pushed to the external DNS service with the DNS name and DNS domain associated to the port and the network that we use for the instance. Are you guys being able to follow the thing in your VMs? Okay, perfect. So that's use case number one. In use case number one, we want the DNS information to be associated with the port and the VM. Whereas in use case number two, we want the DNS information to be associated with the floating IP. With the idea that you publish that information in the external DNS service, and then you can change VMs. It doesn't matter what VM you're using. You're going to preserve the same DNS information in the external DNS service. So let's do that. Let's create a floating IP. And in this case, we are not going to specify a port ID, right? Because now the DNS information belongs to the floating IP. I forgot. But in the floating IP creation, we are going to specify a DNS name. And let's call it myfip and dnsdomain.org. As you can see now, the floating IP shows that it has DNS attributes associated with it. The DNS name and the DNS domain. And we should see that information in the external DNS service. We created a new record for that floating IP. The other thing that we are creating also is we are creating PTR records, reverse lookup records in the external DNS service for you every time we create that. So essentially, let's open another terminal. Begrant SSH. Is that good enough? In this case, what we are going to do is to sign in as admin. Okay? And once we do that, let's do an open stack sound list. And as you can see, we are creating reverse lookup sounds for you. Specifically for the floating IP, it's the 255 sound. The last row in that table, it's the sounds that we are creating for you. Those sounds are created by the integration. You don't need to create them, okay? And it's configurable whether you want PTR records or not. You can say, I don't want reverse lookup. In that case, these sounds and records are not created for you. And the idea here is that the PTR records go under an admin user, an admin tenant, an admin project, and that's where we are creating the PTR records for you. So let's take a look at open stack record set list. Let's look at this specific sound. And as you can see, there you have the reverse lookup records, the PTR records for the two floating IPs that we created. The floating IP associated to the instance and the floating IP that we created on its own. Finally, there's a third use case, and that use case is where you want the port and the port's DNS name and the port's DNS domain, the network's DNS domain associated to that port to be published directly to the external DNS service without the need to associate a floating IP. And this use case is one where you have a network, a provided network, wiring your deployment in such a way that you are routing those ports directly to the outside. So in that case, you may be interested in publishing the DNS name and the DNS domain associated to the port and the network directly to the external DNS service. For that to happen, you need to create a network. It can be a flat network, it can be a VLAN network, or it can be any of the tunnel-type networks, VX, LAN, and GRE. The only condition is that the segmentation ID associated to those networks has to be outside the range of the tenant networks. So if you enable the integration between neutron and designate, and you create a network with a segmentation ID outside the ranges assigned to the tenant networks, the integration is going to assume that you want to publish that information to the external DNS service and it's going to push that information to designate. Does that make sense? So let's run an example. In your... So to create such a network, we need admin privileges, so please source, do the following command, openrc.admin, and we are going to create a network outside the... In this example, this is a simple example. I'm using VXLANs. That's what it's configuring in your VM. So I'm going to create a VXLAN with a segmentation ID outside the range associated to tenant networks. In this example VM, we assign the range from 1,000 to 2,000 for tenant networks, and we are going to create a network outside that range. I'm saying create type VXLAN, segmentation ID 2016, and it's going to have the DNS domain, mydomain.org, and I'm calling that network public, okay? I'm also associating two subnets to that network, one IPv4 subnet, and one IPv6 subnet. So after executing both commands, you should have something like this under your user1 user. As you can see, there's a public network with IPv4 and IPv6 ranges. So let's create a variable with the ID of that network, and let's put an instance. I'm going to call it otherVM. So our otherVM seems to be working fine, let's see. Yep, as you can see, we created for you the IPv4 record and the IPv6 record in the mydomain.org, and we also created the PTR records for you. So there you can see the PTR record for the IPv4 address, and a similar thing for the IPv6 PTR record. Okay, it's the last row. As you can see, the record is active. So how do you configure this thing? So let's go to the... The slides really walk you through the commands that we have executed and shows you the different use cases.  How do you configure the integration between Neutron and Designate? So the first thing you need to do, in Neutron.conf you need to do essentially three things. You need to configure a DNS domain. DNS domain is a configuration parameter that exists in Neutron prior to developing this integration. Its default value is OpenStackLocal. Essentially, if you want to enable the integration part between Neutron and Designate, you need to change that DNS domain parameter to something other than OpenStackLocal, whatever you want. And that way you are signaling that you want to enable OpenStackLocal, the integration with DNS. You also need to specify the external DNS driver, and in this case we are using Designate. And this is important. The way we implemented this, we implemented this as a pluggable driver, and we Designate being the reference implementation. We essentially defined a common API for the external DNS driver API. So with the idea