WEBVTT 00:00.000 --> 00:22.880 So, the last talk of the days from Thomas, the maintainer of Ansio of Rep. A, who is bringing 00:22.880 --> 00:30.400 a cool presentation that explores some of the ideas that we occasionally have, like, what 00:30.400 --> 00:36.080 if, right, those moments that, for instance, what if, fine, for implement, they see back 00:36.080 --> 00:44.160 in, or free PA with the health of AI. And then I don't want to spoil more the presentation 00:44.160 --> 00:48.920 and then I give the microphone to you Thomas, so you're going to start. 00:49.800 --> 01:05.240 Thank you. So, hello, welcome to my talk. So, I didn't prepare an adagangia agenda. We simply 01:05.240 --> 01:11.960 start with the first slide. So, but the question that I was asked, can we use Claude for any AI? Yes? 01:17.000 --> 01:18.600 How do I? 01:23.640 --> 01:32.280 Okay. So, the question that I was asked in, that also I asked myself, is can we use AI in my case Claude? 01:32.280 --> 01:44.200 AI for development. And this talk was showed journey and also some results. So, at first, I tried, 01:44.200 --> 01:51.160 I tried with my project Ansio of PAPA and I thought, okay, it should be possible to do something 01:51.160 --> 01:57.960 like this. So, the first one was, okay, we are still supporting Python 3, Python 2, we need to get rid 01:57.960 --> 02:06.360 of Python 2 at some point. So, try it. Give Claude AI a try. And yeah, the result was very 02:06.360 --> 02:12.040 questionable because after thinking for a long time, it simply removed a lot of empty lines. 02:12.760 --> 02:20.120 So, Ansible test will fail. Python code is not really valid anymore. So, not really good try. 02:21.240 --> 02:27.560 Second try, same problem. So, okay, try something else. We are supporting old IPA 02:27.720 --> 02:35.080 versions. That, for example, for real 8, we are for real 7, but we need to get rid of at some point. 02:35.080 --> 02:43.480 So, we have code that is especially for those versions. There are if blocks in there with if and so on. 02:43.480 --> 02:50.760 So, it should be possible to find them. So, I said, okay, we want to support this IPA version 02:51.560 --> 02:59.800 so do something. Try to fix it. And yes, it did something really unexpected. It simply increased 02:59.800 --> 03:09.320 the minimal version check. So, yeah, somehow it achieved something, but not what I wanted. 03:09.320 --> 03:18.360 So, second try, also not a good result. So, this third one was, okay, we have the free IPA 03:18.360 --> 03:27.240 source code. We know there are topology issues and so give me the topology. And Claude came back 03:27.240 --> 03:32.360 and said, oh yeah, I created you a really long document and you should have sex. 03:32.360 --> 03:37.640 Sick, the six replication agreements. Where have you found that? 03:39.640 --> 03:46.520 Ansible from Claude, the typical answer. It searched again and said, oh yeah, it's for it. Thank you Claude. 03:46.680 --> 03:57.960 So, it was not what I wanted to hear. So, ask myself, what can we do? Okay, let's try to do 03:57.960 --> 04:06.600 something else and it's best more complicated. So, the next step was, what can we do? Okay, 04:06.600 --> 04:14.840 we have been talking about some CA in the past. I think five years ago. So, how about creating a 04:14.920 --> 04:27.000 lightweight CA that can simply as a replacement for a doctor? How far can we get with that one? 04:27.000 --> 04:34.040 Yeah. So, this is the wish list, which should it be able to do? So, 04:34.920 --> 04:42.280 at best Python cryptography, based, it should have a service, it should have log files, 04:43.160 --> 04:51.960 elderful storage, a rest API, it should provide sub CA profiles and as SDB. All the nice things that we have 04:51.960 --> 05:01.800 with dark tech. Yeah, good. So, reality comes back. So, I started. 