Good morning, everyone. Nothing like Guns N' Roses at 9.45 in the morning. So let's kick this off. Welcome to the jungle. You're at challenge. Build a secure app. So we're going to talk all about the things we can do to build a secure application. We'll make it fun, too. The game originally was supposed to be around the reboot movie, Jumanji. But I was told I couldn't do that. We didn't have permission to do it. So it helped me. I had to go ask ChatGPT for an equivalent, so a coding game that's themed like Jumanji. And this is what it came back with, which was pretty cool. Code Jungle, the secure application quest. Developers must navigate through a treacherous virtual jungle filled with cyber threats, puzzles, and security challenges. And your mission is to write a secure application that can withstand the most cunning of cybersecurity attacks. The fate of the virtual world hangs in the balance. And only by mastering the art of secure coding can they emerge victorious from this adrenaline pumping quest. So I thought that was pretty cool. And it helped me check the box on including AI in my presentation. So all right, a little bit about me. Again, my name is Rob Truesdale. I'm your jungle guide today. I think the Nile was equivalent in the movie. Spent a lot of time in cybersecurity, spanning development work, QA, testing, security engineering. Now I'm in product management at a company called Pangea. You can see some of the skillset that I've worked on in the past. On the personal side, I'm going to pretend outdoor guide. So this was kind of fitting anyhow. And then I'm also learning Snapchat. I had to use Snapchat to make this image. So that's the first time I've ever had to do that. OK, so let's dive in and learn a little bit about the player profile, so yourself. How many in the room just show your hands? Are software engineers that are working on apps for a startup? Raise your hand. OK, awesome. Cool. What about software engineers that are working on enterprise B2B apps? OK, more, yeah. And then software engineers that are working on more consumer-facing apps. OK, great. So now that we haven't understand the players, let's talk a little bit about the instructions. So this is something you can Google around about. Jen Easterly, who's the director of the Cyber Security and Infrastructure Security Agency, along with the FBI, the NSA, and six other countries, have published guidance on how to build more secure applications. The campaign that they're building is trying to influence software builders to take security much more seriously and embed security directly into their application rather than putting security or the obligation of security onto the people deploying the tech or the users using the tech. So you can Google around and look at this paper. I definitely recommend it. They talk about a wide variety of things, spanning from memory-safe programming languages to SBOM analysis and code scanning to deployment tactics all the way to and what's highlighted in the red box, secure software components. That's what this game is going to revolve around today. What are the components that you all can put into your application to help you build a more secure experience for your users and secure your application? Now, some interesting findings throughout this game are the journey of building a secure application. At Pangea, we did some research with a partner group, the Enterprise Security Group, and surveyed thousands of developers about their perspective and relationship and tactics when it comes to security. And what came out of that research was pretty interesting and I don't know if this is something that any of you have thought about or encountered, but the stats are interesting. 76% of apps that these developers were working on interact with personally identifiable information in some way. So that includes things like financial information, health information, social security numbers, really anything that could identify an individual. So that's somewhat alarming, meaning we have to do the right things as application developers to make sure we're handling that the right way. More stats. 80% of developers admit to submitting insecure or non-compliant code due to the pressure to innovate. So we all know the name of the game. It's more features. How do we get more features faster to either satisfy a customer need or deliver a better user experience? And so feature delivery tends to be the number one priority. And this research shows that. Now the challenge that we run into with that are how do we do that while maintaining a high standard of security? There are ways that we can do that. We'll cover that in a few slides. 84% of developers say the security team is a hindrance that they try to avoid, right? So this is the classic tug of war where I think there's some people who have the perspective that security teams could hinder innovation or hinder business. Really, that's a mindset that's changing in the security space where they're becoming more business enablers and they are somebody who slows it down. But developers have this perspective, right? And it's, whether it's true or not, they believe that. So what are the things that can be done to help that? And then lastly, 76% of developers say that their security team views them as a vulnerability, which is a major problem. So we wanna fix that. And this is our guide in how we're going to do it. So a classic jungle map that we'll use to kind of step through how we would build an application that would help relieve some of those stats that we talked about. So it's gonna start with authentication and we move to authorization, secure audit logging, encryption and secrets, management, proper data handling for PII, file storage and sharing, and then lastly, threat intelligence. So we're gonna step through each of these in our maze to escape this jungle. So first, the power pack in secure authentication, what are the capabilities? And we'll hit select on our Nintendo controller to pull that up for anybody who remembers that gaming console. But it starts with authentication. And I think all of you are very aware of that. We're at Octane's Developer Day, so you're familiar with Octa and or Ops Zero. So authentication, a lot of you probably know these capabilities, right? We want web authentication, access to that at least, pass keys, social auth with OIDC and OAuth, magic links, these are all the different things that really we want to make sure are available to us to use within authentication. Passwords are listed last. Of course, if there are passwords, we want complex password enforcement, but I'm even seeing a lot of modern authentication implementations that are disabling passwords by default and almost forcing you to override that if you wanna use them. So these are the things that are just like natively capable that we should be using. Now, how do we score points? How do we score bonus points? Like particularly with that security team, what are the things that we can do as app developers within authentication to make this even better?  So when you have a user registration, let's look at that user, let's look at that user account, the email address, the password that they're using, if they're using one, and try to identify if this is an account that's being abused. Doing things like IP reputation check on the origin IP that that user is coming in from. Doing geolocation checks. Doing domain checks on the email that's being registered. So all of these are things that are available to developers via APIs that you can embed within your authentication experience to score those bonus points on the security side. Other things, like so there's a bonus plus plus thinking like legal counsel. Having geo-based user pools to align with things like GDPR, ensuring that privacy policy in terms of service acceptance is included in your auth flow. These are all things that you should be considering when you're thinking through authentication. Now a game hint for developers, don't roll your own authentication. I've talked to a few startups who have gone down that path and it's like why do that? You don't need to. There are so many options out there for authentication, whether it's Auth0 or other vendors or open source. Pangea one as well that you could use. But nevertheless, you don't have to roll your own. It's non-differentiating. Spend your engineering cycles on things that actually deliver value for the application that you're building and focus on integrating an existing auth and solution and add these security features on top. Now authorization, a word on this. The key capabilities that you should have available when you are examining authorization in your app. We have role-based access control, which is something that we're familiar with with most apps. There's also relationship-based access control and attribute-based access control, which are for fine-grained access. And this is a bit of a cheat sheet for you that kind of breaks down the differences between the two if you're new to authorization. So RBAC is on the way right-hand side. That is your classic, more coarse-grained access controls. And some of the problems that lie within RBAC are when you try to get fine-grained access controls, you get this rule explosion problem, which becomes difficult to manage and creates some performance challenges. So the response to that are RE-BAC, relationship-based as well as A-BAC. RE-BAC is really based on a framework called Google's Anzabar authored by Google. And if you've ever shared a file in Google Drive, which I'm pretty sure 100% of us have, that is relationship-based access control. So you have a user, you have a relation, and you have a resource, and then a accept-and-i. So that's really the foundation of what's called RE-BAC, relationship-based. And then A-BAC is really kind of giving you the opportunity of the catch-all in access controls where you can take not only things like ownership or relationship to a file, but also other attributes about that particular user or file, including things like time of day access, a tenure at a company, what organizational group are they in? What are the attributes of the file? What's the originating IP address that you're trying to access a file from? All of these things can be, I should say, taken into consideration when attribute-based access control are in play. So what are the things that we can do to score points? Let's look at, again, the originating IP address, what's its location, what's its reputation score? What type of profile is associated with that IP address? Is it associated with a VPN or a proxy? We can look at those things when we're using something like attribute-based access controls to decide whether we want to permit a particular activity or not. I mentioned time of day access and user profile information already. We want to make sure that we're audit logging any policy updates, and we're going to talk about audit logging next, but these are the things that, again, score points when we're thinking about securing an application or building security inside of an application. Additional hints, and you're going to hear this as a recurring theme, don't roll your own on Z. Don't build your own authorization. I know I've, again, talked to several companies that have built their own apps from the ground up, and everybody who's in that R-back mindset, when they start to look at other, was just say, attributes that they want to start applying permissioning to, they get stuck very quickly, or they used to, and they said, okay, we're going to have to build our own to manage this. There are so many options that are out there that you can take a look at that are commercial, open source, that allow you to integrate an authorization solution via API versus building your own. So the next step in the game, secure audit logging. And this one is probably the most overlooked or the one that will say attracts the least amount of attention from a developer because people think of audit logging, they just think, okay, I'm going to create an event and ship it off somewhere. But there's a lot more that goes into audit logging that developers should be aware of. There are things like tamper proofing. Are we digitally signing our logs? What type of schemas do we have for audit logging? Are we applying encryption? Do we have multi-tenancy support? So these are the key capabilities in that video game power pack we should be thinking about with secure audit logging. Now, how do we score points from a security perspective? Not only is it about logging the right events, but it's also about coordinating with the security team on what events they'd want to see and also what log format would they want to see it in? And can we standardize that across all of our applications? Again, referencing other applications or companies that we've talked to, we find that particularly those that have many apps across a portfolio, they'll build a capability like secure audit log in a very snowflake type way or a unique way for that particular app. And then the next group builds their own audit log, unique for that app. And then the next group builds their own audit log, unique for that app. And all of a sudden you have five or 10 different implementations of the same capability that are all