ThinkTech. I'm Jay Fidel, and we're having a 10 o'clock show as we do on Thursdays with Tom Yamachika of the Tax Foundation of Hawaii. Today, we're going to talk about limiting tax penalties under the Eighth Amendment. I bet you never heard exactly or you don't remember exactly what the Eighth Amendment does. Welcome to the show, Tom. Thank you, Jay. Good to be back. Today, we're going to be talking about the Eighth Amendment. I mean, when you think about the Eighth Amendment, you think about people on death row and whether they're going to be given the electric chair or toxic injection or some other means of torture and or death. But the Eighth Amendment also protects other things like no excessive bail and more to our topic, no excessive fine. Now, the problem that this amendment has hopefully addressing has come to light in a few cases that have been happening across the country. One of them involves, first of all, the basic question of whether this stuff applies to the states at all. There was a case in Indiana where a person was caught and convicted for dealing drugs. But as part of that, the cop seized his SUV, valued at $40,000 because it was being used in the offense. And the Indiana basically said, okay, this is ours now. And the Indiana lower courts didn't buy that. They said, well, that's kind of excessive for just one conviction, the maximum penalty for which was $10,000. You're talking about a 40 grand SUV there. It wasn't an SUV. It was a land rope. It was a land rope. $40,000 that he bought with his own money, that he got from insurance policy. And the Indiana Supreme Court basically says, come on, guys, the amendment doesn't apply to the states. It applies to the federal government. It doesn't apply to us. So go ahead and take your land over. And that's when the Supreme Court got in an opinion by the late, great Justice Ruth Bader Ginsburg. He said, which way she would have gone to without knowing more. And she says, the eighth amendment does so apply to the state. And furthermore, it really doesn't matter whether you have a criminal proceeding or you have something called the civil forfeiture. The important part of the equation is that the government is exacting punishment. And the eighth amendment limits the power of government. And so you got to look at, all right, what is this person whose property is being taken, done to deserve the forfeiture it is property. And torture or other way by which your property is taken from you. If that's excessive in relation to the offense, crime, or whatever it is that is triggering the taking of this property, then you got a problem or the government has a problem because it has transgressed the limitations of the amendment. Now, this kind of has raised a couple of important issues. This, by the way, was a case that happened in Indiana just last year. So just for people who were taking notes, Tom, what's the name of the case going to give us a name? It's called TIMBS versus India. Okay, thank you. Okay. I was decided last year Justice Ginsburg and people are just trying to make sense of it now. Okay. There's a case in the Ninth Circuit, which is the Court of the Federal Court of Appeals that Hawaii, among other places, reports to. And that case involved the city of L.A. and its parking fund. Now, the issue there was you had the L.A. County municipal ordinances that provide for parking fines. And what that says is you can park in a meter place, but if you go over the meter and you get caught, you get slapped with a $62 plastic. Okay. And if you don't pay it in 21 days, you get a late fee of another $62. So a plaintiff there challenged that as being an excessive fine under the amendment. And so what if the Ninth Circuit and the Ninth Circuit said, well, we don't have any problem with the $62 initial fine. But really, nobody's spoken on the late fee. You know, the city of L.A. didn't advance any justification whatsoever as to why a $62 or late fee is reasonable. And so there really isn't a record for us to judge this. So we're going to send it back to the District Court in which they did. But so we have the Eighth Amendment's excessive fines clause now being applied to parking fines that are imposed not by the federal government, but by municipality. Okay. Now, how do you then apply that to something like we have in our state here? We have first of all, we have our GE tax, which we all know and love. It provides for penalties. And, you know, back in the mid-2000s, we thought we would, you know, we had a new sheriff in town and we thought, ah, we're going to beef up these penalties. We're going to make them substantial. This was in 2009. And we provided that several of the penalties applicable to the tax code were going to stack. Unlike the federal system where they don't stack, ours stack. So if, for example, you don't file a GE return, you can get written up for failure to file a return, which is a 25 percent penalty for negligence, which is another 25 percent, and for substantial understatement of your tax liability, which is another 20 percent, total of 70. I have seen in my law practice and, you know, talking with other practitioners, I have seen people get written up for 70 percent penalties. And that was just the start. The following year, and I think we talked about this on the show before, the Legislature enacted and the governor signed the General Excise Tax Protection Act, one of which had two very harsh provisions, one of which was if you file your tax return, your annual tax return, more than a yearly, you lose the benefit of any exemptions or reduced rate or deduction. So if you're a wholesaler, for example, you normally pay tax at a half percent. But if you get caught in the teeth of this provision, you don't file your tax return within a year after it's due, you wind up paying four and a half percent, which is 9x. Okay. And I have a case where this penalty has been asserted against the taxpayer who dutifully filed their periodic GE returns on time, the G45s, but forgot to file the G49, the annual return. So payments were made, the state got its tax, the taxpayer was on the radar, but they're still in the teeth of this penalty. So they didn't file the summary return at the end of the year, which would have reported exactly what was reported earlier. And for that transgression, the tax increased from half a percent to four and a half percent, 9x. And that's extraordinary, extraordinary time. And that's before the penalties were applied. Yeah. And the penalties would have been on the 9x. The penalty on the 9x and interest. So the penalty on interest on the 9x had interest of 8%. So part of that is punitive. Oh, unquestionably punitive. But the other part of it, I don't know how recently that assessment was made, but part of it has to be that the state is in desperate shape financially. The state is trying to raise money. So somebody said to somebody else, you know, you've got to be as aggressive as you can possibly be with these gross excise tax assessments. We need the money. And at the end of the day, that's a political issue. Right. And it does even more because the other part of the General Excise Tax Protection Act is personal liability. So if you work for a corporation but have some say over where the corporation's dollars get dispersed and GE tax is unpaid or is owing, then they can go after your house. Personally. Personally?  It's excessive. Excessive fine. Or unusual. Unusual is the word that comes to mind. It's excessive, but it's also unusual that, you know, you're operating as a corporation or an LLC. Supposed to have limited liability. This is clearly the liability of the company. Now they're coming after you individually because they say so. And that troubles me right there. Yeah. And actually what you say kind of brings up another very important point. And that is, what happens if you don't have a person? Would you have an entity like a corporation being the taxpayer? Okay. Do the same restrictions apply? Well, Tins versus Indiana didn't answer that question because it obviously was an individual. Okay. But a case in Colorado that came out earlier this year said, oh no, the Eighth Amendment is a restriction on governmental power. It doesn't really matter who the victim is. Well, it's a restriction. Governmental power so corporations can get protected by this too. That's just said, the Colorado Supreme Court. So I mean, is that something we should question? No, I think it's a very good decision. I think it's very much in line with the philosophy of the Eighth Amendment and of the Bill of Rights in general, which was to limit the power of government. So I think corporations, partnerships, S corporations, LLCs, they can all benefit from this analysis. And if you have the full weight of state government bearing down upon you through the tax department, this is maybe a way you can fight that. Yeah. And don't forget that the gross exercise tax is completely regressive. I mean, from a societal point of view, you're putting an inordinate burden on the little guy. So then when you make it tougher still with excessive fines and penalties, those are imposed on the little guy. That's very, that's very troubling. But what I get out of the conversation so far is that for a long time since the Eighth Amendment was written, there hasn't been a lot of litigation or pronouncement by the Supreme Court. This Indiana case is important because now it's on the radar. The Eighth Amendment is on the radar. Number two, I think it shows that it wasn't only Indiana, there are a lot of states that forfeited things far in value, far in excess of the actual offense or the fruits of the offense. And so I think it kind of was running away with itself all over the country. In many states, we had forfeiture statutes that were really inordinate. And then what I get also is that if this applied to Indiana or to California, then it applies and a lot of it applies all around the country. The legacy of Ruth Bader Ginsburg on this issue is pretty important. And it means we have to take note of the Eighth Amendment and we have to straighten up because local governments have been too hard on people often because they need the money, like in Hawaii. And the last point I get out of the discussion so far is that this happens in Hawaii, too. We have excessive fines, penalties, and stacking. And we should take note of that. Often the taxpayer has no resources to fight with the tax office and he either has to pay for it or settle it, but he's not going to go to court on a U.S. constitutional issue. Is there