Hello and welcome to this virtual presentation titled Rational Isogenes from Irrational Anomorphisms. I'm Lawrence and this is joint work with Walter and Frey from Leuven. So, as you might have guessed, this is a talk about isogeny-based cryptography, but I still want to start off by giving a very high level explanation of what our paper is about for people who don't know much about the underlying mathematics but still want to get the big picture of our work. So the most direct implications of our work concern a scheme called C-Side and that is basically just a cryptographic one-way group action, meaning it's an algorithm that takes two inputs. The first input is an element of an abelian group G and the second input is an element of a certain set X and then the output is another element of X and well being a group action means that this operation is compatible with the multiplication in G such that when you apply two group elements it's the same as applying the product of these group elements. Why is this interesting? Well, we can easily build a Diffie-Hellman style key exchange from this by essentially taking Diffie-Hellman and replacing the X pronunciation that's happening in Diffie-Hellman by this binary operation. So then the secret key space would be G and the public key space would be X and well it's easy to figure out that this works and for well-chosen group actions and we hope that C-Side is such a thing we can hope that this gives a post-quantum secure Diffie-Hellman non-interactive key exchange which is why this is kind of interesting. So one open problem that's sort of reasonably well-known among isogenic people is that of hashing into the set X. So that basically means you would like some method, some algorithm, some formula that essentially spits out elements of the set X in such a way that it's provable ideally or maybe plausible that nobody can know which element of G took you to this new element of X that your algorithm just produced. So sticking with the discrete log analogy that would mean you would like to just produce an element of your group where you can argue somehow that nobody knows the corresponding secret key with respect to some generator of your discrete log scheme and for DLP in fact we easily can do this for all the groups we care about. So for finite fields you can just write down a random number and it's good for it occurs you have to do a tiny little bit more work but basically you can very easily sample close to uniformly or uniformly from these groups. Unfortunately for this isogenic setting this is much harder. If you just write down a random bit string it has an exponentially small chance of being a representative of an element of X. So we have to do more work. Here is a complete survey of the known methods to produce elements of the set X besides dumb things like random guessing. The first one is you take some known element of X there are a few of these they are documented in the literature you can easily figure some out and then you pick a random element of your group that has enough entropy or something and you just apply it to this well-known public element and then you have a new element of X because that's what this group action did. But the problem is that obviously this doesn't serve our purpose right because well we know what the connecting element is because we chose it ourselves so you know this is definitely not the thing we want and the other method is and that is in fact actually the method how we even arrive at these few publicly known elements of X is to reduce a certain well-chosen elliptic curve over a number field modulo your prime P and then you know if this curve was chosen well enough it will in fact be an element of X and it's not immediately obvious how this new element is connected to the other known elements that we've obtained earlier that are just publicly known or at least that was the case until we wrote our paper and basically this is one of our main conclusions if we know a little tiny bit of information about this curve that's reduced modulo peer then we can easily write down what a certain group element is that connects this new curve that we just obtained to some other well-known curve that's existed forever. At this point I should also mention that this is very much related to parallel independent work by Wune and Love and well they basically arrive at the same conclusion using quite different point of view. Alright so after this very high level overview let me explain some more details that we'll need to describe our results. So among elliptic curve people it's relatively well known that if you consider an imaginary quadratic order that occurs as the anamorphism ring of an ordinary elliptic curve then the ideal class group of that ring acts on the set of all those curves that have this anamorphism ring and this action is free and transitive meaning that once you fix a base element it is a bijection. What's I believe much less well known is that in fact this also works for super singular elliptic curves if you restrict to curves defined over fp instead of fp squared and you also consider just the subring of anamorphisms that are defined over fp. So this again is an imaginary quadratic order whereas the full anamorphism ring of a super singular elliptic curve is non commutative and it's a maximal order in a quaternion algebra. So this is in fact the the main contribution of seaside using this action on a super singular as such a graph defined over fp for cryptography. So seaside is just the cm action of an imaginary quadratic order containing q adjoint squared minus p on the set of elliptic curves that are super singular necessarily defined over fp which have that order O as their fp anamorphism ring. Computationally how do we compute this action? Well the elements of the class group are represented by invertible ideals and so this ideals are subset of the anamorphism ring and the action on a certain curve e is given by well intersecting all the kernels of anamorphisms contained in this ideal and quotienting that out and by general elliptic curve isogeny theory we know that every finite subgroup is the kernel of anisogeny so this gives you anisogeny to a different curve and that's the output of your group action. You can prove that in fact this action is also free and transitive right so there's another problem here namely that generally computing the action of an arbitrary ideal is quite hard if you do it naively it's exponential time there's an algorithm that does it in sub exponential time but it's definitely not poly time so to make this action efficient we in fact restrict to ideals of a very special form namely there's some fixed choice of small prime ideals called l1 through ln and then we just take some small product combination of these prime ideals and use that as our secret keys and then you have to some more estimate the size of the key spaces and stuff to make this all big enough to cover the entire the entire public key space and and so on but this can be made work and then evaluating the action of this is very efficient because well each individual l can be applied quite efficiently and then doing this a small number of times is still efficient one main advantage of seaside compared to using the cm action on ordinary curves is that applying one of these prime ideals li is particularly cheap so the bottom line is that seaside gives you non-interactive key exchange that we expect to be post quantum secure and it's relatively fast at that so it's really sort of like a replacement for Duffy helman in many cases a helpful and quite common way to visualize this group action is through its schreyer graph which looks like the one shown on the slide here and this graph is made by taking all the elliptic curves in your set x as the nodes and then between two curves you draw an edge for each ideal in your set of generators l1 through ln that connects these two curves right so the colors here represent the different generators l1 through ln and then from each curve you have two outgoing edges for each color and that represents the action of l and l inverse so in a sense you can really interpret this secret key group operation as a random walk on this graph which maybe gives some intuition why this is potentially secure okay so in this slide i'm showing all the notation used in this talk um it's just here for reference so feel free to pause the video if you want to have a look at it i'm gonna skip it now cool so with the preliminaries out of the way we can finally start thinking about the actual problem that we were trying to solve um so suppose somebody just hands us a curve in the seaside graph for instance um and we're told or guaranteed that this curve has an irrational anamorphism of some prime degree l so irrational just means it's not defined over fp and we're asking ourselves the question where in the esogenous graph can this curve be can we somehow just learn something about a based on this knowledge that uh it has this anamorphism um so looking at a picture um this circle represents for example one of these esogenous cycles in the shari graph picture and uh yeah so here the situation is that a connects e0 to e and we're trying to figure out what a is given e0 and e and knowledge about this anamorphism of e so the first helpful fact to reason about this picture is to notice that it has at least in some cases and we're just going to consider these cases for now a certain symmetry namely it was already pointed out in the initial seaside paper that um in the special case that p is 3 mod 4 and you use this very specific curve um y squared equals x cubed plus x as your starting curve then um taking the quadratic twist of one of these curves in the graph basically means you're inverting the class group element that took you there from e0 so for short twisting means inverting the class group element that's a good rule of thumb to keep in mind and uh that alone doesn't tell you much yet but the second more crucial observation is that if you additionally assume and that's not always true but let's assume for now that um this anamorphism anticommutes with Frobenius then you can actually make an fp rational isogeny from e to its quadratic twist from that anamorphism by just composing with the isomorphism from e to its quadratic twist right so that that isomorphism is also not defined over fp but the composition of these two maps is defined over fp and the reason is basically that the isomorphism to the quadratic twist negates Frobenius so if before composing with this isomorphism the anamorphism was anticommutative with Frobenius afterwards it will be it will commute with Frobenius and that means it's an fp rational isogeny so basically knowing that this tau exists and assuming these extra conditions that I've just added on this slide tells you that there must be an edge from e to its quadratic twist in the L isogeny graph and that must come from the action of an ideal of norm l so I've just added this to the picture and now if we look at this picture very carefully we can see that the composition of a and a again and then in the middle this bit is just the green arrow labeled l plus or minus one well it's the entire circle right so we can just solve the equation arising from this picture and it's a quadratic equation and it tells you pretty much exactly what a squared is so we just observe that just knowing that this curve has this kind of special anamorphism that satisfies all these conditions on the last slide already allows you to learn a whole lot about the secret element a in fact it's defined up to the two tours in the class group and of course there's still a computational question of being able to compute the square root but let's get to that later for now the question is is this just a weird special case does this only happen for that very specific choice of parameters on the previous slide and well the answer is no so basically we're going to spend most of the rest of the talk on removing all of these conditions that I added on the last slide and just for brevity we'll quickly introduce the word twisting anamorphism for an anamorphism that anti-commutes with Frobenius all right so on this slide I've basically compiled our to-do list of questions that arise from this very special example that we've seen and so of course the very first question is can we even compute a when we're given a square can we compute square roots in the class group and it's not that obvious how to do this the next question is once we can compute a square root is it clear that there's not too many square roots like for all we know there could be so many square roots that you know it basically doesn't tell us anything about a so we need to somehow bound the size of the two torsion of this of this class group then the question is when are anamorphisms twisting is this very common can we expect this to happen do they even exist another question is well we've seen that this example worked partially because this very special starting curve E0 was right in the middle of of this isogeny cycle so it was basically on the axis of reflection