logging things a different way. And there's a lack of uniformity. And not only that, but wasted development time in building that and maintaining it. So, working with the security team to understand what type of schema and what events to log are very important. Also, doing things like redacting PII is important to consider as well where we're storing events about customers or your users. And sometimes there's particular information at an event that you don't wanna be responsible for holding on to. You don't want social security numbers in your audit logs. That becomes a liability for you. So, being able to intercept that data and cleanse it before committing to your audit log is also a great bonus. I mentioned in the last two, and I'll mention again, don't roll your own audit log. You can get these capabilities and integrate via API very easily and save yourself a lot of time and maintenance on building your own. Look for providers that have that. Take it seriously, audit logging, particularly when it comes to ensuring that those audit logs are not tampered with and are secured after you've created the log are very important. The classic move by attackers, which again we probably all know, but attackers are gonna try to cover their tracks. When somebody is manipulating your app or manipulating data or doing something nefarious, the first place they're going to go are the audit trail and try to cover their tracks or augment those audit logs. So, having things like tamper-proofing capability and encryption and digital signatures are very, very important. And it's very easy to get these things now. This is not something you have to build yourself. Okay, next, encryption and secrets. This is our fourth kind of step in navigating this maze. Use a vault that's stating the obvious, but we need to make sure that our secrets and keys are all securely stored and managed the right way. So we need to make sure that we can revoke those secrets. We need to make sure that we have rotation policies and version history. All of these things are important. And if you're rolling your own vault, these are difficult things to do because you're just thinking about how do I generate a key? How do I generate a secret and get going? But there's a lot of things that need to happen after you generate that. Again, back to things like rotation, version history and revoking them. So bonus points. How do we think like a security pro when it comes to these things? We want to make sure that our vault supports things like automated and manual rotation. We wanna make sure that we can support short-lived secrets. Short-lived secrets are great to use, but they're difficult to manage if you don't have the right system in place to manage them and provision and retire them. We wanna make sure that we have secure audit log integration involved with this as well so that when we're making changes to any of these, we're audit logging that activity. We want strong access control policies. So you can see how these start to weave on top of each other. Authorization involved with vault. Secure audit log involved with vault. So all of these are very important to consider when you are thinking about how to manage secrets and keys within your app. And then again, the engineering hint, don't roll your own. Let's find one and use it so that you can spend your time writing apps that are differentiating. Okay, the fifth of these seven challenges, data handling. And I talked about this a little bit on the audit log side and the stats about handling PII inside of your application. It's going to happen. So being able to first identify what that information is is very important and then optionally redact it. And it's, it is an option but we find that most people decide, yes, like we want to redact. So behavioral, it's almost 100% of the time but it's an option. And then there's different variants of redacting. Do you redact on write? Do you redact on read? These are things to take into consideration. But it all starts with let's identify that PII and make sure that we're handling it the right way. So I mentioned already the audit log example. This is a very important one. So when we want to think like a security pro and make sure that we are handling data the right way, let's make sure we're not storing this information in our audit logs. Also, when we are redacting, what type of text do we want to replace that PII with? A lot of times you can just have a general string that just says data redacted or you can have hash based replacement methods and what's nice about that and why security teams like it are, while you can't identify what that information is, you can identify patterns and repeat instances occurring. So this is particularly useful for things like IP addresses. Again, you wouldn't be able to identify the IP address but you could identify that there is something happening over and over and over again from that same source. So hash based replacement methods are great to use. Thinking like legal counsel using location based redaction, so understanding is this an EU based user? If it is, then I have to apply very specific redaction policies against any data that I'm encountering. So again, there are APIs that are out there in services to help you with this and something we need to make sure that we're considering when we're building a secure app. The sixth challenge, file store and file share. Not every application is exchanging files but many apps do. So we need to make sure that we have robust access controls, we have sharing links, make sure that we have highly secure access to those shares. So things like multi-factor auth being enabled, password protection perhaps, having link expiration, access counts. These are all the things when you're exchanging a file, it's much more than just let me throw a file in S3 and give you a link or something like that. We have to take these things into consideration so that our shares aren't being abused for malware distribution. So thinking like a security pro from a developer perspective. Again, audit logging, very important. So all of our file share operations, we wanna make sure we audit log. Doing security checks on these shares. So the incoming IP address who wants to engage in a share, let's run reputation checks on those. The user, let's run user reputation checks or user credential checks on that user and understand if this is coming from an account that's being used for abuse. Let's make sure we have very solid fine-grained access controls on these shares and let's incorporate things like content disarm and reconstruct on the files to really try to prevent or mitigate the risk of people sharing malware through our shares. So other game hints for you. Account sharing for files across users inside of your user pool as well as external users. So you could have, there's a great example that we've talked about inside our company using State Farm, like an insurance agency or any insurance agency for that matter where you have an agent who's an internal employee working on a particular incident and you have external users, the customers of that insurance agency and then you have legal experts inside of the agency. So there's a lot of different stakeholders in a scenario like that that could be sharing the same files. So being able to have the flexibility to have a file share capability in code that can look at your internal employee user pool and how it interacts with shares along with external users is very important and still layering on these security features like access counts, password protection, reputation checks on incoming share requests. All of those things are important to consider when you are looking at exchanging files inside of your app. Okay, so the last one, the last challenge, threat intelligence. So what are the tools that we have or the capabilities inside of the game? We have IP intelligence, we have domain intelligence, file intelligence, scanning, user intelligence, and there's a few others that you can see on the slide. A lot of developers are aware of these tools that are out there but don't necessarily have access to them very easily at least in a way to incorporate inside of their application. When you go to the security side of the house, these are tools that are in their back pocket that they use on an hourly basis. But now what we can do with the right APIs that expose these or start to bring them into the application itself. So ways that you can use this and think like a security pro as you're writing your application are every touch point that you have with a user or with a file or with a domain, you can attach these type of lookups via code and hit an IP reputation lookup or a domain reputation lookup. Again, there are APIs for these that make it really easy. When you have a suspicious result, so if you run an IP reputation check on an incoming IP and you see that it has a malicious score of 100 out of a range of zero to 100, that is incredibly suspicious, right? So we're gonna want to prevent any activity that we can inside of that. We're going to want to make sure that we audit log that and also communicate that to our security team. When you start doing those type of things now, it's making your app not only more secure but it's becoming a great teammate with your counterpart on the security side as well. And it starts to alleviate some of those stats that we talked about before where, excuse me, developers feel like they're seen as a vulnerability to their security team. So we can correct that by using those same tools that they use inside of our app in runtime code. So that's the guide of getting out of that jungle, right? And getting us closer to building more secure applications. You could do a two hour talk on any single one of those topics. This was just meant to kind of show you at a high level the things that are available and out there that you can use in your code. Now, what this really points at, and this is what what Pangea is really focused on are this mindset shift of shifting security left of left. So we've, so most of you have heard of the whole notion of shifting security left, which means instead of or in addition to deploying security in the production level and operation side, how do we move security left into that or further left into that development cycle and start doing things like integration testing, static code analysis, dynamic testing, SBOM analysis, that's all occurring in that integration and testing phase. What we look at are, can we go even further left? And can we start providing components and APIs that developers can use while they're writing and designing their code? So these are capabilities that would go directly in line to the application runtime code. And these are the collection of services that we build and make available to developers. We have secure audit logging, secure object storage, a vault, all the threat intelligence APIs, and I'm not gonna read everything that's on this slide, but the idea are how do we bring all of those capabilities that I just walked through in that kind of maze to escape the jungle, but make them accessible via API to developers. So these are available, you can go up to Pangea.cloud, check them out and start building security directly into your application. So to close, a few things that you can take away and maybe try for yourself or read on your own. The first QR code there is a link to Pangea.cloud and there's a code there, it's Octane 2023. You can get $20 in free credit on the platform and use those APIs. I think it's a $5 freemium credit that you get in addition to that and that replenishes itself over time. So if you use it, you always get restocked and replenished to $5, but if you wanted more than that, if you're starting to really kick the tires with some of these APIs and you want more credits, there's a code that you can use there to redeem more. Our documentation, everything's open, you don't have to sign up to go check out the docs or anything like that. The QR code is there, so everything is, again, API-driven, so the API docs, the SDK docs are all up there. There's a link to our GitHub as well, so lots of sample applications that demonstrate some of the things that we talked about today. And then we have a secure by design education hub, so if you wanted to learn more about these topics, I mentioned that you could do a two-hour talk on every single one of these and I covered it in two minutes, so I didn't really do its justice, but hopefully it gives you an idea and you can go research more on our education hub. But I think for everyone, again, I encourage you to check out the platform, check out the APIs, there's free credits there for you to use. If you have questions, we have a Slack community that you can go to, it's called Pangea Builders. You can Google for that and discover that or go on our website and link to it. And if you have questions, you can reach out to me on Slack, you can reach out to me over email, robitpangea.cloud, and we're here to help. So I think that's it. If you have questions, I'm going to be out in the hallway there and we can talk more about any one of these services or other services that you have in mind and how you could use them. So thanks for your time and we'll talk to you in the hall. Thanks.