that in the near future other people are going to be implementing other drivers for external DNS services. For the timing, the only reference implementation is Designate. And there is a Designate section in Neutron.conf where you specify the URL of Designate. This is specific for Designate. The admin credentials that you want to use remember that we use an admin user to create the PTR zones and the PTR records. Those are created for you. And finally, we specify whether we want a reverse DNS lookup or not. If that variable is set to false, you are not going to find the PTR records. They are not going to be created. And the IPv4 and IPv6, the last two parameters essentially specify the sound prefix size for the reverse lookup records. For both IPv4 and IPv6. The other thing where you need to change something is in the ML2 plugin configuration file. And essentially there is a parameter extension driver that allows you to configure the DNS extension driver and other ML2 extension drivers. In this case, we only have DNS configured, but if you regularly run a DevStack and configure DevStack with Neutron, you will find that, for example, DevStack configures port security also in that extension. And those are the knobs, those are the parameters that you need to play with to configure the integration between Nova, Neutron, and Designate. All this information is contained in the slide set, in the presentation. And the other thing that is important to mention is that we did our best to document this. So we added a chapter to the OpenStack networking guide and all this information is explained in detail, each use case is explained in detail in that networking guide. The last thing that I want to mention in this presentation, the very last thing I want to mention is some performance consideration, and this is for use case number three. That use case where you publish the port and the port information directly to the external DNS service. And in that case, if in Neutron, the port binding extension is configured, when you create the instance, Nova is going to execute one additional port update operation on each port associated to the instance. Okay? Therefore, before adopting this use case widely in your deployment, please make sure that you take this into consideration and see what the impact might be in your instance boots times and expected performance. In the testing we have done, it's really not significant, but that changes from SLA to SLA, so make sure that you take that into consideration. And again, this is mentioned in the documentation that we created for this. So I think we are right at time. So if you have any questions, I'll stay here for as long as you guys need. Come to the front and I'll try to answer all your questions. Thank you so much.


Everybody forced here ripping 22 and 21 bowman sterling baseball hobby four box mixer Number 10 random team style results can be found at late sports cards.com anytime. Let's get started Stop illegal cardinals. I mean the results link is in chat the cardinals are Jason H has met Cardinals combo spot To box to 2021 sterling first. Yeah games. I had I guess Wander prospect base refractor auto rays Harry Berto Hernandez 99 to 150 Marshaw Tyler Stevenson Kenzie Patino base auto Marlins Jose Salas Now castle rookie drew waters. Yeah, it's two of 2021 and two of 2022 Neil Cruz ready singer base auto brewers headbert Perez Shea Hendrick. Come on stittem Joe Adele rookie refractor Phillies Alec Bum 182 of 199 and base auto Dodgers honey old Choi Wee's Langeleers base auto angels read embers Richmond and Pearson. All right second box for 2021 Personals are full tonight. Everybody got more personals 10 a.m. Eastern tomorrow with Kenzie It's a Sunday daytime person is you're from 10 to 3 that base auto white sox who elk we cess this It was redembers Ryan Mount Castle drew waters Ibrator Gilbert rookie refractor D backs Geraldo Perdomo 172 of 199 base auto rays Nick Bitsco Lacey Cabrion Hayes Just a Mackenzie nice color coming up. Patino is Royals rookie Brady singer 47 of 75 Royals and a Red Sox Black atomic triple auto Jeremy Durand Jeter Downs Tristan Kossus 10 of 10 Awesome card red Sox go Anthony P Durand Downs and Kossus Here's that Thomas Another black atomic here is angels auto Alexander Ramirez two of 10 Two black atomics in the box great box Alexander Ramirez angels two of 10 last pack of 2021 Refractor Giants Hunter Bishop 184 of 199 and base auto rays Harry Bertow Hernandez Okay, two 2020 twos now. I'm ready for the Jags game. Is anybody's not ready for the Jags other than Titans fans? Everybody wants a Jags to win As they should they're playing good ball right now Base auto Mariners Jonathan Classe. All right, Carl needs a Brian Acunha a la Cruz base Pacheco Sheets base auto Rangers Luis on a la Cunha Nice hit Rangers there Veerling and Jeremy Pena rookie base Juan base God cutter Crawford rookie refractor Red Sox 218 of 199 Orange auto Ellie de la Cruz 27 of 75 Congrats Reds He goes since he congrats congrats. Yep. Has an Acosta de la Cruz a speckle Reginald presciato Cubs 20 of 99 There's Marco a speckle and wave auto Luis Rodriguez Dodgers two of 125 Another good box is Sterling Grats Dodgers on that one press the auto warming Bernabelle Hedberg Perez base auto brewers God redemption yeti capi Marlins prospect auto base auto got a Sterling tack Jason Dominguez 47 of 99 Yankees All right, Jonathan. Let me Text management here must have been days off for people Jonathan. So I'll text and see what's up last box Then an auto recap. Oh, it looks like It is a Yaro Pomari is out of for the Giants for a 50. You go Giants nice card Cunha Harry Ford Raiders got a stop. There's a stop rookie base de la Cruz Quintana Miguel Blyce Red Sox base auto Siano Conor Wong Yeah, it might be something you need to talk to PayPal about because there's not like a if you don't have an order number Never got a confirmation from us, and I never went through to us Padres base auto Victor Acosta If that I would think I just don't know 100% last two here ice gold rookie Bobby wait, Jr. Royals 19 of 50 That's a big card in this four boxer great four boxer. You okay see Mag that base auto