This is stock number 9J150A. We are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used Jeep and Jeep Grand Cherokee headquarters. Today we are checking out this super clean 2019 Jeep Grand Cherokee Limited. This vehicle has the 3.6 liter award-winning Pentastar V6 motor. It has been fully safe and inspected by our service shop has a fresh oil and filter change. All the fluids have been checked and tapped off and this Jeep is 100% ready to go. Bright white is the color. We shoot all of our videos in 1080p, 60 frames per second. So if you have HD capabilities on your computer, tablet, or smartphone device, I highly recommend turning them on right now because it's definitely your best way to ensure the quality and condition of the vehicle before seeing it in person. And if you want to check out all the photos on this Jeep in the upper right hand part of your screen, there's a link right to our website. Click that and check us out there. Comes with the painted and polished aluminum rims Michelin Premier 26560R18 tires and they have probably about I'd say 60 to 70% of the tread left on them. Front bumper is an excellent shape or fender is an excellent shape to see any dents or dings on that has the projector lamp headlamps, the projector lamp fog lamps, and the front bumper is an excellent condition as well. The limited package does give you the chrome trimmed grille and I didn't see any dents or dings or imperfections on that front bumper. Passengers side fender is an excellent condition as well, no dents or dings there, and the passenger side rim no scuffs or scrapes. As you go down this side of the Jeep, take note of how clean the body is, how reflective and mirror like that paint is. We take these HD videos so if you are far away or even if you're close by and just cannot make the trip down but you're still interested in purchasing the vehicle, you can see the vehicle, hear the vehicle, and have confidence in what you're looking at before you even get here so that when you do get here there's absolutely no surprises. The roof looks really good and that's why we offer the Summit Auto Fastpass option in the upper right hand per your screen. A link right to our website where you can apply for financing, get pre-approved, see a payment quote, even appraise a trade all from the comfort of your own home making your shopping experience easy and hassle-free. Back tires have just as much tread as the front tires in that back rim, no scuffs or scrapes on there. As we come around to the back of the vehicle, the rear bumper is an excellent condition. You do get the full towing package which includes the receiver hitch four pin and seven pin wiring. You also get the rear load leveling suspension and the back of parking sensors. LED tail lamps and the rear gate is an excellent shape. It is a power lift gate so you just press that button, it comes on up like so. Back storage area is in really nice condition, no rips or tears back here.  Those seats do fall down for extra storage and to get this back gate down you press that button, it'll beep at you three times and then begin its descent. And as you go down this side of the Jeep just as clean as that passenger side, no dense or dings on that rear quarter. And for full disclosure, no scuffs or scrapes on this back rim as well. Very nice and clean all the way around. You do get blind spot monitoring, heated mirrors and built-in LED directional signals in the mirrors. Entering ghost system.  Both of these seats are heated, both of these seats are power. No rips or tears on there. You get driver's side lumbar, factory floor mats throughout, auto headlamps, tilt, telescopic steering wheel. You get the black rose grain wood grain trim, power windows power locks and power mirrors and memory driver seat. I did want to show you that it does have the capitalist fuel fill which is a nice feature. And we'll hop inside the Jeep here. This one has 14,000 and one miles. Instrument cluster is very nice and clean. Got a little bit of dust on there. We'll get that off. Has the heated leather wrap steering wheel. Cruise controls on the right. Bluetooth and information center controls on the left. Audio controls on the back of the steering wheel. This one has the 8.4 4C radio which gives you the factory navigation. So you're going to get the serious, I believe, traffic and travel link plus on here as well. AM FM and Sirius XM radio capabilities.  You also can do your heated seats and heated steering wheel buttons and you can check out your backup camera without actually putting it in reverse which is pretty neat and those are dynamic grid lines which line right up with your receiver hitch in the middle there and they turn as you turn the steering wheel. Like I said, you get your heated seats and heated steering controls. You can also do Android Auto and Apple CarPlay. Project to the screen from your cell phone so you can do if you have Waze or Google Maps on your phone you can project those to the screen and it's like you have your own navigation system if you don't like the factory navigation system. You also get the off-road pages which is really cool. The other thing I will, while that's loading, you get the Quadra Track 2 system with the snow sand auto mud and rock selectors as well as a neutral setting for flat towing. You also have the downhill assist control and four-wheel drive low. 8-speed automatic transmission. Here's your key fob with your remote start and the enter and go system. So here's those off-road pages. Pretty cool stuff. You got your steering angle and they also tells you if you're in two-wheel drive or four-wheel drive which is pretty cool.  Now the pitch and roll is really cool as well. It tells you if you're angling down or up and if the vehicles off kilter there too which is really neat. You got your accessory gauges, coolant temp, oil temp, battery, trans temp, oil and pressure as well and then you got your select terrains which I think if you change, if you do the turndial here you'll see it change on the screen up there. So that's sand and then snow and then you got to do rock. You got to set it up special. Anyways, you get the nice gloss black around the radio which is really cool. You can do your climate controls and your audio controls down here if you don't like doing that up there. You also get backup parking sensors, start stop capabilities, eco mode, sport mode and your stability control. You also get two USBs and an AUX jack in there. Pass in your side format and seat are in excellent condition. This vehicle has never been smoked in, smells very clean inside and the headliner is in excellent condition. You do get your home link buttons for your garage door security systems and lighting systems and your map lights up there. We'll take a quick look at the back seats and then we will check out under the hood. Back seats are just as clean as the front seats. No rips, no tears back here.  Very nice and clean. These seats do fold down for extra storage and you can see just how nice and flat that those go and they go down really nice and easily as well. And you do get two USBs and 115 volt 150 watt plug-in back here. Factory floor mats, get that nice black rosegrain wood trim there. The child safety locks, bottoms of the doors all look great as do the kick panels. And we'll take a quick look under the hood. I would personally like to thank you for checking out the video today and hopefully from this HD video. You will have been able to tell just how clean this Jeep is all the way around inside and out. Under the hood we have the award-winning 3.6 liter Pentastar V6 motor. Engine bay is very clean, runs very smooth. This Jeep has been fully safe and inspected by our service shop has a fresh oil and filter change. All the fluids have been checked and topped off and this Jeep is 100% ready to go. And to see more pictures of this Jeep or one of our other 450 new and used cars, trucks, SUVs, minivans, Wranglers, half tons, three quarter tons, one tons, Grand Cherokees, you name it we got to go to our website www.summitauto.com. Full pictures and descriptions of every single vehicle from two locations all at summitauto.com. If you'd like to check out more HD videos you can go to youtube.com slash Summit Auto. Remember to like, subscribe, and share on this video and all the videos that you see there. In fact in a second you will see a link to subscribe to our YouTube channel on your left. A link to more Grand Cherokee videos like this one on your right. If you have not been to our website on the bottom link to this vehicle on our website click those check us out and we really look forward to helping you with this super clean 2019 Jeep Grand Cherokee Limited in bright white. Thanks again.


