Tea and Anarchy with Alice Goldfuss and Ian Coldwater

Alice: [00:00:00] I think it’s supposed to be bad manners to just be like, lol, your shit’s broken.

Bridget: It’s time for Arrested DevOps, the podcast that helps you achieve understanding, develop good practices, and operate your team and organization for maximum DevOps awesomeness. I’m Bridget Kromhout. We have a great show for you today, all about team building. IT, anarchy, ranting about the intersection of computers and security. But first, a word from our sponsors. The worst thing about the Arrested DevOps podcast is when it ends. You’re left wondering what to do next. What are you going to listen to on your commute home? How do you occupy your time when walking the dog? What are you going to listen to during the quarterly all-hands meeting? But fear not, dear listener. There is a solution. You need to subscribe to Software Defined Talk right now. It’s a weekly podcast that recaps all the news in cloud computing, DevOps, and enterprise software. The hosts, Cote, Matt Ray, and Brandon Wichard, will keep you up to date on all things cloud while offering tips on how to optimize your Costco haul and how to PowerPoint. It’s a fun, free-flowing conversation that will keep you entertained, and informed. What are you waiting for? Subscribe to the podcast today by visiting softwaredefinedtalk.com or by searching for Software Defined Talk in your favorite podcast app.

[00:01:29] Joining us today, 2 awesome guests. First, welcome to Ian Coldwater. Ian, what should our listeners know about you, honking, containers, etc.?

Ian: Hi, my name is Ian. I am not actually a goose. I live in Minneapolis, Minnesota, as does our lovely host, Bridget, and I specialize in hacking and hardening containers, Kubernetes, and cloud-native infrastructure.

Bridget: You’re gonna have to tell us exactly what cloud-native is.

Ian: Okay.

Bridget: But, but we are lucky enough to have 2 guests today. Our other guest is Alice Goldfuss. Alice, what should listeners know about your perspective, whether it be the most delicious tea or anything about how terrible computers are?

Alice: Oh, I like to combine tea and computers by spilling one onto the other. Hi, my name is Alice Goldfuss. I have a background in site reliability engineering, systems programming, software engineering, network engineering, and shitposting on Twitter, and I’m located in Portland, Oregon. So great to be back.

Bridget: [00:02:40] Fantastic. Okay, so we’re calling this episode Tea and Anarchy. And we are talking about containers, whether they be those that hold tea or other— tea or bits. And you’ve both given talks about and have a lot of depth in container security. So my first question, and I guess I’ll first throw it to Ian, is what should our listeners focus on if they’re trying to improve their security posture, especially around containers?

Ian: Important thing to understand about container security is that container security has to be thought of holistically, because containers share resources with each other and with the hosts that they run on. Really, your containers are as secure as your stack is, as your silicon, as your operating system, as your kernel, as what’s running on your containers. You don’t just want to look at one part of that individually. You want to make sure that you’re using defense in depth, to make sure that all of the parts of that system are as secure as you can make them.

Bridget: [00:03:47] Yeah, I know that Alice looks at the entire stack and operating system, etc., kernel, all of that. Alice, what should we be afraid of specifically or in general?

Alice: Specifically to containers, I have never had the pleasure of working on a container team where we had a specific person dealing with security. I think that’s true for most places. Security is always an unfortunate afterthought. It’s a checkbox you want right before you’re about to ship. I’ve talked to people who say they switched to containers because they want security. That is usually the conversation I’m having with people, where they’re like, oh, yeah, well, we need to separate things, or, we want customers to run arbitrary code on our servers, so we’ll put them in containers. Containers, and then they’ll be contained. They specifically choose containers for a security reason. But then, when I talk to security people, they go, well, containers aren’t— if the box itself is insecure, the containers will also be insecure, possibly even more so because you’ve got more ports open and more ways of ingress. I think we should be scared of false prophets and marketing supplies, and people watching Docker 101 talks and then back and putting their VP suit back on and going, you know what we need? Containers. They contain things like mayonnaise, and that is all we need to prevent rot. So that would be my general approach. If you are choosing containers for security, you need an expert like Ian on your side, and you need to listen to them. You don’t just have to consult them and then throw everything they say out the window. You have to actually implement what they’re what they’re telling you to do.

