Welcome to the 1878 FM podcast. It is Episode 7. We have got a full complement again this week. The Bushmaster General failed a late fitness test last week. Luckily for us, it was only a slight discomfort in the back. He's had treatment and he's back amongst us today. So Mr Bush, how are you? I'm good man, I'm good. My back still hurts. Sorry to be off last week but I bought some CBD oil from my back. Does that make me like a stoner? Do I have to start wearing a... No, it's all straight legal. That's it. I might start wearing tie dye or something like that. Do you know what I mean? I think you could carry that off. Thanks guys. That feels like a generalisation, doesn't it? I'm not sure the kids in Liverpool are wearing tie dye. They take CBD oil or other versions of it. Other versions of it that probably. It's a strange on that. It seems like it's come from nowhere, doesn't it? And it's always been legal and now you can get gummies in it. They give them out on planes, don't they? Do they? Yeah, apparently. They don't give them to the pilot. I just think it's really strange because you've got something that was at one point in recent history kind of seemingly contraband and not socially acceptable. And now they sell it in Holland Barrett? That's progress, Dave, it's progress. What is more, nothing says socially acceptable now than Holland Barrett. And it's four times the price of norm. Other stores are available and I'm quite sure Holland and Barrett in certain prices are competitive. When we were in Washington they had the real deal was legal, wasn't it? Yeah, it was. And surely they can make a version of it that doesn't stink. That's the one. Because the whole of Washington just stunk of weed. It should be like strawberry flavoured or something. Yeah, like vapes. They must be able to pop, but then again it's that's going against the natural elements of it, isn't it? There's now worse though being on a train. Someone gets on who's obviously had a bit of it. And it just stinks, doesn't it? I can't lift my handbag like Vic Reeves on shooting stars. Whenever that happens. When I worked as a taxi driver, people would get into the car just reeking of it just on their clothes and everything. And it was just hot.  What have you been up to? And it was horrible. See the problem? I didn't wash eye there. So these smells of weed and feet. That's how I describe large areas of deprived areas in Liverpool of just smelling like weed and feet. The problem is as well is that it does stink. It's disgusting, isn't it? But you don't even get any benefit to that. It's not as if like the getting in your taxi and these things, but you're getting a little bit mellow. I don't think that's the best way to feel in a 12 hour shift. No, no, but just taking the edge off rather like CBD does CBD. Doesn't make you knock. I don't know, I've not had any. I've had some CBD. I haven't tried it yet. It's nice, it just chills it. Maybe next episode we could all drop a gun. Shall we? I've genuinely, I've got some downstairs. I've got sent like a free packet, but I've never tried it. Maybe next week is when we should try it. Or try it as per to air frying, what about that? We should do air frying on CBD. Can you air fry CBD? I'm not going to put my air fry through that. No, but you could make a snack with CBD. No, it doesn't have to. I've seen the Harry Bikers do an episode where they were in California and actually they went to a restaurant that specialised entirely in edible marijuana for one of a better thing. And they had gear and all sorts of stuff, you know. So maybe the air frying of the CBD capsules is the way forward. Maybe that's the way forward. To get back to the very first episode, Dave, what about a marijuana pasty? Absolutely, you know, I could do your CBD toast if you want. In the George Foreman lean grilling machine. That's all that. We could open a coffee called Amsterdam air fryer and just see what happens. Just run with it. Literally chip and pan fire. Kitchen fire every week. I've not been on the ball. That was the only time I've ever had any kind of experience of this world. My sister used to live in Amsterdam and so it was like an easy cheap weekend away. I went over with my missus at the time and my sister took us to some coffee shop and gave us some stuff which was perfectly legal over there, which was perfectly not legal where we live. It was like every stereotype. It's the first and only time in my life where it's actually kind of gone well or right in so much as... I just spent an hour walking around Amsterdam just giggling and eating individual slices of pizza and burgers and just general munchie stuff and then nearly got run over by a trolley bus. I'll be honest, I've been to Amsterdam twice and I haven't had any kind of substance and those things all happen to me as well.  