a similar provision in the state constitution, Tom? I guess there is, but it's pretty much the same language, but it really hasn't been spoken to by our Supreme Court yet. But along that lines, Jay, I wanted to follow up on one of the points you said. And Ruth Bader Ginsburg was, I think, prophetic because in the Tim's opinion, you know, here's what she said. Even absence of political motive, fines may be employed in a measure out of accord with the penal goals of distribution and deterrence, or fines or a source of revenue, while other forms of punishment cost a statement. Don't you think that was a very wise thing to say? Yes. And I think it's very much in line with what happened in 2010 when state government was reeling from what then was the 2008 recession and they wanted to shore up their coffers in a manner that wasn't offensive to the general population. So they thought, ah, we're going to go after the bad guys. We're going to go after the scoffload. We're going to make life really tough on them. So this is what they came up with. And it was like one draconian thing after another. Well, you can say draconian on that, but let me offer a thought. So let's say that there were tons of scoffloads in LA. Nobody was paying parking tickets. Nobody. They stick them in the glove compartment by the dozens and never get around to it. And the state, the city, LA didn't have the resources to go chase all those $62 parking tickets. It was not an economic experience for them to try to chase. So how in the world do you make an efficient model of collection? Well, you discourage people from putting them in the glove compartment and you make it clear to them that there's something more here. And unless they pay, they're going to suffer. And, you know, there's a certain, you know, I think this is all guided by what does the average person think is fair and unfair, excessive or unusual, and so forth. And, you know, if I'm an ordinary person and I see all these people with full glove compartments, I say, you know, we got to find a way to have them pay. It's unfair. You know, if the ticket was wrong, let them argue with it, but if the ticket was right, let them pay it. And if they don't pay it, we got to find a way to make them pay it. It's not unreasonable, is it? Of course not. And I think that's probably, you know, part of what motivated the lawmakers there and here to pass this kind of legislation. I think, you know, in 2010, there was a lot of discussion of, well, geez, there are too many, you know, corporations and businesses that are really coming their nose at the general excise tax and not, and basically disobeying the requirements of the law. So we got to make them, you know, we have to impress upon the public that we're serious about this stuff. And, you know, we can do this by making some examples of people and really beat them up. Yeah, but, you know, at the end of the day, maybe the parking should be free.  I mean, we're in a crisis of social compact where people don't like the government. They really don't. And they live their whole lives not caring about the government, not wanting to help the government, not being sympathetic to the problems of the government, criticizing the government for everything. Bottom line is the government is us and we are the government. A better society is when everybody likes what the government does.  And he is going to, or she is going to carry around enmity for the rest of his life, maybe over what he considers or she considers a an unfair maneuver by government. And I think the government always has to take that. When you have this us and them kind of mentality, we are going to punish. We are going to forfeit. We are going to make them suffer. You know, then you lose the social compact. I know it's a 50,000 foot way of looking at it. But I think that government ought to be very conscious of how people feel about it. And when you're giving out tens of thousands of tickets every day, you're making tens of thousands of enemies every day. Is that the right thing? Well, you're, I think, very much correct in that the government is us. And there's a great need for us to engender trust in the government that we have. If we can't trust our government, when the government's us, then who can we trust, right? And the way government can do this is by doing things that are fair. They may be severe, but if they're understandable, then you and I as citizens can get behind it. If it's not understandable, if it's not reasonable, if it really shocks our conscience, we're thinking, geez, what the heck are these clowns in power doing to it? And it makes us all fearful because what happens to Joe Q. Public one day can happen to me the next day. Yeah, and if you want to be firm, fair, and also consistent, universal. And I think one of the things that happened, you remember there was a fellow who, he was a political animal in Hawaii and he could fix a ticket. He was somehow attached to the political party or the legislature or something. I forget his name. And if you knew him or knew somebody around him, you'd call him up. He could fix the ticket. And what troubles me about excessive fines, excessive forfeitures, excessive penalties is that if it's excessive, it's made for corruption. It's made for inconsistent enforcement. It's made for arbitrary corruption. Say it again. It's made for arbitrariness in its application. If you really bludgeon somebody, the question then becomes, well, why are you bludgeoning this guy over somebody else? Or these thousands of somebody else that did the same thing? Or worse?  When you're letting, you know, A, B, and C go and they haven't filed any terms. Or paid any tax. Or paid any tax. Yeah, we have to be smart about it. And I'm afraid I'm afraid we haven't. And that's why the tax foundation is so important to take a look at these things and to analyze them from a public policy point of view. And I'm not sure that it's the right time to make that kind of analysis right now when we're in desperate straits for next session and fiscal policy. I mean, somebody said the other day, we could expect to have a $1.2 billion shortfall deficit in this state next year. Wow, how are we going to cover that? 0.4. It's already there. It's not, you know, can we expect, it's already here.  Okay, there's a $2.4 billion difference.  Yeah, so what, you know, okay, so that's one side of the coin. And the other side of the coin is to try to squeeze the taxpayer. Now it's hard to raise income tax. It's hard to raise gross excise tax. It's very politically unpopular.  So what do you do?  I think we can expect more of this time. Yeah, no, I think there will definitely be the tax increase proposed in the legislature. One of the things you got to watch out for is that, you know, when you look at all the taxes that we collect, there are basically two big ones and everything else combined is equal to one of the other two. Okay, the two, the two big ones are one, the GE tax and two, the individual income tax, not the corporate tax, but the individual income tax. Why? Because of the wage earners who pay withholding. If you want to make changes in, you know, other kinds of taxes, yeah, you get a few million here, a few million there, but you're not going to get, you know, a billion dollars or two billion dollars, which is what you do. So, you know, what are lawmakers going to do? Well, I don't think they can furlough enough people to really make a big difference. And by the way, furloughing is also politically unpopular. And you have government workers, unions that would scream and shout about it. Were they doing that now? Yeah, sure. They're doing that now and it'll be worse later. Everything will be worse later. So, what does the government do? I mean, it's hard to raise taxes. It's hard to furlough. I guess you got to cut services in some way. I don't see an easy option. Where do you think there's give here so as to get back to a, you know, a balanced budget, which is supposed to be the requirement? I think one of the things that the government's got to do is just to figure where the core services are and then figure out what's, you know, nice to have as opposed to we really need this and start getting rid of the nice to have. You know, realistically speaking, that's what you've got to do. Yeah. And that really has to be done on a rational basis rather than on a political basis because, you know, whatever happens in government in this state and most others is going to be a function of lobbyists and political pressure from constituents and cacophony, pressure from all sides. And politicians these days, especially in this crisis, that they have to, they have to not accept that. They have to say, no, we're going to do this on a completely rational basis. We think we should call Tom Yamachika up and ask his advice. Yeah. And I think in those kinds of times like now, we should be glad that we have, you know, fundamental protections like the Bill of Rights to protect us. Yeah. It was, it was a fun show, Jay. Yeah, including, including the, the Eighth Amendment. So the Bill of Rights and the, it's one of the Bill of Rights. And we forget, but now maybe we should remember. So before we go, Tom, I just have to tell you one short story. I made my mind up to tell you about when I was in the service, I was a legal officer in the service. And one case across my desk about a fellow who went, went AWOL and, and the military judge who sat on that case was a strong athlete. And he was a very liberal fellow. Like he went on freedom rides in the South, that's the kind of fellow he was. And he decided that he was going to make a, make a difference here. So instead of putting this, this young man in the brig, he gave him two weeks in St. Mary's Orphanage, which, which was in that Coast Guard district. And he made him swab the floors in the orphanage for two weeks. Okay. Okay. And the fellow had a crafty lawyer step in and he said, no, no, no, no, no, you can't make me swab the floors in St. Mary's Orphanage because of the Eighth Amendment. That's unusual. It isn't cruel. It isn't excessive. It's unusual. And he made his, he made his appeal on that basis. And can you guess the result? Um, the judge said, okay, you don't want to do this. You go right to the brig. That's exactly right. That's exactly what happened. I thought you'd enjoy that story. So the word unusual has all kinds of, you know, strange implications. Well, thank you, Tom. Great to talk with you as always. I look forward to our next discussion. Take care of you well. Take care. Aloha.


