Hello, I'm Caroline Bowman, Director of Cooper-Hewitt Smithsonian Design Museum, and I'm so glad that you joined us tonight for what promises to be a fascinating discussion of design and the design process. First of all, thank you to our very generous sponsors, Target Design Within Reach, Facebook and AmazeFit for making this and all of our National Design Week activities possible. This annual celebration of design brings into focus the incredible work of our National Design Award winners and includes a series of free public programs hosted by Cooper-Hewitt's Stellar Education Department. This past weekend we actually welcomed, believe it or not, over 7,000 visitors to our beautiful new Arthur Ross Terrison Garden for the Target Family Design Festival. Here today, just about a half hour ago, over 300 New York City high school students met professional designers from across the country to ask questions about career paths, inspiration, and the day-to-day life of a designer. And for those of you who might be free on Thursday night, it's not too late to secure your place at the National Design Awards gala, visit our website for more details. Tonight's event is a really unique opportunity to gain insight into how some of our country's most talented designers think and create. The National Design Awards span 10 jury-selected categories, and the recipients joining me here on stage represent four of them, Roman Alonso of Commune, winner in the interior design category, Stephen Berks, recipient of the Product Design Award, Adi Gill of Three Is Four, winner of the Fashion Design Award, and John Underkoffler, winner of the Interaction Design Award. I never cease to be amazed by the intellect and imagination that our winners possess. Their work is truly inspiring, and I can't wait to get the conversation started so that we can all learn what drives them, what excites them, as they share their experiences and perspectives with all of us. Now, I can't help but make a plea for social media. For those of you that are tweeting tonight, here are our hashtags. Please feel free to go wild with social media. And to kick things off, I'm going to ask each of our panelists to introduce themselves and say a few brief words, and then we'll launch into a conversation. It should be. Hello. Yeah, it is on. Hi, everyone. I'm Roman Alonso. I'm one of the partners and founders of Commune in Los Angeles. We're an interdisciplinary studio. And I'm one of a group of 46 people or so that work at Commune, and then we have an extended family of artists, artisans, craftsmen, builders. And we can't do what we do without every one of those people involved. It's a process. A process that we learned in other lives. We came together about 12 years ago and created this company from different paths. So some of us were trained closer to inter-design than others, but it's something that we learned on the job mostly. And from each other and from the people that work with us. We believe on a holistic approach to design. We have graphic designers, interior designers, and architects in our firm. And whether we're doing one or all those aspects of the work for someone or for a client, we still consider them all and think about them all and have a background in PR. So I even think about that when we think about a narrative or a concept for a project, particularly a commercial one. I can't help but think how we're going to communicate to people what we've done. So we really do look at it pretty holistically. Anything else? Hi everybody. I'm Stephen Berks from New York, representing New York. My studio is called Stephen Berks Manmade. I'm a product designer, industrial designer. Over the past 10 years, my work has been about kind of returning the hand to industry. So we look at the intersection between what a machine can make and what a hand can do, working with various artists and groups around the world. And we look at that space as the most fruitful space for innovation. I usually work in the luxury sector, home furnishings mostly, but also in packaging and some interiors and installation work. I am very excited to be on this stage because I was once a juror for the National Design Awards and going through that process and thinking to myself, maybe one day. So for me, this is about opening the kind of closed sort of closed world of design to a broader audience, expressing a more pluralistic vision of design and hopefully accessing a kind of broader cultural spectrum for what can be part of the conversation design. Good evening. My name is Adi and I'm one part of 3S4. My other partners are sitting right here. We have Gabi S4 and Angela Donhozer and we work together. It is our 10 years anniversary this year, so this is a big celebration.  And we make fashion, but we don't consider it as fashion. Hello. We think that our garments are timeless. So we look at them as something that will stay forever. And we show in fashion week in New York, but we also do a lot of art shows, gallery shows, museum shows. So this is our tool to express whatever we do with garments. And what else can I say? I guess we'll have more soon. I'm John Undercoffler. I'm the co-founder and CEO of a company called Oblong Industries based in Los Angeles. So you have two Angelinos sandwiching the New Yorkers here. Coast to coast, LA to Chicago as the song goes. I'm deeply humbled to be among you and I'm sure it's only a matter of moments before Caroline discovers her horrible mistake. And I'm escorted from the building. But until then, my goal has always been to, in many senses, humanize the computer interface. We are, after all, an intensely digital and organic beings at this point. It's a choice we've made by not making the choice and there we are. And so if no one's doing anything about adjusting or improving or evolving or advancing the human machine interface, which at the end of the day is all we have as humans, it's the only part of the computer you can see and touch and feel and affect. If that language is not advanced, then we become, we're placed at an increasing disadvantage. That all sounds polemic and sad sack. Of course, it's really, really joyous and the proper inspirations come from all over the place. What we want is for the act of using a computer to be a kind of joyous and synthetic experience that is informed most of all by how everything in the physical world works, and least of all by how anything in the history of computers has ever worked. So I think that's probably way more than enough. Wonderful. Thank you to each of you. Am I loud enough? Can you hear me in the back? Great. I should tell you that John had me jumping up and down before this panel discussion. He says he does this before each stage present, so it'll make for an especially scintillating conversation tonight, I'm sure. It's a great honor for me to be with the four of you. I'm very excited to celebrate your achievement all week long and all year long through the National Design Award program. Thank you also for participating in the Teen Design Fair. We've been having a lot of discussions about time this afternoon. So what I'd like to do is go back in time and then go into the future a little bit later in the panel, and I'll be asking some general questions, then some more specific ones, and then we want to open it up to all of you, because I'm sure there are a lot of questions. So just to get personal for a moment, I grew up with sort of wonderfully crazy physicist, engineer, father, and our cellar included photographic dark room, a place where we actually made telescopes and made the lenses of the telescopes, and a printing press, which was my favorite. And at about six, I grew this real love for typography, and I would set my business cards, which of course didn't have any career on them, but just Caroline Bowman, and I would give them out to people on the street. I'm a total nerd, I know. But I'm bringing this up because it's when I believe that my love for design was really sparked. So now I'm going to open it up to our panelists. John, do you want to start with when were you first inspired by something related to design? I thought it was safe being at the end of the alphabet here. That's really hard to say. For me it was an implicit thing that came gradually over time, and I think I was probably dabbling in it before I was consciously aware of it. I mean, we can choose individual moments, and they often revolve for me around a particular process. So I had a fantastic aunt or aunt, depending on which part of the country you're from, who inspired me in lots of ways, gave me books on building pinhole cameras. She was a photographer herself. And so you start doing this, you build a pinhole camera, then later on the first time you have a handset type is critical. And I think I'm really interested in all of these physical processes that are a little bit lost, or the teachings that they bring with them are lost as we go to digital everything and digital this and that and so forth. So I'm doing a really rotten job at answering this question specifically, but for any given field, and I think all of this is at its best when it's colliding as many fields as possible, you can find individual moments.  All of those are formative moments, and then at a certain point you kind of find yourself doing it for a living. And you had mentioned watching movies with your mother, was also a big inspiration for you? Yeah, it was, and there's a few in particular that I remember vividly. And they're turning points in future careers. So you can't plan those moments certainly, and you just sort of have to take them as they come, that's for sure. I think design is everywhere for me, and I think for my partners as well. We always look at nature, and first of all, and we think the way we are designed as humans, for example. This is the best design, or even if it's a cookroach or a butterfly, anything that comes from nature is first of all the most ultimate design for us. I think looking at that and combining it with what we actually do, that's a beautiful challenge. And our work is always about that, and we always try to combine that, and especially these days, nature and technology. So the most interesting balance for us is to find these two elements. And I think, of course, I was not conscious when I was very young. I don't know if that works so well. It goes in and out. Hello? Okay, so I think when I was younger, I was not really conscious of... I was not really thinking about these things. I was just creating. But I think with time later on, you really put more thoughts into that, and it all makes sense now. We're going down the line here. I think it's interesting that we all have the hand as a starting point for what we do, even in the digital realm, and maybe that's significant of the winners this year. For me, I grew up always knowing that I wanted to make things, and always conscious of the physical