Ian: [00:05:36] This is a very important point.

Bridget: Well, and when we’re, when we’re talking about expertise, I have heard that people can look it up because your name is on it or there’s honking or something. You want to kind of fill us in on what’s going on with all these CVEs? First of all, what’s a CVE? Because I will tell you legit, I had to Google exactly what the acronym stood for again, like this year, because I kept forgetting. So what is a CVE and why should we be terribly afraid of the ones you recently had something to do with?

Ian: CVE stands for Common Vulnerability Exposure, and basically what it is, is it is a taxonomy where if somebody finds a vulnerability, then they submit it to the CVE Numbering Authority and then The— this is an extremely coloring with crayons way to explain this. And then it gets assigned a number and then that vulnerability is then CVE-2020, for example, 15157. And then you can look up the number and that is then connected to that vulnerability in this large database of numbers. The problem with these numbers is that they are often not terribly human readable or memorable, which is why people tend to give their vulnerabilities names for maximum memorability. Different people have different feelings about this. I recently got my first credited CVE, which was in fact CVE-2021-5157, which was a group effort with my hacker crew SigHank. It was a credential leak vulnerability in containerd 1.2.x, and it was a fun bug to find and get to go through the process with. Once upon a time, I told somebody to look up CVE-2019-11253, and that was a billion last attack CVE on Kubernetes that some friends published an exploit POC for that sent honks and in fact honked Kubernetes to death.

Bridget: [00:07:49] All right, so, Alice, say you’re advising someone as to what to do when they see that Ian has done some honking, and they’ve published a CVE, and it’s all terrifying. What should someone do when there’s a CVE?

Alice: When you find a CVE, and hopefully, you have a company with at least one dedicated security person who is paying attention to these things, because otherwise, you find out about them on Twitter, which is where I find out about them. You go, oh, there’s a vulnerability in a specific version of some application, like Kubernetes or containerd. Hmm, are we running that version? And then you have to find out. And sometimes that is difficult because sometimes you don’t have a one-stop shop, like an inventory of all the software versions you’re running across your fleet. So if you don’t have that, step number 1 is getting that. But hopefully you have one place where you can look. And if you are running that version, you need to come up with a mitigation plan. And that comes into play with noting the severity of the CVE. What is, what is the likelihood of that CVE happening on your fleet? For example, is it just everywhere? Is it just a full kernel? If you start the service, is it instantly vulnerable, or does someone have to do cartwheels on top of a server rack to make it possible? Is this like an Ocean’s Eleven CVE? Also, how vulnerable are you? How much of your infrastructure is affected? If you just have 2 old hosts that are running this version, then that is a very easy fix, but if it’s the main stable version you’re running, that’s another story. You use these things to calculate the possible severity and then how long it would take to mitigate. You put a timer on it, like, this needs to be mitigated within the next 24 hours, the next week, the next month, whatever. Then it is usually up to some sort of operations infrastructure, SRE team, whatever you want to call them, kitchen sink DevOps, to mitigate it by rolling out the patch. Typically, once a CVE is announced— CVEs aren’t announced, and Ian can correct me on this, unless a patch has already been in the works. I think it’s supposed to be bad manners to just be like, lol, your shit’s broken. We’ll be coming for you now, without having a proposed fix in place. So, typically, if a CVE is announced, you can expect a patch very shortly if one is not already posted, and then you need to come up with a plan for upgrading your stuff. But it can be gnarly if you’re running on an older version and the patch is only on very new versions. It could have all sorts of unexpected consequences and interactions in your system, and you can come up with You can cause your system to go down by trying to make it better, which is one of the reasons why having an operations or an infrastructure team that is always trying to do rolling restarts and upgrade your systems to keep them secure is best practice.