All right. Hey, everybody. I'm here. I'm actually excited about this. So for those of you who don't know me, which should be the vast majority, I'm Surma. And at this point, it shouldn't really surprise you that I work for Google in London. So as Matt just said, I kind of wanted to piggyback off of the slogan that you have heard multiple times today. And you will probably hear a few more times today. And I'm sorry about that. But most of the time, it's true. And we used that slogan also already excessively at Google I.O. this year, where we announced Polymer 1.0. And I was in the audience. And I was thinking, but what if there isn't? And since I thought it's probably a safe assumption to make, but I'm not the only one with that question, I thought I'd use this opportunity in particular the Polymer Summit to write an element with you. Something that shows like a few little tricks, some design patterns that will make you write an element that integrates well with the rest of the elements that are already out there so that you will have a good app. So as I said, with Polymer 1.0, we also announced the catalog at Google I.O. By now, there's actually more catalogs out there that you can just find and have like collections of elements. But for us, we have these collections of collections, to be exact, that solve multiple use cases that you will encounter when you're writing your apps. So we have wrapped most of the client-side APIs. If you're looking for a server-side API, chances are a little bit slimmer, but they're steadily growing over time. And especially for Google APIs, we have basically elementized all of them. And I think elementized is a word now. We've gained, obviously, a lot of experience while writing these elements in terms of what kind of patterns they are. And we discovered a few practices, and that's what I want to share with you. However, I want to be clear that what I'm saying and what I'm going to be saying are patterns that are not untouchable just because we are Google. These are things that we've found to be working well. But Polymer 1.0 is still kind of new, so things will evolve and be trashed and maybe be deprecated at some point in terms of patterns. And the new ones will come up at some point. So here's an example of what we're going to look at today. This scenario is pretty clear. You have an API, but you don't have a specific element. So the question is, what you're going to do? So this could be like some third-party API. This could be the API of your very own startup, and you thought about wrapping this. And this is something you might be asking, why would I want to wrap the API in an element in the first place? And this is something where actually web components already shine because they give you the ability to turn something like an API which you would usually lose programmatically into something that you use declaratively. And that is a really powerful concept. It gives you a toolkit. It gives you a common vocabulary to talk about what you actually want to do and gives you the ability to be composable, something that Kevin already talked about very much. It also something that's really nice is that it gives you the ability to do refactoring because you're literally moving elements around, either from one element to another or just inside one element. So Polymer is really standing on the shoulders of giants. You're namely web components and all the other web standards that we're actually combining under the hood. So I hope I've convinced you that you do want to write an element for your API. Now the question is, how do you do that? The main goal usually is to hide the complexity but still make it available to the developer if he wants to. And how you do achieve that is usually by using two-way bindings excessively.  And I'm going to show you how this works. But even for APIs, we have elements to talk to in a generic way. We have seen before that there's an IronAJAX element, something that turns vanilla XHR request into a Polymer kind of thing. And we have even more of these kind of generic elements in the catalog. So before you start, always take a look at our and all the other catalogs if there's something in there that you want to combine into a new element because composing is really the main thing to do. So I thought for this talk, I would use a website that we all know and love and probably use every day, which is Reddit. And there is no element for that. I just said that actually. So we're going to build what you're seeing right now together. So this is straight up just off-the-shelf elements. This is a paper input. It's paper radio buttons. It's a HTML5 standard list. And we're just composing these into an app that will allow us to list the current entries in a certain subreddit. So everything is there except for one element. And that is how we actually get the data, our connection to the Reddit API. I will use Reddit's JSONP API for multiple reasons. Once, for once, it allows us to avoid the course issue. It forces me to stay read-only for this talk. Otherwise, this would not be a 20-minute talk. And also, we already saw IronAgeX before. And this will actually utilize another element from the catalog. So this will be the app. This will be the app that uses the element that we are going to write. It looks kind of overwhelming right now. But I hope at the end that this will kind of make a lot of sense to you. So don't try to read it just now. As I said, it's all off-the-shelf elements except for the Reddit API element, which is what we are going to focus on right now. So the use, it should be kind of obvious to you, I hope. It takes a subreddit as a string. And it takes a sorting as a string. So you can decide if you want to see the hot topics, the new topics, or the controversial ones. And via the post attribute, it spits out an array of the posts that are actually in the subreddit according to the sorting. That was usage. Now let's start implementing. As we've said before, and I think Rob said that, it is kind of weird to think about having elements in your code that don't render. But for API elements, it would actually be confusing if they did. So a rule of thumb is if you actually have an element for an API, don't put any visual content in there. Just have it as an element that you take a reference to, and that's it, no more. And you can see here a very slight version of composing. We are using another iron element inside our own. And this is the ironJSMP library element. This element is great because it makes ironJSMP weirdness into something that feels kind of all right, even though it's still JSONP. So for example, this element takes, via the library URL property or attribute, it actually takes the URL to load and takes care of generating a unique callback name for you. So you can even fire off multiple requests concurrently with that element and don't have to worry about these different requests interfering because each request will get its unique callback, which is really good. Also note that we are actually binding the library URL to a property called request URL. This is actually, I think, the most important property of our own element, but we're going to get to that in just a minute. Let's look at the other properties first because they're actually really simple. So the first one is the subreddit property. It's obviously a string. I'm using reflectToAttribute, but note that reflectToAttribute has to be used with care because what it does is it actually deserializes the actual value to the DOM and deserializes it if you're actually going to use it. So this can be really slow, especially if you do it often or if the value is actually huge if it's like a huge JSON object. So for example, I will not be using reflectToAttribute on the post property because that would make everything look ridiculous. Also in this particular instance, I like using reflectToAttribute because it gives you the ability to look at the current value in the DOM inspector of your browser. Also a reason why it would look really weird on post because that would be like a huge JSON string in the middle of your API inspector. But since we're writing an API element right now, it's safe to do reflectToAttribute because these API elements are usually only used once on a single page. Notify has been introduced multiple times before. This is just there. So we have it available for two-way binding. And as I said, two-way binding is what we are going to use a lot because it's really, really powerful. Sorting, exact same thing. Post is the first property that's actually a little bit different. First of all, it's obviously an array, not a string. So we are having a different type here. I also declared readOnly. As I said, this element is going to be readOnly. You will not be able to post something to read it by appending to the post attribute or something. And also, what's really interesting is that posts will, on the side, generate a setter function that is called underscoreSetPosts. So we can set the value, obviously, but from the outside, if you assign to the post property, it will actually raise an error and you know you will have done something wrong. I also added a default value just to make sure and notify again for the two-way bindings. There's actually a fourth property that I didn't talk about because it's not really important, but I did add it, which I call base URL. So technically, this Reddit API element is going to be able to talk to your private hosting of it if you have something like that. But the default value obviously uses the official API endpoint of the front page of the web that we all know. Let's get to request URL because this is where it's actually going to get interesting. Request URL is, as I said, bound to the library URL of our JSONP element. So it's supposed to have the value of the endpoint where the JSONP request is supposed to be sent to. And as you can see here, it's actually a computed property. So what that means is that we're declaring, or we're saying, use this function to actually calculate the value of