Live from the Oracle Conference Center in the heart of Silicon Valley, extracting the signal from the noise. It's theCUBE, covering the Oracle Cloud Launch, brought to you by Oracle. Now your host, John Furrier and Dave Vellante. Okay, welcome back everyone, we are here. This is theCUBE live in Redwood Shores, California, Oracle's headquarters. This is theCUBE, our flagship program. We go out to the events and extract the signal and noise, I'm John Furrier, the founder. SiliconANGEL, my co-host, Dave Vellante, founder of Wikibon.com. We are here pre-gaming the Oracle Cloud Platform Launch. Larry Ellison and the executives will be laying out the new platform updates and momentum. And we're going to cover that here live on SiliconANGEL.tv. And of course we're pre-gaming, getting all the interviews and setting the table and trying to dissect what this means. Our next guest is Carl Olson, Research, Vice President, Application Development, Deployment. Welcome to theCUBE, welcome back. Thanks. Good to see you. So I love having analysts on theCUBE because we can actually break it down. So we get two, two analysts and you and Dave. So we're teasing out, we can't really go in. We have the release where we have it in front of us. We can't really tease it out, but it's Oracle Cloud. And they're competing and Larry Ellison go back five years, false cloud at Salesforce, hitting them hard. And then all of a sudden that sea change in the middle of their investment in engineered systems. So you saw that sun acquisition, all that stuff going on within Oracle. And then all of a sudden cloud is a centerpiece. Big shift. What's your take on it so far? And where do you see it kind of connecting today? Well, I mean, when you talk about those two trends, you talked about engineered systems, which is a part of the larger converged systems movement that we've seen. That is one trend and cloud is another trend. So converged systems all about trying to improve your ability to maintain large systems in already very complex IT environments. What's another way to go? It's to move some of that operation to the cloud so that you don't have the complexity of managing those systems yourself. And you have it running on, as Larry likes to say, professionally managed systems. So we're seeing a lot of interest in the cloud in general. There's big uptake certainly on the SaaS dimension. We've been waiting for that at IDC. We've been predicting for the past few years that cloud was going to take off. But he said, we don't know exactly when. Because timing is one of those things where if you could actually answer that question, we'd be playing the stock market instead of being analyst. But it has been taken off. And now platform as a service is sort of like the next step where people who have complex applications, homegrown or they're looking to evolve or develop those applications, they want a platform that can support the things that they need to do. And that's a cloud platform because it gives them the agility, but a private cloud platform is actually pretty hard to manage. It's complex, you know, there's a lot of pieces to that. You get the nail on the head. I want to get Dave's perspective on this too because Larry Ellison has shifted his role over the past few years and he's engaged. I mean, he sees this market exploding. He makes comments over the past few years, like, oh, just, we'll just call it cloud. But what he really sees is the middleware market and his bread and butter and apps at, not at, potentially at risk, but they have a huge position in the marketplace. So Dave, Larry Ellison is CTO. He's totally engaged in the product line. Can you guys both comment on what that means from a technology standpoint? Because I asked Emmitt and Xavier earlier about the, how easy it is to just do middleware in the cloud. Oh, they have a hackathon this weekend. The past market truly isn't grown up yet. So the middleware is the battleground. So what's your thoughts, Dave? Well, look, I mean, the bread and butter is database as a service, right? Or database and database as a service is kind of the hot new thing. We were talking off camera. You've talked to a number of customers. I think we both agree. There's a lot of potential momentum there. What are you seeing in database as a service? Well, I think that the leverage is really at the past level. In other words, rather than pure database as a service where you write your application on your own systems and they communicate with the database in the cloud, that's awkward. There's performance issues involved. It's much more, it works much better if you have everything in the same cloud platform. And so using middleware that is part of the same environment as the database just makes a lot more sense. So what do you make of initiatives like Cloud Foundry? Which you're essentially, they don't own the database, almost count Green Plum, but that's not really the core of the global 2000, right? So going into the market, trying to build an ecosystem approach, obviously reliant on the global 2000 who's using Oracle or maybe SQL Server or others. What's your take there in the landscape? Well, for one thing I want to point out that there are a lot of different kinds of applications you might want to put in the cloud. Some of them are amenable to say a straightforward Java implementation against a relational database, but others have different requirements. So it makes sense to have a variety of choices, going with a Cloud Foundry approach where you have an environment in which most of the elements you need have been thought out and put together for you. It makes sense for certain kinds of applications. So the ecosystem approach can work? Sure, absolutely, yeah. I mean, yeah, I mean, you've got, let's make a distinction too, between the applications, there are applications that are going to run the cloud, they're going to be web-based, they're going to drive mobile devices, but they're very session-oriented. Obviously gaming applications come to mind, there's certain kinds of retail, especially location-aware retail applications and things. And they need certain kind of database functionality. They're probably going to use some combination of a no-SQL database of some kind, and a relational database on the back end to manage the business dimension of what they're doing. And so, but Oracle's been pretty clear with that strategy. I mean, it's going after integration, right? So you talked earlier about some of the advantages there. What are customers telling you? I know it's a little early, especially for database and a service and even platform as a service, but what are you seeing there in terms of some of those advantages? I mean, we don't have a huge sample size, obviously. So I can't say, you know, it's a handful, but they've been pretty happy with where they're going. And the first thing you do when you move to the cloud is you move what you already have, what you already know, and then you go from there. Then you can take advantage of the flexibility of the agility of the cloud environment gives you. Step one is to, they're not starting from a blank slate, most of them. They're starting from, you know, we have needs to evolve our application beyond what we can manage in our own in-house data center. I mean, in other options. The complexity issue, though, it brings up a good point. I mean, the Oracle customers, their footprint is massive. So for them to roll cloud in really is a strategic win for them if they can pull that off. Oh, sure. The momentum alone last quarter was about 1400 plus new customers. Now, I don't know how many they've lost to the cloud. So there's a little bit of cannibalization going on that was kind of discussed in the areas. Guy's thoughts on that.  What is that thought? What are your thoughts on that? The good move? I'd love to get your take on this. I've said a lot about some of these large companies. I've certainly said about IBM and HP. They've got a shrink in order to grow. You're not saying the same thing about Oracle. They're sort of holding onto that base. Largely, I mean, there's big maintenance component there as well, but their cloud business starts to kick in now. They seem to be doing a good job managing that transition and their business, it seems clean to me. An infrastructure service, platform as a service, software as a service, and it's all rental. And it's clean. A lot of companies, is that really cloud or is that kind of actually on-premises? Oh, it's actually on-premises. So I think there's a clean story there. My question to you, Carlos, is the new growing fast enough to offset the headwinds on the old? Well, it depends on the timeframe you're looking at, I guess, answering that question. If you're looking at it, you're by year. I'd say over the next 24 months. Over the next 24, well, okay. So I think looking at, I'm not a prognosticator of revenue, of course, but in general, I would say, you said you have to shrink in order to grow. In Oracle's case, it's probably more like you have to accept more flatness in order to grow. I wouldn't say shrink. Right, I think that's right. But it is the case that when you move from a perpetual use-license model to a subscription model, there is going to be a bit of a hit there because you have customers who were writing a big check up front in order to use your stuff. Now they're writing a subscription check that's over time. So over time, that revenue stream amortizes and it works out to be growth. That's why I asked you the question of what kind of timeframe you're talking about. Over time, it works out, it overcomes where you were. Well, over 10 years, it's... Or even five years, I would say. Very exciting business, actually. Yeah, and not only that, but it's a more stable business because you have an ongoing revenue stream. One of the things that really gives a lot of heartburn to guys who are product managers in that field, as I used to be in my earlier days, is this worry about keeping people on maintenance and getting them to buy upgrades because that's what your revenue stream is. But when the issue is, let's get them on a subscription. Now we know that as long as we're satisfying their needs and they're being successful, we can keep them on that subscription. That's a much more stable revenue stream. It gives you a much more stable figure. Yeah, so I used 10 years because the back of the napkin math is about, you actually had a spending about a third more over a 10-year period and the margins are just as good. Well, this brings up the question of, you know, race to zero BS that's kind of been kicked around about Amazon. Dave, you won't call it on the cube. There's no race to zero. There's real dollars being there and then we had to debate the value shifting. So I'm a big believer that commoditization is evolution in industry. Certainly business models will change, but value has to shift somewhere. So I want to get your guys' thoughts. So race to zero is an easy conversation. Oh, it's driving prices down to zero, but okay, if the price is going to zero and the margins into another area like apps or whatnot and the time table changes, this is the new economics. What's your thoughts on this? Well, Amazon's