Hi, everyone. So my name is Rachel Sibley. I'm the automotive QE, technically, for the automotive program at Red Hat. And here with me is Priyanka Verma, who also works with me on the initiative. So we're going to talk to you today about how to qualify a safe Linux distribution in cars. So a little bit about the agenda. I'll talk about what is the Red Hat in-vehicle operating system in Safe Linux, our overall approach to Safe Linux, and how we're working towards compliance against the ISO 26262. We'll go into what is the test strategy like, freedom from interference, failure mode and effects analysis, the process aspect of it, and how we're managing the requirements based on man pages, and test assets and traceability and the work items that go into that. So what is the in-vehicle operating system? It's a smaller footprint of RHEL. We are inheriting everything from RHEL, except the kernel. The kernel is the only package we're rebuilding for hardware enablement. We're using the RT kernel. It's based on OS Tree, which is very common with running OS Tree in embedded systems. We're working to achieve functional safety certification to conform to the ISO standard. It wasn't really made for pre-existing complex software, but there is an initiative to adapt the ISO 26262 through an ISO pass to complement that better. So we're working with a company or a partner, Exida, Consulting Body, and they're helping us with achieving continuous certification for FUSA. So what is FUSA, or Functional Safety? It's the absence of unreasonable risk that could lead to harm or injury or even death later on in the road in the vehicle. So we want to ensure that we did everything in our power to avoid potential harm to the user. So by doing that, there's compliance against this international standard. We have safety goals that are derived from potential hazards. We provide technical solutions to be able to react to these faults. A big part of it is it's very process-oriented, very rigorous, detailed flow to be able to work towards the functional safety certification. So a big aspect of it is providing the evidence so that if we get pulled into court later on, or there's an audit, we have the evidence to be able to back up to say, yes, we did what we claimed that we were doing, and then we set out to do, and we have the evidence to back it up. So you might hear the term ASL a lot throughout the talk. ASL stands for Automotive Safety Integrity Levels, A being the lowest level up through D, which is the highest level of hazard. So ASL A would be something like your rear light, which is very unlikely that's going to cost somebody to be in an accident and become harmed in any way, where you look at something like ASL D, which is the airbags failing to deploy. So this is a high level view of the different capabilities in a car and how they would relate to the ASL levels. For us, we're certifying against ASL B. So ASLs are determined by three factors, probability of exposure, controllability by the driver, and the severity of the failure. So this slide has a lot going on, but I'll try to summarize it. So the ISO throughout the specification mentions the V model quite often. This is the verification and validation process. It's derived from the waterfall model. This isn't something we typically follow within RELQE. So we take what we're already doing well and complement it with the various aspects into this V model. The safety analysis is really what identifies how complex and how much rigor we really put into this. And these are the FMEA analysis, the failure modes, and effects analysis, which Priyanka will get into a little bit later on. So on the left side is the verification activities where we do our system design and requirements analysis. And then on the right side, we're doing our iterative testing at the unit level, integration system level, and so forth. So for the in-vehicle OS, we're leveraging all of the same tests from REL. They're already doing a really good job there. We don't want to duplicate the effort there. And they also take a lot of the tests from their upstream, REL being our upstream, and then further upstream, and so forth. So we take all of those tests, and we rerun them in our environment, which is an OS tree environment. Also working on adapting the tests to a new test framework. The tests weren't really designed to work against an RPM traditional compose, so there's a little bit of work to work with an OS tree system. So because of the aspect of not being able to write and not using DNF, we're using RPM OS tree and so forth. And then there's additional work to adapt to the test framework to get them to run in our CI systems. So the requirements are derived from the ASLB APIs. So for each of these APIs, we needed to derive test cases, have targeted tests that are 100% covering the requirements, which I'll talk about in a little bit. But where we want to be able to reuse the technologies and tooling within REL QE, we don't want to fork their tests, and we don't want to duplicate what they're already doing well and be able to reuse those technologies. So we have two main pipelines where we're running our tests. One is the AutoToolchain CI pipeline. This is specific to automotive, with building custom images and rerunning them in the pipeline. And then we use the, where we're using testing farm and TMT, there were other talks about that. Earlier, you might have attended those, but TMT stands for Test Management Tool and highly used within REL QE. And then CKI is the kernel CI effort that is going on in Red Hat. They have high engagement with the upstream kernel community with testing upstream kernel trees. So they have a, they test very early in the development cycle at the patch level, and we want to be able to reuse that as well. And then the other effort is being able to provide the traceability in Polarian, which complies with the ISO standard. So for requirements testing, we have the package level verification, and this has to happen per API level. A lot of, there's a very detailed workflow that goes into this, which starts with reviewing code reviews and static code analysis, structural coverage, so the code coverage analysis, the requirements level verification, which is derived from the man page of the API. We then take an API, then we take a man page and we break it down into low level requirements. So we are able to break that down into something more, that's maybe something that's ambiguous. We break it down into testable parts to ensure that we have the traceability for all the behaviors that are specified in the man page. And then if we find any discrepancies with the man page, it's also a chance for us to be able to file a merge request, to be able to provide those changes to make sure that the specification, e.g. man page, is actually doing what the implementation is designed for. So the integration level testing, this comes out of the safety analysis, which I mentioned earlier, so the failure modes effects and analysis. There are specific failure modes that are identified within an API and external SIS calls, and dependencies, and we need to ensure that our existing package level testing is already covering the integration level testing as well. And then again, more details about putting that into Polarian, adding the requirements. We need to have the requirements linked to test cases, and test cases to test runs, and so forth. So Priyanka will talk about that a little bit. So I talked about code coverage analysis earlier. So the ISO recommends the software is verified using code coverage analysis. The target is 100% compliance for the recommended quality metrics defined in the specification. We don't have to do this for every API, only for the complex APIs. We also use it to assist us with the simple APIs to ensure that we have the 100% requirements coverage. So within the specification, you'll see recommended, highly recommended, for all of the techniques within the V-Model. So for the code coverage, structural coverage, it's recommending both statement and branch coverage. So for code coverage workflows, we're trying to do more granular reports that are specific to the API level, rather than running against the entire package source, be able to do detailed analysis where we can drill down into specific API to see where our gaps are. So the low-level requirements also have code coverage analysis that are showing the traceability of the tests to the requirements, and the test coverage there. So that helps us understand where our gaps with code coverage and requirements, and therefore, requirements coverage, to know, well, I need to go and develop new tests and then push them upstream to be able to pull them back down to Raul. So another major aspect of functional safety for road vehicles is freedom from interference. Freedom from interference is about absence of cascading failures. As we can see in the image, the cascading failure is the failure that actually cascades from one element to another. So for example, there was an event that causes a fault in element A, which made the element A fail, and the failure of element A causes the fault in element B, and it fails the element B. So this is a cascading failure, so freedom from interference is majorly about avoiding the cascading failures. So it's also linked to the easels, that is, there should be freedom from interference between lower and higher easels, or a quality managed level to any easel, A, B, C, or D. So how do we ensure freedom from interference? First thing, we analyze. So there is DFA, dependent failure analysis. So this covers the cascading failures, which are for the freedom from interference, and then also the common cause failures, which are related to the independence. So common cause failure, as the name suggests, it is due to a common cause that at the same time fails element A and element B. So these failure analysis help us figure out the failure modes that could lead to the failures, and we try to mitigate those failures. Again, these dependent failure analysis are of two categories. One is deductive analysis, and the other one is inductive analysis. So as Rachel mentioned, that we are targeting easel B. So according to the functional safety standard for road vehicles, for easel B, it's highly recommended to do inductive analysis, which is FMEA, failure mode and effect analysis. So under this exercise, what we do is we brainstorm and list the failure modes that could be applicable to a particular component, and then further analysis happens where we calculate the risk priority number. So risk priority number is nothing but the multiplication of severity, occurrence, and detectability. So we get that number after the multiplication, and then we have the data for the failure mode. Now comes the chance of mitigating that failure. So we apply technical solutions to mitigate the failure that we have already listed in the FMEA. So after putting that medication, again, the risk priority number is calculated, and it's checked if it's under the acceptable range or not. And from the mitigations, then finally, there is one more way of deriving requirements that is through failure modes that comes into picture. Now comes the process aspect. So process aspect is majorly about the evidence, and then the traceability. So evidence is that we have to prove that we did what we were supposed to do according to the functional safety standard. We have to prove that we tested a requirement, or we made sure the failure mode was covered with the mitigations, and we followed all the timelines, the fault, time tolerance, interval, and a lot of more things. So these evidences could be for testing, for QE, it could be our test asset, it could be our test plan, our test specification, and our test reports that tell us when we tested the requirement, how we tested the requirement, what techniques were used, and what methods were used, and what were the results, which tools we used. So we have all the data if you want to retrieve. And along with all the data, this data needs to be traceable. So we should be able to make out which test is for which requirement and which result is for which requirement, whether the failure mode has the