be here. Thank you for having us. We have prepared a great workflow presentation for you all today, but first off, just to kind of start on who we are, as Megan said, I'm Thomas. I'm a partner solutions architect at Sneak and then co-percenting with me today. I have Tom Gibson and Ryan Patterson. I'll let them kind of quickly introduce themselves before we start. So hi everyone. My name is Tom Gibson. As Megan and Thomas have said at the stage, I'm a senior staff engineer at CloudSmith. I've been with the company around about two years or so and I work to sort of lead the engineering teams within CloudSmith. I do some of the webinar type stuff we're on today and work to further the engineering roadmap. So nice to be here. Really excited to get going. I'm Ryan Patterson, a senior solutions engineer at CircleCI. I've been with the company about a year and a half. My role just means I get to help teams adopt CI and CDBest practices and allow for rocket ship emoji growth. I love the rocket ship emoji. Thank you, Ryan. Thank you Tom, for being here and co-percenting this with us. For the audience, we've prepared an awesome presentation that shows how we can together help construct a secure software supply chain. But before we jump into the meat of this presentation, the demo, just a little bit about who these three companies are that are coming together. So from the sneak side, we've been around since about 2015, gone through five rounds of funding. We're used to buy over 2.2 million developers worldwide. And our mission is to put into those developers' hands the tools that they need to take security of their applications into their own hands and help turn security into a team exercise that everybody owns. So from the sneak side, we'll be talking about security. And then Cloud Smith. Awesome. Thanks, Tomas. So Cloud Smith founded 2017 in Belfast in Northern Ireland. So you'll have to excuse my accent. So we operate to essentially enable our customers to do continuous packaging. And you'll hear us talk a little bit about this further on in the webinar. But we offer a package delivery network in order to help speed up package downloads, uploads, all that kind of stuff. But our primary mission is ultimately to help people secure their supply chains. We offer universal repositories. So they cover virtually all of the formats that people use today across all of the biggest organizations. You can see some of those on the bottom slide, such as MyOB, Font Awesome, Shopify, a bunch of others as well. It's a 24-7 product. It's SaaS based. It's entirely cloud native. So I'll hand over now to Ryan to talk a little bit about Circle. Thanks, Tom. So at Circle CI, we help high performing teams, all types of industry, different points in their trajectories. And we bring some of these points up really just, we've hundreds of customers, thousands of customers that run millions of builds per day. We've seen it all highly flexible in terms of what things people can do on the platform. So developers come onto Circle CI really to just reduce workflow duration, increase deployment frequency, and reduce mean time to recovery. And put that a, it's a more simple way, deploy more code, get feedback faster, and troubleshoot more quickly. We'll get on to the presentation. Yeah. Thank you, Ryan and Tom. So before we jump into the demonstration, just a real quick overview of what we're going to be showing you today, we're going to cover all these points we've mentioned in the introduction. Continuous everything, right? So this includes integration and delivery, security as well as packaging. We're going to wrap this all into a demo and kind of show you what it all looks like in action. So before we jump into the good stuff, just to walk you over what it is we're going to be showing you without stealing too much thunder from the demonstration. So you've probably, if you've heard about Shifting Left, it's this concept of introducing security testing earlier into the development workflow. So if we think of the lifecycle of an application, it's about testing the application as it gets written. And then also testing it after code is checked into the source control system to ensure that no new vulnerabilities can be introduced. But there's a couple of extra steps that need to happen for an application to go from code and concept to production. And so that's where CircleCI comes in, where a build is triggered to package and get our application deploy ready. So Ryan, can you walk us a little bit about what we're going to be seeing today from a CircleCI perspective? Absolutely. And again, without giving too much away, CircleCI, I guess it's pretty evident, is in the business of continuous integration and delivery. It's right in the name. We can think of that really as just a change validation for developers who are committing code. And good CI enables the business to be more nimble and to meet customer needs faster. What we'll be seeing in the demo today is just how CircleCI is used to coordinate the work that needs to be done as a change passes from early stages when it's triggered to the point where it's ready to get into the hands of customers. And then I'm going to pass it off to Tom to talk a bit more about the Cloudsmit and Continuous Packaging piece. So thanks, Ryan. So yeah, today we're going to be talking a little bit further about Continuous Packaging. We see, in essence, the glue between continuous integration, continuous security, and continuous delivery. So we're going to talk a little bit about repository structure best practices and how you can help mitigate against dependency confusion attacks and focus a little bit on distribution to your teams, services, and customers as well. Beautiful. Thank you all. So again, not to steal too much thunder from the demonstration, but we're going to be showing you how all this fits coherently to ensure that the applications that are being deployed into a production environment, whether it's a containerized application, a serverless function, or an application running on an application server in a VM, we hope to demonstrate some of these security best practices and how you can build workflows where validation happens naturally as part of the workflow. So with that, it is time to tempt the demo gods and let's show all this in action. So starting off with the application, we're going to be demonstrating the application with the coolest name ever that Tom shared with us. This is, we're calling it the Waffle application, more specifically the sturdy waffle. And this is a Python application that, you know, we're going to be running through CircleCI to build. And in that CircleCI workflow, we're going to see how that application, as Ryan mentioned, how that application is taken from concept into a packageable artifact. And this is constructed using a CircleCI config.yaml file. So, Randy, you want to kind of walk over real quick what this config file does and how it translates into instructions for CircleCI? Absolutely. Yeah, so everything we're going to see, again, another sneak peek later in the UI is set up here in source control. It's a config file under the .CircleCI directory that we're looking at. It has the instructions and logic for what to validate or needs to trigger. It's all set up here. So each time CircleCI kicks off work and follows the instructions there. The mandatory piece is you see a job stanza here. And there's also an orb stanza that was above. Orbs will get into. But again, just a little hint, they're great for extensibility and best practices. And then a workflow stanza at the bottom. So we'll dig into what those really are, but those are the main pieces of the config file. And we'll see how it all mirrors into the UI. Yeah, and that's a perfect transition over to the CircleCI UI, where we have our pipelines. So, Ryan, can you just walk us over what it is that we're seeing here? Absolutely. So we are in the CircleCI UI, the all pipelines page. And a pipeline is the full set of workflows and the parameters run when work is triggered into CircleCI. So you can just think of it as that full config file that we just saw with all of the surrounding context. Just on that, actually, sort of can ask a question actually on that. Just what are the best ways and what are the ways in which pipelines can be triggered then? Yeah, excellent question. The pipelines are triggered on any action like a new commit, a tag, a PR through the API. And there's also a button in the UI to be able to trigger those. In a sneak peek, you can also look for additional native triggers that are coming up in the coming quarters as well. Awesome. And then, Tom, do you want to jump into that workflow? Perfect, way ahead of me. And then, so under a pipeline, a workflow is just the orchestration of jobs, which jobs are running and in which order. And the jobs are set of commands, specified environment. What we're seeing these here is they're each their own independent ephemeral environments spun up on demand to the specs in the config file and then torn down after. They each have their own set level of vertical scale. So CPU and RAMs to match what's needed for that job specifically. The environments can be Docker, Linux, Mac, Windows or a custom hosted runner. Also, Brian, you mentioned something interesting, a custom hosted runner. Can you tell us a little bit about what that is? What is a custom hosted runner? Who would need that? Yeah. Yeah, so it's a go binary you can install. If you want to, we have cloud resources that are available, absolutely scalable for you. But there are a couple, I think reasons that people might also raise their hand to use a self hosted runner. One would be exotic compute requirements. I love saying exotic like I'm describing a jungle cat. Our execution environments cover the vast majority of use cases, but there's something really specific you need to run on. It's perfect for that. And then sometimes security protocols. So if you can only access production environments from behind a firewall, for instance, or if you have some other protocols, you can use those for specific jobs that are part of the core workflow. Awesome. And so we're seeing here, this is a workflow and then each of these are the jobs within that workflow defined by the by the config file. Yes. Yeah. Yes, exactly. And we can jump in perfect ahead of me yet again. And so we're seeing a failed job here. Of course, we want everything to be green, but in reality, you know, that's what we're here to talk about is how to fix things outside of the happy path. And then a job is really just a set of commands in an execution environment that you specify. So you can absolutely want to set your environment, run the exact steps needed to validate what you want inside of that environment.  