Dodgers Jose Ramos I'm just not a hundred percent on that Jonathan That's what it sounds like it is if we never got Base auto Tigers Isaac Pacheco once that guys Your autos you've got Ramos Dodgers Pacheco Tigers Acosta Padres Blice for the Red Sox a gold pomare's Giants to 50 Yeti Capi redemption Marlins Brewers Heather Perez wave Luis Rodriguez Dodgers to 125 Rangers Luis and a la Cunha Mariners. Yeah, it's a class a raise her to Bertha Hernandez and Nick Bitzko White Sox you'll acquiesce, but it's angels read Detmer's Dodgers honey old Choi Brewers headbert Perez Marlins Jose Salas refractor auto raise her to Bertha Hernandez the 150 and Black atomic auto to 10 Alexander Ramirez angels the orange Allie de la Cruz auto 27 of 75 Gold rookie Bobby Whit jr. 19 of 50 Great cards there and a nice black atomic triple red Sox Jaren Durand Jeter Downs and Tristan Kossus Hoping for big things from Kossus and Durand still All right, that'll do it. Thanks again, everybody. I was from now on this one was from 2021 by the way You got more baseball Coming up


For those who were here during the first panel session, I think we have a challenge. First, they were right on time. Second, I thought the the conclusions and the answers were very appropriate as a prelude to our session. Number one, we're focusing on before the event and that's the name of resilience. You have to prepare for the event, adapt, change the attitudes of the people and the behavior and then transform so that we truly become resilient. The second point that I think came out loud and clear in the first session is whether it's a four to one ratio between the private sector participation having one and the government having four. And I think that's a figure with Katrina or what have you. The reality is in a developing country like the Philippines, they have to invest before the fact and they have to do substantially more, in my opinion, rather than four to one and in many ways, Mr. Mayday of PDRF brought that up. And secondly, the PDRF is a private sector conglomerate. There's many more that can participate and we have to motivate the private sector a great deal more to be devoid of partisan commercial competition when it comes to resilience. And I think you know what I mean in that respect. I was scheduled or rather I was scheduled on a video to listen and I was supposed to harangue you for seven hours, no seven minutes, but in reality I think I would have done you a disservice because I think it's more important that we do it in the context of a greater brief summary as a background and then we'll have more discussion and that's, I think, the name of the game. So, and before I've seen, let me just say I'm delighted that Secretary Singson is here because I consider him a role model public servant, despite the fact that he went to the wrong school because he went to La Salle and I went to Ateneo. And second, we know the difference between North and South, but Mr. Quisha and Mr. Secretary Singson wouldn't know that. So let me show you two slides here that we have that basically says that that's the name of the game as far as we can get its concern, prepare, adapt, transform. And we had this video that basically said, and Mrs. Loisaga there helped me prepare it, but in essence it was the Zulek Family Foundation, the Romulo Foundation and the Manila Observatory. That has worked on this project, this three-year project that we are now starting as of last July, but we'll bear fruition hopefully in starting January. Now we all know the Philippines. It's rich natural resources, et cetera, et cetera, thriving economy, and we claim we're also the fastest growing economy in Asia. And we can argue that point, but we are moving forward. Now in 2013, the figures will show 80% of all deaths from disasters were in Asia, of which 7 to 8,000 of these deaths were related to the Philippines, Typhoon, Yolanda. And it affected millions more, and indeed the country suffered economic damages equivalent to more or less 5% of GDP. Now disaster experts at the UN University have identified the Philippines, a second only to Vanuatu in 2014 in the context of vulnerability to disasters. Switzerland also categorizes as number two, depending on what you look at. So if you look at our large population and our institutional weaknesses in coping and long-term adaptive capacity, persistent poverty, income inequality, inadequate infrastructure, and indeed environmental degradation, it makes us extremely vulnerable to earthquakes, and I say that again, earthquakes, volcanic eruptions, tropical cyclones, and floods. Now global climate change will impact the Philippines in many ways. Atmospheric scientists note that while the number of tropical cyclones making landfall has not changed, we have had more super typhoons and extreme rainfall events in the last 30 years than ever before in our history. And the rise of sea levels all over the country compound these events, three sea levels, which is about three times that of the average. Now nine out of 12 largest cities are built along the coast, which is to be expected because we are an archipelago, and more people live in cities today than ever before. And by 2015, these millions will depend on them for economic survival, and metropolitan Manila is expected to include 24 to 25 million people. That's a phenomenal amount of people that we have to worry about. Again, think about earthquakes. Now we're building our cities in low elevation coastal zones where we also draw water for domestic and industrial use. And the shape and length of our coast, subsidence tides and sea level rise are exposing our cities to floods and storm surges. Now rapid economic growth is no match to our urbanization, environmental degradation, weak governance systems and high income inequality. In 2011, and this is an interesting figure, the increased wealth of top families equaled 75% of the increase in annual GDP, while 42 million live on less than $2 per day. The poor bear at this proportionate level of risk and rely principally on each other for support during disasters. And we have not learned from history as records show. Many places like Leyte and Samar have