05:02.760 --> 05:09.720 I am first iteration. Yeah, we have something. It's not really working. So, iteration iteration 05:10.360 --> 05:19.640 and Claude was refusing some of the requirements or ideas and thought, oh, I can do this in a 05:19.640 --> 05:25.720 better way. I know what you want. No, you don't. And so, you get back those nice things. You're 05:25.720 --> 05:36.600 absolutely right to question this. Oh, really? And so, in all those steps, I had to modify code. 05:37.160 --> 05:43.960 Go back, go for and say, no, this is not what I want. We need this, we need that. So, and then it 05:43.960 --> 05:48.280 comes back and says, oh, you're absolutely right. I apologize for the confusion. 05:48.280 --> 05:57.720 This is like, come on. So, in the end, I cannot say how many iterations they are because 05:57.720 --> 06:07.320 it took some weeks. Several weeks, a lot of weeks. So, I asked Claude, please provide a note of 06:07.320 --> 06:12.680 you. This is the second version of this overview. The first version was, we had five iterations. 06:13.640 --> 06:21.400 No, or seven, not even Claude's. So, in the first version, it also said, I was doing all the 06:21.400 --> 06:31.480 work. I was only reporting books. Sure. So, second one is a little bit better, but it's still far 06:31.480 --> 06:42.520 from what is real. And you can see, yeah, it even said most features require 20 to 30 iterations. 06:42.520 --> 06:51.320 I removed that because, come on, it was not even writing about 30 here. So, the next step was, 06:52.680 --> 06:58.840 you know, the silent challenges that we have found, that I have found. So, what was the AI able to do? 06:58.840 --> 07:05.640 It always had some issues with architecture. So, a simple, the end structure or storage banning, 07:05.720 --> 07:13.640 it was broken. It was not working. It created sometimes big files and repeated and copied a lot 07:13.640 --> 07:20.360 of code from one to the next. Come on, this is not correct. This is not right. This is not proper 07:20.360 --> 07:27.640 software development. So, I had to change a lot of things. Also, security related. Oh, yes, we need 07:27.720 --> 07:36.760 to open all keys and certificates open to the world. Read, write. Yes, we want that. For sure. 07:38.600 --> 07:47.000 So, there are lots of things that have not been properly according to my, what I expected 07:47.000 --> 07:53.640 and what I wanted. It should be placed something that is relatively safe. So, it should be at least 07:53.640 --> 08:02.360 that level and also those refusals from, from cloud. At some point, it's simply stops to do 08:02.360 --> 08:10.680 something. For example, it added simply deprecated Python functions in so many places. It was 08:10.680 --> 08:18.120 copying this plug over and over and I think, come on. Either we create a function or replace it. 08:18.200 --> 08:25.320 So, I created a with grab. I was creating a file. These are all the places you need to fix. 08:25.880 --> 08:34.520 Yeah, in a minute stopped. And said, I'm done. No, you're not. Go on, fix the remaining. So, 08:34.520 --> 08:46.600 it started again and surprise, it was not fixing them all. So, the result of all this, 08:47.240 --> 08:55.640 we call it ipafincier. Now, you get a little bit of overview of ipafincier. Yes, the name changed 08:55.640 --> 09:04.200 over time in the beginning. It was ipafripto and so on, but yeah, other names are already used. So, 09:04.200 --> 09:12.680 this one is the only one where you can say, okay, it should be safe. So, here you have a architecture 09:12.680 --> 09:22.040 review of what we got. So, really got all of this. It was a lot of work. Yes, a lot of gray here. And 09:23.160 --> 09:28.680 so, we have all the typical things that we require. We have the excess layer. We have the rest 09:28.680 --> 09:40.280 API, the framework IPA, Agma protocol. We have the core where we have CA, sub CA, KRA, OCSP, OCSPS, 09:40.360 --> 09:50.360 HSM support. And below, we have the storage. So, we are placing, we are saving the same things 09:50.360 --> 09:56.200 in all of that dark tech is. We have on the files, also the keys, certificates, and so on. 09:57.000 --> 10:08.120 And also, we have an SDV support. So, it should be prepared. And yes, we can do a lot, we can deploy. 