Hi! My name is Henry Castro. I had experience resolving bug-related to import conditional format data bar examples from Excel document. Overview. First, I will talk about the main data structure relationship of conditional format, the LibreOfficeCore process. Then I will analyze the data structure relationship to import data bar conditional. And finally, the issues I have found for future improvements. This is the main dialog interface to insert data bar conditional format. It can be invoked when it's clicked in the format menu in the folder conditional. As you can see in the in the dialog, there are the basic properties to it. Here is the main data structure relationship in the LibreOfficeCore. You can see the class conditional format is the list of entries of with each entry. This is the base class. And all the six classes you can check about one, the color, the date, and conditional entry. But in this particular set classes, we will see the generalization of this, or else specialization, the color square format. You can create instances or one of these. But this is the main focus for now because I'm going to explain how I fixed some some of the bugs here. And the data bar format. You can see has some specific properties. And if we create an instance of this data structure in memory and insert to this list, LibreOfficeCore will process the conditional. Okay, let's concentrate on the data bar format class. As you can see in this relationship, there is a struct called data bar format data. There's a relationship of composition here. I don't know why it separated this. This could be included here. But anyway, there is an actual relationship here in the memory of LibreOfficeCore process. Then you can also hear the basic properties of the data bar format. And focus on this one, the positive color that I added because it was missing. And we will focus this dissertation here. But later we will show you some issues I have found and very, very confusing when I was reading the code and trying to understand these data relationships and try to fix or patch some of the code. Okay, let's try to import this example, a portion of XML file. And you can also hear that the field color property is the one that wants to extract it or read it. After the parsing process, this data should be saved in our memory here in positive color within our data structure data bar format. And once we get that information in memory from the word, we will successfully import it. Finally, we will analyze these classes you can see in the relationship. This class has two compositional classes and one is the role model and the format data. You can see that the attributes from these two classes is very similar in their duplicate data. This is one of the first issues I have found. And of course, this is when I was reading the code during the parsing, it is read it and write it here that bubble before. And after calling the finalize import, this is copy that data from here. Obviously, this is a duplication of code. And in some way, if you are going to read this code and a future improvement, you can remove this class. It is not necessary and it's very confusing at the beginning. I'm trying to read this code. And of course, the unique pointer here with this data structure is all confusing here. Anyway, that will possibly improve in this in the future. That's it for me. Thank you very much.


So this is the name of our presentation, Insights from the Cloud Native Security Slam. I will be giving you insights and I'll be telling you what the Cloud Native Security Slam is by the end of this.  I am a father of a nine and a half month old child. I'm a recently published fiction author, recently published author of several Linux foundation training and certification courses, which we were joking about with probe just a second ago. I'm a reviewer for the open SSF security insights specification. I organize the event that we're going to talk about today. And I am a maintainer on the compliant financial infrastructure project for Finos, which is pretty fun. And I've been doing that for a few years. I am also the Ospo technical technical program manager for Sonatype, which is just a lot of words strung together to try to describe the work that I've been doing for them, which is just engagements with all of these foundations and helping elevate the community as a whole, because that's a really strong vision that we have that doesn't have any of my social media profiles on there. So you can't hate tweet me. But if you guys want to drop me a line, I'm on any of the slacks for any of our open source foundations. You can also just shoot me an email if you have any questions about the stats that we're talking about today. Connect with me on LinkedIn. And please don't visit me in Austin. My company Sonatype. If you're a user of Sonatype, sometimes you might actually forget that we are servicing your company. What we do is we provide dependency management solutions. But what we're most known for is our research that is very frequently quoted. It's been quoted three in three different talks. You quoted it, you quoted it. I don't see anybody else that's quoted it. This particular conference. But this is the eighth annual picture that I've got up here. This is from 2022. The next one is coming out in six weeks. Ah, I forget. Very soon we're coming up with the ninth annual, the annual supply and security report. Sonatype is really, really big on research, gathering data, analyzing the data, yelling at each other about the data before we write it up and present it with pretty visuals. That's something that we really, really enjoy doing. And so I decided, Hey, let's do that with our work with the CNCF. Part of that is that we're going to be looking at lines. So you guys should know a thing about lines. Some lines your family and your kids will beg you for other lines. They will beg for you to get them away from some lines are just suggestions. Other lines, you really want to get right. Some lines have a multitude of purposes. Some lines are very, very specific. Some. Oh, I didn't do my, my animation on here. Yeah. Some lines are work that nobody gets to see. Some lines will make you a star. Some lines arbitrarily describe the world around us. Others holistically define what we experience, such as jet lag right now. Some lines are, my animations are messed up again.  Some lines tend to self-organize. Other lines, you get the point. So we're going to be talking about work that we've done within the CNCF. Over the last couple of years, there are a couple of things that we've noticed inside of the cloud computing foundation, which is that hygiene needs are really, really complex. It can statistically, we see that it's not easy for maintainers to achieve the necessary security hygiene to achieve. I'm going to pause to actually reference the security report that we did before our annual reports. We found out that there are ways to predict the presence of a CVE. I'm going to talk about that more later on, but the things necessary to bring yourself statistically less likely to have CVEs are difficult. They're complicated. It takes a little bit of focus to actually get those in place. So inside CNCF, there has been an effort to create a tooling that is going to actually run a series of checks, automated hygiene checks, and make them available for any projects that are part of the CNCF ecosystem. Some of those checks are going to require non-dev knowledge to make those improvements. And so last year, well, we've been doing things similar to this for a couple of years, but last year we had the first official cloud native security slam. This is an event designed specifically for collaboration, so that way everybody's making the same improvements at the same time. We're going to talk a lot about that and the results that we've seen from that. But another problem that we've seen is that there hasn't been a lot of knowledge about where we've been. There's been a lot of point in time knowledge, but not historical knowledge about where we've been and how we got to where we are now to help us predict about where we're going in the future and lessons learned. And so last year, during this event, we added historical score tracking, which seems super intuitive. If you're doing checks, why would you not just drop the results into a database? And once we said that out loud, we were just like, yeah, yeah, let's do that. So we've got 11 months of scorecard results inside of Clome Monitor, but these are limited. If you haven't been to one of the talks this week about scorecard, there was a talk that was like, here's exactly what scorecard is and all the value and how it fits together with other tools within the open SSF ecosystem that are provided for open source maintainers to help increase your security hygiene. If you didn't go to that talk, Google it, figure it out. It's actually a really cool tool for open source maintainers and for consumers to be able to know about what you're getting from your open source projects. Clome Monitor runs a subset of checks from, oh, I didn't even mention, there's another talk that broke down for maintainers about exactly how you can bring your score from zero to hero. They spent a lot of time getting it to zero to bring it back up to 9.6 or something, which is about all that is practical for a lot of folks. Clome Monitor seeks to take a select subset of checks from the open SSF scorecard and then do a bunch of other stuff. Hygiene is the goal, not perfection. And we have now 11 months of visibility from those checks being run. And I did about 8,000 API calls to get all of that data, format it. This is for 163 code repositories that are tracked and have been tracked. And as you can see, things are great. This is going really well. But we didn't have this knowledge before. We have visibility now to see that it's not just where you are today, but over time, without intention, without a thorough eye on what you're doing for your security hygiene, you're going to be all over the place.  That is the percentage of lines that are not visible for that particular month. This is 11 months. I just grabbed five of them. They're not visible because they're all the way at the top. You have 100%. Those are the projects. Remember, we're doing a subset of the scorecard. Scorecard 10 is amazing. You got 10. You are probably the first person to ever do it. You're perfect security hygiene. Clote monitor is not looking for perfect. Clote monitor has a standard that is expected. And we do predict that all projects can be in that green section. But this is how many are right now. At each of the points in time. So let's scope it down a bit. Get some of those lines off the sandbox projects. They're the most sandbox projects because there is a process to get elevated from sandbox, to incubation, to graduate. There's three different levels. Sandbox is the first level where CNCF says we believe in you, but you're not there yet. Incubating is going to be the next one. We kind of expect this from sandbox. They're not yet incubating. They're going to be all over the place. So incubating is, hey, you've been hanging out with us. We've seen your project grow. We've seen adoption increase. We know you. And as expected, the security trends kind of go up. There's one big outlier there. I put it in blacks that we can't call them out too specifically because these are incubating projects. We don't hold them to the same standard as graduating projects. So we would expect, this is roughly what we would expect to see. So when we go to graduating projects, as you would expect, no, that's not what we would expect to see from graduating projects. We would expect to see sandboxes all over the place. Incubating is better and graduated has the highest standard, right? Now, I don't have a really, really effective laser pointer here, but if you can squint and see, let me wiggle it right about here. Actually, it's right about here. Kubernetes is right here. It's green. It's green. 65 to 75. 