this property. And these are the parameters that the value depends on. And then Polymer does something great. It takes care for us of the fact that whenever any of these properties change, it will automatically reevaluate this function. And the request URL property will assume the return value of that function. This is the function that is going to be called. It just effectively concatenates all these different attributes. It also appends the percent callback percent placeholder. That is a predefined placeholder of the JSONP element. And it will be replaced by the uniquely generated name for the callback. And what this means is whenever any of these attributes change, the URL will be recomputed. It will be immediately passed on to the JSONP element. And this will, in turn, mean that this request will immediately get fired off, and it will get new data. So we have just written an element that is completely event-driven without us ever touching the explicit event infrastructure. So whenever the user changes, like clicks on one of the radio buttons or changes to separate name, immediately data will get reloaded, and you will immediately see the new posts on the app that we have written. So as a last thing to look at is just the event handler new data that we are using just there. And that's actually pretty boring. The data that we get back from Reddit is huge. It's exhaustive, so I'm just mapping over the post and taking out the title and the link, because that's all we need. And then I'm using the previously mentioned set posts function to set the value of our read-only posts attribute. So let's get back to the app that I mentioned earlier. It's still kind of overwhelming, but now we know all the elements because everything else is off the shelf, as I said. So let's look at this step by step. So first of all, we have the paper input. We have introduced paper input before, and we know that we actually don't need to do the colon, colon trick that Kevin mentioned, and I'm doing it anyway for a simple reason because I'm not listening to the value changed event but to the change event, which is a DOM native event. I'm doing that because if I left that out, every key press would have emitted an event and our DOM would look like this. Every key press would fire off a JSONP event, and we don't want that. By rebinding this value to the change event, I'm effectively waiting for the user to click somewhere else outside the element, then the input field will emit, I have changed my value only once, and then we will fire off the JSONP request. So we will only have one request on the bottom line. The next element that we have is our radio group. It's straight up a radio group with radio buttons. I actually just wanted to excuse to use emoji in my slides. It's just one of three sortings, pretty straight up. And lastly, and this is probably the most interesting part of this front end part of the app, is a DOM repeat. We are using the right API to give us the posts two-way binding and passing that in as a one-way binding to the DOM repeat. So we are using this to render all of the titles of the posts in the current subreddit and we'll link to the posts by using an anchor tag. And now suddenly this should not look as complicated anymore. You should actually kind of see what's going on. It's kind of straightforward. So to summarize, we actually just built an app that reacts immediately to user changes without having to do any bookkeeping of our own. And this is one of the powers of two-way bindings, no extra wiring required. So as a last thing, I wanted to go to the Platinum Elements. Matt just talked about a lot of them, but he talked about the usage. When I looked at them, especially at the server-searcher elements, I was kind of amazed. If you know the browser-level API of server-searcher, you know that it can get kind of weird. And then I looked at the Platinum Server-searcher elements and it was just like magic voodoo. I did not understand how it would be possible to wrap this weird API that is used outside your main thread into an HTML declarative-style thing that is in the main JavaScript thread. And once I looked into the implementation, I actually realized it's a really, really nice pattern to hide complexity, but still give you the ability to go through the veils and actually do everything you need to do if you wanted to. So this is the server-searcher register element. It registers a server-searcher for you, pretty straightforward. You can hook up to events to get notifications about when the server-searcher has been successfully installed or when it's been updated or when it's failed so you can react appropriately. You can influence the registering process itself, but you can't really do anything else with the register element alone. You can say, please cache these files or please call this JavaScript function when a certain request is being fired. So as an example, I used import script and fetch. These are two elements that you can use inside the register element. You can put them as children to the register element and basically say import the script for me and execute it inside the server-searcher and then you can say, please call this handler whenever a request from the web page is being made matching this pattern. And this handler would have been defined in one of these scripts that you imported earlier with the import script tag. You can also already see a little bit of synergy there. So the question is, how does this work? How does this communicate with the service worker and that you can actually kind of modify this? It's complicated, but that's the point, right? You re-hide the complexity for you. So I'm gonna explain to you now how it works and it's gonna be a little bit unwieldy, but in the end, it's just about this pattern of using children elements. So the first thing that this register element does is it iterates over its own children. So it looks on all its children and checks if the element has underscore get parameters function. And if that's the case, it's gonna call that function and expect this function to return a promise and it collects all these promises in an array. In the next step, it's gonna wait for all these promises to resolve, expects each promise to resolve to an object and then merge these objects together into a huge object. This object in the end will kind of be a description of what you want the service worker to do in adjacent object notation, so to speak. This object in the next step will then be URL encoded in a stable matter and then used as a query part on the navigator.serviceworker.register call when calling a service worker script that we provide from the SW toolbox that Google published a while ago. In case I lost you, that's fine, but that's kind of the point. This is really complex. The way we try to shove data from the main site to the service worker site, we have to jump through a lot of hoops to make that working, but you don't have to worry about that because it's all encapsulated in both the register element and in the children element that you can arrange inside and use multiple times. So you're actually really just declaring what the service worker is supposed to do. And if you ever find yourself that you have to write something really complex and you wanna write an element, try to break individual subparts into sub-elements that you can use inside, which is a really nice parent to actually make it reasonable to you and can be able to give your team maybe a way to talk about this without going nuts. Also, to be honest, the code on the slides right now is already simplified by me. The code is even more complicated in the repo because we have a few corner cases we have to catch. So in any case, if you're interested, I encourage you to actually look at the code because it's really, really good. And I have a few more links for you that give, I think, a really good introduction on how to write elements, that you just look at the code and see what they're doing. They're usually very readable and they have been field tested so you know that they will work. And just to make something clear, this is really just the tip of the iceberg. Polymer 1.0 or Polymer 1.1 is still kind of new. We know about elements. We don't know that much about apps. Things are still changing and evolving. There will be new parents coming up. They're probably gonna be better than something that we're doing right now. So jump in and let us know how you're solving problems we're really interested to see. If you have questions, hit me up on Twitter. I'll be around, I will be around, especially in the Colab area, so swing by there and thank you for your attention.


Hey guys Matt Beck from freesaloneducation.com and I want to invite all of you guys to come hang out with us in Orlando, Florida This weekend at Premier Orlando We're gonna be hanging out at the Millennium Systems International booth all day doing interviews with cool hairdressers From all over the place whether they're famous or not We're gonna interview them and we're also giving away a lot of cool stuff We got some new buttons that we're giving away so stop by say hi We'd love to meet all of you and a little secret It's not really a secret if you watch us But we're giving away some cutting stools from Minerva because Minerva Beauty is awesome So check them out on MinervaBeauty.com, but these are hundred and fifty dollar Salon cutting stools I sit on every day and I love so make sure you stop by our booth You could get some cool stuff and you get to meet us and it would be a great time to hang out So check us out freesaloneducation.com. We'll see you in Orlando


I see theology as a matter of life and death. It's an urgent thing. I grew up hearing my mom say that the theology is healthy and the theology is sick. Theology that is whole brings wholeness and theology that is sick brings sickness. For me, the litmus test for all theology is whether it brings life or death. Does your theology bring life or does it maintain and reproduce the structures that are killing people around us?