Bridget: [00:10:47] Yeah, absolutely. I think that what you alluded to, that Ian and company are hopefully not just dropping a zero-day and saying, lol. What does that disclosure process look like, Ian? I know that there’s always going to be a different answer, but in general or in the specific of the CVE you just were participating in, what does responsible disclosure look like?

Ian: Responsible disclosure and what that means is a matter of some debate, but what the disclosure process itself can look like is hopefully it goes well and if you find a bug, you talk to, you know, you write to security at, you know, whatever, and somebody who is responsive answers and says, oh, thank you for helping us find this bug, let’s try to figure out a mitigation plan. And then you file for a CVE through the maintainers, who then decide the severity, as Alice alluded to, according to likelihood, exposure, impact, that kind of thing. And then the CVE numbering authority assigns it, and ideally, you know, you come up with a timeline for disclosure and what that looks like and what the patch is going to look like, and then you work together and it’s all friendly and good. In this case, it was, and it was good. Occasionally, and this is part of why responsible disclosure is a matter of some debate, if somebody comes to a vendor with a bug, then in fact they will not be very nice to that person at all, and they will you know, say that they’re going to sue them because they found a bug in their software, and that is not how that ought to be done. And if you are a company who thinks that that is good behavior, it is not good behavior, and that is how you get 0-days dropped on Twitter on you. But ideally, security researchers are there to try to help you, and certainly if they’re coming to tell you about the bug that they found, they are clearly acting in good faith, and that is evidence that they are acting in good faith, because if they weren’t acting in good faith, they would just sell it or drop it on Twitter. So assuming that the researcher is acting in good faith, working with the researcher to help figure out, you know, what that timeline and everything could be, get the details about the vulnerability from them is the way to go. But yeah, the answer is it can look any number of ways. Sometimes it can look better than others. Ideally, it looks good.

Alice: [00:13:11] If you are like starting a company or perhaps you are listening to this podcast and you are not like like fully in the tech space, quote unquote, you might be more adjacent. If you get an email from someone saying, hey, I found this vulnerability on your website, do not respond, you’re a criminal, you’re going to jail, I’m gonna find you, this is illegal, how dare you. That person is trying to help you. Unless the email continues, and you must pay me $100,000 or I’m going to release your webcam footage, or what have you. Like, person, if someone is just reporting an issue, they, they could have done many other horrible things. They are trying to be a good person here. They are trying to help you out. Do not threaten them with, with, with the criminal activity and putting them in jail. That is not the right way to approach this.

Ian: And it sounds wild, but it happens all the time.

Alice: It does.

Bridget: And that’s ridiculous. It’s like, hi neighbor, your window’s unlocked. Why you?

Alice: [00:14:13] Exactly. And but you see it all the time. You see people saying, uh, I might have found something on this platform. Are they cool? Can I tell them about it? I don’t want to get in trouble. What is the right way to do this? Because people can just go off the rails in their reactions. Wow.

Bridget: All right. So the CVE space, very interesting. And this is— we’re just talking right now about vulnerabilities that come to light in software, but as we all know, computers are sadness and there is a great deal that lies beneath. And, uh, Alice, I think you have some insights into all of the stuff below the software, like, say, kernels or anything like that. Uh, what kinds of things should people look out for when they are intersecting with their computers well below the application software or even the operating system?

Alice: The whole hodgepodge as well. First of all, the kernel is software and it has the, the same openness to vulnerabilities as anything else, although I will say it has been around long enough and has a very well-entrenched maintainership that they are usually pretty well on the ball on getting patches out, and operations teams are usually very used to patching kernels and interacting with those mailing lists, so that’s good. Hardware also has its own undercurrent of things. As we were talking about CVEs, I was thinking about one of my favorite CVEs, not one that I had discovered, but one that I had been on the receiving end of, which was that several years ago, one of the leap second days, there was an announcement put out by F5, literally 2, maybe 3 hours before the leap second was to occur, that, oh, hmm, turns out that some versions of F5 load balancers have a vulnerability that will be triggered by this leap second, so you have basically no time to upgrade your load balancer tier before your systems possibly go down. That was fantastic. I don’t remember if that was at the software or the hardware layer because F5 does both, but I do know that that was a bummer. I got to interrupt an important meeting with a bunch of execs to be like, problem. It can happen all over the place. People will introduce vulnerabilities at the hardware level. This is getting into sort of like, I don’t know, advanced security, nation-state activity, spyware stuff, but there’s certainly the, what is it, the hotel maid move, the idea that you take your laptop to a hotel, to a foreign country or some sort of hostile environment, and the quote unquote hotel maid can come in while you’re gone and put some sort of tracking device in your laptop. I know companies that do, or security researchers that have done scans of their computers before and after leaving China and being like, hmm, that is a new thing inside my machine. So, I mean, vulnerabilities can definitely be taken advantage of and exploits can be introduced at the hardware levels in all sorts of ways.