things around me. And then, you know, my grandmother really, there's always the one relative of my grandmother in particular, really pushed looking at art and being aware of culture, in a sense. So I'm from the inner city in Chicago, and Chicago has not only great museums, it was always a member of the Art Institute, for example, but great architecture. And so very early on, I had this kind of fascination with the skyscrapers and the built kind of urban environment. And maybe that's not so visible in my work today. I don't know, but there's this kind of underlying modernism that I think is really part of who I am, because of where I come from and what I saw and what I've been kind of involved in. So taking that and translating it into the objects that we make, which are partially made by hand, I think sometimes it's an interesting approach, those references that come out when you don't expect them. I was raised in Venezuela by Cuban parents and definitely surrounded by aesthetics and architecture and all those things. But I never ever thought about it for a second. And a lot of nature too, and I just sort of lived in it. It wasn't until I was in my teens, I think I might have been 15, I came to New York to visit a cousin. Cachita was her name, and she lived in Union City. And she was a disco queen, and she took me out. And I have to say, it sounds kind of cliche, but I opened an issue of interview, and that led to an issue of details. And I was 15 years old, and I didn't know what it meant, I didn't know how to do it. I had no idea, but whatever was that was in there, I had to be part of it. And of course it led to eventually moving to New York to experience that. I think that that was the beginning of my interest in design, in all kinds of design. Something hit me, even though I had been always surrounded by it, I never felt it. It was something about this place that made me think about it. And now I reference that past of mine and that childhood all the time. I think about it so much in retrospect. It really shaped me, but I wasn't aware of it. That's funny because I think that moment in time, creatively, was really impactful. I mean, maybe we're all of a similar generation, but I have to admit, my uncle was living in New York at the time when I was in elementary school, high school. He was the cool guy that came back with the stories. He had the imagination and he had the right books to read and all the right references. In a sense, New York became this kind of heroic figure also, I think, for me creatively. And we met downtown. Yeah, in the 90s. We know each other from way back when we were 12 years old. Exactly. No, it's true. I think there's something about that New York connection, at least. Urban spaces are really important. They're not the only important thing, but they represent the combination of density and potential. In some ways, New York is in danger now and David Burns written recently about it and so forth. But the 90s, when anything was still possible, when artists could afford to live in Manhattan. The 80s. Yeah, well, that as well. I did. Which again is why our teen design fair is so invaluable for these kids. I mean, it's really an unforgettable experience for them. And I certainly wish we had all had a teen design fair when we were 13 or 14 or 15. And Tim Gunn brought up something really interesting this afternoon about being in a rut. And really encouraged the kids to get out of that feeling of being in a rut. And I'm curious, keeping with this time theme, can you all talk a little bit about when you felt particularly challenged in your careers? Either giving a specific example of what was that brick wall where you thought, should I be in design or should I be doing something else? I know it's a tough question. So up to you, who wants to jump in? It's funny. Okay, one of the kids asked me that for sure. You know, what do you do and when is your most challenging moment? And I literally said every day. You know what I mean? Because it's sort of about just always doing the work. You have to kind of always be doing the work. And Gerhard Richter said something about the everyday act of painting. So just being present for your own profession in a sense is so important. And of course it's always like, how are you going to get over this? Or how do you get past this? Or how do you get beyond this? And every day I have those challenging moments. That's exactly what I wanted to say. My answer was every day. I mean, there's always something. And even now people think, oh, you've got this award, which is amazing. But at the same time, I mean, there'll be another thing tomorrow. There's always a challenge. And it's life, I think. So we just chose this. People say, oh, fashion business is so difficult. Yes, it is. At the same time, I'm sure the art business is difficult. The music business is difficult. You know, that's a part of life. And we chose to be independent and to do what we do by ourselves. And yeah, I think when we first started, we really didn't think too much. We just went for it. I always compare it to a jungle. I just spoke to some of the kids and they asked me what's the best thing for them. And I suggested, you know, I think to intern is the best school.  And I think looking back, I mean, I didn't have a pass by school, but the best school is experience and life more than anything. I mean, I think there is nothing like that. I agree. You know, for me, it's strange because I didn't do what I do until very late. You know, I didn't really design an interior or anything until about 11 years ago. And I had a few lives before. And I think my first job as a designer for Commune, because I wasn't doing it at the beginning, was a project here in New York. And I remember starting to work on it and thinking, I don't know anything about this. And the project had a ton of molding. It was something I really didn't have any background on or anything. So I did what I always did before. You know, I threw myself into research and I threw myself into finding out from the best people I could get my hands on everything about it. And just by being busy and following a process, I think you unlock that. And you also gain the confidence because you're gaining knowledge. So for me, that's always been that way, whatever I've done, you know. So I recommend that as well, you know. And Tim, what he said too about stepping outside, I thought was important. And in any city that you're in or place, you can, you know, benefit from that. He was saying that New York is so stimulating, you can step outside and be inspired immediately.  So I think, yeah, stepping outside is also important. I think the one thing I'd add is that for me at least the remedy for being stuck and really badly stuck is the same as the remedy for everything else and that's comedy. So I was a graduate student at the MIT Media Laboratory in the 80s and 90s. Itself is any place, right? The brilliance of Nicholas Stiles' lab in a very technical surround but to deliberately collide all of these disciplines and scrape together all of the misfits from around the university and around the universe. But after a while, I myself got very, very badly stuck. And they were trying to throw me out of school, which probably would have been a good idea. But eventually a great friend of mine said, this is the media lab, it's ridiculous. What's the most expensive thing, the most expensive project you can imagine doing? And I said, well, why don't we replace all of the light bulbs in the world? And I won't go through the rest of the story but the kind of combination of bombast and comedy, it's the one thing that can jump you a very high distance indeed out of any size rut. Be ridiculous, always. I'm thinking about Adi's comment about cockroaches and butterflies and looking at your outfit and remembering my wonderful studio visit from about 10 days ago. When the three of you are designing, are you thinking about a specific client or are you creating a line and not thinking about... It really all depends. It depends. There is a little bit of everything but we usually just... I think the best thing is to think about yourself. Because we do many things, some things are more out there and loud and some things are actually very approachable. I think people look at us as those very avant-garde. We don't like to say that word but people like to use it. We look at our garments like sculptures but it doesn't mean that you cannot wear them. I'm wearing a dress that we actually just did for our last collection. I think you can see that it's different but it's very wearable. For me, this is a good challenge. I'm all about balance so I'm all for that. Cockroach and butterfly is a good balance too. Something in between. How often can you just exhale and draw and design without thinking about the line? That's a question for all of you too. Because we have to obviously live and feed our clients and give them what they need. How often can you just have fun whether it's digitally or on a piece of paper or with watercolor? For us, we're always working on 20 different things at the same time. The scale of the things are different from packaging to furniture to exhibition or something. I really thrive when I have more to do. The more things that I have to do, the more I'm inspired to take these little breaks and say, okay, what about that? I make a quick doodle here, a quick sketch there and it may be completely unrelated from the project but it's somehow connected to another project or something else. The butterfly cockroach metaphor for me is about having enough different things going on that for the studio it's a mess and very confusing. Nobody really knows what I'm thinking at any given time and somehow that can be destructive but it's also constructive and I think that's just how my mind is working. How do you unplug, though, with everything going on? How do you refresh? I mean those little breaks when I get to actually, I don't know, if I have an idea a day, I'm excited. That's a different idea, unconnected to all the quote-unquote projects, let's say but just something that comes into my head like, wow, what if we did that? Or how about this? Or this material? Or this place? Or these people? So I know it's not a vacation but it's somehow inspiring and it takes me elsewhere. And certainly your travels I'm sure are a great source of inspiration. Yeah, that's great. That's amazing. So John, are you equally physical when you're looking for inspiration? Do you do calisthenics? I think exercise is important as the first lady would tell you. We have to keep our minds and our bodies fit. There's more balance, right? But I think getting outside of the built environment is really, for me at least again, it's absolutely the key. Driving down here from Boston two nights ago, my wife and I stopped in Connecticut at the big old rambling farmhouse of an old friend