She's going to turn $424 into $6,000 to $10,000 offer finally settled on 215 paid a dollar for it at the Benz. Hey Bolo Buddies, thanks for watching. All right, in this video, we're going to talk about big money Bolo's items to be on the lookout for items you can buy low and sell for a profit. I'm going to tell you where they got it, what they paid for it and what it sold for. These Bolo items come from my Bolo Buddies Facebook group. I posted this in the group, share your best June Bolo and members of the group, the Facebook group, which looks like this, share their Bolo's. If you're not in the Facebook group, there is my link tree down below. You can click on that and it will take you into all my links and it will say Facebook and you guys can go over and join. So if you want to share Bolo, awesome. If not, no worries. Let's talk about these big money Bolo's figs scrub set. Never heard of it. I love it when you guys post your clothing Bolo's because that's not something that I typically talk about a lot on my channel. So it's good to know. This is figs scrub technical collection women's two piece set jogger. It's scrubs paid 15 at a local yard sale bought four pairs three weeks ago to have sold buyer paid 64 49 with free shipping which cost me $8 and 30 cents in a padded flat rate. So about 47 profit. I usually charge shipping but wanted to see if they sold fast and free, but three of these at 303 from VV what's VV they all sold for 300 at different times. It is a teacher program for kids with the workbooks and answer booklet VV not sure what that is reading lab series. Yeah, definitely a Bolo 300 bucks. I started my journey at the first of the year. Wow. I took a gamble at an estate sale and pick this setup for $8 so crazy. The first of the year like just a brand new reseller. So you guys in the Facebook group there are people who are brand new to reselling and people who have been reselling for a very, very long time. So you are definitely going to learn so much started my journey at the first of the year. I took a gamble on this at an estate sale and pick this setup for $8. I hadn't invested that much in one item before sold in a day and a half for $75. It's a Sierra glasses pitcher black 22 karat gold coin seven piece set rocks whiskey Bob Wollick. I'm going to tell you much props for grabbing a breakable and being so early in your reselling career. That's crazy. Found this vintage batgammon set at a local garage sale in a box of free stuff. Cost of goods was zero and sold for an offer of 110 took about a month to sell. Very happy with that profit. Yes, but it is Bakelite. So I probably would have put that up for auction. Anytime you find a vintage game that has Bakelite, I would do an auction. I cannot believe you got that in the free box. Congratulations. This is what it looks like. Paid $20 for a bag of Calico critters items that came with a dollhouse. I almost left the house behind. But remembered Courtney takes them apart and sells the pieces. So I brought it home and started taking it apart. When I saw that this house was rare and sells for 150, I had to put it back together. It all sold on auction for $199.99. Yeah, if you've got the whole dollhouse, definitely keep it together. But if not those doors, those windows, those railings, those stairs, those all pull off and you can sell them individually, people are looking for them. I can see in her listing it says just missing the front the front porch rails and steps. So somebody's going to buy this from her and then they're going to look on eBay for those replacement parts. Congratulations. Nice sale. And thanks for remembering my little tip. All right, I picked up this tall ceramic tiki mug at a garage sale for $1.50 and it sold for the buy it now price of 125 in about a month. It is a the mighty Alcala tiki mug, false idol first edition 2017 Bosco Trader Dane, whatever all that means. Husband found this on at an online auction site, equips bid, I think, never heard of that, was a blurry photo and a bad description. Said something about two neon lights and the other light was a neon flamingo that sits on a table. Anyway, he figured out what this was and won it, paid three dollars, cleaned and tested it works, put it on auction and it sold for more. But buyer flaked out, relisted and no bids ended, received two messages saying they missed it, but offered 450, reposted and took an offer for $450. Immediate payment received amazing, fine, long story, amazing Bolo. Very rare vintage oil rain lamp, collectible black light, neon retro light. Wow, $450. That's great. This one comes from Abigail's Artful A Boat. She is a Bolo buddies member of my YouTube channel at level two or higher. That means they get the perk of having their YouTube channel or eBay store popped up and the links are down below. She has an amazing YouTube channel. Her videos are totally, totally different than mine and you guys are going to love it. She sources totally different from me and she just has this elegance about her. You guys are going to want to go check her out. She said, I remember seeing straw hats on a YouTube video selling for big money. So I decided to list a few and I just sold my first one for 90 on Etsy. It was marked on the inside Colonial Williamsburg, obviously a representation of an early piece. I paid $5 for it at a rummage sale. This most, the most challenging part was finding a box that was large and shallow enough for it to fit in. So $90. Now, I will say one thing with straw hats. I learned about straw hats from Butterfly Hustles. This is her YouTube channel. Go and follow her. She's incredible, but I did not sell straw hats. And then I watched one of her what sold videos and she was selling them for big money. And I was like, I'm going to look for some straw hats and I found some and I've done really, really well with them. A lot of them are foldable. So a great box is the priority male shoe box and you just kind of bend it up. Or there's the 12 by 12 by nine priority male box that you can usually just sit them down in. This one does not look as flexy as the ones that I typically sell. So her title says vintage Colonial Williamsburg. Oh, I can't read it. It's so small. I'll pop it up and I will make it bigger for you guys. All right. This one also comes from Abigail's Artful Boat. She said, I had this unusual Tiki MCM bird whose feathers and head were knives and forks. Eventually someone on Etsy decided it was worth buying. It sold for seventy three dollars and the buyer was thrown. I can't remember what I paid for it. I want to say about it for 12 at an antique mall in Boulder. And this is what it looks like. This one also comes from Abigail's Artful Boat. She said, I picked up this set of thirty five cigar flags for ten dollars and a huge box at a vintage market. They were novelty items that came in cigar boxes. And these looked to be from the thirties or forties. I decided to keep them all together and listed them for eighty five on eBay. They sold within a week, making for a tidy profit. And this is what they look like. This is from May. And I was so excited to really have one to share, but just now figured out how to find the post for it for it on a mobile device. I picked this up for 50 cents at a yard sale without checking comps and a few other card games. When checking comps at the time, there were only two sold. The game was 100 percent complete, and I listed it for eighty dollars. Last sold was sixty nine, took a best offer of seventy about a week later. Gorilla Games card game Lifeboat by Jeff Seedick. A hundred percent complete, excellent used condition. That's what it looks like. This isn't just a single Bolo. This is sort of a group Bolo while going through our garage for a yard sale. My hubby found a stack of View Master Reels. I snagged them to list since I was pretty sure I could get more from them online. I wasn't wrong. I have sold Tom and Jerry in the beginning. Casper, the Friendly Ghost, Olympic National Park, Washington, Mount Rain, Rainier National Park, Washington, Crater Lake National Park, America's Man in Space 1962, Seattle, Washington, Tacoma, Smith Tower, Master of the Universe, Fat Albert Cosby's Kids. They sold for between five and fifteen. I sold three on eBay, two on Mercari and five on Facebook Marketplace. I still have 10 listed with three left to list. So do you part it out or do you sell it as a lot? Five to fifteen each. So definitely a Bolo when you add them all up together, but definitely time consuming to list them all individually. Let me know what you guys would have done. Would you have listed as a lot or sold individually? I purchased these little figures in a four dollar box of vintage military toys at a garage sale, so four bucks and had no idea what they were. I consulted Google Photos, Google Lens and still wasn't quite sure. And when I put Alex Archer in the title, I included a question mark. Thanks again, Google Photos. Less than a buck into a little over a hundred. I love selling toys. Me too. Thirty piece lot of vintage Alex Archer question marks, Spaceman toys, astronauts, mini multi color 1950s. And this is what they look like. Paid nine dollars on March 13th at the Goodwill, sold on June 6th for full price of 200. These I'm sorry. This brand's been on my bucket list to find for a couple years. This coat retails for four hundred and fifty dollars. It is the great cottage plaid Yale coat. Size large sold on eBay for one hundred and twenty. I'm sorry, sold on eBay for two hundred and fifteen. I listed it for two hundred and fifty and then countered a couple of times after he messaged me three times in an hour about his initial one hundred and fifty offer finally settled on two fifteen paid a dollar for it at the bins. It's an Aurora Cartier Leopard within C. Or I'm sorry, NYC Taxi, eight inch plush stuffed animal. This is what it looks like. He's cute. Hi, Courtney. Thanks for the opportunity to share my June Bolo's. I have a few. I'm a new online reseller, but seasoned thrifter and been selling on Poshmark under 411 Johnny since December. After watching your videos, I learned to look for glasses cases picked up six for a dollar each at a local thrift. Sold one Vera Bradley for 18, then accepted a bundle offer from another buyer for four of them for 50. Kate Spade, Vera Bradley, Nicole Miller and Draper James. Never heard of that one. So all of these on Poshmark, so sunglasses cases. Pick this up at the Goodwill Bin, so maybe 50 cents in it and sold for full asking price of $40.  