Hello, I'm Hashay Arbauruti from Laboratory of Security and Cryptography at EPFL, and today I'm going to present our paper titled Cryptanalysis of Plantlets with Subadip Panik and Takanori Yuzobe. We will start by a brief introduction on small state stream ciphers, specifically Sprout. Then we're going to talk about some of the cryptanalysis results in Sprout. Later we will talk about the updated version of Sprout, which is called Plantlet. Last but not least, we're going to describe our attack on Plantlet. So let's start with the introduction. In 2001 an Asia Crypt, Biryakov and Shamir presented a work in which they proved that the internal state of a stream cipher should be one and a half to two times the size of the secret key, otherwise the stream cipher would be vulnerable to some generic time memory trade-off attacks. But in 2015 at FSC, Arminyak and Mikhailov proposed Sprout, which kind of contradicted the results by Shamir, because it had a state size exactly equal to the size of the secret key. But they were using some key-mixing method to get rid of this attack, this trade-off attacks. So Sprout has a grain-like structure, meaning that the internal stage is composed of an LFSR and an LFSR, both of size 40 bits in this case. And it has a much smaller area than any other known stream cipher. This is a diagram of the Sprout circuit. And now we can talk about some of the cryptanalysis results in Sprout. So in 2015, the same year that Sprout was proposed, a related key distinguisher was proposed by Junglin Hall. Later on, Mitra et al. proposed a partial state exposure attack, again in the same year. And in crypto 2015, a guess and determine attack was proposed by Leymann and Plasencia. So later in SAC 2015, a time-memory trade-off attack was proposed by Eskin and Kara. And in interquip 2015, Banik presented a work called Improved Key Recovery with Partial Knowledge of the Internal State. So now let's talk about Plantlet. So Plantlet was proposed in FSE 2017 by the same authors as Sprout. Basically, Plantlet is an updated version of Sprout, such that it will be secure against the attacks that we talked about before. So first of all, to avoid the guess and determine attack, the LFSR size in Plantlet was increased to 61 from 40. To avoid the attack by Eskin and Kara, the key mixing was changed to fully linear. And also, a neat trick was used to avoid Banik's attack. So Banik's attack was using the fact that using a specific IV, one can set the whole bits of the LFSR to zero. And to avoid this, the authors proposed two phases of LFSR update. First one is during the key IV mixing phase or the initialization phase. So in this stage, the 61st bits of the LFSR would stay fixed to one. And then the rest of the LFSR would get updated. And in the key stream generation phase, the whole 61 bits will be updated. So here you can see a diagram of the Plantlet stream cipher. So let's talk about the LFSR updates. As you can see here in the first 320 rounds, the LFSR update does not touch the 61st bits and also the generated key stream bits is given back to the register. And during the key stream generation phase, the whole 61 bits are getting updated. And both LFSR functions would have maximum period this way. So I think we have enough, we talked about Plantlet. So let's talk about our crypt analysis result. This observation that we made was that as the LFSR function is fully linear, imagine you have two states, two LFSR states at time t1 and t2. So knowing the difference between these two LFSRs and also the difference between the times t1 and t2, you can recover the values of the LFSR at time t1 and t2. So this is some basic linear algebra, we will talk about it later. But basically what it says is that given LT1 XOR with LT2 and t2 minus t1, one can compute LT1 and LT2. So we started studying the differential structure of Plantlet. And what we noticed was that imagine we have two times t1 and t2, both 0 modulo 80, and the internal state at this time only differs in the 43rd bit of the LFSR. And we found out that having such an internal state difference, we can have a 160 bit difference vector such that 45 bits of it are fixed. And this difference vector is not anything strange. So basically we take the 80 bit long key stream from time ti on and from time ti backwards and also we do it like we do it for t1 and t2 and then we XOR them together and we get this difference. So 45 bits of this are fixed with probability 1. So also another observation that we made using the same difference is that for seven other bits, different bits in the key streams, although the value is not fixed to 0 or 1 with probability 1. But it's just a fixed linear combination of LIs. And also for another difference bit, for one other difference bit, this difference is just a quadratic combination of the LI values. So we use these observations and filter out the incorrect candidates for the internal states in our attack. And now we're ready to present our attack. So our attack has four main stages. First there is an offline pre-computation stage. In this stage, we basically compute the LFSR values out of the differences between the LFSR values and the differences between the time. The second stage is the online stage in which we just collect a lot of key streams such that a certain hypothesis is satisfied.  And then finally in stage four, we generate some algebraic systems from these pairs, from these good pairs that we collected, and we solve those systems. So let's talk about the pre-computation stage. As we mentioned earlier, having the difference between the LFSR values and the time difference, we can recover what exactly these LFSR values are. So plantlet by design does not allow us to generate more than 2 to the power 30 key stream bits. So we have that, this time T1 and T2 should both be less than 2 to the power 30. So how many different possibilities for T do we have? We have 2 to the power 30 over 80, because both T1 and T2 are multiples of 80 as well. So we want the difference between these two states to be E43. This is the difference that we care about. So having this, we just have to solve this equation. We have to find LT1 in this equation. So we have the LFSR update matrix to the power T, which is the time difference, plus I times LT1 is equal to E43. So and we prove that this system always has a solution, always yields a solution. So this way we can compute LT1 and adding E43 to LT1, we compute LT2. And then we save all this computed LFSR values in a hash table, which basically the key is the time difference. So let's talk about the first online stage now. So in this stage, we basically want to collect a lot of key stream bits such that we would be sure that for two of them, for two of these samples that we have, the states, the internal states at some point only vary on the 43rd bit of the LFSR. So we first check that if we have N of the samples, what's the probability that two of them having this property? And we prove that this probability is equal to N to the power 2 over 2 to the power 102. This is a simple birthday argument. So like we mentioned before, Plantlet doesn't allow us to generate more than 2 to the power 30 key stream bits. So we have that N would be equal to 2 to the power 30 over 80 maximum for a single IV, which is approximately around 2 to the power 23.7. So what's this probability here? It would be 2 to the power minus 54.6. So how many different IVs do we need? So we would have one good hit on average. We would need 2 to the power 44.6 different IVs. So let's talk about the second online stage. So here we will keep a list of these pairs, T1, ZT1, YT1, which these are the things that we defined before, the forward direction key stream bits of length 80 and the backward direction such that we want to keep the pairs such that they pass the checks that we had in observation 1 and 2. So the important thing here is if we have this difference here in the internal state, we would definitely get the 45 fixed bits in the difference in the key stream generated and also the others, the observation 2 conditions. But the other direction does not necessarily hold as you can imagine. But what we will do is that as soon as we see this type of a pattern and the key stream generated, we will just assume that the internal state had the desired difference that we wanted, meaning that they only differed on the 43rd bit of the LFSR. So this is the idea of the attack in this phase. So we're going to keep everything that passes these two conditions and then we will guess that they have this difference, the 43rd bit difference in the internal state and then we will solve some equations and see if our guess was correct or not. So what do we do? We can just implement this algorithm by a hash table. And then we first check if the key stream bits at these two times have the desired difference on the 45 bits that were fixed. Then we assume that the internal state difference is only on the 43rd bit of the LFSR. Then we compute LT1 and LT2. We just check the precomputed table that we had and then we check the observation two conditions having these values of LT1 and LT2. And then we see if the difference that we have and these values are compatible. So let's see how many pairs would pass these checks. So how many pairs in general do we have? We had 2 to the power of 30 over 80 different samples for each IV. So we have N choose two different pairs which is around 2 to the power of 46.36. So what's the probability of a pair passing the first test is that those differences, those 45 differences should be 0, right? So it's 2 to the power minus 45. Then we compute the value of the LFSR assuming that the internal state difference is only on the 43rd bit. So we have 800 bits that we can check. We have seven linear combinations of the LFSR values and one quadratic combination. So for the linear combinations the probability of them being compatible with the LFSR values computed is 2 to the power of minus 7 and for the quadratic one is 3 over 4. So in average the number of pairs that would pass for a single IV is 2 to the power of minus 606. How many different IVs did we have? 2 to the power of 54.6. So how many pairs in general pass is 2 to the power of 48.54. So let's talk about the last section. The last step in the attack.  