of hers and I was thinking back, nothing has recharged my soul over the last year like standing in the barn with the chickens, petting the chickens with a glass of wine at 1 a.m. Sounds good. Try it. It's amazing, right? That's pretty cool. Nature. I was in the middle of nowhere like, I don't know, actually it was somewhere very specific. Three, a month ago, I was watching chickens. I didn't dare pet an egg because I'm a city boy. But I was outside of a small village in Senegal making these baskets and it was to me so refreshing to see just wildlife running around and people just sitting on the floor and things just being completely free. I petted a goat, but I don't want to tell anybody about that. Is that legal? Farm animals? But that was kind of cool. It's the change of context, too. It's so important, right? I always think about David Cronenberg, the filmmaker and one of his best films is Existence and until you realize it, you don't realize how brilliant it is that it's the only science fiction film, and it's very good science fiction by the way and there's not a lot of that, the only science fiction film that you can think of that doesn't take place in an urban environment or in space or something like that. It's deliberately set in the countryside. There are no televisions, no telephones and yet its ideas are kind of as progressive and transgressive as anything you've ever seen. So just juxtaposing something really, really unlikely is another way to bounce yourself out. I'm like the luckiest guy in the world because I get refreshed just by starting new things within my work. I've always been curious and I really take the opportunity that the work that we do brings to learn new things and learning is really what energizes me. So any opportunity I get to experience something new, read about something new, learn about something new, that's my vacation and I used to take vacations when I lived in New York and they involved laying on a beach. I haven't done that in years because now my vacation's involved going to investigate something or meet someone or learn about a new city or seeing new architecture. I mean anything like that for me is a total privilege that is attached to what I do. I wonder if that's true of all of us because I didn't take a vacation this year but I went a lot of places for work and maybe it's just a new way of working but it's great when you can travel for work and also get inspired and also feel like you're getting recharged and not miss the lane on the beach thing. In LA we hike. I mean that's one thing we have that I didn't have here but just hiking up a mountain and down within 45 minutes you kind of feel like a different person. We go to Central Park. It's good too. Beautiful. So I'm really interested in the client-designer relationship and Stephen starting with you one of my favorite projects of yours is the Missoni bottles that you covered with fabric and it was reused fabric and I'm wondering can you talk a little bit about how Missoni responded to that? Were they excited? Were they hesitant? Yeah. So I have a kind of special relationship with them which evolved over years but the vases happened very early in the relationship and I don't know I felt like I was working on one project and they were interested in that project and we had just started collaborating on this new exhibition thing together and I thought I have the ear of one of the most amazing fashion houses in history like how can I do something just for them? What could I come up with? And for me the patchwork sweaters that time Missoni used to wear and that are for me iconic of the brand and that sort of signified not just who they are but what their inspiration is and so they were very open.  I mean this is kind of the process. I think we started with a candelabra and worked our way through a chair and through all kinds of other objects and ended up with this vase and something about the vessel being so, I don't know, archetypical in a way and crossing cultures like really resonated not just with me but with them so they were very open. They never knew that the vases were all recycled. I mean I don't know. I remember my mom was in town and we went around to all the thrift stores we could find and bought these vases for like next to nothing but then the combination of, this is what made it so important to me the combination of a $5 thrift store vase and this amazing digitally woven textile because their fabrics come out on a loom which is like a giant inkjet printer with hundreds of spools of yarn up above and all these different colors that are feeding and all these threads and we got to go sometime. It's incredible. Feeding in and it's literally just like white glove guys and this beautiful fabrics coming out and so taking that fabric and combining it with something almost disposable just to make something by hand in the studio it was like a light bulb went off. To me it was a completely new way of working and sort of unlocked all of my other projects. So I'm curious, Missoni got it, right? Yeah, they were. So your embrace of giving work to people in the developing world and then first world clients did you ever have to give more of a convincing plea to some clients? I mean I have to admit it hasn't been as successful as I would like. I mean we did Cappellini Love with Giulio Cappellini and you know a year into the project he said, hey, you know what? We're not really selling these like we should be or we think they're too expensive or, you know, so it becomes... Those are the recycled wallpaper magazines, right? No, we did Silicone and Mosaic Glass Tile and oh yeah, yeah, yeah, the tables. Cappellini Love tables, you're right. I almost forgot about that. But yeah, so that stuff, in a way, it was really exciting for us and they jumped into it but then it's about the long term, you know. How do you get that long term commitment and that long term support? And I think the work is difficult because it's easy to get the marketing buzz and it's kind of indicative of the times. You know, everybody wants the kind of fast hit but to really take those craft traditions and make them part of a contemporary vocabulary over the long term has been the harder challenge for us. But you were a real... I mean people are following in this trend now which is fantastic and you're one of the first to go down this pathway. Yeah, yeah, yeah, it's all my fault. Building that bridge. No, no, no, I'm really... It's been really exciting and we're just looking at different ways now, you know, like what's the next step for that and where does it end up? I found that people are talking less and less about that way of working from let's say DIY to artisanal this to craft that to more experiential design. Like that's the kind of new catchphrase. So how we've all become acclimated to the notion that our environments, our objects, our fashion, all of these things become touched by the hand in some way and that adds quite a bit of value but then it has to now do more. Like the products, the spaces, the fashion, everybody's kind of expecting it to do more and so this notion of experiential design is really interesting to me. Like what does that mean for all of us and where does that go? Well, Commune is known for sort of blurring the lines between eras and styles and the Ace Hotel is just such an incredible project and one of the things that has caught my eye is the tiles that remind me of the Frank Lloyd Wright tiles in Blade Runner actually. Can you talk a little bit about the history of those tiles? Yeah, she's talking about the Ace in Los Angeles, not here in New York, but we have a very interesting relationship with Ace. We've had a very long one and we kind of grew up together and our process of design has evolved together. So it's very symbiotic and how we think about things and sometimes we have to surprise them because they kind of know every step that we're taking. Those tiles were a surprise. They don't like to put their name on things or have noticed that but they don't really have an overall identity for the company, each hotel has its own and they don't really like to put their name on the front and we hid their name in that tile. I didn't see it right away. Did you watch carefully? They actually didn't see it for a while and when it finally was produced they loved it but that's just part of a very small part of a narrative that we create together and for that hotel in particular it had to do with the architecture of the building itself which was built in 1927. Los Angeles as a place and its history since then and we looked at what was happening in Los Angeles at that time and really dissected it. In all areas the building was Spanish Gothic which is something that doesn't really exist but it was like a Hollywood version of that and at the same time that Mary Pickford commissioned that building in the height of total craziness, LA and the prohibition and all that Schindler and Neutra were doing their thing and really establishing modernism just at the same time and Frank Lloyd Wright certainly had started it in Los Angeles so we pulled all those references together and that tile was just one part of it. All these different characters played a part in the narrative for the hotel and Frank Lloyd Wright was one of them. So where were those tiles made? They were made in Los Angeles. I didn't know if you used the Heath connection and had Heath. Well we worked a lot with Heath. In that project we didn't have any Heath but usually there is Heath in our projects and probably 80% of what we do we were very close to them. So do you sit in any of the ace hotels and just watch so that people don't know that you're the designer to see what the response to this hybrid space is? Of course, I mean that's the fun. And what's the reaction? You know it's all kinds. The first one we did was in Palm Springs and it was the first for them working with a designer and I remember when it first opened spending time at a pool and I was so surprised because it really wasn't what you would have expected. You know there were families and older people and it really felt like a campsite and that's what we had designed for. And it was like wait a minute, it just happened. Like it's there. And I think we set the stage for it but it's really nice when you get that response and what you've created actually fulfills a purpose which you thought of. With them it's very much about that because it's a fully experiential design and everything falls into place. The music that you're listening to as well as the fork that you're using and the room is just part of it. You get involved in those conversations about the fork choice. And we work the same way. Everything we do is like that. Our backgrounds led us to that. Pam was a production designer and you had to learn who the character is and to her it was just as important what they were eating because