Yeah, as long as this is not a medical device, I feel like this might have been, I could be wrong, but in one of my Vera videos on eBay, I'm not a hundred percent sure. But before you list on an eBay, be careful. I'm not a hundred percent sure, but she sold it on Poshmark. So I know you can't sell prescription items, but I don't think. Well, it says it says Snore RX. Hmm. Be careful with that one. I'm not sure. Just an FYI, I don't know. It could be fine. I could be misreading or thinking about something different. Pick this up also at a Goodwill Bin, so less than two dollars. Had it listed for 90 for two days, then close my closet for a 10 day vacation. Day after returning, received an offer for 76 and I accepted. Happy to get a quick sale after being away. Rothy, sage, camo, essential, wristlet, zipper, magnetic pouch. So for 76, this is what it looks like. Had to add this one. This one is Jersey Shore Thrifter. Some I'm sorry, same estate sale where I found the hockey mask. This set of books cost ten dollars, took about five weeks to sell for full asking price of two seventy four ninety five plus shipping. If you see this set or any individual books from it, latch those Bolo seeking fingers on it and don't let go. Jerry, you're funny. Man, myth and magic, illustrated encyclopedia, supernatural, complete set of 24 books. First edition, I think, is what that means. Not a huge Bolo, but super cute and loved the vintage look. Listed for almost a year, sold for full asking price of 45 plus shipping. Fire was all in for fifty nine seventy three lilies of Beverly Hills vintage tennis outfit. So long tail, but doesn't take up much space. Found this vintage Christmas tree kit at a yard sale for two bucks. Sold on Etsy for a hundred and twenty five plus shipping. Vintage 1985, Westroom Crafts, mini Christmas tree kit, open box, complete craft, new old stock. And this is what it looks like. Found this at the Salvation Army, and this one comes from Mom knows treasures. Check her out on YouTube, and she is awesome. Three ninety nine was badly scratched, but decided to take it home, clean it up and test it. It played fine without skipping. What makes this special is the Van Gelder stamp. It was the nineteen sixty three pressing, so it was only worth about fifty to sixty. Fifty to sixty if it had been the nineteen sixty one, it would have been worth hundreds or even thousands. Put it up for a seven day auction and it didn't sell first week. Reposted for auction with offers of at least fifty eight and sold the first day of the auction for fifty eight plus shipping. Yeah, Mom knows treasures, knows a lot about records. So be sure to check out her YouTube channel. She's great. Found at my local thrift store for a dollar, but it was twenty five percent off day, so cost seventy five cents put on auction for forty with best offers accepted of at least thirty seven sold same day on best offer. This is a Spanish and English Tex-Mex record with various artists. Fifteen and fifteen hits with the big Texas groups. Volume three loosely translated. I don't know what any of that means, but this is what it looks like. I went to an estate sale for the mushroom, but recognized the first group in line and knew I wasn't getting near a merry mushroom. That's funny. So she went to an estate sale and recognized that the people in front of her probably were going to grab that mushroom. Good thing I done my research on all the other items. I walked in and grabbed five hest trucks, ten dollars each. Typically, these are at best bread and butter, but this one is super rare and I got three sold to and have the last listed. One sold didn't work at all. Second sold worked. Mostly third works perfect. The two sold breaks down to cost twenty sold for one thousand and fifty. That's awesome. Congratulations. Forget that mushroom. There you go. Same merry mushroom sale, three dollars each, because I knew the blue and white would sell. Andrea by said, static or said, fishnet items, these four sold quick. And I have two left as of writing, excuse me, as of writing this, total so far, twelve dollars cost sold for one hundred and twenty two plus shipping, two picks for the four items. And this is what it looks like. So she sold to and has two left hit a yard sale around eleven thirty. Yeah, I was late, picked up a mortal combat bookends for five dollars and sold for eighty on McCurry. And that was not the big find there because there was a full table of books. I pulled Stephen King and a Soctric, I don't know how to say it, then found Warhammer, which is a tabletop game like Dungeons and Dragons, but in space with Marines. Two dollars a book and two hundred later, I drove away very happy. Then remembered three blocks away that he said he had more in the house, emptied my car, then to the bank and two hundred more, total two hundred and thirty one books for four hundred and twenty four dollars. So about a hundred. I'm sorry, about a dollar eighty four each. I've almost doubled my money in ten sales. Wow. So ten sales, she's doubled her money and she has two hundred and thirty one books. The top sale so far is the picture. So three books spent five fifty two best offer of three hundred plus shipping. So around two hundred books to go and six to ten K value. Wow. She's going to turn four hundred and twenty four dollars into six thousand to ten thousand dollars in books. I always pass by books. I've got to look at books. Here's the one for three hundred and forty. Oh no, I'm sorry. She took the best offer of three hundred. The Horace, Hersey, Primmarch one. Raboot. Oh my goodness. What kind of this is what it looks like? I don't even know. I can't even read that. So I guess long story short, by books that you can't read the titles up. All right, you guys, thank you so much for being here. Thank you for watching. Be sure to like, comment, subscribe and share. Let me know how you found the channel. Be sure to go down to the description. Join the Facebook group. Check out all of the people that were mentioned in this video. And as always, thanks for watching.


Good day, May 40 here. So do you remember all the despair after Trump lost the 2020 election among people right of center in the United States? This was the last election due to demographics that Republicans could possibly win the presidency and it's turning this despair is turning out to be without strong foundation. So number one the demographics issue is widely misunderstood because just because the US Census says something doesn't mean that that reflects reality and so if someone is say seven eighths white and one eighth Chinese they accounted as Asian in the US Census So if someone's part white and part non-white they are only counted as non-white in the US Census So the United States Census dramatically overstates the number of non-whites and correspondingly dramatically understates the number of whites in America. So much of the wailing and gnashing of teeth over the demographic situation in America is vastly overstated compared to the reality. So now white people are not going to be replaced and done away with in the United States. Now people respond to incentives. So for example identifying its Anglo is not considered, you know, cool in the United States and much of the first world. So 10, 20 million Americans who are primarily Anglo in descent identify with the minority part of their their demographics. So, you know, Irish or German or Asian or whatever. So America is far more Anglo than it says in the US Census because there is a flight from white because in some circles being white is considered boring and if you can only get a little bit more ethnic that's spicy and that's hot and that's cool. So the US Census dramatically undercounts the number of Anglos in the country, dramatically undercounts the number of whites, dramatically overcounts the number of non-whites in the country. Now, normally in polls about party identification, Democrats generically hold about a four-point advantage and according to the latest Gallup organization poll, 47% of Americans now identify with the Republican Party and 42% with the Democrats. So after Joe Biden took office a year ago, Democrats held a 49 to 40 advantage. So Democrats held a nine-point advantage. Now Republicans hold a five-point advantage. So there's been a 14-point swing in the polls. Why were you banned from Reddit, Stacey? Well, I think Reddit's become increasingly politically correct over the past three years, right? So there's much less robust discussion on Reddit. So a 14-point poll change in party identification is about the most dramatic reversal that Gallup has ever recorded. And the data analysis website 538 shows a similar parallel collapse in Joe Biden's own popularity. Looking at Christopher Cordwell, he writes fairly regularly for the New York Times. So Christopher Cordwell is one of my favorite commentators. He's about as far right as you can get and still be in polite society. He wrote that fantastic book last year, The Age of Entitlement, about how the civil rights revolution had essentially replaced the Constitution as the new and more powerful Constitution. So we no longer had, for example, freedom of association, that you could not discriminate when you're renting out an apartment, right? Let's say you've got your age mother and you can't discriminate in who you may rent out a guest house to. And you can't discriminate in employment, even though obviously, generally speaking, the more you have in common with your fellow employees, the more efficient and effective will be the workplace. So when we got the civil rights revolution, you had a vast expansion in rights for historically oppressed minorities, but this vast expansion of rights came with a vast decrease in rights for other people. So it's not like you expand rights for one oppressed group and nobody's the loser, all right? You increase rights for one group, you're taking away rights from other groups. So Joe Biden