All right, so my name is Brad Powers in the CTO at Passport. Talking a little bit about complexities and government payments. Find print. This is for informational purposes. I'm not a lawyer. I don't give legal advice. Ask your legal counsel if this is the right thing for you to do. We've done some of these things and I don't know if it'll impact your business specifically, but hopefully it'll give you some stuff to look at. So I'll kind of give you an overview of our business and the concepts that apply. A lot of the same problems that you guys are tackling that we have done at Passport. PCI and a baseline of what's important and what I think is important for you guys. Regulation in the payment space. And I don't know, I called it secret sauce. Maybe some of the things that we've learned and some of the similar things that you guys have all uncovered in payments and government. So Passport, we've been around for about six years. We have about 500 customers. We're processing about 300,000 payments a day. And our basic products that you guys probably know about are mobile payments for parking and transportation. So here in Durham, if you download our app, you can pay for parking on the streets or private parking lots. Or if you're riding the bus or the light rail or heavy rail, Miami light rail. And pretty much a lot of the other cities that we are the back end of most of their systems. So Chicago, London, Montreal, Toronto, Boston, et cetera. We are the payment platform that these guys are running their payments on. Not just those mobile payments, but we're also doing the enforcement aspect. So when you get a citation, we might be writing it. So apologize for that. And then tolling. So if your car is not parked, if your car is moving, we might be tolling you as well. We want to try to make money all the time for the government. If your car is parked or if it's moving, they want to be making money off you, right? And how do you figure out, you know, how to manage those revenue streams for the government when gas taxes are right? Or gas usage is going down? More electric vehicles losing tax revenue and gas. Also now you have to make up the money somehow. So is it going to be tolling? How are we, the government, going to do this to continue the revenue necessary to support government operations? So, you know, issuing citations, mobile payments, writing a train, bus, and then validation. So maybe you don't pay for parking. Maybe your restaurant pays for parking on your behalf. That's kind of our solution set that we're working through. That is a map, but I don't know why it's white right now. Some of the customer base, you might not know, but those are some of the apps that we support out there. Our model is right. We're a gateway at our core. Everything is a payment with our specific verticals of product that process those payments on top of it and with a data management reporting layer for the operators, right? For the government entity so they know what's happening and then followed by, right? We have advanced analytics, which is a light at this point. It's not too advanced, but we like to be advanced. But that's more around, right? You know, maximizing revenue or compliance or how do you predictively price or dynamically price parking in certain areas based on demand? Is there an event? Are there any spaces left? How do you get people to the right areas when there's congestion, et cetera? So those are the things that we're focusing on. I just like that slide, so I included it. Marketing makes these cool slides and I'm like, man, that's a great one. I'll take it. So very similar to what everyone's doing here, right? We have a marketplace and we've had to build out some of these gateways because we're selling to governments and when a government has a contract with a particular payment provider, all their payments have to process through that provider. So I think we have 19 or 20 right now that we are integrated with. And we've also done our own gateway with First Aid on their Rapid Connect platform. But just, again, very similar things that you guys are experienced with. So talking about PCI, here's just a couple of things we're going to talk about. PCI, why I think it's important for you guys at any size to just go ahead and start thinking about yourself as a level one provider. And that's when you're processing 6 million Visa and 6 million MasterCard transactions, or if you've had a data breach, a credit card breach, or if they want to just demu your level one and you have to do it. So the reasons why I think you should start thinking about it now is because the further down the path you get to not doing it, you'll make mistakes and scope and just decisions you make from a technology perspective or a compliance perspective or a user access perspective. All these different things will really change how you make your decisions today. So if you just think of yourself like you should be doing it, it'll make it a lot easier when you have to do it. For us, we're in government, so everyone wants a stamp of approval to mitigate risk, right? If we can come up with an AOC signed off by a third party auditor, great. Reduce risk for the government, they love that. With your QSA right now that if you have a third party coming in, they can give you some great recommendations on things to do. There's another set of eyes that will really help dig into some things that you might not have thought of. We've been really happy with having a third party do that for us. Again, stamp of approval. Third party ethical hackers. Every other year we hire a different firm to try to get through our system and we provide them all our source code so that they can make an attempt, as much of a valid attempt as they possibly can, with as much knowledge as we can give them to try to do it. So if you haven't done it, it's actually pretty fun and they always find something. Compliance in the cloud. I guess we're at AWS that clears up a few of the requirements related to PCI. When we started doing this five years ago, when we went through our first audit, like some of the QSAs, it was like they're the first time going through an audit in the cloud as well. So it was a learning experience for everybody and what's important. And when you're saying you're at AWS and they're like, okay, we'd like a data center tour. It's not going to happen. So it's become a lot easier and they all understand it now. It's great. PCI for like, it's not something you do once and don't touch again. It's constant work. There's a constant level of effort that you have to continue to maintain. And there's costs and bodies associated with that. Our Visa and MasterCard registration. Again, for us, it's like validating compliance. It's a barrier to entry. Once you're compliant, once you're registering with these guys, you're getting the contacts at the different building relationships with Visa and MasterCard. Again, Stanford for customers are all about low risk. They're about working with someone that's been validated and proven and trusted. We can keep out the small guys in our business because it's government RFPs. If the requirement is you need to be validated by Visa and MasterCard and someone doesn't qualify. Sorry, you don't qualify. You can't compete with us. So you can't build that RFP, right? So keeping other guys out of the business is one of the ways why. Like, hey, require service level one, right? Other guys won't be able to compete with you then. Make it a requirement. Tokenization and card store. We ended up doing this at the beginning because we wanted to operate on multiple gateways and we wanted a seamless experience for the user. You know, it's more about the technology is easy, right? It's like encrypting a card that's easy, providing a token that's easy. But it's all about the implementation of it and, you know, like how you do key rotations, how you expire cards out, how you delete cards. All the processes related to that and maintaining that is way more important than encrypting a card. I had a good collision. That's just something we ran into at one point and I thought it was interesting. I don't know if anyone else has run into anything like that, but it doesn't happen often, but it happened once. So we had to have a solution for it. Key rotation. Since we're all on the Amazon stack, it's become a lot easier because they have products like their key management systems and just, again, there's a lot of new technologies out there and services provided that just take a lot of the complexity off of us. Regulation. I'm going to pick up a piece of paper because I don't want to say things incorrectly. But I'll try my best not to screw it up so I don't get mad information. So e-commerce laws. There's a lot of guys out there that have spent way more money than we've all spent figuring out terms of service and agreements for your terms of service with your user and they probably do something maybe similar to what you do. So take a look at their terms and see how they're doing it because they probably had a bunch of lawyers and things look it over a lot more than we did when we started. Shipping delivery refund policies. All this stuff