Hello everybody, welcome back another Adobe After Effects tutorial and this one I'm going to show you how to 360 degree animate text in a spherical or circular or cylindrical motion just like this. This adds a ton of production value. It's 3D, it's awesome and it takes seconds to do. Let's get cracking. Let's start from scratch. All right, follow along with me. We've got nothing open here. Your first step, new composition, 1920 by 1080, 24 frames per second. That doesn't matter. Just open a composition, you don't have to worry about any of that stuff. Anything will work. The next step, grab your text tool up here at the top and then you're going to type in what you want it to say. So for this one, it's going to say cylinder and I'm using the intro font but again you can use any font, any size you want. I'm just going to put that right about here. Now let's get into the business. The next step is you want to go to window. Make sure there's a check mark beside effects and presets. For me, effects and presets is located here. When you go there, what you want to do is in the search bar, type in this CC space cylinder. This is a free effect that comes with After Effects. Drag and drop that onto the text. When you do that, presto. We've sort of wrapped it around and we've got some 3D effect which is awesome because we don't even have the 3D layer box checked so this doesn't even require that. So I'm just going to go ahead now and I'm just going to drop down and take a look. So I'm just dropping in here. I've clicked on this little triangle then I'm going to click on the effects triangle, the CC cylinder triangle and then the rotation triangle. So we're kind of digging in a little bit but that's okay. I want to show you all of the things. So play head at the beginning. Here's what I like to do. Again, feel free to season it to your taste. For CC cylinder under effects, you'll see radius percentage. I'm going to go ahead and increase that to about 150 because I want it to be a little wider just so it's easier to see. Under position, do note that you can change it, you know, move it to the side, move it up and down, et cetera, et cetera. I'm not going to do that but I want you to be aware that that is an option if you so choose. The most important point here though is under rotation. So it's under the effect, CC cylinder rotation. You get rotation X, Y and Z. I'll show you what they are quickly. This is the X and this is a really great way to add some production value and make it look cool because we're going to have it spin sort of off center. I can rotate Y which is what we want to rotate and we will rotate that and you can also rotate Z but it doesn't, you know, it's just kind of a little weird. So what we're going to do now is again play head at the beginning. I'm going to go to rotation. I'm going to go to rotation Y. I'm going to click this stopwatch which is the starting the basically we're just starting key framing it. I'm going to move the play head to the 10 second mark or wherever you want the rotations to stop and then watch this. I'm just going to go ahead and slowly pull this to the right and you'll say maybe we'll do three rotations. That should be enough. So I'm going to make this somewhere around three rotations. Let's stop it right about there and now watch this. This is already done. Bang! We have animated a 360 degree rotation text effect in After Effects in just a few seconds. Thanks for watching.


Okay, the next speaker is going to be Maria Hita Pérez, who is talking to us about coupling three Joseph Johnson flux qubits for non-stochastic adiabatic quantum computation and she is from Madrid. Good morning everybody. Today, I'm going to present our work on three Joseph Sonjanci and Flasky with couplings for adiabatic quantum computation. Particularly, I'm going to introduce the work in these two papers. The first one, Ultrastrong capacitive coupling of Flasky bits provides a numerical and analytical study of the effective capacitive interactions between two Flasky bits and a Flasky bit on a resonator and the second one, three Joseph Sonjanci and Flasky bit couplings provides a complete numerical study of the interactions between three Joseph Sonjanci and Flasky bits. Among all of the different platforms that have been proposed for the implementation of adiabatic quantum computers, superconducting circuits stand for their flexibility in fabrication. They provide building blocks for quantum computations such as harmonic oscillators and qubits forming an harmonic multilevel system such as church qubits, Flasky bits or three Joseph Sonjanci and Flasky bits. And also multiple coupled mechanisms between them such as mutual inductance, capacitance, and other superconducting tunable elements. This allows for the realization of a large variety of effective Hamiltonians which are not only useful for adiabatic quantum computation, but also for quantum simulation and other quantum computations algorithms. For example, we have this circuit here which reproduces an isentype interactions, typical to that that they use for the waste quantum annealers, or this circuit here which exhibits a James Cumming dynamic. We are particularly interested in the implementation of non-stochastic Hamiltonians using superconducting circuits. I'm going to briefly review what a non-stochastic Hamiltonian is, even thought most of you already know this. A quantum Hamiltonian is stochastic in a certain basis. If its entries are real and its diagonal elements are non-positive. These definitions let us differentiate two different types of Hamiltonians. We have stochastic Hamiltonians which do not suffer from the same problem, are in principle solvable using Monte Carlo methods, and on the other hand non-stochastic Hamiltonians which suffer from the same problem and cannot be simulated efficiently. This makes them intrinsically interested because they can be used to simulate other quantum systems that suffer from the same problem, and these type of Hamiltonians are also interested because they have been shown to enable a universal adiabatic quantum computation. So what we do in our works is we propose several superconducting circuits to implement these non-stochastic Hamiltonians. Particularly, we study the coupling between three Josephson Janssen flash qubits. A three Josephson Janssen flash qubit consists on a superconducting loop Interrupted by three Josephson Janssen. Two of them identical and one of them alpha times smaller. The main property of this system is that when the external flux when the external flux equals half of the flash quanta it develops two opposite sign current states left and right, which can be connected through tunneling across the potential barrier. We are particularly interested in the tunneling inside of the unit cell which we call the one in this direction. The symmetric and anti-symmetric superposition of the two opposite sign current states form the low energy subspace of the system and are the ideal candidates to form a qubit, and hence the effective Hamiltonian of the system can be written in the form of a typical qubit Hamiltonian where delta represents the gap between the zero and one states and is also called the tunneling amplitude through D1. So we want to couple two three Josephson Janssen flash qubit. We first derive the full general Hamiltonian for this type of system following the rules for circuit quantization and circuit theory and we find that the general Hamiltonian has this form where h1 and h2 are the Hamiltonian of the two single elements the qubit 1 and the qubit 2 and the last terms give interactions between them. Then we derive the effective Hamiltonians. We do so by means of the C4W transformation which maps agonist basis in the full Hamiltonian basis to agonist basis in the birth Hamiltonian basis without the interactions. Provided that the energy subspace of the system can be divided into two subspaces, a low energy subspace which we call p and a high energy subspace which we call q. In our case of two flash qubit couplings we have that the low energy is composed by the four lowest energies of our system which is formed by the composition of the two qubit qubit states. We perform this study using two different procedures. First we perform an analytical study following the typical perturbation method but we also perform a numerical study for following the non perturbative method proposed here by Cosani and Hubert Barton. This method allows us to obtain the effective Hamiltonian simply in terms of the full Hamiltonian, the projectors in the low energy subspace and the C4W transformation u. The only issue with this procedure is that it is computationally expensive. Note that computing u in the full basis requires working with matrices whose size depends directly on the number of elements of the circuit and the dimension of the physical qubits or elements or either truncating the Hamiltonian to a certain number of states that has to be determined by convergence. We propose here a method to avoid this obstacle simply by computing P0up in terms of the operator a which comes directly from the singular value of the composition of the multiplication between the two low energy subspace, the VIR and the full projectors into the low energy subspace. Hence the computational cost of the process is reduced to that of obtaining the low energy eigenstates of the system which can be done efficiently with numerals methods. So when we perform this C4W transformation we find that the general effective Hamiltonian for this type of circuits of 2-flask qubit coupled by a coupler-situor and by a geosubsection has this form. When the two first elements are simply the effective qubit Hamiltonians where delta can be renormalized by the capacitive coupler and the last term gives interactions between the qubits in three different directions sigma s, sigma s, sigma y, sigma y and sigma c, sigma c and is modulated by the coupling strength which we call J. We first study the capacitive coupling between the flash qubits this means that we consider this circuit but without this geosubsection. When studying the effective Hamiltonian what we find is a strong