entered office with higher approval than Ronald Reagan, Bill Clinton, or George W. Bush at 55%. He's now tumbled to 42%. So how did the Democrats get into so much trouble? And remember, it's a two-person race. So a lot of people commented, how could Joe Biden win the 2020 election when he wasn't a particularly inspiring campaigner? Well, Joe Biden didn't have to be great. He simply had to be more appealing than Donald Trump. So Stacey says, I was just trying to discuss whether white people have a unique ingenuity and inventiveness. Yeah, say something positive about white people. It's a good way to get banned from places like Reddit. Okay, so when Joe Biden ran for president, all he had to be is more palatable than Donald Trump. He didn't have to be awesome. He didn't have to be inspiring. Like, I've never met anyone who's inspired by Joe Biden, right? There was no enthusiasm for Joe Biden. There was tremendous enthusiasm for Donald Trump. But in the end, when people came to vote, they had a binary choice. They could either vote for Trump essentially or vote for Biden. And so there was a 3% swing away from the Republicans in the suburbs in both the 2018 midterm election and the 2020 election. So Trump lost the election in the suburbs, simply the suburbs of the Midwest swing states like Philadelphia, Wisconsin, and Michigan, Michigan. Okay, so the Democrats have gotten into trouble more than the Republicans have been particularly effective, right? But as the Democrats sink, it can't help but push out Republican prospects. So even though we'd be hard pressed to say, you know, this Republican was particularly inspiring, maybe Glenn Junkin, the new governor of Virginia, maybe he's been the most effective Republican politician, perhaps Ron DeSantis in Florida. Yeah, Richard Spencer tipped the scales of Trump in 2016, for which there's zero evidence. So how did the Democrats get into trouble so much? So I think the main thing was that they allied very strongly with the great racial reckoning.  And I think that's the primary reason why Democrats have sunk in the polls. So the January 6 Capitol Hill riots, discredited Trump and discredited Trumpism and did far more damage for the cause than if they just done nothing. On the other hand, you know, Black Lives Matter and the Tifa riots have done far more damage to the Democratic Party as opposed to doing nothing. So overall, non blacks in America are less sympathetic to black issues after the great racial reckoning of 2020. And after all the Black Lives Matter riots, then they were prior to that. So stage one, you take action, but stage two, there's a reaction. So that's why the wise person has to consider what will be the reaction to what I'm about to do or what I'm about to say. So the Democrats by largely throwing in with Black Lives Matter and the great racial reckoning and the defund the police movement, right? They essentially thrown in with the criminals as opposed to the police. And even liberals don't enjoy rising crime rates. You know, we've had skyrocketing. We've had homicide rates are up approximately 40% since 2019, right? Most liberals don't appreciate that.  I think that's the number one reason for the dramatic decrease in Democratic Party identification in the polls and with it an uptick in Republican identification. Joe Biden has become much more liberal on immigration. And so we've got like a wave of mainly Haitian immigrants, about 14,000 Haitian immigrants have arrived at the Rio Grande near Del Rio, Texas. And American voters are not pleased with this massive influx of illegals. So we're no longer getting a massive influx from Mexico. But most Americans would not be thrilled with 14,000 Haitians invading the country illegally. So Joe Biden's approval ratings on immigration are 36%. We've got massive increase in homicide rates, about 40%. And Joe Biden's approval rating on crime is 39%. So the Democrats are on the wrong side of the growing apprehension about rising crime rates. So the Democrats, by and large, have thrown in with the criminals rather than the people trying to keep the peace. Inflation, right? We've got inflation running at 7%. I'm going to have an unpopular opinion here. I don't think Joe Biden is to blame for the inflation rate. I believe that the inflation rate is primarily the result of problems in the supply chains, which have nothing to do with Joe Biden. A fallout from the pandemic lockdowns. COVID-19, as Christopher Cordwell points out, opened up a window on our public schools. And Democrats, once again, increasingly on the wrong side of many issues that voters are passionate about. So Democrats are the party of the teachers' unions. The Democrats won't go against the teacher unions. And what are in the best interests of teacher unions are not necessarily in the best interests of America. So teachers' unions have been largely behind stopping in-school education and trying to push things online because they feel like they'll be safer for their union membership. But parents who are working through the COVID crisis, they can't stay home to look after their kids. So the Democrats largely back the teaching of contentious race dogmas, like critical race theory, right? And they are the party that supports teachers' unions who want to just have online education as opposed to in-person education. So parents who are working, they want their kids in school. They can't be staying home trying to look after their kids. Also, Democratic Party and their leading politicians have overhauled and abolished competitive public school exams in New York, in San Francisco, Boston, Northern Virginia, California, because of the racial composition of exam results, usually disproportionately Asians who are doing well. And so Asians are increasingly splitting off from the Democratic Party. Latinos are increasingly splitting off from the Democratic Party. Whites, right? There's probably less identification of whites with the Republican Party after Trump than prior to 2016. So that's a surprising result. So Trump dropped about five points among white men in the 2020 election, but he gained among Latino and black men. So the Democrats in the news media have been talking about this vital need for voting rights. Our democracy is under threat. We need this voting rights act, right? We've got to protect democracy, right? That's the media line and that's the Democrats line, but from a more objective perspective, it just seems like a partisan wish list. It doesn't seem to have anything to do with protecting democracy. So Joe Biden taught in the Lanter crowd this month that those who opposed this voting rights bill, which is really a partisan wish list, were the same as the segregationists and the people who supported the Confederacy. So he kind of combined Hillary Clinton's 2016 deplorables remark with anti-white race beating. In 2020, Democrats lost white non-college educated voters by 25 points that will probably keep growing with this kind of approach. So many minorities, many Asians and Latinos in particular don't like the Democrats increasingly racialized approach. So the Democrats are increasingly turning themselves into the black party and painting Republicans as the white party. And an increasing number of Latinos and Asians in that circumstance say we would rather not identify with the black party. So blacks have been very successful in influencing, dominating the Democratic Party, but it is coming at the cost of Asian and Latino support. So in a hypothetical rematch of the 2020 election, Biden and Trump rate evenly among Hispanics. So in the 2020 election, Biden won by 30 percentage points. Right now, he's even in a hypothetical rematch with Trump. So the Democrats are also increasingly attacking Republicans as the party of Trump. But while Donald Trump may not be so popular, Trumpism is the way forward for the Republican party. So a Trumpism without Trump may well be the most electable path forward. Trump was very successful into tapping into smoldering grievances against the information economy elites and managers, and many blacks, Latinos, Asians shared that resentment. In the 2020 election, Mark Zuckerberg gave over $400 million to a non-profit to help local governments organize elections under COVID conditions. That gift equaled the amount of federal funding designated for that purpose. And people who worry about private wealth influencing elections, they're not going to be happy that Mark Zuckerberg essentially underwrote the 2020 election. So let's go to the comments. And the crowd says, sometimes I think Luke is jealous of Richard Spencer. Richard Spencer tipped the scales for Trump, and then he tipped the scales for Biden in 2020. He's basically a kingmaker, a world historical figure. Poland is building a wall. So Poland's in a tough spot because it's in Germany's interest to have good relations with Russia so they can get cheap energy. Much of Europe is incentivized to have good relations with Russia so they can get cheap energy. But that comes at the price of Germany and much of Europe is not going to be inclined to put crippling sanctions on Russia if Russia invades Ukraine. Also, the United States and most of Western Europe doesn't have any particular interest in whether Russia invades or does not invade Ukraine. Ignoring the Richard Spencer question in your political analysis will leave you wanting. He is like the missing puzzle piece to a career worldview that's hilarious. Let's make Apollo great again. Why it's identifying more and more with Richard Spencer? I don't think so. After Richard Spencer's political reformations post 2016, he is captured by the Republican Democratic Party. Had to say who would win that rematch between Trump and Biden without figuring out who Richard Spencer would be supporting. Okay, it looks like Republicans are headed for a massive sweep in the midterm elections. If Saturn is parable, everything stays on track in 10 months and then seem to be well positioned for the 2024 presidential campaign. Who would be the most formidable Democratic candidate? Can't think of one. But if the Democrats nominate a white person to go against Donald Trump in 2024, probably all things being equal, I think the Democrats would win more later.