10:08.760 --> 10:16.760 We can deploy a server. We can even deploy replica using the server. So, here you see a small comparison. 10:18.520 --> 10:27.560 So, this is generated by clock. And it needed some tweaks because it's some point. So, for storage, 10:27.560 --> 10:35.000 it's at, yeah, we have LDAP. No, we have also files, we have NSSDB. Why is it missing? Oh, you are right. Thank 10:35.320 --> 10:45.400 you for that. So, but the good thing is, we need a lot less memory. It starts up in really 10:45.400 --> 10:52.760 second or two. That is a big difference to dark tech. Also, deployment. If you deploy with dark 10:52.760 --> 11:02.520 tech, it is about three minutes only for dark tech. Sorry. And with this, I can show you later on. 11:02.520 --> 11:08.760 It's a lot faster. We can deploy a complete server with DNS, with KRA in two minutes. 11:09.560 --> 11:15.160 Okay, and my machine here with a container, and it will take a little bit more time. Sorry for that. 11:17.560 --> 11:24.600 But, we get to the benefits. So, what can we, what do we have out of this? So, we have 11:25.000 --> 11:33.400 faster deployment. We have lower sources. We have, let's say, minimal dependencies compared to Java 11:33.400 --> 11:40.760 and so on. We have a simplified architecture. Also nice. And it's 100% IPA convertible. 11:43.320 --> 11:47.960 We might find bugs still, yes. For sure. That is expected. It's the first word. 11:48.200 --> 11:57.400 Um, and so we can use this in environments where we have limited resources at computing. Containers. 11:58.200 --> 12:04.280 And something that Alexander was pointing me to? Yes, we can use it for deviant and Ubuntu. 12:04.280 --> 12:11.160 They do not have the resources to make sure that there is the Tomcat is running or and so on. 12:11.480 --> 12:20.680 So, the next steps for us now. Yeah, as expected, we need to test it a lot. 12:21.880 --> 12:27.800 And, um, one thing that I really want to make sure is that the replica deployment 12:27.800 --> 12:36.440 with its own CA is also probably working. This is not tested yet. So, um, and the next big step is 12:36.680 --> 12:44.280 PQC. For this, we are already working on some parts. Alexander was working on some things for 12:44.280 --> 12:50.520 Python cryptography and so on. And cloth can help us with that for sure. 12:56.920 --> 13:03.560 So, this is how the deployment looks right now. So, there is a new parameter you can see in the end. 13:04.200 --> 13:14.120 This one here. Um, use IPFNCA. And then it deploys. And you see, if for example, you go to 13:14.120 --> 13:24.120 IPA CDL status, there is a different service. Yeah, um, IPA and its structures needed some 13:25.240 --> 13:32.280 smaller push to make this possible. Because normally, um, dark take is hard wire. It's 13:32.280 --> 13:38.040 been so many places. And this also applies sadly for tools like IPA health check. 13:39.000 --> 13:46.200 If you run it, uh, there will be a lot of hard put. Oh, there is no dark take. There is no dark 13:46.200 --> 13:53.960 edge. Where is Tomcat? It's simply not there because we don't need it. So, here, for example, 13:53.960 --> 14:01.080 is the configuration file that is generated while deploying. And you see, it has all the important 14:01.160 --> 14:08.360 stuff in there. So, post name realm domain where the CACRT is stored and for 14:08.360 --> 14:16.440 elder up how many connections. So, there's already optimization in there. And which port should 14:16.440 --> 14:22.280 be used and how many workers? This is something you can change on your own. So, we need more workers? 