turning hardware provisioning into like a service, a software as a service. Where's Oracle's value? So you'll see that as a race to zero. And so it's very hard to compete with that. Oracle can compete because it's got, it owns the database, it owns the middleware, it owns the apps, it's got differentiation that drives value. So that's my high level take on it. What do you think? Well, I agree. And I think that when you're dealing with somebody like Oracle, and they're not the only ones, but we're here to talk about Oracle, so let's talk about them. We can talk about others too. That you're dealing with somebody who is optimizing all the dimensions of the system for the service. So they have complete control, and that's what you need. They can control everything from the iron right up to the top of the software to make it fit, not only for the kind of service they want to deliver, but within the cost parameters that they need. What do you make of this sort of push button simplicity to go from on premise to the cloud that Oracle's sort of putting forth as a value proposition? Is it really that simple? Well, I don't know how you define push button. I mean, there's going to be some, you know, there's going to be some, I mean, you have to at least move the data, and their issues with that, is you know, we're talking about running systems that can't be interrupted. So that's a little complicated, but I mean, I think they are trying to make it as simple as, look, they're not- Well, test dev, that's kind of a no brainer. A test dev is absolutely a no brainer. And in fact, that is the strongest business mind. That's what we're seeing taken up first, by the way, in terms of database, you asked before about data service. That's what we're seeing taken up first is the test dev model, because that is the model that benefits the most from the kind of agility and sort of self-service capability that the cloud gives you, right? I mean, in other words, and a lot of people don't necessarily know this, but one reason why applications can't evolve fast enough to meet the changing needs of the business is that you have to schedule time and resources for your development environment in order to make those changes and test them. But if you have a more agile environment, which you can sort of say, okay, today we're going to test this, boom, okay, the database is ready, let's go. I mean, what a huge difference that is, instead of having to wait a week for the IT guys to set aside some of these constraints. Well, this brings up your control thing. So the last couple of minutes, I want to drill into this whole control. I mean, optimizing for the cloud service is a great thing for its control. So we had this debate going back to the first year of theCUBE when Paul Moritz laid out the VM where he was the CEO of VM, or VM where he laid it out, basically cloud, mainframe in the cloud, so to speak. The question is, at what point does the top get hardened where no one cares? We used the debate of the Intel processor, a lot of proprietary stuff underneath there that no one cares. It's just, no one can say it works. It enables more value on top of it. So this comes up in the cloud. At what point, where's the hardened top, and is that okay? It's okay to be have full control.  So what's your thoughts on that concept? Is this the new Intel kind of model on the cloud? This is a concept of hardening what looks like proprietary technology could be open source or whatnot, but at some point, do people really care? It works really fast and eliminates complexities. So what you're really referring to is a term that a lot of vendors don't like to use, which is lock-in, right? In other words, at what point are you at a system where you can't move out? I don't think that that's the issue here. I think that the issue here is, if I can continue to meet the needs of my business and you can make it as simple as, I just focus on what I need to do, and I don't have to worry about all this other stuff, all the operation, how it works under the covers, what the technology is, and all that. You're saying, I don't have to worry about that. I'm willing to pay for that. Well, I mean, I'm not down on lock-in.  Lock-in with choice is competitive advantage. So if it works, lock-in with no other alternative is like customers have no choice and they have to deal with it, but if someone says, hey, here's a product that works better, and you have choice to switch to anyone else. But this works, this is a piece of great hardware and software, and it's not a bad value proposition. And I'm sure that if Larry was sitting here, he would also point out that you write your code in Java, which runs on many platforms. And it's a relational database, and if you choose not to use Oracle extensions, it's very easy to move the data. That's their open card, is Java. Yeah, yeah. So, you have a story. Everybody has an open story and a choice story, right? Well, a lot of times choice and openness is just marketing. It's marketing. The truth is, I was just gonna say, the truth is that Oracle isn't the only, everybody's doing this, which is what I think you were getting at, well, not everybody, but you know, you look at Oracle, you look at Microsoft with Azure, you look at these other environments, they are custom made to serve that customer and those technical needs, and they have submerged the details that you shouldn't have to worry about. People criticize Oracle, because Oracle has more pricing power than most. So, because of the database, and they leverage that pricing power, and so, okay. Well, now there's another dimension of change too, which is that Oracle's, we already know this, that Oracle's move to the cloud made them attractive to customers who are smaller than they used to deal with, because they used to only sell database. They've expanded their TAM as a result. That's a good point. That gives them more flexibility. That's a good point, and I want to get the shout out to Dennis Hallett, who's on the crowd chat, and asked a question, commenting on the longer single license deals. He says that logic is a little bit off from his perspective. He's seen regular deals at 3 p.m. running 10 to 15 years, I don't know what 3 p.m. means, but 10 to 15 years horizon. Similarly, we're seeing price increases in cloud apps among the major players. So, two things, obviously, the TAM is lower on the market, but he's still seeing price increases. No, we're agreeing. I'm saying over a 10-year period, the spend that you'll spend on the cloud is higher than it would be on-premise.  The other thing is people don't know how to compare these things. They're comparing what they're doing in their internal IT system today with what they're going to do in the cloud, but they're going to be doing so many more different things in the cloud. How can you compare those things? You know? I mean... Yes, that's great. We got great commentary. Jim Crawford just jumped in with similar commentary. Again, we'll be back more, we're live here. The Cube, special pre-gaming of the Oracle Cloud platform announcement coming up shortly. Larry Ellison and Top Execs is with me on stage, detailing out all the successes and new features coming from the Oracle Cloud Platform. This is The Cube. We'll be right back with more coverage after this short break.


Go get your bear But I'll show them in a minute Girl the glory that it's all her is out. Oh lord. It's a lot of hair y'all and I I feel like my hair Is she getting thicker? I don't know what it is.  This is the week before my surgery I'm not sure when I'm gonna upload this and I sure couldn't upload this before my surgery or afterwards I'll show them in just a second. Let me just tell them this baby and I'll show them sit right here next to mommy Okay, go get your book to where's your book? Okay, open it up and start looking at the pictures. Yeah, I'll show this what he has Today I made a follow-up appointment just to see my NP because of the coughing and I caused I caught my plastic surgery because you look y'all. I was nervous that I was coughing so much I'm gonna cut those stitches open, but glory to God the coffin has Almost gone down to hardly nothing. I'm coughing every other hour one before I couldn't even get through four or five words without coughing So the NP told me today that to continue with the nebulizer treatments for another three days But she couldn't hear any wheezing. She thinks I'm good and I have a follow-up with my pulmonary specialist not until the 30th of May, so Everything sounds good long sounds sounds clear and I'm good to go for surgery But you cannot tell me this is why I want to come on camera say this you cannot tell me that there is no such thing as a God Cuz I'm telling her say I'm telling the NP. I said, okay Well, you're gonna have to contact the surgeon and give him the green light because he wants to he may Want to hold off if he thinks I'm really sick. So she said well who's your surgeon? I said it's Travis holocaum. She said Travis. I see a doctor holocaum. She said I know him I used to work with him. She said you are in very good hands She gave me a brief background on the guy and Just you know just praising him.  And so we sat there We talked for a good 20 30 minutes. So that I wasn't nervous at all But that really silk the deal for me that I picked the the great surgeon and everything So let me show you guys so JB apparently has been doing so I'm so proud of him y'all and you know children are definitely Children are definitely little blessings. Hold on baby. He told me today. He said oh girl I almost started crying. I had to I had to hold back those gangster tears. He said, what did you say, baby? He said I am he said you make me so happy. I was like, oh lord. Don't make me cry. So he's been doing so good They gave him for the week Show him what it is, baby I Don't show them everything baby, hold on. Let me see if they can see it So it's basically a girl. This is a guy This is a bootleg build a bear it's all turned around baby. So the whole concept is to take the bear and Go on a little adventure And we take pictures you're gonna change it. Well, baby I'm gonna put that on camera. That could be part of your YouTube your YouTube channel. Okay, all right I'll do that for you. So anyway y'all You can't absolutely, baby So yes y'all that made me feel so good knowing that you know in this NP I've been going to for two years. She's the one that was helping me wear my anxiety last year during the wedding Gave me some referrals. She was telling me not referrals. She gave me some resources to look up online She was seeing how She believes that anyone could be healed but a grace to God because I was dealing with some other medical issues that I I don't really care to share on here But she said, you know, I absolutely believe in healing power and that to hear a medical person say that Is amazing. I want to show you real quick. I'm making a scar cream for my breast assist I'm taking some of JB's because this stuff goes a long way Taking some of his shea butter mix that I made literally three months ago because it I normally use just pure coconut oil on him and I use this depending on what his skin looks like I have some sweet almond