of this twisting symmetry and so can we somehow generalize this idea to starting curves that aren't their own twist and finally can we generalize all of this to primes that aren't 3 mod 4 the first problem on the list is how to compute squares in the class group and the good news is that first of all gauss knew how to do this 222 years ago and it turns out that his method from back then is actually polynomial time now so that's pretty good if you happen to know the class number of this ring and it's odd then of course there's an easier way like in any group but computing the class number takes exponential time so this is much less efficient in general how many square roots are there so it's known that you can only get elements of order two in the class group at primes dividing the discriminant of the number field and in this case the discriminant is either minus p or minus 4p depending on the value of p modulo 4 so the only potentially bad prime devices are p and 2 let's have a look at what these give us for p dividing the discriminant well we just get the ideal generated by Frobenius but that's a principal ideal so it doesn't correspond to a non-trivial element of the class group for two dividing the discriminant we indeed get a non-principle ideal dividing two so this corresponds to an actual non-trivial element of the two torsion and the bottom line is that well the two torsion of the class group is either just the trivial group when p is 3 mod 4 or it's esomorphic to z mod 2 when p is 1 mod 4 and therefore a square element of the class group has either one or two square roots depending on what p mod 4 is and with this we finish discussing the first two points of our to-do list let's talk about twisting anamorphisms so recall that our goal was to locate reduced cm curves in the esogenous graph the question is how common is it for an anamorphism that comes from reducing a cm curve to be a twisting anamorphism to answer this question we got the following theorem that basically says well if the cm that this curve has is by an anamorphism of prime degree l that's smaller than about p quarters then the reduction is guaranteed to be a twisting anamorphism so yes in principle there is a restriction but for cryptographic purposes p is so massive that you can't even write down these curves for a larger l so I dare say practically speaking reduced cm anamorphisms are always twisting for the case we care about moreover if they aren't it's typically easy to find a twisting anamorphism if you're given just any irrational anamorphism this depends a bit on how these things are represented and some details but as a rule of thumb this is usually doable so we've got ourselves another check mark on the to-do list so if the starting curve is not as nice meaning it's not exactly in the middle of this picture right on the axis of reflection then it has a non-trivial quadratic twist somewhere else in the graph and this twist must be connected to the starting curve by some ideal class b as shown in the picture and then if we fill in the ural scenario that we're considering of an elliptic curve that has a twisting anamorphism of degree l we get a similar picture as before except that there's an extra twist of e in the picture and this is ideal class b but basically there's no reason why we can't still solve for this missing part a and if you write down the equation it looks just like before except with a little extra b stuck in there so basically this is no issue at all so yeah of course we can deal with starting curves that aren't their own twist the last question on the list is what if p is 1 mod 4 instead of 3 and the good news is that we've basically already dealt with all the issues that arise in this case while going through the other items on the list namely well if p is 1 mod 4 then the class group order is even so you get 2 instead of 1 square roots and there is no curve that sits right in the middle of this picture so there's no curve that's its own quadratic twist but everything else basically works the same it's just that this element of order 2 gives you an additional symmetry in this picture and you can actually sort of visualize it like this and if you stare at this picture for long enough it becomes kind of clear why this picture is not enough to distinguish which side of this circle you're on so that's why just using equations based on this picture you cannot distinguish how many copies of t there are in your secret ideal to figure out which square root is right you can either just try both and see which one works or there's actually a much much nicer solution which is in a recent e-print paper and that one breaks DDH for the case p is 1 mod 4 for this group action essentially by looking at this two torrent component and seeing if the defilement pairs are consistent with the with the two torrent parts and this can also be used to figure out which of these two choices is right in our scenario so that's our last check mark on the to-do list and we've essentially generalized this very special example from the beginning to a complete theory of what's going on here so based on all this stuff that we've just discussed we came up with the main theorem of our paper it structurally looks like this i'm not showing all the details but you can read up in our paper so basically for this cm reduction scenario where you take a cm curve and you are used in modulo p to get a super single elliptic curve we tell you exactly how many curves over fp there are that are reductions of these curves which combinations of fp and nomorphism ring and reduced cm ring are possible and finally and that's perhaps the most important thing cryptographically speaking where exactly in the esogenous graph all of these curves are so we tell you exactly how to get there from the special starting curve and it's important to point out that we formulate this theorem only for p equals 3 mod 4 because that's the interesting case for a c-side but similar results are most likely possible for p equals 1 mod 4 it's just that we didn't work it out exactly and didn't write it down okay so just in case the previous discussion seemed a bit abstract and detached from reality i'm going to show an example that shows just how explicit our methods are so in the c-side 512 parameter set it's actually true that p equals 11 mod 12 which means that this curve written down here y squared equals x cube plus 1 is also super singular because p is 2 mod 3 so where is it and well we figure out exactly where in the graph it is and how to get there from the starting curve chosen in the c-side 512 parameter set and this basically shows that you cannot possibly hope to use that curve as a non-vector publicly chosen random curve in the graph that nobody knows the secret key to on this last slide i want to talk about something that is actually a significant chunk of our paper but obviously it was impossible to present everything in this talk so i'll just give a short summary and i encourage you to have a look at the paper if you're interested so in the esoterany literature there's a thing known as the KL-PT algorithm named after coelater pt and tinol and what this algorithm does is well given a super singular elliptic curve defined over fp squared and given its entire anamorphism ring in some sufficiently explicit computationally useful representation you can use this to find an esoterany from some specific fixed curve zero to that curve e in polynomial time um however a priori usually this esoterany is not defined over fp and there's not really a reason for it to be so this doesn't really break c-side even if you reveal the entire anamorphism ring so the question is maybe we can actually reveal anamorphisms except those that are twisting because of course according to the earlier contents of this talk those break the scheme and our paper also addresses this question by basically giving an analog of the KL-PT algorithm for curves defined over fp so the scenario is you're given an elliptic curve defined over fp that's super singular and you're given its entire anamorphism ring so that's over the algebraic closure and then we output an ideal that connects that curve to some fixed starting curve in polynomial time there's one caveat here namely turning this into an actual esoterany still takes sub exponential time because well the output this ideal that is output here is not particularly nice and as i mentioned earlier when describing c-side evaluating a general ideal on a curve takes super polynomial time however we also resolve the obvious question that comes from this namely can you do better can you maybe do this in polynomial time and output a smooth ideal but we prove that this would imply that you can compute discrete logarithms in the class group of this imaginary quadratic field and i mean fundamentally there's no reason why this shouldn't be possible but it seems quite unlikely that this is just easy to do because people have thought about this problem all right that's the end of the presentation thanks for making it this far and enjoy the rest of the virtual conference


From theCUBE Studios in Palo Alto in Boston, bringing you data-driven insights from theCUBE and ETR. This is Breaking Analysis with Dave Vellante. After a two-year epic run in tech, 2022 has been an epically bad year. Through yesterday, the NASDAQ composite is down 30%. The S&P 500 is off 21% and the Dow Jones industrial average 16% down, and the poor hodlers of Bitcoin have had to endure a nearly 60% decline year to date. But judging by the attendance and enthusiasm, it made major in-person tech events this spring. You'd never know that tech was in the tank. Moreover, walking around the streets of Las Vegas, where most tech conferences are held these days, one can't help but notice that the good folks of Main Street don't seem the least bit concerned that the economy is headed for a recession. Hello and welcome to this week's Wikibon Cube Insights, powered by ETR. In this Breaking Analysis, we'll share our main takeaways from the first half of 2022 and talk about the outlook for tech going forward and why, despite some pretty concerning headwinds, we remain sanguine about tech generally, but especially enterprise tech. Look, here's the bumper sticker on why many folks are really bearish at the moment. Of course, inflation is high. Other than last year, the previous inflation high this century was in July of 2008, it was 5.6%. Inflation has proven to be very, very hard to tame. You got gas at $7 a gallon, energy prices, they're not gonna suddenly drop. Interest rates are climbing, which will eventually damage housing. It's gonna have that ripple effect, no doubt. We're seeing layoffs at companies like Tesla and the crypto names are also trimming staff. Workers, however, are still in short supply, so wages are going up. Companies in retail are really struggling with the right inventory and they can't even accurately guide on their earnings. We've seen a version of this movie before. Now, as it pertains to tech, Crawford Del Prett, who's the CEO of IDC, explained this on the Cube this very week. And I thought he did a really good job. He said the following. I think, Matt, you have a great statistic that 80% of companies used COVID as their point to pivot into digital transformation and to invest in a different way. And so what we saw now is that tech is now where I think companies need to focus. They need to invest in tech, they need to make people more productive with tech, and it played out in the numbers. Now, so this year, what's fascinating is we're looking at two vastly different markets. We got gasoline at $7 a gallon. We've got that affecting food prices. Interesting fund fact recently, it now costs over $1,000 to fill an 18-wheeler. All right, based on, I mean, this just kind of can't continue. Do you think about it? Don't put the boat in the water. Yeah, yeah, yeah, good luck if you do it. If you, yeah, exactly. So a family has kind of this bag of money, right? And that bag of money goes up by maybe 3, 4% every year depending upon earnings. So that is sort of sloshing around. So if food and fuel and rent is taking up more, gadgets and consumer tech are not, you're gonna use that iPhone a little longer. You're gonna use that Android phone a little longer. You're gonna use that TV a little longer. So consumer tech is getting crushed. You know, really, it's very, and you saw it immediately in ad spending. You've seen it in Metta, you've seen it in Facebook. Consumer tech is doing very, it's tough. Enterprise tech, we haven't been in the office for two and a half years. We haven't upgraded whether that be campus Wi-Fi, whether that be servers, whether that be commercial PCs as much as we would have. So enterprise tech, we're seeing double digit order rates. We're seeing strong, strong demand. We have combined that with a component shortage. And you're seeing some enterprise companies with a quarter of backlog.  