she had to pick the right fork. And in interior design that's our approach. We got to think of what's happening in that room and the best way for that to happen because it has to follow function. It has to work. Everything at A's has to work. It has a purpose. The operational narratives are really detailed and they change throughout the day and all that comes into play. In the guest room, a lot of them are very small and have to involve an enormous amount of things that you might actually need and never thought you did. All that has to be covered and because the spaces are so small, something has to be designed for every single one of those activities. So it's very customized the experience and most of the time with a budget. So it's not like a lush production. You have to really think about where you put your money and usually it goes to function first and then you figure it out. So how often are tweaks made and how do you analyze what's working and what's not? It never stops. So constantly you're making changes. Palm Springs opened seven years ago and although it's pretty intact, there are still things that come up and... It's funny, Palm Springs... I think that was the first day Cybers stayed in, but it felt to me like it was rediscovered, not designed, quote-unquote, like it was sort of a bit... I mean, definitely feeling like... It had been there forever but then at the same time feeling very alive and of the moment, you know? So I felt really comfortable there. And I'm not normally hanging out in the desert like that. In a resort town. It works. I think with interiors, for us, it's like when you can't put your finger on it, when you can't, when you don't really notice it but you feel great, that's successful. We really focus on the way things feel and the way things look. It's not really about decoration. It's more than that. The people in the gift shop were really not very excited when I wanted to pet the pelt wall. But surely... You must have anticipated that. They're okay with it. Maybe they've been retrained. Can you work on an ace hotel on the Upper East Side, please? So Cooper Heard visitors can enjoy. I'm sure they'd love it. I think Gabrielle and Angela will try anything and cause a person to reimagine what a dress is. And first of all, I'm very happy to hear that you're celebrating your 10th anniversary because Cooper Heard is also celebrating our 10th anniversary of National Design Week. So we share one more thing. But I would love for you to just dive into your process a little bit. Your creations have such an ethereal, beautiful quality. Talk a little bit, for example, about the dress you have on was conceived and then constructed. Well, like I said, there is no one specific process. Anything that we do, all the collections or anything, in a way they're all connected to each other because what we find inspiring is, like I said before, nature is a sacred geometry. For example, let's say fractals are something that we use many times and I'm sure we'll do it again. And every time we use it, it's always different. There is so much to play with and it's fascinating and just to find a balance between nature and us so anatomy works makes sense to us because after all we are creating garments so we have to work with the body so just to be inspired from anatomy is super important for us. At the same time, we also like to work with traditional craft work technology and balance these two aspects together. In any of our collections you can see the thread that is connecting through all the connections and these specific dress well, I was thinking about I don't know if there is a specific story to it. Actually, we believe that something needs to function on the body so this dress for example is a good example because it works with the body because it's a woven fabric but also an elastic fabric together and that's why it can work. So we've been playing with that like putting two different fabrics together we call it like it's like future garments because it works with your body for example, we can make a suit but we can add like an elastic fabric under the arm and you can actually move why you have the jacket on so we like in the last few years we've been playing with that and we love experiential yeah but at the same time it works, it makes sense it's not about making something, of course we do shows and we love to work with for example, we did like a 3D printed dresses for the last few seasons we're very lucky to work with an amazing company materialized from Belgium they sponsored us to work with and we got so excited to play around with 3D printing and that's the future but in the future we believe our garments will be 3D printed and you can develop weaves that will be moving with our bodies and that is the future so we started playing with that as well so we're working on different weaves with our architect we're actually working very closely with an architect without him we could not do this by ourselves because you have to use specific programs and the challenge is to work again to work with new technology and still think about the traditional craft and I think why it makes sense especially to us because I think we are the in-between generation we were younger than our cell phones or anything like that and now nobody can live without their cell phones so for me it makes sense to work with these two different these two different things because we are the in-between generation so it makes sense so there's this wonderfully creative feeling in your studio how does the work divide between the three of you and do you use pencils, charcoal, what's your medium computer everything? I mean we are very lucky to have amazing interns that come from all over the world two of them are here to work with us and we only get amazing people we are very blessed so we do everything our interns get to be our assistants so we everything really computers sewing cutting, pattern making we do it all and between the three of us there's no specific we kind of learned with the years to let each other be or at least try and what's so great I feel very lucky to have my two partners because the good things about working together is when we can uplift each other because we are only humans after all so when one of us feels a little less inspired the other ones can inspire we inspire each other so for me it makes sense and I feel very lucky your family, I'm sorry yes so you're referencing the future as a perfect glide into the world of John undercoffler who also celebrates an anniversary of 10 years it was 10 years ago that Minority Report came out and I believe it was 2002 when Steven Spielberg invited you and several other major thinkers across the nation to get together and talk about what will the world be like in 2054 and apparently John was one of the most valuable participants in this group not surprising at all he interviewed our panel with talking about the future and at the TED Talk in 2010 you referenced a lot about the power of the gesture in interaction and what that might be like five years later so here we are five years later do you feel like we're dragging behind or the opposite dragging behind well in some of the ideas in Minority Report I wish I had the mesh glove to do this and gesture and make things happen that's not a common place activity now so that kind of thing it's actually the first thing that we built at Oblong Industries after getting it off the ground we literally built the Minority Report stuff so a glove based gestural gesturally driven system turns out that that isn't by itself general purpose enough and part of what we need to do is remake the computer in some better image but it has to be a general purpose computer so the gestural stuff is technologically bound but it's also I think situationally bound I'm not actually this is going to be hugely disappointing I'm not that concerned about being five or fifty years into the future I think the present is about all we can handle and we're not doing that great a job as a nation or a world or a species at it I think sometimes but there's certainly more than enough work to be done here and right now and frankly having worked on a bunch of films is fun but it's not nearly as much fun as bringing it to life in the real world so can I ask a question I'm actually interested in words a lot generally and I'd love to get from each of you your favorite word this year because you probably have one for me two years ago it was agency the idea of efficacy the power to make stuff happen last year it was permission because that's what we get hung up on is waiting for permission and this year it's exhilaration that's a great word and when I look at your plural work that's the sense I get exhilaration thinking of myself being in environments exhilaration visually thinking about the structure and forms of the culture or being in it myself and the exhilaration of being around these fascinating objects and I think it's really really hard to define design I don't know if anyone has a really because it's so big and so all encompassing but for me that's one piece that's non-negotiable there should be a moment of recognition there should be a click, a pop there should be exhilaration in everything you build and I think if you follow that and a couple of other deep principles as your poll star at some point on the horizon that you fixate on and sail toward you do better than if you're simply trying to predict the future Silicon Valley right now is full of people and overfunded companies trying as hard and as fast as they can to build some little chunk of the future that is then disposable and thrown away and we do it again and there's a great deal that's lost through that process I think I mean I don't know I'm completely bored with this idea of the future I don't know I'm talking to my team about what Steven Burke's man made this that or the other looks like and I have trouble with it because I don't like the starting point you know what I mean I don't like the box, I don't like the screen I don't like any of that stuff and so my favorite word of the moment is participation and I'm just, I'm really obsessed with how do I get more people out there participating not just in this talk because I think we need to do that but also in the work that I'm doing I think one of the things that the future has brought us is access so everyone has access to these tools like I was talking to the teenagers today and I said you guys have Google Sketchup do you use Google Sketchup and we just started using Google Sketchup okay that probably shouldn't admit that but I mean that's free it's incredible the access that we all have to very complex tools for making things and so when I compare that in a futuristic way with the access that I would love everyone to have to very traditional ways of making things that's the hard part so to get back in touch with a greater