So how many of them did we have? 2 to the power of 48.59. So we start, for each one of these pairs we start creating a system of equations. So we add a bunch of unknowns to our system which are basically the LFSR bits N02 and N39 and K02, K79 and then the values of the LFSR computed using the lookup table that we had. And we have 320 polynomials in Z2 and K. So these are basically the polynomials that we get from that key stream generation function from time t1 forward of length 80 from time t1 backward to the length 80 and the same for t2. And then we feed these equations to a SAT solver to see if we get the secret key or not. So first of all, we run some experiments to time these, to time the solver. Like how long does it take for the SAT solver to solve when we have a unique solution to the system? And here you can see the histogram. And then sometimes the assumption that we had that the internal state only differs on the 43rd bit is wrong, although we had the desired difference on the generated key stream. But in this situation, the SAT solver would abort and would not give us a solution. So we also approximated the amount of time that it takes the SAT solver to abort this type of a situation. And this is the histogram of that. And in the end, of course, we just measured the amount of time that it takes for a single platelet encryption to happen with the same processor that we used. And this is the histogram for the encryption. So now let's talk about the total complexity of the attack. The pre-computation stage is not really costly. So we have matrices of size 61. We have to do Gaussian elimination on them. So the complexity of this is approximately 61 to the power 3. And also, how many of these do we need to do? It's 2 to the power 23.7 for different t-values. So the second stage, the first online stage, is the most costly part in this algorithm. So what's the complexity of this stage? We need to generate 2 to the power 30 key stream bits for how many different IVs? For 2 to the power 54.6 different IVs. Hence we have 320 plus 2 to the power 30. This is the initialization phase. Time 2 to the power 54.6 platelet iterations. Which would approximately give us 2 to the power 76.26 platelet encryptions. So let's talk about the solver part. So the SAT solver, when there is a unique solution, will give us that solution in 2 to the power 17.5 platelet encryptions on average. And when there is no solution, meaning that the assumption that we had that the difference is only on the 43rd bit of the LFSR is wrong, the SAT solver would abort in 2 to the power 17.13 platelet encryptions. So how many different sets of equations do we have that we need to solve? We have 2 to the power 48.54 of them, the entries to amount. And so what's the total complexity? We have one correct sample which is going to take 2 to the power 17.5 and we have 2 to the power 48.54 minus 1 incorrect samples. Which each of them will take 2 to the power 17.13 platelet encryptions. So in general we would have 2 to the power 65.7 encryptions. So all of these stages are done independently from each other. Like they're serialized. So when we add up the complexities we just add them together. There's no multiplication here. So what's the total complexity here? It's completely dominated by the key stream generation phase. So the total complexity would be around 2 to the power 76.26 platelet encryptions. So we're not really happy with this complexity because we went through a lot of trouble and then we get like an algorithm which performs 8 times better than an exhaustive search. And as we said, the most costly part is generating the key stream bits. So we started thinking if we can generate less key stream bits and still have the same amount of pairs. Because we just need those amount of pairs to make sure that we have a pair that the internal state only differs on the 43rd bits of the LFSR. So during the talk we always mentioned that T1 is equal to T2 is equal to 0 moduloat. But we never actually use the fact that T1 and T2 are 0 moduloat. But we only use the fact that they're both equal to each other moduloat. So what we do is that we take different possibilities of T1 equal to T2 equal to some i, which i is between 0 and 79 moduloat. And doing this we can do the filtration and the solving part for different i values separately. But we would need 80 times less IVs to get the same amount of pairs. So what does this mean? It means that we need to run the 2 to the power 30 bit key stream bit generation for 1 over 80 times less IVs which means that the whole complexity like the dominant part of the complexity would be also divided by 80. So the total complexity would be 2 to the power 69.98 plantlet encryptions. Which is way better. So let's conclude this talk now. So we presented an attack on full version of plantlets in this work. And the main thing that we use was that the internal state difference such that the NFSRs are equal to each other and the LFSRs only differ on the 43rd bit actually propagates a really nice difference into the generated key streams. And the total complexity of our attack was 2 to the power 69.98 plantlet encryptions. So I think that's about it. And thank you very much for listening. I would recommend you to read the paper for more details specifically on the memory complexity and all the tricks that we used and the proof of dilemmas. And feel free to contact us by email if you had any questions. And thank you again for listening.


Stay tuned we're going to share some low-carb keto carnivore tips with you Either njrew22.com here with another quick low-carb keto carnivore chat today.  You can make if you're on the run It's from a pretty decent website. Check the link in the description But I just wanted to say one thing these are good snacks for people that are like transitioning from the standard American diet the sad diet into Better better times, you know low-carb at the very least and maybe keto or ultimately carnivore because if you're on the carnivore diet You will not need this 50 snack lists because you'll never need a snack You'll never want a snack. You'll you'll just eat one meal a day Maybe two and have some very basic fundamental meals like meat and cheese and dairy if you can tolerate it And that's it check the link in the description and if you like the video Please hit the subscribe and the bell and all that then we'll see you next video


So hi and welcome everyone. Thanks for attending the session. I know it's Fridays and the conferences are the best the worst Days to have a session in the morning My name is Salo for Garcia, and I am one of the tech leads with Kubernetes to release So just a little bit about me I worked for my whole life for my own company and then they until the pandemic hit and had to Switch jobs, and I am now a senior DevOps engineer at Marmos I have two little girls, and I also like to Travel the world with my bicycle one of our can and so with the beginning that this year I let the effort to produce a nest one for Kubernetes All right, so let's start a little bit to talk a little bit about sick release and what we do so sick releases the special interest group That does the Kubernetes releases whenever you see a new Kubernetes patch release or a new version coming out We are the guys that work to make that happen so we also form the Kubernetes release team that is managed by the Kubernetes Release leads joining us today here. Hi, Ray and we also manage the actual Decision of what goes what goes what gets shared picked to the supported branches of Kubernetes and The the other thing we do that is maybe worth Concerning today is that we are in task of continually improving the Kubernetes release process to keep it up today to practices and best Best practices and standards that can keep coming up so I Wanted to talk a little bit before we go into the as one thing about what is in a Kubernetes release? I wanted to go briefly into this because the Kubernetes release has many different kinds of artifacts many of different ways of distribution and so we think it's a good example of why Having an S bomb is a beneficial thing for a project of this size so the most people are used to How consuming Kubernetes by its container images we produce Five different images for five different architectures and If you cross that together you get 25 images, but there's a lot more to a Kubernetes release than just the images We those images are produced. We support three different operating systems Linux macOS windows we Have we built some of the artifacts and the images for the what we call the supported platforms Which are currently the 386 AMD arm arm 64 the PPC 60 and as the ms3 90x platform we As I said before we have 25 images with each release We produce 53 naked binaries the naked binaries are what you whenever you download for example a cup a copy of cube ctl How cube call ready to run? that is one of the Then that's what we call a Naked binary same thing for QB by the end et cetera We also have a bunch of tarbols Which bundled together some of the components of the whole Kubernetes system? Which are called client node server and tests and for example if you download if you want to some of those the client side of of the tarbols includes QCTL and the node contains the binaries that Drone the cubelet and so on Then we produce a source code tarbol With the the source code up to the point where we chose to the commit that we chose to cut the release The RPMs and their packages and also file with release notes So our mission is to provide guidance and tooling to facilitate the production of automated releases if you take a look at this Statement mission statement. It doesn't specifically say Kubernetes in it That is why we Try to produce some of our tools as and may make them as general purpose as possible If you may you may be familiar with the release notes, which is the probably the most popular Can call these things popular Project and utility that we release it's used by a bunch of other projects to generate their the release notes We also publish as a general Purpose tool the the builders are controlled so cool with cloud builds Then we have a thing called publish release which allows you to upload and sync your releases with github and Finally the bomb tool, which is think that we're talking about today so the S-bomb definition, so I think this is the Previous definition right now. This is they prefer it has been updated since But I wanted to more than take a look at the actual S-bomb definition Tell you a little bit of what I think how I see the build of material So when you see a bill of materials you have it's a document that lists The components in a in a in a software release and it allows you to determine the relationships Among them. So if you think about the work have warehouse like this A bit of materials would would really quickly allow you to determine where things are if you if you want to ship a Complex a multiple item order you could easily find out and pick them up from from the boxes but the way An important thing to note here is that we are sick release. We are not sick as one so what Well, our focus is more on how we can actually describe a more complex Release that spans many distribution channels and can so far to facts So I tend to think about the release a little bit more like this like a market So if you think about a market, you probably can find some of the items that sale there in different Presentation, so if you think for example, you may have a tomato and that tomato come maybe available In its raw form for you to buy by the by the way, or you can maybe could find the Transform to a salsa inside of a sandwich or different presentations and for me a software release is kind of the same thing So if you remember the the can so far the fact that a Kubernetes release produces We have the same components package in different ways. So we have the if you think about Cube CTL It's available in an RPM package as a binary inside of the notable or even in source code if you Want to consider it like that like like a consumable? so There's a thing to consider when you start building your S1 You the first thing that you will do you start thinking about the S1 is So you take your documents and the first thing that you would add to it is your source code and Now project like Kubernetes the S1 lists about 24,000 files of an if I remember it correctly so Just by listing all the files in the source code you get a long long list Then you start adding for example your container images and then you add your binaries then you add more binaries and your packages and then the dependencies the transient dependencies and Then all of a sudden you've got everything in there except for the kitchen sink or maybe you do have the kitchen sink like in the picture and So what I what we chose to do is that to start thinking so we the first says one that we produced was a single Monolithic file so we've been thinking about other ways that we may split the S1 into more consumable documents more linear ways of doing that so I Tend to think about a Way that we could produce linear s bombs for what could potentially consume them. So