been hit by extreme weather events over the last 130 years, and they're shocked we've even shown pictures of it, of the past. And we continue to build our towns and cities in the same sites, and as has been explained earlier that we're trying to change that attitude. Again, it's attitude and practice. As our environment changes, our society and economy should also. We need to prepare for hazards that we know, adapt to changes around us, transform the trajectory of risk, and prepare for alternative futures. The private sector, as I said earlier, is uniquely positioned to drive this transformation. And the resilience partnership that we are envisioning for the next three years will try to lead cross-sectoral dialogues to build a shared understanding of resilience in terms of preparedness, adaptation, and transformation. And I think at the end of the day, this is what we're talking about today. Now, I am the moderator, and I shall try to also time them so that they will speak five minutes only each, as were the previous speakers. So forgive me, but time management is my concern because we cannot lose face compared to the other panel. Let me just say that you have before you the program, we have a distinguished set of panelists, including one from this other university called LaSalle. And let me just say that, let me read out, besides Secretary Singson, we have Dr. Charles Anderson and Ms. Bernier-Toth. And one who is associated with me, Antonio Yulo Loisaga, and it shows you what they are. So without further statements from me, you've heard enough, and I hope I spoke less than seven minutes. May I ask the first panelist, Secretary Singson, to give his comments. Thank you very much. And I would welcome, even after Secretary Singson talks, if there's a question, they can ask him because he's the government, let him answer all the government questions. That's fine. Thank you very much, Secretary Romulo. Let me just say that even before Typhoon Haiyan occurred, we were already in the process of building resiliency in the program of government. In fact, we were ready to start piloting the concept by building, identifying in each municipality in the disaster prone areas, specifically on the eastern seaboard, either a school site, a hospital or a municipal structure to be able to come up with a resilient structure, meaning to us engineers, when we say resilient structure, we mean that that building should be functioning during and after an event. So the design has to be changed. You have to provide that particular evacuation center with enough backup power, telecommunications, as well as backup on the staff. Because as you can see what happened in Yolanda, the hospital personnel themselves were victims. Police themselves were the victims. So we had to bring in people from all over the country to be able to operate these facilities. So when we say resilient structure, not just physically, but also the staffing that will back up. So when this Yolanda happened, it provided us an opportunity to be able to reconstruct, rather than go on a pilot mode, we decided to go full blast. And that's why the position taken by the president was build back better. Now, having said that, we have part of what we've done is agree within the national government that there should only be one agency. How many minutes do I have? Is that five minutes? Or is that somebody calling you? Anyway, the build back better policy in fact came in place. The issue of flood management, we already agreed in the cabinet that when we address flooding, it cannot be based on political boundaries. A river basin system has to be addressed in its totality from upstream to downstream. So the approach to flood management, water resource management was brought to the president. Mr. President, there are some 30 agencies involved in water. We have to do institutional restructuring of these 30 or so agencies. And that's why the president approved the creation of a water board, a cabinet level water board, so that we address water resource management in an integrated and coherent manner, rather than each agency doing its own thing. I'll stop at that. Thank you very much. First, I'd like to thank Ambassador Rahman as well as Director Hendrickson for inviting me to participate in this workshop. Peace Wins America. We're an organization about six years old. As a result of working with USAID for about 20, 30 years, we realize that disasters can stop economic growth. Disasters can result in lost lives or in leadership, especially within the Asia Pacific region, where about 60% of disasters happen. My last post was in Japan, and I realized that Japan and U.S. are the big responders. Complimented by Australia, if it's in the South Pacific, and often UK. Sometimes Korea, in the last few years, it's now China. But the two big responders are U.S. and Japan. How to increase their efficiency through cooperation? Knowing more about each other, we began a program in 2009. We were funded by the Japan Foundation as well as Carnegie, and we together, or we brought together the Japanese militaries, NGOs, their Gaimushō or their Ministry of Foreign Affairs, their private sector, meeting with USAID, our military, our NGOs. So they got to know each other's limitations as well as capabilities. So they knew the strengths of each other, and they knew the weaknesses, they knew the timelines of each other. This, we thought, would strengthen our bilateral alliance. And last year, we put together a report, which you're welcome to read on our website, or you could contact my colleague, John Ehrenfeld, how the militaries can work together, how the NGOs, how AID can work with JICA. We then approached the Asakawa Peace Foundation and Carnegie and Japan Foundation and said, we want a third partner, the most vulnerable within Asia Pacific. We want to partner with the Philippines. The Philippines we see is not only a host nation or a recipient nation, but also can be a donor nation.  