is like, if you're clear with your users, it makes it a lot easier when someone complains and then files a lawsuit against you for your refund policy or your terms of service. I mean, I'm sure, I don't know if everyone else, the past like three weeks, how many GDPR emails you've gotten telling you about updated terms, updated this, updated like, yeah, we get it now. Just another GDPR update email that likely they're not even doing anything correct. But you got the email so they're clear, presumably. E-sign and UETA, right? This is about disclosures and like how you disclose information to your customers because when you're contracting a payment or an account that is holding funds or something like that, how you, like, customers have the right to get that data or get that statement in writing like by mail, so like having E-sign specifically calling out those things so that you can provide that electronically. Like if you don't do it, I mean, they can ask for their statement in paper on a monthly basis or something. So just some things to like, you'll probably see it the next time you look at someone's terms and conditions. It'll mention E-sign. Handling customers data, right? Like data retention policies. This is all things that like the government's very sensitive on because of breaches constantly and they don't want to be at fault because they'll be liable, right? So liability taxes, how you collect taxes, third party, there's awesome third party tools out for tax services and calculations that I'm sure all of you guys use as well. But relying on other people to reduce your risk and your burden is great for that. Accessibility, Stephanie talked a lot about accessibility. It's interesting to think about parking and at least in the parking space thinking about like, okay, maybe there's a blind person and maybe they want to drive their car downtown and pay for parking. That was like some of the things like, why does our app have to be accessible? That doesn't make any sense. But maybe they're riding in the passenger seat and want to pay for parking. So accessibility, right? Like, again, it's a government service paying for parking and you have to be accessible to all people and you have to have an option for them to pay. In that parking idea, right, we have to be accessible to all people and that means like all levels of income too, right? So if someone has a flip phone, they can call our IVR system and walk through that way like on an IVR telling them, hey, what zone are you in? Please enter your car, et cetera, et cetera. And then we have a web-based payment system, right? Instead of just an app because maybe someone doesn't have any space left on their device or they have a Windows phone or a BlackBerry. So we can't discriminate against anyone because of those choices. We have to provide a payment option for them. So money service businesses and registering with Vincent. This more applies to, like, if you're moving large amounts of money across between, you know, if you're making, like, when you're the merchant of record and you're going to be holding money on someone's behalf and then distributing it out, this is most of what it has to deal with, right? It's like, it's more of a banking thing and the guys like Venmo and PayPal and some of the marketplaces, those guys have to deal more with that. We do have a wallet which we do collect funds and distribute money out from. So there's interesting scenarios there that we have to do, although we operate a closed-loop wallet and operate under a certain value threshold that makes you exempt. But if you get into bigger accounts and amounts, then it starts becoming a factor. And then when you have to do things like this, all the monitoring and reporting and then how they come after you for suspicious activity and they want to investigate your systems and records and people using your system. So if you just keep those accounts small, you don't really have to deal with it. I think even PayPal went through something related to this and while they didn't admit that they had to do this, they went ahead and did it anyway. But that was a long, I think it was some time ago. Money transmitter licenses. So like if you're transacting between states or transacting business in states, you have to get a license to do that. And so you have to decide which you're supposed to have them all if you're doing business in all the states, but it's quite expensive. Look at the states you think you need to do and maybe do those. Some are really cheap and then some are expensive, but yeah. I mean that's a tough one and it's not like they're out looking for people, but when they do one audit, they audit pretty much all the states get together and we'll get on your case or something like that. It's an interesting rule. I'm pretty sure like more than 80% of people don't even do money transmitter licenses, but you're supposed to be. I'll talk a little bit about I guess what we consider our secret sauce and maybe some of the things other people were doing. I'll try to focus on the ones that I think other people didn't already hit because no reason to repeat it all. So when we built our system, we tried the same things that others were trying to do. I'm not a speedly customer and I didn't even know about them until recently and it's interesting because a lot of the pain points we have in processing are like similar things that they're having to deal with too and it's just funny that I didn't know about it and then someone else is tackling the same problems and maybe I could just throw my problems to them. At least for some of them, right? So I think I'm going to say build versus buy, yeah. I'll talk about that in a minute. So when we built our service out, we separated out into a totally different AWS accounts and the access for those accounts is limited. We have about 40 developers and we only have three guys that have access to our PCI environment and that's the infrastructure, that's everything code development, get JIRA. We have a separate instance for all of that just to segregate it so that there's no questions about who's accessing it, who has, you know, there's no questions. It makes the scope, someone talked about scope and they said, you know, make it as big as possible. You want to make it as small as possible. All of our systems, they don't have any access to payment information. They all work on tokens and requesting through these services. So it's like this little service is a stripe or a spruedly or something like that. So that was what we did to really accelerate so we could accelerate growth in our other platforms and not have to worry about a lot of the security and controls around that, although we still, when we run scans and things like that, we still run scans against our entire footprint of our system. Yeah, it's worth it. You know, it's just, I'm just kind of showing the card flow and what we have here is like, so everything's segregated, right? The client app is making a request to tokenize a card and authorize a card from a completely independent system. Completely different domain. Everything's totally separate. And this is just, I mean, this is like your card folder data flow that you'd probably have to submit for PCI if you went through something like that. Wallets. No one's really talked about wallets, but it's really interesting for us. And when we look at payments and merchant processing fees, you know, we've got payments that are like real, like low dollar amounts. So although we're processing 300,000 transactions a day, some of them are like a quarter. And that's not very efficient when you're charging a credit card a quarter. So we instituted wallets. And so some of our customers that they have low parking rates or low transit fares, you have to do a $10 wallet. And that was one thing that from a costing perspective, you know, when the Durban Act came out, like that eliminated the small, your small payments, discounts that most PCI and MasterCard were offering to make them economical to process. And when they introduced the Durban Act, that went away. And so everything was, all the rates were jacked up and you couldn't process them cheaply anymore. So that's where we got into the closed loop wallets. So it works for parking. I'm sure it works for other us. You know, I think Apple, when they were originally doing some of their app store purchases, I think like they almost kind of instituted a wallet or they were batching your payments on a regular basis just to consolidate the spend or it was iTunes or something like that. They would like, you know, give you the day and then charge you at the end of the day for what you were doing. Fraud in our system is interesting too. We don't see a lot of fraud because you're paying for a parking space and usually entering your license plate number. So we have integrations with all 50 states. So we can look up the registered owner information on a particular vehicle. So you're likely not going to use a stolen credit card to charge parking for your own car. So that has been something that we haven't, our fraud rates are so low. We haven't really had to deal with that yet. As well as when we do detect fraud or get a charge back, we just blacklist your plate and you can never park again until you make a phone call in and say, okay, I will take care of that problem and I won't charge back or I will repay that and then you're allowed to park again in the city. So, I mean like, yeah, we can, it's the government, right? They can make it so you can never register your car again or renew your license.  