if you think about The source code maybe that would go into some kind of source code tool like code search things like that that could could actually Take advantage of the large number of items that they're in there. So the same thing with containers got the container images Could be better suited for things that will actually consume the container images So if you think you could have like an admission controller in Kubernetes and would check the the Contain images coming to make sure that everything is in place or that to match them against a certain for an ability so and so on and Same thing for the binaries the binaries are intended for the operating system. So it would make sense to check them in there rpms so on So our If you were at the keynote this morning, you're aware that there are two great efforts going on to Produce s bombs. We went the Linux Foundation way, which is as PDX which is now an international standard Of course, I'm going to repeat a lot of what was said this morning in the in the keynote, but I'll try to give you SPDX looks like this It's That's the header of the SPDX document and a fragment of a file listed in there It has information about the the document an external reference to another one And then the file entry with the sashes the license It's her So how can we build a better Kubernetes s bomb? You have a if you have a monolithic S bomb like we had at the beginning The first thing that you can leverage is the ability of SPDX to Do two things relationships and packages Using those constructs you can start splitting parts of your S bomb Apart from each other and the first the first the first thing to that user package is your source code and we inside of the Kubernetes had been treated like a separate package of that Bundles all of the source code together and then we simply point all of the artifacts as being built from that From that package Then another thing another thing. So this is not what we do in Kubernetes But it's like a some of the ideas that we've been having in the towards the future of how we can handle it The next thing that we can do is split out the container images And so if you think about the container image, it's simply a bunch of star balls, right? And you could think of those If they were packages in themselves and then if you think about it there is an index manifest in front of them and that So what we the way our tool works is that it marks each of the Platform-specific images as being variants of the base package, which is the index manifest That's the way we try to start structure container images when described in them here And then after that you can start making more complex decisions like for example here. We have a Potential S bomb detailing the binaries and the RPMs Spends one into a different document and in there we have the dependencies bundled into another package so the idea is to make this Units more consumable and available and better suited to process by the tools that could potentially Use them in the future. We're still Understanding who is going to use them. Are you going to use them inside of your processes outside to make matches with other systems and so on? So how about our tool? all of the code that we wrote to generate the Kubernetes releases derived into a original SPDx implementation Which is which runs inside of the release the parental release process every time we cut a release but we we brought those libraries and built these This this general proposed utility that you can use to to run and process your your repository so the the easiest way to to add that to create a bill of materials for a project is just CD into your repository file run bomb generate in the path of the directory and it'll it'll speed out your bill of materials describing that of course a bill of materials to be complete and useful you have to add more things to it so you can pass and other kinds of artifacts To to be to get included into the into the below front here So you can add directories you can add images that are stored in the registries and You can have Tarble the the tarble flag down there is a container image, but exported as a Docker archive in your file system and as well single files you can add all of those kind of artifacts to your to your Bill of materials now the other thing that this thing does is that you can have a declarative as one definition inside of your repository and now the bomb utility as a step in your CICD pipeline, so it will read the the definition that you're that you just do right in the yaml file and Construct your S1 based on the under artifacts that that it finds and are defined and there will see you have them all you know it Okay, so let me switch screens to My demo so okay It's it like a big enough Little bigger so This is a test project, it's a little project that I wrote Call mini proud which is emulates the proud interfaces in GitHub actions, but the project itself is not really important What I wanted to show you is a way to structure. So this this project is like a single it's a go module standard go project with its tests and and Files in there, so let me remove this S1 because that's Not needed now. Okay so For example this when you compile this project it spits out in this output there it through here It's binary. So if you wanted to So the first thing I wanted to demo is the thing where I was saying that you can just point it to the directory run it and have your album so If I do Bomb generate So if I just pass it that a directory as a as a source and run it It will run and process everything inside. So let me give you a brief overview what sort of what it's doing there so it starts by processing the files in the directory listing everything it it goes and fetches the SPDX license lists from the SPDX website So SPDX has a set of the fine open source licenses that the Linux Foundation produces and maintains and They the S1 the our libraries have a classifier in there that Read those licenses in which it's downloads in JSON So that it can interpret any any files licensing files that that it finds inside of your project and dependencies, which we'll see in a bit so downloads the licenses and writes them to disk and It scans your directory and says oh, so probably this is the license file for the whole project And if it finds one of those predetermined By predetermined means like I did not quite scientific study of the license names that people use But they're kind of hard-coded in there for the moment But it will it will use them as defaults and it will actually look for other Files or licensing information inside of other of other files as well But it looks for so it asks itself. What's the license that I would use as a default for this project? then The next step is that the tool will actually read and honor your git ignore files so if whatever you Set in your git ignore it the it'll honor those patterns and keep them out of the s-bomb when you're running in directory mode like this and Then it scans the files the whole file tree and adds them to the directory It right here. It's detecting that the director contains a a go project Oh, by the way, the only Since this is this was written for Kubernetes the only language that we fully support and for the moment They'll say it like this is go It'll it will allow you to index Container images binaries and things like that from in Derived and compiled from other languages, but if you want the the dependency analysis, it only works with go so It reads your go mode and lists those are dependencies as direct And then after that it will calculate the full dependency graph and add the transient dependencies as well to your project So once it's it's got the information it needs to run It will actually go and fetch all of the go modules download them or use them in from the local go cache To actually go inside of each of the directories of the programs and look for licensing and information to include them in the in the final output And it found called dependencies and It wrote So it wrote the file so The the first new feature for others that have Perhaps previously look at this tool or not. I I want to showcase a new feature that I have been working on for the last month or so is that you can now take So if you see the help for the bomb utility, you'll see it and it has to Uh, two main modes of operation. Oh completion there. Yeah, so yay for supply chain and features getting added so the the the two modes of operation or for operation are generate and document so the first one is generation of documents and there are there is Ways of working with documents and currently what you can do with uh document is the following You can actually outline Your s1 Tamed it so that's okay so Here is So if you take a look at the actual spdx code It's like really hard for humans to understand what's going on there Of course, if you take some time and try to visualize what's going on that you can certainly make sense of it especially in a simple s1 like this one, but I thought that this Kind of visualization should bear on this help People understand better how their s1s are structured so You have the root document here Which is describes one package if you remember When we were talking at the beginning how you should probably list all of your source code inside of a single package It it it's what it's doing there and that that package has 31 relationships defined to Which are the actual files of the source code in my little project here That that that's the first ones and then it lists the the next set of Relationships which are the dependencies of the go of this go source code At the end this it it says that it describes zero files because what it means is that you have the root null of the document and from there Then the next derivation is that the next branch or yeah branch you you could see it as Having packages or files attached to it and what it's saying there. It's that it doesn't have any files so An important thing to notice We are defining we're like Showing here the s-bomb in a tree like fashion But it's just a simplification to make it easier to understand if you think about the many many many One-way relationships that an s-bomb contains it would be I think better suited to to visualize it as a graph more than a tree like this Since Since one package one file can span multiple multiple The relationships and with other things inside But I mean certain helps as you can see here we can kind of understand the how the s-bomb was built so Now the next thing we want to do is for example This this little project is designed to run as a github action. So it produces a container image Which are already oh, maybe we can choose one of the errors. Let me So Okay, so this this one is interesting So what I'm going to do here is run the bomb generate command and I'm going to pass it a One of the distro list images to see how how it will actually generate the next one for A container image by reading it from the registry. So first thing the first like this Okay, so what is what it did there is that it went fetch the image and its layers from the registry downloaded them and Generated the s-bomb from there So if you take a look at this one We can take a look at the outline of this the way it's structured it So The this s-bomb has one package which points to the actual tag of the image and then itself It's a package which contains all of the images in there as I was saying before Things can be related to other things and in this case You can see here the same the same It's the sbdx element listed twice by because The container the actual container images are variants of the tag. That's that's the way we structure them so Now I want to let me see the time okay and What I want to