At higher prices, which also- And therefore that drives, that drives their price. And this is a theme that we've heard this year at major tech events. They've really come roaring back. Last year, the Cube had a huge presence at AWS re-invent, the first re-invent since 2019. It was really well attended. Now this was before the effects of the Omicron variant, before they were really well understood. In the first quarter of 2022, things were pretty quiet as far as tech events go. But the Cube has been really busy this spring and early into the summer. We did 12 physical events as we're showing here in the slide, Coupa, we did women in data science at Stanford, it was Coupa Inspire, it was in Las Vegas. Now these are both smaller events, but they were well attended and beat expectations. San Francisco summit, the AWS San Francisco summit was a bit off, frankly, because of the COVID concerns, they were on the rise that then we hit Dell Tech World, which was packed, it had probably around 7,000 attendees. Now, DockerCon was virtual, but we decided to include it here because it was a huge global event with watch parties and many, many tens of thousands of people attending. Now the Red Hat summit was really interesting, the choice that Red Hat made this year. It was purposefully scaled down and turned into a smaller VIP event in Boston at the Western, a couple of thousand people only. It was very intimate with a much larger virtual presence. Veeamon was very well attended, not as large as previous Veeamon events, but again, beat expectations. CubeCon and CloudNativeCon was really successful in Spain, Valencia Spain and PagerDuty Summit was again a smaller intimate event in San Francisco. And then MongoDB World was at the new Javits Center and really well attended over the three day period. There were lots of developers there, lots of business people, lots of ecosystem partners. And then the Snowflake Summit in Las Vegas, it was the most vibrant from the standpoint of the ecosystem with nearly 10,000 attendees. And I'll come back to that in a moment. Amazon Remars is the Amazon AI robotic event. It's smaller, but very, very cool, a lot of innovation. And just last week, we were at HPE Discover. They had around 8,000 people attending, which was really good. I've been to over a dozen HPE or HPE Discover events within Europe and the United States over the past decade. And this was by far the most vibrant, a lot of action. HPE had a little spring in its step because the company's much more focused now, but people was really well attended and people are excited to be there, not only to be back at physical events, but also to hear about some of the new innovations that are coming and HPE is a long way to go in terms of building out that ecosystem, but it's starting to form. So we saw that last week. So tech events are back, but they are smaller. And of course now our virtual overlay, they're hybrid. And just to give you some context, the Cube did, as I said, 12 physical events in the first half of 2022. Just to compare that in 2019 through June of that year, we had done 35 physical events, yeah, 35. And what's perhaps more interesting is we had our largest first half ever in our 12 year history because we're doing so much hybrid and virtual to complement the physical. So that's the new format is Cube plus digital or sometimes just digital, but that's really what's happening in our business. So I think it's a reflection of what's happening in the broader tech community. So everyone's still trying to figure that out, but it's clear that events are back and there's no replacing face to face or as I like to say, belly to belly, because deals are done at physical events. All these events we've been to, the salespeople are so excited, they're saying, we're closing business. Pipelines coming out of these events are much stronger than they are out of the virtual events, but the post virtual event continues to deliver that long tail effect.  The bottom line is hybrid is the new model. Okay, let's look at some of the big themes that we've taken away from the first half of 2022. Now, of course, this is all happening under the umbrella of digital transformation. I'm not gonna talk about that too much. You've had plenty of DX Kool-Aid injected into your veins over the last 27 months, but one of the first observations I'll share is that the so-called big data ecosystem that was forming during the hoop and around the Hadoop infrastructure days and years, then remember it dispersed, right? When the cloud came in and kind of, you know, not wiped out, but definitely dampened the Hadoop enthusiasm on-prem, the ecosystem dispersed, but now it's reforming. There are large pockets that are obviously seen in the various clouds, and we definitely see an ecosystem forming around MongoDB and the open source community gathering in the Databricks ecosystem, but the most notable momentum is within the Snowflake ecosystem. Snowflake is moving fast to win the day in the data ecosystem. They're providing a single platform that's bringing different data types together, live data from systems of record, systems of engagement together with so-called systems of insight. These are converging, and while others, notably Oracle, are architecting for this new reality, Snowflake is leading with the ecosystem momentum. And a new stack is emerging that comprises cloud infrastructure at the bottom layer, data, a PAS layer for AppDev, and is enabling an ecosystem of partners to build data products and data services that can be monetized. That's the key, that's the top of the stack. So let's dig into that further in a moment, but you're seeing machine intelligence and data being driven into applications and the data and application stacks that are coming together to support the acceleration of physical and to digital. It's happening right before our eyes in every industry. We're also seeing the evolution of cloud. It started with the classification of the enterprise where organizations realized that they didn't have to run their own software on-prem and it made sense to move to SaaS for CRM or HR, certainly email and collaboration and certain parts of ERP. And early IS was really about getting out of the data center infrastructure management business, call that cloud 1.0, and then 2.0 was really about changing the operating model. And now we're seeing that operating models spilt into on-prem workloads. Finally, you know, we're talking about here about initiatives like HPE's GreenLake, which we heard a lot about last week at Discover and Dell's Apex, which we heard about in May in Las Vegas. You know, John Furrier had a really interesting observation that basically this is HPE's and Dell's version of Outposts. And I found that interesting because Outpost was kind of a wake-up call in 2018 to in a shot across the bow at the legacy enterprise infrastructure players. And they initially responded with, you know, these flexible financial schemes, but finally we're seeing real platforms emerge. Again, we saw this at Discover and at Dell Tech World, early implementations of the cloud operating model on-prem. I mean, honestly, we're seeing things like consoles and billing similar to AWS circa 2014, but players like Dell and HPE, they have a distinct advantage with respect to their customer bases, their service organizations, their very large portfolios, especially in the case of Dell, and the fact that they have more mature stacks and know how to run mission critical enterprise applications on-prem. So John's comment was quite interesting that these firms are basically building their own version of Outposts. Outposts obviously came into their wheelhouse and now they've finally responded. And this is setting up cloud 3.0 or super cloud, as we like to call it, an abstraction layer that sits above the clouds that serves as a unifying experience across a continuum of on-prem, across clouds, whether it's AWS, Azure or Google, and out to both the near and far edge, near edge being a Lowe's or a Home Depot, but far edge could be space. And, you know, that edge, again, is fragmented. You've got the examples like the retail stores at the near edge, outer space maybe is the far edge. And IoT devices is perhaps the tiny edge. No one really knows how the tiny edge is going to play out, but it's pretty clear that it's not going to comprise traditional x86 systems with a cool name tossed out to the edge, rather it's likely going to require a new low cost, low power, high performance architecture, most likely ARM-based that will enable things like real-time AI inferencing at that edge. Now we've talked about this a lot on breaking analysis, so I'm not going to double click on it, but suffice to say that it's very possible that new innovations are going to emerge from the tiny edge that could really disrupt the enterprise in terms of price performance. Okay, two other quick observations. One is that data protection is becoming a much closer cohort to the security stack where data immutability and air gaps and fast recovery are increasingly becoming a fundamental component of a security strategy to combat ransomware and recover from other potential hacks or disasters. And I got to say, from our observation, Veeam is leading the pack here. It's now claiming the number one revenue spot in a statistical dead heat with Adele's data protection business, that's according to Veeam, according to IDC. And so that space continues to be of interest. And finally, Broadcom's acquisition of Adele, it's going to have ripple effects throughout the enterprise technology business. And there, of course, there are a lot of questions that remain, but the one other thing that John Furrier and I were discussing last night, John looked at me and said, Dave, imagine if Veeamware runs better on Broadcom components and OEMs that use Broadcom run Veeamware better. Maybe Broadcom doesn't even have to raise prices on Veeamware licenses. Maybe they'll just raise prices on the OEMs and let them raise prices to the end customer. Interesting thought, I think because, you know, Broadcom is so P&L focused that it's probably not going to be the prevailing model, but we'll see what happens to some of the strategic products, projects rather like Monterey and Capitola and Thunder. We've talked a lot about Project Monterey and the others, you know, we'll see if they can make the cut. You know, that's one of the big concerns because it's how OEMs like the ones that are building their versions of outposts are going to compete with the cloud vendors, namely AWS in the future. Okay, I want to come back to the comment on the data stack for a moment that we were talking about earlier. We talked about how the big data ecosystem that was once coalescing around Hadoop dispersed. Well, the data value chain is, it's reforming and we think it looks something like this picture where cloud infrastructure lives at the bottom. We've said many times that cloud is expanding and evolving and if companies like Dell and HPE can truly build a super cloud infrastructure experience, then they will be in a position to capture more of the data value. If not, then it's going to go to the cloud players and there's a live data layer that is increasingly being converged into platforms that not only simplify the movement and ELT-ing of data, but also allow organizations to compress the time to value. Now there's a layer above that that we sometimes call it the super pass layer, if you will, that must comprise open source tooling. Partners are going to write applications and leverage platform APIs and build data products and services that can be monetized at the top of the stack. So when you observe the battle for the data future, it's unlikely that any one company is going to be able to do this all on their own, which is why I often joke that the 2020s version of a sweaty Steve bomber running around the stage screaming developers, developers, developers and getting the whole audience into it is now about ecosystem, ecosystem, ecosystem, because when you need to fill gaps and accelerate features and provide optionality, that list of capabilities on the left-hand side of this chart, that's going to come from a variety of different companies and places. We're talking about catalogs and AI tools and data science capabilities, data quality, governance tools. And it should be of no surprise to followers of breaking analysis that on the right-hand side of this chart we're including the four principles of data mesh, which of course were popularized by Jamak Tagani. So decentralized data ownership, data as products, self-serve platform and automated or computational governance. Now whether this vision becomes a reality via a proprietary platform like Snowflake or somehow is replicated by open source remains to be seen. My history generally shows that a de facto standard for more complex problems like this is often going to emerge prior to an open source alternative. And that would be where I would place my best, although even that proprietary platform has to include open source optionality, but it's not a winner take all market. There's plenty of room for multiple players and ecosystem innovators, but winner will definitely take more in my opinion. Okay, let's close with some ETR data that looks at some of those major platform