Hello and welcome to the presentation of this STM32 Evaluation Boards. It covers the main features of the Evaluation Boards dedicated to the STM32 G4 series. The demonstration software included with these boards will allow you to become more familiar with this new high-performance microcontroller. The STM32 G4 Evaluation Boards offers everything required for users to get started quickly and develop applications easily. These boards enable a wide diversity of applications, taking benefit from security, connectivity, and motor control features. The STM32 G4 Evaluation Boards come with the STM32 Comprehensive Software HAL Library, together with various packaged software examples. They also embed a debug probe that helps you develop your own applications from the existing examples. The STM32 G4 microcontrollers have three sub-families. STM32 G4 X4 High Resolution Line STM32 G4 X3 Performance Line STM32 G4 X1 Access Line Two types of Evaluation Boards are available. STM32 Nucleo Evaluation Boards Three Discovery Kits complement the Evaluation Boards, Digital Power, Portable Oscilloscope, and Electronic Speed Controller. Embedded software solutions are available to quickly develop applications based on STM32 G4, including a motor control software development kit. The highly affordable STM32 Nucleo Boards allow anyone to try out new ideas and to quickly create prototypes with any STM32 MCU. Sharing the same connectors, STM32 Nucleo Boards can easily be extended with a large number of specialized application hardware add-ons. Nucleo 64 include Arduino Uno, REV3, and ST Morpho connectors. Nucleo 32 include Arduino Nano connectors. The STM32 Nucleo Boards integrate an ST Link Debugger programmer, so there is no need for a separate probe. A comprehensive STM32 software HAL library, together with various software examples, is provided with the STM32 Nucleo Boards and seamlessly works with a wide range of development environments including STM32 Cube IDE, IR, EW Arm, Kyl, MDK Arm, Embed, and GCC, LLV, M-Based IDEs. STM32 Nucleo Boards can easily be extended with a large number of specialized application hardware add-ons thanks to Arduino Uno, REV3, and ST Morpho connectors. For example, USB Type-C and power delivery, motor control, LORA, and power consumption measurement boards are available. The STM32 EVAL Boards have been designed as a complete demonstrator and development platform for the STM32 MCUs and MPUs. They carry external circuitry such as transceivers, sensors, memory interfaces, displays, and many more. The evaluation boards can be considered as a reference design for application development. The STM32 Motor Control Nucleo Pack PNucleo IHM003 is a kit composed of the Nucleo G431 RB Nucleo 64 Board, the XNucleo IHM16 M1 Motor Driver Expansion Board, a low-voltage motor. STM32 Discovery Kits are a cheap and complete solution for the evaluation of the outstanding capabilities of STM32 MCUs. For more information on the STM32 G4 Nucleo Board, go to www.st.com.stm32nucleo.


This month on Maker Update, a fully functioning MIDI instrument, Adafruit's response to COVID-19, an easy-to-sew face mask, dropping eggs, Morse code, and Circuit Python and Espanyol. Hello and welcome back to the Adafruit edition of Maker Update for April 2020. I'm Tyler Weingarder. I hope you're doing okay and staying safe. I'm guessing by now you're either Hawkeye for anything related to COVID-19, or you just want something to take your mind up the global pandemic. We're trying to do both here, so let's check out our project of the month. Liz Clark and the Ruiz brothers are on a tear of collaborative music-based projects for the past few months, but this might be their finest work yet. Their latest project is a MIDI guitar inspired after the controller for Guitar Hero, complete with MX mechanical keyboard switches, a strum bar, accelerometers, neopixels, and more. The guitar can interface with just about any digital audio workstation software via USB. The keys on the neck can play notes directly, or you can use the strum bar to play chords. There's a whammy bar and an accelerometer to modulate the notes, potentiometers to help shape the sound, and an eight-way switch to change the octave of the instrument. The brains of it is the Grand Central M4 Express, and the code is all written in Circuit Python. This might be one of the most impressive music instrument maker projects I've ever seen. They could have just harvested the strum bar and whammy bar controls from a discarded guitar hero or rock band controller, but instead they've engineered their own. Both from a hardware design and a software interface, this project is an incredible resource. Now for the news. You may have noticed that Adafruit has been a little quiet with regards to new products, but they've certainly been keeping busy. They've shifted much of their manufacturing over to the production of personal protective equipment for first responders. In doing so, they've established themselves as an essential manufacturing business and have kept every single one of their employees on the payroll. They've published their own facial design for anyone who wants to make them at home. If that's not cool enough, they've also posted a collection of wonderful gifts of their manufacturing process. Check them out if you haven't seen them yet. Which is not to say they've abandoned their community. Since we've all been sheltering at home, they've expanded the weekly Adafruit show and tell to one hour every week. It's one more way they're helping makers to stay connected, even while maker spaces and meetups just aren't possible under the current health regulations. Now for more projects. You're likely overwhelmed with designs for face shields, masks, and other PPE you could be making for your family or for your local first responders. But if you don't know where to start, Erin St. Blaine created this fantastic tutorial for making a cloth mask out of materials you likely have around your house. Her patterns can be printed on standard letter paper and it's all hand stitched.  And this time when certain foods can be a little hard to find at your local grocer, it's tough to rationalize sacrificing them for engineering challenges like the egg drop challenge. You know, the one where you need to build a device to protect an egg being dropped from a specific height? Anyway, John Park used the sensors and the display on board the Adafruit Clue as a digital stand-in for a reusable and less messy Crash Test dummy. Perfect for prototyping designs before its final egg test. Whether you're sheltering with family and your board game collection is getting more regular use, or you just have a regular game night and want to add a little bit more structure to it, this Neopixel Game Timer by Erin St. Blaine is a wonderful addition. Thanks to the Circuit Playground Express and Make Code, you can set it up in minutes. You could be done with just the board, but it'll look so much better if you extend it with a Neopixel strip, or find a bigger button to mash when it's time to take your turn. Carter Nelson from the Adafruit community built this Adafruit Morse Code Chat Client. And if you've been looking for a good way to learn Morse code, this is the perfect rainy day project. You'll need at least two Clue boards, and they connect to each other over Bluetooth Low Energy. One button is for dots, and the other for dashes, and if you press both together, it will send your message. Incoming messages are just displayed in alphabet letters, so this will only help you with your expressive skills, not your receptive. Still, this looks super fun. Dana Wall created this guide for outlining some of the design considerations for face shields. It covers a few different strategies for cutting out the PET sheets to form the protective barrier, and a video guide for setting up parametric designs in Fusion 360. The designs for protective face shields are changing fast, but it's a great guide for anyone who wants to get involved. Last month, our featured product was the Adafruit Feather NRF 52840 Sense. Now, Catney Rembore has a full guide up for this powerhouse development board. There's a complete rundown on the board pinouts, including the iSquad C addresses for all the onboard sensors, a setup guide for the Arduino IDE, a few basic BLE tutorials, and more. She also outlines the Adafruit BLE NRF 52 API and walks you through Circuit Python on the Feather Sense. Speaking of Circuit Python, there's now a Spanish translation of the Circuit Python starter guide, courtesy of Alvaro Figueroa Cabezas. The code examples and the messages from the REPL are still in English, so you'll need to be a little language flexible, but this should help to extend Circuit Python to more people. If you've managed to get your hands on any recent Bluetooth low-energy boards like CLU or the Feather NRF 52840 Sense, there's now a desktop dashboard that runs near Chrome browser. Once you connect to your hardware, it will spawn a number of panels depending on what sensors it has on board. There are panels for accelerometer, temperature, barometric pressure, button indicators, a light sensor, an RGB color picker, and more. This should come in really handy for debugging your next project. For this month's Adafruit product spotlight, you may have noticed there's quite a few boards lately that come equipped with a combination proximity, RGB, light, and gesture sensor. If you've wanted to include this sensor in your projects but on a breakout board, you're now in luck. There's an on-board voltage regulator allowing you to accept 3.3 or 5 volts, pins for I2C, 3V out, and a pair of Stem Equic connectors. It's on the standard 0.7 by 1 inch PCB, and there's four mounting holes. Best part? It's only $7.50. And that is going to do it for this month's show. I'm hoping that the next time you see me here, this whole COVID-19 business will have settled down a little bit. As always, huge thanks to everyone at Adafruit for letting us do this show for you. Stay safe, look after your family, take care of your community, wash your hands, and keep on making. Thanks so much for watching. We'll see you soon.