65 to 75. Yeah, I was hoping I had a red laser pointer today. I don't. 65 to 75 is where Kubernetes is hovering. And that's on security hygiene that is basic expectations. This means that according to sonotypes research, Kubernetes is statistically more likely to have vulnerabilities than many incubating projects. Now, Kubernetes has a massive code base, an overwhelmed contributor base. It's a huge target. It's understandable that it's going to be hard for them to keep up with everything, but it's also important to know to keep track of it. And so this data is really, really important to have so we can visualize it so we can swing back around and I can tell the Kubernetes contributors, hey, guys, in May, you failed the code review checks. Why? Why did that happen? And so we can have those conversations now. But let's look specifically at those projects that I mentioned earlier. When we started doing this data tracking, it's because several projects came together for the event to collaborate on improving their security scores. Google was amazing and ended up donating your team, ended up donating about 27,000, I think it was 27 and a half thousand dollars towards the CNCF diversity fund, diversity and inclusion fund. I think Sal, you helped secure some of those, some of those processes. So it was really, really cool to have that happen. And they were all donated on behalf of these projects. So these projects have their name on a website somewhere saying that in their name, donations have been made to the fund inside CNCF because these projects worked to elevate their security hygiene and Google wanted to give them credit and attention and awareness for that. This is their scores over the last 11 months. That is so much better, right? There's still variation, right? There is still some things that we need to talk about. And because we have this data, we can have these conversations. But that is, yeah, that is so much better. I think right now, two, maybe three of those are graduating. And the majority of them are sandboxer incubating. And yet they're performing significantly higher on average than any graduating project inside CNCF. So what we're going to do now is we're going to look at what are the things that we increased? What are the things that we've been focusing on? And then we're going to break down for each individual one, such as binaries in the source code, I'm going to break down what the actual results were. And this is why it took me 8,000 some odd API requests to get all this data. Because from here through the rest of the presentation, we're going to be talking about each individual check and how the different maturity levels performed. The first one is binaries in the source code. This one is terrifying if it fails. If you're going to attack a project, if you compromise a project, or if you compromise a container, the best way to slip your attack through without getting it noticed is to give an obfuscated file that executes during build time. It's going to be a binary file. It is not a code file that is reviewed and visible, and all of us can see that it says steal the crypto. It's just X, Y, L, 1. It's just a mess all over the place, and you don't want to see it in there. So it's good that we are over 75% passing on this check. It is good that our graduated projects are almost universally passing it. We're going to have to have a conversation with somebody because one of the projects unpassed it in May, but they fixed it. So conversations are possible for these kinds of things. Concerning, though, and this blue line right there is our sandbox projects, that level one of three, level two is the red one going right across there. So it's concerning that there are more sandbox projects. I didn't make myself a post-it note with the exact number, but there are, oh, it's on the bottom. This is how many sandbox projects are passing that check in the blue graph right there. The red is how many incubating projects. There's just so many more sandbox projects that exist. And so the fact that they are statistically more likely to have proper hygiene on the scariest check possible, it's kind of weird. That's a weird thing for incubating projects to be aware of. This is that purple line up there is our slam participants. People who last year focused on their security hygiene have not had a single dip the entire time. Green is the average for the entire ecosystem. Right? So let's go to the next one. Securing your CICD pipeline. This is a check that CNCF cares about because if this check fails, that means that there is a practice in your build or release process that could subject you to some really scary stuff. Here's an example of how you could exploit an insecure CICD pipeline. This is not code. This is not fancy. This does not require special permissions. If your project is printing out the title of a pull request, which is a common thing to do, here's my pull request. I'm going to in my delivery pipeline print out the name of the PR that's being checked or merged. If you are not properly filtering it, somebody can dump out all of your secrets. That's freaking alarming. So this check makes sure that you're not doing that type of thing. There's a few other things that are lumped in it. That's an example. So we're really happy to be above 75%, but again, we're going to need a conversation with these incubating projects because this is another terrifying check and between 20 and 25% of incubating projects are failing it. The graduated projects we would expect to be at 100% and they're not. Somebody from the security slam drifted recently around June, but because we have this data, we can have that conversation. Here's the next one. I didn't animate this properly.  This is the thing they tell you never, never try to fix it on the fly, but I've got information behind there that I want you guys to see. So let's click the animate button and restart it. Let's see how this goes. Oh, it's so convincing. All right, don't start from the beginning. Let's present from here. Oh, this is exactly what I wanted to happen. That's what we were going for. That is what we wanted. Yeah, no kids, no animals, no live demos. This is live edits. So I think that might actually be a combination of an animal, a child and a demo. All right, I'm mentioning the dependencies. There's just some background information. What I didn't mention before is that on these slides I'm quoting myself mostly. I told you earlier that that probe helped me and some of the others produced some training courses on this material. Those are where these quotes are coming from on these slides. Managing your dependencies, this is dependabot. This is renovatebot. If you're a maintainer of open source projects, these are things that you're very familiar with and you shouldn't be scared of implementing. It just takes a little bit of focus, a little bit of time and you're going to implement it. Really cool thing that I was trying to save for a second is that Sebastian has got a pull request right now to make a back reference to open SSF scorecard. So that will be a configurable option that you can add to your renovatebot outputs once that pull request is merged. So it was merged yesterday. Huge, huge. Things like that are what elevate the ecosystem because we don't all know everything all the time so we need to cross-reference as much as possible. So when we're inside scorecard, we're reminded that we have to use dependabot when we're inside. Renovatebot, we're reminded that we need to use scorecard. When we're using guac, we're reminded that we need to use salsa, et cetera, et cetera, et cetera. These are the things that we need to do because there's so many different ways that we can improve our security and reduce the availability of bad actors. Dependencies are what we're talking about on this slide. Dependency management is just do you have a tool in your ecosystem telling you when updates are available? This is trending upward. The thing on the bottom is the one that I really, really like is that our sandbox projects are really getting aware of this and incorporating them. And again, they're staying percentage-wise way above our incubating projects, which is a conversation that we need to have. Having these dependency updates gives us the knowledge that we need to make the right decisions to secure our projects. Here are our SLAM participants compared to the average in the ecosystem. Can't do a lot of applause for this because it's just expected at this point, right? But with that last one, I do want to call out that green line going up is really important. Percentage-wise, it's low. We don't have a lot of momentum percentage-wise, but the number of projects that are realizing that they need to be implementing something like DependentBotter and Grenovier Bot are rising. And so that is something to actually celebrate. That means that the ecosystem is having the right conversations and is being exposed to the right information. We just need to do it faster. Permission is the pipeline. This is another one that affects our CI, our CD. It's something that is important. We want to keep an eye on it. And we definitely don't want to see it hovering at 20%. Fortunately, our graduated projects are twice as likely to be securing the permissions in their pipeline. But if the ones that don't, the 40% of graduated projects that don't are going to be more... Ooh, I lost a word that I was going to say. If there is a compromise at any stage in their pipeline, there is a chance that their entire pipeline could be compromised. Their entire delivery process, their entire codebase could be compromised because they have not properly implemented the permissions across their entire CI, CD pipeline. We are not perfect among our SLAM participants, but that line is very far away from that green line. And so dependency permissions or CI, CD permissions are something that is annoying to maintain. Every time that you update your pipeline, you need to keep an eye on how you are declaring your permissions in there. It's annoying. It's not easy to get perfect every time. But we see that the people who have been made aware of this are generally maintaining it. Next one. We're on five of nine, so we're almost through all of these checks. We're past halfway. Communicating security policies. This is something that is not actually programmatic. This is community-wise. So we've got people in our community that are bug hunters, security researchers. We third of our employees are security researchers, I think. These are folks that are going to be finding issues in code. And then you've got clever end users that are going to say, that didn't behave like I expected. Let me figure out why. That would be a disaster if somebody took advantage of that. There are people who are finding things in your community across the board and you need to give them information about how to report that. The security MD is a standardized way to do that. And it's also where you're going to put other security information that's just going to be helpful for your team, your project, your end users. But the biggest, biggest thing is that the security MD, when formatted properly and used properly in your code base, is going to give projects the ability to receive those vulnerability reports from the community. I did expect this. Our graduated projects are almost universally making sure that vulnerability disclosure processes are communicated to their communities. I didn't expect Sandbox to be as high as it is. So this is actually a pretty optimistic stat. But a year from now, all those lines to be at the top. That's what I want. Because we know it's possible. Protecting your source code. Does that sound important? Yeah, it's important. Branch protection is one of the ways that we are securing our core source code. And April was rough. Because not because everybody just completely dropped the ball, but because the insights that we had available to us became more accurate. And we found out that there were just places where the branch protection was not as robust as it otherwise had appeared to be. And this is another really scary statistic. The fact that it was hovering around 75% was scary. Learning that a lot of our incubating projects are barely above 50%. The likeliness of an incubating project to be passing a score is barely above 50% is not okay. That's a weird stat to have. And we need to be talking about this. I'm not proud that our SLAM participants are not performing significantly higher. They're performing higher. Because they're thinking about these things. They're addressing these things. The thoughts have entered their head. But it's a difficult thing apparently. And we need to be paying closer attention to that. Maintenance. I think we were talking about this last night, Billy. Maintenance is not an easy check to pass. Because it shouldn't be. We should be holding a high standard for how often our code is touched. Because that means that somebody is getting in there and thinking about it. Not just looking at do I need to do a dependency update. But that's still something. When we're actually getting in and looking at our code base, we are more likely to bring in knowledge that we've gained over the last month. We're more likely to be having critical conversations about potential vulnerabilities. Pretty good. That's pretty good. Most of our projects are active. I like those numbers. I like those numbers more. S-bombs. The biggest debate and hottest topic. Do you have software materials published? Pretty good for weight. That is zoomed in. We are not supplying information to our end users about how our software is being built. And what dependencies they are bringing in. Which means that we are not giving them the critical information about the actual code that they are running on their machines. And if you're doing federal, it's going to be even more important for your future. Look what happens when we zoom out. It's a big gap. Look at the bottom. Half of the S-bombs in the CNCF ecosystem. Green bar is the total ecosystem. Purple bar is our slain participants. Half of the S-bombs in the CNCF ecosystem were produced by projects that participated in the security system. Nine of nine. Do something for provenance. It's really, it's not like, hey, guys, get to salsa level three and have Guac like integrated into your ecosystem and then publish things for your free, it's like, do you have a signature in place? Like, are you signing your releases? That's what we're checking here. And that graph is zoomed in again, you guys. That's not cool. So my biggest question is, if we tell end users and ourselves, if we, if we say that proper security hygiene when consuming a product is to validate that it originated in the correct place, how can we, how can we build a habit of validation across our end users if we're not providing them signatures to validate if less than half of graduated CNCF projects are not supplying signatures? How are end users of technical projects across the world going to build a habit of consuming those signatures when less than half are actually been providing it? Less than a quarter of total ecosystem is providing it. But it's not something that's impossible. It's annoying. Our slam participants actually were delayed on getting that line up. It's annoying. Yeah. But it needs to happen. And it's a really, really, really annoying number to see that green line hovering under 25% because that means that we cannot create a worldwide habit of validating the origin of our software, our provenance. But bad news is first, good news is second. I tried to do that on every single slide. Bad news is the ecosystem's not doing well. Good news is we've got the purple line. We can show that things are trending upward. This is the total summary score. So earlier, I gave you that massive graph of everybody bouncing around all over the place. If we summarize that and then just put colors on it per ecosystem, 75% of our projects are... Oh, sorry. This graph's confusing me. It's good. It's good. But it's possible to get it way, way, way, way, way