plays who talk a lot about digital transformation and kind of world changing impactful missions and they have the resources really to compete. This is an X, Y graphic. It's a view that we often show. It's got net score on the vertical axis. That's a measure of spending momentum and overlap or presence in the ETR survey. That red, that's the horizontal axis. The red dotted line at 40% indicates that the platform is among the highest in terms of spending velocity, which is why I always point out how impressive that makes AWS and Azure, because not only are they large on the horizontal axis, the spending momentum on those two platforms rivals, even that of Snowflake, which continues to lead all players on the vertical axis. Now, while Google has momentum given its goals and resources, it's well behind the two leaders. We've added service now in Salesforce, two platform names that have become the next great software companies, joining lights of Oracle, which we show here and SAP, not shown, along with IBM, you can see them on this chart. We've also plotted MongoDB, which we think has real momentum as a company generally, but also with Atlas, it's managed cloud databases as a service specifically and Red Hat with trying to become the standard for app dev in Kubernetes environments, which is the hottest trend right now in application development and application modernization. Everybody's doing something with Kubernetes. And of course, Red Hat with OpenShift wants to make that a better experience than do it yourself. The DIY brings a lot more complexity. And finally, we've got HPE and Dell, both of which we've talked about pretty extensively here and VMware and Cisco. Now, Cisco is executing on its portfolio strategy. It's got a lot of diverse components to its company and it's coming at the cloud, of course, from a networking and security perspective that's their position of strength. And VMware is a staple of the enterprise. Yes, there's some uncertainty with regards to the Broadcom acquisition, but one thing is clear, vSphere isn't going anywhere. It's entrenched and will continue to run lots of IT for years to come because it's the best platform on the planet. Now, of course, these are just some of the players in the mix. We expect that numerous non-traditional technology companies, this is important to emerge as new cloud players. We've put a lot of emphasis on the data ecosystem because to us, that's really gonna be the main spring of digital, i.e. a digital company is a data company. And that means an ecosystem of data partners that can advance outcomes like better healthcare, faster drug discovery, less fraud, cleaner energy, autonomous vehicles that are safer, smarter, more efficient grids and factories, better government and a virtually endless litany of societal improvements that can be addressed. And these companies will be building innovations on top of cloud platforms and creating their own super clouds, if you will. And they'll come from non-traditional places, industries, finance that take their data, their software, their tooling, bring them to their customers and run them on various clouds. Okay, that's it for today. Thanks to Alex Meyerson who is on production and does the podcast for breaking analysis. Kristen Martin and Cheryl Knight, they helped get the word out and Rob Hoth is our editor-in-chief over at SiliconANGLE who helps edit our posts. Remember, all these episodes are available as podcasts wherever you listen. All you gotta do is search, breaking analysis podcasts. I publish each week on wikibon.com and siliconangle.com. You can email me directly david.volante at siliconangle.com or DM me at dvolante or comment on my LinkedIn posts and please do check out etr.ai for the best survey data in the enterprise tech business. This is Dave Vellante for theCUBE Insights powered by ETR. Thanks for watching, be well and we'll see you next time on breaking analysis.


Hey, this is Brett with Summit Automotive in Fond du Lac, Wisconsin. You're new and use Jeep and Jeep Wrangler headquarters today. I'm excited to go over the 2020 Jeep Wrangler Unlimited Sahara, especially this one in bright white. It's got a lot of cool options on it. This one has a 3.6-liter Pentastar V6 motor with electronic start-stop capabilities on it. It's going to give you 22 highway 19 city miles per gallon for an average of 20. Now we're just going to do a walk around here and then we're going to get up close and go over all the options on this particular Jeep. I can tell you that this one has the premium audio and 8.4 group, the LED lighting group, the color match hard top group, the leather group, I think it's the cold weather group as well, the tow group. So those are just some of the options on this particular Jeep, but we're going to get up close and go over everything on this one. And if you want to check out more pictures of this Jeep in the upper right-hand part of the screen, it's a link right to our website, so click that and check us out there. Comes with the painted and polished aluminum 18-inch rims. You get the granite crystal pockets here. You also get the little Jeep logo on the rim there. Bridgestone Duler All-Terrain 25570R18 tires, and you can see that it definitely does have an all-terrain tread pattern on there. This is a Sahara. You get the LED lighting group, which gives you the LED lights in the fenders. You also get the LED headlamps, the LED ring lighting on the running lights there, as well as the LED fog lamps, and I got those turned on so you can see just how nice and bright all of those are. It's a really nice option on these Jeeps. I don't think I'd get it without it. You get the silver finish on the grille inserts as well as the headlight bezels and around the fog light bezels there. You get the tow hooks up front, color match fenders. You do get the digital Jeep still climbing up the side of your window, and if you can see them, here they're kind of hard to see. There's little sandal impressions on that plastic piece there. You also get the Torx 50 nomenclature there showing you which Torx wrench to use to take those doors off on the bottom. You get the factory running boards standard on the Sahara package. We'll take a quick look at the window sticker, the original window sticker. I'm going to go kind of quick, but feel free to pause it, pause the video so that you can see it. If you want to check out this window sticker on our website in the upper right-hand part of the screen is a link right to our website, so click that and check us out there. You can see it has the leather trim seats for $14.95, cold weather group $9.95 total, and heavy duty electrical group $7.95, LED lighting group $1045, 8.4 and premium audio group is a $16.95 option, automatic 8-speed transmission is $2,000 option, the 3.6 liter is a $12.50 option, the color match hardtop is a $21.95 option, for a total of $51.60 on the MSRP, and you can see those highway miles per gallon, and the front crash ratings are at four star and rollovers at three, and the other two are not rated. So we're going to take a look at that interior in just a little bit more depth and a little bit here, but first we're going to do the final, the rest of the walk around up close, the color match hardtop, both the back and the front pieces are color matched, you get the LED lighting group back here. So those tail lamps are LEDs as well as the license plate lights there. You have the backup camera right here, matching spare tire and rim. These rear doors are a lot lighter now, they open a lot smoother than the old JKs, if you've ever had JK you know they can kind of be clunky sometimes. This is your case for your front hardtop pieces, you get the alpine subwoofer back here, I like that they put them on the side now, so that you still get all the storage space underneath and it's quite a bit of storage space underneath here. You also have your tool kit for removing that hardtop and everything else as well as a hitch cover that comes with it. You can see they color match those bars back here. You also have three bolts on the bottom and one on the top, four on each side to get that back hardtop piece off, two quick disconnects for your windshield washer fluid and your electrical and they store right here on that piece, which is nice, they used to be like flopping around on the JKs, you didn't know really where to put them, but now they solved that problem. The back doors like I said are a lot lighter now and you can see they got the JL badge right back here and it tells you the four door, two door, overall wheel base and overall length as well as water 40 and all that cool stuff right there, but they still work exactly how the old ones did, how the back glass flips up and the door swings open.  You get the Sahara stitching on the back rest here and I wanted to pull this up so I can show you that they do have airbags standard on the side airbags now. These still are manual forward and back seats, but they also have your seat height adjuster and lumbar, factory floor mats throughout, auto headlamps, power mirrors, power locks, tilt and telescopic steering wheel, which is new for the JL. You get the seven inch LCD display, digital speedometer, outside temp, compass display as well. You get the heated leather wrap steering wheel, cruise controls on the right, Bluetooth and information center controls on the left, audio controls on the back of the steering wheel. This one has the 8.4 touch screen radio. This is the 4C radio with the factory navigation. So why that's important is that a navigation system gives you serious XM guardian service for one year. It also gives you serious traffic and serious travel link for five years when you get this radio. So even though that's a sixteen hundred ninety five dollar option, it's really giving you a lot from serious XM as far as traffic alerts and weather alerts and stuff like that on the radio, which is really cool in addition to having the factory navigation, which you get to keep forever. So you do get that factory navigation. You can also do your climate controls here. You get AM, FM and serious XM radio capabilities. You can do your heated seats, heated steering wheel buttons here. And then my favorite part about the new JL's is the backup camera and how crystal clear that backup camera is. I mean, that is just, you know, everybody used to rag on the Wranglers because they didn't have backup cameras. Well, now they got like the best backup cameras. They're super clear. You have the dynamic grid lines, that middle line lines right up with your receiver hitch. And it's just a really great backup camera on these vehicles. Now, if you don't like using all the settings up here, you can can use all the ones down here. Also, this one has Android Auto and Apple CarPlay capabilities so you can project your cell phone to the screen. So you don't like using this navigation. You can use Google Maps or like Waze. A lot of people use Waze, which is a really cool map app. If you haven't checked it out, check it out.  You have your start-stop capabilities, stability control, downhill assist control. You can do all your climate stuff here, as well as your heated seats and heated steering wheel. You got your power windows, AUGS USB, USB-C hookups. Four auxiliary switches, part of that tow and electrical group. You got your four by four shifter on the floor there and the eight speed automatic transmission. You get that little Jeep logo on there as well. Quickly, we're going to show the key fob nice and bulky. I like it. It's a flip out and it has remote start. The hard top pieces in front here come off very similar to the old JKs, except there's no screw-ins right there. But they come off pretty much exactly the same. You get SOS and assist buttons up there and your home link buttons for your garage door security systems and lighting systems. Also, the auto dimming mirror. And we're going to take a quick look at the back seats and then do one more quick walk around on the Jeep. So back seats, a lot more room on the JLs than JKs. You also have this latch child safety systems back here. Two USBs, two USB-Cs, 115 volt, 150 watt plug-in. You get the factory floor mats back here as well. And these seats do fold down nice and flat, nice and easy. They don't hit the seats in front like the old JKs did. And these headrests stay down when you're not using them or when it's in the upright position.  We'll take one more quick walk around. I'd personally like to thank you for checking out the video today and hopefully from this HD video, you'll have been able to get a good idea of the overall looks and styling on the Jeep Wrangler JL Sahara package, especially this one in bright white with the LED lighting group. And if you want to see more pictures of this Jeep or one of our other 450 new and used cars, trucks, SUVs, minivans, railways, unit, we got it. So go to our website, www.summodauto.com. If you want to check out more videos, go to youtube.com. Remember to like, subscribe, and share on this video and all the videos that you see there. In fact, in a second, you'll see links to the YouTube channel on your left.