So they will not be defrauded. I mean, I think it's simple to understand why the wallet's efficient for merchant processing, right? You're just dividing up the cost over multiple transactions and like I was saying, if you're having a low dollar amount charges, it makes 100% sense. I mean, I don't know if there's, if you guys have business models that are similar, but it makes a ton of sense for us. Batching, you guys, the push pay guys hit on it earlier, right? Like it's even, while it's important for them, it's even more important for us because we have inventory that expires immediately. Like if you don't pay for parking right now or you don't pay for your train right now, we're not getting the money and the downstream impacts of that revenue cascade, right? Because if you didn't pay for parking because the system was unavailable, a gateway was unavailable or something, that means that the city can't enforce and so they're not allowed to collect revenue for citations.  And next thing you know, the government just says, okay today we're just not, it was free parking today. But that's hundreds of thousands of dollars for them in revenue. So when we looked at batching, we looked at it similarly and decided if the consumer doesn't know that we're batching, is it gonna hurt? Are they gonna try to defraud the government? And the answer is no, they don't know that you're batching it. So it's an acceptable risk, right? What are the odds? So we look at how likely it is that we'll be defrauding and then decide okay, we'll batch for that particular customer and you know, the payment won't go through right away and we only do that if we're experiencing an outage because again, it doesn't, it doesn't, we will never go to offline processing where we do it beside 100% offline but we will always try to make the attempt. At 1056, one of our gateways went down for 10 minutes and it's like, there was 460 payments that batched and no one knows why yet, but we'll find out. It happens more than you think. Our best gateways first data, by the way, the Rapid Connect one, we've only had two outages in five years and both were very short periods of time of the 20 we use. Build versus buy. Man, that's tough, right? Like outsourcing your, one of your things that sets up your availability at a certain level or like for your system. How you decide to make that decision, it's like, that's a critical decision for everyone if you're willing to give up some of that part to shift risk off to someone else. Sometimes, I don't know, you have to, you have to weigh those things yourself and figure out the costs and benefits of each one. For us, right now, for our main payment, gateways and things like that, we're always going to do it ourselves in the margins that we're operating on. We make five to 35 cents of transaction, right, for 300,000 transactions. So it's outsourcing that or having another party involved in availability increases the risk that there could be an issue and if we can decrease that as much as possible, we can so we can always stay up and process. But then it's time to market. We recently launched in Mexico and there's some gateway we've never integrated with and now we have to build an integration for one customer and is it worth it? Maybe build it out if we were doing 10,000 transactions a day with them but if we're doing three or 10 or whatever it is, maybe it's better to use someone else for that. Again, and then the maintenance costs, reoccurring costs, compliance. I mean, it's a lot of work and you have to figure out if you're ready to take it on and want to maintain it forever because like I said before, it's not a one-time thing. That concludes. I hit next and I'm like, did I have anything else? That concludes it. I appreciate it. Thanks a lot.


Make sure the bird and the chuck are grounded then we're gonna reel out the line and bring it up to the bird


Hi we are going to get started now because this is going to be a very packed talk and Launching right into it. I'm Matt Heon and I am here to talk to you about pod man So bit about me I've been an engineer at Red Hat for the last five years and I've spent all of those with Dan Walsh over there on the containers team and I've been working on pod man for about the last three years basically since the project was conceived of and I'm one of the lead maintainers on it So Let's start talking about pod man. This is a pretty simple sample pod man commands You can see we have a volume. We've got a memory limit we're gonna launch a fedora image and We're going to run bash and all of this came about because Scott McCarty I don't think it's in the room, but Scott McCarty asked me what happens when you press enter on a command like this and We're gonna answer that today and we're gonna trace this command in two different ways we're going to run it as roots and we're also gonna look at what happens when we run it without roots because Those two end up being pretty different So let's just move on briefly to the architecture of pod man just an overall view of it and You'll notice that we have two of them here We have one for root and we have one for rootless and rootless pod man is not a set UID binary Which means that we don't really have privileges We only run with what the user came in with and for an unprivileged user We're not gonna be able to do a lot of things Which means that we are going to have to do a lot of differently as opposed to root Now I'm not gonna linger on the architecture here other than to say that Everything aside from the attach socket you see over to the left is a separate process We'll go into more detail on each of these components later But let's just think about the differences between the root and rootless architectures here as we go Onto the biggest of those differences the rootless user namespace. This is the big box. You saw around the rootless container So rootless pod man needs a user namespace for two big reasons The first one is we need to be able to mount some file systems that we might not otherwise normally Unprivileged users can't really mount but within a user namespace We gain the ability to do bind mounts fuse mounts tempFS mounts and a few more that are less relevant But those three are going to be enough to let us establish a container root file system It's also going to let us get some additional users in play because normally when you log is an unprivileged user You have access to one UID and exactly one UID your own But if you pull any container image, you're gonna find that there's more than one UID in play There are a lot of files that are going to be owned by users other than root And we really need to support that for the rootless use case So here once we create this rootless user namespace using Unshare We are going to have to get the first and only set UID binaries involved new UID map and new GID map and those are going to read Etsy sub UID Etsy sub GID You can see those right there and they're going to grant us some additional users based on that So you can see my username and he on in there And it's going to give me six five five three six users Starting at one hundred thousand. That's the third and the second number respectively makes some sort of sense But once we have these users in here We have access to them and we can use them in the container so if you want to run a system desay in that rootless container you're actually able to and And finally the rootless username space gives us the ability to change the users around a bit in terms of ordering Our namespaces really are a way of altering a way of process looks at the rest of the system And in terms of the user namespace it allows us to remap both in terms of Excluding and including users from the host but also in terms of reordering them So we are going to take UID zero in the container and we're going to make it whoever launched the rootless container So you're still not going to be rude even though you launch this container You don't gain any privileges in terms of the kernel But you can pretend to be rude within the container and that's pretty important And now once we've finished setting up this rootless user namespace for the first time We're actually going to keep it around because any subsequent containers we need to join the namespace as well Those containers are if they want to share anything with containers that are already in this namespace For example, if they want your namespaces, they all need to be within the same rootless user namespace So we launch what's called a pause process to keep this alive and every subsequent pod Manification rootless is going to join this and again This is only for rootless if your root you can mount anything you want you have access to all the users There's no need for it Now let's move on to the first real