better, way better. So the big thing to tackle, to think about, is how do we get it better? And something that I will preach until I tip over is that when we're figuring out what to do, especially with that whole long list of different security hygiene improvements, it's like, well, you're just giving me nine things and that's a subset? Like 20 more than I'm not even talking yet? Like that's really annoying. And if you look at Clio Monitor, they were also like, well, hey, there's the best practices and then there's legal and there's licenses and then there's documentation. And these are all indirectly contributing to your security. It's really annoying to triage and prioritize this work. This right here, it's in one of the courses about scorecard, about how to prioritize which checks you're evaluating. But at the end of the day, there's two key things. Any work, whether it's security or software features, you want to think about how important it is. If it's features, how many end users are we solving problems for? If it's security, how many bad guys are we stopping? How bad are the things that we're stopping? What would be the problem if this wasn't done? So that is going to raise the importance of something. But the ability is also something to consider when we're evaluating the priority, when we're deciding which order to do things. If Billy just had a baby and he's out for the next two months, but he's the only person on our team who has the knowledge, the historical insight, the skill set to address this critical security problem. Even though it's the most important one that we have, does that mean we don't do the second most important one? Well, Billy's out. We can't get to number one. So let's work on product features for a while, guys. No. This is kind of a no-brainer, right? But oftentimes, what we do is we look at the biggest, most important, hardest things. We say we don't have the people at the table right now, so we'll do security later. And that's just not the way that it should be done. And it doesn't have to be done that way if you just slightly shift your thinking to involve ability and importance in every single triaging conversation. And if you want to talk for 30 minutes about that, I will. What I can't put on a slide right now, but I have been given permission to say it, allowed to you, is that in the 2023 report that's coming out next year, it has been found by Sonotype that the end user secure consumption of open source has not improved. There's been zero improvement in the last year of secure open source consumption. Yeah.  I feel like this is a lot of really good insight. Yeah, the fact that our end users are not using the information, I'm actually going to bring a microphone next time you talk. The fact that our end users are not using the tools that we're providing to them, the fact that we're not always providing those tools is important, too. But the fact that end users are not managing their dependencies, that end users are not validating their provenance. Things like this are examples, and it has improved. So this year, going into the security slam that's starting next month in October, if you're part of a CNCF project or would like to harass your maintainers to let you make contributions, next month, what we're going to be doing is one of the problems that we're trying to solve is that end user awareness. And so we're going to be incentivizing and creating prizes and awards and little badges and patches that you put on your sweater or backpack if you want, the creation of documentation so that end users can know the best way to consume this. And actually, we've got some really good ideas for how those improvements are going to be getting distributed to end users. The second problem that we're trying to make sure that we solve is that dip that we saw in SBOM documentation. Providing the SBOMs to end users has dipped, which means that it's not properly being automated. And so we're going to incentivize proper automation of your SBOM creation. Whoa. Whoa. Let's go to that one. So the third thing, right there in the middle, that we're seeing is an issue, is that there are other indirect stuff. So I mentioned it. I kind of rattled it off. There's documentation. There's licensing. There's just general best practices. Legal statements that are just being made available so that way end users in enterprise settings can better consume this need to be considered. And so instead of only focusing on the scorecard checks this next year, we are going to incentivize and reward projects who make general hygiene improvements. And this one was added especially for that purple line. All the people who participated last year and already got their security stuff in, hey, you guys do the indirect stuff too. Like, we've got a prize for you. And this year we are focusing on giving awards to the actual maintainers that are doing the work. Fourth one, not all projects are actually set up to where they're showing up on our stats. Billy, I think you have a couple that are not showing up on our stats. We were talking about this earlier. So we just want to make sure that they're actually tracked. And then that they are brought up into the proper security hygiene. Then self-assessments remain incentivizing doing a self-assessment because I changed this to problem or hypothesis. The fifth one down is a hypothesis. We believe that simply thinking about the security state of your project will result in you making better security decisions in the long run. And so we want to test that out. This year we're going to incentivize projects doing a self-assessment. So that way we get that historical data. A year from now we could look back and say, hey, the ones who had stopped and documented their own state of security have now performed this way over the next calendar year. So if you are a end user of a CNCF project, a maintainer of a CNCF project, or if you're just like wanting to harass your maintainers and get an opportunity to get involved with elevating your project community. We have an event page. We've got a kickoff webinar where we go spend an hour going through all of this. A couple of people in the room are going to be speaking at that webinar to help make sure that we're all aware about the opportunities. And we have a library of curated resources to make sure that we have a good knowledge base for when folks are choosing and triaging which of the problems they want to tackle, that we have resources available. So that way in that 30-day event that's coming up from October 10th to November 7th, I think is what it is. That's not 30 days is it? That month-long event, we're going to make sure that we have community channels for conversation, SLAM resources for research. And we want to see as many projects as possible participating in this. If you're an end user, which I mentioned a minute ago, we have a survey on there, just pop in and say that you care. So that way we can spin around your project and we can say, hey, I have five of your end users who cared about these three metrics specifically, right? So that can help you guys in your prioritization as you're choosing what to do. My next slide says Q&A, but I'm just going to leave that QR code up there. How much time do we have left? Because I lost track of we started at 11.55. So that means that we have 10 minutes now for conversation. Is there anything you guys would like to talk about considering all of this, right?  Some of those stats are concerning. Some of them are kind of encouraging if you look at them in the right light. Yeah, please. I saw you first. Sorry, I'm supposed to do this. Mute. Could you tell me your name too? That'll help me out a lot. Programmers don't do end user devices. So my name is Tom Hennan. I was curious, the way that this is presented, it is measuring the individual projects, which is certainly how it needs to be done. Certainly some of those things are potentially failings of the project themselves for not putting in the work. But do you have any guidance for specific things that could be done better that can actually make this easier? Like you mentioned, hey, we're not generating S-bombs in an automated fashion. If we just added this tool to this default publication workflow that everyone on GitHub Actions is already using, then it would just happen and they don't need to do anything different. Yes. So we have a course that just went out yesterday that is going to be part of that security same library that touches on, so it's Linux Foundation training and certification course that's an hour long that touches on every single thing to consider related to S-bomb production and signatures and provenance. It's really cool. It's really fun. OpenSSF helped contribute to reviews and stuff for that. But the key thing is that if your only goal is to automate your S-bomb creation, there are tools that do just that. And it's a matter of finding those tools that are appropriate for your language. Do you mind a follow-up question from him? Is that okay? Yeah. Well, I guess what I was wondering is like, to what extent can we bake these best practices into the defaults of the tools that these projects and all the other users are doing? As an example, GoReleaser in their most recent release has added S-bomb generation as an option. So it's totally possible and we are seeing the community go in that direction. Please. Hey, Frenchie from Syncnia. Two questions. One, you mentioned regressions when that's detected. It's the opportunity to have a conversation. Is that a conversation? Can that be automated? And then second one is obviously seems like a very clear correlation between involvement and security slam and positive outcome. What are the constraints for more involvement? I don't do good with two questions. Sorry, first one was regressions. Is that a conversation? I think it's a conversation. It's, hey, was this automated? If it was, then why did it dip? Did you change your automation maybe? In some cases, it came right back up. Code review for Qboarden went down and then came right back up. So when we saw earlier, there is a page where just everybody bombed on code review. Qboarden wasn't even watching their stats. They just were part of that dip and then quickly resolved it on their own through best practices. And so that conversation with Qboarden would be like, hey, guys, what did you, what did you do that you recovered so quickly and other people didn't? And then with the folks who we thought had automated it, the question is like, well, then why didn't, why did it dip? Right. And so, so I think conversation is very, very often the first place to start. Yeah. Kara, you raised your hand first earlier. Oh, cool. Okay, great. The same question was just correlation between involvement and security slam. And yeah, how can we help get more people involved? Awareness. I haven't talked to a single project that said that sounds dumb. It hasn't happened. Yeah. But, but also there's, there's just a limited number of us that are really championing this and saying, Hey, this is an event. Argo, for example, they're not going around screaming that everybody needs to join it, but into it is blocking off engineering hours to make this happen this year. Right. So there's a lot of excitement, but not a lot of championing. Could you talk a little more about the role of documentation? You were saying that documentation seemed projects that documented their security practices had fewer regressions. Is there any other data on that or other non-engineering actions that support? Yes. So the indirect stuff right now is, is part of a hypothesis. I think there's some places where we are asserting that increased documentation is going to, to result in, and we're making that assertion. But as a, as a general trend, it's a hypothesis right now. We, we believe, we firmly believe that increasing the health of your documentation will create those security outcomes, but right now we're, we're wanting to use the security slam to prove that hypothesis as true this year. Do you mind passing the microphone? If you have a question on the way, just steal the microphone. I think a light means it's muted. Is it? Okay. Love the power I've got now. So I think the one, you're going to get statistics out where it cuts around languages as well within this, which I think is going to be interesting. So, so what Sal just referenced is that we are intending and hoping and, and trying to make sure that next year's statistical analysis includes a breakdown, not just of project maturity, but project language. That's something that we want to, we want to make sure we do. But I think in terms of making this work and make sense, this is common sense interventions. I think the reason why this is not having the effect that I would like it to have is that we're effectively coming in as volunteers and doing drive-by security interventions and not getting the buy-in from those developers to start doing security first principles, right? So the reason why Intuit and Argo CD are doing this because we've all worked with them, right? We've worked with them to get that as a security first space. So thing that you can do to make sure that the security slam works is make sure that you have that focus of security in your team. Set that time aside next month. Yep. If you're listening and you're an end user, I don't care if you're a maintainer of one project, but if you're an end user of a different project, fill this out, let your projects know that you do care about this to help elevate that importance, right? Our reputation with our end users will increase by doing this. We have a survey that's published on the other side of that QR code that you can drop out and we're going to just let projects know this is what we're hearing from your end users. Thanks, Sal. We are past time, but I don't think anybody's going to yell at us if we keep doing Q&A. But please, if you're tapped out on Q&A, feel free to step up and leave. This was really, really, really pleasant, guys. Thank you so much.