14:22.280 --> 14:29.800 Okay, start more workers. Um, the certificates, the user that is used for this one, 14:30.440 --> 14:37.240 yeah, in the beginning I was using the same user as for dark take. And yeah, I thought it is not 14:37.240 --> 14:44.280 good idea. Yeah. So, and the last one is logging. So, we have full logging support and this is also 14:44.280 --> 14:54.920 something that I really like about it. It's simple to find things. The next one is the structure 14:55.000 --> 15:02.520 and while I have been CA. So, they are subdirectly generated with the keys with the certificates. 15:02.520 --> 15:12.200 Yes, we need to work on this for sure. It's the first version. And for KRA, the private keys 15:12.200 --> 15:18.760 and also the profiles. The profiles are not properly stored in LDAP yet. I know about that. 15:19.720 --> 15:30.200 Oh, it should have been on the list. So, and we have locked directory. And this is really nice, 15:30.200 --> 15:40.600 as I said. And so, excess log and I profanity a log was helping me a lot to find issues and to 15:40.600 --> 15:55.400 report them to plot. Now, I have more slides. Or I have a demo that I will show. So, here's the 15:55.400 --> 16:02.520 obscene people. It's currently my private branch and my private repository of free IPA. They are 16:02.520 --> 16:10.360 copper builds for Fedora. Currently, 43 only raw it was failing. Yeah, we have some issue with 16:10.360 --> 16:20.920 note. And there is a script for a guest script on GitHub. This is simply the script I used to deploy 16:21.720 --> 16:29.000 this server in a container. This is reusing Ansible Free API structures and infrastructure scripts. 16:29.960 --> 16:43.000 And so, I will now show simply a deployment. So, let me increase this. Hopefully, 16:43.320 --> 17:07.400 it's the size good. Good. Okay, so this is a change version of this script because I do not have 17:07.480 --> 17:16.120 a lot of internet here. So, I simply created a tar archive. It's simply the container saved 17:16.120 --> 17:30.920 after installing the packages. And we can simply start this. And it will load this top hole and 17:30.920 --> 17:40.920 that loading talks some time. These are, as I said, these are things that we're using for 17:40.920 --> 17:47.000 Ansible Free API testing. So, we're waiting till the container is really up so that we have a running 17:47.080 --> 17:56.440 system D. So, that we can use it. And then we started deployment. And the beginning is the same. 18:02.680 --> 18:10.680 And at some point we will get to Python CA. Should be right after that one. 18:10.680 --> 18:23.560 So, the typical IP deployment is like six or six minutes. Yeah. When thing that I can 18:23.560 --> 18:30.360 change, all elder stuff is taking time. So, loading schemas into elder is taking time. I cannot fix that. 18:30.600 --> 18:39.960 Yeah, a good idea. We should get this class to speed up L of PUN. 18:45.960 --> 18:48.760 How it's remote. What means it's remote for you? 18:51.320 --> 18:54.440 How much time have you, would you have taken more? 18:54.920 --> 18:59.000 Okay, the question is how much time would it have been taking without cloth cell? 18:59.720 --> 19:06.920 Okay, cloth was helping to understand some things that I'm not aware of. So, to get into 19:06.920 --> 19:12.360 Freex to analyze for example, dark tech. So, because I had to analyze dark tech to find 19:12.760 --> 19:17.000 the interface that are there. What are we using and so on? This correlation. 19:17.080 --> 19:25.640 Lot was helping that perfectly. Hopefully it was not hallucinating. But for this case, it was really 19:25.640 --> 19:35.880 good. Code wise, it was a questionable sometimes. And at some moments, it really refused to do 19:35.880 --> 19:42.040 the things that I asked for. And it was sure I did the right thing. And I said, no, this is nonsense. 19:42.120 --> 19:47.240 I was not writing nonsense. But I said, this is not what I want. We need to do it differently. 