step once we're past this which is pulling the image and If you've already seen Nolan's talk he went into more depth on this than I will be able to But let's go on anyways and do a bit of a brief overview So if the image is available locally, we can obviously skip this step. Let's assume that it's not The first real step is going to be to figure out what we need to pull if you remember that sample command I showed you it was your fedora image and fedora is not very descriptive here We need to figure out what the full name of the image is and we do this using something called search registries These are defined in registries cop And we're going to use those to generate some potential candidate image names full names and you can see those over there These are as it would appear on a standard fedora 31 system You can see that there are five potential candidates and we are going to pull those one by one in that order first one to pull successfully is the one that we're going to use and Pull in general is just going to be a series of HTTP get requests We're going to ask the registry do you have a manifest this image if it does not we're going to assume It doesn't have the image at all go on to the next one if it does Then we're going to try and pull all the layers of that image and once we're done pulling them We are going to save them into container storage And now we get to actually create the container So the first step is to parse the CLI of pod man into what we call create config This is basically a convenient struct that holds all of the changes that you made on the command line plus some baked in defaults And once we make that struct we're going to turn it into an OCI spec Most of you are probably familiar with the fact that pod man does not directly launch containers itself It calls something called an OCI runtime and the way we define the container the OCI runtime is going to build is the OCI spec and That is going to contain things like the memory limit we concluded it's going to contain the volume we included It's going to contain some baked in default as well But there are things that it's not going to contain the OCI spec for example does not care about images it expects all that to be done before it runs and It can't care about things like say a lib pod name volume if you make a volume with pod man volume create We don't really know enough to make a bind out for it yet And the OCI spec also doesn't care about it So we end up with a bundle here of an OCI spec But also some things that don't quite fit inside of it and we're going to pass that bundle into lib pod Which is the container creation library used by pod man all our container operations are managed by lib pod the repo is actually named container slash lib pod and We're going to you call create in there and that's going to save an immutable copy of this Container definition the OCI spec and the things that aren't quite in there and Once we have that saved the container is created as far as lib pods concerned But we have one more thing to do we need to make this container in the storage library We just pulled down an image, but an image isn't quite a container definition We also need something on top of it images are obviously immutable You want to share in between multiple containers without making changes to them But at the same time the container is not if I go into that container which was running bash and I touch some files I want those to show up so we have a read white layer on top of the container and That is going to be made by the storage library, but it's not going to be mounted yet. We're just making things Now we're going to prepare to start the container now if we were running just pod man create We would have halted right there But we're going to go on and we're going to call something called start and attach in lib pod And as the name implies starts the container attaches the container. That's the remaining work upon man run The first step of this is an internal function called a knit and a knit is going to make the container ready to start But start stop right before it starts it First step of a knit really is to get the container mounted. We need to mount it up using overlay FS on root Which is basically going to take all those layers that we downloaded from the image plus that root top layer We made earlier and it's going to merge them all into one directory and we can access that as a container file system now Unfortunately, as I said earlier root doesn't rootless rather doesn't have the ability to make many mounts So we cannot use kernel overlay FS the solution here is fuse overlay FS which was developed by Giuseppe I think he's in the room But fuse over lay FS is a re-implementation of kernel overlay in user space so we can use it without privileges Which is pretty neat. It's going to do roughly the same thing, but fuse and Then once we created the file system. We're now going to need to mount the network So or not mount the network create the network So the container needs a network namespace and as root we're going to use something called the CNI plug-ins if you're not familiar with these It's a series of binaries that will each perform a separate discrete task and in typical use one of them is going to modify system Configuration add the podman network to a bridge one of them is going to add some IP tables rule So we can forward traffic to and from the container one of them will handle any port forwarding that we need And all of these are making big sweeping system changes that again, we don't have privileges for as Routeless, so we are again going to have to work around this and the solution here is something called slurp for net nests Slurp is a small binary that originated in the vert land I believe it was part of Libford at first and it basically is going to tunnel inside the container to outside the container It acts as a manual bridge so to speak and lets us forward traffic without directly creating a network interface It's got its limitations obviously, but when you run as rootless when you have no privileges You have to accept some sacrifices And then we are going to create some container specific files because we don't want to use everything in the image as is The image probably has a resolve.com, but it is in no way related to the network that's running this container So we want to take the host resolve, but we also want to be able to change it You want to be able to alter the container So we're going to make a copy of the host resolve.com We're going to make it so that this is by mounted into the container and then we're going to finalize the OCI spec Now we have everything that we didn't have before because we made it before but we didn't know where the container was mounted We didn't know about these extra bind mounts that we've added We didn't know where the network namespace was now that we've finished preparing We can finalize the spec and write it to disk and then we can use it to launch conman Conman is the container monitor we call it and You can see a sample conman command line right there And what I want you to take away from this is that you should never ever invoke conman yourself let podman do it for you This is basically a very lightweight C binary and once we fork it off It's going to double fork to demonize and once it's finished doing that Yeah, so once it is finished doing that it is going to provide some services for us So podman itself is dangerous Which means that the podman process can go away at any time But the container is still running in the background potentially and what if I want to do say a podman attached to it Or what if it exits? I need to get the exit code Conman will monitor the container and it will provide a few services like attaching to it if we do a podman attach and It's also going to store the exit code for us and Once podman creates conman and conman double forks It has very little to do but invoke the OCI runtime and the first thing it's going to do is the OCI runtime Create command so what I'm about to say here is true for run C and C run What it's not true for is Cata G visor There are various other runtimes and most of them will be hypervisor based and they will have similar end results But the steps I'm about to describe very different. So this applies to run C C run whatever your default probably is Now the OCI create command basically OCI runtime create command is going to make what we call an init process And that is the larval form of a container and it's going to start adding security restrictions and setting up What will eventually become the container it's going to make all the namespaces We already made the network namespace before but it's going to establish a mount namespace paid namespace IPC namespace for example and Then it's going to finish the root file system So we mounted the image before but all the bind mounts they're going to be handled by this OCI runtime and Then it's going to create its C group the container has a C group But this is another place where root and rootless differ in the C groups be one hierarchy It's not safe to give a rootless container delegation It will be able to modify resource limits that were