One other note before I pass it off to Tom, though. So there's another piece that we're also here to talk about. In reality, most people don't want to write everything out in bash in each config. Really want to utilize the best practices and simplify the processes. So orbs are CircleCI's tooling to help establish processes. Configuration is code and you can think of them as CircleCI's package manager. We have certified partner orbs with great teams like Sneak and Cloudsmith. And with these orbs, you can not worry about reinventing the wheel. The best practices are built in helps you simplify your configuration. So just think many lines of code combing through docs to figure out what to write simplified into a single or a few lines of code and plug and play commands, full jobs maintained by CircleCI or the partners and you know they're up to date and version. Perfect segue to actually hand this off and talk about some orbs and ways to use them. Yeah, thank you, Ryan. So just what we're seeing here then going back to the CircleCI YAML file, we kind of give a sneak preview of that. But here are the two orbs that are in use as part of our workflow right now. And these orbs are used in the jobs that we ran, which each of these lines represent. And what we're seeing here, the failing job is actually an invocation of the Sneak orb, where as part of the CI pipeline, where in this particular case, testing to see if there are any vulnerabilities in the open source components utilized by the sturdy waffle application. So Sneak, the whole idea here is just an extension of that shifting left. Yes, we want to put security into developer's hands, but it's still important to integrate security testing because developers are human or new vulnerabilities might be disclosed for an open source component that a developer was using. And when it runs through the CI pipeline, what we're doing here is just testing, making sure that we're preventing issues from entering our production environment. Question on my end, do all the types of security tests have to run at the same time? So, Ryan, that's a good question because Sneak supports testing the open source, we can test the built container image, we can test the proprietary code that's part of the application and the infrastructure as code. Short answer, no, we do not need to run all the tests at the same time. Case in point, right here, we're only testing if our open source dependencies have vulnerabilities before we build our application. So that's a great question. So in this case, let me zoom in a little bit for the viewers and the audience. The orb that invoked the Sneak CLI, in this case, failed the job because we have an issue in one of our eight dependencies. There's one issue in the JINJA package that is used by our application where version 2.11.2 is introducing a regular expression denial of service vulnerability that can be fixed by upgrading to JINJA 2.11.3. So when we set up this orb, we can actually see a reflection of the vulnerability within the Sneak user interface. So when you import the GitHub repository, where this application is currently hosted in the Sneak, it constructs a representation of, oh, here's our requirements.txt file. And if we go into the Sneak user interface, we can see that exact same vulnerability that was identified in the CircleCI workflow. And from here, as a developer, we can choose how we want to take action. Do I want to manually upgrade this to JINJA 2.11.3? Do I want to ignore this vulnerability? Or do I want to have Sneak help fix this for me by creating a pull request? In this case, because we have a broken pipeline, and we want to make sure that we can resume our builds and get our application pushed as fast as possible, we're going to have Sneak open a pull request on our behalf, which is going to bump up that version of JINJA from 2.11.2 to 2.11.3. Question for me actually was for doing that, Thomas. Can we configure? Is there a way to configure the tolerances of the Sneak orb itself so that you can open the range and say, well, I want to allow some things through or I want to reject? Can we get controls on that? Absolutely. So within the configuration of the Sneak orb in the CircleCI YAML, you can definitely pass in what we call the severity threshold, where you can choose what the level of acceptable risk is that you want to allow introducing into your code base. So in this case, this is a medium severity vulnerability. So it is totally possible to add into the CircleCI or instructions. Like, yeah, only fail my build if there are any high severity issues or higher. So in this case, though, we have it failing on all severities, which is why this medium severity issue failed our build. But now we've merged this fix into the repository and which will be received by CircleCI and then Tom will kick off another build by pushing another tag. And what we should see is that the Sneak orb will now allow the pass to allow the task to pass. So while that workflow runs though, because it does take a little bit of time to retest, it's a good chance to verify, to talk about what it is that CloudSmith is doing here to ensure that both the artifacts we're using in our build, but also the artifacts we're publishing come from a known trusted good source. So while that runs, Tom, you want to take us through a little bit about what CloudSmith is doing here in this pipeline? Yeah, yeah, absolutely. Thanks so much, Tomas. So you can see on the run within CircleCI we're in the process of building a Debian package based upon of that Python application. And the process then will be to push that up to CloudSmith. So thumbs up, it looks like it's doing the right thing. It's nice to see within a demo. Always a good thing to do. But I would like to talk a little bit just about repository layout then within CloudSmith and I guess best practices perhaps and ideas for how you can best structure your assets and strategies and techniques that you can use in order to strengthen your supply chain. So Tomas, would you mind showing the repo list again? So first off the list, you see the app repository. So the app repository in this case is where we perform continuous packaging. We're constantly producing new versions of this application and pushing this up to CloudSmith. What happens when it goes into that is open. We can trigger off other workflows, perhaps using webhooks. We can perform actions based upon that. We can enrich the information within that as well. A couple of other repositories worth mentioning at this point. We have first off the different environment repositories. And so we're going to talk here a little bit about a staging repository and a production repository as well. Tom, quick question. What kind of stuff can you store in a repo? Do they have to be all the same format? No, that's a great question. We like to try and leave that up to our users, ultimately their best place to make those decisions. So we currently support around about 25 formats, give or take a margin off the top of my head. It's changing rapidly, but it's ultimately about empowering our users to have the flexibility and freedom to structure the repositories in the ways in which they fit and make sense to them and their deployment. So one of the best practices that we advocate in this case is to use, keep your assets organized by environment. So in this case, for example, we've got a staging repository and a production repository, both of which reflect your different environments in a traditional setting. This allows you to kind of think of things and approaches to promote things across a pipeline. So within a staging repository, for example, we can put assets in there. We can perform tests against there. So we could call it to sneak, for example, if we pushed a Docker image up, we could call it to sneak and perform a vulnerability scan. We could perform end-to-end testing, perhaps some smoke testing, API testing, whichever really makes sense for the application. And then sort of once everything has been signed off, once we're thumbs up, it's all looking good, we can then promote those assets into the release's repository. And that whole process is in essence what we like to call continuous packaging. There is an element of this then that sort of talks about, well, applications are built, right? They have dependencies. So I'll talk a little bit about that now in the dependencies repository. So Tomas, if you mind bringing that up for me. And thanks very much. We'll talk a little bit about what's going on here. First off, you might ask, well, why would you keep your dependencies in CloudSmith? Ultimately boils down to trust and visibility. Having a single 10-foot view of what's going into your software, it helps inform you of your bill of materials, software bill of materials. Manufacturing has had this nailed for years. If I pick up my iPhone, right, not to discredit other phones exist, they're all very good. This particular phone, we have a screen, we have a chassis, we have a main board. I personally don't know the components that go into this, but you can be rest assured that the manufacturer does. So they have a list of all of the components. They know that the main board may be sourced from Foxconn, the display may be sourced from Samsung or LG. And that information is retained by the manufacturer. They're fully aware of everything that's going to go into that product. And so software should be no different. We've gotten to a stage now where tools such as CloudSmith and others are getting to a point where they're really helping facilitate that visibility of what's going into a product. And ultimately, it's about assertion that we are fully aware of where our stuff is coming from, where dependencies are coming from, and validating that it is what it says it is. And we do that through the use of upstream proxying and signing keys attributed to the repositories as well. So you can prioritize upstreams. Ultimately, you fetch a package. If it exists in the local repository, it's served out first. Otherwise, it can fall through to upstreams and be served. And there is a priority to those. So you're able to fetch from the local and then upstream number one, and then upstream number two, and so on. Tom, interesting that you mentioned upstreaming. Is that related to this very hot topic that we constantly hear about called dependency confusion? Is that related? Yes, yes. So, Bingo, bang on. Let's take a hypothetical situation. So we have Bob at Hooli, right, bearing no resemblance to any fictional companies that you may have heard about. But Bob has been in the company for a long time, three, four, five years. He didn't get a promotion for the third year, but he's getting quite jaded about this very disgruntled. Bob leaves the company. But with that walks out a lot of the knowledge of the internal systems of Hooli. So Bob is fully aware that they have a Python stack, that they have packages internally called Hooli middleware and Hooli comms, et cetera. And so ultimately, Bob could be in a position where either he wants to inflict harm upon the company or he could sell this information to someone who wishes to act upon it. And so the process is quite simple. You can create a package named exactly the same as an internal package, upload this to a public upstream, such as PyPy, and all of a sudden, Hooli CI at some stage could potentially pull that into the environment. And so through use of services such as CloudSmith that enable you to have that layer in between, we can actively help prevent that. We can ensure that when requests are made for that particular asset that they're serving out the asset that has been uploaded directly with CloudSmith rather than any external untrusted sources. Awesome. Thank you, Tom. So if we flip back to CircleCI, we should have given it enough time to complete our workflow. We can see that the test that previously failed succeeded this time. And because that test succeeded, it proceeded with the rest of the workflow. We now have built and published our Debian package into CloudSmith. So what comes next? But how would we then take this? You mentioned staging to release repository. What would be the next part in our workflow, Tom? So the next stage, right? At this point, we will have uploaded an image. We've created a package. We verified it with Sneak. We've uploaded it to CloudSmith and we created a Docker image from everything at that point. So now everything lives in our staging repository and we're looking to kind of okay things before it gets promoted into a production. So you may need to hit refresh on the UI. There's a second step has appeared above and true demo fashion, these things, you know, they line up. But so we've utilized CircleCI to do an approval step in this position, which is a great feature and allows us to be able to give a manual intervention step prior to doing something that could be potentially risky. So in this case, we're talking about putting in something that's just been created, something that's just been built into a production environment. It's obviously something that we want to, we don't take lightly. So with that, the next step is to essentially approve that, if you want to want to do that. And this is, you know, there are multiple ways in which you can do this, right? Common ways we've seen in the past is perhaps to call out to Slack or some other kind of system using some of the CircleCI orbs in order to do so. And they help facilitate and make this process seamless. But with the approval, we're at the promotion stage of this application. And from here on out, we're able to take that asset and put it into our production environment. So at that stage, we've verified it's all good. Everything's looking great. How do you get yourself out of that repository, right? Well, to get things out, our best practice is in general to use entitlement tokens. So you can use sort of, you can have users, you can have public repositories. But for private repositories, our best