Good morning Jim. Hey folks it's Jim. Good morning Jim. Good morning. A small group today huh? Yeah, so far. Folks usually jump on a little late I think. Yep, we can wait a few more minutes and see if anyone else is joining and get started maybe at five past. Hey Jim, Robert, Kristen, good morning. Good morning. Hey Raj. We'll give folks a couple more minutes and get started at five past. Right. Should we get rolling? Yes, we should. All right. So it looks like the only item we have on the agenda today is to go through the. Policy white paper outline. So we've discussed this in a few prior meetings and. I think the intent was to get to a point where we have an outline and then. We'll transfer the outline into. Or a folder in our get repo where we can kind of collaborate and pick on different sections. So here's what some of us, you know, worked on. We had a breakout session also last week. And came up with in terms of the second of went and cleaned up a few of the things moved. And then we did a lot of work on that. And then we did a bunch of the notes and other kind of place holders into the details section, but then we can revisit. But what the outline looks like at this point. You know, something like this. I think there's about three main sections. And maybe there needs to be one more, which we can talk about. I'll mention what I was thinking of there. It seems like the main sections would be the. So we talked about the cluster components. Container images. Resources resource configurations. The runtime of the cluster components itself.  To see if there's anything that needs to be called out there. And so that's in the policy. I just titled that scope for policy scope. We can sort of change these and get more feedback. Then there was an architecture or a how it works sort of details type of section, right? Which I think Jaya has mostly kind of filled in the major components, which we would be looking at. So there's a definition language, the authoring point, like where are these policies managed and stored. Like upstream get ops repo or some other management play. Or I guess there's a authoring point and a management point. So those are called out separately. There's the enforcement points, which could be, there could be multiple like the CI CD pipeline, as well as admission control and then run time. And then the policy reporting, which we can talk about it for the CRD. And then we have a section on mappings, integrations. And I think I'd seen use cases. Yeah. Use cases is also here. So we can kind of figure out what to put in this and. But maybe before we go to those sections, I think those need to be refined a little bit more. Let's does this general structure and these major areas. Does that seem relatively good to everyone? Any thoughts, feedback? Hello, this is right now. I just joined. Sorry. I was late. I do think we need to expand this mappings and integration section. Detection is important, right? When a policy violation happens. So a subsection under the mappings and integration or a separate chapter on detection of policy violations or changes that are happening. Can be detected from a cyber perspective. I agree. I was wondering, do we need looking at the outline level, Jim? Do we need kind of like a policy life cycle, which would include like the detection of policy violations or policy enforcement? I'm just wondering, is there, is there. Maybe there's an overview. Maybe it's just a sentence. Maybe it's just a, a diagram, but do we kind of need to like enumerate the phases? So, you know, policy definition, policy deployment, policy enforcement, policy violation detection, policy, not violation detection. I went the right word. Success cases. Yeah. Yeah. I mean the policy is. I believe in forest, you know, so monitoring, I guess, is probably a better word. Sorry. So there was some aspect of a life cycle. Dressed maybe. Right. Yeah. So there was some aspect of a life cycle in these, you know, components, but maybe we could, in the architecture, perhaps there's a component section and then there's a life cycle, you know, to show. Both. And then some mappings and integration. Yeah, I'm not sure what exactly the intent of that was. And I don't know to your point, I'm not sure if detection would fit in there or if it should be in the chapter. Right. You lost Jim. Okay. The idea of mapping and integration that we had was that I think when you talk about the life cycle where we entered this section was around, you know, how do you author policies? How do you manage policies, enforce policies all the way to report them? And the question is what do you do after that? Right. And that was the idea behind the mappings and integration. So my recollection was this was more it started about as we were talking about from operational to compliance to what other teams, you know, outside of the Kubernetes domain would want to see. And yeah, that was what we would put in there. Integration is still there as well, right? Every Kubernetes might have some Kubernetes implementations will have Istio mesh, right? Service mesh. And if we don't want to call Istio, that's fine. But some integration of policies because you don't want to have conflicting policies at different layers. So I think mappings and integrations we should specify which all integrations are we focusing on? I mean, from a cyber perspective, these things make sense definitely, but which all integrations are we addressing? Yeah, maybe we need to, we might need to separate those, right? We say mappings to saying, okay, you have the operational policies of the Kubernetes layer. Perhaps you have some Istio policies, other policy objects. What comes above it, right? How do I translate this into compliance and regulatory into that domain? Right. So yeah, maybe we could call out integration separately. We can talk about, you know, things like service mesh. So integrations should be before the mapping stand, right? In terms of hierarchy because detection and saw compliance that should be on the integrated system rather than just the Kubernetes at that point. I don't know. That's my opinion. Yeah, I think the, can you guys hear me? Yes, we can. Yeah. Hi, this is Jaya. I think the mapping and integrations was more focused on things external like Jim was saying to Kubernetes, right? So if you have a customer who is, who has existing tools that they use to manage, you know, compliance or other processes, right, that they have, how do you integrate this architecture into that, right? So, so that was the focus. There is something like service mesh. Yeah, you cut out. We can't hear you anymore. Into the table that you had in the previous document. Yeah, you cut out for a bit. If you could repeat the last sentence, please. We heard something like service mesh and then nothing for a bit. Maybe she can. Right. Okay. Yeah, no, that makes sense. So we just need to understand what, what we want to cover in each section. I think here really the, the goal was, okay, now that we have these policies, we have the reports, the violations, who's going to care about them? And how do we, you know, kind of use them? Right. All right. The fit of detection here. And I think that's, I brought this up. So policy can be a preventative policy, a detective policy or a corrective policy, right? Why specifically just call out detection here? What is the idea? Detection for me is if somebody, something malicious is going on, right? Somebody's maliciously changing a policy, then somebody in the cybersecurity team would want to know, right? My focus is cybersecurity. That's what I'm thinking from that perspective. Okay. Right. I think the, the, the, well, a lot, I mean, you're absolutely right. Most cybersecurity today is. Detective and remediation based, you know, and vulnerability based in particular in a lot of cases, but. Yeah, I think there is an evolution towards. Especially in Kubernetes, you're, you're a state based system, right?  So if you. If you declare your policy correctly, and that's enforced by the infrastructure as code, then you're, you, you in a sense shouldn't have any. Vulnerability is you shouldn't have any violations. I still want to have controls that are reporting compliance. That are reporting policy enforcement, right? Does that make sense? No, I'm not against that. I'm not questioning that. What I'm saying is that the point I'm trying to make is that I see that orthogonal, right? What I mean is irrespective of what policies we have in the life cycle, we talked about from a policy perspective, right? Whether you author it, you enforce it, you can do this, enforce this through three mechanisms, right? You can put that ahead. I mean, we're talking about the CI CD pipeline and that as a use case. For example, that is a preventative type of mechanism, right? At least in most cases, then you can have detective. We have not talked about corrective at all, right? Sort of the GitOps based remediation workflows might. So my question is, should we expand this to our other points to cover these other things? Because if you just call out detection, I'm just trying to understand what does that mean, right? What does that mean for preventative sort of policies and corrective sort of policies? Even a preventative policy could be maliciously changed by an attacker. And that's what we want to detect on as well. So maybe detection of changes to policies, whether they're preventative or detective in runtime, as well as in the. Yes. Yeah, I agree. And I, that's what I meant earlier by drift. I'll clarify that. Yes. Malicious or unintended changes to the policies themselves. I agree. I think that is a concern. Just circle back, Raj. I agree though I myself, how do we express a preventative or corrective policy in the frameworks that we currently have? Like we have admission control. Yeah. But where else, where else can we, I mean, the common set of policies, right? Most things that we have in CIS run as non root are all preventative policies. Right. You can't execute though, you can't execute those containers until unless you have, you adhere to those policies. A detective policy is more typically happens in the action access control, right? Post facto. Maybe we are using different terms here. I'm just, right? I just wanted to call up because when, when you typically read the policy papers on Nest, right? The way that they categorize is along those four buckets. These are the terms they use. And that's why I'm calling them out. You know, I absolutely agree with the terms. I'm literally trying to wrap my brain around like at the Kubernetes level. Because I mean, you know, the goal of this white paper is to kind of get a little bit under the details and drill down into how do you actually implement this? You know, not prescriptively. Here's the code, but, you know, taking it. Would you give an example of a detective