previously passed on it So it could basically ignore any resource limits and What that means is unless you're running C groups B2 we can't really create C groups for the container Next we're going to go ahead and we're going to drop our capabilities So we probably are not we're not running a privileged container here So we're going to drop any capabilities that we don't want to retain and this actually happens for rootless as well Because rootless established the rootless user namespace which gave us a set of fake capabilities within it And we're going to drop those capabilities next we run to initialize our security features sec comp se linux and Once that's done. We're basically almost at the container, but we're going to stop here we're going to stop right before we execute that first thing in the container that bash process that we want and and Conman and the OCI runtime are going to signal podman that We're done with this and then they're going to go to sleep and wait for the next step because there's one more thing that we have to do And that is we need to attach to the container So unless you specify hyphen D attach is going to happen if you do then we proceed to the next step We start the container and then we just print the ID, but let's assume that we didn't and Attaches as I said before handled by conman conman is the parent of the OCI runtime the OCI runtime didn't double fork So it's a direct child and conman has its standard streams So what conman is going to do it's going to open a unique socket for us And anything that gets written to the containers standard out and standard error It's going to append a head or two it to multiplex it over that socket and then it's just going to send it out And then anything we send to that socket will be written to the container standard in And the reason we have to do this now and not after the container starts is because this is not buffered So if we start the container and then attach to it anything that happens between the start and the attach we lose it We could write buffering code, but These are just do this And now we get to the final step We are going to invoke the OCI runtime Padme is going to do it this time not conman because we're just invoking OCI runtime start and that Really is just going to contact that init process that has been sleeping and tell it to wake up and move on to that next step And that next step is to exact that bash process And now this is not a fork exact. This is just an exact We are going to overwrite run C with the new container process the back process And since run C has already set up all these security features for itself It's already joined the C groups always set up name spaces. We now have paid one in our container and it started running Let's see I think we have a bit of time. So we'll go briefly into this. What happens when the container exits Conman is waiting for this. It's waiting on the container's PID and It's going to save the exit code once the exit actually happens But it's also going to do something else. It invokes a command called podman container cleanup Podman container cleanup is going to take the exit code the podman that conman stored because conman can't talk to our database so container cleanup takes the exit code and It stores in the database and then it tears down any remaining container resources It's going to tear down the network. It's going to unmount the container and once it's done we freed all our resources and The container is basically done One more thing is that if hyphen hyphen rm is given then the container would be removed at this point Alright, I think that was about it I know this was a very quick overview and I rushed through a bunch of things but Only 20 minutes. So if you have questions on anything that wasn't clear questions on anything that you'd like more detail on Feel free to ask Yes That is What? Okay, so I've been asked what happens when conman gets a PID That is not its child and that that is honestly bizarre I have no idea how that would happen if you want to open an issue on this one We'd be glad to hear it because that sounds very interesting Any other questions? So the question is why use conman and not systemd and the answer is largely Attach we cannot convince systemd to forward what we need from the container standard streams wise So we really need something to hold open those streams for us and to Basically forward content to one from the container. That's the big justification conman and in the end It's a few kilobytes of memory and basically zero CPU. So we're okay with leaving it around So the question is comparing docker and podman so Briefly speaking podman its goal is to provide a docker compatible interface So our command line front end is going to be basically identical We've got a few places where we differ but not many and We're going to add some features on top of docker for it from that We're gonna add pod support for example and generate play or generate cube play cube But we're also gonna do this in a manner that is demonless. We have no demons So there is no process that is waiting in the background and managing the containers aside from conman Which dies the moment the container does so we are lighter weights and potentially more portable because of that I Think that's a good summary any other questions So the question is on image pull what decides the order that we pulled the potential candidate images And it's pretty simple the order that they're defined in registries.cof So we have a list of search registries and registries.cof and we'll try those in the order. They're listed We're going to make a file and then we're going to write the exit code to it And that's going to be in a temporary directory just for the container So container storage in addition to mounting up the container It makes us a few directories that we can store files related to it in and we will throw the exit code in one of those and We will when we read the file back We know basically where it is it's named with the ID of the container and The contents of the exit code and the time that was created is the exit time So the question is how Cata containers are different from the other OCI runtimes and the biggest thing is going to be We didn't need to make a virtual machine here Cata containers is VM based so it's going to need to spin up a virtual machine and Once it's done that it is actually so they do a VM Per pot, which is actually rather interesting. I believe they're still doing some of the things we do like name spacing within those VMs But they need to spin up a VM with the root file system from the container I believe right now they're using device mapper to manually share it between hosting container There are other ways like vert IO FS or 9p but the big thing here is Cata runs inside a virtual machine and I believe it's still doing some container things inside that VM But they're separated by a separate kernel instead of just using the same current other questions Yeah, so the question is non-root podman advantages and disadvantages the advantages definitely security You are running with absolutely no capabilities besides one set UID binary, which isn't even part of us That's a I think core details or shadow details. Anyways No privileges and can be run basically anywhere. It's configured because of that any user can run it without worries Disadvantages definitely speed because we are using a fused file system We are having to manually shuttle traffic into and out of the container I'd say another disadvantage is also you can't do some things that you normally would be able to Podman for example can normally make NFS volumes. No privileges to do that as rule is so there are some things that you Just cannot do without root, but yeah advantages or security disadvantages can't do a few things and Slightly slower. Any other questions? Yes, I'm doing a lightning talk in about a half hour Come to that you will be happy Anything else? Oh never mind. We are out of time. Thank you everyone