sense of why this is this way or that's this way or you know this is this way that those things to me have so much value and I don't know how to get more people participating in that so I'm really thinking quite a lot about how we can all be more engaged in the real stuff rather than artificial stuff although Sketchup is pretty cool I don't think we've ever been very focused about the future I mean I'm going to speak for my business partners but I feel like we've always looked back to look forward in everything that we do and like all of a sudden like ten years past and we're like oh my god it's been ten years because we're really focused in what we're doing at the moment and always looking back to actually execute that so what you say about really looking at traditional ways of doing things and why they worked and why they worked for hundreds of years and why they're still here I think that that's perhaps more important than obsessing about what's going to happen because god knows I mean I'm the son of Exiles you know what I mean enjoy it while you can that's been our motto as a family so for me it's always been about now and I think for my partners too it's like we just focused on the everyday and making sure that we believe and enjoy what we're doing presently and that leads us into the future I mean here we are beautiful Adi what's your word I agree with you I think now is the right word in the same time I think hope is a good word it's a timeless word and I think yeah we've for any all of us I think hope must be always there and in particular with what we do in fashion in the end of the day we always say nobody needs another dress really like there's enough dresses out there or like but if you have some kind of a meaning behind what you really do and what I want to bring up is not just working in a group we and finding a balance between nature and everything that I said for us it's very very important to deliver a higher message I was born in Israel I take you somewhere completely else I was born in Israel Gabi my partner his parents are from Palestine and Angela my other partner she's half Russian half German she was born in Tajikistan so for us it is important to deliver a bigger message with what we do with yeah design and fashion it is important to find something else and deliver especially today a bigger message with a higher message of unity and togetherness so for us it was always and I think it will always be a very very important subject well yeah now exhilaration participation hope hence some kind of bad poetry or something well unity and hope I think this is a great opportunity to open up for questions from the audience I see there are several and Susanna here has a mic so please introduce yourself also thank you yes hello my name is Issa to I'm a student at Parsons I have a question for those of you who are continuing to or have worked with artisan communities in developing countries how have you gone about trust when you've gone into these communities I can start to talk about that I mean it's you can't really you kind of have to do it and then maybe they trust you I have to say this was my third or fourth trip to Senegal this recent one I took and it was really challenging because I had to struggle just to get permission to take photographs permission to document the work in the process of the work which is really important to me and so you know regardless of the number of times I've worked with this little community there's still this question of like you know I represent the other you know I'm like this outsider and believe it or not in Africa I'm not even black you know what I mean so there's so many degrees of otherness there that I can't even talk about but it's it's challenging to get that trust I started with not for profit so I started working with aid to artisans artists news to Columbia the Clinton global initiative so those are a great way to kind of at least get your foot in the door because they have the they have the people the local people in place they you know they're kind of opening they introduce you as someone that's there to make a contribution but since I've been going independently more and more often it's very challenging because I'm just kind of like this guy you know and sometimes they look at me like a walking ATM and sometimes they look at me like you know I'm gonna really radically change things and I don't know if that's for the better or for the worse and it's hard to say but I believe in the idea of progress so this word hope is super relevant and I believe in the idea of participation so for me you know we can't look at these communities and say you have to remain this way so I can come and play every now and then it's about trade not aid you know and so to get them participating in the bigger story of design is always my goal and in the way that I can share that with them so sending the pictures back of okay here are the basket lamps that went into this place or you know here are at least the pictures I took of you you know so there's little ways to kind of build like I didn't just leave you behind and forget about you kind of thing but it's tricky I mean it's not an easy I don't know effort to kind of pull off but it's doable great question can you raise your hand high I'll have the same question hi I'm from Cooper Hewitt but I have a question because you're representing both coasts and since I know you've lived in New York and Los Angeles how would you all characterize the differences in those two cities as creative senders that's certainly changing they're both changing you know LA will always have the geography and the weather and that certainly creates for a different situation it's and when you reach some point in life they become that situation becomes a lot more important than others that you might find here so from a personal point of view it's an easier place to live all around because of those two things that gives you a lot more time and perhaps energy to devote on yourself room to actually work on yourself that's something that I never did in New York you're always facing out in LA you're forced to look in and it's a total cliche trust me I know but it's true it does give you that opportunity and it's why some people make it they have to deal with it they have to come back but if you embrace it you actually start finding out certain things about yourself and that exploration is enriching and I'm not saying that you can't have it in New York it's different in New York in New York you're inspired and you have to be open to taking everything around you and then really filter it through and that is a process within yourself as well but it is different they're both very different places and I think they'll always be because just you know what's in them but a lot of people are moving to LA right now from New York and that's interesting I don't know we have our arms open as I was saying earlier the conversation is more interesting in LA in the last few years I've been talking about the second city phenomenon a bit just not that LA is the second city to New York I don't mean it that way but what I mean is that maybe you know in this kind of global moment that we're all going through when we have so many tourists dominating the kind of primary cities of the world the London's, Paris's, New York's Tokyo's population that lives there on a daily basis almost has to take a different path you know what I mean I feel like the urban condition becomes striated in that way or you know there's a duality of two different lives being lived at the same moment whereas in LA maybe I mean not that you don't have tourists but there's a lot because of the highways maybe you don't see them the way we do in New York the sidewalk is the highway and I'm almost for an express lane you know like I'm almost I'm almost there but that's a real problem we have so I was thinking maybe for the creative culture to flourish in the next generation you almost have to think about the Detroit's of the world and the Chicago's my hometown of the world where it's a little bit somewhere in between it's not New York, it's not LA Paris or Tokyo it's not like the whole rest of the world is converging on you all the time there aren't expectations there can be a little more room to breathe that's interesting because LA and New York are very easy to contrast when I first moved to LA somebody said something to me and it really stuck and they said to me you're in New York you're always looking up and in LA you're always looking out and that's a really big difference so the contrast is big but yeah I mean when you're looking at other cities you have to it's a little more subtle the differences and I think they offer different things that are less obvious I mean I haven't tried it so I don't know but you guys maybe someone it's a possibility it's just a possibility I think that makes it make sense there is opportunity and at places like Detroit where young people, creative people can live I mean that's what New York was like and perhaps it'll become that again I know that it isn't really that moment right now it's apparent but you know cities go through cycles and usually there are about 20 years long before some change happens so maybe it's coming up but it's really about young people and being able to exercise their creativity in a place that they can afford to do it in and that they're given the opportunity to do it in and you know they follow those places so we'll follow them a few other questions Hi my name is Melinda and I'm a designer and I also volunteer at the Cooper Hewitt whether you feel that you kind of live design all day every day or if you have hobbies that are completely unrelated to design that you do to kind of get away from it or if you do design related hobbies as well once a week I try and go running living in LA we can I mean I exercise and I spend as much time outside as possible because we can and it would be a crime not to so that's kind of what I do I get outside I think for us we leave it pretty much every day because in our studio we call it the silver cage and it's never stopping I mean there is always action for my own self I can say that the best place to go is inside of yourself you have to just recharge I call it so people call it meditation that's the best charging battery the best recharge you can do for yourself yeah I don't find that there's any outside of design it's always there if you're not doing it you're taking inspiration for the next time you need to do it explicitly it's always back to the hands I think the single most satisfying thing I've ever done physically with my hands is glass blowing and the second and it's been 20 years and about a year ago I started making bread this is going to come off very hippie-ish and horrible but it took a full year to get to the point where you understand the dough with the germs no packaged