right requirement associated to it or it was a tested well, was it 100% tested or partially tested. So that kind of data should be traceable. So yeah, that's traceability is one of the things that add value to the evidence, and evidence which is not traceable is not valuable. So how do we achieve it? We are doing it by using Pallarian. We are using Pallarian in different ways, as you can see, for our test case management, for writing our technical safety concept, managing our requirements, and something that's in progress is the configuration management, tracking our change request, whether they are related to the tools, the process, or the requirements. And lastly, we are using it for the metric reports, like the traceability matrix and also the pass fail metrics according to the requirement. Now we come into how do we derive the low level requirements and the associated conditions of use? So as Rachel previously said, that we are taking reference from the man pages of the associated APIs that are in the safety scope. So first we analyze the man page and from that man page, we derive the low level requirements that are testable. And now there are other things that come into picture that are assumptions or the conditions of use. These assumptions of use or conditions of use come into picture when the fulfillment of these low level safety requirements is dependent on the context. For example, I define a requirement for an API, but that holds true only if my system is 64 bit. So that is going to be my assumption of use, that the so and so requirement should be verified and passes because if you use the right environment. So that's the assumptions or conditions of use. Later, yes, the verification happens and yeah. That's how we move forward. Next thing, when we talk about man pages for deriving requirements, the first thought that comes into mind is man pages are subject to change because they're upstream, right? So how do we detect and handle those changes? So we have an application that runs and gives us the diff if there is a change and then there is a CI that's automatically triggered and MR is raised. And there the analysis happened where, which tells us that whether the change is related to the API in our safety scope or not. If it's not in our safety scope, it automatically gets merged. And if it is in our safety, if not in safety scope, it's automatically merged. And if it's in safety scope, then the MR is pending for review. So what happens when there is an MR pending to review due to a change? Then our change management workflow comes into picture. A change request is opened and then the impact analysis take place. In that impact analysis, we take into account the technical impact, the schedule impact, and what are the different work products that will be impacted due to this change, whether it affects only documentation or testing or testing development and documentation. So that kind of impact analysis is performed. Based on that impact analysis, there's a change control board that approves or reject a change. So once the board approves the change of the man page, the related requirement gets the change of text and hence the implementation changes and hence followed by the VNV activities that is validation and verification activities. Now, the traceability aspect, how does it fit in the complete scenario? So we have low level safety requirements. We have failure modes. We have man page based requirements. And for traceability needs, according to the functional safety standard, we need to have bi-directional traceability between the different hierarchical levels of the requirement. For example, if I'm at the lower level requirement, I should be able to trace back to the top level or the parent requirement. And from there, I should be able to come back to the related or derived low level requirement. And hence the requirement should also be traceable with the test specifications that are verifying that requirement, the test results, and hence the test plans and test report. Basically all of our test assets. And same goes for the failure modes. So our failure modes should also be traceable according to what test plan they were planned in and the test specification reports and more. So this is an example traceability report, how it finally looks like. So what you see here at the top level is the man page based requirement and which is further associated to the lower level requirements that it has, the failure modes that are in the blue icon over there. And that exclamation mark is for the assumptions or conditions of use. And below that, if you see, there is the low level requirement associated with the test case. So we see that which test case is verifying which requirement and how the requirements are related to or bi-directional traceable to the failure modes. So that's an example. Any questions? Yes, please. Is it the standard of that software caused in hardware? Yes, actually the standard incorporates at, it has, it is for all three levels. At the software level, the hardware and the system level, which is software plus hardware. So currently here we are concentrating on the software part for now and maybe in future if it, if it, you know, the lifecycle permits than hardware and software interfacing at your site. Yeah, G-Cov, yeah, G-Cov R as well. Which, the question was which tool were you using for code coverage analysis? G-Cov, G-Cov R. Yeah, a lot of the work that we're doing for the safety scope, like a big part of it is affecting G-Lib C package for example, so there's a very large upstream test suite that we're re-running for RIVOS and then we're trying to break it apart by the unit level to show the traceability to the specific failure mode or the specific package level test against the API. So new tests are being developed and they're being staged and we're in coordination with the SMEs about how to be able to upstream those tests to the G-Lib C project because then REL QE can take advantage of that and then pull them back down and re-run them for REL as well. The question, yeah, the question was how we create this requirement hierarchy with the high level requirements of the man page and then low level, so there's even more levels actually beyond that. There's a technical software safety requirements that are defined from our safety goals and then they trickle down to our man page requirements which go to the API like get M and then from the API get M, we then look at the man page and then we look at the behaviors within the man page and then break it down into functional parts because not every part of the man page is something that you would test, for example. So those become low level requirements and then those get fed into code coverage analysis to show that we have 100% code coverage against those low level requirements. But now we might not always get 100% code coverage so as long as we can provide justification as to why that code path wasn't reached, for example, that's allowed, but otherwise for the complex APIs we have to have 100% code coverage. Yeah, where do we get our requirements from? The APIs which are our ASLB APIs, those come from the OEM so they provide the list of APIs within the safety scope. Of course, we work with them to influence them and help guide them about which ones should be in the safety scope but those specifically come from our customer which is GM who we're working with right now. So the question was, some of the man pages are very minimum and then they point to other documentation. Was that the question? We will have to handle that, yes. There's this call wrappers and that sort of thing so yeah, that's something that we need to handle and it's yeah, so part of it will be redirected back to the actual API that's wrapping around it so there's different use cases based on if it's like a Cisco wrapper or the API or and then there's different categories of very complex, complex, high, medium, low and there's a different rigor that's taken upon the complexity of the API as well but eventually those are gonna be broken down into two aspects, simple and complex once we get to a point where we can do that classification. Well thank you very much.


So I'm here from Lawrence Systems and we're going to talk about IoT security. Now, people lump a lot of things in IoT. That makes these headlines way more fun to read, of course, because then it makes the attacks look bigger and bigger attacks and doom and gloom is something the news wants to sell you on. And let's talk about we're going to break down this versus the reality of security. Now, if you're interested in needing help with your network, whether it be IoT security or other projects, head over to LawrenceSystems.com. There's a hire us button and you can learn more about the hiring process having us help secure your network. Now, Hacking Nemo, an adversary compromises smart fish tank at Casino. I love the headline. This is from a couple years ago and there was a fish tank that had Wi-Fi that, well, it had some flaws and they attached to their corporate network, which is a horrible idea, because once someone pivoted off the fish tank, they were able to fish around and find all kinds of fun things on their network. And frequently companies leave things open on their network. So once you're inside or behind the firewall, lateral movement becomes a lot easier. Well, that being said, that's probably not a good idea to attach the smart fish tank to your corporate network. Same with this, IoT worm can hack Philips Hue, late bulbs and spread across cities. Easy chain reaction hack would spread across Paris. Well, back to the same problem of it's a great headline from 2016 and here we are in 2020 and I have not seen the apocalypse of flashing late bulbs that we thought we would see, but hey, once again, a good headline. It's a real risk and I've done a video on proxy chains and a red teamers guide to pivoting and they talk about how to, once you get into a device that has been pushed through the firewall and has access to it, you can then pivot and get inside of a network. These are the things we want to prevent. So let's go and look at how these systems are being attacked. Telnet, SMB and SSH, Microsoft SQL and MI SQL ports. And I bring this up and I'll leave links to all these too so you can do some further reading on it. One of the things is this is all stuff that got them through the firewall. This is why you want to put it on a separate network or have a good firewall. We're going to get to that in just a second here. And second part is IoT. The reason you see the numbers bigger than they are in terms of, and I say as they are, is I don't necessarily think routers should necessarily, it would be listed in IoT devices but they are. Cameras maybe but routers, they're routers so your firewalls. And the biggest piece of all these, you know, Mirai botnet and many of the other botnets out there that are variants thereof of Mirai and all these attacks are because consumer routers are poorly made. We're poorly made for a long time without security in mind, never get updated. Therefore, they are the method of attack all the time. And right there when they point this out, retroactively looking at victim devices, service banners, internet world scanning, most of the devices appear to be routers and cameras reported by a short amount and they are. So, a lot of people start really worrying about all their IoT devices but they're not as likely to be attacked when they're not directly attached to the internet with the exception of the routers, which if you have a good router, then you're a lot better off. And I have a couple of videos on this topic and we're going to break this down. I do have, and this is going to go a lot more in depth than this video will, but this is the detail of how to. I'm going to talk a lot about the philosophy here. PF sends some rules for IoT devices with MD&S. That's what this is right here. I have this video where it breaks it all down, how to set up the rules, how to put things on a separate network and talk to them. Then to go a step further, maybe you have an office network. This is a little bit more expensive, but an office network design and planning with VLANs, LOPP