Today, we're talking about de-radicalizing in the Middle East and elsewhere. In a world of terror, de-radicalization is critical and possibly it's also impossible. So for this show, we have Tim Apachele, my co-host. We have Gene Rosenfeld, who is an esteemed guest as always. And we have Jason Olson, United States Navy Lieutenant Commander, Foreign Area Officer. You're gonna hear more about what he does. Anyway, welcome to the show. How are you guys? Thank you. So Gene, let me go to you first and ask you, what is radicalization and is it accidental? How does it happen? It is not accidental at all. It has been a principle in the Middle East since Israel was founded to propose or propagate a narrative, which we're hearing much more of today of colonialism and worse things having to do with the Palestinians in general over a long period of time. But prior to that, we know that the jihadist movement had a philosophy of radicalization and recruitment and violence that departed from traditional Islam and is active now throughout the Middle East, North Africa, parts of Asia, and even among certain communities in Europe. So this poses a problem because we have generations growing up under extreme conditions of polarization, especially in Israel and the Palestinian area. And these generations are being taught and brought into this narrative, which is basically to get rid of the West and Western influence in that part of the world. Well, I don't know why, but I do know why, but this reminds me of the Muppets. And we're gonna show you a clip comparing an Israeli Muppet show in Israel TV and I guess you'd say an Arab Muppet show. Again, broadcast on Israeli TV. Let's see this clip. The difference between Israeli Kitshow and Palestinian Kitshow. Omar, Omar, Shalom. I'm Omar. I'm Omar. I'm Omar. I'm Omar. I'm Omar. I'm Omar. I'm Omar. I'm Omar. I'm Omar. I'm Omar. I'm Omar. I'm Omar. I'm Omar. I'm Omar. I'm Omar. I'm Omar. You shall summarize and explain it for us. Well, this happens when radicalization takes places. The clip showed they use the term merhaba which usually means welcome in Arabic that was portrayed. And then you saw the other clips showing that they wanted to be soldiers of the Mujahadib. These are children. six-year-olds, seven-year-olds, eight-year-olds, and so radicalization, the earlier the better. We've seen that in history with the brown shirts in Nazi Germany. We see it, you know, you basically indoctrinate your children, and it's much easier to send a message later in their later years, because they've been indoctrinated very early in life, and so they're more susceptible to for a different direction of thought. Yeah, you know, Jason, this is programming. It's programming children at an early age, and I'm no psychologist, but I would guess that that program lasts a long time, if not forever. I remember seeing a video of a young girl in an Arab community who was barely old enough to speak, which he was saying was kill the Jews, kill Israel, kill America, and it was quite impressive that those were pretty much the only words that she could speak, but somebody had taught her to say them. So, you know, how long is that young girl going to keep thinking that way? How permanent is the damage? Can you talk about it? Jay, thank you. Yeah, Jason Olson here. Yeah, I'm not speaking on behalf of the United States, just only speaking for myself, but this kind of worldview is very deep, and it can last a lifetime, but it really comes through the education system. I think about the difference between schools and military bases, and if we have any hope of changing or de-radicalizing, it's got to start in the schools, and that's something where the international community has to get far more involved, as we've seen in the news lately, with ANRA. You know, ANRA has not been very successful in de-radicalizing. In some cases, they've encouraged and helped radicalization. So, these are issues where we have to look at the schools and be responsible, and as we've mentioned, cases of de-radicalization in Japan and Germany after World War II, that meant occupation forces from the Allies in the West going in and transforming these schools, so you get new generations of leaders that are de-radicalized.  But what about the home? That two-year-old child just learning to speak, she didn't get that in school, there was no school. And for a lot of these Arab kids, there is no school. They get it at home. How do you change that, Jason? That's more difficult. We, you know, it's not the, it's not appropriate in our Western culture of liberal democracy for the state to intervene and penetrate the home that deeply. You know, we like to give autonomy to parents to teach their children what, you know, what they want. That's the right of parents all around the world. So I think that that's difficult. I think that the schools is one place, and then the media is another place. And it's when you have freedom of speech and freedom of the press, you know, the media can feed children, whatever is feeding them, as we just saw with these clips. So, so the, we're, this is a delicate balance and friction between the freedom of education, freedom of the press, and the autonomy of parents. But if we're trying to derate our cause, we, you know, these are things, there's things that we can do in the United States. And there's things that we can do abroad. There's different authorities. And that's something if you're, if you're interested in getting into, right, there's more options that we can do abroad than we can do in the United States because of the Constitution and our civil liberties. Yeah, a quick note to that is I saw a piece in the paper recently about these home school situations in the United States. And educators are looking into exactly how that works. Because if you have a cult trumper home with the parents who are cult trumpers, and you have home schooling, you know, exactly what message is being passed down to those kids who spend, you know, their, their time learning with their parents. That's the way it works in home school. So I think we have an issue here in this country as well. You know, Jean, we've talked about what happened in Germany and Japan after the war. And I have to say, those were successful pretty much. And we de-radicalized the youth that hadn't participated or would participate in another war. But, you know, are those good examples now today? Because if I, if I scan my own experience, my own understanding, I don't find a de-radicalization example that's actually happening, such as the one that happened through MacArthur in Japan or through the American forces in Germany. I don't see that happening right now anywhere. Do you see that happening? Could that happen? Would it work? Would it work like in Japan and Germany? I think Jason can answer to this. He has done more study of this than I have. Just one example, Germany has been the most successful nation, according to Manfred Henningson, who is German himself, but American now, in terms of de-radicalizing its past. They have established memorials and stepping stones and all kinds of ways in which their law has been changed to, they're better at dealing with domestic fascism than we are today. But I think Jason has something to say about Japan. Jason, you know, let's talk about UNRWA, which is really a great tragedy, and a lot of people are denying that UNRWA did anything wrong to encourage radicalization, although I think we know better. And, you know, what, what could UNRWA do? What could UNRWA have done to improve that? What could a replacement for UNRWA do now to replace that? You know, this is a very difficult mission. It's going to involve a whole new paradigm. What would that paradigm be, and how could we achieve it? Oh, no, thank you. It's a great question, Jay, and Jean, as well. So, yeah, I think UNRWA, in my opinion, has failed. It's become synthesized and embedded with Hamas itself. So UNRWA had, in many aspects, has become integrated with Hamas. So Hamas is on its way to being completely destroyed. My recommendation is the unconditional surrender of Hamas, really, you know, burst the bubble of radicalization. That kind of end state would really strike a blow. But I'm also studying the United Arab Emirates and the Abraham Accords in particular.  They named the Muslim Brotherhood a terrorist organization, and they purged their sovereign territory of the Muslim Brotherhood. And since then, to put the antibodies of radicalization into their system, they're also working on transforming and reforming their education system in an extremely positive way for religious freedom, religious pluralism, more human rights, more rights for women. So just in the last couple years, we've seen the fruits of that. The Abrahamic family house that they opened up in Dubai with a church, a synagogue, and a mosque, standing in a structure equally together, the Emirati states building a Jewish synagogue in Abu Dhabi with state funds for the first time ever. So they're opening up these spaces, I think, for, like I said, both religious freedom and religious pluralism, and combating radicalization both in their curriculum development, but also by actions, symbolic actions. And the Saudis are also doing the same thing as well. There's Impact SE as an NGO that's worked closely to reform K-12 or higher textbooks so that they're removing intolerance, pre- anti-Semitism, radicalism from the textbooks. I think that that, I'm a big believer that that's a great place to start. Well, you know, you'll have to admit this is recent. Very recent. Yeah, and so you have kids and families and people in the pipeline already that have been exposed to radicalism for a long, long, long, long, did I say long time? And so how do you take that out of the mix? How do you change their minds? I mean, take a four or five or six-year-old kid in school, one who watches the Muppets, for example, and sees all the stuff about violence and who hears it at home and from friends and community. What do you say to that kid to extract, to remove your term, to remove the radical training that kid has had? What do you say? I think it's top-down. It's got to start with the highest levels of the state, that the state sees it in their interest to ensure they have a moderate population that is committed to peace, committed to prosperity, committed to civil rights, human