renormalization of the qubit gap due to the active capacitance and interactions in the three different directions. We find for small values of the parameter gamma we find a strong sigma y, sigma y contribution which comes from the expected church interactions between the two flash qubits and when increasing gamma we see that the other two terms gain strength. We find an also strong sigma c, sigma c contribution which comes from interactions mediated by the high energy again states of the system and becomes equal in magnitude to sigma y, sigma y for a sufficiently large gamma and a residual sigma s, sigma s contribution which is directly related to intercell tunneling and comes with an enhancement of church noise. We then study the inductive coupling between three geosubsection flash qubits mediated by a geosubsection Janssen whose geosubsection energy is gamma times the geosubsection energy of the flash qubits. In this case we find an ultra strong sigma s, sigma s couplings which comes from the expected the polar magnetic interactions between the flash qubits and some residual sigma y, sigma y and sigma c, sigma c turns which are up to three times smaller and can hence be neglected. In both cases we see that the coupling strengths depend directly on the qubit parameters. The extensive analysis of the capacitive and inductive coupling suggests that combining them for a could allow for the obtention of non-stonquastic Hamiltonians where with interactions in the three arbitrary with arbitrary interactions in the three directions. One could, for example, couple the two flash qubits using a six-undit DC squid to find capacitive interactions fixed by design and an inductive interaction that can be modulated by changing the flux treated in the squid. So another interesting approach to the coupling of flash qubits is to use an oscillator to mediate the interactions. For example, in this work by Manuel Pino and Juan José García Ripoll, they study a quantum annealer where the qubit interactions are mediated by bosons in an oscillator. In this type of superconducting circuit architectures we find that the spin boson Hamiltonian encodes and spin spin Hamiltonian with interactions in a direction which is determined by the spin boson interactions. For example, in the work by Manuel Pino and Juan José García Ripoll that I have just mentioned, they couple a flash qubit and a resonator in the sigma x direction and what they find is that these Hamiltonian yields sigma s sigma s qubit-qubit interactions. In this respect we study the capacity coupling between a three Joseph Sonjancion flash qubit and an LC resonator. Again, following the rails for the quick quantization we find that the general Hamiltonian of this system is given by the Hamiltonian of the two single elements, the qubit and the resonator plus a term given interactions between them. Then using the superwall transformation we derive again the effective Hamiltonian and we find that it is given by the Hamiltonian of the qubit with a parameter delta which is also renormalized by the coupling plus the Hamiltonian of the resonator in terms of creation and annihilation operators plus a term given interactions between them in a direction which is perpendicular to that that one finds when studying the inductive coupling between a flash qubit and a resonator. These last terms provides evidence of ultra strong coupling which magnet use above 12 percent of the qubit and resonator energies and it's also dependent of the qubit and resonator parameters. To conclude I would like to make some final remarks. We have derived a complete set of Hamiltonian from the coupling of flash qubits finding evidence of ultra strong coupling and non-stop elasticity. We introduce an efficient method for obtaining the nonperturbative FFT Hamiltonian of theoretical superconducting circuit elements coupled such as a flash qubit and we saw ultra strong capacitive qubit resonator interactions which combine when they with the inductive interaction will allow for the study of new regincent light matter interaction. This way we take a step towards non-stochastic adiabatic quantum computation providing also tools for quantum simulation the study of new new ultra strong dynamics or novel Hamiltonian models. For future works we would like to study the tonability of these couplings by adding different circuit elements and it's some of the suitability of the presented Hamiltonians for quantum simulation, quantum annealing, adiabatic quantum computation, another quantum computation algorithm. With that I want to thank you all for your attention and I cannot leave without introducing our group. We are the quantum information and foundation group. We work at the Institute of Fundamental Physics in Madrid which is part of the Spanish Research Council and this project has been made in particular in collaboration with Gabriel Yawma, Juan José García Ripol and Manuel Pino who is now working at the NanoLab at Universidad Salamanca. This project is also part of the European funded project Abacus. And that's all. Thank you all for your attention. The questions are welcome. Thank you for your talk. Maria we are open for questions from the audience. Yes? Can you, can you, would you be able to extend your numerical analysis to four qubits, say three or four qubits coupled? Yeah, in principle that's the advantage of using this formula instead of this formula because you can like, you can like obtain the numerical Hamiltonian for the four qubits and then you only have to find like, in this case, if you want four qubits, two elevators to four levels of the system and then you can perform this analysis and obtain the effective Hamiltonian in principle. We have not tried yet. I actually have a question about this particular formula. I did not really understand what you are exactly transforming from this, from this standard Schiffer-Wald transformation to this parameter of this operator A. Can you please explain what this operator is, how is it different from the standard Schiffer-Wald transformation? Yeah, so what we do is that we use the property of the of the operator U, the Schiffer-Wald transformation, and we find that it can be written in terms of this parameter A, which is, which comes from the singular value of the composition of the multiplication of the projectors into the low energy subspace of the Hamiltonian and the very Hamiltonian. So what we do is we find the low energy eigenstates of the system without the interactions and with the interactions. We then find the operator B by multiplying the two projectors and then we perform the singular value of the composition. The properties of the multiplication P0, P or P Udaga P0 ensure that we can pre-write this form in terms of this operator A, which comes from the operators that we find when performing the singular value of the composition. So if you want like more details, it is explained on our, on this paper, on the one of the three Josephson Janssen Flasky with couplings. And also you can ask me and I can send you like the derivation of the formula. And thank you. Maybe today during the break I will ask you. Okay. Comment on, on what approximations need to apply and whether the, you know, how accurate the results are when you do the singular value decomposition? It is, in principle, it is the same if you use like the full formula, because you don't have to do any approximation, it's just like algebra, multiply and matrix and projectors, and you find this. So as you probably know, there was a paper by D-Wave a year or two ago where they experimentally demonstrated non-stequastic interactions with a capacitive circuit. Could you comment on similarities and differences between what you're proposing and what they did? Yeah. Like, I think that the circuit scan is like similar, but we in, in their case, they use like trussman qubits, I think, or composed by RFS quits, qubits. And we use these three Josephson Janssen Flasky qubits. I think that is like one of the main difference. And also, I'm not sure if they use like a perturbative method for the study of the FETF Hamiltonian, that's what I think. And, and I think that are, that are like the, the two like main difference, but also I think that it is true that the results that we find like coincide with their results. So I think that's a good thing. And that's it. We just wanted like to study another like qubit proposal for implementing this type of sequence. No? Okay. So what are you, what are your assumptions when you consider separately the capacitive coupling and the inductive coupling? Do you know what you are losing by making this separate analysis? We don't like, we simply like build the full Hamiltonian, taking only into account here in, when we consider the capacitive coupling, we only take into account the capacitor. And then when consider the Josephson Janssen, we only take into account the Josephson Janssen. We're really in this, in this graphic here, we also consider the capacity, the capacitance that is always coupled to the Josephson Janssen. But the interactions are much more stronger from, for Josephson Janssen down for capacitors, so it is important. Time for the last question. Thank you for the nice talk. So do, do these coupling values, how tunable are they as a function of that external flux value or the, the flux that would penetrate there kind of in the loop defined by the coupler? And then also, or do they tune at all with any application of offset charges to the circuit? Okay, so in principle, these two coupling cannot be, are not tunable in this form, but for example, you could replace this Josephson Janssen via a squid, which is a loop consisting onto Josephson Janssen. And then you could tune it using a flux written in the squid. And also, and also another study that we want to make is to find a way to make the capacitive interactions tunable, because in this form, with just a capacitor, it isn't tunable. An option could be the circuit we present here, for example. Okay, since we have to move forward with the schedule, I would say that we can leave further questions. You can, for further questions, you can contact Maria personally.