How much killing is enough killing? Israel has killed multiple times as many people since October 7th as were killed on October 7th, has caused many times more destruction since October 7th than was caused on October 7th, and has inflicted many times more pain and suffering since October 7th than was inflicted on October 7th. Even if you completely ignore the power dynamics and abuses which led to the Hamas attack, and just look impartially at the raw data, it's an easily quantifiable fact that what Israel has done since October 7th is worse than what Hamas did on October 7th. While there is a huge taboo against saying this publicly, it's not seriously debatable. The only way to make it seem otherwise would be to see Palestinian lives as worth less than Israeli lives, which is not a position that deserves to be taken seriously. But that isn't the foremost objective fact separating the death and destruction on October 7th from all the death and destruction that's happened since. The foremost objective fact separating the death and destruction on October 7th from the death and destruction that's happened since is that October 7th already happened while the Gaza massacre is still ongoing and can be stopped. Everything that happened on October 7th is in the past. It's done. No matter how many bombs the IDF drops, no matter how many civilians in Gaza are killed, no matter how many buildings are smashed to rocks and powder, no matter how much propaganda the Western media churned out, it won't bring one single Israeli who died on October 7th back to life. Nothing about October 7th can be changed. It's in the past. We have no access to it. But what can be changed is the decision to keep killing civilians by the thousands with a relentless barrage of military explosives and strangling them to death with siege warfare for something they did not do. At any time Israel could stop turning entire city blocks into rubble and adding to the thousands of children who've been killed, but they don't. It's still happening. Every hour this goes on is another decision made by the Israeli government to keep it going, and every hour it keeps going is more death and human misery in Gaza. And at a certain point there's a very important question that will need to be answered, and that question is this. How much is enough? How much killing is enough killing? How many civilians need to die before we can draw a line under this one? How high does the pile of mutilated and dismembered children need to be before it's high enough? Give me a specific height, please, in meters or in yards. It's an answer we're going to come to one way or another. At some point we're going to reach the end of the killing, either because some sliver of conscience awakened in the powers perpetrating and facilitating it, or because it became politically inconvenient to continue, or because some meaningless and arbitrary goal was declared to have been met, or because the killers felt satiated by the amount of killing they'd done, or because there was no one left to kill. So we may as well begin chewing on that question right now so we can settle on a number as soon as possible. How much is enough? It's a question that demands an answer, and the answer we come to collectively will say a lot about our species and about where it is headed.


Fecal microbiota transplantation, FMT, has been used for centuries to treat various illnesses, but it wasn't until the late 1950s that it gained renewed interest, due to reports on its effectiveness in treating fulminant enterocolitis. In 2008, a double-blind randomized clinical trial showed that FMT was more effective than antibiotics in treating costridium difficile infections, leading to widespread acceptance of this treatment option. This article was authored by Albert K. Growne and Max Newdorp.


convention Orlando Florida 2018. I am Hunter Drew and I have the honor of introducing our next guest. He goes by Tex. Tex is a friend, a mentor, and a man who's been thrown ropes for quite some time now. He's a moderator at the Fraternity of Excellence. He's active on Twitter and you can find a majority of his writing over at TexasDom.com. Now when I first came across Tex's work it's when he joined the original men of March, our 31 DTM campaign.  Okay, Roger that sir. Since then we've been best friends and though he never explicitly said you can hit me up any time you have an issue, I took advantage of that. So every time I needed an issue, every time I was going through personal matters, my family, I'm pretty sure my wife met him, she gave him a bigger hug than myself. He's a man who puts himself out there to anyone who needs it. He's a man that has created the resource and gone throwing everyone on his back and he will carry you to that finish line if need be. So let's give it up for Tex. So if Hunter is the El Dorf Gimley, I guess I'm the elder white wizard Gandalf or something like that. I'm gonna work with it. I like the Lord of the Rings. I have lived my entire life to be here right now. For this moment. So of you, we all came together for a reason. We took it on ourselves to fly out here and get here. Everybody's talked about it. We've listened to a lot of great speakers.  So when I got out of college, the space shuttle blew up and I had to go to work teaching high school. And there was a class I was forced to teach. It was called Earth Space Science. And it was for the kids that couldn't do chemistry and biology. They were just not the sharpest sticks in the quiver. So at the end of the first semester on the space part of this whole thing, I said, Okay, I'm gonna have this lecture folks. I want you to put your notebooks down. I want you to not worry about being tested on this. I just want you to listen. And I gave the lecture of a lifetime. It was on black holes, Earth Space Time theory of relativity. I mean, I knocked it out of the park. I was so patting myself on the back during this whole thing. So at the very end, I said, Does anybody have any questions? And little Mary Catherine in the back raised her hand. Okay, this is going to be good. She really got into this really well. She says, Coach, does this have anything to do with the Bermuda Triangle?  So I got out of coaching right after that. So why am I here? I am here to talk to you a little bit about how I got to where I'm at. And we're going to talk about something called DNS, which is dominance and submission. But I want you to know one thing. I am you. I have walked the same walk. I might be a little older version than you. There's one or two people I might be a slightly younger version than you in here, but not too many. I've gone through the battles. I've done a lot of things that have gotten me to this point. Some good and some bad. 30 years ago, I got married. I was the most blue pill guy in this room. I listened to Donovan's little fabulous four and all of his things to do this morning. I'm right there with him. I made a lot of mistakes early on. I dated a lot of bad women before I finally met my wife. It's a good woman. But single mom, checkmark right there. And I thought I could do everything right if I was just a nice guy. Thank you, Dr. Glover. Great book. One of the first ones I ever discovered, by the way. And so everything went along pretty good. I'd gone through college. I was a bouncer and a bartender and I had a security company thing that the summit Houston for rock concerts, but I was living the dream. I was spending plates, things were going along really, really well. Decided to settle down, got married. And all of a sudden the sex dried up. We all know the story. Things weren't go so good. But the one thing that I look back at now is that I don't blame her at all. She just did what she needed to do to do what she needed to do. She never cheated on me anything like that. It's just she was eventually forced to lead. This was my fault. I gave up leadership. The king abdicated his own throne and stepped aside. You go back to the Lord of the Rings thing, right? The king in one of those kingdoms where he was all just sitting back there all zombie liked and somebody else was running the kingdom. That's what it was. Only one person could drive the bus when you got two people in a relationship. She was driving our bus. It wasn't that she wanted to. It was that she had to because I was out dicking around doing things, you know, working hard, making the money coming home, drinking the beer on the weekends, drinking the Jack Daniels, watching the football. Oh, my God. DVR's hit and cable TV really hit in the 80s, right? 90s. Now I got football on four nights a week pro football and I got college footballs on Saturdays. And I mean, I'm just sitting there. I became Peter Griffin, the family guy, man. I was that guy. It was it was ugly. So along the way, we raised two kids, one of my sons with me here today. We did a pretty good job.  That makes life so much easier and the kids get this consistency. So we did a good job parent our kids, we did a shitty job parenting our relationship. So by the time everybody had moved out, and we were sitting here by ourselves looking at a wiener dog thinking now what what do we do now? Eventually, I kind of went my little way. She went her way. I was miserable. She was miserable.  And we were kind of locked in golden handcuffs, great job, big house, mortgages, the whole nine yards, we own rental properties, we had a business together. Lots of things that went in that in that regard. So eventually, we finally had both had enough and we were searching trying to figure out what we were going to do. And we were miserable. I was in therapy.  I had a female therapist who actually, when I start talking about dominance and submission to her and talking about, you know, the things I like to do, she was cool with it. And in fact, there's a modal therapy called EMDR, which is pretty impressive stuff. If you're trying to break, lose some bad memories and things, but I digress. So at some point, she had suggested to me to start spending some more time by myself. But instead of jerking around playing guitar, watching TV, start thinking about what makes me happy. And I had my girl do the same thing. Sit down, figure out what makes you happy. Let's not talk about it now. Just try to figure it all out. And we danced around it and danced around it. Eventually, we started talking divorce. And the D word had never entered our vocabulary. We called it the D word for 25 years or so. And then finally, we were like, you know what, this isn't working. We'll sell it all, split it down the middle, go our separate ways. But neither one of us wanted to do that. Right? We still loved each other. It was something that was in our hearts. And I know we talk about don't get married, you hear all the different things that you've heard this week. There is true love there. And it's still there. There's love and we love each other. I don't want to be with anybody but her. That's just the way I am wired. I don't believe that's one I just these days because I'm living a red pill life these days. So eventually, we got to this point, we got to the final drive. She was going to go to the airport to go out to fly to Alabama to visit the grandkids. Anybody have three which are awesome, by the way. I'm thinking we're driving down this lonely road going through the north side to get to the airport.  