showcase next is the The building the s-bomb from the file. So this here is the The yaml of initial for the for the project I'm running Probably if you take a look here What we are defining here to be included in the s-bomb is the directory where we are running A single file which is the the compile binary that gets written to the output And then the container image We give it the license of Apache 2 then The other thing is okay, so there's a new A new feature that I also wanted to to showcase today is that we've added We've been working on enhancing the Kubernetes Supply chain security to a little bit and we've started working on producing in total attestation files For some of our artifacts. So what I've done here is that I've actually included Those libraries into the s-bomb tool so that whenever if you if you don't if I don't know if if you're familiar with the attestation file, so The attestation files are a list of components similar to an s-bomb But but they can it contains information so that you can trace those those items back into the CICD chain Back and actually find out where those will build so if you think about an s-bomb you're already Tracing all of the artifacts that get produced in the in the s-bomb And you already have that information So what this tool can help you achieve is produce like an empty attestation file that includes all of the files So you can reuse them and maybe build your whole provenance from there So this is highly experimental and secret code. So let's see if it works because I'm I'm not sure. Let's see So let's see what happens So I I run the tool and I pasted the pasted the Configuration file so that it detects and reads the ammo configuration In it's doing the go dependency construction and it's Adding here. Oh, this is this is the actual provenance conversion of the artifacts And the container image. So if we were lucky we should have the The s-bomb ready. Okay, it's there. So let's take a look at the At the outline So here's the output So as we saw before here's the image That got listed as the as a package there then the source code It will always grab the the name of the of the code module as the name of the module and then here's the The the single binary attached at the end So if those were to be my artifacts that I'm releasing my s-bomb ready to ship And then the new the new file that should have it produced is this attestation file right here jq Here to make it more visible. So This is the attestation file that uh, this is the intoro attestation file. So If you if you see here, it has the the the part that concerns and relates to the s-bomb The metadata is is the is the subjects here. So since we already computed the hashes for all of the files in there the It's virtually free for us to include in the attestation file. And so if you have this file And you simply go and complete the predicate section down here, which is basically the information about the process that run the thing the dates Who did it and things like that the recipe which arguments went then you You if you completed the information to this file you have the s-bomb and as well the the necessary attestation to make uh, potentially make your your Your release salsa level one compliant because if all you're missing is the provenance metadata, which this think Makes you create and Yeah, I think this is those are the main points of of the tool that the way they work Yeah, probably those are the ones and then A little bit of a future the direction of this this tool We are as I said at the beginning Kubernetes releases a bunch of RPMs and dev files The packages with the release we are not currently listing those Because we are still working on the actual analysis of the rpm and and the packages then we been in talks with the linux foundation s-bomb generator folks to maybe see into merging our efforts and that way we could maintain the project and Uh, we would benefit by gaining more languages in our tool could be an An option and then the final one. Well, not the final one, but spdx allows you to output not in just that format that you saw there, which is called tag value It also allows you to output in many other formats from rdf json YAML and we only currently output to to to the tag value This is a validated one, but if you need it and the one of the others are still missing and then At some point I would certainly like to add some validation and verification. There are still Divergencies in spdx tools in the way they interpret things. So the way you saw For example container images listed here or some of the packaging that goes on in there different vendors Toolmakers have different interpretations of how they see and things we are trying to to to Make efforts like the s-bomb upcoming s-bomb or amma Where we will try to compare and make more Consensus on the output, but what I would like to add to this tool in a not very distant future Is the capability to ensure that if it produces an s-bomb it can be Reverted and to make sure that the actual Output corresponds to the things it it understood and so on your artifacts and yeah, and that's That's the that's it for for for what I had prepared and if you want Those are my my deals if you want to contact me ask me in a way Just I usually go by puerco in most most everywhere and If you search for The blue link there it will be when I upload the slides you can you can use that one I did a version of this presentation where we demonstrate the how to integrate the s-bomb tool inside of a tecton Release pipeline and having it as a task And you you can see it there. There's also a ripple A ripple with the with that content in there And yeah, I think we don't have time for questions, but But if not, I'm happy to take any any on the hallway or


Okay, thank you very much. Based on my area of interest, I would like to briefly discuss the current state of the global trade governance. As all of you know, the Doha round has been drifting for 16 years, and yet we do not know when and how it can be concluded. This kind of impasse had never happened before since the start of the multilateral trading system of the WTO in 1948. The 11th WTO Ministerial Conference will be held in Buenos Aires, Argentina next month. To prepare this MC-11, an informal mini-ministerial meeting was held here in Marrakesh early last month. However, ministers found that there are still sharp differences on major issues among the groups of countries, depending upon their own country's interests. As the multilateral trading system of the WTO was struggling with the Doha round, many countries actually have attempted to liberalize their economy by seeking bilateral as well as regional FTAs. And most recently, a new trend of forming a mega-RTAs with multiple participants has emerged, such as TPP, RCEP, and TTIP. However, as you know, the Trans-Pacific Partnership Agreement will not be implemented. You know the reason why. Furthermore, the negotiations of other mega-RTAs seem to be also prolonged. In addition, President Trump, you just heard from Marcus Norland, America's first trade policy is making the global trading environment more uncertain and more unpredictable. Against this backdrop, some international organizations and the Leaders Forum have worked to improve the global trade governance. In particular, the G20, the premier Leaders Forum for International Economic Cooperation, has made various efforts to restore the credibility of the global trading system. As we remember, at the 2015 Turkey G20 summit, leaders asked trade ministers to meet on a regular basis. Following this request, G20 trade ministers met in Shanghai in July 2016 and welcomed the establishment of the G20 investment and trade investment working group. However, during this year's German presidency of the G20, trade ministers did not meet, and no substantial agreement on the improvement of the world trading system was even included in the G20 summit declaration. Meanwhile, at the German G20 summit, leaders discussed the importance of fair trade and level playing field and recognized the role of trade defense instruments, just like anti-dumping or countervailing duties. It should be noted that G20 leaders at this time had more interest in fair trade than free trade. I would now like to make some suggestions in my own personal thinking on global trading system. First of all, the WTO members should seriously discuss how to save the multilateral trade negotiations. To save the Doha round, serious discussions should be made at the upcoming MC-11 to revise the agenda which was written 16 years ago. Second, along with the multilateral negotiations, WTO members must consider taking different approaches to address further liberalization and new commercial rules. Given the nature of the decision-making mechanism of the WTO, we may need to seek for bilateral agreements for certain issues among like-minded participants such as government procurement agreement. Of course, if other countries who later satisfy certain requirements, they are allowed to join the agreement. Furthermore, if these agreements extend the benefits to all other non-participating members of WTO on an MFN basis, this agreement would become multilateral, like the information technology agreement. Third, we know that WTO's dispute settlement function has been respected despite the failure of the Doha round. However, recently, WTO has unable to fill vacant members at the WTO affiliate body. This really hurts the credibility of the WTO's dispute settlement system. We do hope this problem to be resolved as soon as possible. Fourth, I would like to also emphasize that MC-11 must produce a successful outcome with another small package. Fifth, I would recommend that WTO members agree that investigation and imposition of trade defence measures should be consistent with WTO rules and purposes. In this context, it would be extremely important that trade remedy systems are operated in a fairer, more transparent way. Sixth, I would like to note that there seem to be a growing consensus about the need to make all the citizens share the opportunities and benefits of trade liberalisation. Regarding this issue, there are two important areas to focus on. First, we have to look at this issue from the consumer's point of view. In many countries, consumers often do not feel the benefits of trade liberalisation. One of the main problems in this case is that distribution process of delivering imported goods from the border to the final consumers is extremely complicated, making the final price of the imported goods much higher than the initial input price. From the consumer's point of view, expensive imported goods are not attractive and therefore they cannot see the real benefits of trade liberalisation. Major reform should be made in the distribution process of imported goods. Second, we have to consider, reconsider the way to assist industries, firms and labourers which are having difficult times from liberalisation. We now need more inclusive policy schemes to assist losers from globalisation and trade. As these two issues, I would like to recommend WTO along with other appropriate international organisations study and suggest concrete policy recommendations with best practices. Last but not least, I would like to suggest WTO members utilise their existing and future bilateral FTAs to further liberalise trade and reflect new commercial issues in the agreement. In other words, if the WTO members decide to have new FTAs or revised existing ones, they should make the FTAs as modern as possible by including newly emerging trade rules such as competition policy, e-commerce, trade remedies, state-owned enterprises and investment facilitation to name a few. I'll stop here. Thank you very much.