Hello, in this lecture we will define net pay according to fundamental accounting principles while the 22nd edition the definition of net pay is gross pay less all deductions also called take home pay. When we're thinking about net pay we're thinking about the paycheck that an employee will receive and we're thinking about the net pay net of those deductions those deductions including withholding. Let's take a look at an example. If we had total wages or gross pay of 1200 we would then be removing some things as the employer some things that are going to be required to be removed by government including tax withholdings some things that might be benefits to the employees such as retirement plan contributions or health care. So we might have Medicare or we would almost definitely have Medicare that would have to be withheld part of our payroll taxes from the employee wages we would have Social Security


I'm Bradley Merrill Valley. I'm going to present about WP time management. And if you guys need the speech or you want the presentation, just go to www.bradleymerrillvalley.com. You can download it, keep it, go back. There's going to be all sorts of references and sources, YouTube videos. So I highly recommend you guys go ahead and do that. So let's get started. So I'm Bradley Merrill Valley. I'm a former senior web developer at Green Banana. We were an Inc. 5000 digital company, digital ad agency out in the North Shore of Massachusetts. A big about WordPress development. I was a software engineer before this. In short, things, it was my calling. And luckily I got what I call a Rich Dad, if you ever read the book Rich Dad Poor Dad, who kind of took me under his wings and said, I'll hire you on spot if you're more impressed. And ever since, it's just been a rise up. And I've just been extremely fortunate. And so I've been reading a lot of self-improvement books about time management, about software engineering, about web development. Most of the good stuff. So I'm really excited to be presenting to you guys. And of course, I have a life outside of web development. I enjoy yoga, volleyball. It's also dancing, woodworking. Just anything to break the habit of being on the computer. Kind of like a film or like that. And so to kind of start off, the biggest thing to start off with is your why. So as Simon Siddix would say, very few people or companies can clearly articulate why they do what they do. By why, I mean your purpose, cause, or belief. Why does your company exist? Why do you get out of bed every morning? And why should anyone care? People don't buy what you do. They buy why you do it. He has a famous Ted Talk speech that you guys can go back to. But it really comes down to you why. When you present yourself, why are you going to do this? What kind of care is yours? So for me, in terms of why I'm presenting, I present Green Banana SEO. And unfortunately, my senior developer at the time, he was starting to get really stressed out. He wanted, he took a two week vacation. Two weeks turned into three weeks. And then by the fourth week, he said, I'm not coming back. This isn't for me. So then I was the only one left at the company in terms of the web department. So my workload just increased 50%. I had to take all of the projects and whatnot. And it's like, what do you do? How do you do any of this? And it was, you know, really had to put the time management skills to the test. And honestly, I know we all have a bunch of projects to do. And everyone wants to get the most amount of things done in the least amount of time. So I'm excited to be sharing what I've learned over the past multiple months and being the sole developer there. The first things, first, I would highly suggest you filter your emails. If you have Gmail, this is the link that you guys can go to and learn how to do that. It's great for like your app notifications, your plugins, WordPress, anything to anything to just try to silo all of the different emails that you come and come through. I've seen so many people they don't they don't do this. Oh, some of their emails are just stacked up because 50 emails a day. And you look at it and it's tough because you just you still have those really important emails kind of tucked away with all those WordPress, you know, WordPress just updated this that you have 20 sites, just got the updates like, then you miss something. It's just it's really critical. So one of the so my email set up, you got your app notifications. So yes, Slack, Google, Project Hub, have all sorts of different things all set up in your filters. I got one for WordPress, WordPress, always have always keep my contact forms saved on here. Just in case somebody said, oh, how come the contact form didn't work? It's like, no, it didn't work. I'll keep that in the same place. So filtering out your Gmail is highly critical. Oops. All right. Yeah, another big one is how you format your emails. Big thing is trying to get the most important words at the beginning and at the end of your sentences. The way people read and the way people listen is that you want is that the most important words are at the beginning of the end of sentences. Sometimes if you might hear people suggest that for reading purposes, if you're trying to read a book fast, you just try to read the beginning and ends of sentences. So in all honesty, the person who does the best and I know it's kind of local is Donald Trump. There's a big speech. There's a YouTube video that I can add up to the slide. And if you ever see his tweets or whatever he does, it's just wicked funny because he'll say, he'll always kind of start off with some sort of like capturing one more thing. It's like clothes. And then he's like the White House is closed on this date. And he always structures it really well. His house has been really interesting to see. That's pretty much why his campaign was a success. People were able to remember what he was saying. Also the big one is to repeat back what your client has said. That's a very military style. So military, they would say something like, take the Jeep, bring it down to the gas station, fill it up with gasoline, call me back when that's done. And so just repeat back what he says. Okay, I'm going to take the Jeep, I'm going to go down to the gas station, I'm going to fill it up with diesel, and I'm going to call it. He was like, no, no, not diesel, gasoline. And so you want, you always want to try to repeat back what whatever the client said, the question from you, that way you guys can have that confirmation. Yeah. And so one of the things is like this is a simple example of like, what a client would say, something like, I was thinking today that maybe we should change the bar where the user sees the notification for next Tuesday. So my clients know that we're close for the day. That is one long sentence. I'm not really sure exactly what next Tuesday is. We said something about today, but today has nothing to do with the notification thing. And it's just, it's really convoluted. So a better example would be our store will be closed on Tuesday November 6. Please update the notification bar to reflect this change. Something simple, easy sentences. Yeah. What else? You just want to kind of want to be segmented like that. And also white space is huge. If you guys can mold things, italicize things, just anything to make it very easy for the reader. For some note taking, I highly suggest just, so if it's a simple task, sometimes you can avoid the step, but as soon as you start to have three or more items, you brain really can't handle more than three, three things on the mind for a task. So one of the best things is to create a list with checkboxes. And so some of the applications you can use is Avernotes, Google Keep, Google Docs, Microsoft Word. Depends if the client sends you something in Microsoft Word. I'll just keep that and do a little checkmark right next to each task or do a scratch outline. Avernotes and Google Keeps are pretty cool. They have the ones with the checkboxes. It's been pretty helpful. And then, there's some note taking examples. So before I set the devices, now repeat yourself. So you don't want to keep saying like home page, do this on the home page, do that on the home page, home page. Just like, no, we can try to set it up where you have the home page and you have the task that you want. And I always try to have the type of task that's going to be an update, is going to be a remove, it's going to be an add, things like that. And that seems to be very helpful to keep everything together. It makes everything very clear out of what you need to get done. And so one of the things to do is try to use things that are popular. These things have the most support that you can get. Right? I think we've all experienced something like Yoast SEO plugin. It's like million downloads and a great support team. You always want something like that. If you don't have to always do that, typically, I always suggest going to something that's popular. And if it's not what you're liking, it's like you really be sure, you know, you're going to be using it for something that's very unique to you. Because typically, there's a lot of things online that already have free tools that you can already use to get ahead of life. And another suggestion is to do something called change your approach. So you've got Tony Robbins here. He says, frustration is a very positive sign. It means that your solution to your problem is within range. But what you're currently doing isn't working. And you need to change your approach in order to achieve your goals. I've encountered this many times where you're trying to come up with a solution, trying so hard, you keep trying the same solutions over and over again. It's like, all right, the solution you're proposing isn't working. You spend an hour on it, spend two hours. This isn't, maybe this isn't the way. And if you start to start feeling that frustration, like, how come this isn't working? Take a breath, take it easy, rethink it over. Is this the right approach to what you want to accomplish? Or is this something else that you might need to change the way you're approaching your goal? There's another cool one which is trying to get into a state of flow. So your goal here is to try to balance your competency and the challenge. So you want to do things that are competent. So if you're doing things that are competent, it can lead to boredom. Eventually, you're competent at something, you keep going, you keep going. Eventually, it's like, oh, you start to get this tiring feeling. It's just not feeding your soul, basically. But then you also don't want to do things that are too challenging because then it leads to stress and frustration and this feeling like, I can't do this, this isn't right. So you want to try to get into that balance of the two and that's where you get this change, this state of flow. And you guys probably already experienced that at some point where you work on a project in an hour or two, maybe three go by and you just don't know where the time's gone. And it's because that's that perfect blend of a challenge met with something that you're competent and something that's just above your competency, just enough challenge just so you can kind of keep going on this rocket ship up. So you have a perfect graph, there's a YouTube video on this whole discussion. You want to try to get enough challenge to get into the state of flow where you don't want too much or else you start to get anxious and you start to think you can't do it. And then if you get too used to what you're doing, you start to get bored, so you get tired, you start to, it's kind of zone out, not really feeling up for the task. And if you get in the state of flow, you get to achieve ecstasy, which occurs as a very good feeling. And so there's some books I highly recommend, one of them is Eat That Frog, 21 Great Ways to Stop for Fascinating and Get More Down in Less Time.  