yeast the germs that are floating around your kitchen so they're your germs and there's a your body has wisdom so there's a physical reality to this thing that you're shaping with your hands and you can get it mostly wrong and then bit by bit you get it right you can feel it rewiring your brain you're getting in touch with bits of kinesthetic and proprioception and all the pieces of your brain that are completely dropped to the floor when you live in a digital world so I think doing as much of the opposite as possible is always a good first start maybe we should try let's go try the bread or try bread making make it hi my name is Gretchen and I'm a student at Parsons and I also work at the Cooper Hewitt with Susanna for Susanna but I have a question in terms of why design is important and how you articulate that to young students coming out of the teen design fair how to articulate more than just wearing more than just using why design is important and how to articulate that to non-designers we actually were talking to some of these young people about that about how it's if it isn't well designed it doesn't work well so you know how it works is directly tied into it's design and that's really the first thing about design it's how things work everything I've always talked about everybody being capable of design for me I think about how design comes from our dreams and it's just it's like a direct expression of your consciousness you want to be actively changing your environment and so besides the way things work I mean just moving your furniture around you know what I mean just the clothes that you pick out you know there's this whole designing of the self I mean I don't know how it could be unimportant but it is changing the way we think about what design is definitely changing you know I look at my industry and this idea of design title D like the big you know Milan Italian design world and how that is in some ways becoming less significant less important and young people today may never ever aspire to a $10,000 sofa and that's okay I mean I hope so I'm curious how the impression of design is changing I think it's always going to be relevant it's always going to be important but I don't how we define it and what it means to people is changing it's somehow becoming more innate so I don't know if that answers your question a little bit for me the word is consciousness and I'm really glad you said it I mean design is the imprint of time on something that's going to last past the present moment and so to say design is important is basically to abdicate your responsibility to anything I know we were talking about it now but your broader social responsibility to anything other than you yourself at the instantaneous moment after that if you have any kind of regard for what happens next and what happens next or if someone needs to use it later you need to think about it later then it's design we at Cooper Hewitt like to obviously emphasize how design changes lives also and in response to your question about how do you get the younger generation to realize that the design with the other 90% series has really done that we saw a huge number of high school students and college students really getting it with design with the other 90% so we're now working on the third iteration which will open next year and we're also working on the third iteration of design which is on poverty in American cities so that's a big part of Cooper Hewitt's mission in opening young people's eyes to the power of design I think that's fantastic and I heard recently the Nobel Prize winner in economics saying that the actual poverty index of water systems and food systems and all of this so design is having that huge impact and the rest of the world for sure design of communication other questions is that a hand? I think it is there was something that somebody asked him about if they couldn't get into a school that kind of stuck with me because that is a thing and it shouldn't be so he was worried about financial assistance and I think that is a big thing and I was really impressed that he was coming from an art and design high school which I didn't know existed when I was in high school so it already seemed to me like he had an advantage but he was still worried about the right school and how we would pay for school and all of that I don't know, I feel that if you become a well-rounded person and really learn from the experiences that you have around you, you could become a designer but maybe that's naive, I don't know I mean, you look for your heroes you hound them you get in there, you work for them for free you do all the things that you need to do to learn from someone if you can't learn from a school so, I don't know I don't know, I've kind of been whenever I'm speaking in things about the idea of no heroes and I do that intentionally because I think I feel like everyone's path is different and even if this kid doesn't go to the right school if he's really passionate about trying to be a designer trying to design things, it'll happen somehow and I think you weren't going to school and here you are, it's incredible I think that's amazing we start to think that you have to take a certain path and I don't think you have to honestly there's a lot of heroes out there and they don't have to be on stage and they don't have to be in the right magazine and all this stuff for me it's vitally important that if you're pursuing design that you somehow find your love in it find your passion in it and then just do it so he might be who knows, the next young the set or the other without any kind of school at all school is overrated a lot of times certainly today it's overpriced doing is more important than schooling I was telling the kids that the best school is life and experience and I told them the best thing is to do some research and just go and work for whoever you admire and that's the best way to learn and that person could just be like your next door neighbor I don't know, you find heroes everywhere one last question oh great, last question so my name is Matt, I actually I work for John with full disclosure with John and we're here celebrating achievements and I'd be curious to hear about significant failures you've each had and how that sort of shaped your future achievements so I was fired from my first design job and right out of school you know and after a year working in this department the consumer environment so it's called with a big design consultancy thinking I was going in the right path getting the salary I wanted and business trip and I realized that I was just maybe not mature enough for that and it was kind of like eye-opening to me because it made me reflect upon like first of all is that what I really wanted is that where I wanted to be is that what I thought design was did any of that really make sense to me and were they just crazy for firing me because I think I so it made me want to just do it on my own and so that was like a bit of a spark for me which kind of propelled me into wanting to run my own business I think there's many I don't know which one to choose just like so by the way we did went a little bit to school back in Germany but that takes me to your question it was a very commercial school and me and my partner Angela went I don't want to say name but it's pretty commercial and we had to pay a lot of money to get to the school it was for three years so the first year we took what you call it like sketching, designing and then you took sewing and pattern making and it was super expensive for the second and third year we had to choose one part because I couldn't afford and also my partner we couldn't afford to take both parts so I chose design because I was attracted to sketching and whatever I wanted to include design and now I'm thinking maybe I should have taken that apart but what I wanted to really say is that at school back then because it was so commercial we actually always people looked at us the teachers and the manager everybody looked at us as like the black sheep it was too much for them we were never commercial enough and never good enough and we came here and somehow just went to the big jungle New York and just followed our heart and just did what we we did and still that's what we still do and we're still doing it so back then it wasn't good enough for them we didn't get the very high grades I think as a designer you have to be ready for failure all the time especially if you're working with clients I mean sometimes it works sometimes it doesn't and you can't take anything personally but you can learn from it so there have been many failures if you things that we couldn't solve things that we couldn't do it's always important not to put it on them but to see about what you did and how you can actually improve on that and maybe next time it'll then work so lots of failures but definitely learn from every single one of them have a long list can we talk about this back at the office? well you know almost every young company goes through at least one near death experience and some of them turn into death experiences but it's very rare to find one that doesn't have that and Oblong certainly had that about three three and a half years ago and it was mainly through stupidity and inexperience on my own part and it was incredibly painful like a vacation compared to some of the stuff we went through back then but I think one of the great secret weapons in human endeavor is existence if not persistence if you can manage to keep going at all then then the Brownian motion and the random jiggling eventually kind of finds its way and stuff that deserves to fall into place falls into place because certainly for the first four years no one knew what we were talking about at all and then they started to get an idea of what we were talking about but they didn't want to buy it and over time if there's any merit at all in the ideas that you pursue there are little sparks there's little points of connection where somebody recognizes it and that kind of snowballs over time wow Cooper Hewitt's mission is to inspire, educate and empower people through design and I feel very inspired from this discussion I just don't want to end it but we have to and thank you so much this has been really thoughtful and illuminating so many thanks to each of you and we look forward to honoring you on Thursday night thank you