rules, IoT, and guests using Unify and PF sends. I break down all of those details on there. Now, these are two complete guides and setups and you can see they're a little bit longer, but we're going to talk about what goes where, because this is the one part where people start asking the question of what goes on what side of the network. I'm starting this simple, but you could add more networks as needed. IoT devices with the exception of routers. I'm going to make some assumptions here that you have PF sends or some other router that's not one of the really inexpensive big box store consumer brand ones that are easy to buy. I don't know how else to define them, because I can't say it's a Cisco, because yes, those old Cisco's, they made some consumer ones and they make commercial ones. If you have one of these consumer based routers such as the D-Link or Netgears, they frequently have security holes that never get patched, and if they do get patched, people don't load the patches. So I'm going to point out specifically, instead of trying to say it fuzzily, PF sends has a solid commercial router solution. It is both open source and a big favorite of mine. Other runners up and I've done videos on them, is you could do this as well with something like Untangle. Another really good option. I also point out in this particular design, I'm using a unified switch, but really any type of switch or multiple switches would work. We're really going to focus on the concepts here. Those other videos break down some of the more technical details in there. But when it comes to concepts, right here we have this network with full access to local internet and this is more like a guest network. It's separated. It is internet only, no local access as in these devices can't talk to these devices, but these devices can talk to these devices and that's usually adequate for separating the devices. But the next question is, well, what devices belong over here? Cell phones, I actually prefer over on this network. Now your cell phone is generally designed, whether you have an Android or iOS Apple device. Both of those are devices designed to be on what I would consider hostile networks. They generally provided you're running them stock, don't have open services on them for someone to attack them. They're made to go on public Wi-Fi and deal with that type of environment and your streaming devices, such as a Chromecast or a list of other devices you want to usually use those from the phone. You want to play your music or play a video on watching on the Chromecast in your refrigerator that can be on there too. Now having them all on the same network and I say like a guest network, but you don't want to do isolation policies because well, that will cause an immediate problem of if you isolate devices on a guest network a lot of buttons that you check to say isolation what that means is that stops the devices from laterally talking to each other. Maybe you want that on a guest network because you don't want the guest network to see other guests, but when it comes to setting up IoT devices, if I want my phone to talk to my Chromecast on the same network works. Now one of the other videos I mentioned there are tools so you can have devices on this network and through a tool called MDNS talk to this network, but it is one of those things that you'll find is a little bit buggy and not everything supports it. So phones, your Amazon dots or Google homes or all these and like I said, this is all about security, not privacy. That's a whole separate topic of what you think of having these devices or a fridge that listens to you is a whole different topic, but keeping them all on one network is fine because if any of these devices gets compromised in any way they're going to look for lateral movement. Are they likely from lateral movement to then in fact the Chromecast? Not likely. Could someone possibly hack the fridge and broadcast them to your Chromecast? That is a possibility. And there was an event perpetrated by the person named themselves the hacker giraffe that did compromise a bunch of Chromecast, not through this methodology, but through the fact that they opened things through universal plug and play and were able to broadcast things randomly to the network and on your Chromecast. So it's not an unheard of possibility but in general it's not where your security problems. So other than the potential for these devices to if they have some type of port open or are insecure they're all on the same network. Now if you wanted to really break it down and put every one of them on their own network you could do that too. But each of these devices reaches out to the internet and comes back with the data. They're all talking to the cloud server that they belong to. So they don't actually need to talk over here. Now what about printers? Aren't they an IOT device? Well, sure. Anything I guess you could call an IOT device but printers because we have our workstations and laptops over here on this network and this is the network where we're getting business done. You throw your printers over here. Now could you throw them over here? Yes. Will you have problems? Maybe. Depends on the driver of the printer. You have some printers that work really well being on a separate network. You have other printers that just don't. They don't like being on separated networks. The people who wrote the drivers of the printer didn't expect them to have separation. Now when you get into the commercial networks like your Xerox copy centers and your Kioseros and Ricos and your large copiers, they simply don't ever really seem to have a problem being on a separate network. We set those up when clients request and they're made to be on like a routed network and that's not a big deal. But a lot of the consumer ones, whether they're wireless or wired, putting them on a separate network creates immediate problems with the drivers not being able to communicate with them. Now this is not true for every printer. Someone's going to point out but I have this printer networks. Great. If you have an exhaustive list of which ones do and don't, cool I don't. And this is one of those problems we run into when people contract us for consulting is they've stuck the printer on the other network and the drivers aren't supported and they want to sort it out. I'm like there's not a really sorting out problem that's got to go on this network but isn't my printer an attack factor statistically unlikely. For someone to get into your printer one, we're assuming you've not opened the firewall up to talk to the printer. That would be the first thing you don't want to do and because by default with PF Sense the firewall does not allow things to come through and UPnP is off by default in PF Sense unless you have done something too insecure of the system the printers may or may not need access to the internet and you could write a rule to block their access because well the only thing you really need is to go from one computer to that printer from this computer to this printer but the printer itself does not need to get out to the internet so you could if you're really worried about it rate rules to block access to there but I've looked a lot of printers don't seem to ever call out to the internet unless they have something firmware that the driver updates that they do that that they need but it's not as often a lot of times that is all facilitated by the driver you're loading on your computer that speaks to the printer and it is what pushes those things and if you're truly worried about it get and I know they're harder to find now actually USB printers I've I went and looked I know it's a lot of the consumer ones don't always even have USB they're kind of expecting them to be wireless now I don't know a lot about printers because we still use old HP printers because they work even though which once again I do know there's some security flaws potentially in those printers because of their age but I don't really worry about it and why do I say that you know being a security guy because we don't even have internet access on those printers they're kind of locked down and someone would have to get in our network and the worst thing they would do because there's passwords between my servers and my computers and everything else is they would be able to maybe scan the network with a really old slow controller that's in here and it doesn't have routing in it so you can't go anywhere else but this partial network and you would have to figure out a way to get inside my network first for these devices to even start doing that and the reality is and this is something a lot of people overlook well couldn't they attack this well if they're already in my network they're probably going to use whatever tool got them in my network to provide better faster scanning and more effective scanning so my first goal is to keep them on this side of the firewall because once you're on this side the printer is the least of my worries this is a slow device any device they have is probably not as old as the printer and if they're on this side of the network ladder movement is going to be facilitated by whatever device they either compromised or added to this side of the network this is one of those security thinking things people need to do of they asked me about certain attacks I'm like that's the one it's like oh couldn't someone plug this in attack I'm like once they have physical access to your building there's a lot of different things you need to be concerned about it's not likely they're going to go put a dropper on an old printer it's more likely because of speed to attack it in some other way so printers I do let live on this network now a couple things I'll throw and I do cover this in my more extensive office setup video one of those videos I'll leave links to below is for example if you have phones using things like LLDP awesome you can build your own separated network for phones very easily and have it pass through or putting them on a separate network now phones once again kind of the same they may depending on who you use for internet they may need to reach out to the internet to talk to a server but often like in our case for example our free pbx servers local so they only need to be on the same network as our free pbx server to talk to that so you can kind of make your own determination but having on a separate network is not a bad deal at all that way all that traffic is over there and you can put special quality controls on it if need be because well you want phones phones don't need necessarily speed but they need low latency so you may want to set priorities on that that would be a separate topic lastly cameras what about these cameras aren't that a big part of the mirai botnet yes but the problem with the cameras is not actually usually cameras getting hacked it's the nvr system itself and people like to punch a hole through the firewall and expose it don't put that thing on this network don't put it on your network you use here which is the in this case the 192 1683 network that would be bad putting it over here is a better idea but trust me if you are using one of those off branded and once again it's hard to define these but there's a lot of these companies that make these inexpensive nvr recorders that are poorly done they sell them at a lot of the big box stores they don't get security updates or patches they're frequently wide open with admin and 12346 as their default password and no one ever changes even when you do change it they're written so many years ago and have so many security flaws and they frequently get infected well I don't recommend opening these crappy things to the internet people still do those at least should be over here in a separate network or if you want to create a separate complete network for all the cameras just so they're over somewhere else that's perfectly fine too the cameras themselves are less a worry you can block them from the internet because generally they don't need it but they do need to reach out to a time server and you can usually set something local for example in unify because once it's something that's important for a lot of the cameras is to