Now, there's also the fact that maybe you're not a morning person. So there's different tasks, so one sometimes is like, all right, I'm up, I'm alive, I'm waking, I'm alive and awake, feeling good, I'm gonna go ahead and eat that frog, I'm gonna go take on the biggest task of the day. Alternatively, I'm always more so of this baby steps formula that Dave Ramsey talks about, which is, you've got an important task, it's small, it's achievable, like 15 minutes, I'm gonna do this quick update for somebody, after 15 minutes, like, I just did my first task, you start to build that momentum, then you go for something harder and harder, you try to go up in that order, you build up that momentum. So it depends on the task, depends how you're feeling, it depends on a few things, but those are two big important ones. Another big one is something called a Paradeo's principle, it's also known as the 80-20 rule, you hear the famous line, 80% of your business comes with 20% of your clients, another one is 80% of your results come with 20% of your actions, and you start to see that in your life, the certain tasks you're doing, and so the big question is, what is 20% that you do, it gets you 80% of the results, and that's your homework for tonight, try to think of something that you do, that if you kept focusing on it, what are the results that you could really achieve from it? And so there's also a few other things, there's like three steps to mastery, one is 30 to 60 minutes in a book or magazine, another one is trying to go to networking events, workshops, and courses like WordCamp, and another one is audio programs, think about how much you could have learned on your commute here to WordCamp, also to audiobooks that I highly recommend, there's some podcasts as well that are pretty helpful, and another one that's not on here is that they've asked like Jimmy Hendrix at one point, I was like oh well how often do you play the guitar and stuff, he's like I practice eight hours a day, he's like you're Jimmy Hendrix, you're like the best, you're the best ever, it's like why do you need to play eight hours a day, he's like well that's why I'm the best there is, because I play eight hours a day, and so they started to realize that if you get up to I believe a thousand hours, add something, it's either a thousand or ten thousand hours, you become a master at your craft, and so you start to think about all the hours that you spend a year, I think one year is about two thousand working hours, you do that for five years, you'll be a master of whatever you're doing, so it's very important to build up good habits and have work, in five years you can be a master of what you're doing, another one is to guard, nurture your energy levels, are you a morning person or a night owl, one big thing that I noticed a lot of times people, we're morning people, then they're going to the emails and checking emails and spending all this time on the emails, it's like is that the best use of your energy is like you're a morning person, you can spend all that you know energy ready to go on your emails, sometimes maybe those things are better off like in the middle time or later on, I know that's a little difficult because fines might be expecting your emails, but it's things like that to just keep a mind of, it's like when are your energy levels at your best, right, so just something to consider, another book I highly recommend is The Seven Habits of Highly Effective People by Stephen Covey, and so the seven habits are one is to be proactive, adopt a perspective of responsibility for your actions, reactions and results, I'm just going to fly through these habits, another number two is to begin with the end of mind, make sure your efforts start with the establishment of your personal principles, like what are you trying to achieve, whether your goal is in life, is this the path that you're going to go down, and what is it going to look like in the end, you really want to think about your goal, what you want to do for your career-wise, what's it going to look like in the end when you spend all these hours on these websites and doing these different tasks, number three is to put things first, we'll be talking about this in a little bit, but spend your time on things that are important, not the things that are urgent, and this is called the Eisenhower Matrix after the president, we'll be reviewing that in a second, I'll always think about when, when the approach of every interaction with the perspective of trying to fix the system, not the person, in order to find the solution that is the best for all involved, so you see that a lot, and one kind of thing is like if you get something from me that I lost, or vice versa, it's like no, that's not how this all works, you try to bring an approach that's like I'm going to build your website, you're going to pay me, and we're going to have your relationship, you're going to get something that you want, you're going to get something that I want, and then it all works out for everybody, and so it's always good to have that positive mindset, number five is to seek first to understand, under, seek first to understand when to be understood, meet people's needs to be understood, establish trust, and communicate your emotions, and then communicate the logic last, right, you want to be approachable, you want to be liked, kind of think of like that, I don't want to say politician because they kind of have that sleaziness to them, but you want to kind of feel like someone that you can trust and understand, a good realtor will do that, there's many, many people that you can look up to for that type of understanding, everybody kind of seems to connect on the emotional basis, I mean that is why, how we typically vote for politicians in general, set this base on how do we trust them, how do we feel about them, I know many, many people who are like Republican people for Democrats and vice versa, just because of their, their affinity towards them, number six is to synergize, combine your, the first five habits, or an exponential higher level of effective and corroborative daily interaction, so that's all about building up good habits, as soon as you get those habits in place, you're not going to even think about them, it takes 21 days to build up a habit, so you can, you know, try to build up that habit, things are going to just become really easy, you're starting to enter that state of flow, kind of type of effects, so it's very important, and number seven is to sharpen the saw, which is all about maintaining your body, you know, exercising, eating right, feeling good, you'll always want to try to build up that energy in you, and so the Eisen, so back to number three was about the Eisenhower Matrix, so you have four different boxes, you have your first box, which is important and urgent, you're important and not urgent, not urgent and important, and then not important, not urgent, and to break that all down, you have the first one, which is important and urgent, and this one's all about the house is on fire, the IRS is sending me a letter, my passport is about to expire, everything's just chaotic, you're freaking out, you don't know what to do, you're starting to get nervous, you're starting to wonder, do I have the money for this, do I have this, that, it's chaotic, you don't want to be here, but it's important, you need to call 911, you need to figure out your letter to the IRS, you need to do these things, but you need to not be in this box all the time, oh so you're going to start feeling chaotic, you're going to feel very, very tired, so the best thing to do is try to set up habits to like, oh my passport's going to expire right here, try to get ahead of the curve on all these things, you know, paying your taxes on time, having some sort of system in place for all these things. Number two is important and not urgent, this is actually the most important box, if it's all about learning a new skill, reading a book, attending a work camp, trying to find time for things that are going to really improve your life, and it's typically the things that you know in the back of mind what you need to do, it's just the fact that you haven't made the time for it all. So do your best, that's another big homework piece for you guys, try to figure out what's your number two box, the important, not urgent, and have a big time for it. Number three is you're not important but urgent, these are typically phone calls and emails and notifications, and that annoying co-worker always tells you how bad they have it, you can always try to avoid these things, obviously you need to check your phone and whatnot, but typically at work I keep my phone on silent, I'll check my phone periodically, but I don't need that constant interruption of notifications and text messages, and people kind of stop me from what I'm doing, because then I lose that state of flow and it just really upsets the system. And number four is you're not important and not urgent, it is kind of funny, it is an important box because you do need time to relax, kind of be ambitious and go get her all the time, but things like social media, movies, video games, Netflix and jail, it's like you don't need this in your life, at least to the extent that we have it, I think the average person spends three to five hours of social media a day, it's like what if you had found time to do those other things in life, so these are the areas like fair warning, be careful, but it's important to hang out with friends and do things as well, this is actually a box I need to focus on a little bit more in my life, you know, in all irony, and so for good time management you really, really, really want to be in this box, the important, not urgent, if you can master that life's going to be really good. And so some more specific tools and advice that I can give you guys is to first create some documentation in terms of initial setup, your style guide, and launching a website. At my old company we really didn't do much for style guides, they were sending me a logo, the sales reps would always just, they're just trying to push the sale, and so the client would give me a lot of content, but I took up a new job recently and so we have a style guide, highly effective, try to make, even if it's something small, I would always do something small, all right, these are the colors that we're going to use, these are the different fonts, just like any, any type of style guide is important, and then the other two guides are more general or like your initial setup, that's going to be different for everybody. I use Ledwood Web, formerly known as Rackspace at my old company, now we're using our own internal servers at Amazon, so that's going to be different for everybody, but there's definitely a system in place that you guys use, definitely important to write it down, it's great to have for when you guys hire somebody new, or when you're still having to forget a step, it's always very important and it doesn't have to be, you should always do the two things, which is to have the documentation and then to add it into a checklist, so that way when you go down the steps, you can easily check it off, you don't need to read the six pages of your documentation, you just have to read this one page of your notes, and the same goes for launching a website as well, I have, there we go, we have my Evernotes, so this is my documentation for how to launch a website, you go review all the pages for links, and make sure the content's good, is it responsive, is there a Fabricon, is there a 404 error page, a copyright date, does that Google Analytics, and that's all under general, and then everything's broken down, this is the delete your unused content, your contact form set up, the different plugins that I'll use, and it makes everything very easy for me to follow up, did these things happen, and I have a checklist in the future for when the client says, oh, did this get done, I said yes, these are the things that got done, or I can double check, in turn, it's like how did you check these off, I didn't notice you did check these certain things off, did something happen, it's really good, so you guys can easily follow up with what's going on, and if you had any questions, like how to install certain plugins, or how to set up certain things, you can go back to the documentation, but you're supposed to be building up habits, so when you look at this, it should be very easy, you know what to do, or you just check it off and move on to the next thing, all right, selecting plugins, and there was a good speech today about whether to do in-house development, or whether you should download a plugin, in my scenario, we were trying to build out sites really, really fast, I typically would just have one day to build out a website, so I would just have to give them that, so I'm like, all right, well, no time to build plugins, so I was like, what do I do, which plugins do I use, and so it's always use the most popular, try to use the most popular plugin, unless you have a really good reason not to, and it's really helpful because there's typically a community that can help you with these