So a few weeks ago. I did a streaming event where I streamed for a couple of hours. It could have went a little bit better Long story short. I did a test stream people said there was some lag So I lowered the quality video so it didn't look as good and then it was streaming too fast So the timing got out and people were complaining that the video was going faster than they were watching it And people were at different times the video blah blah blah anyway if you're a patreon supporter I've already sent you links to download those videos At least most of them in little chunks, but I will be over the next two weeks Posting them all here Some of them are gonna be pretty boring some of them are just me playing video games by myself playing video games with my daughter But I also go over some interesting stuff. So I hope that you enjoy these videos We'll see about doing another streaming event in the future possibly I Thank you for watching and as always I hope that you have a great day Look forward to those videos starting tomorrow should be one almost every day this week and then again next week And maybe the week after that there should be 14 or 15 of them Have a great day


Hey there, welcome to the webinar. My name is Steve Jageir. I'm a developer advocate for Bridge Crew and in this show We're going to while you just set up on screen What is the cost of a secret identifying secrets with a check off before? public exposure as I said, my name is Steve Jageir. I'm a developer advocate. That's my Twitter and Check out that loose lips might sink ships. I found that that is some I guess you'd call it I don't know if we call it propaganda I guess it is kind of called that from World War two from the United States and it still applies today It's interesting that information leakage can cause some form of damage regardless of the context and that's what we're going to talk about today. How can we mitigate the damage of releasing secrets, but also Find secrets as early as possible in our software supply chain. How can we do that? So Let's go for it. All right. So next Let's look at some horror stories Starting with the fear as always, right? The first one goes way back to 2014 Ryan Hellyer did it did actually a lot of the right things He was trying to give back by pushing his WordPress website into get up He knew that the WP config which is kind of where all the secrets live in WordPress Decide what you want about that from a security perspective, but he knew that was a bad thing to push He put it into his own directory Added it to the get ignore all good things But missed one critical piece and that was that there was a a backup mechanism that created a dot save version of that That was not in the get ignore that got into AW that got into github, sorry and Within well, he went to sleep big mistake Doing things just before you you go to bed six hours later. It wakes up. He has a bill from AWS for six thousand He was running six hundred EC to server instances. He normally has zero So that was a bit of a giveaway there and then cleaning things up was an absolute mess both in terms of AWS and In terms of github so he blocked the whole thing out there for all of us to learn Have we learned not really? Yes and no Fast forward to 2021 you have to be living in a cave to not have heard of solar winds Intern leaks passwords. They always blame the intern don't they? SolarWinds CEO testifying in front of Congress. This is not what you want You do not want to ever find yourself testifying in front of Congress. That probably means that your breach was significant, but in this case a An intern leaked an internal password, which you normally think would be safe, right? So if we move this way, you can see the solar winds password solar winds one two three I Tell you I have worked for a lot of different companies and I can guarantee you even the best intentions Fall sideways when we're creating internal passwords. They're almost placeholders. We still use password one two three solar winds one two three They it matters internal passwords matter as well, but that's probably for another webinar All right, let's move So what is a secret? Let's let's expand our definition of that if we go back to these guys here the hackers cult Slash almost comedy film from the 90s now when they you can see it like on the weird lighting on their faces above me love God secret password had to be in there surely these were the we obviously were not paying brute forcing Let's say brute forcing was pretty easy back in the 90s. You're not that are you a skilled hacker really? It's probably seen pretty easy back then Now though it probably doesn't look much better. This was from a report from Dashlane I believe it was or one password or last pass or a password management company They released there every year. They released their top passwords 2021 number one was one two three four five six Passwords in there courties in there So I'm just kidding solar winds one two three was not in there But you get the idea these are all very simple passwords, and you're probably thinking I don't use past Does anybody use password? Can you even use password anymore because there's so many constraints around what you can do? I'm sure these are legacy, right? That's why they're still there, but we haven't we really haven't human nature has made it so that we never learn, right? That's what we do. That's our that's what we're best at not learning Now what we do instead of writing password is we capitalize the P or Maybe we add special character Or perhaps we add a zero or we add a one or we put an exclamation point on the end and that's good, right? No one's gonna figure that out. That's crazy complicated. Oh, but then the my organization makes me change the password every month So, okay, I can die right got it. So That's kind of what we do now. So why would we expect anything better in the future? Now to make matters more complicated when we're talking about secrets Automation needs passwords now so now we have generated passwords and those can be really messy like if we look at a shot two five six of That word password one it's a big messy complicated thing and When we look at that we're like, whoa, okay Well, what am I gonna do with that? What if you had to use that as you're creating automation? What if you're writing some code and ansible you're creating something in terraform and you need that to? Provision something or to create something or configure something. What do you do with it? Well, your first instinct would be like well, I'll just do I hard card you as soon as you say hard code That's like a swear word in programming, isn't it the H word hard coding So you don't want to do that. You need some kind of strategy for your secrets You need a supply chain for the secrets themselves that keeps them private and That is a whole other problem So let's talk about a little bit more about that. Let's get dive in Secrets are passwords, so we're still in familiar territory But what they represent in the real world is database credentials encryption keys API keys SSH tokens that is not an exhaustive list, right? I'm sure you realize that and How do they get revealed publicly? Well, we saw those two examples You can just forget to add Files to your get ignore by accident or just simply through ignorance You can hard code them into a container image That's there's lots of ways that container images can give away secrets not just that one and we can do a whole webinar on that You can cut development corners by temporarily hard coding your credentials into something Temporarily, you're gonna remove them. It's fine, right? I'm not saying I've done that personally recently Even though I know and I'm doing a webinar on this. I have made that mistake. It's easy. It's too easy to do Finally committing infrastructure as code templates like terraform cloud formation Many are available into your github with the credentials inside and this is very very easy to do and you're probably even thinking How could that even be possible on you might be asking the question? What is infrastructure as code? Okay, it's possible. You're thinking Can you just do a quick Definition of that and I will do that one slide a one slide infrastructure as code So you want to provision things at scale? You don't want to do it manually. That is a massive pain So you there's many formats of code for doing this and there's many types or styles of doing this So there is procedural and that's probably very familiar an example of that would be Ansible and Then there's declarative and a good example of that would be terraform or Kubernetes YAML What does that look like in an abstract way? Well, think of it in terms of like making a cake, right? Preheat the oven to 160 mix flour eggs butter to a fluffy the imagine these are all commands in a script and You want them to be repeatable and do the same thing every single time So you put them into your recipe or in Ansible's terms a playbook You run it it will happen you get the result a cake is made although that is kind of assuming a bit of knowledge that I am a chef and chef interesting, okay Which I might not be what I like better and is becoming very popular is the terraform example as you can see Now I rely on a provider who is to act as the the creative the chef and I simply say I need a resource It's a cake. It's called birthday surprise. This is my spec icing fondant sponge texture diameter layers boom make it And that's all we have to do and I have a cake I really like that because you can even use that to look for a drift to see if the cake changes over time Does it match my code of definition? It is declared state Instead of procedure.  Does it happen? How often does it happen? Interestingly, you can see up there. I've got hacker news get a co-pilot which was released just a few months ago in Beta Digitates valid secrets. Does it really? I don't know Get a co-pilot is an AI driven plug-in for VS code where a lot of people create these these infrastructures code templates And what it's doing is it's spitting out Predictive lines of code and even functions to make you code faster in a variety of different language including infrastructure as code templates so In some instances there were some claims potentially conspiracy theory Maybe a little bit of trolling that this co-pilot was spitting out passwords and API keys that were still valid Based on the breadth of its knowledge from the massive github code repository Is this real? Was it not real? Nevertheless people believed it because it it happens that often that it made sense that perhaps this was a possible thing Let me make you make it clear though. I Really tried to do it and I could not do it So I don't know if it's possible or if they fixed it right away, but it doesn't seem like it's doing it now But nevertheless What do you do if credentials are exposed? What if you accidentally did this? Let's let's put a little bit of corrective action in here just to just you get an idea Of course, you should disable the keys that you think were in there revoke them immediately Rotate them look for compromised services like what happened to the individual who Checked in their WordPress credentials and suddenly they had 600 servers running Look for your logs for nefarious activities add probably have to add new monitoring clean your get history That's not easy. I'll show you