do time synchronization so they do look for that so this is kind of a breakdown of where to put some of those things and some thoughts on design of it for the more technical aspects I'll link to those other videos where you can dive deeper into like the functional how I did it with PF Sense in unify and how I set the VLANs up etc but from a concept standpoint and security standpoint this is the IOT which by the way if you don't have other things in place for security like a password manager and all that do those first because a lot of people focus on this IOT and the reality is they click a phishing link and that's what gets them pwned they open up a bad link in a browser that's not been patched from an unpatched system that gets them pwned this is actually lower down the list despite having great headlines in terms of everyone really excited about IOT and being the death of the internet and the massive lights blinking everywhere and you know all the fun things that we have with you know hacking things on here but the reality of what I deal with the security and doing incident response and follow up this is rarely this is it takes some hunting to find that the IOT devices almost every time it's been phishing emails and other security practices from unpatched systems where people just opening up firewalls from their default opening them up and opening up a bunch of these devices that's where we see more problems not from oh my gosh my Amazon dot completely is what compromise a network mostly that's gonna have a privacy problem more so than a security problem with those devices alright and thanks and thank you for making it to the end of the video if you like this video please give it a thumbs up if you'd like to see more content from the channel hit the subscribe button and hit the bell icon if you like YouTube to notify you when new videos come out if you'd like to hire us head over to laurancesystems.com fill out our contact page and let us know what we can help you with and what projects you'd like us to work together on if you want to carry on the discussion head over to forums.laurancesystems.com where we can carry on the discussion about this video other videos or other tech topics in general even suggestions for new videos they're accepted right there on our forums which are free also if you'd like to help the channel in other ways head over to our affiliate page we have a lot of great tech offers for you and once again thanks for watching and see you next time


If you've been waiting for the new Samsung Galaxy S22 device, then the team at Appalachian Wireless has some good news for you. Appalachian Wireless is launching all Samsung S22 models on sale. We are you. We are Appalachian Wireless. Friends of the Tugfork River will be at Panther State Forest April 9th to teach stream monitoring for free. Monday we spoke with Big Laurel Learning Center director Grace Williams about the event. We want to be able to pinpoint and narrow down what contaminants are in the water. We know that there's a lot of high bacteria levels in certain streams and that is from usually sewage runoffs. So whether that's testing for Pico coliform or testing for E. coli, those are both going to show you where you have sewage problems, whether that's a break in septic system or a failing sewage line. And this is one process to kind of identify which streams are problem streams. And then once you have the data and the facts, you can help get funding and support and action to repair those. Ultimately the goal is to make the Tugfork River a cleaner place for residents and recreation. Williamson adds that she hopes residents get engaged. I hope that it's local residents that are really interested in learning more and getting engaged or already engaged in environmental, you know, looking out for the river and looking out for our home. But the other hope is that you can learn more and spread the word. So if people want to come, it's at the Panther State Forest, April 9th, noon to 5 p.m., will be best to let one of us know that we can have materials, you know, for enough volunteers to make sure we're prepared. But then the hope is that throughout this year, once you're, you come to the training you're certified in Kentucky and in West Virginia as a stream monitor. And so the hope is that folks will be able to participate throughout the spring and summer and fall to get water samples in their area. So that might be streamed out or the creek, you know, in their neighborhood or their town and be able to sample that water. If you're interested or if you would like to get involved, you can call Grace Williams at<PHONE_NUMBER>. For Mountain Top News, I'm Joel Chorjol.


Dead babies, she chanted to herself.  This is the introduction song. It's not very good, but it's not too long. OK, so does anybody remember The Chemist? Probably not. It was written by Stephanie Meyer, who is most famous for writing the Twilight books, which are, I mean, I don't need to explain those. They were a series of books that got huge, spawned a million copycats and spin-offs. Then they had Movies Made, which also got huge, spawned a million copycats and a million spin-offs. And she also wrote The Host, which, while it wasn't as big of a success as Twilight, did still sell a lot, and it did still get a movie made with Cersei Ronan and everything. And as a brief aside, I will say that The Host is much worse than Twilight, even though no one ever really talks about it. It's mostly just because it has weird sexual assault undertones, which just make me deeply uncomfortable. But that's not what this video is about. The Host and Twilight are bad, yes. But The Chemist was also written by Stephanie Meyer. And it's not like this was a recent book, so people haven't heard about it. It came out in 2016. But it also wasn't like her first published novel, and she wasn't a big name then. She was a pretty big name when this came out. And it was apparently a bestseller, but I've just never seen anyone talk about it. Even her more recent stuff, like Midnight Sun, which is just Twilight from Edward's perspective, that came out in 2020. And it has twice as many ratings on Goodreads as The Chemist does. So it made me wonder, what is it about this book that no one has ever heard of it? And I read it, and it's pretty bad. So I'm just going to spend a few minutes going over it in spoiler-filled detail. So I'd say it's slightly better than Twilight. And it is pretty funny some of the time. But overall, it's pretty bad, and I don't really recommend it. So this book follows the adventures of the main character, who they call her Alex later on. But at the beginning, she just straight up does not have a name. She's just referred to as she, she, she, forever. I'm going to call her Alex throughout this review for the sake of simplicity, but I do want to bring that up because it's extremely annoying. Sure, in a visual form, that could be fine if we don't know their name. I've seen movies do it before, like Serenity. Chichuel Ejiofor's character is just called The Operative and because he doesn't have a name in the movie. And that's, that's fine. It works. It's a movie. And maybe she also could have gotten away with it if it was first person because then we don't really need to know her name necessarily. But she's just, she doesn't have one for quite a while. And after a while, they start calling her Alex. But we also learned that her original name before she became a spy and everything was Julianna. And she also has a code name, which is Oliander or Oli for short. So she's getting referred to by all these names and it's really obnoxious and difficult to follow sometimes. But anyways, the book starts off with Alex just being on the run. She's already been on the run for several years. She used to work for a government agency called The Department. It's so secret it doesn't even have a name, not even a nickname, which would at least give it some character. But OK, whatever. It's like she's been on the run for a while. They've been trying to kill her this whole time for one reason or another. We don't actually know at the beginning. And she has managed to keep herself safe by just being super paranoid as a spy, you know, keeping a low profile wherever she sleeps. She sets up booby traps and stuff. And because she's like a genius with chemistry, hence the title of the book, The Chemist, she really doesn't use firearms or anything to take people out. She usually sets booby traps that will like fill a room with poison gas or something, which seems like a bit much, if I'm being honest. Like, sure, it's mentioned in the book that she doesn't really use guns because they'd be easier to trace back to her. And they're more expensive and OK, sure. But you can buy guns illegally. Like, I don't recommend it because if you get caught, you're looking at a very long prison sentence. But like, you can do it. Like, there's black market arms dealers and stuff out there. And if she's a spy, she should be able to find them. But again, OK, whatever. So basically, the whole first chapter is just her explaining what her life is like now, that it's on the run and how it's terrible. And she, yeah, OK, whatever. And then one of her old bosses from the department contacts her, says, hey, we don't want to kill you anymore, we need your help. And rather than thinking, OK, this is an obvious trap, she just decides to go for it. And she goes out to meet with him. And before she even goes out to meet with him, I know I keep going on tangents, but that's important for this beginning part. Before she even goes to meet with him, it goes over all of her spy gadgets and stuff that she still has, some of which she's made herself, some of which are from her old days in the department. And most of them, again, all revolve around chemicals and stuff, rather than a pen that's a gun. She has syringes hidden on her person and stuff, which, OK, sure, if you're going to go for a theme with that sort of thing, I don't actually mind that much.  Like, for instance, she has these little earrings, which are little glass globes, right? And if the glass breaks, then it'll release poison gas. And she'll know to hold her breath, but anyone nearby won't know to do so.  That's a crappy delivery system. I feel like that would also break if you just turned your head too quickly or something. Like, just a lot of little things in this book which are not thought out.    And eventually, she agrees. And they give her some information on this guy who his name is Daniel. And they just tell her, hey, capture this guy and get some information out of him so we can figure out what's going on. And so she goes to Washington, DC, where Daniel works and lives. And she manages to capture him by pretending to be just a pretty lady who's interested in him on the train. And then she bundles him up in a car and drags him off somewhere in West Virginia in the middle of nowhere. And she sets up this whole chemistry lab, basically. And this is where we find out that before when she worked for the department, she was an interrogator. And basically, she tortures him by injecting him with various chemicals, which caused him severe, severe pain. And look, this is the point where I really started to hate Alex as a character because, well, for a couple of reasons. One, torture does not work. This is not my opinion. This is not a debatable thing. This isn't me talking about the morality of it. Objectively speaking, when you're trying to get information out of somebody, torture does not work at doing that. And it just annoys me when stuff portrays it as though it does work.  And at no point in the book is it really thought about how, hey, maybe that was kind of a nasty thing that you used to do. And it'd be one thing if this was a book about a morally gray character. That would be fine. That might even be interesting if it's done, right? But it's not about a morally gray character. It's about a person who is treated as being a good person. And it's never acknowledged that she did a lot of terrible things. And nor does it ever really affect her personal relationships going forward, mostly with Daniel, because, again, she tortured him. Please keep that in mind as we go forward. She tortured him for hours at this stage. So she asks him a bunch of questions about what he's up to, what he's doing. He claims that he's innocent.  