The ditches are filled with water the whole nine yards. And then we have that moment where she says, Hey, I really want to mention something to you. I want to talk to you about something. And you know that feeling you got when your wife says I want to talk to you about something. And I knew it was coming. I'm thinking she's going to be gone for 10 days. We've got a separation in our future. We need to do this. She's going to be gone. This is going to be good.  And she said, Hey, I've been studying about what makes me happy and who I am and all that. And she said, I think I'm a submissive. And I was like, What? I mean, she runs her own company. And that's also fatal flaw if you work with your wife in the same company. I would go in there and kind of assist her with some bookkeeping and things like that. And eventually, I became her employee and that transferred back to the house, which was another one of the issues that we dealt with. But the woman says to me, she goes, I think I may submissive. I'm like, Yeah, I can maybe see that. Okay.  I about into the truck right up about there.  Okay. And my first reaction was, Yeah, sure. I got this. You know, problem.  What am I going to do now? And so we got to the airport. I walked her up. And I got to the ticket counter. And the continental or United Lady behind the counter says she goes, Oh, you're walking her up here to make sure she gets on the plane. So you can go have fun, right?  And I'm like, No, I'm walking her for playing because I want to make sure she's safe. And that sparked something in her when I said that. And I was real fricking serious about it. Fricking, by the way, not fucking. So I walk her over to the Starbucks coffee shop there in the terminal. I couldn't go through security. We were there early because I'm obsessed about getting the airport early as fits. So we're sitting there having coffee and talking.   I got her on the plane. I went home and I spent 10 days researching this dominance and submissive lifestyle. I thought, Okay, she wants to do something to try to save our marriage. She thinks this is who she is. Is that dominant who I am? And I've always been pretty alpha until I just for some reason decided to give up. And I just gave up, you know, lack of sex, whatever. Jack talks about intimacy. Men need intimacy, at least I do. I wasn't getting it. I just wasn't, you know, I want to be with the woman in bed. I was, he was talking about this. I could have been my story. Jack, I mean, I was exactly where I was. I mean, I was a lot of empathy for her brother.  So keep kind of moving a little bit and I figure out what it is. It's total power exchange. It's where she trusts me enough to give up all of her control, all of her power. And she says, Okay, I want you to lead me. I want you to lead this family. I want you to protect me. I want you to do all these things. I want you to quit asking me to make decisions. I want to give up my power. And I take it.  So she's now free to figure out who the hell she is. Now she doesn't have to worry about paying the bills. She doesn't have to worry about the money coming in and doing this out in the other.  Let me times we all done that, right? What do you want to eat? I don't know. You sit there in the parking lot for 15 minutes trying to hash it out and each of you trying to figure out which one wants to do. And it just never works. So the other thing that came up on this was, is this just kinky sex?  And DS are two initials in BDSM. So there's a lot of ways we can take that. We'll talk about that a little bit because God knows we all like to talk about sex, right? So is it? Let me ask you a question. What is the fastest selling paperback book of all times? You're kidding, right? Why is that? Think about this. This is like kryptonite to feminists, okay? Because they're looking at this, oh, we're empowered and we're doing this on the other. And yet, thousands, if not millions of women are reading this book and masturbating in their bed when their husbands are off doing something else, right? This is like, they're into this. And so I'm sitting here rewind about a year prior to the to the final drive. I'm laying in bed. I'm thinking it's over. I'm thinking I got to start. This is, this is bad. I've started lifting weights. I started trying to figure out how to take care of myself. I said, okay, I'm going to start losing weight. And I ended up dropping, I don't know, over about the last 10 years, maybe 100 pounds, and started losing weight exercising, doing it.    I was doing P90X.  I love Tony, right?    I don't like Tony. I'm like, get over yourself. You know, I'm losing weight. You're not. Right. So we're doing, we're doing what you need to do. Well, eventually she starts catching up and she starts ramping up her game. So this is all this going on.  Okay, her way over here, me way over here. So I download this book onto my iPad, because God knows I'm not going to buy the paper copy, right? No way. And I'm laying in their bed reading it. And this is this is awful, awful chick porn. And it's enlightening, man. You'll learn a lot about women.  She looks over at me and she says, what are you reading? And I said, I'm reading 50 shades of gray.  And just like that. Right.  And I'm like, I remember when I was reading that 50 shades of gray. I got a good idea here. So we get back to basics. This is even if dominance and submission is not your thing, even if you're not married, you're on an LTR, you're just a single guy you want to spend place. Let me tell you something about 50 shades of gray.  Women are not going to break they give birth. Babies come out of them, right? Pretty painful experience to watch. They like to be dominated. They like you to be aggressive in the bedroom. They want you to be vocal in the bedroom. That was something else that I had missed out on completely. I used to be getting there to to pump Chuck, you know, dump whatever you guys just say all the time. I mean, I was in there. I was out of there. We're good to go. No wonder she didn't want to have sex. It wasn't very much fun for her probably.  So it's like, you know, what's the old line we hear about the men's fear?  Would you? I mean, think about that.   But you got to have masculine and feminine energy. They've got to be polar opposites. They've got to have a spark, you know, you can't take two positive and ends of a magnet expected to pull together. You got to have a positive and a negative in and they'll latch on to each other. I'm telling you, this goes back centuries. Thousands millennia. It goes back. It's a natural order. It's the way men and women have been designed to interact for years. Men lead women follow. And if you find a woman that is exploring her submissive side, you expect you to lead. So this is one Rolo said I could grab one of his his quotes. Frame is everything. Always be aware of the subconscious balance of whose frame in which you are operating. Always control the frame, but resist giving the impression that you are. This is the number one iron rule of Tomasi telling you it's all about frame, guys, all about frame out anything you do in this life. That's the first thing you got to work on as your frame. So the interesting thing though is but resist giving the impression that you are because what happens in a DS is that she expects you to maintain the frame. She's asking you to maintain your frame.  And so you can take care of me. You can make the decisions and you can allow me to express myself and do things that I've always wanted to do like bake cookies and go plant flowers and work in the yard and do the little things that make her happy.  You're not baking cookies, you're not coloring with the grandkids, you're not doing the things that make you happy. So no wonder she's miserable as well. So extreme frame control. That is the number one superpower you can come up with in your life. You know, we talk about we all need to lose weight, we all need to do all these things, controlling your own frame.  You're going to be able to lead. It's going to be something that everyone around you is going to benefit from. It's a little hard work on our part. But the results are worth it. So when I talk about dominant, I'm not talking about domineering. Anybody can run around and go, give me a blow job. It's time. Let's go. Anybody can say, do this, do that, do this, do that. I'm not talking about being domineering. There's a huge difference. A man needs to be dominant, needs to be in charge. Weak women need not apply. I do not want some milk toast girl with no opinions and nothing going for her as a submissive. The submission is a choice. Women make this choice. It's an active choice. It's a daily choice that they make every single day when they wake up. This isn't abuse either. We talk about flogging and doing some fun things in the bedroom that are kind of fun and I won't go into too much of that in detail since my poor sons back there having to listen to this. Sorry, sorry Fitz. Here's the thing, right? This is kryptonite to feminists. Freedom from the whole feminist imperative.  So these women that choose to live this lifestyle or just be a stay home mom, you know, they're dealing with, you know, all kinds of stuff going on there. Yes, they don't have to work. They can stay home, take care of the kids, do this to have the other and sure that's hard work. I'm not disagreeing, but every one of those has to deal with their girlfriends that are, you know, at some office somewhere that are earning their livings and driving their little escalades and all the other things that they do these days and they're treated as less than less than real women and they're not.  So let's get into some basics.  And even if you're in a dominant submissive relationship, you're in an LTR, you're married, or even if you're just looking to maybe put spend in place one day and get into this marriage thing or whatever LTR thing. These principles apply to anyone in this room, whether you're into the fun stuff or not. Trust. If you want this woman to allow you to lead, you have to have some trust. If you want to tire up in the bedroom and do naughty things to her and give her 12 orgasms in about 30 minutes, right? And that's very, very possible. Dr. Glover hit that one on the head. You learn a few things. When you start getting into some of these little games that we'll talk about in a minute, you're getting into her biggest sex order, which is right between her ears.  You start in the morning when you wake up and you end it an hour or two after you guys get started. We laugh about guys going for 15 minutes, but some of this you got to have communication. What was the biggest thing that girl and I learned is that we can't read each other's minds and we expected each other to read our minds. And so you get to the feeling that, hey, I got to ask. Guess what? Every time I ask, I have a problem or have an issue, she's got all my answers.  