oil here Some essential tea tree oil. I'm not using this This is going to be what I'm going to use directly when it really itches And then I have some vitamin E oil and the shea butter has some other oils too Yeah, this is what I'm going to be using On my scars to help them hear Hey y'all, so we were out this afternoon at a kindergarten JB school had like a kindergarten almost PTO get to know everyone meeting It's a lot to take care of girl. It's a lot to take in starting at a school new school in general It's a big boy school. So Um, it is a charter school. They do wear uniforms. And so I'm glad I wasn't going to look at that folder. They gave you a folder full of information I wasn't even going to look at that until yesterday, but I am glad I peaked at it tonight because It looks like I have to do a separate registration for summer camp Coffee is back up. So I'm gonna have to get back on the nebulizer soon. But anyway, just another thing I have to do A few days before the dangles surgery, so I need to go ahead and take care of that and What baby? There's something in his bathroom. Okay, JB. Um, I'll come get it out But the good thing is that we saw at least half a dozen kids and parents that he knows they're either from his old school New school or just people that we know in the community. So let me go see what just sounds something So I made a couple of comments in response to Summer Funkin and he was latest videos not even A few I think I've made less than three comments on his videos And some of his, you know subscribers or responding back And people a couple of people In particular are like, well, didn't you say that this is his truth? Basically On the transsexual video, you know, he said that he has a video that's titled. I used to be afraid of trans Um, but now basically since he's talking about black women, you have a problem That's not what I have a problem with your delivery means everything And I respond it to one young lady is not what you say is how you say it case in point Conscious tv did a very similar video Or he discussed his points on similar topic And I was able to receive it because it wasn't coming from a place of bitterness And he wasn't being disrespectful in his video He was able to articulate without Basically offending an entire group of people So I'm very open you guys. I Rarely do I disagree or agree with people. I receive the information. I take it um And that's it.   But what are your intentions really I don't want to say he's not really interested. I think he is interested in some of these deeper discussions But overall, I think he's doing some of it for It's clickbait clickbait. Excuse me for money. Um, and it's what is this platform He has every right to do it just like we don't have to watch they we don't have to watch his videos We can keep keep it pushing and look. I'm not that person. I do not go back and forth with people I will say what I have to say usually in three sentences or less And if people respond, you know, I may respond to one or two My block game is strong, baby. I will block you and keep you pushing. I got nothing to do. I got a deep condition I got a cook. I got to get my teeth. I don't have time. I don't have time. So, yeah Can y'all see me you really can't see me girl. I'm in the closet picking up. I'm gonna wear to the natural hair Look D I didn't have any intentions going to the natural hair show this year because I'm supposed to I'm I'm relaxing a few days before my surgery so She's been posting D my girlfriend from newbie and glam rock that you know She's been posting stuff for months And I just took the time to look at what she posted And mind you, I haven't even spoken to her about the event, right? And so she posted a couple pictures of me saying, you know, this is one of her local Naturals make sure you spot her at the natural hair event. I'm like girl You didn't check with me. I wasn't sure if I was going or not But now since she posted that I went ahead and purchased a ticket.  I guess I'm gonna go. Um So I'm gonna wear this cute little floral shirt and my makeup is going to be Ridiculously sorry y'all my makeup is going to be ridiculously cute. But look y'all look There is nothing for free in this world Nothing is ever free. So I'm sitting up at my desk. This is Thursday Which is like uh almost friday for me and fridays. I typically do half a day work I'm just keeping it real. I get up early and I'm done with work by noon on fridays So I'm wrapping up stuff today, right? Why do I get I've been getting messages all day from the hospital? I'm getting my surgery Girl, why don't I get an email excuse me on a text message that says make sure you bring your payment of $470 I'm like, what? Call here for information.  She's like, yes You need to make sure that you bring your payment. I said, what payment? She's like, well, you have it you have sycna and it shows here that you haven't met your deductible y'all That completely slipped my mind Because let me tell you something yesterday not yesterday last year. I was a mess physically I was stressed out and we all know that stress can affect to you physically I was sick a lot. I mean, I was in and out of the doctors. I was in and out of the car factor Whatever, I met my deductible like that. I met my deductible by March so I haven't even came close to meet my deductible this year. I've been relatively healthy So when she said that I was like almost offended. I'm like, what are you talking about? Y'all, so these are my freezing meals. I'm making this is tomato soup black bean soup Squash soup. I got some vegetable broth homemade vegetable broth squash soup This is This is squash squash soup. This right here is chunky squash soup I have barbeque chicken here and then I have orange chicken there. So yes, yummy, yummy Give me your bear. Look, I gotta carry the dang on bear Lord have mercy Looking at some hair products. Here we go with some hair products. We have camille rose Shea moisture Nothing's on sale Oh, they have that huge thing. That thing is $20 To allocate naturals. That's pretty big though, but no, I'm not getting it for $19 that could stay up there This is good to know they have so my sally's has a lot of products and then um, I could come here for camille rose Which I have already reviewed a lot of her products y'all It's hot Let me turn on All right, so we are on our way to the Um Hair show. This is the first year that JB's going with me This is my fifth year going. Um No sixth year going and so yeah, this is JB first time going with me excited JB Yeah, yeah, like my hair. This is the meal organics review is coming I guess in about two or three more weeks. My hair did really really good. Keep in mind. My hair is old Like this is two weeks old and um Yeah, this is my makeup girl I did not do a makeup look on this because I had to get really in on the Mirror Directions, I think I know what I think this is in a restaurant That's what they had to miss our legs A gradient that you should look for that you that you don't want that you don't want in your product This is beautiful that's necklace Now you have the stage right here This is where everybody's gonna wear the people right up here or the wrath of people who come up here I I'm not the JB. So we're out of the event y'all. I only came here up here for an hour Um, because I knew she had it. I knew where this place is that is right next to a Caribbean restaurant, which I don't know why I did this to myself.   It could have been a lot warmer And I could tell look i'm a cook y'all know i'm a cook I could tell that it was chicken that they had cooked probably In batches a couple of days ago. It wasn't fresh So it had potential if it was if it was fresh, I know it would have been the bomb But typically mom and pop places like this They do that someone who worked there and I saw fake baby that that was Yeah, someone was holding a fake baby a reborn which is another story. So hey, I'm here to show my support It takes it with it One two three awesome Y'all I am tired. Look, I don't know about you. I don't know those type of people when I get home I do stuff around the house. I don't immediately sit down. Unfortunately. Sorry JB. I don't immediately sit down So I'm in up. I don't even know what time it is. I've been up cleaning. I wanted to get everything Straighten up as possible because we are gonna go to church tomorrow Oh, which I I'm struggling with this because I need to set my hair and send my mini twist Which could take between four to five hours to do and I need to wash my hair So we're looking at baby stop it washing my hair deep conditioning. We're looking at About about six hours of doing my hair And that's it you guys I put up my camera equipment back here because I typically do Record one hair video a week and release it schedule it out in advance. JB. Don't do that All right, you guys so I have to look come back here because this child is acting crazy. So anyway It's real I put up all my equipment my camera equipment my backdrops everything which I need to get that together Girl, I see how it's been looking in a video slightly Um put everything up because this is done. I'm done. I'm done. I have literally about four more videos to edit upload and Girl he act like someone's killing him because I locked him out while I'm recording this real quick. Um It's the point girl Yeah, I won't have to really record anything until July Because I have video I have content scheduled For the next seven or eight weeks. So yeah, we're good So y'all I will be back vlogging if I could come back at the end of June. I will if not It will be July. I'm sorry for the camera. It'll be July. So y'all stick with me There will be hair related videos coming full videos coming But just know that I probably won't be able to respond to everyone like to recomb it because your girl is resting All right, you guys take care. Bye