This is TFNN, The Tiger, Financial News Network, News Update. Good morning, everyone. On this Monday, the very first day of May, we're looking at the Dow at this 10 o'clock Tiger Financial News Network Market Update, up 60 at 34,163. Fascinating action. I'll be talking about it in my show coming up, the Tiger Technicians Hour, as well as in my webinar coming up this Wednesday at 4 o'clock for the subscribers to my opening call about the power of this nine-period exponential moving average. Yes, we spiked up high, we've made a new recovery high. I would not be surprised if we got a real choppy week coming up. We're looking at the S&P trading also up. It's up two at 4,171, made a new recovery high. Notice that an old G or a brand new AO, big question coming up. What is the QQQ doing? Well it's down 80 cents at 321.75. This rectangle, the formation that it broke down below and then now spiked above, it's going to be, you have to watch it closely because under 318, a close under 318 says, yep, choppy sideways action. WM, the Russell 2000, is up 67 cents at 175 and 90 we're looking at within this rectangle formation. It's just kind of stuck there and if you're looking at gold and this is going to be fascinating as well. Why? Because gold is holding quite nicely. It's unchanged right now, 1999, but look at silver. Silver has had a very nice strong move to test the recent two-week high that it made and now it's at 25.80. I think it's in this range of the rectangle, but it is showing some strength. I don't know how long the strength is going to last because the dollar, the dollar is down, announced up a little up five ticks at 101.70. It's stuck in the range, but it's trying to hit to the top, but it hasn't yet done that. Looking at high-grade copper, high-grade, oops, high-grade copper is trading right now at, let me just do this if you don't mind. High-grade copper is trading at 3.96 and the continuous contract up 7 cents. Yeah, it's actually a little bit weaker, but the bonds, now we're looking at the TLT and the TLT type in the wrong place, as we're about to go to the break and then the show, the Tiger Technicians Hour, we've got bonds down to $1.74. Oh, this is going to be a fascinating session. I'll be back for the Tiger Technicians Hour, check out both before they use that I'll be back in a few minutes.


What is going on everybody Astos here welcome back to another video so in this video We're gonna be talking about the top 10 stocks that I'm personally watching and looking to trade here in the third week of April in 2019 we're also going to be talking about some stocks that you guys actually called out either in the comment section on Friday's video or in our call-out section in our Discord group chat so before we do get into all these different stocks for everybody Out there that finds value in these videos all I ask you to do is to go down below and hit that like button and really Support to me and supports the channel in general and if you're actually new to the channel I have two links down below in the description box for you one of them being the Discord group chat and the other one being the Facebook group both of these communities are 100% free of charge and I guarantee you guys you'll find a ton of valuable information in there And you'll be able to interact with a ton of knowledgeable and helpful people in those two Communities so again 100% free of charge. They are linked down below in the description box and without further ado Let's talk about these 10 stocks and really a little gist of what the overall Market did yesterday and if you guys want to see a more in-depth market update go check out Friday's video I broke things down a bit more in-depth there, but just to quickly run through the S&P 500 very quickly the SPX The 500 largest publicly traded US companies. We pretty much Gapped up here. We pushed to a higher high from this little Consolidation phase this little consolidation You know a couple of days that we were seeing here over the past week really and then on Friday We saw that big pop-up, right? So what I'm waiting for and what I'm watching for this week is to see whether or not we're going to really pop up and test The 2915 level because that is the next resistance that we are really facing here in terms of the SPX Which was a support from back in September of 2018 and why I'm watching that level and instead of this 2905 level is because as of Friday's close It seems like we are trending and trading above this 2905 level since we did close above that level and it seems like we're holding that level as a new support So pretty much now guys for this week I'm going to be watching this little horizontal channel whether or not we're going to be trading between 2905 to 2905 are we going to maybe sell off and break this level of support and then head back to the 2890 level which is the next support are we going to pop up again and maybe test 2905 and then break out of that level of resistance to then test all-time highs These are some things that I'm watching for for this upcoming week and be mindful We're about 33 points away right now from the all-time highs This is literally a day or two of green and the markets will be at those all-time highs again that we were at in the beginning of October of 2018 so be mindful of that when you're planning your swing trades another thing I want to mention here guys is that we are in earning season earning season a lot of the big name companies are Reporting their numbers here over the next couple of weeks So keep that in mind as well when you're taking your positions when you're day trading when you're you know taking swing trades Be mindful of the companies you're putting in money to trade to swing trade Understand when they're reporting earnings because this is super super important because it can really honestly Fluctuate the price of that stock up 10 percent down 10 percent depending on you know Whether the earnings were good and whether the market perceived those earnings as good So keep keep all these different things in your minds guys and let's talk about now Let's just hop right into it the 10 stocks that I'm personally watching for this third week I haven't linked or really written rather all here. So first on the list is Apple guys ticker symbol a APL and Apple is actually a stock that we were watching really for these past couple of weeks I've been talking about it and pretty much every single weekly 10 stocks I'm watching video because it honestly hasn't been disappointing literally every single week It seems like Apple has been higher than the previous week in terms of its price and this past week We actually saw a bit of a rejection on Apple stock at around this 200 to 201 level of resistance and we saw a retest at the old support roughly at about 196 to 197 you know this past Friday We saw a bit of a sell-off all the way down to about 196 where we were actually able to Confirm the bounce on that old support and we reversed very aggressively and I actually took a position in Apple Right around here this past Friday roughly in the 197 dollar level and I'm planning on swing trading these Shares so why I see potential and Apple guys is because we're maintaining the 50 simple moving average support right now Heading into this week. We're maintaining that old support or the support rather at around 197 And I want to see really a continuation of the push to the upside and and for it to test $200 before putting more money into Apple and if we were to test that $200 level which is the resistance right now about a couple of points away from where we are now and we were to break That level this could be a good breakout pattern for the continuation of the uptrend and we could potentially be testing You know 207 208 210 and at that point I'd be up a pretty solid amount on my position on Apple So I'm watching it this week guys And an ideal move would be a break out of 200 and for it to head up to 205 210 Which would be roughly my goal sell price on Apple so the second one is actually one that one of our members in the chat are on the in the comment section ended up calling out ticker symbol BX Blackstone Group LP so overall what I'm seeing here in terms of BX Let me just pull out my drawing tools very quickly so we can draw some support and resistance levels But right off the bat. I'm noticing a very nice thing right here. We're seeing a reversal of the overall price You know of this stock, right? We're not down trending anymore making lower lows lower highs being rejected by these simple moving averages We're now treating these simple moving averages as support levels. We're trending above them We're making higher highs and higher lows, and we're really reversing in Price and one thing I want to point out to you guys I'm sure a lot of you already know this but you can use moving averages to identify Trends right when you see a 50 simple moving average cross below a 180-day simple moving average this green one here is the 50 SMA this yellow one is the 180 SMA That's pretty much a bearish move right when you see the 50 cross below you can expect more red more potential bearish, you know sentiment You know moves in that stock when this happens does it always happen? No, but really when it does happen You should keep your eyes open to the possibility of it happening, right? And when we see the 50 SMA crossing above the 180 SMA, that's a very bullish move You can potentially expect more green so we can see really in practice here This happened perfectly with BX, you know, we cross down here more bearish Movements since that cross and now we're popping up this bullish cross and we've been seeing more green movements from there So if we draw out a really a critical resistance right here on BX You know, we're at a very critical level right now the $35 level We've been rejected there back in the beginning of November back towards the beginning of December back in You know towards the middle to the end of March this previous month and now we're seeing some Resistance at that same exact level now this past Friday So really the breakout move here on BX is going to be if it breaks out of this $35 level the next spot it could potentially be going to is around $36.67 which would give it roughly Let's see off the top my head. I would say about a three four percent margin Yeah, roughly about a three percent margin up to the next resistance if we successfully break out of this $35 level, which is what I'm honestly going to be looking For in BX and what I would recommend for you guys to keep an eye on and again I am not a financial advisor. This is strictly, you know, my personal opinion I'm giving you guys my perspective my outlook on these stocks Don't just buy them based off of my opinion. You have to do your own research You have to do your own technical breakdowns on these so you can understand, you know The patterns the movement for yourselves, but this one's looking pretty good Especially if we break that level and then head to 36 if we break 36 the next spot is probably going to be around 37 75 238 dollars so BX is looking pretty good AMD and NVIDIA are the next two. I'm going to be talking about here and these are both um Really stocks that I've been talking about over the previous couple of videos. I made a the three swing trades I'm watching or I'm trading in April rather These were both in those videos and I figured since the patterns are still intact since I'm still actually in these positions Myself in these stocks myself, you know, I want to talk about them in this video as well So AMD advanced micro devices the honest You know the overview of this one is we pulled back from thirty dollars down to about $27 and from there We've been maintaining this 50 simple moving average as a support over the past couple of trading days And we can see that right here right after the pullback We've been maintaining it and that's a very good sign that the stock wants to continue This uptrend pattern at a higher or low from the previous and it quite frankly Excuse me wants to continue this truck upwards to the previous resistance, which at this point is around thirty dollars But before we do get to that thirty dollar level We have to break 28 and maintain that level which was an old resistance here at