That's the biggest problem. We ask a question and then we keep talking. So another thing in this position where you've got her head on your shoulder, you've got her in a rather submissive position, you'll be surprised as how much more truth will come out of that. And that's the other thing. I mean, this trust and communication thing.  Several years back before we got right, my girl would pick up my phone to use it to make a phone call and I'd freak out a little bit. I'm on Facebook talking to people doing some things I shouldn't be doing, maybe, but always made me nervous. Now, I can hand her my phone and walk away. Maybe put my phone up for me. She knows the code. She can get in. I could care less. I have nothing on there that I give.  She doesn't like it. She can leave. Yeah. There is a freedom there. She knows I can leave at any moment and I know that she can leave at any moment. And we've talked about that. I sat there and said, look, if you leave, I'll be sad, I'll be sad for that long. You know? And she's the same way. I mean, it's just the way it goes. You can't read the minds. Love and respect. Women need to be loved. Men have to be respected. She and I get into a lot of different things in our lives. She refers to me as her warrior. I am her warrior. I'm also her master.  We do a little master slave stuff where I'm, I mean, and we sometimes will carry that on for a week or two. Sometimes it's just for the night. Sometimes it's just for fun. And I'm her dominant. She introduces me to people as her sir. This is my sir. You want to blow some people's minds? This is, what? You know? Or I don't allow her to talk to anybody. We go to a party. Right? You're not allowed to talk to anybody. Stay right behind me, right behind me on the left side. You know? So anything I talk about today, if you decide you want to start playing this game a little bit, or you just want to start having a little more fun in your bedroom, spicing things up a little bit. Three words, safe, sane, and consensual. Okay? Greg was talking to breakfast this morning. He's having his son basically take screenshots of text messages with girls that he's about to go date. Any kind of consent, any kind of things that led up to it, you know, we're talking about having to protect ourselves in the Me Too World right now. I'm going to make sure I mention to Greg wherever you are. But consent, you know, it's got to be consensual. So the part of this, and I'm going to get into the icky stuff for some of you people, but man, this is fun. We call it a scene. And it's a situation where I literally tell her what to wear, tell her where to be, and I'll plan out an intricate time for the evening. I have plans. I'm going to do this. I'm going to do that tour. I'm going to blind folder. I'm going to layer down. I'm going to use ice over here.  I have it all planned out. She has no idea what's about to happen to her. I just prepper and tell her what I want her to do. And that happens in the morning. And you can do this too, even if you're not into this stuff.  I want you to do this. I want to have dinner ready. I want a glass of wine sitting on the counter and lay it out for her. And when we first got started, I did that kind of. I tested her. I want you to be in the kitchen making spaghetti in a skirt that I was telling her about with no panties on. Just to see if she would do it. And sure enough, she did. She got a reward for that. So, yeah, like I don't get rewards out of this, right? But you're in there and you plan this thing out.  But I can literally get in there and I have to have almost a running dialogue. And I love to blindfold her. Because that way, if I drop something, she has no idea what I'm doing. Just keep her blindfolded the whole time. And it's just a lot of fun. You can literally almost talk her to an orgasm if you get your words down, right? And you got to get vocal in the bedroom if you're ever going to want to have any serious, serious long term. And they don't break, man.  Make her remember it. Make her walk to the kitchen and her legs are all jelly and wobbly and bow-legged and everything else, right? So when I first got into this stuff, oh yeah, we're going to have a scene. You know, we're going to go and dock some stuff out and we're going to have some fun and this and the other. I was like, what's the end game? Why am I doing all this? You know, I got a little power trip on my part. I'm kind of enjoying it and I always get mine in the end. Always get mine in the end. That's non-negotiable. There's a thing called subspace. And I'll touch on it briefly. You can Google it and you can research a little bit. But in impact play, that kind of thing, you have about five, six minutes of impact play, that kind of thing.  And then you wait a few minutes and literally look at my watch, wait about five, six, seven minutes and we do it again, maybe a different toy, maybe something else. And it's just fun stuff for me.  And then after a little bit more impact play, the endorphins release again. So you do this five or six times. She can't talk.  And loving it. And absolutely loving it. And she absolutely lives for me to get her into subspace. And it's, I know it sounds whack. Ain't gonna lie. Sounds whack to me too sometimes. But when you see the results, I mean, your girl follows you around like a lovesick puppy for a month after a couple of these sessions.  You literally are a God. And we've had experiences where just doing simple flogging and stuff will give her an orgasm now.  It's a beautiful thing. It really is. Oh, I love this quote. This is a really bad graphic. But submissives require more attention and can be needier than the average person. And man, you got that right. Okay. They already want all your time. Women want your time anyway. That's your most valuable currency. But submissives really need your time. And they dry up and wither if you don't feed them well. You don't water them well. Be careful what you're getting into.  I am a Dom or put a big D next to your name. Be careful what you're getting into.  So you need to research, plan some things out. You don't want to be that guy. Just trust me. Somebody in this room probably already done that at some point in their life. So there's a lot of different dynamics this side and the other. You got master-slave relationships. Daddy Dom, little girl. And sometimes the little girl, it gets down to... And again, I talk men and women a lot. But there are Dom submissive relationships where the man is the submissive and he willingly walks into it and wants to be that guy. And he's got a strong woman who is his dominatrix or Dom A or whatever they call her. Not my thing. But one thing I've learned about getting into this world is I don't judge people for their kink.  I don't care if it's two guys doing a Dom submissive relationship. It's not my business. It's their business. It's not my thing. I don't necessarily want that thing around. You know, it's not what we do. But I have learned through this community to quit being an uptight judgemental asshole, which is what I used to be. Now it's like, live and let live. You know, when it comes to what you do behind your own closed doors in your own bedroom, it's none of my fricking business, right? It's none of your fricking business.  Head of household relationships. Think Grandma and Grandpa. Think 50s. You know, 50s relationships. They even call it a 50s. 50s head of household. You know, the ladies got to wear cotton dresses type of thing, like out of the 50s.  There are couples that actually switch. One night, he's the Dom. The next night, she's the Dom. They go back and forth. That's what they want to do. That's the way they want to live. And then in the world of submissives, I mean, there's littles where they actually, girls actually kind of get down to where they're like 12 and 14 in their head or 16 in their head. And some of them are really, really, really little, which pacifiers and diapers and whole nine yards, which ain't my kink. But again, again, not being judgmental. Not my thing. Sometimes they get bratty. There's rope bunnies. They like to get tied up with intricate designs and all this stuff. I'm getting into this lecture phase and I really don't want to do that. What are some of the pitfalls? I'll tell you what, too many rules. The first thing they want to do, every couple that gets into this, we're going to make a set of rules by God and we're going to have this, this, this, this, and this, and this, and this, and this. But we're going to draw up a contract. You saw that if you ever watched one of those goofy movies. Keep the rules simple if you're going to do this. A couple of rules. Don't make it too hard. Just spend all your life enforcing rules when that's really not the idea about this. The idea is to make a connection with somebody that you totally trust. And she totally trusts you. And you can communicate and you can have that intimacy. You can have all those things that you really do want within a framework. That's all it is. It's just a framework. There is no one way, I always put that down at the bottom here. There's people that would lead you to believe that their way is the only way.  Every single couple out there decides exactly how they want to do this kind of thing. The biggest question I always get is why is she not acting right? And invariably you get the situation going, life is going good, and then she starts acting up. She's not doing the things she did. I'm not getting that great headlock I was getting previously. She's fighting me back a little bit. Every single time that's happened to me, I go look in the mirror. Guess who's fault it is? It's me. Why? Complacency kills. We're all naturally lazy at some point. We take our foot off the gas. We sit back, start reading the paper and wait for the train to come. We all do it. We all do it. Everybody here does it in their own relationships. You back off a little bit. You start getting fat, dumb, and happy, and you let it go. A little too long sometimes, maybe. I'll bring this up, not just for the older guys, but for younger guys. Great divorce. The stats are out there. In the last 30 years, people over 50 having divorces has doubled, and especially the ones that are only marriages.  In fact, one out of four people getting divorced today are over 50. So think about it. Don't just assume, just because you got 20 years in, 25 years in, that it's all hunky door. It's always going to be that way because it's not. And what do they say? Women normally initiate, what, 90% of the divorce is out there. So you've got to work within the frame of what you've got.  I get asked first steps, what do I do first? How do I make this happen? The number one thing you can do, I think, is to start off doing what we've all been doing here for the last four days. Learning to lead, learning to be a strong man, doing the things you need to do. Subtle things, lower the pitch of your voice. Every time I get really stressed out, my voice kind of comes up here, and she knows after all these years that if my voice is rising, I'm stressed. That causes her to get stressed. She doesn't know why I'm stressed, but it causes her to have that same thing.  