And he's like, hey, that's not me. And her first thought, her first thought, when she realizes that he's telling the truth, is maybe he has dissociative identity disorder. Maybe this is just another personality coming out of him doing this. And I'm just, lady, lady, how is that your first thought? Did you think that maybe the people trying to kill you for several years might be setting you up right now? Did that ever occur to you? Because that's exactly what happens.  She manages to subdue him and his trained attack dog at the same time. And then she takes off his mask and realizes, hey, wait a minute, this is Daniel's twin brother, Kevin. So Daniel literally had an evil twin who was a spy. And Jesus Christ. And this sequence also opened up my next big problem with Alex, which is that it tries to treat her as being vulnerable. You know, it has her being on the run for years and years. It limits her arsenal in terms of weaponry and stuff. She can really mostly rely on chemistry. She, it wasn't like a field agent beforehand. So she can't do all the crazy martial arts moves or anything of somebody like Jason Bourne and James Bond. Like no, she is just not a normal person, but she's closer to a normal person and she's being attacked by all these spies and everything. So it's trying to treat her as though she's a vulnerable person. But at the same time, it has her getting out at these crazy situations without too much trouble. And it has her knowing a lot of useful information, which maybe she shouldn't know. And it's just, look, in the spy thriller genre, it's very common for the main characters to be some sort of crazy Superman who's way above everybody else, like James Bond is a very good example of this. But if they wanted to do someone who is more vulnerable and just more of an actual character, I would have been fine with that. In fact, I think that'd be a major improvement, but trying to do both just does not work, you know? So I would rather that they had made Alex more vulnerable and had her have to rely on other people a bit more, like, because that would just make her better as a character to me. But at least if they leaned more into the Superman direction, that would be committing to something and not trying to have it both ways because it just does not work in this case. Like Kevin is an experienced field operative. He's armed, he's done this a lot more than her. He's also just a much bigger man than she is and she still manages to get out of it because she's just that cool. And it just, I don't know, I didn't like it that much. But anyways, once Kevin comes to, they all talk it out a little bit and it turns out, okay, this whole thing's been a big setup, like all the agents that have been sent after Alex over the past couple of years, which she has killed, it turns out they were members of the department didn't want anymore. So they sent them after her thinking, okay, either they'll kill her, in which case we're in the clear, like that's a loose end tied up, or they'll kill, or she'll kill them, in which case, that's another loose end tied up. So it works out for them either way. And I will say I did like this twist. That was pretty good. The actual delivery and framing of it could have been better but that was a nice twist, I liked it. And so all three characters realize, okay, we're in trouble, the government's hunting us, what do we do?  The actual destination and reasons for going on a road trip are not super well explained at this point, but they go for a road trip and that is most of the book, actually. It's just them going from place to place and most of the time, nothing interesting is happening. At one point, a hit squad does come after them and they manage to take it out, again, because Alex is that cool despite being treated as vulnerable. And while she's interrogating, one of the hit squad members, she cuts off as pinky and flushes it down at toilets. It's an odd moment, but okay, it's really nothing too crazy, nothing I haven't seen before. And that really brings me to my main issue with Stephanie Meyer as a writer is that she's just constantly explaining all the minutiae of everything that happens. Like every event that happens in every day of every character's lives, life needs to be explained and quite frankly, this book is over 500 pages long. You can see it's pretty thick. A good editor would have cut that down significantly. Like it could have been 70% as long and it would still have told the same story. And it makes it a slog to read. Normally I would have probably gotten through it quicker, but it's a slog and it's boring. And eventually, while the characters are out on their road trip, they discover that this whole thing that they've been set up for did have to do with biological weapons. And basically the guy who was in charge of creating these bio weapons and is trying to cover up his involvement with them, his name is Wade Pace and he is now the vice presidential candidate. Okay, that's a little too similar to Mike Pence in my mind, because it just threw me off and every time I read the name Wade Pace, I was imagining Mike Pence in my mind. And basically the rest of the book from this point is them formulating a plan to assassinate Wade Pace and then doing the plan and then one of them gets briefly captured by the department and then they have to go and rescue him and Alex kills her old boss and then they run off to start a new life together and hiding again. And the epilogue is kind of weird. Like the events of it aren't weird, it's just the framing of it is weird. So basically the main character is all start a restaurant somewhere together and like that's their new life with their hidden identities. But the way we find out about this is in the epilogue a television producer for a reality show calls them and says, hey, we want you to be featured on our show and they say, no thanks, we're trying to keep a low profile because reasons. And the producer's like, okay, that's a little weird but if you change your mind coming back and like that just that's how we find out about it which is odd. And I know I skipped through that last bit quick so we're gonna go back a little. So the Wade Pace thing again, that's just, that's weirdly similar to Mike Pence and it just threw me off because this book isn't like an overtly political thriller or anything.  It's like, it's just very vague.  So it's hard to really get a feel for it other than, okay, he did the bio weapons thing which is scummy certainly but it just, it's not that much more scummy than some of the other things that get mentioned here. So the idea that he's the ultimate target and the ultimate villain is odd and it's just so vague about all the politics other than briefly mentioning that the guy who Wade Pace is running with the presidential candidate is an extreme right candidate. And like, I get this came out in 2016 so it might be trying to comment on that somehow but it's too vague and too weak for me to get anything out of it. Like, I mean, I don't know what Stephanie Myers personal political beliefs are and I don't particularly care but you know, it's there. And throughout all of this, Daniel and Alex apparently fall in love which like, I know that's a pretty common trope of the spy thriller genre where characters just fall in love over the course of a couple of days or something but again, Alex kidnapped and tortured this dude for hours in very, very painful ways. Like it's described as being a horrific experience for him and within a couple of days, he's not only forgiven her and is willing to work with her for the sake of survival, which I could buy but he's just romantically involved with her and they're having sex and stuff. Stephanie, they're not even married. And then there's just issues surrounding the whole climactic plan to assassinate a vice presidential candidate. I think if I say that enough times in this video, the NSA will put me on a watch list so I'm gonna keep doing it. Like the plan doesn't have enough detail in it. There's not enough planning or anything and some things about it are just blatantly wrong. Like they mentioned how because he's only a vice presidential candidate, he's not going to have secret service protection. Like, yes he will. Like major presidential and vice presidential candidates get secret service protection during election time. That's a thing that happens. And just, you know, something that big which is supposed to be the big ending to this thriller, it needs more time to really sink in and at some point along the way in the plan, like usually something will have to go wrong and the characters will have to improvise. Like there's different ways to do it but it just felt way too easy in this book, you know? And that not in like a fun Superman-esque way where we're like, oh, Dirk Pitt, he does everything perfect the first time around and it's just cool to watch. Like it just isn't very satisfying and so that was a big disappointment. So yeah, that's the end of the chemist. It's not a good book really by any means but I will say that I respect how Stephanie Meyer got out of her comfort zone here. You know, it would have been so easy for her to just write more supernatural romance and I'm sure she could have cashed in on that too. Like Grant said, she already has more money than God but she could make a hell of a lot more if she just kept writing in that same niche forever but she didn't. She clearly just felt like writing a spy thriller and so she sat down and did it and the result isn't great but you know, I respect that she tried and I respect that she took a risk, I really do. And also she only wrote the one book like it's just one and done. It's not trying to be stretched out into a series or anything, kind of like The Host.  That is one good thing I'll say about it. It didn't try to get stretched out into a franchise and the thing is, yes, I was kind of vague and I did gloss over a lot of the details in this book. The reasons for that, well, there's two reasons for that. Number one being that I just don't really have time to go into excruciating detail with it like I often do because I could have.   I have to do that and then I have to do The Fifth Sorceress which is an extremely long series. So if I were to do that with the chemist, I would either be pushing those back at least a month or two or I would be having to push the chemist to the end of that and I wouldn't be getting to it until like, what, September or October and I don't really, I don't wanna do that. I just wanted to get it out of the way now. And number two being I wanted to leave some of those details for other YouTubers to cover because again, no one ever has talked about the chemist it seems and I feel like there's a lot of material to be mined there so I mean, if you really want somebody to go into excruciating detail about it and make fun of all the little moments that don't make sense, go bother strange aeons or Amanda the Jedi or something. They'd probably get a kick out of it and anyways, that's about it. The chemist is not good but it's slightly better than Twilight. If you've watched this bar, thank you. Please subscribe to this channel and follow me on Twitter and go check out my Patreon and all that stuff I'm supposed to say here, goodbye. Hello and thank you for watching this far. If you did, you have my thanks and if you see all these names here, those are my patrons. My $10 and up patrons are Oppo Savalainen, Olivia Rayan, Brother Santotys, Buffy Valentine, Carolina Clay, Dan Anseljevic, Dark King, Echo, Flax, Great Griebo, Karkat Kitsune, Liza Rudikova, Lord Tiebreaker, Madison Lewis Bennett, Marilyn Roxy, Matthew Bodro, microphone, Peep the Toad, Return of Cardamom, Sad Martigan, Sillier the Vixen, Tesla Shark, Vavixus and Wesley. All of you are great. If you want to get your name up here, then consider becoming a patron. If you can't do that, then you could also become a YouTube channel member or just like the video, comment and subscribe to share it around and help me eat food this month. Yeah, thanks, goodbye.