types of things, so always look for most downloads, and then there's most, typically most downloads, and then sometimes I'll look at the ratings to see if there's good support and stuff, you always want to make sure the plugins have some sort of, you know, some frequency of terms of release dates and updates and things like that, sometimes you'll see things that haven't been reviewed, that haven't been updated in a year, it's like, all right, that's, it's not looking so good, so you can still use it, but you really, really need to be aware that this plugin might not be supported anymore and try to have a full of that plan, should that happen. As I always say, while I build something from scratch, we can modify what somebody already has made, that's been the big thing when I was having free banana and trying to achieve all the goals that we had, and so some of the plugins that I recommend was Duplicate Page, essentially you can duplicate all sorts of pages, posts, color and posts, it was really cool because you can start to note out pages really, really fast, try to get some demo content in, if you already have a page set up of a certain style that you already liked, you just keep it in the Duplicate button and all of a sudden you've got a bunch of pages that you can edit, so that was one really good plugin. Another one is this plugin called Insert Pages, this is pretty cool because you can build out, like typically I build up a footer in Avada and I have a nice like visual, use a visual editor, has all sorts of, you know, parallax picture, contact form, everything's nice and unique, but then we want to put it on every page, we want the footer, we want this like very stylized footer on every page, just like oh how do we do this, and so there's this cool plugin called Insert Pages, you can just insert the shortcode, so I'll have a page called Footer, I'll insert that footer with the shortcode in the WP Footer template, and all of a sudden I'll have this really pretty footer on all the pages, and it's like, we're done, it's like that's cool, all right, and then we move on to the next task. Another one was this Better Search Replace, essentially it only does is it replaces your text and code throughout the database, some people it's difficult sometimes to get into the cPanel, log in, you're going to write this query, this that, skipped all that steps, this plugin does it all, so you replace your code, your phone numbers, email addresses, you do it all globally, the only big thing is you need to save your database or at least understand what you're going to be changing, you don't, if you change your, what do you call it, when you change your URL address, it'd be very very careful, you might end up breaking the site, so before you do this, at least understand how to log back in to your database, try to update your URLs using this type of plugin. And if that happens, you guys can always contact me, I'll help you guys out. And another one is Pageless, this was a cool plugin, we used this a lot for SEO purposes, to build out a site map, you literally, all you do is insert the short code Pageless, and it generates a site map, and you're done, that's it, that's all you need to do. And yeah, it's just another quick way to get things done in the least amount of time. And so selecting a theme, I've always just stuck with Avada, we kept using different themes, kept purchasing different themes, and then as you would know, you go to the theme options, things are different places for different themes, and wondering where we're going, where we're going to spend all this time researching, and eventually I said that I've had enough, I'm sticking to the Avada theme, I'm just gonna, I'm gonna know where everything is, I'm gonna know this one theme front and back, and it's been extremely successful to the point where I built out a site in like four hours, nice five page site, contact form, all sorts of different things, so if you get really good at one theme, know it really well, develop some CSS that you can implement that you typically use, you can just really try to turn out sites, like good looking sites in a short amount of time, and so one of the things is that I have almost as other files, but like a quick example would be, I want to center things, I want to hide things, easily write something like this, like dot center, text align center into your code, as soon as you have a code block, you want to center everything, you just insert that class name center, and all of a sudden everything goes well, you can do that with like background colors as well, something like BG red, and all of a sudden your color's old, your background color's all red, anything to just try to make the process much faster, much cleaner, and big thing I always recommend is to read up the bootstrap documentation, because you can start taking all sorts of different lessons of how they structure their CSS, and how they view things, so they'll do something like red or primary color, just that, and you just start inserting the classes, and all of a sudden you'll start to be coding a lot faster, a lot cleaner, and so I have a big list of things I use over and over again, all sorts of avada stuff, so I have a typography thing, so I'll have something for like, it'll be like H1 red, H2 red, all these different things, just trying to get all my coloring right, I have all sorts of things for like the contact forms, and I don't know, just makes that life really easier, occurred here for the recovery dates, you just have to realize you're going to repeat the work that you do, people are going to like the other things that you've done, so if you try to save up all the things that you've done and try to generate yourself a process, you're going to be coding a lot faster, a lot cleaner, and last but not least is to learn your one-on-ones, so I always recommend everybody should learn the one-on-ones about writing, design, development, photoshop, business, sales, SEO, just the basics, so I have to learn photoshop, I'm my own job, all you really need to do is to be able to look crop images, how to optimize your images, how to add a color overlay, I'll get a logo that's like black and transparent, and you're like, oh this is good, but then you realize the site they want is also black and it's like okay, black on black, that doesn't work out at all, so to be able to go to photoshop and add an overlay to make it white, something like that's very critical so that way you're not always hanging on to your designers or the other people at work, and you just have to realize like that from Rado's law, which is that 80-20 rule that you only need to know like the 20% of photoshop, you don't need to know everything about it, but you'll achieve 80% of the results for knowing that, so it really helps you become a more self-independent, self-efficient type of developer, and that's it. So if you guys have any questions, let me know. Any questions? Sure. Can I find all of your slides at the URL? Yeah. Does that include the development checklist that you shared? Yeah, I can get that out there. Just give me a day and I'll get to it. Okay, because I want to compare your checklist ideas from my instructions. Okay, sure. Yeah, we can do that, and if you guys need anything, you guys can always email me. Everything's on my website, so phone call, email, anything, text, you guys can find it out on my website, and I'll easily help you guys out.  The question about relating to efficiencies, some of the things that are just great and standard, but in regard to billing, do you have any tips or things that you do to make sure that you're not wasting hours on something you thought was going to take this line or that one? Yeah. It's how, the best thing is to try to keep a record of all the things that you've done in terms of like how long certain things it takes, so that way you can have this history of like how long certain things will take. Like let's say you add in a contact form to your website, does it take 30 minutes, does it take an hour, try to find that range of what it might take, and then I always add an additional 50% in terms of time while I say, all right, we're going to do this, or try to do like a range, so if I think it's going to take an hour to do something, I'll say, oh, it's going to take an hour to two hours just so I can have that wiggle room. If somebody else has a better suggestion, I'm open to it, but that's typically what I've been doing, and at my new job I don't have to do those things anymore, so I didn't have enough time to test it, that was the best method I'll look at, but yeah, that's what I really like about that. I'm just curious, like, you know, if you were doing, if you were timing something, I'll be able to go on that all the way to the end, that's what it does, but all of a sudden, I just spent 15 hours trying to get it done and give you the right global, like, very charging, very charging power. Well, it depends, because certain customers, they block when you give them a global fee, and if you say, well, I'll do it hourly, then they'll be like, oh, I'm wondering if you can show, it's kind of the, you're trying to watch the balance. Yeah, typically we do it by the whole, so typically I didn't have to worry about it, but at the same time, we'll have to do something kind of hard type of stuff as well. We use a tool called Harvest, and we have probably 15 people that are billing at any given time, and so Harvest is an invoicing and timing tool that will integrate with Basecamp, or Zendass, or Rellow, and what it does, it turns it all the time, and you select the client, you select the task, and you turn the timer off, tap on and off, and you start another task, it'll automatically switch, and so what it does is over the course of the day, you can see what you're doing on the course of a project, you can get a breakdown exactly what your time at, and so our clients love it because it's like, lawyers will bill every 15 minutes, they're even increments, but they get our increments, and it's like, it really runs our support tasks, a bunch of 10-minute tasks, 7-minute tasks, and then we can bill immaculately at the end of the month, so you can generate your invoicing type, and you can probably create, you know, if you're doing a lot of like, smallish websites, you know, most websites are the same overall, you know, right, same process, like that, grab a cat, so you can set up a template in Harvest of what the website project asks for tasks, and then just kind of run through that, so that you can look back in time, and say, okay, a footer takes an hour, a contact form takes two hours, a page on average takes three hours, and you can quote based on actual data. Just as an info, I always found it very helpful to make sure my clients understand that websites are works in progress, they aren't done, finished, completed things like a brochure or a catalog, and just say that, you know, what they see now they are not limited to, and the website will look different a year from now than what it does now, and also too, if I have a client that wants, you know, to write a blog, just have them write the blog in an email and send it to me, and I'll get it posted in WordPress. Don't try to make your client learn how to create posts in WordPress unless they like WordPress, because they'll just get frustrated and they won't tend to write them. If they have a blog that they've written, just have them send it to you in an email, I'll get it up and post it in 30 seconds, that would take them 10 minutes or 20 minutes to do. That's a huge time saver. It's funny because sometimes we would go back and forth about this, and I still don't know what the best solution was, which was sometimes like, I'm overloaded on the one guy, somebody really wants their thing up, I'll send them a documentation, like, oh, here you go, this is how you do this, if they couldn't do it, well, we'll charge them, it's like that's fine. Yeah, unless I'm familiar with how to create posts in WordPress, just have them send you the blog in an email, you'll get it posted. It's more work for you, but it's more worth the time, and it solidifies the relationship. The moment it's done, it's up. You know how to set featured images and blog in posts and things like that. And to be fair, to be banana, it's not like we just charge everything. Yeah, I throw in a lot of things. We do like two maintenance tasks, when a part of your hosting, so if you had to do a post or something like that, then we'd happily do that. Thank you. All right, you're very welcome.