rights. The state has got to buy in, right? Otherwise, what we've seen for generations is chaos and instability. So there's a balance there. I think sometimes we get an attempt at projecting our own concepts onto the Middle East region or other regions where we want to just only support democratization and elections and that's all that matters, but there's other spaces that matter as well, religious freedom, human rights, civil rights, women's rights. I would say rather than putting democratization as the top goal, build these other infrastructure in civil society so that as democratization comes slowly, the people are, you know, they have the liberal values that will enable them to have a liberal democracy instead of like a radicalized democracy or those are kind of the lessons that I've learned from studying the Middle East for many years. I did my PhD in Near Eastern and Judaic studies from Brandeis University, so that's what I've noticed the trends, but there are great trends and I think they're the best trends or state led at this point. You know, I love asking you this question, Tim, because you're our media man, okay, because we know media plays an extraordinary role in this country increasingly, and for that matter it plays an extraordinary role in every country these days through social media, television and otherwise. Where does media come into this? Where does media come into affecting the public opinion, the individual sensibilities that lead to radicalization and that lead away from radicalization? Well, I think the most recent example of media influence is the the stroke that Hamas took the second they committed the atrocities in Israel. They got out in front of the cameras, in front of all the the social media sites, and became the victims, not the perpetrators of violence and atrocities, but they were now the victims, and so they they caught the narrative early. And how does media play? Well, it plays well. I mean come on, look at advertisers. They hone in on certain psychological needs, whether we call them Maslow's hierarchy of needs or not. The number one that I think that helps radicalization or programming, I like to call it programming, is the need to belong to a group, not to feel ostracized, not to feel outside that group, and you know when you are it sounds like a cult, doesn't it? Well, you could argue that many many things in this world that are cultish. You know, the first thing you do to deprogram someone is to extract them from that environment, get them away from the ideas and the peer pressure of ideas to the individual. You know, that's that's step one, but that's hard to do when you know you live in the same community in the same environment day in and day out. You just don't extract children or you don't extract adults from the environment in which they live, so deprogramming is very very difficult if you can't get them introduced to a new set of ideas or the old set of ideas that they used to adhere to. Remember, well in the case of children they've always been exposed to it, but there are times where adults have been, if you want to say brainwashed, we could use that term and there's a radical shift of who they were versus the identity of who they are now to be. Yeah, and Jean, you know, before the show began I asked you a question I'd like to ask you again. Suppose I'm an official in Iran and it occurs to me that I could do my proxy wars. We have discussed that phenomenon before and the proxy wars helped me. The proxy wars helped destroy Israel, but more than that the proxy wars helped me with a mission. They helped me to consolidate my power. They helped me connect people up to where I want to go. So my question is, is this official in Iran who has the ability to run proxy wars and run proxy terror groups? Why does he do that? As a matter of policy, why does Iran want to do that? What's the purpose of establishing the proxy and establishing Jihad and of establishing radicalization? Well, Iran has a proud past as an empire, the Persian empire, even though it wasn't, it wasn't Islamic then.  They're also Shia and a great divide, we've talked about this before, in the Middle East preceding the problems with Israel is a Shia Sunni divide. And I have heard that the Shia are much more hierarchical than the Sunni. The Sunni are kind of decentralized. Their authorities are more local, whereas with the Ayatollahs who run Iran, there is an apex authority. I've been studying obedience to authority lately in the Milgram experiments in Zimbardo and what's interesting when people themselves need to be disabused of violent theories like these things that take hold. Conformity to a peer group is very important. That's the way you get recruited. On the one hand, Mark Sageman has studied that, but on the other hand for deradicalization, if the parent's peer group generally subscribe to a set of principles and values and act out of those that do not jibe with the radical views that they have, they become isolated. So if you can free up the people, the majority of the people in these countries who want peace, stability, they want their values in Islam, which is actually a very tolerant religion, then they can exercise their peer pressure on those that do not. We've seen this happen domestically in the United States where white supremacists, families establish themselves in places like Aryan nations in Idaho, and we've seen deradicalization take place when they realize that they're very isolated and what they're aiming for. That's why people clumped together a like-minded way if they want to cause problems. Now remember Hamas. Hamas finds a Palestinian in Gaza who disagrees with Hamas's jihad. They're going to kill him, and that puts that down.   Now since we covered the Muppets, I think it's only fair to cover Ferdinand and Isabella. Ferdinand and Isabella, you know, running the equestrian in the 15th century, were not perforce anti-Semitic. They knew, however, there was an anti-Semitic strain that had existed in Spain for 100 years, and they wanted to consolidate their power. And one of the things they did is say they accommodated the anti-Semitic threat in Spain by becoming anti-Semitic and encouraging the Inquisition. So it's question of power, isn't it? If you use it like a tool, you use the jihad, the radicalization as a tool to get people together under your control. Can you talk about that? Am I right? Am I wrong? Do you do you rather believe the Muppets or do you rather believe Isabella and Ferdinand? I haven't really studied that very much. I do know that they were busy conquering the Islamic caliphate in Spain at the same time, and they also, the Islamic caliphate was actually quite tolerant towards Jews. And maybe they had to define themselves in contra-distinction to that, but we also know there there's his history of really bad anti-Semitism in the Catholic Church. Gary Wills has talked about this, and he's a Catholic for 2,000 years. So they use those tools in society cynically as we accuse politicians of using such tools today, but perhaps they really believed it too. I don't know. With respect to the jihadi virus that has grown up in Egypt initially and spread all the way to Afghanistan and throughout the Middle East, and which fires these people up, it's like we're actually in another cold war with hot spots in it. Yeah. You know, Jason, the idea about retraining, the idea about building a synagogue, what have you, it's complex because this is a very difficult task to de-radicalize the subject of our show. And it's not only that, but it's dangerous. I mean, would I go as a Jewish person and settle in the land my forefathers might have lived in, you know, in the Middle East, a land which is now anti-Semitic? Would I go there and try to be, you know, the cutting edge of the reemergence of Judaism in that country, participate in the development of a synagogue there? That sounds hard and it sounds dangerous.  