Hello. I'm Kim Pepper. I'm the technical director and co-founder of previous next and the skipper hosting platform Today we have some great lightning talks for you So we're gonna sit here from Nick shoe who's going to be doing some tips on improving Infrastructure security. We've got Hasitha Garughe Who's going to be looking at better key management in Drupal? We've got Chris Burgess who's doing a talk on dependency track and finally we've got Steve Kuchin Who's doing security considerations? For Drupal programming and we hope to have some time at the end for Q&A So please post your questions in the live Q&A tab and Without further ado, I'd like to introduce our first speaker So Nick shoe is the systems operations leader previous next and architect of the skipper hosting platform He is passionate about Drupal Kubernetes and everything in between so take it away Nick Hey everybody, how you going? Happy Thursday, so I'm gonna be running through a lightning talk covering a couple of I Guess areas that I think that folks could improve on with their stack and just kind of start the thought in your mind about this Kim already introduced me So I guess all that's left is my Twitter handles and my and my lovely face So but I'm operations leader previous next and yeah, my day-to-day is Kind of covering a lot of these aspects that I'm going to talk about here. So Let's let's get into it. We have a lot of content to cover this session. So So the first first area I want to cover is understanding interactions So I think this is a bit of a bit of an interesting area because it's about understanding what kind of traffic is coming into your stack Who's interacting with your sites? Like it's very important from a business standpoint that the business knows what features are being used what things as You know, like are they using the search feature? Are they contacting us? Are they falling, you know falling off the site after 30 seconds? Like those are all important metrics the same thing goes for infrastructure. I don't think we do enough of this We don't really understand what type of interactions actually happen like who's consuming our website who's viewing our website What kind of is it a bot? Is it a person? Which kind of leads me into my first lovely graph So what I want people to do is go away and think about how they're kind of analyzing their traffic in a very simple way That that'll show What kind of what kind of things are hitting your website by setting up these? four graphs We were able to quickly like with AWS bot control. This will be using AWS. Sorry as kind of an implementation Example, this is what we do and these are actually real graphs, but But in a couple of dashboards and using AWS WAF and bot control we're able to quickly see You know what ratio of the site is bots what's real users what kind of Interactions are happening? Is it you know a search engine going to the website? Is it an actual client? And this is very high-level, but it but it can go deeper. I Thought this was super super interesting like when we turned this on and then you could see like oh What's app or Apple bot or I think Facebook's in there. There's a bunch like that's a lot of stuff Like I it's and I thought this was very very interesting And it's very very interesting to know what kind of things are hitting your website out of kind of the standard standard Interactions because this kind of leads you to have a greater knowledge and be able to understand If things are good if things are bad should things be blocked What should we what should we be doing or is there a demographic that we should be also considering in the future? So that's kind of at the top of the stack the next one down is about locking down code so so we've compiled our you know our Drupal site or we've deployed our Drupal site and Now we want to make sure that that is the that's the truth We don't want things to change Gone are kind of the days of running Vim on an app server or a web server somewhere and changing settings dot php We really need to be able to understand the artifacts and the applications that we're shipping to ensure that the things are okay Here's an implementation of what we've done on our skipper hosting platform This is read-only containers. So the idea is that Developers can't change code, but hackers can't change code. Nobody can change the code Fun fact, this is actually a feature that I helped contribute to Kubernetes So this is kind of my my one that I'm very proud of but but this is very important because in the case of You know like a Drupal get-in or something like that bots can't go and edit you had HT access file and start mining Bitcoin and making money So so there's also that aspect too. So So if you want to continue down this path I highly recommend you either chat to your ops team and and consider how how your code's being handled Is it is it permissions or is it containers in the same vein? We have intruders being able to detect intruders. So This is something that I think has really started to come up a lot with the cloud native Ecosystem and mainly in the form of the Falco project. So so not only do you need to make sure that your code can't be changed? You also need to make sure that things aren't executing bad commands on your infrastructure. So I Think just the reality of a of an application like Drupal is that that you do have to shell in once in a while You need to be able to run drush You need to be able to run chron tabs like if a deployment fails Maybe you need to run a config import again or update DB or cliches like this There's a whole slew of things that you need to be able to do and you can't just turn off the command line For for developers to block this problem out So so the next best thing you can do is have a layered approach not only just have a read only code base but also Have some monitoring around what commands are being executed and when so then you can have some kind of audit trail in this case, I'm using Falco and Here's a really cool Example of something that I didn't know so so in this example The so I guess to start from the beginning Falco is configured to log Commands that are executed within our containers and then it just logs it logs it out to standard out It just logs it our logging system picks it up and then we can query it now For the longest time like I've been using New Relic for you know Many many years five six seven plus years awesome awesome APM software But I had no idea that it was running a Damon until I deployed a bit of software like this I'm like, oh, it's not just a peckle extension or it's not just an extension It's it also executes and fires off a Damon which makes a lot of sense But you just don't know those kinds of things if you're not kind of in the trenches and seeing what's going on So in this example, this is kind of just highlighting the fact that you should be able to audit What's being executed on your environment? So then you can put your hand on your heart and know that you know Things haven't broken through certain barriers in your infrastructure and people are running the right commands on your infrastructure as well And for my final one, which is a bit contentious maybe I don't know for some people others Might have already drunk the Kool-Aid I sort of have it's managed services or more specifically managed cloud services Look at the end of the day If you're hosting infrastructure or deploying an application or you're building a product You could say at the end of the day, you know, we're just hosting a Drupal site but you are like your product is the infrastructure that your developers use and if you go ahead and deploy my SQL and Like, you know and a firewall and a caching layer and all these kinds of things yourself There are definitely trade-offs and one of those is security because it's you know, a small set of eyes versus What I would arguably say is this is this is the product page for AWS And what I would arguably say is you know a much superior company to shipping products and manage and maintaining them and them Running audits and there's there's a lot more eyes on this versus your You know bespoke my SQL configuration So anyway on that note, it's a lightning talk. Thank you Okay, so Moving on next up. We have Hasita better key management in Drupal So he says a PHP and dotnet developer for the last 15 years And I've been involved in many small to life-scale triple projects from version 4 to 9 He's currently working as a Drupal engineer at City of Burundara. Take it away, Hasita And Yeah, it's a good afternoon. All right My topic is securing integrated systems with a better key management process in Drupal So I'm sure most of you or some of you familiar with key management Situations in Drupal or opportunities. What are the ways we can manage keys or handle keys? So I'm just going to briefly Like start What are the available options in Drupal? So There will be a poll Going on So it's asking your question like whether you have ever hard-coded your keys secrets in Drupal or any other platform at least once in your developer life So just feel free to pick yes and no based on your experience I'm guilty. I have done in that past. So yeah That's that's how we learn, right? So I guess most of the developers have done that mistake before so when it comes to things we are handling with integrated systems It comes to keys, secrets, certificates sort of things so These are the possible ways even though they are they can be bad or They are available. So anyone can hard code secrets keys anything in code and then you can store in database and then do a database query and get the keys or secret from database I know all these are bad things and then you can hard code these things in environment file so You know the dot env files. You have these files specific to environments local environment separate file and then for dev environments uat or production environments. There are separate files and keep these key secrets in these files and then hard code in settings dot php when it comes to Drupal specific ways, you know settings dot php You can have separate php settings files for each environment if you need or at least for local so you can hard code these things in there and then another way of doing that is store in files say for an example You are creating a small text file or whatever with the key and then access that file and get that key while you are accessing the third party integrated system and then another way Drupal introduced is configurations right so We can store these keys or secret certificates with Drupal configurations as well And then the other one is server environment variables. You can keep these variables in server as environment variables and then access those server environment variables when you are in that server environment and the last one is storing your key secrets in a third party keyboard kind of thing so Definitely maybe some of you have done that like you have different solutions like Azure is providing Microsoft Azure is providing Azure Key Vault and AWS is providing their solution and things like that. So there are third party providers giving you opportunity to store your keys securely and access whenever you require And on top of all this you can secure these additionally with some encryption method right so when you are storing your keys Definitely you can encrypt these keys or secrets and then use some some sort of decrypt algorithm to decrypt them when you are using to connect with the third party systems So the other one is like What are the available? method especially in Drupal or modules available in Drupal to support this key management So there will be another poll coming up, I guess So that is asking you a question Have you ever used key module in Drupal? There is a separate module called key Most of them or some of them must have used it and that's one of the best modules I have seen to manage keys. So my topic will be mainly about that and I'll be discussing what are the available modules and then finally What's available in key module? So As you suspected my first preference that's the key module and then There's another third party provider called locker. So you can find this locker and It's a third party provider like Azure Keyboard or something you can store your keys with the locker module and then access from locker whenever you need them in your application and then Townsend security key connection. There's another provider providing key management and Azure Keyboard So this is one of the custom modules. I built and