They have probably the best community organization. So we envisioned the three of us responding to other ASEAN disasters. So that was the vision of our 2013-2015 Japan-US Philippines Civil Military Disaster Preparedness Initiative. Concerning Haiyan... You have 30 seconds, huh? Really? Okay. We responded to Haiyan, and as you can see, the second point here is our partners in that initiative. The difficulty in Haiyan and how we can make this more resilient is on the point coordination issues. There are four pillars, as you can read. DSWD is response, preparedness is DLIG, local government. How to get them to communicate together. This is the issue. When they set up operation centers, get them to set up a joint operation center. The UN wants to set up their own. Every ministry has a tendency to set up its own. The military sets up its own. If we want to have resilience, we have to change these policies. All the ministry said they need to know more about AFP. How AFP or the armed forces of the Philippines can complement their efforts. AFP is strong, but how can they work with DSWD? DSWD needs to know the capabilities, the timeline, the weaknesses. Then, how do we integrate with the U.S. and with Japan? The U.S. military, they were there before it happened, and they were there two days after. The Japanese are very slow. Well, let's build on that. Let's have the Japanese focus on resilience. You've gone over time, but your points are very well taken. I think we can bring it up during the question period also. Thank you. Michelle Lee. Thank you, and I will talk quickly. I would like to thank CSIS and the U.S. Philippine Society for the opportunity and the honor to be here. I'd like to provide some reflections on how the U.S. worked with the government of the Philippines to respond to Typhoon Haiyan and what we have done and will do and are doing to prepare for the next disaster, because as we have heard, there is always the next disaster. The U.S. government began preparing for Haiyan before the storm made landfall. The U.S. State Department sent out warning messages to U.S. citizens. The Peace Corps moved its volunteers out of harm's way, and our embassy in Manila convened a U.S. mission-wide meeting to coordinate our preparations. USAID mobilized its Office of Foreign Disaster Assistance Team, and in partnership with the embassy, coordinated the whole of U.S. government response and relief operation. Here in Washington, our principal deputy assistant secretary for East Asia Pacific Affairs met with the Philippine ambassador and others to put into place an outline of what became a major relief operation that saved countless lives. One of the State Department's highest priorities is protecting the safety and security of U.S. citizens abroad. The Philippines is home to hundreds of thousands of U.S. citizens, many of them dual-nationals. Haiyan's impact quickly made it clear to us that a major U.S. government response would be needed. And let me highlight some of the actions that we took, and our consular officers on the ground in the Philippines took in particular, in Manila, in Leyte, and elsewhere. We helped coordinate transportation for more than 21,000 victims, not all of them U.S. citizens, obviously, including hundreds of U.S. citizens, out of Tacloban. Embassy teams helped U.S. citizens board aircraft, and upon arrival in safe havens, arranged emergency shelter and medical care for those who needed it. We investigated and resolved inquiries from frantic relatives in the United States who were desperate for information about their loved ones in the affected area. We had over 1,200 inquiries all told. Concert teams deployed, when they could, to Leyte and Eastern Samar to search those disaster zones, we literally sent people door to door or if there was a door there to knock on. They located hundreds of U.S. citizens and helped the survivors contact their loved ones in the United States to allay their concerns. And not least of all, we assisted the families of the 10 U.S. citizens who died and the presumed fatalities as a result of the typhoon. And finally, we worked with the Department of Homeland Security to expedite immigration visa processing for the families of U.S. citizens who had been affected by the disaster. As an example of our coordination with the Philippine government, Philippine officials contacted the embassy for help in transporting nine orphan children from the typhoon zone who were in the process of being adopted by U.S. families. U.S. and Philippine officials ensured that these children were transported to Manila on a U.S. military flight as soon as possible. Our hearts go out to the thousands of families who lost their loved ones in the storm and the 4.1 million who were displaced. The United States shares close historic and people-to-people ties with the Philippines, and we were among the first international responders. Our embassy in Manila served as a center for coordination and communication with other agencies, Philippine authorities, private organizations, and international partners. Once the storm hit, the State Department, USAID, and the U.S. military working closely with the U.S. Embassy in Manila, coordinated a swift and effective response. USAID mobilized food assistance to 3 million Filipinos and sheltered and medical supplies to tens of thousands. The U.S. military quickly deployed major resources to the Philippines, which were essential in the initial relief effort. At its peak, U.S. military efforts included more than 13,400 military personnel, 66 aircraft, and 12 naval vessels through which the United States delivered more than 2,495 tons of relief supplies to about 450 sites. The State Department set up a task force in Washington to monitor and report on developments, identify and overcome obstacles to both relief and evacuation efforts, facilitate coordination with other agencies, and respond to public inquiries. This effort managed thousands of phone calls, kept U.S. citizens and their loved ones informed of what was happening, and received inquiries about effective U.S. citizens. This domestic response allowed embassy staff to focus on the on-the-ground activities that they needed to do. The idea of resiliency is something that we in Consular Affairs take very seriously. We talk a lot about it. So I was pleased that we had the chance to come here and talk today. We are constantly