policy? A detective policy typically an access control. A termination control is a very classic example of detective policy, right? You have turned the user, the user continues to have role bindings, right? Or super admin access, right? Into a cluster. And you want, you are trying to evaluate if those access are valid. That's an example. The second thing could be, for example, that you have a cluster and you do not have logging enabled on the cluster, right? You don't have stack drivers. You don't have Azure log analytics. So things like this, right? Which is post factor. You're observing this out of band is what do you typically call detective? Yeah, detective policies are more oriented toward runtime, right? Meaning after the already deployed and running and everything, you know, how do you monitor, right? On a non-going basis, right? That is preventive or more like admission control. Exactly. Both are fine. And one comment I have there, Jaya and Raj, is that a great, if we have those detective policies, then we should have, we should identify how those detections are remediated. Is there automation being built around that as well? So I think detection and maybe detective policies can be a subset of the detection itself, right? They're kind of correlated. And then for those detective policies, we can further expand as to what kind of auto remediation can take place in certain cases. I think Jim has done a good job of sort of putting those bullets there as well. Yeah. I'm not disagreeing with what you're saying. I'm just pointing it out. And I think he has sort of added those line items there. Yeah. So one thing I would add to that though is what we're seeing is that really every policy, even a policy which is intended to be enforced, needs detection, because there's always use cases where you want to do the additional runtime scan, right? So I don't think it's such a, you know, concrete categorization in that sense, because as you're rolling out and this goes back to what Robert was saying with versioning and drift. So let's say there's a new CV, now you want to roll out a policy, there's existing workloads. In most cases, you're not going to bring down those existing workloads, but you're going to detect if those violate the new policy, and you're going to take some remediation action which could spend some time. So I think both, it's what we're seeing at least with Toronto policies is you are going to run every policy, even if it's configured to block. It still has a component where it will detect workloads which violate that policy for any reason. Maybe you have bypassed the admission web book, maybe there was an upgrade going on, or maybe it's just a new policy like I described, right? So it seems to me that their detection is always required for every policy. Yeah, yeah, I agree completely. I think also, you know, there may be resources that were created before a policy was put in place. Exactly. That's why you have the gatekeeper, for example, has both admission as well as audit. Correct. New cases, right? So, yeah, that makes sense. And I agree with our other on the remediation aspect, right? I think they're never possible. Obviously, you know, not every policy can auto-remediate, but if there's a way to do it, that's an option that we need to think about. Yeah. And that remediation could also be in a separate system.  So, you know, it looks good. I think maybe perhaps we can combine these two sections. I'm not sure if, you know, they, or we can move life cycle before architecture or, I don't know how we'll have to see how this plays out, but I think these, this covers all the right points. I think so. Okay. So integrations we briefly mentioned things like service mesh. Are those just part of Kubernetes workloads or should be, I mean, I understand it's not an application. It's more of a infrastructure component, but it is in some ways it's a bunch of CRDs, right? So is, do we need to give that special treatment or do we just say, say it's a Kubernetes resource that's covered as part of any resource policy? Like when we're doing configuration security configuration checks. So in addition to config, I mean, so, and apologies, maybe you already have this covered, but when it comes to any of the network things, right, there's the config and then there's what's actually happening and observability. And so, so policy, yep, I might have a config policy. How are you going to assess if there's a violation of that policy or is that not part of this? No, so that we were thinking would be covered in the runtime. Like perfect. Yep. Makes sense. So yeah, you're very right. Like, how do I know if my CNI is even working, right? Cause I may have all the network policies configured, but if my CNI has an issue, yeah, I don't know. Right. So I, yeah, and that, that is slightly more difficult. Those type of things are harder to audit, right? Cause you wouldn't actually need something like Sonaboy or another runtime tool, which is doing behavioral tests to make sure that things are working as expected. Okay. So let's take another quick look at the overall outline. So yeah, I guess the question still is, I mean, we can leave this integrations for now and see if anything comes up, but otherwise we can. Yeah, otherwise we'll see if it collapses into some other section on the use cases. I added configuration security, operational compliance, regulatory compliance and supply chain. Do those seem appropriate or as we're saying, these are use cases for Kubernetes policies. We think we just said run, well, I guess runtime is under operation. And supply chain obviously is very wide, but I think there is a component there. That has to be done in cluster or admission control. So that would be interesting to call out. It would be helpful to at least my mind Jim to be very specific on the use case. So if we are talking about supply chain and the question is, for example, how something like a Solari gate, right? This policy project will help. Or if you're talking about regulatory or maybe not regulatory compliance, if you're talking about a sort of industry compliance, right? Security compliance, something like PC, ADSS or high trust, I think it would be, and then we can obviously expand that to others, right? But I think the more specific we are, the better it is. Right. Yeah. So you're, I think we can, you know, maybe replace this with something like image provenance or whatever is the right component, but ultimately the use case, I guess the higher level use case that we'll be mapping into is supply chain security. Right. I think the goal is to outline here and then we'll volunteers will fill in the specific use case. Right. And then on the mappings, we had incident management, compliance mappings, Oscar and then I think last time we were just started talking about security operation center or SOC and what users there would require. Any other upper upstream mappings that come to mind? Yeah. I think vulnerability management tends to be separate from those items. It may feed into a SOC, but there's often a different team for vulnerability management as well. And SOC is an interesting subject when it comes to container platforms. True. I don't know. The jury is still out. I've had a number of conversations in the industry about SOC for, you know, Kubernetes platforms. SOC teams are at a loss as to what they are supposed to do. So it'll be good if we can address something here. But yeah, I think I've heard similar and isn't it, it's basically they're just using this umbrella term of, oh, that's now DevOps. So they don't know what that means, but they know it means not SOC. Ooh, but that brings up a really good point, right? Because is there a DevSecOps dashboard? You know, it may be a DevOps dashboard and in fact, so where does that live and what does that look like? I think there would be both. So there'd be the DevOps and I'm just going to arbitrarily draw the line like DevOps is getting my stuff into the cluster and it's running. And then from that point, DevSecOps is, you know, maintaining the client's vulnerability. I'm going to strongly disagree because DevOps is supposed to always include security in the pipeline. And the reason people, you know, started using the DevSecOps term is because it keeps getting forgotten. So, so a DevOps pipeline should include security scanners and it should include a security dashboard for managing the results. So it's, if you're doing security only on the ops side of DevOps, you're missing. I completely agree. I'm just recording from the field. Yeah. And I think we need to help change that thinking. And actually most DevOps pipelines I know of include at least vulnerability scanning. Right. Yeah. So I guess the question, and I think we've had this conversation in several forums is, is it the DevOps team that's transforming into a DevSecOps team? Or is it more the central security team that's learning about Kubernetes? And I think we can't. Yeah. And we can't prescribe that. But I think what we can say is that policy information should be part of, you know, policy should be part of DevOps. It should inform DevOps and policy and security. And at least this would be my opinion. It should be included as an external, you know, place we'd want to send, you know, information should be available. Well, I mean, I think that, I mean, to your point, Kirsten, this is our chance to put a line in the sand and say here, recommendations. I will say from, from the government world that I interact with. They're just trying to figure it out. So I don't know that they have, I think they would read this and, you know, and many other white papers, but they would, they would use this, our guidance as what is the best practice.  