Hey everyone, welcome to my talk. Welcome to the last day of Kupcon. I'm super excited to be here and sitting on the other side of the podium is really curious for me. So thank you all for having me here today. So who am I? My name is Jonathan Pulsifer. I'm an infrastructure security engineer at Shopify. Certified Kubernetes Administrator number 89, if that means anything. You can find me on GitHub and Twitter at John Pulsifer. Previously, I was a team lead at the Canadian Forces Network Operations Center. That's where I got some of my security operations experience and donned my tinfoil hat. A network defense instructor at the Canadian Forces School of Communications and Electronics, and I did some work for SANS, some construction, and so some packet analysis and all that stuff. So I am a certified packet ninja. So thank you again for having me on stage today. My first Kupcon was back earlier this year in Berlin where I was sitting on the floor watching Jesse Frazel and Alex Moore talk about securing GKE clusters, or securing the Kubernetes clusters. So I'm really glad that the venue has a little bit larger room than they did in Berlin. So that's fantastic. Fun fact, for those who didn't know, the Kubernetes store, the CNCF store actually runs on Kubernetes at Shopify. So that's really interesting. I went and talked to the folks who were running the booth down there, and let them know that they should be letting you know that if you purchase anything, you're actually purchasing something through Kubernetes. It was one of the actual first doors that we moved to our cloud platform at Shopify. So before we start talking about security controls and how we do this, first we need to gather some more context about how we run services at Shopify. So we have what's called a service tier model, where as an application sort of moves through the software development lifecycle, we start off at tier four where we have a lot fewer requirements. It encourages that rapid prototyping really gets agility in there. And as we move through business importance, we impose things like service level objectives and the traditional software development lifecycle and controls, and impose things like page rotations, CI, alerting, redundancy, incident response, these sorts of things. And so when we were moving to Kubernetes and setting up all of our clusters, and I was thinking, why don't we do the same thing with security? So I've coined what I've called the security tiers. So first and foremost, when you create an application on our cloud platform on tier four, we impose things like strict R back, crities attestations. We'll talk a little bit more about what those are later. But as we move through the tiers, I have this vision, if I were to have one, of restricting the runtime of containers with secomp, app armor, the network policies, strict security context, dropping all the container capabilities and these sorts of things. So this is the vision that I have for doing this on my team. So we're going to explore a little bit of how we do this. So how many namespaces do we have? How many clusters do we have? What does it look like? So Kubernetes namespaces by tier. We have about 60 namespaces in tier one across a number of clusters. Tier two, we're about 70. Total, we have 450 namespaces operationally for services running at Shopify on GKE right now. So that's pretty outstanding. How does a team of seven cloud security individuals maintain sanity and sleep at night with this many namespaces running amok? And it's important to know that as we move to Kubernetes, we're not there yet. We're still in, I guess, an exploratory phase. We've moved most of our internal applications over, but it should be noted that we still have two data centers which are very much hot and we're exploring some Kubernetes there, but we're actually going to be focusing on GKE for the portion of this talk. So I'd like to introduce our cloud platform. Our cloud platform is running on GKE. So again, we have about 600 projects in Google Cloud Platform today, maintained by 15 folders, 700 Google groups, and 20 GKE clusters. So this isn't like the running one service per cluster idea. We have a number of clusters in a number of production projects which serve a lot of traffic. So that's some numbers for you. With that many clusters and this many resources that we have to control, does security work when you have to rely on people to do things correctly? Obvious answer here is a big no. So it's important that as we scale our operations, as we scale our clusters, as we scale all this, we need to introduce this automation into our platform so we can actually maintain agility with our developers, with a thousand active developers at Shopify, and how do we give them that Heroku sort of feel? How do we let them push code and how do we then secure those running containers? So this is a general overview of our cloud platform architecture and what we're going to do is we're going to step through a number of components here and we're going to introduce not the operational patterns, the operational automation because it's not the focus of this talk, but it's going to be the security automation here. So at each sort of stage in this process, we have our traditional, I guess everybody has a builder, right, CINCD is not new, there's been a lot of talks on this, but there hasn't been a lot of talks on introducing security controls into those pipelines. So we're going to step through those and see what they mean. So we're going to start off with services DB. So services DB is this sort of front end for services at Shopify where we have about 300, 400 services that run, how do we visualize or how do we make sure that everybody has their playbooks set up, how do we make sure that their logs are there, how can we visualize this? And this is a tool called services DB. I'm not going to focus much on the actual front-ending of operations again, but with services DB, because it has sort of the application context, this is the first place where an application sort of begins its life cycling. You have a repo and you sign up for services DB and then you can do some things like automatic patching. So on the right-hand side here, you see we have this robot who's creating a pull request on my repository that says, hey John, your Shopify cloud gem is at a date, so you should probably get that patched. We're a big Ruby shop, Shopify. So most of the automation we have built in for our dependencies revolve around Ruby. So this is an example of one of those where we actually provide our developers who are building Ruby on Rails applications with a gem, the Shopify cloud gem, which builds in some more operational automation, as well as things like providing good patterns around, say, storage, for example, is a good example of that. So with this, we actually, when we have a repository and we create service runtime, create cloud runtime, it's actually going to do a lot of magic in the backend and this is ground control. And ground control is really curious, because we use this to assign sort of identity to our namespaces. So we wait for, and we've heard of the container identity working group and Spiffy and we're getting to a point where we can then attach identity to a pod or a container. We can't do that today. So how did we do this at Shopify is where we actually give identity to the namespace. So when you create your cloud runtime with services DB, what's going to happen is we're going to create you a GCP service account that's going to be bound to your sort of namespace environment pair and we're going to mount that secret for you inside your Kubernetes namespace. At the same time, we're going to provision you an eJSON key pair. So what's eJSON? So go check it out. It's actually open sourced. It's called encrypted JSON. It allows us to use asymmetric encryption techniques to keep our secrets inside of Git repository so that we can actually have those secrets encrypted in there and when we deploy to our Kubernetes namespace, it actually decrypts that runtime. So we don't need to worry about these secrets being baked into containers, that bad anti-pattern that sort of has come up over the years. And we can avoid this by using encrypted JSON. So if we have an encrypted file full of secrets in there, who cares, right? But with this, we actually get the auditing for version control and all the secrets. So if somebody goes in, checks in a secret, we can see who did that when. So that's really unique. And we also annotate the namespace with your GitHub and who owns this, where does this repo come from and give a little bit more context to that. So now that we've taken a repository and we've sort of built its Kubernetes groundwork with ground control, how do we get your container built? So this is the fun piece. At Shopify, we do about 6,000 builds average on weekday. This is not like container builds going into production. This is everything from CI. This is our overall builder stat. So we build about 6,000 containers per weekday. Life-cycling is really hard. So we have about 450,000 images in GCR today. And that has given us and the folks doing the GCR vulnerability scanning, a little bit of load testing help, because as they're building these products to help us out, the amount of containers that are actually shoving in there has actually given us a hard time. So there's a bit of a latency problem there, but we're going to chat about that a little bit later. So our builder is called PIPA. And our builders run on build kite you saw previously. So PIPA in Portuguese actually means kite. So that's where that name came from. And it's a Docker in Docker, Golang creature that does a lot of discovery. So what I mean by that is, if you have a repository as a developer, should you understand explicitly how to build a Docker container? I mean, arguably no. So what can we do here to help get a secure container into production? So with PIPA, what it actually does is it discovers using the same Heroku build pack model, what code lives inside of your repository and will provision you the appropriate build packs needed for your application to run. So on the right-hand side here, you see the sort of build kite screenshot there and a couple different stages of our pipeline. Through a pipeline setup, we trigger the validation build, then we build your container. At the very bottom, you see this Grapeus and Creedy stuff. We're going to chat about that next. But with our builder, it's important to know that when it comes to building a container and actually building that container is when you have the most context as to what's going to be run inside of that container. You see the packages being installed. You see the versions of build packs. You have the most context. So this is where we can actually do a lot of our initial discovery and auditing and actually sort of check out what's going on. So we can actually do some audits like, does this image run as root? Do you see any vulnerable packages and container attestations? So what are container attestations? What does this mean? I want to talk about Grapeus and Creedy's. If you all have seen the sessions that have been going on, there's been a couple on Grapeus. And Grapeus and Creedy's has really been a large focus for the cloud security team for the last little while. So Grapeus is a software component metadata API where it allows us to store details or metadata about a given software package, right? You can have a dev, an RPM, these sorts of things. But isn't a container just an image that we could also have metadata for? Absolutely, right? So using the namespace and image and the digest as the key, we can actually produce what's called the note at build. So we can sort of start this chain of provenances who created this container, when was it built, what other, is it deployed in production right now? And these other pieces that we have context for at build time. So we produce these notes at build. And if you actually use Google Container Builder, you get all this stuff for free on the inside, which is sort of neat. So as a personal customer, I didn't know this, but building my own containers and my own personal projects, I said, okay, well, what is this stuff? What does this look like? You can see what's called an occurrence or a note of a package vulnerability. So with Grapeus, it's just metadata, right? So we can actually start pushing things like vulnerabilities there. So you see this is a TCP dump 490 package that's vulnerable and it's fixed in version 492. So if we have this information about this TCP dump package, a container build, we know that we're installing a version of TCP dump in a container. On the other side, then we can say, hey, look, this container, this specific container contains this package with this vulnerability, right? It's that container introspection. And that's where Grapeus is really powerful for keeping that container metadata. So if you want to learn more about that, check out Google Cloud's blog or Shopify's engineering blog, I wrote a little post