striving to build the resilience not only of our consular teams, they're my responsibility, but that of our international partners. The State Department believes that this is especially important in a country such as the Philippines that is so unfortunately prone to natural disasters. A key element of resiliency is preparedness, as we have heard, and the United States has a long-standing partnership with the Philippines on disaster response. We work closely with a range of government officials in the Philippines to help strengthen their abilities to prepare for and respond to natural disasters. For example, under the visiting forces agreement, humanitarian assistance and disaster response activities are major elements of our frequent joint military exercises. These efforts ensure that the U.S. and Philippine personnel, both military and civilian, can work together when disaster strikes. Helping countries prepare for natural disasters ensures our partners are better able to manage and recover when they inevitably occur and minimizes the human suffering when they do. We look forward to continuing this partnership with our counterparts in the Philippines. Thank you very much. Thank you very much, Michelle. Mrs. Lozaga. Thank you very much. Good afternoon, everyone. And I'd like to thank the Carlos P. Romano Foundation, the Swedish Foundation, the U.S. Philippian Society for allowing us the opportunity to be part of this event. I'm from the Ateneo, so I hope you'll be a little bit lenient with me, Ambassador. For those of you who don't know the Manila Observatory, we were established almost 150 years ago by a fellow named Padre Faurá, who was a Jesuit priest who was the first leader of the Pagasa and the FIVOX, which is the Seismological Observation Bureau in the Philippines. Recently, Ambassador Goldberg mentioned at the first joint committee meeting of the U.S. Philippine Science and Technology Agreement that the first scientific collaborator in the Philippines was the Manila Observatory and he gave the year 1901. Actually, it was 1898, I believe, or whenever the Battle of Manila Bay was, because Admiral Dewey had sent for weather information from the Manila Observatory. The Spanish director of the observatory gave him the information, it was immediately stripped of a citizenship and he became a stateless person. Since Spain said he was a collaborator with the enemy. That's a very quick review of the concepts that we're talking about today and I'm using today the USAID definition because there is a national definition, I understand, from the national imperative institutions that are involved in a shock or an event. But in the definition for developing countries, the USAID has actually made it a point to mention chronic vulnerability, which is in fact the condition of many of developing countries, including the Philippines, and the ability to facilitate inclusive growth, once in fact resilience has been met with people. And the key words in both definitions are in fact vulnerability, which pre-exists any hazard from hitting a country like the Philippines. What do we know and what did the Manila Observatory do during Haiyan? We did three things principally. We produced the science, we issued a report on November 7, which mentioned among others the strength, the speed, and the magnitude of the possible disaster. The information was available from all international sources. We collated, we run our own models and our tracks. This is the NOAA image that was released and we issued the report. We are not a warning agency and therefore we released it to our partners among the mayors who in fact used it in their evacuation plans. Consequently, they did encounter and they have zero casualty in their municipalities. The second thing we did is we worked with the military and I'll speak a little bit more about that later. The boundaries of the debris field, which would in fact help us determine where the hotspots were for search and rescue. And I'll talk about that in my succeeding slides. Immediately once we had the computation of the hazard, we looked at the tracks and we mapped poverty incidents in the country. Really looking at poverty as part of vulnerability of coastal populations as well as inland populations. As you see there, some are in fact, as Dr. Garila had mentioned earlier, is among the poorest provinces in the country. We also looked at the possibility of inundation of low elevation coastal zones. This information is in fact available and we were able to overlay where potentially the wave might hit. Next, as you can see, the entire area built up of Tacloban is in fact within almost entirely within the five meter low elevation coastal zone assessment. And a post disaster needs assessment program for the AFP. This is principally with J7, the civil military unit of the AFP which is located all over the country. One of the first people to hit the ground after Haiyan was a young major, Major Ruben Ginobay who had seen extensive experience in Basilan. In my interviews with him, he was asked early in the morning to deploy immediately to Tacloban and General Suerte, head of J7 said, give us an assessment. These were his exact words. There's nothing to assess. Sir, send everything. He said he had never seen the extent of devastation that he saw in this area. In fact, all the years that he said he worked in Basilan and he fought in Basilan, he had never seen the amount of deaths that he saw in this area. The other point that we tried to raise, in fact, working with the AFP was where was the search and rescue operation. In interviews with governors and mayors who in fact sent their very capable search and rescue teams, the response was common. There was no organization on the ground for search and rescue. They were sent wherever they could go in order to conduct their own separate search and rescue operations. So this in fact, in conversations with everyone who talk about relief, search and rescue is the first order of the day. There was no coordinated search and rescue operation. The work with the military really centered on, not with the work with the US forces, but the work with 12 foreign militaries who in