And I'd just have this little limp fish thing hanging. No, no more. I hold her knee hard. I grab her. I do things like that. When we're walking down the road together, I put my hand behind the back of her, her lower back. I grab it hard. I make sure she knows I'm there. I do these things to let her know that I'm in charge, that I'm there taking over and doing these sort of things. So it's not that hard of a relationship to get into, but how do you introduce that to your wife, right? People say, oh, we watched Fifty Shades of Grey and I kind of asked her some probing questions after that and see where it went, but now everybody gets into that thing. We go back to that other slide where it said Love and Respect. There's a great book out there written by a guy named Emerich and it's called Love and Respect and it's got some blue pill stuff in it. But I swear it talks, it's written by a pastor so it's got some biblical things.  But it talks about, from a biblical standpoint, of women submitting to their men. And it's her duty to respect you. And it's the man's duty to love her.  She doesn't respect me.  I mean, it's ugly, right? And you get this negative spiral going down. And so it takes one person in that relationship to flip it around and say, you know what? I'm going to love her even if she doesn't respect me. I'm going to give that a try for a while. All of a sudden, you're the person who puts the brakes on the negative and you turn it into a positive spiral. It starts working its way back up.  And I call it DNS 101 for rookies, for newbies. Give your wife that book and let her read it and see if it's going to work for her. You read it too. It's a good book. I see some blue pill stuff in there and all that, but it'll get you closer to where you want to be than not reading it at all. So we'll talk later on questions and that kind of thing with this. But I did want to give you a couple of closing thoughts. I don't want to get too bogged down in the whole DS thing. I just kind of like whet your appetite a little bit. Hopefully you'll get online. You'll Google a little bit and something that strikes your fancy. But first and foremost, if you're going to have sex, freak and protect yourself. Somebody touched on this the other day. But if you're under 25, there's a vaccine for genital herpes, little wart things, not herpes, excuse me, the genital warts, HPV, yeah. If you're under 25, it's a shot. Go get it. If you're over 25, it's too late. You know, it just came out a couple of years ago. But protect yourself for God's sakes, right? It's one less thing you got to worry about in life. Wrap your stump.  You know, you start wanting to go bareback and all that stuff. You're going to end up with diseases. It's just the natural thing what's going to happen. And again, protect yourself, not only there, protect yourself with the whole consent thing. You know, be careful who you're putting it into.  Okay, you got strength. These guys want what you have. They want your women. They want your car. They want your house. And what are they doing every day? They're training. The other part of this is if you can't pick your girl up and flip her over on the bed and manhandle her on the bed, you don't have enough strength. Or your girl needs to lose more weight. Good happen. I'm telling you explosive strength is where it's at. You got to be able to pick her up, flip her around.  You do this, you do that, bend over here, do that, twist that over there and you're helping her go. And she just feels completely owned. That's your job, right? Robert was saying it earlier.  Make her remember it. For God's sakes. You may get hit by a freakin' bus the next day.  How did it work out for you? Hope it was good, right? Okay, biggest freakin' surprise of the 21 convention for me.  I'm like, man, I'm gonna have to get up extra early to get in there before all those guys get in there and see, I don't lift that much weight. You know? Harleen and money in there, man. Five or six guys at the most every morning. I'm just saying, if you're not in shape, get in shape for God's sakes. We all talk about this stuff. 10 years ago, I was laying in a hospital bed dying, which Dr. Glover and I have in common. I had flesh-eating bacteria in my leg.  Managed to live. And I walked out of that situation, thinking, okay, I'm in poor health. I just about died. I don't want to die right now. I got too many things to do. I got great, you know, my son's awesome. My wife is awesome. It's kind of funny, even though we were doing poorly in our marriage, she had two different occasions where she saved my life, literally saved my life during this event. And I have a million-dollar insurance policy on my life. If you have a lot of insurance on your life, you might not make those decisions if she doesn't love you very much. Just saying. But no, she literally, I was bleeding out one time. She caught it. Nobody else had caught it. And at one point, the infection was spreading up my leg, and they put a Sharpie mark across here. And they said, if the red goes above the Sharpie mark, you know, get him over here and all that. And it did. And I was in denial. I'm like, nah, it's nothing. No, I got this. It's all good. So I do a blog thing. Oh, this got out of order here. Picture of me and my son were in Scotland at this awesome freaking castle back in March. And our buddy Sam from England, priest down in England, actually took a train up and hung out with us all day.    We're hanging out with them. They're bringing you down. Crab's in a bucket, right?  You don't have to have a hell of a lot of money to travel. You can do it locally. The United States is huge. For those of you, most of you live here. Go find things to do. Go hiking, even if it's just in the state park down the road.  Don't wait. Like I said, I waited all my life to get to this point, not standing on this, this station, but to get to this point where I can be that elder that Hypnotica talked about, or where I can mentor a few guys here or there. I can help throw a few ropes. And it's something we all have to do. I got a little blog that I write. I mostly wrote it because my girl wanted to start a submissive blog community for like-minded women.  So I went ahead and opened up a little blog on my own, and I call it texasdom.com. And I'm not selling anything other than some ideas. And I talk about submission, I talk about masculine stuff, this, that, and the other. But I identify with a Spartan warrior picture. I've never been in the military. I mean, my job, I work with military cops, firefighters. I do counter narcotics, you know, bomb squad, EOD stuff, that type of thing. So I'm around warriors all the time. And I identify with that archetype quite a bit. The code of honor is intense. You gotta have a mission, and warriors have a mission. You know, a warrior without a mission is dead. I encourage all of you to find your mission. We all have to have a mission. I found my mission a year and a half ago. I got on Twitter to look for President Trump's awesome tweets during the election. I don't do politics, but Trump. But then I found Dave in the back, say, buddy of mine, we're in this Dom entering peer program thing. And he sends me an article from Hunter Drew. I'm like, fuckin' Hunter Drew's a Dom. I'm reading this through him.  He's a Dom and doesn't even know it, right? Takes charge of his wife, his family and all that.  But Hunter always refers to Red Pill or Mary Red Pill in a lot of his blog writings. And so eventually I'm Googling, trying to figure out what this is.  I'm like, I'm out of here. You know, these guys don't want to hear what I have to say. And it's a brutal environment. Yeah, Ryan, I did the whole Batman origin thing, sorry. But we all got him, right? Or it's the brotherhood. There are brotherhoods online right now. Richard Cooper's got a site, right?  Craig and Hunter have got a site, Attorney of Excellence. There are resources there. If you want to interact with people daily on this thing, 21 University's got a million videos. You know, they're there. But if you want to have live interactions with people, there's communities out there that are like thinking, masculine men that can help you. Constantly working on improving, constantly working on topics that matter. We have this phrase, no man left behind. And that's the other thing the military always impresses on everybody. You got to fall in brother. You got to pick him up. You can't leave him sitting there. Brandon, we talk about handing the rational mail out when the guys hit rock bottom. And I think I've probably bought maybe 12 or 15 copies of rational mail over the last couple of years. I keep giving them out. And I think one or two things are going to happen. They're going to read it and I'm going to get a question back. Or it's going to go on the shelf. And eventually when they hit rock bottom enough, they'll read it and then I'll get a question because I'll know they finally read it, right? So keep doing that kind of thing. Throw ropes where you can. You might think, hey, I'm just getting into this thing. Who am I to help? You're one more person to help. Everybody in this room is somebody to help. I expect everybody in this room to reach out to another man that's having trouble. I expected of you.  There's a lot of rope out there. Bill Foster's got about 6,000 feet on a truck. We'll lend you some if you don't have enough rope. Make it happen. This is an awesome book. You want to touch base with your warrior side. Gates of Fire by Pressfield. Highly recommended. One of the best awesome books I've ever read in my life. Definitely gets into the whole warrior thing. So we get back to this. It's one of the things that I say on my blog all the time. You've got this. Things are going through your mind at warp speed. You've heard so many things over the last few days. You're trying to put it all together. It's going to get overwhelming. You're going to start having doubts. You're going to start wondering if I'm on the right track. You're going to start doubting everything about it. You've got this. This is something that's completely in your power to exist and do well. I want to read one thing to you. I put a little tweet out a while back. It resonated with a lot of people. It's not that long. Humor me. I bring a message of hope.  Damn it. If I can un-fuck my iPhone.  Dig deep. Find the bravery to admit the truth of who you are that you deserve the life you have right now. The life you have now is your fault.  That's who you are. Dig deep. Spend hours looking into the mirror and analyze what you see. Take some action eventually. You get that paralysis by analysis thing and it happens to the best of us. Quit worrying about stuff. Take some action. Even if it's wrong, you can course correct later.  There's an entire community of black-minded men ready to help you when you falter. But you have to take the first step.  Why are you waiting? Why aren't you starting right now? The character you have is what you do when no one else is looking. The little decisions you make day in and day out. How we treat those who cannot help us in any way is how we will be judged eventually. Throwing ropes to drowning men must be important because those men are important. Each one of you is important.   We will throw the rope to you.  Pull yourself up. We're waiting. Come join us. Thank you.