Bridget: [00:17:20] So, that actually, speaking of the possible nation-state actors and, you know, dramatic happenings in our world writ large, That makes me think, all right, we are here on the internets talking about computers. Hopefully no one will want to come inspect our computers because we were talking about computers, but we all have to balance the public speaking work that we do, the public-facing, you know, informing people of things they should know with the quite reasonable, you know, having our own goddamn life that is not for public consumption. I’m just kind of curious in terms of whether it’s, um, like where you draw those boundaries. And I’ll say, like, for example, I post lots of pictures on the internet. I don’t worry about location tagging because honestly I only go to like 2 places, like our garden and our home. And our garden and our home. I post lots of pictures on the internet. Um, I am related to other humans other than Joe. I don’t post pictures of them on the internet. I don’t post pictures of their houses on the internet. Things like that. You both spend a lot of time making sure the internet hears things it needs to hear, and yet you also live your own lives that presumably don’t all occur inside the computer. And I’m wondering, how does that balance look for you? What would you recommend to people that they might want to consider? Alice, your thoughts.

Alice: [00:18:57] So I am pretty involved in sort of a physical safety mindset. I’ve written an article about this in Increment Magazine a few years back. I am very— I’m very cognizant of sharing my location and where I’m physically located. I don’t do location tagging, much like you, Bridget. Uh, there’s, there’s the idea of like, oh, if you’re gonna go out to a restaurant in the before times, you’re gonna go out to a restaurant, you don’t share you’re at the restaurant while you’re at the restaurant. You may share it, you know, hours after you leave, but you don’t want people showing up there.

Bridget: Um, in fact, it has happened.

Alice: Yeah, has happened. I think I just saw people. Yes, something I try to tell people, uh, if I’m making friends for the first time and they slowly learn about all of the habits I have. I have to stress that I learned these behaviors through experiences happening to me. I have had experience, I have, you know, crossing the street to get home, being stopped in the middle of the street by someone who recognized me online, sitting next to people in a restaurant who recognized me online, going into a restaurant with friends and being stopped by someone who recognized me online, and then my favorite one, of course, is the anonymous valentine in one of the Portland newspapers. And it just got to the point where I was like, you know, I really need to lock down where I am, where I live. And so I don’t post about where I live. People know the general area, Portland, Oregon. I mean, I run a local DevOps meetup here. You can’t really avoid knowing that I’m in the area. But I am a protected voter in Oregon, which you can do by filling out a form and justifying why you need to be protected. Oregon has, in my opinion, pretty insecure voter registration, and so it’s pretty easy to see someone’s voter registration information, including their address, but I’m protected. You can’t find me. And the things that I share on Twitter, I find it really interesting. Well, I will talk about having anxiety or fears or, you know, specific things I’m working on, but I don’t share the names of my partners, or at least I haven’t in the past, and I, yeah, I don’t I don’t post a lot of family stuff, and it is, there’s an interesting boundary there. Currently, I’m not sharing where I work on Twitter, because establishing a boundary there has been very good for me mentally. I currently get no benefit out of sharing where I work, and in the past it has hurt me, both from the public point of view and from my company point of view. So yeah, I do draw that line in the sand. And really try to enforce the parasocial relationship boundaries whenever possible to keep myself safe.