contributed to Drupal So this one is connecting with Azure Keyboard and get the Keyboard keys or secrets for you in your Drupal application And there's another one API key manager and HashiCorp if you know already and on top of all these things encrypt so There's a module called encrypt and you can use that encrypt module to Secure your keys or your data inside Drupal any sensitive data in your Drupal instance more secure and there's another encrypt KMS So it's using the encrypt module and it's providing more functionality so I'm next going to discuss what does key module provide so That's my main topic exactly because That's one of the best Modules I have ever seen in Drupal When it comes to key management So key module has three sections exactly one is key providers so With the default module like with the key module it's providing three default methods One is configuration provider so you can basically Keep it in Drupal configuration with the configuration provider and then environment So as I mentioned before you can keep it in your environment variables with this environment provider and then the file provider So with this method you can easily store certificates or anything like private public certificates or anything in a file and Use this provider to manage so Then the next option key module provides is the key types So when it comes to keys or secrets or certificates, there are a few different types, right? So we know There's authentication One username password can be on pin. Maybe authentication again with multiple values Maybe a few passwords or something or maybe more than username and password and another third variable and Next one is encryption. So It can be a encryption Decryption kind of thing and then it's use password things and then the other is Providing like key inputs. So According to these key providers and key types It's offering these few types of key inputs. So one is none. So for an example, if you selected the key provider file You don't need to input any keys because it's a file selection from your server space or somewhere So you can select none or else if you are generating an encrypt key, you can Select generate and then you can select text field if you're adding using a more password and things like that And finally text area use multiple values And also you can pick override. So this is one of the The main feature In key module, you can override the config of any key for an example Say you have you are doing a custom module and you are creating a separate username password area in that custom module and it is storing in the Rupa configuration, but with this key config override feature you can basically Overwrite that configuration and store them in a third party keyboard or somewhere easily, so that's the benefit of that and plus all Or on top of all these you can extend the key module with your own providers key types or key inputs That's the best and what are the extensions available so These are the extensions available at the moment. So locker as I mentioned before you can use alone As well as you can Use it within the key module. So locker is providing an extension to key module and then town sent a km is providing another extension and then As your key vault The module I built it's providing another extension You can use it keyboard the module Alone to use the key vault and get the keys and everything in code But if you need a ui Using the face to handle all these keys in a key vault Then you can use that on top of the key module as well And then asymmetric keys and things like that Yep, and I'll be quickly finish it off and The benefits of the key module These are the benefits. So everything all the keys in your Drupal solution You can just manage it in one location And you can store in configuration environment file as mentioned and third party cloud services and On top of all those config override. Those are the best options we have So thank you. And if you have any questions, I'm happy to answer in our last few minutes of Q&A session. Thank you These are all quick lightning talks to get against So don't have a lot of time to talk Next up is Chris Burgess. Uh, Chris is exciting Excited to be is exciting and he's also excited to be working um in open source software Sharing knowledge and and still learning after 20 plus years in open source 15 of these are in in the Drupal community. He's a senior developer with catalyst it Take it away chris Um, I'll turn it up to 1.5 times. Okay. Um, I'm a developer with catalyst I live deep south in beautiful Otipote And I'm really excited about building Drupal projects in our community I'm Zerizem on most places online except for my Drupal get handle because of CVS transfer Um, so We like components. Uh, Drupal projects can be complicated staying on top of updates as a requirement for system and data security Understanding our project happens at lots of different levels from the forest to the weeds Um, we like components because we can build complex things. It means understanding the components we're using and Most agencies most organizations have a bunch of projects with a bunch of pro components in them So there's lots of advantages to understanding this but security is one of the biggest So years and years and years ago catalyst announced our comedies at a Drupal south like this one quite different actually Um, and then we turned that into Matahara and today we're looking at other ways to review how we're using all these components um Composition analysis is a tool which lets us understand what all those pieces in the pie are For a Drupal project you can have hundreds or thousands of packages in your dependency tree Especially once you consider that you've got other packaging systems in place such as npm for the theme or front end You've got frameworks and containers in the operating system and possibly firmware. I don't know what you're building So what are we running? What else is running these same things that we're using in different projects and how can we consolidate those and reduce The number of things that we need to think about What vulnerabilities do we need to care about and also what license considerations do we have for different projects? Licenses do matter and depending on what you're building they can have a really big impact on what you're able to do or what you're able to use dependency track is an OWASP project that Provides software composition analysis and I've been looking at it to see whether it fits the bill for what we want to do um currently version 436 to java application You can run it up in um docker to give it a spin I ran a demo copy up on catalyst crowd catalyst cloud. Yay nice and easy and Yeah, I had a bit of a play with it But we've been using it as a prototype as well for some real world projects. No real world data today though So how it works is you take your composer dot lock or your composer dot Composer lock and jason your package lock From node maybe your gem file dot lock from ruby Um, all of those different software systems have locking mechanisms that allow a build to record what's in it and we can take that and turn that into a bill of materials, which is a common format um a bom bill of materials bomb Um, that allows us to communicate with you know interoperate between systems about what went into that build Um, so you can pull it out from your ci or you can manually upload it and extract it You can also combine bill of materials between packaging systems together To comprehend all of the different packages that have gone into building a single project So you want to aim for automated inbound data, but you can test it out with manual manual imports and manual compiles Um, you can import that into dependency track Which will analyze and extract the metadata the versions the licenses And it will also haul and uh vulnerability databases that it can match your components against So it sources that vulnerability intelligence externally you can retrieve from public and licensed systems so you can Pull in from some of the more expensive or um, yeah restricted databases You can configure dependency track to apply your organizational rules over the top of this so Tell me about unlicensed components that exist in this project. And what does it mean for us? If we're pulling in something that doesn't have a license applied at all Um, send me a report on slack teams, whatever When something comes up with a vulnerability and which projects are affected So what do you get out of the box? This is the front dashboard of dependency track You get a snazzy dashboard that will report on all the scary things for you Um, this is the same dashboard bit bigger. Um, this is the project's view Um, so we're looking here at a particular project project one at version naught naught one Um, it's a composer droopland npm project and we can see that we've got some vulnerabilities identified And we've got Yeah, some audit audit notifications coming up as well We can dive in and explore the components that make up this project. You can see here that there is a Medium or high level warning on one of the three versions of acorn that node has managed to pull in I don't understand how it got three versions. Hey, um You can review your vulnerabilities in more depth such as this handful of multi-medium spicy npm bones Um, and you can look at policy violations So here's a list of all the components that didn't have a license and it's telling us go sort that out um What does this mean for us? So it means that we can have early advisory of vulnerabilities and not just from the Drupal components Which is what you can get from Drupal at the moment um Drush. Yeah, anyway, there's there's some drush commands, which will help with that too. We'll talk about those in a moment. Um Yeah, okay, cool interesting. I've got the wrong notes here I'm confused. Um, let's talk about that. So we get consistent assessments across projects. We get our Um a reference for developers so that they can look at the other components that we're already using in different builds Which may help you as an agency if you want to avoid Divergent spread of components being hauled into new projects and give people Visibility on what the other approach is that the same company or organization has been up to Um gives you an additional review step that you confirm up your processes around selecting components Um, and it gives you automated analysis over time So not just when the changes are applied, but also ever vulnerability drops on one of those packages That you're using you can find out about it quicksmart right, so What else is out there? In your ci pipelines, you might be using things like composer outdated or drush pm security To identify known outdated components in that space and you could be using npm audit alongside that There are also paid services such as tide lift which Offers additional support. They will help you curate your packages and tune for the appropriate licenses for your systems And they'll go off and do the work of identifying when there's a missing license in a package, which can be really useful they are a paid service and They are really engaged in supporting maintainers by contributing back the paid service Income to