fact offered their aircraft and their goods and landed these in the Maktan Air Base. This became the joint center for all the foreign militaries working with J7 and the Air Force and in fact hosted all these 12 foreign militaries and their aircraft. Two things are notable about this exercise. When we arrived there on Wednesday, which was five days after, there was no setup in the office. There were no facilities and immediately with the help of other militaries and the UN and the World Food Program, an operation was supported basically by basic tables and chairs, computers and connections. If you look at the air condition on the right-hand side, you'll see a wire sticking through that right beside the air conditioning that brought in the Wi-Fi router. I was there when they actually drilled the hole into the wall. To make the router actually connect and provide Wi-Fi operations. You'll also see a young man who is obviously not a Filipino in that picture. That young man is a fellow by the name of Luke Beckman. He works here at the American Red Cross and the Manila Observatory brought him in to embed him deliberately with this group under the command of General de Veratuerda and Colonel Santiago of J7. Luke was among the first people who landed in Haiti right after the earthquake. Luke actually set up the logistics coordinating mechanism for all the 12 foreign militaries and the AFP. They were flying out up to a million pounds of goods a day out of this operation, all with the help of a Google Docs system. I could see who was taking off and landing hourly at my room in Manila. And basically he approached all the different foreign militaries together with the Filipino AFP and every day they would set up two meetings in order to know who would fly out the next day and carrying what and to where to the three different operating airfields in Guywan, Tacloban and Armok. So I think that this is a very little known story but in fact this particular operation supported 12 different countries aid to the Philippines and one should also note that none of these countries first donated the services of their aircraft. The negotiations for the use of aircraft were done on the ground in Magtan. Then it was cascaded upwards to the different embassies. The generals and the colonels who run this operation individually negotiated with the countries before the countries sought permission from their State Department or their equivalent of the State Department. So all these aid actually happened on an ad hoc basis and I think that's something that we need to address when we look at reforms in the AFP and collaboration with foreign militaries. The last bit of my presentation is the question really that people ask. Can a Haiyan happen in Metro Manila? And the scientists have answered certainly. Manila Bay is shallow, it is also a concave bay and definitely much of Manila is below sea level. So certainly Haiyan is possible in Metro Manila. However, and I think this is something that the Ambassador has mentioned, we worry most about the earthquakes at the moment. The JICA study and it's been updated now by an Australian grant called the Risk Analysis Project. Note that in fact Metro Manila may be separated into four different sections and you see the field box in the middle there. That's a poster which is a visualization of a separation of Metro Manila in a 7.2 earthquake. What the observatory is doing is pointing out not only do we look at structural measures and with all due respect to Secretary Singson there have been retrofitting of bridges and critical infrastructure in Metro Manila. We're looking at the social dynamics of a post disaster situation. The intersections between the physical science and the social science need to be examined here. On the immediate, on the exposure slide you see the density. Where are all the high density areas in Metro Manila? The redder, the higher the density and you'll see that these are mostly along the coast. The fastest growing barangays in Metro Manila are the barangays along the port. They are growing at 10% a year and these are largely slum barangays and no one is actually paying attention to that growth. The last slide that we have here on the right, I'm sorry, on the left, north, south, right, left is a vulnerability slide and this is something that we had discussed in many conversations and yesterday with Ambassador Quisha. There are roughly 4 million informal settlements in Metro Manila. Informal settlers, I'm sorry, in Metro Manila. If 10% of these individuals go in search of food and water in the immediate aftermath of a disaster such as a major earthquake, we would have people roaming around basically looking for sustenance similar to Tacloban that really amount to a figure that is higher than the entire armed forces of the Philippines. So we need to pay attention to these intersections, physical and social, and begin our work for resilience really as part of state building and not as part of a response to a severe disaster. We need to move from cooperation to collaboration and this is an active collaboration at all levels and across all sectors. And finally, just some good news at the end. In terms of prepare, there is a U.S.-Philippine Science and Technology Agreement and it's just had its first joint committee meeting. Under that agreement, there are two notable projects. One is the collaboration between the Philippine Government Weather Agencies with NOAA and that includes really the determination of storm surge that is associated with typhoons but hopefully that will be translated as it is in the U.S. into a mandatory evacuation policy for different populations along the coast. In terms of adaptation, we'd like to take a good look at ADMIR which is the ASEAN agreement on military assistance to each other during disasters that we hope to take in context of what was said earlier in the first presentation. In terms of transformation, there's an ongoing project within NASA, the Naval Research Laboratory and the Observatory and hopefully some government agencies as well, looking at the way climate is changing specifically along in the South China Sea as well as along Manila and