So where's the cutting edge here? And who will do it? It's nice to hear about some of these countries that have been made more liberal, more tolerant, but who should get the point on this? Who should be the leader on this? Well, we're at a paradox. There are trends in the Middle Eastern region. As Gene said, there have been periods of time, the golden age of Spain, and we look at Maimonides, the Rambam. There have been times in Jewish Islamic history where there was great tolerance. And so some of these states, the United Arab Emirates, for example, in Bahrain, they're looking at the last, you know, century as kind of an aberration, and they're trying to go back to a time when Jews and Muslims had warm relations and tolerant relations, which there are pockets throughout history. Unfortunately, what's happened, that's why it's so critical, like I said, that United Arab Emirates banned the Muslim Brotherhood, made it a terrorist organization. What's happening is Hamas, the Muslim Brotherhood, other jihadist organizations have metastasized and spread it out throughout the world, including in the United States, and also purged themselves in different college campuses in the West, throughout the West. And so they've, in some cases, they've been expelled from different Middle Eastern countries, and they found homes in other places in the world where they're continuing a war against the Jewish people, a war against the United States, a war against the West. And so it's, there's a globalization, and we saw that with al-Qaeda. Al-Qaeda was the first to really decide we're going to expand our war from just Israel and Saudi Arabia, the Saudi monarchy, and we're going to make a global jihad. And that's what we're finding. They're willing to find new spaces where they can thrive and attack their enemies. Yeah, you know, Tim, that opens the question of whether the United States as a target of radicalism, one of the targets, the main target, the West, you know, the United States can be the city on the hill and can be the leader in trying to de-radicalize other places in the world. Is it qualified? Is it qualified these days with a fair amount of anti-Semitism going on in the country, an increasing amount of anti-Semitism? Could it ever be? What would have to happen before the United States could resume its liberal role as the leader of tolerance in the world? Or is that in our history only? No, I don't think it was in our history only. I'm thinking of the 60s when John Kennedy made the famous quote, Ask not what you can do with your country. Ask not what the country can do for you, but what you can do to your country. How many people volunteered to do outreach in foreign countries and in third-world countries? And so there was this informal diplomatic corps, if you will, that showed people what America was about by their deeds and actions, not versus the stereotypes that were formatted to these populations, for stereotypes of Americans and how America was. So through action, a lot of myths were dispelled. I'm thinking also, even in Afghanistan and Iraq, there was an effort to go into villages and show the kindness of the military that we weren't just there at boots on the ground and camouflage that people wore, that they were interested in building schools. Hopefully not through nation building, but through humanity building. And the military became a part of that, I think. To what degree that was successful, I don't know. Maybe Jason has a better sense of that than I do, but there was an effort, at least, to dispel the myth and the stereotypes of Americans and how we were bent on destruction and war. I have a hard question for you, Tim. Given all of that, given all that we've talked about today, suppose I find a murderous radical who has killed a lot of people. And okay, a war criminal, that kind of thing. Do I try to show him a better path or her? Do I try to explain to him how wrong he was? What do I throw him in the slammer forever to keep him off the streets? What do I do to protect myself against this murderer? Well, I think you're referring to justice and there is international justice. There is local justice and justice needs to be implemented, particularly if there's a radical murderer at your front doorstep. But I also caution against what I would call the sum to more argument. That is, there's some group of people that act like this. Therefore, as a form of argument, we project that onto a wider population that therefore they must be like this.  Well, maybe that's the stereotype and number two is maybe that's the sum to more argument, that yes, there are a group of these radicals, but you can't broad-based paint an entire population to be that same radical theology or philosophy. Yeah, familiarity helps. You know, I mean, that's why I went to Israel and they put me on a tour around the border. They wanted me to be there at the border, a tourist at the border. And, you know, so I could see and people could see me. And so maybe if you force the familiarization that helps, it's time for our closing statements that I could see that Jason is wound up about many, many issues here. So I want to ask him first to summarize what he would like to leave with our audience today. Oh, I just, I think that the United States of America is a quintessential country. And that to solving these problems requires American leadership and American intervention. That's been my experience. Things don't just happen on their own. We can't just extract ourselves as Americans and just expect everything to run well. We need to have well-crafted strategies. We need both our academics and our policy communities and our elected leaders to work together to solve the problems of the world and to exert leadership. The countries of the world look to the United States for our leadership. They want to see what we have to say and what we want to do. And many times, if it's a good solution, they support. No, I'm interested in that. I feel strongly about that. I also feel it affects my personal security to make sure there is no jihadi attack here in this country. So I'm perfectly willing to take steps, Jason, as an ordinary schmo. What do I do as an ordinary schmo?  We all can play a part to make the world a better place. It's just I worry about the different forms of isolationism, especially at a time now when the world is breaking apart at the seams and we have, we have wars in Europe and we have wars in the Middle East and we're trying to prevent more wars from breaking out. So I think it's engage, talk, you know, we have social media now. So can you can communicate with anyone in the whole world at any time? Yeah, but before I leave you though, I just want to touch on the social media thing. There's so much disinformation, that means lying on social media. It's so easy to be misinformed. What you've read a lot, you've written a lot, you've spoken a lot. Where do I look for a clear message on this? What should I be reading? Just take, take a couple of the top some sources that I need to check on regularly. Well, I can only my own personal opinion of voices that I think are helpful. I am a big fan of, of Neil Ferguson and Victor Davis Hansen. I am trained in history. So I think it's important to look for the lessons of the past because those are real facts and real evidence that we have. And try to find patterns from the past of what succeeded and what failed and then see how they can be applied to current problems. Well, that means we should be, we should be talking to you on a regular basis. Get a handle on that. Gee, thank you for bringing it. One among some, but those are some sources. The really good historians that rely on facts are the best sources in my opinion. Gene, thank you for bringing Jason Olson to us. Appreciate you arranging this. I hope we can do it again.  What lessons have we touched on here that you would emphasize? I think we need to be very careful about understanding the anthropology of each country, even the way people think logically is different. So that's one thing. We need knowledgeable people involved in this. This is all a soft power program. We're engaged in military imposing security on zones which are very insecure. That's number one. But once you've done that, after the Gaza war is over, everybody's been saying, well, what do you do next? Well, then you use the soft power, and Jason has spoken somewhat to that. The other thing I want to verify is that it's not always just top down as a former member of the Peace Corps, and I'm going to date myself now, way back in the 90s. Oh, we never knew that, Gene. I have a whole different view of you now. I was a few years out of college when I went into the Peace Corps. Great experience, and I learned a lot from it. I learned a lot from it, and what I learned most about is that they taught me about the world. Americans are too isolated or too clumped together. Jason's admonition to get out, if you want to do something, get out to another country. We took our kids, my husband was a doctor in the Peace Corps, too, before I met him. We took our kids to a third-world country when they were small, on purpose, because they were so privileged. We wanted them to see that they could connect, and they did. They did connect with teenagers in that country. Well, Tim, your thoughts here to close? Are you going to be watching more of the Muppets? No, I will not be watching more of the Muppets. I didn't watch them when I was a child, nor do I tend to as an adult. So, you know, my final thoughts are, and maybe I'm taking a left turn to talk, but I think we bring ecologists and psychiatrists into the discussion. What is it about the frailty of the human condition, the human mind, that it takes relatively little work to craft tools of what we would call propaganda, and work its magic relatively easy to completely shift one's attitude, values, and beliefs in a 180-degree different direction? And what does that say about human beings as a species that they're so malleable, and influence them so easily? And until we understand the, I think, the physiology of the human mind, and how weak it is, radicalization will continue from here to eternity, or at least to the date of the human species becomes extinct, whichever comes first. So, the question, Gene and Jason, is whether the species is perfectable or imperfectable, and we are at that inflection point. Thank you very much for joining us today, Gene and Jason and Tim Aloha.