practice would be for entitlement tokens. Basic question coming in hot, Tom. What does an entitlement token do? Is it like a password or set of credentials? Yeah, in a nutshell, but there's a lot more to it than that. Good catch. It allows you ultimately to control your stuff and who has access to it and where it can go. You can get reports on it. So you can get reports on the number of downloads, perhaps the amount of bandwidth that's been confused. So if you happen to be selling software, for example, you can get visibility of someone's abusing a token or someone's went rogue, and perhaps this token is being misused and out in the wild somewhere. But you can also apply constraints to it via filters. So I could, for example, as part of my deployment, give container D within Kubernetes permission to pull an image to do an instant to bring up a pod. Or perhaps I could give Terraform exclusive access to the repository just to retrieve Terraform modules. So the choice is ultimately yours with them. We try to empower users like the whole way through the stack. But certainly when it comes to the deployment piece, these things are quite powerful. They're the recommended approaches. They're a read-only way to get your stuff out of the repository, and they can be filtered and constrained throughout. We obviously like all of this stuff, right? We recommend this stuff is cycled. So, you know, where possible, where makes sense. Refresh these tokens. They could be done through the UI, the CLI, API or CircleCI, you know, either way. This gets my gears turning, right? Going to go slightly off-script here. But this approval process is really interesting because we built our application. It got pushed into our staging repository. And then you have this approval to promote it and declare this artifact production ready, effectively. But you could apply the same logic to security testing as well as other activities. This concept of acceptable risk, Brian, to your question earlier about setting different severity levels for the Sneak Orb. If you don't necessarily want the Sneak Orb to halt your pipeline in the case of vulnerabilities, you can still use these types of manual approvals to say, ah, well, it did find some low severity issues, but that's okay. We're going to still let this artifact be promoted. And this allows you to set up different tolerances for deploying an application, maybe to an internal staging environment that's not customer-facing and is not exposed to the internet, and set up more strict rules toward a production environment that is exposed to the internet that is customer-facing, where those risks are much more important to address. So really cool mechanic here that we've displayed with this approval, because it could have been used to let the pipeline continue, even though the Sneak job failed. What you could even do on top of that is set up the approval to only work if someone is tied to a certain security group in GitHub.  So that's a really cool thinking. Yeah, absolutely. So to kind of recap, there's a lot of things that we didn't show, but for the audience, what we wanted to demonstrate is the workflow lives on CircleCI. In CircleCI, you have these orbs that allow you to extend the tasks that are running as part of your workflow. In this case, for this demonstration, we showed two orbs. First, the orb for Sneak that allows you to test the open source, the code. We could have scanned the container, we didn't show that today. We could scan the infrastructure as code. All of this can be done with the Sneak orb. But then we also showed the CloudSmith orb. And some of the invisible functionality that wasn't shown with CloudSmith is what Tom mentioned, knowing that the application's dependencies are coming from a known trusted good source. But then also using the orb to control that promotion of an artifact from staging to production ready is a way to ensure that whatever you're deploying in production, you really know where all those bits of your supply chain. Tom, I loved your iPhone analogy, like showing that you know where the chassis came from, where the main board came from, where the screen came from, have that kind of provenance. That's very, very powerful and necessary to ensure that the software you're running isn't going to compromise you. Nobody wants to be the next case study on a data breach, leaking customer data or anything. So thank you all for helping put this demonstration together. I hope my recap captured most of what we showed. Ryan, Tom, is there anything you'd add? I don't think so. I think we've covered a good bit of ground here today.  That is, we're all on this webinar today because that's something we firmly believe as individuals and the companies in which we represent. The provenance, it starts in one two, right? We think of the mentality of Chef Left, like you say, you know, the earlier that you catch a vulnerability or an issue, the impact weakens, right?  We go, okay, let's bump it, let's fix it, let's move on. If something happens the whole way to the right of that platform, deployment, where it's out in the wild, the customers are using it, it's like you say, you can end up a case study, right? You can end up where this deployment has hit hundreds of thousands, maybe more users, right? It's on systems all over and at that point, the impact in order to try and control and mitigate that becomes significantly more challenging. So these are strategies, right? These are a bunch of strategies presented by us today, but they're most certainly not everything that we should be doing. Ultimately, it's about kind of provoking discussion and trying to shift the mentality. You know, we're already there, right, in the sense that most of our audience members will most certainly be doing continuous integration to some degree. They'll almost certainly be doing continuous security to some degree and continuous delivery. This is about kind of meshing all that together and going, let's think about this holistically as a pipeline and what steps we can do to mitigate this from ever happening again. Absolutely. Thank you for that. I would try to chime in, but that was so elegantly put by both of you also. That was perfect. Awesome. So real, that was what we had for the demonstration, you know, that appreciate the back and forth, the engaging conversation, you know, the questions that were asked, I feel like added value to what we were displaying. So before we, you know, to kind of recap what we showed, right, we showed how you can configure CircleCI, that config, that config YAML file, if you look at the GitHub repository, I look up sturdy waffle, it's a very hard to forget name. But that GitHub repository has the CircleCI YAML that we used for today's demonstration of workflow if you need some inspiration. But we saw how you can orchestrate this entire workflow, including integration, security, packaging and delivery entirely from a YAML file. You can use orbs to add functionality from tools such as Sneak and CloudSmith into the CircleCI workflow without having to write everything from scratch. So definitely check out those two orbs. From the Sneak side, you saw how the Sneak orb, you can use it to fix security issues. In this case, we demonstrated an issue in an open source component, but the Sneak orb goes beyond that if you'd like to also scan your containers for vulnerabilities or if you have Terraform, CloudFormation or Kubernetes YAML files, you want to scan for configuration issues, you can do all that with the Sneak orb. And then we showed how you can use CloudSmith to construct that trusted golden repository and to control how artifacts are promoted and declared production ready as part of these workflows. So thank you, Ryan. Thank you, Tom, for helping put together this demonstration. It's been so much fun to put this together with you. I guess we can, before going into the Q&A, just leave our audience with some calls to action. All these offerings, try them. Try them for yourself. Log in to CircleCI, build your delivery pipelines and play with how you can run your tests and integrate your unit functional integration tests like practice your CI. Check out CloudSmith. Build that secure cloud native repository and integrate it into the CircleCI pipeline using both the CloudSmith orb as well as the capabilities that it provides. And of course, also check out the Sneak orb. There's a free account that you can sign up for. It gives you a free scan allowance. You can replay this entire demonstration that we did today with your own applications. For the slides, we have included some additional resources here for the audience. So if you'd like to read a little bit more about what it is that we do, please check out these resources. But with that, I think we're ready to move into any questions that our audience might have from our interactive demonstration. So I'm wondering, have we gotten any? And as a reminder to attendees, you can drop those questions directly into the Q&A section in your Zoom. We must have blown everybody's minds and just in a perfect manner. Yeah, I'm not seeing any questions. Hopefully just got one. What's the difference between CloudSmith and GitHub? Yeah, GitHub. I guess I'm probably best place to take that one. That's a great question. Thanks very much for that. So I guess the primary difference is when it comes to security supply chain type stuff, it's the amount of exposure and the amount of control that you get in order to put mitigating factors in that. So let's take a look even at the examples that we've seen in today's webinar where we're talking about upstream sources and prioritization of those sources. With CloudSmith, you have absolute full control of that. You can create as many of these things as you like. Our repositories are polyglot. In other words, we support more than one format in a single repository, and that enables us to have our customers use our service like we've demonstrated today in a kind of environment by environment basis. And so the usefulness of that is you can have particular permissions for a staging repository completely separate from a production repository. The world's your oyster with it, right? It's ultimately about empowering control of the users of CloudSmith. So the people that are actually going to be uploading packages, the people that are going to be performing operations with those packages, and then once it gets to the south side and it comes to delivery where those things go. So we provide very, very granular controls in order to allow you to access your packages. As we touched on at the end of the webinar presentation, you can create entitlement tokens on a repository by repository basis, and they're very, very powerful. We have customers that use us, some customers, for example, will use us exclusively for internal development purposes, and many others will use us for distribution. Take Font Awesome, for example, who use us exclusively for distribution of their glyphsets. They're massive. They might have used that they come across is obscene. And one of the big challenges that they have is identifying who are the bad actors that are taking the data out of their service, because many times, particularly for distribution pieces, there is the fear that a license key can be repurposed, perhaps shared amongst users, that kind of thing. We give Font Awesome and customers who use the service the full visibility and provenance of what's happening with their software so that they can make the decisions of, okay, well, it's pretty clear that there's something funny going on here. This has been accessed from 100 unique locations. It's been accessed from a thousand different IP addresses, and so it's about empowering users with that element of control. Ultimately, that's the gist of it. But in essence, keeping everything in the same place, giving you the part to control your supply chain through the use of upstreams, through the use of signatures, signing, all that good stuff. That's an in essence set. There's significantly more, but I don't want to talk too much and consume the entire rest of the webinar. By all means, if there's nothing we're talking about here that doesn't resonate or you need more information, please reach out even to me directly if you'd rather not speak to support. Our details are on the slide deck anyway. Okay, so what if we... I think we just got another