Hi and welcome to the session. Let us discuss the following question. Question says, show that semi-vertical angle of the cone of the maximum volume and of given slant height is tan inverse 2. First of all, let us understand that if we have given a function f defined on interval i and c belongs to interval i such that f double dash c exist, then if f dash c is equal to 0 and f double dash c is less than 0, then c is a point of local maxima. This is the key idea to solve the given question. Let us start with the solution now. Let h be the height and r be the radius of the cone. Now let v represents the volume of the cone. Volume of the cone is given by 1 upon 3 pi r square h. Now let the slant height of the cone be l. Now we know l square is equal to h square plus r square. Now we can find value of r square from this equation. Now this implies r square is equal to l square minus h square. Now let us name this expression as 1 and this expression as 2. Now substituting value of r square from 2 in 1 we get v is equal to 1 upon 3 pi multiplied by l square minus h square multiplied by h. Now this implies v is equal to 1 upon 3 pi l square h minus 1 upon 3 pi h cube. We have multiplied 1 upon 3 pi h with this bracket. Now differentiating both sides with respect to h we get dv upon dh is equal to 1 upon 3 pi l square multiplied by 1 minus 1 upon 3 pi multiplied by 3 h square. 3 and 3 will cancel each other. So we get dv upon dh is equal to 1 upon 3 pi l square minus pi h square. Now we will find all the points at which dv upon dh is equal to 0. So we will put dv upon dh is equal to 0. This implies 1 upon 3 pi l square minus pi h square is equal to 0. This implies pi multiplied by 1 upon 3 l square minus h square is equal to 0. Here we have taken pi common from both the terms. Now dividing both sides by pi we get 1 upon 3 l square minus h square is equal to 0. Now adding h square on both the sides we get 1 upon 3 l square is equal to h square. Now multiplying both sides by 3 we get l square is equal to 3x square. Now square of slant height is equal to h square plus r square. So we can write h square plus r square is equal to 3x square. Now this implies r square is equal to 2x square subtracting h square from both the sides we get r square is equal to x square. Now dividing both sides by h square we get r square upon h square is equal to 2. Now this implies square of r upon h is equal to 2. Now taking square root on both the sides we get r upon h is equal to square root of 2. Now let us assume that alpha is semi vertical angle of the cone. Now r upon h is equal to tan alpha if we see this triangle. Now clearly we can see r is the perpendicular and h is the base with respect to alpha. So r upon h is equal to tan alpha. So we can write tan alpha is equal to root 2. This further implies value of alpha is equal to tan inverse root 2. Now we will show volume is maximum when alpha is equal to tan inverse root 2 or we can say semi vertical angle of the cone is equal to tan inverse root 2. Now we know dv upon dh is equal to 1 upon 3 pi a square minus pi a square. This we have already proved above. Now we will again differentiate both the sides with respect to h to find second derivative of v. So we get d square v upon dh square is equal to 0 minus 2 pi h. Derivative of this term is 0 and derivative of this term is 2 pi h. So we get d square v upon dh square is equal to minus 2 pi h which is less than 0. We know height of the cone can never be negative. So d square v upon dh square is less than 0 for any value of h. Now this implies for alpha is equal to tan inverse root 2 volume is maximum. So we get semi vertical angle of the cone of maximum volume and of given stront height is tan inverse 2. Hence proved this completes the session. Hope you understood the session. Take care and have a nice day.


Welcome folks, this is Tom O'Brien of TFNN. We go five days a week, we go seven hours a day, we go 24 hours a day on the internet at tfnn.com. Always remember folks, whatever you think about, you bring about whatever you focus on grows. Hope everyone's having a great day, safe day. It's making a great night folks. Don't take anything personally. Ignore the opinions of others. Whatever people do, feel, think or say, don't take it personally. Others are gonna have their own opinions according to their belief systems. So whatever they think about you is not about you, but it's about them. That's a tricky card, man. Mugging wise, let's take a look at it out here. We have the Dow Industries up 168, NASDAQ up 236, S&P's up 50. Gold contract up $20, 20 cents, traded in 1946 and ounce. We have Silver up 94 cents, 24 dollars 71 cents and ounce. Lightsweak crew down 83 cents, $78, 82 cents, a barrel, notes and bonds. Ten year note, up 27 ticks, trade in 109, 29. The third year up a full point, plus 29 ticks, had 120, 08 and King dollar. King dollar gave it up folks. King dollar down 164 ticks, 103, 399. Now that doesn't seem a lot, 106, 7 ticks. And it's not, but I'll show you why it actually, I'm saying it's giving it up. The year I was at 108, the year I was at 144 and the British pound was at 127 to one US dollar. Offer numbers 877, 9276, 648, give us a call folks. Want to know what's going on in y'all world and the world of the S&P's, let's take a look at them. We'll bring up the futures contract first. My take, we're gonna run right into the close by the way folks, okay? Bottom line, what you have out here, you climbed up, we bottom line just had another pop up right here, your first pullback was about an hour ago, we just came in again with volume, this thing's gonna go up, hey listen, this thing wants to bounce, that's the real bottom line. If I bring the spy up, what you're gonna see inside the spy is that you are going up into contracting on volume. That being said, this baby, right now you're at 443, you're up 4.8, and you got 446 to like, 446 is the low of a high volume bar. So, if we get some juice, it'll probably try to get into that, or it gets into the lows of the high, which is 451, that's how this is set up. Now, if that's what we do, what would end up happen is this, you can't do an ABC down, well, you can do it, but the definition of an ABC down is you don't do more than a .618 retracement. So if we do more than a .618 retracement, then what we're gonna have is that you're gonna have a consolidation with the highs of this spy being at that 470, and the lows being out here at that 433. Now, that's a trading environment and a half, man.  That's inside the spy. We go to the notes and bonds. Now, this is, we got a lot of movement here, man, and I think we're seeing a lot of turns, and my take is that the note and bond market have also bottomed, and I mean bottomed, okay? So, I mean, higher prices are coming at us, lower yields. That the yield probably topped out yesterday. You can see right here, what you have, we have wide price spread. You have accelerated volume, we have 2.3 million. You broke the downtrend in the 10 year. That's saying, guess what, we're going higher. If we go to the gold market, if you haven't test driven the gold report, folks, you want the gold report, go do it right now. Just go do it, man. Because the bottom line is that, you know, the way that this had come down and the way that it was trying, you know, this broke the downtrend today. What it had done, it had come back into the match level, had dramatically lighted volume, took off like a rocket ship today when the dollar gave it up, has the wide price spread, has the accelerated volume. If you go to the GDX, you're going to look at them. They're all moving, and when they move, man, they move. You know, the GDX right now, you get the expansion with volume. You know, we made a low in the GDX, with 15,000 shares and 18,000. Over the 19 right now, you can see the break. The break is there, man. You get the wide price spread, you actually jumped the trend line, the whole ball of wax, and then where are we going? We're going right into that dollar. This thing, DXY. So we take a look at the dollar. What you're going to have with the dollar is that it spiked this morning. Check this out, man. This was the most, the reason that you're hearing this in my voice, folks, this is the most deviant thing the dollar could have done. Meaning, you know, you heard me out here yesterday, I was looking for quite some time that, okay, this dollar man wants to get up to that next swing point, right? And then, you know, what we did is that we did a loss in golfing yesterday. Now, when we did the loss in golfing yesterday, the way that it works is that you have to close lower today. And so this morning, I'm looking at this market, I'm saying to myself, oh my God, I don't believe it's going to spike it. So it spiked it, but when it spiked it, once I saw it starting to come back, I says, oh, that is the most deviant thing it could do. Why? Because it spikes it, number one, that means that if you're any trite, you say, oh, no, go on to the next swing point. It spikes it, it gives it up, now it's going to be a confirmed loss in golfing. That's the bottom line. And, you know, the dollar right now runs everything, you know? So if the dollar continues to go lower, you're going to see that the market's going to get breathing room to go higher. The metals are definitely going to go higher. And the bonds, you know, we'll find out if that this is just a bounce on a bottom, or in fact, you have a real bottom going in. When I was looking at the mortgage rates last night and looking at the inflation numbers, inflation's over, man. You know, where, that's my, that's also my take. That, yeah, you're going to have some small prices, but the big prices, transportation, food, appliances, it's over, it's over, it's, it is. I do enough business that I know when I'm buying stuff right now, I just did a deal this morning and that's what really made me, it's like, oh, you got to be kidding me, man. The amount that I paid less, I mean, was extraordinary. It's just a point of not 10 or 20%. We're talking about way over that number, way until it was like, okay, you don't get those types of numbers unless inflation's, boom, it's over. Dow, Dow's up 154, Nasdaq's up 238, four S&Ps are up 48. Stay right there folks, we got our man Mr. Basil Chapman coming up next and he's going to be doing a webinar for you right after my show. Stay right there folks, we'll come right back.