maintainers of projects. So they're really interesting to check out. I'm quite Impressed with what they're doing. They're doing cool stuff around funding open source, and I like that Um, and there's probably some other things too. So I don't have a poll But I would love to hear what other people are using to fill the same knowledge gaps or informational awareness In their organizations Looks like that's it. I've got a minute and a half left. Um, yeah, say hi thumbs irisman everywhere Most everywhere and that's me. Someone else can have a minute and a half go Take me off screen Okay, so We are very tight for time. We won't have time at the end of Q&A, but please join us in Drupal Slack for any follow-up questions Look forward to that. Um, so finally the last lightning talk of this session is steve kuchen On security considerations for Drupal programming Steve has a strong background as a developer with over 20 years industry experience is working with company startups and profits of all sizes And steve is currently a developer advocate at snick so yes, steve I've been developing Apps for a number of years now through digital agencies even through at being a Developer advocate or developer evangelist through a whole bunch of companies doing all sorts of fun things from e-commerce to one of my favorites iot can always integrate iot into anything. It's great. Anyway, I've been Built out a number of applications over the years and well using something like Drupal for example I've always loved because well, it's got so many great features straight out of the box That are really easy and quick to deploy Even going back to my digital agency days like building out applications Application sites campaign sites whatever as part of digital agency experiences has always been super quick and super easy but something i've always pondered as part of my What I like to think of as my developer origin story Is just what nasty what things are lurking inside the platforms that i'm deploying Now particularly when you think libraries and dependencies with the likes of composer etc When you're deploying stuff There's usually a whole bunch of dependencies that get pulled in as part of library support Or as part of different frameworks and indeed there's been times where like I've had to go back and clean something up because There's all sorts of nasty pop-ups and whatnot appearing on sites and even some of the code that I've used in the past For various projects, which I mean at 2 a.m. It seems like a good idea at the time Next minute. Yeah, you've got a compromise to help So I thought we'd go through some of the ways to make to help secure coding And I've given that Drupal is built on php. I thought we'd go over some common php ones first Now some of these you probably already know it's probably just a good reminder if anything if you do If you aren't aware of some of the security nuances to some of this stuff then hey um These four in particular are ones that I've always been extremely wary of with good reason and I mean it's common sense is exe for example in um ex exec in php for example Gives your code or gives php access to your core operating system So this is definitely one. Well, you want to use very sparingly if at all Which is generally how I've always approached any of these four Functions before any of these four base language php routines before Is anytime that I've considered using any one of these the first thing I ask is why do I need this and Is there another way? And rightly so as I'm sure you can imagine by giving code direct access to your operating environment Not a great idea There's all sorts of dragons that can be hiding inside that so ultimately investigate if you need to use any of these and I mean you can use things like cron for example to try and run batch jobs or sanitize Image manipulation for example That's potentially one of the things I've looked at using this sort of stuff for in the past anyway Use these ones extremely sparingly So something we've seen in recent years is with some of the sanitization functions like strip tags or even the conversion stuff like mb string to lower Strip tags only filters html so javascript and sql are Completely valid in its eyes, which as you can imagine there be dragons html entities for example is a good option It won't sanitize completely but you can use definable utf character sets mb string to lower it basically Can raise a whole bunch of out of bounds by utf character sets, which is why it's definitely one to avoid Preg replace is always a good way to particularly with sanitization or conversion Is a good way to transform or sanitize strings? If you need to but I mean one of my favorites to use lately in base php is filter bar Which is you know kind of the standard at the moment and you can actually add to this as well using filter flags strip high That is a whole bunch of really nice filters that you can use as part of the input output with the filter bar option so definitely one to look at What i'm going to really really really emphasize on here And we're going to talk about this one in a moment when we switch over to dripple secure coding is Unserialize yes, not only is it grammatically Incorrect, I think I can that was a good combination of word each to use but also Extremely extremely insecure and I can't stress this one enough because serialize Actually, isn't too bad there. I said it Unserialize is kind of the the bad of the worst of the the bad of the two the worst of two Because you can in serialize you can actually store functions as part of like a serialized variable set You can actually store a function which can then be pulled back out and well executed on your system as part of like a remote code execution so Unserialize is extremely bad so much so there is a whole big warning inside The php documentation for it which is one of the reasons many reasons why you shouldn't use it But also the core developers themselves from the core php team actually won't consider Any vulnerabilities or bugs raised against unserialized now as being A security issue because it's so unsafe and you shouldn't use it I kind of wish it would get taken out, but anyway, if you weren't already Aware of why you shouldn't use it is literally because A remote attacker can use this particular function potentially depending how you're Storing your variables how you're storing your data sets or user data inside serialize and unserialize They can use that to basically run remote code on your server, which I mean nobody wants that This one actually is so bad too that the Drupal security team have had issues with it in the past and shout out to the Drupal security team They do amazing work and are extremely reactive in Keeping up to date with any CVEs or security instances that are raised and very quick to patch things. So yeah Of the Drupal security team Incidentally, if you're not already subscribed to The alerts that they put out I would highly recommend to do so because Ultimately these apps that you build and support To keep you using safe. So please keep you using safe On to now that we've gone through some of the PHP stuff on to Drupal secure or coding So of course with twig templates anything between double curly brace is sanitized It does get sanitized and as devs we always Sanitize everything sometimes multiple times just to make sure because you can never be too short, right? Some ways to do some really nice sanitization so There's a couple there on the screen. You're probably already familiar with some of these. So html escape That just outputs plain text xss filter strips html tags out and xss filter admin It basically allows html only for admin users if you need to do so I'm Drupal eval. I'm just going to mention it here It I'm pretty sure it's not in Drupal 8 or 9. Actually, I know it's not in Drupal 8 or 9 But Drupal 7 does still have it. So if you haven't yet upgraded to 8 or 9 Which I know you're totally going to because it's almost out of support or everyone's being encouraged, of course to upgrade and you should totally upgrade But this is based on php Exe and eval and all those nasty dragon things that we were talking about a moment ago So please upgrade as soon as you can Some other things to remember particularly around the database storage side of things When storing data the database layer works on top of the phppdo and uses an array named placeholders of course To make sure always make sure that you correctly sanitize user input But of course you already know that because I just did two slides telling you why that you should sanitize and every Like everyone should know it anyway Sanitize sanitize There's a actually a really good speaking of sanitization There's actually a really good write up on why you shouldn't trust form input variables and it goes back to our Our old friend uncerealize There's also some decode entries in Drupal 7 as well that you should Take a look at but check out the Drupal docs on security and sanitization because there's some really good write-ups on there as well Um, just be aware of check plane. There's a couple articles on this actually, but check plane Uses client browser to provide additional or temporary sanitization Um, we've seen from the security side of things. We've seen some incidents involving browser side Sanitization Recently, so just be careful using that again. I would treat anything that you're Um, potentially concerned about on the security side of things lightly and Remember to just always make sure you're pen testing stuff and testing things where you can as well Ultimately, think like a hacker if you can get around it. They can get around it. So always I always love taking that approach I'm going to do a quick talk on a quick mention on containers because I know that's a big thing at the moment too, which Um, essentially a lot of the top 10 Well, a lot of the docker based images that we find these days on docker hub Basically contain a whole bunch of vulnerabilities in them based on You know open source like library components that we know have open vulnerabilities currently in them as well So always make sure that you're checking and scanning your container types The way I like to think about this is with great containerization comes great responsibility. I always love that that meme No, this also goes back to making sure you keep those end users safe because ultimately that's who we are building these apps for We need to protect their data need to protect their experience A good example of that and this is the druple based image on docker hub as you can see as over 100 million downloads to date, which is amazing Um, but again, like make sure you're scanning doing some base scanning on those images to make sure If there's any open source components in there that need to be upgraded That you're getting those upgraded because again users need to keep them safe That's about all I've got time for so just lastly Please always use your tech superpowers for good and be excellent to each other. Thank you very much Everybody so we've run over by a couple of minutes, but I'll surely agree They're all great talks and we managed to um to crab them all in so yeah, enjoy the rest of your Your uh druple self