question from Wolfsman. So how do developers and security folks work together when it comes to alerting there is a vulnerability found in the software, keeping in view the shift left paradigm? So great question. And so this can... New vulnerabilities are disclosed every day. And so just because a pipeline passed today, taking in context, the demo we just showed, our pipeline may have passed right now, but if an hour from now, a vulnerability against that package was disclosed, next time that pipeline executes, we'll be right back to where we were. So how does this turn into action towards the developer? Well, one thing that... And I'll quickly hop back into the circle CI UI for this bit. But one thing that we do to try to make this in a developer workflow is we actually show, and this is the test that passed. So that's not a good one to show. But when it fails, we do demonstrate the fix, how this component was introduced. So right in the CI pipeline, a developer could get alerted because circle CI has webhooks that can report information back to GitHub as pull request checks or as commit checks. So through the form of those checks, a developer can be alerted, yo, something broke in your pipeline. And in the pipeline execution logs, they can then see, ah, and here's what actually cost it. That's one way. Another way is as we saw in the demonstration, it is possible for a sneak to automate the process of opening a pull request that can fix the vulnerability. So it would show right here, this is where we used to have the vulnerability, not anymore. But if we go back to that previous snapshot where we did have the vulnerability, what we saw today in the demonstration was how we opened a pull request. So a security person with access to sneak could potentially open this PR. And since it creates a separate branch, it won't just commit it straight to the master branch. When it creates a separate branch, all a developer has to do is check out that branch and, you know, test it, make sure all the tests work correctly. So in this case, we're helping it become a team exercise. So either the developer finds out because a pipeline failed, or a security person takes a proactive action and opens a pull request on behalf of the developer. So the developer can start verifying that the issues have a fix. Those are two potential ways that it can happen. Now, of course, there's other ways to do it, right? A security person could use the JIRA integration to create a JIRA ticket on behalf of the, you know, for the developer to fix this, or they could just use the alerting functionality within Sneak where if there is a new vulnerability disclosed, it will show you in the UI, hey, there's new vulnerabilities for your projects. So there's a plethora of options for, you know, encouraging that team exercise. Go back here. That was a great question. Any others? We probably have time for one more. While we wait for that last question, you know, Tom, Ryan, it's been an absolute pleasure putting this demonstration together with you. Thanks for, you know, joining forces with us to, you know, to spread the love and share the message for how developers can speed up their delivery cycles while keeping their applications secure. I appreciate it. And getting waffles. It's been a pleasure. Yeah. For those who want to know the true story of that, it was an auto-generated docker image, right? The docker container that started up, and we looked at it and thought, wow, that looks great. Why isn't there a company that exists with this name? So, yeah. One last question from our same newsman. Thank you for the engagement. So how do you see the future of developer security? You know, the future is one where developers are empowered to own more parts of the stack. You know, before there used to be this really clear line of responsibility where developers would write code and pick their open source, and they would then deploy their application into a golden image provided by their operations or IT department. But now with the rise of the cloud, with the rise of containerization, with the propagation of open source, particularly for serverless functions, developers now have more responsibility over the stack. You know, the choice of base image is developer declaring that in their docker file. The infrastructure that's on the cloud is a developer declaring that in Terraform manifest or CloudFormation manifest or Kubernetes YAML files. So before where there used to be this very divided line of what developers did and didn't do, now that infrastructure is becoming part of the application. So the future of developer security is one where developers can confidently use all these new exciting and empowering technologies confidently and securely, where they have the tools needed to manage security themselves. With guardrails set up by their other stakeholders, the security team, their operations team. And, you know, what Tom demonstrated today with CloudSmith is definitely part of that as well, where developer knows where the artifacts they're using are coming from, where, you know, all their artifacts are being promoted and declared production ready. So hopefully that helps. Thank you, Tomas. And big thank you to Tomas again, Ryan and Tom for their time today. And thank you to everyone who joined us for today's webinar. As a reminder, this recording will be on the Linux Foundation YouTube page later today. And we hope to see you at future webinars. Have a wonderful day, everybody. Thank you all. Thanks, everyone.


The study also proved the safety of this process. They found that using PEMF stimulation was safe for the whole six months they needed it. That's a big thumbs up, showing that it not only works but is safe for the folks using it. So, based on all these findings, the researchers are advocating for the use of PEMF stimulation as an extra treatment for those at risk of pseudoarthrosis. It's like a step forward in making spinal health even better, giving us hope for improved surgeries and happier, healthier lives for patients. Speaking of PEMF stimulation, Archie Coil is the most advanced in PEMF technology. These coils use frequency and energy to elevate wellness. Share your thoughts about this new breakthrough with us in the comment section. Follow us for more videos like this.


The following is a presentation of TFNN the Tiger technician hour with your host Basil Chapman call now toll-free at 1-877-927-6648. Hi everyone on this Friday May the 13th Friday we're looking at the dial of 382 points at 32,107 so let me just do this real quickly because it's technical Friday I should go to this chart that I show subscribers subscribers you didn't get this I sent everything out and it came out as three icons that you should have been a scroll down and you saw the charts we sent out an update thank goodness the update was I didn't want to do anything until 840 this morning and that's exactly what we got might have got one particular buy but definitely got another that's up really nicely from the low day is young let me explain what I'm looking at I actually got rid of these things I typed it in I was getting messy but it's so important you know I've got this pattern that I call Roman Chapman we've Roman candle we're talking about that I've spoken about that in the monthly chart of the S&P at the high it's maybe real nervous about that long wick but look at this you see this long green candle this is at the bottom instead of being at the top called the Chapman we've green Roman candle with a tiny little wick and all at the top and a long body and then a green in this case a green body that's half to three quarters of the low we did that once and we had a fabulous rally for about if you had to count the bars it was about two and a half three weeks and then we took it out we plunge from the 33,000 150 January 24th low to 35,000 824 high made an arch formation the dreaded age tumbled down and made a brand-new one on the 24th of February exactly one month later 32,000 272 and that one lasted also quite a while but it only ran up to a peak be the other one went to peak C minus failed this went to a peak beam and then pull back sharpie and then at that spectacular run to 35,372 pulls back sharpie runs up to the high of have I not written that dating I believe it was April the 23rd or so at 35,492 peak E in that cup formation I drawn in the vertical lines to say uh-oh one was strong on the left side the retracement to the new high was weak and we started coming down and then we made another one that I called right there 32,449 in the second of May I said that is what I'm terming a half Chapman wave Roman candle the body was just too too small but everything else was right and if we went halfway into the week on any shorter term basis watch out because we could take out instead we ran up for two days before sneezing went to 34,170 I wonder what that is only time I sneeze is just doing the show 34,000 want my talking maybe that's called because of the filters in the nose the schnoz I don't know whatever happened this is 34,170 it comes tumbling down in a dreaded age pattern and then yesterday we made the same thing with an even smaller body so now I have to call it a quarter Chapman water mini Chapman wave Roman candle the theory here is if we go halfway into the week within one or two days after that week's low in this case 31,000 uh I don't think I updated that did I yes 31,228 yesterday that's very negative but if we can close sharply above the high of yesterday that's really important but it isn't good to do it one day you actually have to do it two out of three sessions so that's the scenario we've got right now and that's the reason why I say to you subscribers that's why we want to position ourselves in a certain way and now we're going to see what happens because all of the technical stuff that I do was based on three potential outcomes over since Wednesday one was that we have a rally a very sharp rally and it fails and then we come back down make a lower low and then Friday that's today there's a rally that fails and we close way off the low it doesn't have to be negative but just way off the low and then the whole new and then it should include the NASDAQ and then you'll get the media just the weekend will be flooded with negativity and Sunday night the futures are down sharply Monday we come in and we get one of those really important lows my thinking here is that too many stocks that I look at that are really important like a Microsoft like an Apple in this is in the big real big cap sector of the Dow are just not I don't think they're ready for the major major low that would see us make the low for the year and then start moving up into new highs I think this is a work in progress so as it stands right now what we're looking at is look at the chart we're going to show you something quite interesting is that we've got the Dow up 382 so off the lows and now let me show you something also even even more interesting within the context of the S&P the weekly chart could in fact turn out to become a red at a low Chapman wave Roman candle now let me explain it in greater detail because this is technical Friday there's nothing much to do unless you've got your positions if some of you got your positions late yesterday afternoon you've still not seen a fantastic rally if you've got positions that you've just started you need to see it sustained throughout the day you see this candle right here at a high all-time high in fact 48 1862 is a tiny wick and a long candle to the downside for the first time it goes to the black 14 period exponential moving average it hasn't been there it hasn't touched it since the breakout of the 20 of May of May of 2020 I would say May 2020 was approximately two years ago and then it breaks it breaks this green 9 period moving average but then it closes the month halfway or just over halfway of the whole entire body I see that's a Chapman wave Roman candle we saw it back in October of I'm sorry yes October of 2007 and that was the hint to say we've now got a cell signal that's pretty much going to go to a cell mode if we take out the wick within two sessions and go even lower while we did that well we did the same thing here so this is the high of January February we form another Chapman wave Roman candle not ideal but pretty close and we go halfway into the wick but close above it in