19:48.200 --> 19:55.800 And these other requirements, this is what needs to be the result. And sometimes it did it, 19:56.760 --> 20:02.600 but sometimes also not. So, I had to do it on my own. So, all together, 20:05.720 --> 20:11.160 I cannot count the number of iterations. What I did is I started with first iteration, 20:11.240 --> 20:15.960 looked at the code, analyzed the code, took the code, that was good. Remove all the rest. 20:23.960 --> 20:30.200 The question is, if I know if it was faster or slower, I cannot tell. Because I wasn't 20:30.280 --> 20:42.920 working on this full time. And so, it is, it's not a simple question, sorry. But it was helping 20:42.920 --> 20:58.520 me to understand some things. Yeah. So, I'm going to the container now. 21:00.200 --> 21:19.720 Oh, my goodness. So, in here you see, it was deploying. It is rent. We're using random 21:19.720 --> 21:25.160 CO numbers. Yeah, I need to have fixed to have always the right amount of characters. This is 21:25.160 --> 21:35.160 something that Dr. Gistwing, but it should be a smaller one. And it was already doing both. 21:36.760 --> 21:42.280 So, we have a working IPA server. We can use it. I can even run an answer for him. He tests 21:42.280 --> 21:45.880 four certificates with this. So, they are all passing. 21:45.960 --> 21:55.720 It was not only clear. It was. 21:57.720 --> 22:06.280 So, when we do install in the log in the installer log, we leave the timestamps. If you grab 22:06.360 --> 22:12.520 those timestamps, you would know how long the configuration of a particular section. Good. 22:14.520 --> 22:19.800 So, Alexander mentioned that we should see in the log files. Time stamps, so we should be possible 22:19.800 --> 22:25.640 to see how long it really took. 22:36.280 --> 22:58.680 Mm. We should have natural. It's my cell phone. 23:07.000 --> 23:14.040 So, here we have the beginning. 23:14.040 --> 23:20.040 Yeah, if you grab by the speculation, it's that space duration you can see. 23:21.800 --> 23:26.040 Yeah, you come and grab them all. Like if you grab them all from outside. 23:27.240 --> 23:29.240 Oh. 23:29.480 --> 23:35.480 Oh. 23:49.160 --> 23:51.160 If I install this, come on. Let's use it. 23:59.800 --> 24:05.880 Yeah, but this is on the container. 24:09.640 --> 24:11.960 So, do you have questions? 24:11.960 --> 24:13.160 Yes, I have a question. 24:16.200 --> 24:22.360 So, do you recommend installing the key when you start working the cloud and then you end in a哪裡 hole 24:22.360 --> 24:25.640 or to hold back or to start again and then you start to get? 24:26.600 --> 24:27.640 So, the question was. 24:29.640 --> 24:36.520 The question was, if there is a strategy, if you run into that log or whatever with cloud. 24:36.520 --> 24:43.640 So, yes, cloud could be stuck. It could even be stuck completely. So, you need to kill it. 24:45.960 --> 24:50.920 The only way to get out of this is really to kill the section and to start in your one. 24:51.000 --> 24:55.720 Um, I have been there three or four times altogether. 24:57.000 --> 24:59.240 It was behaving really strange. 24:59.240 --> 25:05.800 It was not able to write something or to get something out. It was simply stuck. 25:08.600 --> 25:13.960 It's the same. The same would I did with the other issues. 25:13.960 --> 25:19.960 When I was stuck in one of the iterations, I used a copy to stuff that was good and removed the remaining. 25:21.800 --> 25:28.200 Um, but when thing is really important if you use cloud on patches or on your get tree 25:29.320 --> 25:34.760 and you who changed the comments and you didn't push them and you asked for a change. It might 25:34.760 --> 25:43.240 divert everything you did. And you will see afterwards. Thank you for fixing this. I said to close and 25:43.320 --> 25:52.200 it said, you will come. Um, yeah. It is not familiar with I already. Sadly. 25:56.040 --> 25:58.600 So, is there any other question? Yeah. 25:59.880 --> 26:06.280 So, do you have any tips on how to provide proper context especially when it's from breaks 26:06.920 --> 26:13.240 the people that are working on. Question is if I have a recommendation for context. 