Bridget: [00:21:44] I like that, the idea of finding the right boundaries for you. Like, I post about work all the time, and that’s one of the main things I post about because that works for me. But it’s also beneficial for me since I’m working in an open source space where being able to use Twitter to inform people of updates on projects is one of the main uses I have for it. But it’s interesting what you mentioned about people not really understanding that while they may not see you on their TV, they do see you on one of the devices that they’re doomscrolling on. And that doesn’t mean that you’re their friend and that they should approach you in public and decide you are their friend. And that’s kind of one of those rough things is like back in the before times when there were events, people would come up to me and they would know me and I wouldn’t know them. And I would still be nice to them, but like, that assumption of familiarity is something that you always have to navigate because it’s like, of course I am friendly, but it does not mean that we are in fact BFFs.

Alice: Yeah, one of the boundaries I used to have and hopefully will have again is, yeah, approach me at events. That’s why I’m there. I’m there to meet people. I am there in, you know, event mode. But don’t approach me at a restaurant. Don’t approach me when I’m crossing the street or when I’m clearly out with my friends or something like that. That’s different. That did result in kind of an additional odd thing where sometimes on Twitter people would just tag me and be like, saw Alice Goldfuss today, did not say hi, good job me. Hey.

Bridget: [00:23:14] Did I tell you about the time someone tweeted while I was on a plane that I was on their flight?

Ian: I spent the whole flight being like, who is this person behind me?

Alice: They’re like, on a flight, saw Bridget Crumb.

Ian: I’m like, why?

Alice: And also, why didn’t you say something to me instead of just tweeting from my flight so that I’m kind of like, what is happening? Back when I had my DMs open on Twitter, I was riding the bus to work one morning and I got a DM from someone who was like, hey, we’re on the same bus. And I was like, what the hell? And I don’t remember them having like a photo in their avatars. I’m just like looking around the bus being like, where’s the anime girl who’s DMing me? Oh, what do you think, Ian?

Bridget: What do you think of all this?

Ian: I mean, everybody has to have their own threat model and, and figure that out for themselves and figure out what they feel comfortable with and what they don’t feel comfortable with. And that’s going to be different for everybody, you know. Like, like for me, like, I do historically tell people where I work. I will tell people where I work again. Um, I’m not currently because I’m currently between jobs, but, um, but, you know, everybody gets to, to figure out for themselves what makes sense for their life and for for whatever their personal threat model and comfort levels are. At some point, in terms of being recognized in public, I had a single week in which one of the dads— hello, if you’re listening to this— at my kid’s karate class announced that he followed me on Twitter after the tournament. The guy who was working at the bodega at the counter announced that he followed me on Twitter and actually pointed to me and was like, that girl’s famous on Twitter! I follow her! I recognize that person! And I was like, I’ve never wanted so badly to sink into the floor. I was like, look, she’s internet famous, I see her! Like, oh my God. And I think something else happened that weekend. It was like, at some point I was like, okay, I either need to like go out like with like giant sunglasses on and like, you know, or I need to just know that that’s gonna be a thing that’s gonna happen that I can’t necessarily control. ’Cause like you can’t predict that really. And then I was just like, I’m just gonna know that I’m kind of being watched, sort of, and that it is gonna be kind of weird, and then I’m gonna be visible, and that’s gonna be okay. And that, like, it means that I have better table manners if I’m on an airplane than I used to. It’s just how it is. And sometimes people are creepy, and I appreciate it when people aren’t creepy. And I think, I imagine for some people it can be hard to figure out where that line is, but I would say if you are somebody who is trying to figure out where that line is, err on the side of not being creepy. So if you aren’t sure, probably don’t do it. And if you, if you know for a fact that you’re being creepy, maybe stop.

Alice: [00:25:56] If you know you’re being creepy, maybe stop is a good adage for everyone on the internet. Yeah, I will say that that sensation of constantly being watched and like always having to be on your best behavior, I actually found it’s very It has paid off in a work setting because it is like trial by fire. I am pretty good at minding my words and presenting a certain front and understanding the impact I have on other people. And it has afforded me a certain maturity in situations that I’ve like not been trained on. I’ve been trained through the internet abuse. But I have found that to be helpful in like communicating in a professional setting with people. So thanks, Twitter.