March and then whoosh April we go down we go below and now we've gone even lower so this is the importance of the Chapman wave Roman candle at tops at bottoms they have a different implication there's a difference if it's a green there's a difference if it's a red a green says pushing above says that you've got a moment a green that is at after you've come way off the lows green says something else and now look at this candle the day is young what we're looking at is at 4005 we've come off a low of 3858 just yesterday if the candle if we turn around and this candle closes let me put it this way it negates the whole pattern if we close under 3950 feet all right there's a lot to discuss Basil Chapman Tiger traditions hour got a bunch of questions I want to just finish this up and then we've got a ton of charts to look at oh there's so many things to do let's just see what E-mini is right now E-mini is gone E-A-E-C new legs in the one minute chart I'll be back are you looking for a way to consistently add winning trades to your portfolio Tom O'Brien is here to help Tom O'Brien has been successfully trading markets for over 30 years a frequent contributor to TD Ameritrade Network and CNBC Tom O'Brien founded TFNN over 20 years ago to help educate investors just like you Tom's daily market newsletter Market Insights is published every morning when markets open to give you the competitive informational edge you need to succeed these newsletters are packed full of Tom's advanced technical analysis and are geared to deliver comprehensive strategies for a successful portfolio get Tom O'Brien's newsletter Market Insights today and try all of our products and newsletters 30 days risk-free with our money back guarantee at TFNN.com TFNN educating investors everything in the universe is governed by the Fibonacci sequence this mathematical principle is responsible for everything from the most aesthetically pleasing artwork to patterns in the stock market to stay on top of stock patterns you can take advantage of sign up for the Fibonacci 24 7 newsletter at TFNN.com when you subscribe you'll get a weekly report from veteran day trader Larry Pezzavento on stocks you need to pay attention to and you can trust Larry's analysis after all he's got 45 years experience as a day trader Larry will also provide daily charts videos and data on the key markets that he's tracking expect notifications from Larry on market movement you need to act on at any time first-time subscribers also get a 30-day money back guarantee if you're not satisfied let us know and you'll get a full refund within 30 days of signing up subscribe to the Fibonacci 24 7 newsletter today TFNN.com educating investors sharpening your skills as an investor is like getting better at playing a musical instrument you have to practice sure but you also need excellent instruction from experts at TFNN you'll get advice and guidance from the authority and technical market analysis and it's not just dry tedious text either TFNN airs live financial content streamed live on TFNN.com and TFNN's youtube channel with Tiger TV live every market day from 8 30 a.m to 4 p.m eastern for free each host is an experienced trader and gives their take on the market while taking calls and questions live from around the world from the moment the market opens until the closing bell sounds Tiger TV has eight different shows with expert hosts to help you make the right moves with your money watch online at TFNN.com or on TFNN's youtube channel and become the investor you were born to be TFNN educating investors toll free at 1-877-927-6648 internationally at<PHONE_NUMBER> Hi folks so just let me do this because I did this dude when I was when I saw for Tommy yesterday in his 9 a.m show and then it began at 10 o'clock and I said look at this incredible channel stuck between the like a tube a sloping down tube the price is just stuck there this is the e-mini 10 minute chart and it continued that way in fact after my show which was here it had the big rally and they went right back into the channel and what did it do you remember I spoke about this technique if you want to develop it it's really fine I've got webinars I talk about it I had a number of people saying could you go through these and again well all I do is I take a trend line you've all got trend lines on your software every package has that you might not have arches which is a great shame I'm it's really arch I've divided the arch into I could have it as an arch but I've I've divided into quarters semi on the semicircle that's over here dreaded H pattern and it went to a lower low but look during a time of Brian show as I was listening to Tommy to Tom look four five five times in the 10 minute bars we went into the channel we inside track propellant zone it didn't break down it held it held it held and then it went slightly higher and then it broke out it broke above with the peak B went to the 200 period how important is the 200 period moving average well when I was on my show as I was wrapping up it got right to that at a peak B and failed the winch could be minus at the 200 period moving average went back to the channel we've inside track propellant zone and ran up to a peak B just under the 200 period moving average and remember the closer you get to 200 period moving averages the more important it has both as a magnet and then as a propellant or repellent line well it was a repellent line and then it said I'm done I'm gonna I'm gonna push through and it's stored for four bars and then boom def and then a g and a pulls back and the green line period moving average over the 14 now what we're doing is you see how we've been above the 200 period moving average look how we moving sharply high up 79 at 4006 now the buyers are being forced in because we didn't get the usual smash to the downside hope this is going to be very interesting one the reasons why I'm really hoping that folks might for subscribers I'd say to buy a particular thing and it went to with it it's a high price I mean the price itself is triple digit it went to within pennies so I'm hoping that you said hey I like this the analysis is good you could either missed it by nine cents or you just said this is the area I want to be in but we have got one of them that's doing fabulously right now I'm not complaining I'm just saying I would have liked them both for a couple of reasons that's okay I'm very I'm strict about it I have to call it a miss but I know some of you said we did start the position there and that's great so here we are in leg D in the 10 minute chart I just wanted to go through that now that's enough for this I'm going to get out of that let's go to everything else I want to discuss now the SMB is up 82 points at 4012 so the three scenarios was one that the market just ignores any good news and it just keeps siding down lower highs and low lows low lows the the other one was that we we make some kind of a low that was yesterday and then there's a good response today and instead of sharply pulling back this starts off this kicks off a rally but without what I call the climactic event of the VIX index in this case going above the highs of the the start of the war that was back in the 24th of February where it went to 37.79 I said we have to wait then that means we've got a fabulous rally some of the stocks are going to some of the stocks in the in the the very beaten down like the ARK came I was talking about that yesterday that's the area that's going to see the best response because what happens off a low off the major major turned out there is within minutes you've got a 10 15 20 30 sometimes even a 50 gain and then the gains are start to shrink but they're still strong but they're nothing like the big tops the top start to see smaller and smaller increments percentage wise because they're at a higher price so now what we've got is the VIX index is down in the 29 20s area I'd said that yesterday if the VIX can start to get to the 29 20s that's a much better sign especially in a weekly chart because we want to see weekly charts close lousy on a Friday that's usually a better sign than closing strong like it did three weeks ago so that's number one number two is within the context of what we're looking at let's look at the let's look at ARKK so ARKK is up a four at 4302 it's up 10 percent and basically what we're looking at is the low of 3510 oh I had this drawn and then I had a shutdown so I didn't get the I had this down the another reason why I was really looking at this particular area for subscribers as a potential buy is because it went into the chaplain wave inside which the reason why it's not there right now is that I had a shutdown suddenly yesterday I can't remember it was before my show after my show and I could not I don't know what happened I've had it fixed my man came over and did everything I needed but it froze I couldn't go to file and save I couldn't I couldn't do that I couldn't hit the little save button here I couldn't do it I couldn't do it and it was stuck I could see the prices but I couldn't do anything about changing the screens so I had to shut down unfortunately and I couldn't save so yeah we are the chaplain wave inside track propellant zone the magnies turning up the histograms been improving I like that there was a v-shape remember I think I spoke about yesterday that I'm seeing as the start of a v-shape now what is a v-shape look at this ARKK there's your v-shape in the on balance volume people talk about different indicators they use all sorts of things and I say they're a cut it doesn't work 100 of the time just add it to your to your arsenal of tools because when it when it kicks in look at this top right here when it kicked in this is the February the February on balance volume high of the 12th and a day later it made a top so sorry shouldn't that was of 2021 so the doesn't work all the time let's go to something let's go let's go to QQQ QQQ look at this QQQ there it is this is really it's a nice start but you want a v-shape like that and we haven't got anything like it just yet so that's a saying and now I can go back to my scenarios and the scenarios say that if we don't get that kind of climatic Monday it's almost I wouldn't call it a crash because I there's so much that's been done on the downside I don't see a crash coming at all I see this persistent rotation between the different stocks let's see what Microsoft's doing today MSFT I'm choosing Microsoft because it's a great company it's up six it's up 2.57 let's look at something like what was the guy talking about the other day a firm I mentioned the firm the other I mentioned had had how unbelievably smashed it was so the guy comes on and he's talking about yesterday he's talking about how for everything's going right everything's fantastic famous says no but you've got debt this I don't like the debt I don't like the way the debt's working in guys it's no this is fantastic and that's what I'm saying that you've got to be very selective here there's a rotational aspect to this that says if you want to take advantage of this sector now is the time to subscribe to my gold report the gold report is a comprehensive look at the metal sector as well as the markets that move gold which is the currency and bond markets new subscribers get a 30-day money back guarantee so you have nothing to lose every Monday morning I publish the gold report with coverage of gold silver bonds the XAU hui gdx as well as more than 30 different mining equities to see for yourself the types of profitable trades that are recommended within the gold report sign up now by visiting tfnn.com don't miss out on the next great gold trade sign up today tfnn has just launched their new trading room the tiger zen hosted at discord tfnn has been educating traders for more than 20 years with live programming hosted by a variety of professional traders during market hours and now they are expanding their reach with the tiger's den available to all tigers and tigers for just one dollar for the year there's no catch or added costs when you join our community of traders in the tiger's den you can look over the shoulders of tom o bryan and the other tfnn hosts while they analyze charts during their live tiger tv programs and join an interactive trading community with hundreds of members exchanging ideas interact with other tigers and tigers as they share