about how we use that. Metadata is one thing, but Creedies, or as you'll hear if you hit the Grapeus repository, binary authorization, is really the cool piece. So it's using this metadata that's stored in Grapeus to create and enforce policies at runtime. So this binary authorization means that we're going to step back here and show you at the very bottom you see this Grapeus and Creedies stuff. What we're doing in there is actually taking the digest of our container, we're signing it digitally, and then we're pushing that back into the Creedies sort of binary authorization API, and what we're going to do here is then make sure that we can deploy no image other than the images which have been built by us, which is really unique, because this sort of takes away the idea of an adversary gaining access to your cluster and downloading their own container and running their own tools, right? That could be described as bad, and we don't like bad. So we like to enforce these with Kubernetes. There's actually a demo at the BOF talk for Grapeus of this actually working with an emission controller, which is awesome. So now that we have our repository checked in, our Kubernetes primitive started, we have our container built, and how do we actually deploy this to production? So Kubernetes deploy is really cool. It's a gem that provides us a lot of automation around deployment to Kubernetes. It's actually open source, so go check it out. It's essentially a plugin for our build tool called Shipit, which is also open source, so you can go check those things out and see how we deploy to Kubernetes. But the main features that are really exciting for me and for our developers is that we have the clear, actionable pass-fail results. Green is good, red is bad, it's like the pre-deployment of certain resources, right? Like you have to deploy a service before a workload so that you can have the appropriate environment variables, these sorts of things. Now we do a little bit of that, and the decryption of the eJSON is what's happening here. So what we can do with Kubernetes deploy since we built all these tools, they all have the context, is we can actually put this other structure inside of eJSON to say, create me a Kubernetes secret from this blob named this. And this is really cool because somebody can keep these secrets inside of version control and then deploy them to encrypt them at runtime so we don't need to worry about any of that plain text secrets and stuff. There's a few other checks in there as well, so like we can't overwrite a Kube system, for example, or delete Kube public, you know, these sorts of things, some checks in there to help us out. But there's an example of me deploying a little Go app. So you deploy it in 4.2 seconds, it's good, it's green success, and we're all happy. So this is an example of some of the automation that we have here around getting secrets into the appropriate namespaces that are inside of our containers. Oh, it's black, works for me. Let's try it again. Cannot reproduce, that's right. Oh yes, my fault, always. Thank you so much. So stepping back to Kubernetes deploy. Kubernetes deploy, TLDR, gives us clear actionable passfail results. Also decrypts us our secrets from EJSON into Kubernetes and really helps us with that developer experience. So if we have robots deploying for us, this has actually prevented us from having to give our developers Kube CTL access, which is really unique. So with a thousand active developers, then wanting control over their infrastructure is a really big deal.  We built tools like Kubernetes deploy, and another one which I'm not going to show, but I'll talk about is Kube Shell, which will actually sort of preclude us from having to give Kube CTL access to our developers, which is really awesome. With Kube Shell, what we can do is actually, with TTY.js and a little bit of OAuth, we can actually give them a terminal into their own namespaces with access provisioned via config map. So we don't actually want to explicitly give all of our users that admin access and deal with our back-end that way, so with Kube Shell, we can actually provision a little bit differently. So this is where the phone automation begins. We're going to talk about our cloud buddies. So cloud buddies internally marketed as friendly Kubernetes controllers, keeping the cloud fluffy. Is our brand for our Kubernetes controllers that we built. There's a lot of them, about 15 of them run per cluster. It depends, given the type of services that run there. But this is where we can introduce our service automation, our security automation. So we have things like RedisBuddy, for example, MemcacheDBuddy, that would provision you an appropriate resource under whatever circumstance that we've decided to build. But the ones that we've decided to build for security or implement security controls in, that I want to talk about are AccountabilityBuddy, BucketBuddy, NetpolBuddy, ArbeckBuddy, and SecretBuddy. So it's pretty fun. Here's an example of what AccountabilityBuddy is designed to do. So remember when we created our Kubernetes namespace and assigned identity to it with the GCP service account? It's how do we give access to a given Google API to that service account without somebody pinging me and having me to go and manually click some buttons there? That's not very scalable as we deploy a lot of applications to our cluster. So if they just drop a config map in the repo and say, hey, I want to give this service account, now say container viewer, well, we can do this. And we do have some checks in AccountabilityBuddy where you can't give yourself sort of God mode on the entire project, right? Like this is something that we've accounted for and we don't want to do. But we do have some APIs which we will very happily allow you to check into diversion control and allow us to version that access for you. So this is how the seven of us sort of maintain sanity moving forward with this. With storage, again, every developer would like access to their storage. And since we use G Suite for our actual business products, we can actually leverage that identity on Google Cloud Platform. And then with Bucket Buddy in this example, there's an example of a custom resource where we are giving storage admin to a robot and to a group and giving object creator to you at Shopify.com. So again, with all of this inversion control, this allows our security team to actually then audit who requested these permissions, when, and we have that trail, right? Of course, there's that, oh, anybody can change your identity and get, and that's all good. This is a way that helps us early on build that auditing into our platform, which is really unique. So with this, then we can assign appropriate permissions. Auditing clusters are hard, especially when we have 20 of them. So how do we ensure that all of our workloads are running securely? When I started down this road, I said, well, the tools didn't really exist at the time. I said, how do I effectively audit this cluster to make sure that my workloads are running securely? And this is where Cube Audit came in. We actually have a couple of dedicated developers on this now. We open sourced it very recently. And this is just a little Golang application that allows us to perform audits against arbitrary security controls on Kubernetes. So we can audit for things like Automated Services Account token. We can make sure that the appropriate image and tags are running. You can see an example in the top right there. We have a screen cap of the terminal we do. We have some human readable output, but we also have put in JSON so we can automate this. We can audit for network policies to make sure that you have appropriate default denies policies in there. And every control under security context we can also audit for. So if somebody comes to me and says, hey, John, this image has been determined to be vulnerable. What can we do? Well, we can just quickly run a little Cube Audit check to make sure that we're not running that image anywhere. This is probably going to go away with Grafayus once this becomes a little bit more... Once Grafayus becomes a little bit more fleshed out and productionized, but this is a really easy way for us to do this today and get some answers very quickly. There's this other continuous security monitoring piece that we're missing. So with 600 projects, scaling is really hard. So we have developed a couple tools inside to help us out with this. So there's a tool called Nosey Bastard which does scheduled scanning. It's like our traditional sort of VA or ZMAP, NMAP Nessa scans. It does some discovery of cloud resources on GCP, on AWS, on Heroku, and other operating environments, which is pretty cool. And we also decided, as we moved towards a really strict RBAC control clusters, we needed some sort of visualization there to help us out and look at this, to see which service accounts are mapped to which roles and these sorts of things. And we built that into Nosey Bastard so we can actually go and clickity-click and see which RBAC roles are assigned to which service account, which is really awesome. For setting security, if you all haven't checked that out and are using GCP, please do. It does really, really good comprehensive GCP inventory and there's been a lot of horsepower behind it over the last little while. And we used this for the discovery of other resources and also the enforcement of IAM policies, which is awesome. So we can make sure that if you or a developer at Shopify creates a new project, they can't add any external identities to that project for an example. So we're using GKE and the concept of the MIG or the Managed Instance Group that these nodes come up and go down a lot and moving from a traditional sort of config-managed Chef Ansible sort of environment where we had to ship around SSH keys and these sorts of things, that's not really something that we want to do. So the Google Account Statement that's actually running on the container-optimized OS will actually provision you access via SSH by taking the SSH keys out of the project metadata and then you can take the authorized keys so you can SSH into it. And if you haven't done a G Cloud Compute SSH, ticka-ticka-ticka, and bang, you're in the server, right? But where are these keys held? How can we manage them? Do we have to? That's sort of arguable, right? So our Google Accounts today are actually backed by multi-factor authentication, right? So if you want to talk to Google Cloud Platform API, you got to sign in. So we already have some controls around identity there. So accessing a cluster via SSH or a GKE node via SSH, this is all backed by our G Suite identities today, which is, again, backed by MFA. So do we have to ship these identities around? These SSH keys, if you don't have one provisioned, if you don't specify one, it will create an ephemeral key for you. So what if we just delete these all the time? And then you have to provision them again and again. It doesn't take too long. How often are we actually SSH-ing into a GKE node? Not very often. So given that, we're going to build a tool called SSH Janitor to go in and discover and delete these stale project-wide SSH keys. So every time that we have to log in, we got to do that little dance. Maybe it takes like 30 seconds, something like this. But it's really not that big of a deal if we can actually reduce that threat by having these stale SSH keys around, right? We have to provision them all the time on the fly, which is really cool. So what's missing? People at Google.com, please don't hate me. We were missing, at the time that I wrote this talk, a lot of things. But Kubernetes moves so fast. And given that, like, GKE is open-source Kubernetes, plus a couple bells and whistles, we haven't... We've actually scratched a lot of these off. So for the longest time, we actually didn't have access to the API server logs because Google hosts the master for us, right? So given that, how do you get these logs? Kube CTL proxy, curl the Kube API server log endpoint and pipe it out to a file and do some other things. You know, that wasn't available to us. But as of GKE 173, it's actually in cloud audit logging now, which is phenomenal. Network policies are finally here with Calico, which is great. As of GKE 176, egress network policies work as of 184, which is really good for us. We're still missing pod security policies. I've been poking for a long time. I can't set my cluster-wide pod security policy. Now, why is that important? Why is that important enough to grab a slide? Because we have what, 300 services maybe deployed there now? So if in Kubernetes 1.8, we have the new flag in the security context called allowed privilege escalation, right? So how do I ensure that allowed privilege escalation is set to false in all my containers and all my workload manifests? Well, that's a couple hundred PRs. I would really just like to do that once. So that's really where that comes from. So that's really where that escalation has been really, really fun for us. Not. So