Bridget: Oh, so to sum up, there is not one right way to do, uh, personal security, just like there isn’t necessarily a right way to do all of the computer security. But defense in depth in general, probably a good idea, and general awareness. You mentioned, uh, earlier, uh, Alice, you mentioned inventory. And I laughed a little because I thought, oh, I remember a startup I worked at where we had, in the process of being acquired, we had to go check what all the licenses were on every single module and library everybody chose to use for some random front-end thing. Oh my goodness. Basically, if you don’t know what you have out there, whether it’s personal data or something in your computer, It might make you sad. You should probably know what it is. Take the time. Go find out. So, all right. So I’m gonna change the subject to a lighter note because, Alice, you’ve written blog posts about this. You have a lot of depth here. And I’m wondering if you can answer a very key, important, crucial question. What is the most delicious tea? Show your work.

Alice: [00:27:55] That is an unfair— that is a trick question! My whiteboard is not prepared for that. I mean, it depends on what you like. I do get people asking me for tea recommendations, and it depends on what you currently like. And I really appreciate more people getting into tea. In fact, I read an article, I believe it was in Tea Time magazine, which I do have a subscription to, that said especially in quarantine times, more people are drinking tea. It’s like a comfort thing. And also, we had a really bad season. A lot of harvests, a lot of crops did not come through due to weather. So tea prices actually skyrocketed in some ways. But there are more people getting into tea. And so I guess just in general, if you are like a coffee drinker who’s coming to tea for the first time, you probably like a lot of strong flavors. You might want to try a smoked tea like a Lapsang Souchong or something really bold and malty like an Assam, like an Irish breakfast. Those are usually like the good starters for people like that. If you like something more fruity, while there are flavored teas that have fruit notes in them, I would recommend trying like an oolong. Oolongs are known for being very delicate, and there are oolongs that have fruity flavors to them where you think they’ve been flavored with oranges or something, but they aren’t. It’s just the leaves. And if you’re someone that doesn’t have much of a sweet tooth, you like more savory things, I would suggest a green tea, like a Japanese green, like a sencha, a Fukamushi sencha to start because it is steamed a little bit more, so it has a rounder flavor to it and it’s a much easier drinker for like the first time you’re getting into it. But I don’t know, some of the teas that I particularly liked was like I had a Weishan Bao Zhong last year that had this delicious citrusy toasty notes to it that was absolutely delicious. And I currently have a Dan Cong oolong, which literally like tastes and smells like, like some sort of fruity dessert, like currants. And that is a delicious tea to have as well. So like, I am, I am for all teas. It just depends on my mood. I definitely encourage people to try drinking tea because it’s a lovely habit to get into, a lovely social thing to do.

Bridget: [00:30:19] I’ve had some of those teas and others I’m going to have to try. How about you, Ian? Have you tried some of these teas or are you like, tea, definitely iced?

Ian: Tea is good. I’m not a big tea snob, but I have friends who are, and I appreciate it when I get to come over to their houses and they get to feed me good tea.

Bridget: I am looking forward to the future in which we can hang out and enjoy more tea.

Alice: Yeah, I missed those outings.

Bridget: Ian, it occurred to me when I was prepping for this podcast that I can’t even remember the goose origin story. Like, did it come from that game or that shirt, or where exactly did this legend begin?

Ian: Uh, the goose thing came from a video game called Untitled Goose Game, uh, which came out about a year ago, and, uh, Totally independently, I got excited about that game because it was just fun to run around and honk at people and cause trouble. I thought that it was kind of a good allegory for being a hacker or being a pentester, because the goose in this game sees a lot of seemingly innocuous everyday objects and then chains them together in order to exploit them to achieve its own ends. Independently of this, a couple of folks involved in organizing the Kubernetes Contributor Summit Last year at KubeCon, went and created a whole CTF that was goose-themed. I made my keynote about that. They made the CTF about that. It involved using GitOps to make a particular stuffed goose who was sitting somewhere in the Contributor Summit honk. Then, we all figured out together that we were doing this independently, and then it became a thing. Now, lots of Kubernetes people honk at each other. And that is a thing that we do because that is the noise that the goose and the goat make.