trading ideas news analysis and discuss the market action all trading day even at night and on the weekends the tiger's den at discord is accessible on mobile or tablets as well so it's always at your reach to sign up today and become a part of this educational community of traders just visit the front page of tfnn.com tfnn is excited about our new software charting program the art of timing the trade charts in collaboration with tom o bryan and using his bestselling book the art of timing the trade your ultimate trading mastery system david white has programmed an outstanding piece of software that will complement any traders methodology using this first of its kind program the art of timing the trade charts allows you to scan thousands of stocks for fibonacci formation setups including gartleys abc's butterflies and much more the art of timing the trade charts is designed to help you when scouring the markets for stocks just beginning to form the trading patterns that many investors spend days weeks or even months searching to find and right now we're offering licenses available at only $79 a month we are so confident that you're going to love this new charting software that will even give you a 30 day unconditional money back guarantee don't miss out on this incredible new piece of software get your copy of the art of timing the trade charts today by visiting tfnn.com this segment is brought to you by think or swim for more information just click the think or swim banner on the front page of tfnn.com folks we're back so now we're going to go through stocks ARKK a lot of people have spoken about this a very nice move of 3.96 at 42.96 is this the end i suspect that i'm going to draw this in that there's going to be some kind of an arch formation as the rotation says ah just for the moment just favor the nasdaq which is just beaten down so i think it can possibly go to the 50 49 53 area that's going to be the big test i would not be surprised if a lot of people start to shorten at that point doesn't break the 35 10 low that was made yesterday for me that's always a big question i always say that they're fighting patterns one is the v shape pattern which would mean that this goes up from here and you've got to start measuring left side to right side etc today's the first day i don't even think i need to do that and the other is so it's two fighting patterns one is the bullish v shape pattern and the other is starting to arch over and make it some kind of a top and how does it do the dreaded age pattern oh for you there's so many new people let me just do this dreaded age pattern where is that there it is dreaded age is right here so i always look at three patterns and i'm going to show you stocks right now we're going to go to them um straight line up straight line down cup formation arch formation mix of one and two or one and three there's one and three this is the dreaded age every one of these is a dreaded age pattern look well look what i can do right here uh dreaded age look there's this even just recently a dreaded age pattern it fails the left side low and goes it can go one to one to the downside which is just done um so uh this is where we start to see histogram has to improve on the on the mag d v shaped in the on balance volume stochastic only at 12 percent by monday or tuesday if this is still rallying towards this just touch the nine the pink nine period moving average if this manages to ready the height today is 43 36 if it doesn't pull back today and it holds at least in the mid range of 41 maybe they can be followed through on on uh tuesday so the monday aspect would have given me a volatility x volatility index probably spiraling over the um april high of the vicks hasn't done that so this is called the semi as far as i'm concerned a semi climactic relief rally uh it's just it's the mini earthquake with off the sharks to come so arc is a nice example of just a nicer bigger picture look at the qqq qq is of 3.17 a r k k is up um 10.49 so if you want to match i i don't know at this particular point whether it's arc i want or just kind of a generic uh like a broader index and maybe buy a multiple of two or three of the index i prefer at this particular point to be sticking to indexes rather than specific stocks unless the specific stocks you've done your homework those are the ones you'd be wanting you grab them and you just write them and see where they go to okay within that context i also decided to get a more conservative account of a biotech stock that's held so well and i've liked it probably should have got it when i wanted it two days or three days ago but i like the action so far and i want to be i i want to mix for subscribers we've got one that's doing really well today uh it's it's not in your usual sector that people talk about another one is um looking at looking at the broader context of what can rally here so within that context i'm just being very selective for subscribers now we can do this because i want to follow through with the questions that came in uh what was that question that i just missed over there yes so hood i had said a long long time ago in my overall analysis of the stock market for the mega big move still to come i think hood that's robin hood will be in play but i'm absolutely totally ignoring it i said for a long time when it hit seven point i think seven seventy yesterday was seven seven seven seventy one and it's up almost 30 today it's up 24 percent from the close of yesterday at 10.66 i'm not ruling this out because it's part of the vernacular that i'm looking at that says to me with so many and i'm going to talk a lot more about this with so many people working at home you remember for those of you around in the dot com dot com uh bubble going from that 1999 late period going to early 2000s do you think anybody did any work at all or do you think they were all looking at uh wherever it is and remember i had my one of my things i was looking at for my big mega cycle was one day there would be stock tickers at McDonald's well in fact there was in in manhattan a couple of them they were they were stock tickers at McDonald's um this is obviously before cell phones and everything it was in the old days hoson wagon um and my suspicion is that there's going to be a mega market somewhere and now we've we're filtering out so many different things it doesn't necessarily have to have the dow but i like the mix of the dow so it could include the dow but it could go into back into crypto it could go into something we haven't even thought of but there's going to be something like the real estate market of 2007 and eight where everywhere you went people i mean if you stood at the you went to the bank you there were three people on their cell phone saying i'm just waiting for a commitment or waiting for to get papers passed we haven't had that that's why this to me is not the big market crash that we're talking about that the end of the world for three years to come or more i think that's still to come and how does it come there are people around the world and i suspect trading in america stocks something in america that are trading from the computers at home so when the big big crash comes nobody knows who was hurt until they see the sales sign you remember the big wall street i've got it somewhere that's that for sale on about the third on the thursday october the 30th i think of 29th of 1929 outside the new york stock exchange there was a guy and he's got his beautiful also beautiful something orders and he's got the sign that says for sale need money for fair for food for family and we will not know until we got all these cars out there saying for sale for sale because it will be so silent you won't know their granny whatever her name is was playing whatever the hot stock is that's what happened in 2000 they used to talk about they used to talk about money going from it was all what was it widows and orphans or something widows and orphans that was for bonds well you saw grannies taking money i remember hearing stories about this in 1990-2000 who had gone from not the conservative aspect of bonds into murk or dividend stocks other dividend stocks and things like that they went straight from bonds into aol all these different different crazy name stocks and used only eyeballs and and said we're doing fantastically we have three million eyeballs four of the four million came from my cousin hitting his eye button over and over so i suspect that there's still something to come and then i think we've got a really look at what happens after that oh well that's a good that's a lovely way to start the friday let's go through this big questions came in so that was hood was mentioned yes i we have not gone into hood i think it's going to be a play i don't know when oh is that is that the bell the bell says get on with the show i'm going to get on this show right now there was a question that i had i didn't see it a devon energy again devon energy right here devon engineer holding very well remember i said that it's holding well it's one of the better ones that the energy helped back 161 are you in the market for buying or selling real estate in the bay area including the surrounding st petersburg tampa and clearwater markets tiger real estate llc is a firm that has extensive experience in the tampa bay area whether you're looking to sell your current property for maximum value or you're in the market for a second home or investment property tiger realty has the experience across all areas of real estate in the tampa bay area to help buyers and sellers make the most informed decisions across all price levels from the price you should be paying per square foot in certain up and coming areas to the type of cash flow investment properties are capable of creating tiger real estate can help you make the best decision when it comes to all areas of the market before you make one of the biggest decisions of your financial future call tiger real estate llc today at<PHONE_NUMBER> or email us at tiger at tfnn.com that's<PHONE_NUMBER> call us today the technology around us is changing every day with so much happening it can seem impossible to keep up with all the information david white's investment newsletter the technology insider is designed to give you all the information you need to understand the technology that shapes today's markets and tomorrow's future david white has made his living staying on the cutting edge of technology his weekly newsletter will give you specific recommendations for value tech stocks as well as entry prices target prices and stops to set for each trade david delivers his weekly newsletters every friday with updates throughout the week you can get the technology insider at tfnn.com for only 37 in 50 cents sign up for david's newsletter the technology insider and get an inside look at everything the technology sector has to offer try it risk-free today with our 30-day money back guarantee tfnn educating investors biotech is booming but for how long whether you think the biotech bull has room to run or has run its course trade labu or labd directions daily s and p biotech three times bull and bear ETFs visit directioninvestments.com slash biotech today an investor should consider the investment objectives risks charges and expenses of the direction shares carefully before investing the prospectus and summary prospectus contain this and other information about direction shares to obtain a prospectus or summary prospectus please contact direction shares at<PHONE_NUMBER> the prospectus or summary prospectus should be read carefully before investing an investment in the funds is subject to risk including the possible loss of principle the funds are designed to be utilized only by sophisticated investors such as traders and active investors distributor four-side fund services LLC don't forget you can listen to tfnn live on your mobile device 24 hours per day go to tfnn.com then hit watch tiger tv that's tfnn.com then hit watch tiger tv so a question came in about xbi xbi is the sdb biotech fund it held the chapter with inside track uh propellant zone beautifully the histogram is improving a little bit the castix lousy at 11 percent and on balance one made a w formation that's good i just think that this is an area that is starting to build some kind of support i'm a little concerned about the biotech other than