So there's continuing push. Granted it's hard for organizations to make the shift. And so, you know, I think we just want to include it as, as part of where do we think this information should be, should be provided or support those teams that are actually doing DevSecOps. So we have called that out as our primary audience. So from, you know, from the mappings point of view, I think the way of at least I was thinking of it is everything we're saying is targeted to the DevSecOps team. But then they have to realize that there's these other mappings, including perhaps central security, which needs, you know, periodic reports or some visibility into what's going on in the Kubernetes world, right? At least that seems like the view we have taken here, like we're going from the practitioners out. And when we say, so, so again, so I'm thinking, I guess I'm thinking from the tools angle because that seems to be what the mappings is about. Where is, is the rest of this paper indicate that this information is going to show up in some sort of DevSecOps dashboard? It's, yeah, there's no one single thing you're calling out here. Right. So we're saying because I don't think there are reports, right? Because there isn't really a single DevSecOps dashboard in existence yet, right? Okay. Yeah. So we're talking about reporting. We're talking about metrics somewhere. I believe we had metrics, but maybe that fell off. Would it, would it simplify things if we said reporting, you know, reporting and information should show up in pipelines? Or is that applied above or stated? Yeah. Right. So in the enforcement points and in the life cycle, we do want to call out that of course you can. So policies can be applied in the CI CD pipeline. So that's what we were talking about. We were talking about your out of cluster admission controls. And then runtime is the three enforcement points. So each one could produce reports. Okay. Maybe leave it for now because there isn't right now, but, but so, so the other thing we see right there are security dashboards in AWS. And let me see if I can find an example of one. Okay. Let's, let's leave it for now. Yeah. Yeah, that would be good to call out and see like, you know, give it. So we, we had a discussion on, I think what we decided is we. Could potentially reference projects. Especially CNCF projects, but ideally we'll just stay away from company. Right. Any, any product or even perhaps projects, because things change and once the paper's out, we don't want to kind of look like there's any favorites or anything like that. Right. Yeah. Yeah. Well, and yeah, we could certainly normalize it. But yeah, so, so yeah, let's leave it alone for now. Give it some more thought. Sounds good. Okay. Any, any other ideas or thoughts or things we should cover, which, which is not in this outline so far. I think the outline looks great to me. I'm just excited that we are working going to work on this white paper. And so wondering what the next steps are. Yes. So what we can do is we will, you know, we can formalize this outline or just at least create the sections in a get repo. And we, like we'll just use markdown for authoring. The other thing we could also do is, I don't know. And Robert and I read now, I think both of you. Also, you know, work with six security. So would it, is it too early to kind of get feedback on this outline or should we. We also have a leads meeting on Friday. So I will share this there as well because I give updates on this policy working group. And we can share in the next Wednesday's meeting today. It's kind of too soon to put it on the agenda. But we can start working on this while that is happening. Right. Nothing is stopping us from making progress here. Right. Yeah. And I joined the coup six security meetings. Periodically too. And I'm, there's, there's work on a white paper planned there that's more, you know, more directly security focused. So I think, I think this is a good time to share. Yeah. I don't know if that, I had proposed that, you know, security policies was the white paper that you were going to work on. Okay. Does it make sense to do a separate security policy document or you can. You know what security and this is out, right? I'd have to go back and take a look at the, the outline that was proposed in the coup security. So I think it's a good idea to, to, to, to talk about the security side. My sense was it was fairly different from this, but, and, and I could see there being a need for differences. So, but it's, so all the more reason to share, right? I would. It sounds like we're, we all drift in and out of those same, same meetings. Like the, the, the RBAC, the admission control. Configuration of the cluster, managing certs. I mean, yeah, kind of a lower level, I think, than, than what's here. But, but obviously if you have a different recollection. Yeah. Yeah. A, a, you know, either, either way, if we share the outline, it'll generate a good conversation. Right. Yeah. And it may be good to get if there's somebody from each, and I know like a lot of folks on this call are also in those forums. So as long as we make sure there's coordination, I think that that would be great. So I will take the action to review this and this security next week and then bring any feedback from there on. But if we want to start making progress, I'm good with that. Yeah. Let me know which sections I can work on. Okay. Sounds good. Yeah. So we can, the next thing I can do is I'll set up the good structure and at least, you know, we'll have the, the various directories for the, the, and the markdown files. And then we can figure out who wants to work on what.  I know you're talking about the CNCF. Sick security, right? Right. I'm talking. I was going to ask that. Okay. That's why I put coob in front of mine. Yeah. So the coob sick security team was looking at a white paper. And I'm less aware of the CNCF security. Yeah. In my mind, I mean, this isn't like the defined admission. But I kind of think of the, the CNCF sick security is kind of like the overarching, like all things cloud native. Right. We're kind of at the middle ground of, you know, policy applied to Kubernetes and related stuff. And then the coob security is super focused on, you know, almost at the API layer. That's at least how I organize it in my brain. So when I go to the various meetings, I kind of know where my, the context is. Okay. Yeah, no, it makes sense. I think that matches at least my way of thinking too. And I think there's certainly each one is a very large area. All right. I didn't have anything else on the agenda. And unless someone else has any other topics to discuss, we can break early then for today and I'll, you know, set this up and get and send out something on Slack. I think that's great. Thank you very much. Thank you. Thanks everyone. Bye. Bye. Thanks.


Okay, hello friends. It is time to unwrap another book for wrapped up. Episode six of one and we say it's time to unwrap another one. So we're like halfway through doing this now. I'm going to do this up to 10 episodes. These are the books we have left. Um, how are we feeling? Nervous? So so far we've had five episodes. Three were books that I had been the most excited to read. Two were books I was least excited to read. So this is kind of like a decider for whether the rest of the series could go. I'm feeling nervous. Do we just open one? Oh my god. Okay, okay, okay, we're gonna read another book. Are we all ready? I've, I cannot tell you the level of dread and fear and horribleness I feel when I'm drafting one of these books. It's like my whole fate is in my hand. Well not in my hand. Okay. Are we ready? I want a short book. So I'm feeling drawn towards like okay I'm gonna go for this one. This red one down here. Are you sure? Do I look as if I'm not sure? This is what we're going for. This is what we're going for. I'm not gonna, I'm not gonna doubt myself. Okay, I'm not gonna doubt myself. Oh, what's this gonna do with actually a vlog in a time? This is gonna be interesting. Okay, we have got The Anthropocene Reviewed by John Green. Interesting. Okay, so we've got The Anthropocene Reviewed by John Green. So this is a non-fiction book. I don't think I've ever had a non-fiction book enrapt up. I've gone to a whole vlog on just my thoughts on non-fiction books. Are they gonna be really interesting or not interesting? But I have been so excited to read this. I wanted to read this so badly. I think this was one of the ones I was most excited to read. So it's just like thoughts and ideas about different aspects in life. I guess it's all just about humanity. Oh my god, I'm actually quite excited for this. This is like, I've been craving a bit more non-fiction. So I'm actually really glad that this has come up. Okay. Okay, so yeah, we're gonna read this. It's not very long. It's I think about 300 pages under 300 pages. And I'm intrigued. I've heard good things. I've heard not so good things. But I'm excited to see what I think of it. And I'll just take you along with me reading a non-fiction. I've never done a vlog for a non-fiction book design. But this will be interesting. We can chat a lot about different ideas because it's, I think, full of different ideas about so many different things. We can chat about lots of them. Okay, I'm actually excited for this. I'm feeling happy. Okay, good job, wrapped up. Good morning. It's not morning. It's like four o'clock. I just woke up from a nap. I'm feeling very sleepy. I didn't sleep for long last night. And I had pretty bad sleep. And I just, I fell asleep for 20 minutes after I finished reading the conference section. So I am, I read like the first 90 pages. I love the cover of this. I just think the colors like the pink, purple, and orange, they do something to me. I love it. I love it. And it gives me that buzz. Anyway, so I, I'm the first 90 pages in and I'm really enjoying myself. Listen, I'm feeling nerdy. I always activate my inner nerd. I love this kind of non-fiction. So let me tell you kind of, you can kind of guess what it's about. But basically it's just a series of essays from John Green about the human experience and our life and our world.  So like he's giving everything a rating out of five. And as someone who's like my whole life is reviewing for you, that's what would, it's a bit inception-y because that's what I'm doing right now. I'm going to give this a certain number of stars. I don't know, it's just interesting to think about the nature of reviewing. And he talks a bit in the kind of introduction about like the history of reviewing. And I'm like, huh, much to think about. You know a non-fiction book like cuts a little bit close to I am. But yeah, so these sections, I'll tell you actually what each, after each check-in, I'll tell you what the sections I've read from are so far. So I should have been rating these individually. I haven't. But anyways, the first one was about Your Never Walk Alone, which is Liverpool's song. Then we have Humanity's Temporal Range, Haley's Comet, Our Capacity for Wonder, the, I don't have to pronounce that, Cave Paintings, Per Cave with Cave Paintings, Scratch and Sniff Stickers, Diet Doctor Pepper, Velociraptors, Canada Geese, Teddy Bears, The Hall of Presidents, Air Conditioning, Staff, I just heard him pronounce it on the audiobook, can I come out? Staffelococcus aurorius? I don't know, the, the bacteria and the internet and the ones I've read so far. And I'm just really enjoying it. I love this kind of, I don't know, non-fiction where it's about history, it's about humanity, it's about pop culture. I am preferring the ones that are more either historiography based or like pop culture, like the type Doctor Pepper one was interesting. More than like science. I'm not a science brain, okay? I was always a humanities brain. I'm not a science brain. And so although the stuff is still super interesting, I don't know, it's not as like, it doesn't light my, my brain on fire as much as some of the other sections. John Green trying to get me interested in the science sections. There's science and scientific proof. It's biology. Any book that just has this like knowledge, I love like, I love meaningless facts. Any book that has this kind of knowledge about humanity and just like these little interesting tidbits, I'm finding so fun to read. I love learning about stuff. I don't know, I haven't been, I used to love school, okay? I don't know if I spoke to you about this but I was like top of class, whatever.  