26:13.240 --> 26:21.240 Right. Um, the thing is with cloud and any other AI, it's the same. You ask the same question five 26:21.240 --> 26:28.680 times and you get five different answers. So, it's really moon phase or whatever. You can ask 26:28.680 --> 26:35.320 right question and once it's doing the right thing and the other one, the other case, it is 26:35.400 --> 26:45.720 doing something completely crappy. So, um, but you should make sure that your query is as accurate as 26:45.720 --> 26:54.520 possible. So, if you ask for give me an image, it would create something for you. So, it needs to be 26:54.600 --> 27:04.360 really very, very, to the point. I need this, I need that and use this library, use that 27:04.360 --> 27:13.640 binding and so on. Um, and sometimes also about versions. We have seen. It is trying to do 27:13.640 --> 27:31.960 simple solution. Are there more questions? Yes? Um, so the question is if this is 5pa only or it 27:31.960 --> 27:38.440 could be used standalone, theoretically it could be used standalone. Right now it's 4pa. Because 27:38.520 --> 27:46.520 that was my, that was what I wanted to do. I wanted to have a something that, that is small enough 27:46.520 --> 27:52.840 and think something that I can test also with IPA. So, currently it's completely the IPA 27:52.840 --> 27:59.960 use case. I don't know if there will be enough manpower or something like this to make this 28:00.200 --> 28:09.880 a standalone solution. I don't know. Yes, so, um, just cross my mind about the context. 28:11.560 --> 28:17.320 I know that if we even need to provide a lot of like requirements and like, well, establish 28:17.320 --> 28:23.720 a party to our standards. You mentioned like that you use it some tests, like all the tests 28:23.880 --> 28:32.120 I asked what IPBs they are working. So, if we combine requirements with the tests and as 28:32.120 --> 28:38.360 called to write something based on those two things, new thing might get a better result. 28:39.400 --> 28:49.000 Okay, let me try to repeat that. Um, okay, the question is if it helps if you get more tests 28:49.080 --> 28:57.000 and requirements together, yes, it could help. The only problem is Claude needs to be able to 28:57.480 --> 29:04.040 handle this to execute. So, for example, here, um, I had a test machine. Claude was didn't 29:04.040 --> 29:12.600 had access to this. So, the only solution was copy and paste. Um, because I didn't want to give Claude 29:12.600 --> 29:28.040 access to my machine, my test machine. And Claude is, or the AI is sometimes really good and 29:28.040 --> 29:34.360 as I said, really bad. So, for example, when it tried to use elder, it was not always using the 29:34.680 --> 29:42.200 proper sluffy link. Sometimes it is simply copying what it found in the internet. So, if someone 29:42.200 --> 29:49.800 had a different domain, you might find this in your query. Yeah, perfect. It is not fitting your 29:49.800 --> 29:58.040 use case, but it found itself where. So, we can use it. No. So, in several cases, I needed to fix 29:58.600 --> 30:04.600 those. Also, in test case, that it created. That was very unexpected from my point of view, 30:04.600 --> 30:10.040 because it knew where it is that main, where does the realm, so it should be able to do it right. 30:12.040 --> 30:16.840 We are all good, fine. Oh, well, is the last talk of the day? We can extend. We should 30:16.840 --> 30:23.160 keep the rest in place of the recordings. I wanted to ask why I bought some red shirt in the 30:23.160 --> 30:32.440 floor. Um, the question is, why not some red head AI? Um, I started this somewhere, 30:32.440 --> 30:40.280 all this AI journey I started last year, so mid last year. Um, I had access to Claude. And according 30:40.280 --> 30:47.960 to what I heard, Claude should be good with code. I'm not talking about red head AI at all. 30:48.680 --> 30:54.600 I have not tried. I had access to Claude, so I used Claude. That's simple, the answer. 30:58.840 --> 31:05.560 Anything more? Any other questions? Thank you.