Welcome to All Hands Update. This is your week in Navy history. January 9th, 1918, the Naval Overseas Transportation Service, now the Military Seal of Command, was established to carry cargo during World War I. On January 10th, 1917, the first U.S. Navy production order for aerial photographic equipment was initiated when the Naval Observatory issued requests for 20 aerial cameras and accessories to be manufactured by Eastman Kodak Company. On the same day in 1934, the first nonstop formation flight from the United States to Hawaii, consisting of six consolidated P-2Y1 aircraft from patrol squadron 10, departed San Francisco. After flying 2,399 miles in 24 hours and 35 minutes, the P-2Y1 aircraft arrives in Hawaii. If you would like to learn more about these facts and the Navy's history, visit the Navy History and Heritage Command website.


Hey everyone welcome to this weekend's video update. I hope everybody had a good week of trading. Let's get into checking out the stocks Check out the portfolio give you an update on day trading and we will call it a week. So What a what a What a week I mean Just in the matter of week. I mean last week you look like the market was falling and then now Ripped right back up to all-time highs in the S&P now the the NASDAQ is not fared quite so well It's still well under its Under its all-time highs, but if we look at the year-to-date percentage You know NASDAQ still positive on the year. It's up 2% on the year You look at SPX SPX is up about six and a half percent on the year and like I said Crack through its all-time highs So back up and ready to rock and roll now I would think that we still continue to see a little bit less strength in tech in the NASDAQ versus some of these Financials and travel and some of these other sectors that we've seen some strength in this week So I think we get a little bit of continuation of that going forward All right, so let's jump into the actually before we jump into the alerts just quick update on the day trading On the mighty 90s booked 964 on just four trades did not trade Friday, and we will not be live streaming on Monday either So just four days this week pairs trade booked 845 on three trades and then on the runners booked 907 on 26 trades so all in all for the week a little over $2,700 $2,716 and Year-to-date now on our day trades 17 five Since we started tracking back in August a little over 53,000 so Continuing to do well there All right, let's jump into the alerts for The week starting with the beginning of the week mark March 8th First trade we did was an opening trade in goo So we put on an iron duck just looking for different, you know big stocks to to add some add some trades in just To diversify so we're not just doing all indices with our ducks By the way, I'm talking a little bit quiet of there's someone sleeping in the next room So I'm trying not to wake them. It's 5 30 a.m. On Saturday morning at March 5th March 13th Anyway, here's our here's our Google duck because the price is still in the beak Still got a chance for it to come back into the duck head So we'll hold on to that and that expires next Friday on 320 Next trade was an expiration in spx. So we let this one expire this one expired right in our duck head Booked max profit of 635. So nice nice duck head in spx We did a open another weekly double calendar in spx this one You know, we'd like to open these with kind of six to eight days typically But in flood volatility is contracting nicely so we extended one day So we put nine days in the front week 13 in the back and remember these are the am options so This is a situation where we have the opportunity to potentially let these front week options expire and then get a potential move in the back week the next day to Book even more profit, but we'll see what happens. It depends on where price is I'll update you guys on if if we're gonna close that out early or go ahead and try to Squeeze some more profit out of that one And I'll go to spx on the platform here in just a minute. We got a couple other spx trades Netflix did an opening trade this one a vertigo I did this one with nine days in the front 16 in the back as I mentioned here the valley had a little bit higher percentage Then I like on these vertigos. I think it was like 34 percent But what I liked about this is a Netflix is a fairly volatile stock And if you put these price slices to where the break even is On the charts and just kind of get a perspective of where price could go Price just has to basically breach through this to the upside or breach Through this to the downside and it has nine days to do that and so of course we could get in a period of You know serious consolidation and it could just chop around in between these But I think it's a pretty good chance that with with the volatility going on that we see Netflix rip through or rip down and So I'm anticipating us booking a profit on that one And then and the other reason I didn't do like a I looked at spy looked at a bunch of other stocks to do a vertigo and The just the puts you in the indices was a little bit heavy So gave a little bit, you know, whereas, you know in in Netflix You've got a pretty balanced P&L curve where with with You know SPY it's kind of really heavy down to the downside and that's because of that heavy put skew So that's that's another reason I chose Netflix and a stock over SPY GS did we had a long-call diagonal in GS and We closed two of our three with three contracts We told we closed two-thirds of that two of our three contract booked over 60% on those and then On Friday, I'll go ahead and jump to it as our last trade on Friday We went ahead and closed the remaining one and booked over a hundred percent profit on that one So booked over 400 bucks on that on that Goldman Sachs Long-call diagonal and this is what I was talking about is that rotation into financials and travel stocks Whereas the rest of the market was having some downside You know these financials have just been on a rip roaring tear with interest rates going up potential inflation helping banks In their balance sheet, so you can see what happened here. I think we got in right This on this little pullback or maybe it was this little pullback here And it took a little bit of heat one day and then just ripped up. So nice trade in GS Yes, I've had an iron duck in yes We don't do a lot of iron ducks in the futures, but there's some talk About a couple folks really like doing the futures on the iron duck. So we just did one in our portfolio So instead of using SPY or SPX we did ES Just to show you how it kind of works how it's managed to give you a little bit of perspective ES is five times big five times larger than spy and it's half the size of SPX So it's a good a good size portion. So we did two. So basically we did something that would be equivalent to doing one SPX and Price ran higher. We end up closing this out booking beak profit on the trade. So we're out of our ES duck SPX weekly double calendar So we opened up another weekly double calendar Remember we did our first one when it was at nine days in the front week waited a couple days implied volatility Contracted some more. So we added another one with seven days. So let's go to SPX and check out our positions there so it looks like a Pac-Man ghost if you combine them but If we separate them here, so we've got the 38 20 39 50 38 20 39 50 Okay, so here's here's one. So you get price, you know, we're up about 82 bucks kind of hanging out in the upper end of the range And I've got this one here These both have the same expiration cycle. This one's a little bit left of center So we've got a lot of room for the price to kind of ping pong around in over the next few days Next week, and we'll probably take one of these off on Thursday one of them on Friday Remember, it's the AM options. And so we will we'll make a decision as we get closer to expiration As far as when we when we take those off Next trade SPX weekly double calendar. So this is one that expired Friday that we had on price price moved higher I was hoping for a little bit of downside to get back in a range to book a little bit profit But price just pushed through our break even so we had to exit and close that one out with with one day to expiration Amazon opened an iron duck again, just kind of diversifying out of just Indici iron ducks did this one with 14 days to expiration. So we take a look at Amazon Nice big range here is a little under 85% we put it on But pretty close as far as our pop goes Amazon obviously getting hit with a with a lot of the tech but Get getting a little bounce. So we'll see if we we get a continuation higher or You know, obviously we would love to get a little bit of a move lower Towards expiration and hit another deckhead. So that's the plan In Amazon and then I already mentioned GS. So those are all of our alerts Let's take a look at the rest of our positions. We've got a a long put vertical and ES with that Up move this week prices moved out of range on that one. We're holding that for that short Delta exposure Speaking of short Delta. We're a little less than one-to-one on our short Delta Exposure versus our Our short Delta versus our theta ratio when you beta weighted to spy. So I like where we're at there Gold we've got this iron condor up a couple hundred bucks looking for about 30 40% of max profit on that one ZB we've got this short strangle in ZB that we've been managing Prices pretty close to center there. Just giving it more time to theta decay Apple we've got this long put vertical as a short Delta play looking for some more downside to benefit that Delta airline. So this is one another long call vertical again Kind of looking at that the travel industry and the financials as as potential leaders here in this in the short term Delta airlines up 3% today now this one we put on and we got caught and we put it in on back here We got caught on this big flush, but it's rallied all the way back back up to you know new highs here And so you know now we're we're up about I think prices right here. We're up about a hundred dollars on this trade We've got about three fifty seven is our debit pay. That's our max risk So if we can if we can make another little push into next week this expires Friday We'll try to book 50 75 maybe even a hundred percent profit Assuming Delta doesn't fall apart De this is another long put vertical man. This one has just been a thorn in my side It's a very small position very small part of our portfolio, but de is just been Super strong and so you know when you're daily and look at this rally man So I zoom in here, you know, I