But I loved learning and I miss learning. I miss the feeling of, I don't think I consume as much information in my life as I used to. You know, I don't read, I want to read more non-fiction. I really do. I've been really hankering for it lately because I read a lot of fiction and you still learn from that. But there's just something about someone telling you these most like mundane facts that I am just vibing with. I'm really enjoying it. So yeah, I need to pop out to the shop to run some errands and then I'm gonna cook dinner. It's my night. I'm gonna make some chilli for everyone. So I'm hoping, I've got the audiobook. John Green narrates it and I am really enjoying listening to it via the audiobook. I'm listening to it a bit slower than I would typically with an audiobook. I often do it with non-fiction just to take everything in and just like, I don't feel, I don't feel like I process it as quickly with as much appreciation if I listen to it faster. So yeah, I'm hoping that whilst I cook dinner I will get through most of the next sections. Hopefully I'll check in with you again tonight. Yeah, I'm really enjoying it. Also, I was out again early on different errands and I got back and there was an Amazon parcel for me and I opened it thinking I'd ordered something. But it was a package from Sophie with My Best Friend's Exorcism and Fangs, which is a graphic novel, oh my god, about like a vampire. I am just so thankful. Thank you Sophie. It was like a little cheer me up for the day. These are two of the books that I have probably almost bought the most in person. Like there's been numerous times where I've been in Waterstones or I remember I was in Forbidden Planet with this. I'm looking at them and like I picked them up and add them to the stack and then I put them back and I keep thinking about them. Like I should have got that. So thank you so much Sophie. I'm so, this is like my kind of horror. I feel like me and Grady Hendricks are vibing. I'm very excited to read more of his stuff and then this just looks like such a cute little graphic novel. So thank you so much. Anyways, I'm running late. I'm gonna go and I'll see you in a bit with more thoughts on what more I read from John Green. Anyways, bye. I've just, I don't even know what I'm gonna say to you. I've just sat down and started filming. I have formulated exactly zero thoughts. So I'm now about 180 pages through the Anthropocene Reviews and I'm still really enjoying it. Apologies. I was gonna film B-roll of me cooking last night but um, I was so tired.  That was what yesterday was for me. I was like, listen Megan, just cook. I got so close not cooking so I just had to bin off the filming B-roll. I got quickly yeeted out of the agenda. Yeah, hey the Anthropocene Reviewed. I'm really enjoying it. Let's talk about the sections that I have just read. So we have read the last section Academic Decathlon, Sunsets, Jersey Dudeks Performance on May 25th 2005, Penguins of Madagascar, Pigly Wiggly, the Nathan's Famous Hot Dog Eating Contest, CNN, Harvey, The Yips, Old Lang Syne, Googling Strangers, Indianapolis, Kentucky Bluegrass, the Indianapolis 500. Then there was one on mortification that was on the audiobook. We're not in the book, I don't know why. And then Monopoly. So those are the ones I've read and I've just been loving it. Again, I'm loving this mix of all these different topics. Like I love Wiggly Pigly, you know, Pigly Wiggly, sorry. Sorry. Good God, get a grip girl. That's about like the first day of a supermarket and how that was invented. And just like, you have no idea how this information lights up a certain part of my brain. I just find it so interesting. There's also a lot about football. John Green is a football fan, like a soccer, if you're American, a soccer fan. And I love football. And it's so interesting hearing all these, I love, I love when a book gets like nerdy about something you don't expect it to get nerdy about. Like I didn't know John Green was such a football fan. I am so into it. And I think I heard some criticism of this a while ago. I don't know from who. I think I saw it in Goodreads or something that, you know, John Green in this book is very open about his mental health. And the book is written in the midst of COVID and like especially at the beginning. And you can tell that he is struggling mentally. And I've heard some of you say that that is like difficult for them to read, or they don't enjoy reading from that perspective as much. You know, they say that they find it depressing, or they find themselves sometimes, you know, slipping into certain thought patterns that maybe he's accepting. I don't think it's not like over, but you can tell that it's perhaps written at a time when he's struggling. But from my perspective, my view, it reminds me a lot of when I read stuff by Matt Hague as well, who's very open about his depression and struggles with mental health. And it's when you're reading from someone who has experienced that depth of like feeling to the lowest point, or through dark points, I feel like, and I feel like this for myself when I'd gone through hard stuff is in the highs when you're coming out of that, or it allows you a perspective on the highs that seem even higher. I don't know how to explain it without, I don't know if I'm saying the right thing. There's something in this book that through him recognizing his difficulties of mental health, he's also able to see the beauty in so much in our world, in our lives that I think if someone's perhaps on autopilot, or everything's fine, you don't realize like you search those highs out and recognize them more than other people would in this. And I don't know, I'm just, I am enjoying reading that and seeing with him as we read the beauty in so much in community in, I don't know, I don't know.  That's the idea is like, at the end of every review, he's like, he's giving some stuff, five stars, he's giving some stuff one star. So he also talks about stuff that sucks, but I'm coming out of it with a really, I don't know, positive outlook on life and humanity in our world. I don't know, I'm really enjoying it. So I'm just gonna go ahead and finish it. I'll see you in like an hour and a half, maybe with my final thoughts because yeah, I don't know, just the pop culture, the way we look at the world, I don't know, I'm really, really enjoying it. So I'll see you in a bit with my final thoughts. Spirit of the Book, I give the Anthropocene reviewed four stars. I just finished it, I had a great time reading it. I was thinking like, you know, I had a great time. It's a four star though. Do you have anything bad to say about it? Not necessarily, but it wasn't a five star. It is uplifting and hopeful and joyful about the world while also making you kind of this feeling of dread about different aspects of the world. I feel like it balances those two really, really well. Oh, I haven't told you what section this last, last part was. So we had Super Mario Kart, Bonneville Salt Flats, Circle Drawings, Whispering, Viral Miniatus, Plague, Rentry Mix, The Hot Dogs of, can't pronounce that, it was like a Finnish, Finnish name, The Notes App, The Mountain Goats, The Quirty Keyboard, The World's Largest Ball of Paint, Sycamore Trees, New Partner, Three Farmers on Their Way to the Dance, Postscript. There was like also two, two other chapters in this section that were on the audiobook that went on the physical. I don't know why. I don't know why. I loved it. I had a great time reading it. It was fascinating, it was interesting. I'm so glad that wrapped up made me finally read this because it was a great time. Actually, now that I can think of it, perhaps the one reason that it is a four star and not a five is I think he mentioned this at the beginning is that it didn't feel like this book was like where this information was originally intended to be. I think this started off, a lot of the chapters were originally like podcasts and what have you. And it didn't feel like this book was like, I don't know how to describe this, but he had this idea for the book and he's super passionate about the book and that's why the book has been created. It felt like this is kind of like a pandemic project, piecing stuff together that had already existed somewhat. And I didn't feel like the book was like its own driving force and its own right. It's like a product of other things. Does that make sense? So I think I could feel that a little bit throughout the book and that's why it's maybe not a five. But I really enjoyed it. It was super fun reading from John Green again. I read all his fiction books in Ozhonga and then more recently I read Turtles all the way down. I didn't like it. But I obviously I loved his books in Ozhonga when I was like 13, you know, everyone loves a good old John Green when they're 13. It was fun reading from him again and his perspective and his ideas and reading non-fiction from him for the first time. I could pick up a lot on references and stuff. He talks a lot about God in this. Well not a lot, but you know, it mentions God a few times and his kind of attitude towards God and religion. And it reminded me of when me and my mum read The Fort and Our Stars. We spoke a lot about kind of the God and religious imagery in that book. So it was just interesting reading non-fiction from his perspective. So yeah, wrapped up I would say, well successful. I'm really happy that he got me to finally read this book because this is the kind of book I could put off forever. So yeah, I hope you enjoyed this vlog. Yes, it was a bit different because I was reading a non-fiction and I think it's harder to do, especially a short non-fictionist. It's only like 270 pages and to do three check-ins for that, you know, it's a lot. I hope you enjoyed the vlog. Let me know what you thought of this if you read it down below. Let me know if you're interested and thank you guys so much for watching. As we get closer to the end of this wrapped up edition, I'm very excited because I'm going to tell you now, can't hold it any longer. Episode 10, the final episode of this wrapped up for risk edition is going to be really fun. I'm really excited for episode 10. So it'll be normal episodes up until then and then that one will be a bit different. Anyways, I love you. I'll see you soon and I hope you have a good rest of your day. Bye!