twenty eight dollars as a new Support and this is what I've been saying in the past couple of videos I said this in the in the discord chat as well AMD needs to break twenty eight maintain that level before I honestly add more money into it I'm already in AMD roughly at about 2750 that range I got in a couple of days ago, and I've just been patiently holding the shares So I want to see a break to the upside here my target sell right now is at about twenty nine dollars twenty nine dollars and fifty cents And if we break 30, I'm going to re-evaluate the position Maybe add some more or really, you know build a new position at that point you know for a trade on AMD because if we look back here to previous price history and Previous price history obviously doesn't always You know tell us that the stocks going to go there again But it just allows us to make resistance levels support levels so we can really set Barriers to see where we could be potentially headed You know if the stock does end up continuing to push up right and if we do get back to thirty four dollars I think that's roughly a fifteen percent move from where we are right now Which if you were to buy now and hold till thirty four dollars right that would be a pretty pretty solid swing trade But again price previous price action does not always indicate where the future is going to be for a stock Just remember that guys so AMD looking pretty solid to keep an eye on it for this week in video Very similar pattern for Nvidia right we've seen a bit of a pullback recently But we're still maintaining the fifty simple moving average as well as this one eighty eight support You know at the close of the market on Friday So what I'm honestly going to be waiting for this week are we going to maintain these levels quite frankly what right? Are we going to maintain ultimately above this one eighty five level ideally? I would like to see it maintain above the one eighty eight level and above the fifty SMA These are some things I'm going to be watching and if we just go back a bit closer here on Nvidia stock Let's say the twenty day one hour. We're noticing a quite a bit of a strong resistance here Around the one ninety one to one ninety two level on the stock I want to see a break out of that level for it to head into the mid one nineties before I add Potentially more money into Nvidia and my goal sell price is roughly around One ninety seven one ninety eight right now on Nvidia That's where I do have my limit sell as of now and again if we do end up breaking that level maybe 194 that's where I want to add more money into Nvidia so really I'm looking for it to trade in between this horizontal pattern and eventually get back up to this next Resistance or the really the second resistance after we break one ninety three if we break one ninety three at 203 Dollars so that's what I'm looking for in terms of Nvidia the next two are also ones that you guys ended up shouting out CRM I actually did take a look at this one a bit before recording this video and noticed a wedge pattern on CRM And let me just explain to you a couple of different scenarios that can happen here on CRM which would really determine what we're going to do whether we're going to trade the stock or just not touch it What so ever right? So you're noticing it's making higher lows as well as lower highs at the same exact time right? Putting it in this wedge pattern. So either one of two things is going to happen this week guys We're either going to break the resistance of this wedge Which is going to be a breakout bullish pattern with the next resistance spot being at around. Let's say 163 dollars which would be right here or we're going to sell off retest the support of this wedge And if we break that right to the downside here, that's going to be a huge bearish pattern So that's really all I have to say on CRM Just keep an eye on the price action if we pop out that's going to be bullish right if we get rejected Start the head down retest the moving average as that supports We break those supports and we test the wedge support and we break that that's going to be a very big bearish pattern on CRM so Ford ticker symbol F This is a call-out that was made on my previous video and just to put this out there guys Ford Actually has an insane Dividend on it. I haven't checked in a couple of weeks But I think at its low right here the dividend was like eight percent seven point five eight percent or something like that So since the stock has been pushing up, I would imagine the dividends roughly six percent right now Maybe six and a half percent. Nonetheless, that's an insane insane Dividend so if you guys are into Dividend stocks, you know income producing investments You might as well take a look at Ford because in terms of a yield It's doing very well. But remember when you're investing in dividend stocks, you're not only looking at the yield, right? There's a lot of different components that you need to look into one of them being the payout ratio in terms of Looking at dividend stocks, right? So I don't want to I don't want to go too in deep Too into depth on that but again, just do your own research on dividend stocks But I just wanted to mention that this one is a six to seven percent You know payer right now so in terms of the technicals here on Ford stock It's actually looking pretty good, right on the 184 hour chart It seems like we are Reversing on Ford stock right now if we go to a bit of a longer look on the one year chart We notice the stock has been getting hammered right 12 dollars down to seven dollars and 41 cents at its low It lost pretty much almost half of its value a little bit less than half of its value But pretty much a lot a lot of value in the company was lost, right? But we're seeing now instead of these moving averages acting as resistances now we're acting They're acting rather as support levels, right? We're not getting rejected. We found a bottom We've been making higher lows slowly Reversing out of this mess that we've been in in terms of Ford stock and keep an eye on this on this 50 SMA guys This is looking like it's about to do a bullish cross above the 180 SMA We're already seeing the candlesticks here the price of Ford breaking out of these resistance levels This could mean more green coming up for Ford stock So this is looking pretty good on a long-term Reversal basis here and if we just hop back into the 180 we can draw out some resistance levels very quickly to keep an eye on for this stock so we can see We clearly broke out of that nine level no problem right now We're actually at a you know a shorter term resistance from back in the beginning of November 2018 at about nine dollars and sixty five cents So I say if we break the nine fifty nine sixty level of resistance We could be headed back to ten dollars per share on Ford in terms of a technical basis So thank you for this call out. This one's looking pretty solid But in terms of some shorter term action here, you know, it does seem a bit overextended We haven't had a significant pullback in Ford really in the past three weeks at this point They are a size a bit overbought so if we were to pull back here Maybe retest the 50 SMA as a support maybe at about nine dollars and 15 cents Maybe nine ten this could be a level where I'd potentially hop into Ford as a swing play But keep in mind earnings are coming up and let's see Maybe you can hop in on a dividend play, but I don't know when the X dividend date is it might be um It might be over or maybe it's this one right here for 23 I just have to double-check that so just keep an eye on Ford ticker symbol F Looking pretty good right now and let's get into Disney guys Disney has been the talk of I guess you can say the stock market community especially here on YouTube over the past couple of Days and why why this happened go check out my previous video But the gist of it is Disney really talked more and gave more details on their new streaming service coming here I believe in the fall of 2019 and that's stock the stock this news that caused the stock to surge Nearly 12% all the way up to a hundred and thirty dollars So you may be asking yourself stocks Are you going to buy at 130 on plans of swing trading it up to a higher price? No, this is something that I am not going to do but I'm calling this one out And I'm talking about this one in this video because there's a couple of different things that can happen here Right what I personally think is going to happen is we're going to see a little sell-off in Disney here over the next couple of days Right typically when a stock flies up like this on good news, you know It can hover around that price for a couple of days But typically you know some investors some short-term traders Especially some short-term money in the stock it tends to start to funnel out right people are taking their profits Excuse me causing the stock to fall down a bit Right maybe into the one twenty four not one twenty four maybe one twenty seven one twenty eight Maybe if it starts to sell off a bit more that is where I'd I'd potentially take a position, right? This is where I would be like, okay, we're selling off I want to see a support a new support start to form a new bottom Right before I do end up getting into Disney right so you can you know wait for the pullback Potentially right maybe get in on a pullback for a swing trade you could potentially You know play let's say a put option short term put option on Disney you can short the stock short term if you think it's going to you know go down But just realize this can go either way right, which is why I'm strictly mostly going to be watching it this week I'm not saying I'm going to buy on Monday 100% But I want to see are we going to pull back or we're going to continue to truck up on this good news that we got You know, this is something that really I'm just watching and I'm very excited to see but just keep an eye You know on this RSI level as well It's very very overbought touching nearly the 90 level right now, which is absolutely absurd right in terms of the RSI So just keep an eye guys. Are we going to sell off here? Are we going to pop back up? Are we going to consolidate a little bit and then maybe start to sell off a little bit? You know these are some things I'm watching this upcoming week in terms of Disney so AKS and Rio let's talk about these two very quickly so AKS, you know AK steel a lot of the steel companies out there I've been getting slaughtered right, you know AKS, you know X these have not been doing so good Right, this is United States steel. This is gone from $38 to $16. You know AKS for going back You know it's gone from five to you know two dollars and fifty cents. You know these are Really on a technical basis not stocks that I'm interested in trading right? We're downtrending lower lows lower highs You know the bearish cross we're about to see or we really already saw another bearish cross here over the past couple of weeks You know, this is something that I'm not really looking You know to trade complete to be completely honest with you But let me just you know draw out some resistance and support levels so we can see maybe if these levels Um, you know get broken maybe if we start to hold above these levels We could be maybe reversing back to the upside, right? So we're seeing we're actually out of support right now at about two dollars and fifty cents on AKS Roughly from the previous support from around the end of January in 2019 So let's say hypothetically we break this level. I personally think on a technical basis here We're going to be headed to another lower low on AKS, which honestly it seems like it's already breaking that level It seems like a falling knife right now We're seeing the EMA cross below the 50s in May, which is also a bearish You know move there. These are things that are slowly scaring me away from AKS, but nonetheless guys Who knows what can happen? We can get a big pop here We can break out of these levels and if we break out of three dollars, you know That's gonna be a resistance where if we break out, you know That could be a bullish reversal to the upside but as of now what these technicals are telling me There's more ready to come on AKS. So Rio. Let's talk about this one very quickly