don't mind keeping this because you know some point This is gonna see some downside, but man, it just it just keeps Keeps pulling back and rocking up. So I would have been a beautiful buy the dipper But we are will continue to hold this for short Delta. We'll probably roll this next week DIA Another short Delta play This is a short short call vertical You can see with this week's price movement price busted out of our range, but still holding it for that short Delta. I Mentioned goo. We've got that iron duck IWM. We've got a long put vertical another one of our short Delta plays Lowes So this is one. This is a long put diagonal. This is one where Low saw this weakness cut this little bounce We got this flush lower and we closed out half of our position at a really nice profit We were holding the other half for another potential flush and Lowe's just really ripped higher So now we're down on our our last piece. So we're still profitable on this trade But I need a little bit of a little bit of a flush lower into next week Actually, we got a couple weeks here So we'll continue to hold this closer to expiration and see if we can't get to move lower in Lowe's Netflix I mentioned our vertigo QQQ We've got this short call vertical here. We're about 200 bucks since our last roll Just holding this for that short Delta exposure SMH. We've got this short strangle, which has been adjusted into a straddle We're up a little over a thousand or about a thousand bucks since we did our last adjustment Just wait for some more theta 2 decay Mention SPX Twitter. This is another long Long call diagonal that we got in looking for potential higher prices Twitter busted out after earnings and on this pullback. We were looking for continuation It started to we had a nice profit and then this thing just got flushed with the rest of tech But we'll still hold it. We've got We've got till Friday on this one So if we get a little up movement in Twitter on the week, hopefully we can scratch that one XL K our last position is a short a long put vertical another short Delta play Up about 70 bucks on this one since we did our last roll just looking for some more downside to benefit that piece So those are all the alerts. Those are all the positions Hope everybody has a good rest of your weekend and we will talk to you next week Remember no live stream on Monday free day traders, but we will be doing alerts and in the community So look forward to seeing you then cheers You


Today I have the pleasure of speaking with Frank Bassa from Canada. Silver Cobalt works. How are you today Frank? I'm wonderful Tracy, and thanks for having me again. And of course we have silver We have cobalt technology metals and you have just put out really what our Significant drilling results in the last 24 hours. So let's start there Yeah, it's just what we're doing here And this is that you know people kind of surprised at some of the grades we got You know like they're about 30 to 70,000 grams per ton But these are what we would call the classic cobalt silver grades. These are historical grades and We might now that we also found gold in it. We might actually lower the grade and because By lowering the grade will actually increase our ounces so we do have an inferred resource about 7 million ounces at 250 ounces a ton and We my goal to what was the last operational grade in the camp which was between 12 to 26 ounces a ton Also a previous user issue put out. We found gold. It's the first time we found what we call native gold in the camp I think we're the first ones who ever found native gold in a camp So we're looking at doing a revised resource more than likely be an order of magnitude change in the grade But we're gonna lower the grade and we'll incorporate the value of the gold Okay, I'm gonna get back to that in just a second because this news release Seemed like a major achievement based on my own personal experience professional experience I was reading another story of course on investor Intel And from our year last News release we wrote that the Robinson Zone project is a hundred percent owned by the company in the 78 square Kilometer Castle Silver mine property in Ontario and that Previously your drilling had resulted in an expansion of the Robinson Zone mineralization by 500% which we thought was pretty significant So what does that mean to those old expansion numbers of 500% with the latest drilling results? Can you comment on that yet? Actually, we didn't expect to find this word was As previously indicated the rock is very hard and the drillers have a tendency of What I'll call missing the target, but actually hitting something else and this is not the first time We're still looking at the numbers. We still don't know how much bigger we made it But definitely we are expanding the zone also this goal that showed up I know some of my investors are reaching out to me by text and email and they're wondering why I'm you know Talking about the gold and the reality the the greatest value when I was working for a unique legal minds in a cobalt camp The bar weight it was about three to five percent gold So the gold value in the silver bar was worth more than the silver in the bar and For a long time we suspected it was located at the castle mine and that's why we acquired the castle mine So it's kind of very significant It'll actually definitely change our resource numbers if we include this gold in it and this goal seems to be coming in from another zone We found which is also within the area. So how big this thing will be we still have to have a closer look We're still drilling like I said, we're only get about 18,000 meters. It's only a small program It's about 50,000 meters and actually we're talking about increasing it It also comes to a point where by it might be cheaper to do a wrap to keep on drilling because drilling right now It's about 200 $200 a meter. So we're spending 10 million doing this program and of course we've raised the money to cover that program But we might we'll have a look at it. We might increase the drill program or we might make a decision to proceed with the ramp All right, so back in you up for those of you out there going native gold sounds good But what does it mean? Can you explain that to our audience? Well, and the camp itself was only know that actually actually mostly for cobalt But it was only mine for silver and for a very long time You know, even we were drilling underground at the castle mine We kept on hitting gold on and off on and off and we couldn't figure out where it was coming from So we have a better feeling where the gold is now, but it's a significant Significance thing that happened to us. I know people are looking these high-grade Intercepts we we hit but we hit gold which was What I would call an extremely added value To our resource So it's quite significant and the fact that we found this a gold I think nobody else has ever found it in the camp. So I think we might be able to something quite large The silver with the gold will make this deposit quite significant And I'm sure people out there going okay. This sounds like a very interesting story They may be new of course to Canada's silver cobalt works So I have this quote that I wrote down from Matt Halliday who is your president and COO and he For those of you out there going okay Canada silver cobalt works. We've here silver with your cobalt Now we're here in gold native gold, too He wrote this is the first company to put a 43 one oh one Compliant in situ resource in the whole cobalt camp and he says we have a resource of 7.5 million ounces at over 8,000 grams per ton inferred and then he went on to say to us in our last interview when you compare to other places when you Compare Canada silver cobalt works of course to other places in the world We are 10 to 20 times higher in grade than most camps now if you could just provide kind of an intro and Explain what Matt was saying when he said that we thought that was pretty interesting the last time and tried to draw audience members To that particular quote in particular Yeah, the thing is like like I said we call this classic Silver grades cobalt silver grades these are the normal grades that were actually in the camp when they first opened up I think we're the first ones to hit something probably in decades in the camp So for us was a major game changer, you know really affected our market cap. I really affected our stock price We're still very early in the stage and our drill program is like I mentioned But we still have a long way to go so When you look at other mining companies are looking at you know three three ounces a ton maybe five ounces a ton It's very hard to find somebody in in in our area and basically, you know It's about 250 ounces a ton so we're just a silver and we don't do what we call Equivalence in other words, we don't take the cobalt and make it a goal, you know a gold equivalent So what we're really looking at here is now where we have a grade of about 250 ounces a ton in our inferred resource It's just kind of unique probably the highest grade resource that I'm aware of globally and we don't put in you know Into our silver resource a cobalt equivalent that converts it to silver or the gold into silver It's we're strictly purely silver at the 250 ounces a ton Okay, so I don't know anybody who knows you frank understands it's very hard to get a hold of you. You're always in the field We always have to talk to your ir professional So we're really grateful to have an update from you congratulations on your news And so what should shareholders and people who are interested because your stock did move very aggressively yesterday on this news Usually that doesn't even happen in our sector. So congratulations. What should we anticipate in this upcoming quarter? I think you'll get more more drill results like this We're gonna have a closer look at the gold because gold will be critical to our resource in our development of our resource And we'll be probably making a decision somewhere probably by the second quarter of next year Either expanding the drill program or going ahead with the ramp Well, as always frank, it's a pleasure to see you and wishing you a wonderful 2021 to you and all the shareholders of course of canada's silver cobalt works. Thank you frank Well, thank you very much race. You have a wonderful day. Thanks


Shoot fire! Shoot fire! Shoot fire! He said shoot fire. We've left 40 seconds. 40 seconds. I'm next. Right side of the race, man. Leader bro on the left side. You see the right side? Okay, okay, I got you. Leader bro on the left. Saw. Hey, follow me. Come on.