a little bit that about why that's not easy in a moment It sometimes can be easier to delete the repository entirely if it's new and just create it in your current state If the history doesn't isn't that important to you and then of course monitor your supply chain Look for breakages look for anomalies and understand that you might be part of someone else's supply chain So your mistake might be affecting a lot of other people as is what happened with solar winds So finally and the important thing why we're here today add automation to scan your code for secrets So it doesn't happen again and ideally it doesn't happen ever Some best practices surrounding that create that secret supply chain first Before you need it in automation think about how you're going to do it if you're in dev and you need You just don't have it. You don't have access to it. Whatever always put your secrets into another file Always put them somewhere else and then reference that file and add that file to your get ignore. That's smart Don't put it into the comments like I did and check it in that's dumb because even that even though afterwards when you do The code right because it's not hard coded anymore. You forgot you added it to a comment at one point and now it's like oh If you're in prod, of course use a Production-grade secrets manager like cyberk or hashi-karp free ones are available paid ones are available and almost every cloud provider has one so It's becoming easier and easier to do things right. It's more. I think In dev where things go wrong or when we're rushing or when we're cutting corners that problems can arise Which is why we need to scan Any code be it our application our infrastructure as code anything needs to be scanned before it goes into github Ideally as a pre-commit or on your desktop. So how do we do that? Well, let me introduce you to check off check off is an open-source tool for analyzing infrastructure as code in Analyzes all sorts of different types terraform cloud formation Or my helm Kubernetes yaml serverless framework. There are over 500 different rules that is looking for for common misconfigurations You can see some examples in the image just next to it there However, we have improved check off to add secrets and that is really quite interesting check off It's new feature for scanning secrets is a combination of some of the things we already had in there There were some there was some secret scanning already there combining prowler, which is looking for AWS misconfigurations like CIS benchmarks and secrets with Yelps detect secrets yep Yelps detect secrets was written by an individual named Kevin Hawk and actually full disclosure We asked him to be on this webinar and he kind of didn't want to do that and I'm all right. No problem I never met him. He's very bright guy, but when I looked at his LinkedIn, I saw that all right not the most forthcoming His about says hi no picture no background. Okay got it. No problem You want to just write your code. He speaks through his github account, which you can see right there But combining those two together We are able to create three different types of identifiers and ways of finding secrets and infrastructure as code regular expressions keywords Looking for entropy, which is interesting. We'll talk a little bit more about that in a moment So regular expressions are fantastic if I look at the different types of regular expressions We can see Artifactory AWS JSON Mailchimp Slack very specific ones right Stripe Twilio Regular expressions allow us to characterize a lot of different Credentials a lot of different secret types so that not only do we find the secrets But we can tell you specifics on how to remediate them, which is pretty cool Now also keywords versus entropy. Oh, pardon me If we look at an example of keywords, we're just looking for obvious things like API key password people do that They just say oh password equals and so there are some very obvious common loco low-hanging fruit in terms of finding secrets Because if you call that API key, it's probably an API key So we're looking for wording that fits those those keywords and then finally entropy entropy if you look at a Passphrase and there's a good example there correct horse battery staple for random words in a row that looks weird and You can find that using using an entropy based analysis and Now I could have put an API key up there like we saw earlier that Shaw 256 now that even to the human eye looks Weird so that falls into the same category But it's worth knowing that entropy extends beyond that into examples like this and what we do with checkoff is we even combine all of that so that We're reducing false positives So we're combining all the different checks together But then characterizing the check into an individual type when we're done So we've taken what Kevin Hawk has done. We've taken what prowlers done And we added our own kind of secrets off to that to make it really good All right, you saw that let's take a look. Well, let's let's do it now. All right. Let me just share my screen really quick Screen we are awesome. So I am in a Terraform Directory look there. I have terraform for a whole bunch of different formats. Okay, AWS a Azure It's all part of a bridge crew intentionally vulnerable Environment and I can run check off. So let's do that. I ran it earlier I've still got the command line here check off dash the AWS is going to check my AWS directory And I've got a you think I'm using quiet so that I get I don't get all the things that I successfully did I know I don't need a pat in the back just yet. I'm just gonna look for the misconfigurations So it's that simple. I'm gonna run that and We're gonna see a whole bunch of bright colors go by there we go It's looking for everything. I didn't say just look for secrets. I don't have a configuration file I don't have a baseline any of the other Things that you can do is check off. I'm I'm scanning fresh and we can already see some of the misconfigurations I have in here. So we just look right there like the way the bottom a base 64 high entropy string You might be thinking okay looks like Something bad clearly not base 64 example key there We also could have caught this on secret key and probably combined some of what we're doing to make sure that it was Certainly we caught this one access key AWS access key. We're being pretty specific about that one, aren't we? Private key so we're we've caught this Most likely using a regular expression and we go and we can see a few other ones slack token basic auth credentials Twilio API stripe access key that's getting pretty specific, isn't it? That we found in here and what's kind of even better about this is that We're offering guidance here. So you can see get secrets 17 if I go over here We can see the kind of information that we've been given We have very clean clear instructions revoke the exposed secrets with administrator permissions You can access the stripe api and navigating to the developer section It tells you what to do in the context of stripe itself And we can also see if we look down here Same thing goes for if it was a twilio api key, which we did have we get specific twilio instructions On how to do that. So we're providing guidance that is specific to the type of key because we characterized the regular expression specifically For that type, which is awesome And there's upwards of I think there's almost 20 different types of regular expressions. We've got going on here Now, of course the last step we say clean the get history. We don't get into that Easy just what does google clean get history and just one of many articles will come up That show you hey, let's get started a word of caution. Oh, no, this is not a short article So if you want to know the pain of cleaning your get history You can find it very easily and this is just about having a tidy history That article wasn't about how to eliminate and ensure that you've eliminated a leaked access key That can be That can be a lot worse. Let's say So that's how easy it was for me to find Misconfigurations in my code, but also Secrets that might be leaked in there and of a variety of different types And how easy it was for me to find instructions On how to remediate them Very specific to the type of key that we had which is great Okay, so what are my key takeaways? let's jump back to my screen share and So key takeaways keeps keep secret secrets. Well, that's secret secret That is the whole point of this this webinar be prepared for leaks in advance Assume that's the larger your organization the higher the likelihood somebody is going to leak a secret that would be bad Create your secret supply chain in advance So make sure you know how you're going to handle automation And secrets before you start creating that automation. That's ideal. It doesn't always happen probably rarely happens But understand what you're doing and if you are in dev and you don't have Some smooth automation with something like vault Then always put those secrets into a separate file And add that to your git ignore. So even just maintaining a best practice from an individual perspective is important Remember that internal secrets can still create risk scan all your code Not just your application, but also your infrastructure's code and not just your infrastructure's code also your application Scan locally if you can using checkoff. It's easy to install on a mac. It's like brew install checkoff super simple Add it to ci checkoff has a github action. That is as simple as running it on your desktop It's a one-liner github action and you can embed this into your ci And you can also use that as a pre-commit hook, which I highly recommend and of course finally revoke and rotate keys often in fact when you're choosing services Make sure those services allow you to revoke and rotate keys That can be an important way that you method you used to decide what services you're going to use in the future Because it's really important Okay that Is the end of this Webinar Once again, my name is steve gegar I hope you enjoyed this and you learned a little bit more about checkoff You learned a little bit more of secrets and maybe you learned a little bit more about infrastructure as code That's the end big thanks to the cncf for hosting this And if you have any more questions about checkoff or your And you'd like to maybe join our community go check us out at codified security all one word dot slack dot com Come join the community That's where people talk about the open source tools that we've got a bridge crew and request new features, etc So we'd love to see you there. My name is steve gegar now Let's do the scooby-doo ending All right anonymous hacker, let's see who's really behind all of these data breaches Danny DeVito Whoa, I didn't see that one coming My name is steve gegar. This is the end of the webinar. Thanks for watching