in the Pacific. So that in fact is going to help us characterize our hazards better. On that note, I'd like to say thank you very much. The floor is open for questions. My very smart news lady there from JMA7. I'll make it short but I also have three points. Sorry. No, no, it's important, it's important, it's important. Okay, the first one is the emergency preparedness. One is that I was talking to Attorney Karen and I was listening to Bush Miley and they were saying that helping is supposed to be colorblind. So the question is that the problem with that deters the effectivity and efficiency of delivering health is the politicking of national and local leaders in the Philippines. That I have observed myself because I was involved with the Taipunayan coverage based here in Washington D.C. A lot of the local leaders there were missing during the first days and then when the press and the U.S. forces came, they're all in front of the photo opportunities. That's just an observation. But the second thing too is the economy. I mean I was reading the World Bank report and they're saying that in order to really build resilience and readiness, you have to work on the agricultural livelihoods and the domestic industries and really do job prospects. The point is most Filipinos are now aspiring to be working at a call center, which shouldn't be the ideal job of a smart Filipino with our workforce. So in the third prospect, the third point I have is that the OFWs, overseas foreign workers, they are the ones who are actually saving the GDP of the Philippines as far as my research goes because they have contributed a lot to the gross domestic product of the Philippines. But the point is, I mean most Americans think Filipinos are fractious, but when the Taipunayan came, everyone rose to the challenge. But the point is though OFWs might be an untapped resource plus the social media because during the coverage of the Taipunayan, I mean a lot of our news correspondents were out there and were lost in the lack of the roads and everything. And we were pretty much tracking Twitter, we were pretty much communicating in other words. Your time is over. Okay, thank you. Who would like to answer the question? I think on the issue, somehow you're comparing apples to peaches when we talk about call center and they're too intelligent to be in call center. Do you want them to be farmers? But the more important point that you brought up is the fact that their agriculture is one of the most important things in resilience, okay? Because for example, if all the coconut trees are felled, what do they do? They have no source of income. It's about time we started talking to them about root crops, for example. If all the fishing boats are destroyed, do you just give them all new fishing boats when all the coral is destroyed and there's less fish? Do you have to find new sources of income for them? That is the challenge of resilience. It's not just a question of building a better home. It's a question in a barangay when you look at that total devastation and there's no source of income. It is incumbent upon us, the Filipinos, whether it's government or private sector, to develop a new economic system for them. If they develop, for example, you have a Jalebi, believe it or not. They have cooperatives all over the Philippines because onions, everything except potatoes. For some reason, potatoes don't work. They have to import it. They import chili or whatever you. And then they develop a system where they procure from these cooperatives. In other words, if you develop a certain product, agricultural product and farms, there has to be a farm-to-market process. And those are the kind of things that the private sector and the government has to develop. So it's one thing, for example, Mr. Gary Lau spoke about rural health and we focus there on millennium development goals like maternal mortality, infant mortality. It's very easy. But when you get to looking at measurements for resilience, you have to look at multiple other measurements which we have to develop ourselves. And that is one of the projects we have now is we have to develop a metric system on how to have a resilient society. There are best practices, and we're looking at them also. But the point is, those are the challenges that resilience brings in. Whether I answered your questions or not, I hope you understand that resilience is not something that will happen overnight. What we're trying to say now is resilience is something we have to do now and we can't wait on the next earthquake or the next Haiyan. And the other aspect is we talked about earthquake and Tony pointed out one million settlers, suddenly informal settlers going out. What do we do with them? I have some very basic questions from Mrs. Gajowski. Does bottled water expire? It does. So in other words, if we had depots outside the Manila area and we had P&G water all over, you can't keep it for an indefinite period. Is that right? Well, how interesting. But the basic message is now we have to prepare, assuming whether it's a Haiyan or an earthquake, to have depots all beyond the specific danger areas. And that is where we have to invest now. And our forces, according to Mr. Loisaga, has pinpointed where all the helicopters can land. But they have to have relief goods and that you can't produce overnight. So that's where the private sector also has to step in. I hope you get the twist of what I'm saying. If I may just add, well, I wanted to make the same point you did, Mr. Chairman, that resilience is not developed overnight. It takes time. And if you look at the definition that was posted by Tony, you can tell right away that it's going to develop resilience. But as you said, we have to develop it now. Second is that I beg to disagree with the comment made by late that overseas Filipino workers what's keeping the economy alive. While we appreciate the remittances of our overseas Filipino workers, it constitutes only 9% of GDP. Services sector constitutes 53% of GDP. Agriculture is 25%. And the rest is industry. So we can't say it's just, we appreciate definitely the overseas Filipino workers' remittances. But it's only 9%.