on GKE, we have a couple of different authorizers. We have the webhooker, the IM authorizer, and we have the RBAC authorizer. So for those who don't know, when you make a request against the API server, we have this long list of authorizers, and if any one of them succeeds, the request will succeed. So if I don't have an appropriate RBAC role but I've provisioned myself access through IAM, my request will succeed. I can get my pods, I can list my nodes, these sorts of things, but I'm going to see RBAC failures keep showing up in the API server log. We page on RBAC failures in the cloud security team, and this has been quite the journey for us in this. So we're really missing that IAM and RBAC synchronization. That would be super awesome if that could exist. The GLBC configuration authorizer for the identity aware proxy, I know stuff's in the work there, but I would really like to enable the identity aware proxy because we are a big users of the Google Cloud load balancer. So the GLBC, if I could configure some IP there, that'd be sweet. And container identity, I cross it out. It's not here yet, but we've seen all the work going on with the container identity working groups, and I have faith that it will show up at some point in the future. So that's all I have for you today. Ready for any questions? Thank you. Cross cluster communication in different projects. That's a little hairy. So I mentioned we have four service tiers, right? Tier one, two, three, four. There's actually a couple other ones that I didn't really mention. One is tier shared, and tier shared is that sort of providing access like Splunk and zookeepers and these sorts of things at Kafka, and how do we connect to that? We don't actually connect any other way than we would normally. So we'll still front it with an appropriate load balancer, and we'll still do TLS in the front and clients are often these sorts of things. So we're still using the same traditional login methods that we would have used before. If this was running in the DC, we'd use the same method. Maybe an extra sort of TCP tunnel on there just for funsies, but that's... We haven't really played with that yet, so we're really looking forward to the what's called IP alias clusters, right, where we can actually make the pods and service first-class citizens on Andromeda. That's really cool. We haven't done it yet, but we're looking forward to exploring that when it comes. Yeah, Kubernetes Deploy. So you're guessing the Kubernetes Deploy has access to the project? Yeah, we protect those keys the same way that we protect any other key, and that would be... At Shopify, we have what's called the default to open culture, so typically our engineers have access to all the things, and given that, they're still held in encrypted JSON and deployed the same way that we would deploy another app. So it's just another key, a secret to secret to secret. We do have auditing around this, so if we would determine that it could have been compromised, and with IAM, it's just super easy. We're going to spit out another JSON, kind of good to go, right? And we do have auditing through GCP there. Does that answer your question? No, there's not like a monthly rotation. It's more whenever we feel like it would need if something has gone awry than we would do that, but if there's no indication that it keeps them compromised, there's rotating it to the provider's value, I think. It's not like... So the question was if we have feature parity of sort of cloud trail there, it's not the same, but our models are very much different now. Moving in GKE, all of our cluster operations are logged appropriately through cloud audit logging, right? And we're satisfied with this, but in cluster sort of operations, app level operations, that's all Kubernetes now, so it's sort of like build your own auditing, I guess if that makes sense. We use Splunk for our logging pipeline, so we're going to hit the fluency aggregators, kind of Kafka Splunk, that would just be our ideal pattern, so nothing really changes there for us. Like when we venture into multi-cloud, I don't really see any huge differences. So the question was we still have a number of applications running in our data centers, and what were the pains sort of moving to GKE? Operationally, I can't really speak to this, but security-wise, it's all about the snowflakes, right? So not every app is the same. A Python application is built differently than a Ruby on Rails application, so we've tried to stick to that build-packs model and tried to introduce as many controls as we can there, but some applications are different, so we've actually had to walk teams through appropriately building a Docker container, or just keeping on top of these things, because not every app is the same. It's more of like an operational question, I guess, sort of migration there, but as an infrastructure security engineer, traditionally everything below the app in a stack, now it's like everything below the app in a Docker container, right? Does that make sense? Is that any question? Cool. So the question is, how is the GCP sort of identity that we provisioned for this namespace actually consumed by services? So when we at the beginning in the services DB, when we click create cloud runtime, and that's when all that stuff is provisioned, we actually mount that secret in Kubernetes and then provide that sort of as a volume mount, you know, sort of a secret volume mount inside the container, Google application credentials, you know, the typical place in the file is where we would mount the path to that, and we provide this in the workload manifest sort of for everybody. We have like a number of blessed stacks, right? So, you know, for the snowflakes, it doesn't really work, but if you're deploying like a Rails application, and everything's going to work magically for you, and that's what we get. We haven't done any really like YAML templating, like any templating like I've mentioned before, so that's a little bit hairy, some manifests are quite long, but this is where we can mount those for our developers, so they don't have to worry about these things. No, so this is the difference between the Kubernetes service accounts and the GCP service accounts. They're both like completely separate, so the GCP service account is used to talk to the GCP APIs, and we mount that distinctly as a secret. Yeah, cool, that's awesome. For, yeah, so the question is like, when we do our automated patching, do we actually, is it fully automated, or does a developer have to actually click a button? And sometimes they do. Some, you know, some, for example, like a gem bump or something like this, and then with automatically patching, yeah, they're going to go through and be merged automatically, but that's a risk, right? If we're serving production out there, it says, oh, here's your patch, boom, boom, push it through, like, and it breaks. I don't want to be responsible for that, you know, so not really yet. I mean, we're still pretty young in our Kubernetes journey, so I would assume next year, asking the same question, it'll be different, but right now, no, there's still some manual steps required, so if we're active right now, we can't do it fast enough to put it in the CI and make it worthwhile for us. So our, is Accountability open-sourced and we have a plan for it. A lot of the buddies that we actually have are really sort of contextually bound to Shopify and our patterns, so it doesn't really make much sense for us to open-source those right now. We thought about it. You may see some buddies show up in the future, but right now, they're sort of all monoreboats, so we can componentize those right now. So you want it, right? Yeah, that's awesome. Okay, that's great to hear. That's great feedback. I love that sort of feedback and if I can push that, I will. Yeah, so the question was going to explain a little bit more about why we don't give key pedal access to the devs and it's more about management, I guess at this time, so rewind back a year, and it was myself and a couple others doing the cloud security stuff, so how do we do effective RBAC for a thousand devs at a time, sort of automatically, and that was sort of like a design decision that we had to make, and did we want to expose or teach Kubernetes to developers? Maybe next year, but to keep us moving fast and to keep actually services being created and not having to pause and learn Kubernetes has actually been a really big win for us. So over the last couple of days, we had our company Hack Days, which is two days where we just build the things that are cool, and I think we have 50 or 60 different applications now deployed to that cluster, and it's pretty phenomenal that they can do that without having to worry about the Kubernetes patterns, right? They can just click through it and have their storage and have the Redis and do all the things. We do actually spend a lot of time supporting deployments. We have what's called a cloud help rotation, so we go through and some of us will swap out and actually provide sort of front end support to the devs who are onboarding onto the cloud platform, and us on the security team actually do that as well, so we can actually course correct if necessary if we're seeing these sort of anti-patterns showing up there, which has been really helpful for us. But yeah, we do provide sort of cloud platform front end support. How are we handling the image scans? It's all GCR vulnerability scanner is the main tool that we use for that, and right now we can pull out if containers are vulnerable or not via the gcloud command line utility or hit the API or in the GUI, but again, it's all reactive right now because of the latency. It's just, again, when we have that 450K images in GCR, like we're really hammering the API and we're giving them a hard time as much as they are us, so it's reactive for sure. Yeah, the question is do we see a lot of duplicate images or the same sort of services, and absolutely we do. A lot of applications aren't too dissimilar, so we do actually provide blessed base images to start this off, and that's sort of where we make those decisions, but yeah, there's a lot of duplication. We thought about injecting stuff into the image after deploy, but again, we're following that Heroku model, so Heroku-ish in the build packs really just it works, and it works well, so I'm going to stick with it, I think. Anything else? Yeah, so how are we handling alerting? Alerting on what? I guess. The thing that I mentioned was we page on our back failures, so we're actually looking for returns on roundtripper for our back failures, and we're digesting the application level logs that are anything that contacts Kubernetes API, and just alerting standardly through page-to-duty as we would. Regular logging pipeline sort of stuff. Cool, well thank you so much everyone.


Hello and welcome to the session. In this session we will discuss a question which says that draw the dilated image of trapezoid PQRS with center C and k that is scale factor is equal to minus 3. Now before starting the solution of this question we should know some results. Calculation with center C scale factor k is a transformation that maps every point P in the plane to a point P dash so that the following properties are true. And first property is the image of center C point C itself and second property is the image of point other than center say P Cp dash is equal to absolute value of k into Cp and k is not equal to 1 is reduction is less than absolute value of k is less than 1 that is f is between 0 and 1 enlargement negative then the image lies opposite to the center of pre-image. Now these results will work out as a key solving out the given question. Now let us start with the solution of the given question trapezoid k is equal to minus 3 we are given is equal to minus 3 is negative to the center of pre-image scale factor k is minus 3 which is negative so image to the center of pre-image to 3 and 3 is greater than 1 we know that dilation is enlargement value of k is equal to 3 which is greater than 1 so the image will be enlargement is not given so we are can be drawn easily. Now let us take the point C here now let us draw raise to the vertices of trapezoid point P then we have drawn point Q then we have drawn ray N from point C and passing to the point R from point C and passing to the point now here scale factor k is negative so we make the image no in dilation corresponding image point lie on same center so here let us see idea that is Cp dash is equal to absolute value of k into Cp now here is equal to now we have absolute value of k is equal to 3 so Cp dash is equal to 3 times Cp so we plot at length C is the length Cp which we put a dot which represents the point P dash such that length R dash and S dash such that is equal to 3 times C up is equal to 3 times C we will locate the point on the ray O dash we will locate the point trapezoid P dash Q dash R dash instead of the given question and that is all for this session hope you all have enjoyed the session.