Bridget: [00:32:16] I love it. Oh, so we are almost at the end of our time. And I wanted to kind of wrap up with— we’ve, we’ve talked about and alluded to this, our apocalypse of 2020, what we’re all living through. And I kind of keep coming back to like, How do we make it better? What is our— or tolerable, um, on the, on the macro or on the micro scale for ourselves, for the society around us? Uh, I would say I’ll start and say I am trying very hard to elevate, elevate the voices of people who aren’t me so that people who started paying attention to me for computers, lol, can hear a little bit more about social justice, or they can unfollow. I don’t care. But while I have a modicum of their attention, I’m going to use it to broadcast more messages other than, you should probably have some container security, because guess what? I care about more than just having some container security. So that’s kind of what I’m trying to do. It’s a very small thing, but it’s what I’m trying to do in this space. Alice, what’s your thinking about these times and the measures?

Alice: [00:33:38] So I do think it comes to who you can impact, what your bandwidth for impaction is, and the different stages you can do it. Because you can’t sit down and have like heart-to-hearts with every single one of your many thousands of followers. There’s different messages for different levels. Something that I did this year, was kind of by force. I had to change the format of the meetup I run, PDX DevOps. We had always been a group of about 60 people who would meet in person to discuss technology and then occasionally local things, like there is a local gift drive that I do through a Native American Youth and Family Center that we do every year. But this year in particular, I had to ask myself, well, what is important and what does the group actually need, not as a group of technologists, but as a group of people? And so we took it online because we weren’t meeting in person anymore, but then some of the topics that I brought in changed. I had Liz Fong-Jones talk about ethical organization in a company in the wake of the George Floyd protests. I shared resources for how to protest safely, and there were drop-off points locally for distributing food. I had Allison Krug come and talk about stress release, and I’m going to have someone come— Audrey Escher is going to come and talk about emergency preparedness because we were hit by the wildfires, and the wildfires And I’m just really trying to pivot and provide what I can to this admittedly much smaller group of people than my Twitter platform, but it’s, it’s a group where I can have impact and I can help them and get them what they need. And those people also can go to their groups and their companies, and it can be a ripple effect where they can take the resources and the care for people that I’m bringing to the meetup and they can spread that out. So there is impact to be had there, and that is one of the things that I have been doing this year. To support people and help them during these times.

Ian: [00:35:34] I really like this answer because mine is exactly the opposite, actually, which is that I think it’s really important if we are people in tech, or to me personally, as somebody who has access to phenomenal amounts of resources, to be able to take those resources and redistribute them to the folks on the ground who are doing the work. And so I’ve been spending a lot of time as somebody who has access to tech community resources, whether that be literally just money, people who have money, people who know other people who, who have access to different kinds of resources, and taking as much of that as possible and redistributing it to the BIPOC youth who are on the ground here doing really amazing organizing work. And so, as well as just personally showing up on the ground, I’m, you know, trying to take as many resources and funnel them their way and give them access to as much that they might not have access to as I can. And I think that’s really important because we all have neighbors and folks around us who need things, who are doing the work, who could be doing so much more with better access to resources. And if we are people who have that, I’m about passing it on.

Alice: [00:36:55] You’re absolutely right. That’s what we should be doing, redistribution of wealth and resources.

Bridget: On that note, head over to arresteddevops.com/tanarchy for this episode’s show notes. Visit arresteddevops.com/itunes. Leave us a review in the iTunes store if you want to help other people find the podcast. We’re also apparently on Spotify and iHeartRadio, if you know how to do those things. There are so very many computers. Thanks so much to Ian and Alice for joining today.

Ian: Thank you, it’s been a pleasure.

Alice: And this is always a great time.

Bridget: This is Arrested DevOps, and remember, there’s always DevOps in the banana stand.