What's up guys we're back with another epic video today's video is a recap of an adventure that I went on to New Jersey Golden auctions they asked myself and vintage you go to come down and check out a first edition Legend of blue eyes case. It was pretty cool It's actually from the same guy that we got that first case from about six months ago And he's auctioning it off at Golden auction. So we went down there There's a lot of adventures along the way including mini poke rev Ryan you guys saw some of those videos I actually visited a card shop while I was down there and it got a very cool card So you guys are gonna see that in a minute But before that we have a quick giveaway and this is a good one. This was sent to me by a viewer Let's see if I can show you guys This is a dark revelation for shining flare wingman a member of the channel actually sent it to me with a couple of cards That I needed for my deck and he said I haven't been able to sell this. Why don't you hang on to it? You can keep it. It's like a $50 card. It's heavily played, but it's so really nice It was really cool of him to give it to me and I figure let's just pass on the goodwill So you guys have a chance to win that just like this video be subscribed Let me know your favorite elemental hero and or your favorite part of the trip and let's get into this It's a pretty fun video. I think you guys will enjoy it. What's up guys vlog sent 34 back here with another video I'm heading out to New Jersey Golden auctions invited us for some of their big Yu-Gi-Oh auctions We're gonna go check them out in New Jersey. So we're taking a quick trip Chelsea's dropping us off at the airport Yeah, it's gonna be pretty fun. So we're gonna meet up with a few people up there You might know a few people up there that live in New Jersey and then Another Yu-Gi-Oh guy is coming with me. So you'll see when we get there. We made it. Oh never mind We didn't make it. There we go. We are in traffic It's a good thing. I'm not checking a bag or we would be late We're gonna make it I think though Made it to Philadelphia So I had to run on the plane. We were a little late. We made it. So we've made it's Billy I'm waiting on my personal chauffeur to show up and pick me up right now. So while we're waiting Let's do a quick Not to go sure Maybe next time the chauffeur is here Where they are We can find it. Yeah, that's probably over there. All right, let's see if we can find it He's picking us up What's going on poke a cave today, we're going hunt What's up poke a cave today we are going hunting for Pokemon cards, but also Yu-Gi-Oh cards Who's that? Roxanne 34 And and my name is Ronald Pinsky. I'm 32 years old. I'm from New Jersey. I'm single and I like long walks on the beach I'm the tallest Flocks in 34 here. I can't wear I I can't believe Whoo, New Jersey New favorite stay right here We actually found light of destruction first-edition packs in this shop Which was really cool, but they looked a little bit strange where the wrapping was like see-through I'd seen packs like that before but I wasn't sure if it was legit So Ryan actually bought one and we checked it out Open these up, so what's what's the lucky one? There's go there's go through all this Inie-mini-mini-mini-mini-mini Catch a Yu-Gi-Oh by just just dark magician girl That's the one we're gonna. We're gonna buy this one. Just pull the go through and they're like, yeah, these are good I feel like they're probably good just because it's on both sides. Yeah, it feels good. It's very strange But yeah, do you do a cartridge when you open stuff? No, I don't think you can I don't really know What it would be it's gonna be though.  Where would the rare be? Maybe do a couple do the front couple to the front. What's that? Nine yeah couple to the front. You know I do whatever you want to do is it three Usually not that tricky so all right, let's go I couldn't remember I think there's a rare and Could be I think though so it's four four from the back owners seal, but if there's a hollow Of course, that's what I was on But you give is kind of weirded with some of the such a pretty good condition. Yeah, I think they're fine But yeah again, please it could be Interesting We found a Pokemon and you you card vending machine and Rev was buying stuff So I just kind of came over there and butted in and started opening the you yo cards with them and You guys will see the results All right stadium old lady my bae Barry Maybe we got all the bad luck out of this one You gotta literally Rusty sword rusted sword crushing hammer Right there Ready Let's try this one this maybe this is the one I Skyla Pokemon communication Shauna random receiver We have not hit a hollow. It's not honest. No, I'm ready. Well, if we do it this way. We will Ready Look at that Professional right now. We got a full pack double chance at a rare giraffe rig super rod Team yaltown rusted shield rusted shield rusted one was all We're not giving up yet you you gotta go for the four man you gotta go for That's what the people want. We're not doing that one though We're just dropping cash right now we're getting some magic cards. Okay, all right, let's start with these How to move bulk Hidden springs for the far East in a Ferris wheel Also not looking promising Professor's research ball guy ball guy. No, we got trolled I need to I need to use more of my research for But like we can we can get the coupon And we could get a free this is could be good We could get a free booster box or $20 in free pool. They can't give us a free Pokemon booster box That's it Or $20 of people. Yeah, right? Maybe it's one or the other. Maybe you don't get the juice, you know Double trouble All right, let's go come on This is where we think to the change Rusted shield gym trainer gym trainer. It's gonna be another one. Oh, so many rusted shields and gym trainers. Okay Wait, I'm not so how do you feel after that? Yeah, so we spent $20 in quarters. Yeah, we spend here's what we got This was not good so much of comments in some couple years. Here's some more Wait right here. Here's the rest of it. That was great. That was awesome So was it worth it? How do you feel right now? Can you go back and do it? I think You spent $20 that the odds it would have been at least a pole better or worse than wish If I had to compare it to which I would say honestly, I'd probably prefer to go to wish I Think so as well So worth it not worth it Not worth it. Nope. Just picked up ultimate rare Mobius With pokey ref and Ryan Let's made it to the hotel. It's been a bit a long day flew over to New Jersey Hung out with Rev and cool trainer Ryan. That was a lot of fun. We went to a lot of different stores We found not much, but we did find one thing. I want to show you guys I kind of give you probably a quick preview. I don't know if I kept it in the video or not. We actually found a Ultimate and ultimate rare Mobius the frost monarch. Yeah first-edition ultimate rare from solo the duelist and it was listed as Lightly played in the store and honestly this thing looks pretty good. I mean check this out I'm gonna cover up my face. He's yeah, look at that Yeah, that card looks pretty. I mean does that not look pretty. That's a good find guys Check this out. I mean the back does have the usual soul of the dual scuffing. You can see it there But they had this listed at light play and honestly, this is how they come out of the pack usually I mean, oh man, this is a nice one as a few scratches on it got some scuffing. I mean honestly, it's a really nice card So that was really fun to pick up that We did a few videos stuff like that now. I'm waiting on a Lewis vintage Yu-Gi-Oh to show up his flight got Delayed, I think and he's gonna show up at like 1 a.m. So that was just me I'm chilling thought about to edit for a different video for a video. You guys will see before you see this I'm in a fun time. I got to see the pokey cave I mean if Yu-Gi cave that place is crazy. It's a lot of fun And I think that's it for this this update for the vlog tomorrow. We go to golden We're gonna check out some pretty epic items that they're auctioning off and probably do some chatting with some of the people at Golden auctions.  We are waiting on vintage Yu-Gi-Oh to show up at any second It's late. He's finally here and we're editing Hey You finally made it. Hey, you got some McDonald's after many years. I've aged two years.  You mean to tell me Yu-Gi-Oh carts don't have a deeper meaning And there's a lot of desires I had to am about deep remaining chaos sorcerer masquero Look at that. No, you got it. Okay. Yeah, there we go. Oh, that was good in that I only have a few clips of Lewis and I actually in there with the case. It was really really cool There's actually a full production video coming out on their channel So you guys will be able to check it out when we actually crack the actual case, which is pretty crazy We checked out the boxes. It was it was pretty wild Yeah, right there with the golden option First edition it's about to happen full case That's pretty insane Pinty Ju-Gi-Oh here with absolute fire You can't get anything crazier than that find it and I'll believe it But I think this is the pinnacle of Yu-Gi-Oh items, especially sealed items You know, you're gonna have your prize cards and things like that But of something that you or I could actually obtain and open this is the item to own How do we keep finding these? I don't know Very lucky So if you guys didn't catch it the first time the same seller that we bought these cases from in LA had another Sealed LOB case so yeah, he was setting on an absolute gold mine so he could thank us for telling him to keep it sealed Yeah, so we just opened it for him So yeah, just truly an epic moment. You want to start getting into getting the boxes out here? Yeah, let's do this. The deed has been done yet again We officially broke the seal. Yeah on the first edition LOB case that was pretty fun. That's pretty crazy. Yeah, I think definitely a once-in-a-lifetime thing All the boxes look really nice Chris and seals were right and whoever gets that is gonna have a very unique kind of put your guesses in the comments What will the entire case auction for it's gonna be interesting to see? I think it's in November something. Yeah Yeah, so it's gonna be Be a lot I think but look any of you guys want to buy me a Christmas present That's it Christmas present for vintage Yu-Gi-Oh send it over there if you win the auction. Yeah, it'll be great It'll be great. So just just do that. That's it for this video. I hope you guys enjoyed it There's a lot of different stuff going on We don't do a lot of vlogs if you guys enjoyed this one Then maybe I'll do it more when I travel or whatever happens, you know in the future So if you do just let me know in the comments and that's it for this one. I'll see you guys later peace