specific i'd say specific biotech stocks what i'm really looking at in terms of just you know kennel square again massachusetts and cambridge um that whole area cambridge kennel square now it's boston and now they're starting water town they're getting all the peripheral areas they've been building and building my suspicion is that that area is becoming a lot more specific they had that used thing with amgen amgen i think we i drove by it recently i think norwell norwood norwood somewhere around there um but i think that uh it's very specific areas that could work and um what i would do is just look at really good stocks in this environment so i don't want to get carried away here by saying oh this is it this is the i'm saying for sure well first of all i don't know how long i've been talking since november i've been talking about the qqqs being the weakest link of all and then i spoke about it in cell mode in the daily cell mode in the weekly and a cell signal in the at least in the uh in the monthly chart and i've now got a down arrow and that says actually the qqqs on a monthly basis i probably should wait a little bit but they're at least in the cell signal i'm going to sell more designation yet so i i mean how anyway and for subscribers we've got this huge cat one of the biggest cash positions we've had in i don't know forever just a huge cash position traders we've been in and out in and out that's fine we've made them some money we're not that much but it's going with the down market it's good they're making money no i did not have shorts like i should have i just i was so busy concentrating on other things that i did not go to the short side like i should have i mean once or twice but not enough and within that context cash is king there's no question about it at this particular point there's a chance there are just some areas that you can deploy some money to and part of it would be a trading position for at least some kind of follow through it's not the monday scenario that i was looking at this is premature and premature means that you are looking at the chance that this is just another one of those bounces and you have to treat it that way put your stops in etc if it turns out to be even more and you've got a position that's held all the stops and it's going even higher that's a wonderful situation but because of the the vixx index and because of the way we came off the load yesterday and the way we bounced today that's not the kind of climactic load that says to me wow that's the load you just got to really put money to work just wanted to clear that up now the the question is i'm going through the questions here as a matrix as a matrix still for me the big clue this is this is the indicator that we need to follow because so far they none of them are starting to show any sign that says wow now it's time to get into the semiconductor index so until the semiconductor for me shows some kind of some kind of strength that is persistent to making higher highs and higher lows in the weekly not the daily not to say you couldn't get a bi-signal before that i'm just saying in a bigger picture intermediate term this is an area that just says to me at this particular point there's still that chip shortage it's i'm sure that when it finally comes will this create the kind of glut that i've been talking about that's really going to hinder the semiconductor index or there'd be such a backlog that they use up that inventory very quickly i don't know so that's the estimators trading right now up 8.75 at 229 there's a chance that we are forming a cup formation you wonder it went underneath a key number i think it was 220 216 yeah 216 let's see what the low was yesterday 215.23 i know someone out there is watching that 216 level where it went under it and turned up so we'll see if that's going to be a significant moment i'm watching that weekly candle as well because here again this could be a really nice rally but it could be a shorter term rally rather than just just a bounce and failure or a rally that is sustainable all the way into maybe june i don't know yet all right next thing we're looking at numbers so the questions came in i hope i haven't missed anything in the den if you could re retype it i'd appreciate that questions that you had earlier on tesla yep tsl a tesla had a bounce off the low that was made at seven at 693 680 round number low did not see that yesterday 680 round number low i wonder what happened to um nike he also had a round number low um so 680 round number low trading at 768 i would say that an 80 point rally is pretty good 40 points up today at 768 32 this is more a relief rally and this is another thing the clue is that i don't think that the tlt that's sorry the tlt the tesla i think it needs more to the downside um and i'm basing that on the weekly chart because it went underneath the left side low in an h pattern and the weekly the monthly chart is starting to fail so i think tesla's under pressure i don't think it i mean this is probably twitter and and and musk twitter's down in 41.05 i don't want to get i have no intention of getting into that whole thing right now i i had a question someone asked me about twitter why should i hold it because it's it should go to the 54 offer i said i wouldn't touch it it's just too volatile this you can see the dreaded h pattern within the the rectangle formation plunges down weekly chart doesn't look good that's twitter but the question was tesla and i would say relief rally but my suspicion is that tesla still has to test the 60s that's going to be really important to me and if it takes that out 600 with the next level i think the resistance between 807 the 9th period moving average 840 the 14th period moving average and if it gets above that by within a week and a half that if it does it very quickly i'd say that's impressive but if it kind of does it with the kind of draggy movement and it gets to the 888 200 period moving average level i'll have to reassess but i i think there's a lot of resistance out there just got to be real careful even today it's just i i'd say to subscribers treat this once i look peak d in the there it is you wait for your peak d's in the chapter weight methodology there's your peak d in the 10-minute chart and hit a high of uh 4019 round number high in the e-mini just round number in this case it's an e-mini it's not as important as if you're going in in pennies uh we're watching this closely i'll come back again in a moment but let's look at this so that was a question there so tesla as a trade i a dollar did i do the dog did i do all this i don't even remember doji candle and a leg f in the upside in the day the f in the weekly and a c only a c in the monthly and that says it should go even higher in 2022 but in the meantime i think that the dollar is very i've got the rectangle here i think it's very close we started to chop a little bit a little bit here and it can make higher highs but i think that it's China former base because the 102 level is in the absolute character to hold and that will impact gold because gold right now is now strongly down 13 and 18 11 i'll be back and we go all these stocks oh a little bit of a section out of that sharpening your skills as an investor is like getting better at playing a musical instrument you have to practice sure but you also need excellent instruction from experts at tfnn you'll get advice and guidance from the authority and technical market analysis and it's not just dry tedious text either tfnn airs live financial content streamed live on tfnn.com and tfnn's youtube channel with tiger tv live every market day from 8 30 a.m to 4 p.m eastern for free each host is an experienced trader and gives their take on the market while taking calls and questions live from around the world from the moment the market opens until the closing bell sounds tiger tv has eight different shows with expert hosts to help you make the right moves with your money watch online at tfnn.com or on tfnn's youtube channel and become the investor you were born to be tfnn educating investors you might think that if you want to be successful at trading in the stock market you're going to need a crystal ball after all it's impossible to predict the future right like any endeavor in life before you decide it's impossible get some advice from the experts you might find that it's not so impossible after all for daily market overviews that give you direction on the key indices selective stocks and commodities subscribe to the opening call newsletter at tfnn.com the opening call newsletter is written by basil Chapman creator of the trading methodology known as the Chapman wave the Chapman wave up down sequence gives you an edge in identifying price turns finding the peaks and valleys and stock prices get the opening call newsletter by basil Chapman and your inbox every day first time subscribers also get a 30 day money back guarantee if you're not satisfied let us know and you'll get a full refund within 30 days of signing up tfnn.com educating investors with market volatility roaring back in april larry pesevento has just announced a five-hour live trading webinar coming up on may 17 larry pesevento is a 56 year trading veteran and has mastered his trading skills through many different market fluctuations join larry on may 17 as you host a live five-hour trading webinar from 9 a.m to 2 p.m eastern time giving you insight into how he analyzes the market and decides his plays larry will delve deep into the abcd trading pattern explaining how to structure your trading day the times most likely to generate signals which signals to ignore and how to use the pattern to mitigate risk in this all-day five-hour live trading webinar take a seat by larry side as he trades the market's real time including the dow and smp 500 e mini crude oil natural gas gold treasury bonds wheat and soybeans the euro dollar pound dollar dollar yen and more if you've ever wanted to get inside the mind of a market master you cannot miss this live trading webinar to sign up today just visit the front page of tfnn.com this segment is brought to you by think or swim for more information just click the think or swim banner on the front page of tfnn.com hi folks we're back so we got a little dodgy candle round number 105.00 all time a 20 year at least high in the dollar thank you kota for for pointing that out i always have these people looking out for round numbers for me or correcting my notations and this is going to be very important because if there's a bit of a pullback here we might start to see that gold actually sees a little bit of a bid but i don't like the fact that gold took out that low yeah that took out that up channel little mini up channel called the chapwave inside track support level now it's a resistance area so we're going to be watching the next couple of days so let me do this i i i've still got a ton of stocks but there were a lot of things i had to talk about today that were really important at least in the bigger picture so making a low like we did yesterday and then running sharply today is really important it's a good sign and it says yes there is absolutely a relief rally unfolding right now but if you're looking at certain things i don't think that this is the low i just think it's a low and i think it's one of the better lows that we've seen in a while the best would have been if we had a lousy close today and then our horrible news stories over the weekend and terrible selling on monday and by monday off you had about three ten in the afternoon maybe ten to ten to ten to three just as tom's doing this show we get this magnificent turnaround with the vixen the lawyer all that stuff that you'd always like to look at and we start to that would be a much bigger i think rally and longer chair so this is great right now the vixen this is 2955 if a source moved back to 30.75 later today you will see some sell-off but if a source is slight under 29 this means it has some legs to the up the market has some legs to the upside just using the dow as some people use the s and b i'll use the dow 466 if it's if it if if off the 220 to 240 it is only up maybe 270 that's not a good sign but it's if it's holding here we're getting stronger that's for example one of the weekend safety flow because the vent are coming up very sharp have a great weekend see you on Monday