ticker symbol R. I. Oh This is one another one that got shouted out in the discord group chat. I believe and in terms of Rio right now We're noticing it's really at a high here. It's at 63 dollars and 46 cents. Not too sure if this is an all-time high Let's see it looks looking like it is an all-time high actually. Nope It's not an all-time high with the all-time high was back in 08 then we crashed horribly. Oh my goodness 139 down to 22 dollars. Wow if your wealth was tied up in this stock I feel real real sorry for you during that a big downwards push there But nonetheless, you know, we're seeing a bit of a reversal here on Rio over these past couple of years and let's just see, you know, some longer terms Resistance levels at 60 dollars. We can see alright. We're breaking out of those levels now The next one could be at around 76 dollars here 73 74 dollars, you know judging on this 20 year chart So this is actually not bad, you know If you're looking at these longer term charts here the fact that we're breaking out of this resistance at 60 dollars and we're slowly starting Excuse me push up to the mid 60s You know, this could be a good sign that we want to head back up to 70 dollars in terms of Rio Stock just be careful here on the shorter term You know basis it seems like Rio does want to pull back and retest this 50 SMA If it does end up pulling back retesting the 50 SMA maybe back down to the old resistance at about You know 60 dollars if it tests that and holds it as a new support That could be a good entry point on Rio ticker symbol RIO and that's what I'm watching for this upcoming week So the last one I want to talk about here is Facebook stock guy So Facebook right now is at a resistance at about a hundred and eighty dollars And we've been talking about Facebook and it trading between the 170 to 180 level here over the past couple of weeks And it finally seems like it wants to break out of that 180 level guys. We're so so so close We're almost there all we need to see is a break above 180 and for it to pull back Maintain it as a new support and then for it to slowly reverse from there to test the next resistance Which is at about a hundred and eighty five dollars. So for this week, that's all I'm watching guys, right? I want to see are we gonna push to 180 are we gonna start to fill the second gap up to 185 that is where I think we can capitalize on Facebook stock But remember earnings are coming up which can fluctuate it heavily to the upside to the downside Just like all these different stocks we're talking about and a bunch of ones that you're probably already invested in already trading earnings is coming up so be mindful of that so That's pretty much it for today's video guys Those are the 10 stocks that I'm watching for week three of April in 2019 if you enjoyed the video feel free to go down below and hit that like button it really supports me and Supports the channel in general and if you're new to the channel guys feel free to subscribe again hit that notification bell My name is Stas. I make videos, you know pretty much daily really throughout the week daily Sometimes on Saturdays and every single Sunday. I have a video on trading You know market updates trading updates personal finance the stock market stock news stuff like that So if you are interested feel free to just hit that subscribe button and get into the community hit that Rather leave a comment down below. Let me know what you guys think about these any other stocks. You're watching I would love to know I'll catch you all in the next video. Enjoy the rest of your weekend. Good luck trading this week Peace out


Hi everyone, Joe for jaspyscasewrakes.com coming at you with a little filler pack here to Give away some triple-thread spots four of those spots being given away But first the break big. Thanks everybody here for making this happen appreciate it And there's all the teams right here. Let's roll it randomize it six and a five eleven times Names and teams so different dice roll for the giveaway part But for the break six and five two Three four and 11th and final time six and a five eleven times for the teams one two three four five six seven eight Nine ten Eleven the final time After eleven we got the cardinals down to the Giants All right, there's the first half of the list right here And there's the second half of the list right over here and let's just print this out and rip open this pack and see what we got And then we'll give away those triple-thread spots So home run for Cabin bit. No match up. There's the final print up. Thanks everybody see what we got here Brennan Davis high five futures Bowman firsts You all key sesped is I don't think that's his bowman first But nothing too crazy here in this pack But the crazy thing is who's gonna win those triple-thread spots I think the triple to each triple-thread spot is like a 350 some odd value right here So let's gather everybody's names one through 30 new dice new list Let's roll it and randomize it three and a five eight times So it's just it's not too many winners here top four after eight fingers crossed Good luck one two three four five six seven and eighth and final time Five and three eight times so a lot of sad faces here, especially the number five spot Very close Cory Not quite though five through 30. Thanks everyone for giving this shot for making this happen We gotta do one more of these fillers move some spots straight up then we can knock out that triple threads break So check it out. Jasper's case breaks calm top four happy times for you You're in that triple threads break Chris Walker is happy Cory is happy Jared is happy Harry is happy top four Happy times for you. We'll see you in that triple threads break of hopefully with a little luck a little bit later tonight Jasper's case breaks calm


Hello Stockholm! Great to be back! Third time lucky agile people conference. So let's talk about doing strategy the thing and of course what it is in the modern way in this new landscape of lean and agile and Kinevon and things. This VUCA world that we heard in the previous talk. Of course a few experiments that we've tried and see if we can find some patterns and we can have some insights and some learnings from these experiments. And this is speed talk so let's proceed with speed. So the story I will sort of try to convey is from strategy as chess. You know you have a grand chess master, you have set rules, fixed pieces and the chess board and you know quite slow game where someone is making all the moves and the pawns and the pieces on the chess board.  So let's move away from that and let's look at strategy as football. You know very fluid fast game with you know people who collaborate they play together and they win together and they lose together and they have their own individual moves based on an overall mission or purpose for their team. So that's a metaphor that I would like us to explore the coming few minutes. Okay so my name is Erik Høen. I happen to play football so that's why I like this metaphor and I worked at a few cool companies, Netent the online gaming company, Ericsson the Big Telco and Framfab, anyone remembers Framfab? Yeah from three to three thousand people in three years and then we crashed and burned. Something of an experience. Did we have a strategy? Yes we did. Why strategy? Well you know you heard the previous speaker talking about this Vuka world volatile uncertain complex and ambiguous and it was Vuka already in 18 something when when Hokusai the Japanese woodblock painter made this freak wave. So there's been things going on all throughout history but what is happening now with a digital thing that we are all aware of is that things go by three orders of magnitude higher speed. It's a factor one thousand with bits traveling much faster than atoms. So that's the big difference I would say. So then of course we need a strategy. We need to have an idea of where we're going and the direction and what choices we make to sustainably thrive in this world where the rate of change is never slower than today. What is strategy? I'm not going to ask you I'm going to answer because this is speed talk. So this is a brilliant lady called Melissa Perry and I really like this definition because it's totally in line with with what we have learned you know lean and agile and and Kinevin and all these things. So strategy it's a system you know achievable goals missions working together a line of team around desirable outcomes both for customers and the business and it emerges from experiments towards a goal or in a certain direction. So I think this is a very good modern working definition of what strategy is. So how do you do this? This could be seen as a very abstract right? How do you do it? Enough with definitions and theory let's get down to business right? How do you do it in a real business context? Who's this? Jack Welsh. Some people say he's the best CEO of the 20th century and let's hear from Jack. Real life strategy is very simple. General direction implement like hell. Would you agree? Is it that simple? Let's let's move on. Oh who's this guy? Another old gentleman. It's Dr. Deming the quality guru who inspired the Japanese industry and the second half of the 20th century and you know he's on the line and he looks pretty upset. Dr. Deming what's on your mind? I have only three words for you. By what method? And I guess he was talking to Jack here on this two-party call. Of course we need a method so thanks for the reminder Dr. Deming. We got a three-party call. Dr. Evil is on the line. What would you like to add? Nothing. Absolutely nothing. The strategy is top secret. Just do what I tell you. Anyone recognize that situation? Maybe not as extreme you know Dr. Evil and so on but I think in a lot of companies tend to forget that it's so important with the trust and collaboration primarily between the business side of things and the development side of things to working together with trust and collaboration. It's crucially important. So yeah top secret strategy just do what I tell you. Don't go there. Don't follow Dr. Evil. So how do you develop your strategy? How do you do that? How do you co-create a strategy that is valid? Let's explore that for a while. So this is an experiment you know talking about direction talking about end point you know needs long-term key performance indications. So what are our needs? So this is you know just setting the direction. More value to exceed customer expectations. Faster time to market to be more responsive. Better quality to secure trust. 75% engage people as the foundation. So this was a long-term thing. It was set five years into the future and this was pretty pretty cool actually and the key learnings for this was it was so good to have a stable long-term KBI or key performance indicators. Not having a fluffy long-term vision making it concrete and having it stable gives a lot of clarity and a lot of focus. It was ambitious you know 10 times 4 times 2 times so we realized we needed to do something radically different. It was balanced to secure that we avoided sub-optimization you know lead time at all costs sacrificing quality for instance and it was also really good and easy to show progress towards these quantified measures to give us energy to continue on the journey and of course show our stakeholders that we were making some progress but it was not the next quarter it was not the next month or even the next year it was coming five years and we actually did achieve those targets so I think it's good to start with the needs and setting direction or vision. Then another experiment finding you know a metaphor a simple iterative incremental way of doing or setting up your strategy as iterative choices so this is called playing to win it's a sports metaphor and people relate to sport much more easily than to military or war and stuff so here you talk about your winning proposition we're in this to win the hearts and minds of our customers how are we going to do that then you make choices where are we going to play what's the playing field are we going to play handball or football or ice hockey what choices do we make here based on those choices of where to play how are we going to win it's outside in starting from customers starting from the winning proposition what's the playing field how are we going to play there what choices do we make so strategy is about making choices what do we gonna what are we going to do and what are we not going to do super important and framing it in this sports metaphor helps a lot so based on where to play how to win then what capabilities do we need what capabilities do we have what capabilities do we need to build so this is iterative it's not linear so you go back and forth and you iterate and you learn when you do this and final step what kind of enabling structures you know what kind of systems and measures do we need for you know making this happens so the learnings here was that sports is a very useful metaphor people can relate to this and it really works on all levels talking about fractal things you know it works on individual level it works on team level it works on program level it works on organizational level so that's really cool and we got a very focused description of our strategy you know it could be written on five slides one for each of these areas not 50 pages of boring word or power points that was pretty cool moving on you know another experiment visualize your value offering so this fish bowl is should be red it's a red ocean a lot of fish that are eating each other and then you know we want to move want to fly to the next blue ocean so this is sort of blue ocean strategy where you want to find a brilliant spot where you sort of differentiate and you make yourself unique and how do you do that well use the storytelling of course like this having nice visualizations but you can also have this simple graph where on the horizontal sorry vertical axis you have your offering level is it high like five or low one say and on the the horizontal axis you pick a number of competing factors that are important for your industry or for your market and then you just plot you know in blue you plot yourself and in red you plot one or several of your competitors and the key thing here is of course that it triggers a conversation because all those hidden assumptions that people may have on what makes us unique and what is good for competition you put them out on on on a whiteboard it's you shouldn't really do this on a power point but you should be a number of people gathering around the whiteboard and do this together as a collaborative co-creative exercise so many insights on what you will do and what decisions and actions to take based on this common understanding when you plot this and of course it's hard to find those competing factors that's hard and it's sometimes hard to know exactly what your competitors are doing and how you are doing but that's a trigger for going out and getting data and having conversations with customers potentially as well okay another visualization and I'm not going to go through the details but this is also very very good to trigger conversations you know visualizing your value chain and how it evolves so you have a value chain you start with the customer at the top and the customer in this case needs you know play games console or mobile gaming pc mac or on a virtual reality headset then you can sort of follow those needs and capabilities that are needed to to build those needs via you know your game platform all the way down to power you know plug it in to the wall to get power so that's a chain of needs on the other axis you have sort of evolution from uncharted to industrialized you have some kind of genesis totally creative thing custom built product or commodity so once again this tool which is it's a tool but it triggers the conversations so you can agree on how your product or your service looks like so you shouldn't have a powerpoint once again you should be at the whiteboard drawing this together and having the conversation to get the insights on what are those needs then of course you can start making decisions on okay should we do this ourselves if it's a commodity well of course we don't build the power if it's a product should we buy it or should we build it or should we outsource the development to someone else so this is an extremely cool visualization that will help you to make those hard choices make those decisions and come up with your strategy by drawing it together starting from the customer taking it all the way down to to power and then you know get those consent decisions in a much quicker way because you're co-creating this picture and by doing that you get those hidden assumptions and those hidden insights because some people are very intuitive but you get it sort of up on the whiteboard it takes a lot of practice i can tell you that takes a lot of iteration takes some time those are the sort of negative learnings just to be open with that but it's so useful totally useful okay moving on how do you make your strategy happen and of course as this murbios strip shows it's it's related it's really two sides the same coin how do you develop your strategy and how do you make it happen it's yin and yang it's not you know you do one thing separately from the other but i think this is really really important this alignment and autonomy you may think that they are separate concept either you have total alignment or you have total autonomy but it's not it's not binary it's not either or you can have both so if you plot alignment on the intent the what and why on the vertical axis and you plot autonomy on the horizontal axis that's the actions the decisions the how so by co-creating alignment or coherence on the what and why you're going to do the principles then you can create a lot of freedom on the actions the decisions and and how to do things the methods or the tools so strong alignment gives you you the possibility to have a maximum autonomy and then that helps everyone in the organization to take the right action and to take the right decisions so you enable a lot of freedom and we all know freedom and autonomy through Dan Pink's work is super important but you also need some kind of alignment you want to direct the energy in a in a certain direction that's also very very important and that's should be coherent and it should be co-created so so this was an insight in our way of making strategy happening so long lead time from insights to action so we had those strategy updates in in q1 then we did some balance scorecard in q3 and then you updated the balance scorecard in q4 and then three quarters later you started reporting on those targets and well were they still valid because you know the rate of change will never be slower than today but this is where we started and it was terrible so the the rapidly changing world meant that our targets were quickly outdated so instead we did regular strategy retrospectives and that's you know quarterly you sit down together and involve the whole organization um by you know looking at our long-term key performance indicators looking at the current business situation looking at the current challenge and the current strategy and what we have learned from that and the the ongoing experiments and then you know setting a new challenge because a challenge is something that sort of triggers the whole organization to do experiments trials prototypes to improve and get better so you want to tap into the creative energy of the whole organization and that will take you to where your long-term key performance indicators so the learnings from this experiment was that it was really good to have this regular and positive reinforcement of of our strategy and of the the long-term wanted position and it was much faster of course to move from insights to action we had sort of a quarterly cycle and the progress was made visible on a quarterly basis so people could see that we were making much more progress and i don't have this on the slides but we actually took it down even to to sprints so we had three-week sprints so we had sort of strategy sessions every sprint not only every quarter sort of to to sort of help us with the experiments and and see how we were doing to make the strategy happening so it can be done and it's all about the cadence you go from yearly cadence down to quarters or even to sprints also for your strategy okay so this is a bit more on on how we did this so dig it a bit deeper so we had a challenge which is sort of one thing and this case it was every sprint delivered to a live network a live mobile telecom network and we had our our business leadership team and our development leadership team agreeing on this as a first step then we engaged the whole organization in half-day exercises half-day team exercise okay what are we going to do to contribute to making this happen we also said that you have 30 percent everyone has 30 percent to do experiments their most prototypes learning at their disposal to make this happen so this is what lin gurus called push the forum and pull the content so you give some some direction and you give the what and why and then you give autonomy on how to do it and the learnings here were really that it was good to have clear expectations but it was a bit hard to get bigger things to happen still with this okay final experiment sort of a simple operating system for making your strategy happen this called four disciplines of execution and don't care so much about the words discipline execution because this is really cool actually first thing is focus focus on the most important thing pick one maximum two things and this we we've learned from you know flow and kanban it's limit your your working programs or process this is really limiting the number of of targets you're working on next thing is act on your lead measures and this is something we've learned from startups and an even lean startup you shouldn't only you know look at the measure gloss what happened when it had rained but you need to look at your lead measures your your barometer to see where you're heading because otherwise you're always chasing the rabbit you're always after the rabbit because you measure when things are done so find your lead measures very early on and see how they relate to to your focused lag targets okay so that was number two number three compelling scoreboard once again a visualization and this is a compelling scoreboard for the team by the team it's not for for for managers or for other teams it's really to the team to show are we winning are we losing are we drawing how are our lead measures going how are the lag measures going so it should be done by the team and it could be a bit fun some metaphor some teams use lego and that's that's always cool and finally you create a cadence of accountability and this is similar to what we know from scrum you know daily stand up that's a good thing you create a sort of a cadence a habit and here it's at least weekly where you talk about commitments this is what i'm going to do this is what i've done this is psychology it's not commitment to your manager it's commitment to your mates your your colleagues in the team and of course it's about learning what did i learn from last year how did sort of for last week how did the did what i did contribute to the the lead measures and the lag measures so this experiment was also really really cool but it what we learned was that it's if you do all the four things then you get the the results then you get the outcomes if you start missing out on having this this cadence if you start doing every second week then you start to forget and then it's get boring so i think this that's another learning that that we saw so really go all in to all four and start from there that was the key key success factor and the teams that didn't they started to degrade okay so to wrap this up what were the sort of patterns that that we saw in these simple experiments and those learnings well visualization compelling scoreboards having those strategy canvases having this worldly map where you see the needs and that triggers a conversation which triggers collaboration so you involve people and you interact also the the alignment or to get the coherence how to co-create that and to get feedback loops quickly and uh you know get then the autonomy for people so the combination of alignment for autonomy so final question how do you want to do strategy thank you thank you eric