Weird or without substance. What a place. Right, let's move on to football. We will come back to that. I don't want to move on to football. I don't really, but let's skate over it very quickly then. Let's go straight to the Red Light District and forget about football. CBD and the Red Light District with munchies. And that's a better podcast I think today. But let's quickly skate over Saturday night. Dave, we discussed last week that it was going to be a tough game. Remembering and shivering at the thought of the 5-0 only a few months ago there. Everton ultimately didn't lose 5-0, which was good. There was some slight improvements, but it was still a case of Roperdope, which we discussed the other week, really. They kind of drew us in and kept us at arm's length and comfortably won the game in the end. Yeah, I mean, listen, we said last week that I didn't fancy us at the weekend and actually Everton didn't disappoint in that respect. However, I have to say that it goes down for me to be all about those first two chances that were not put away. The Damari Grey one, which does, to be fair to him, clearly bobble up before he strikes a ball, and that's why he skies it. The Onana one, he should have got it between the sticks, definitely one way or the other. And I think that if one of those two go in, it's a different situation, but they didn't, and the age-old thing with Everton have ruined the chances, and they did very much. But listen, on the balance of the 90-minute spurs with the better side, we knew that they would be beforehand and they were. And I don't think we can have any complaints, to be honest with you. Andy? Yeah, no, I totally agree. The one thing that I was impressed with though, if you're looking for these small nuggets as we recover as a football team, which I think what we're doing is a season of recovery, is that once the second one went in, because it was the typical Everton pattern, wasn't it? Bit of dominance, missed a couple of sitters, you can see it's coming. Spurs are the masters of the dark arts of sitting back and drawing you on to. You know how the second half was going to go. It wasn't a penalty, as far as I'm concerned. No, I didn't think it was either. It's on his brool cream. And then it was just a mistake, it was a Tachowsky mistake for the second as well, but the key thing for me was that we just didn't collapse then. Last season we had collapsed and it had been four, five, whatever. And they don't, I feel like they have more resilience to them and kind of not stayed in the game, but we kind of weirdly had almost a kind of composed finish. So I know we didn't get anywhere near them in the second half, but we didn't absolutely all start arguing with each other and give up, which is what an Everton team last season would have done. So I think it can take some positives out of it. We definitely, as Dave said, we're soundly beaten, but I think in these little steps towards being a better Everton, I feel like there is some positives to gain from it a little bit. Paddy, you've got to score, don't you? Or if the target up. Yeah, I disagree with Dave. I think Damari Grace is woeful. Like I don't care if it's a bobble or not. I think that's woeful. It does bobble up though. It does, but he's a professional footballer. Come on. Maybe for me knew Dave that would have been different, but as a professional footballer I expect him to do a lot better. And I don't know how Nana is the same as well. The two people, two players, not really in fully control of the situation, and that's where Everton have got to improve. And it's same like what Andy said, Dave. It's a case of a bug. It's little, little small steps that you can see, but it doesn't have to make you frustrated when you actually do get opportunities. And there are, like we've said this a million times, you see other teams get results in games where they take those chances, you know. Teams have been to Anfield and teams have been to Old Trafford and the Emirates and the Etihad and they take those chances. And it's very easy to go, well, if we'd scored, Dave would have come back, but you never know. You've got to take your chances. And to have no shot on target, I think is abysmal. One on target in the last two games. Yeah, it's for well as we played in terms of stopping players doing what they do. That's abysmal.  And that's where the forwards have got to get better. And that's where I think Frank Lampard's got to get better. He's got to have something else than just sit back and soak up pressure. That's great. Do you know what? The best teams in the world did that. Contest done that for years. Many nails done that for years. But you can't do anything if you don't have something at the other end. And that's what we're really struggling at the moment. If we had a... I'll just use La Carch, who has just an example, cos he's never been psyched. He was being prolific in the last 10 years. Something like him. And you're thinking, we're going to draw you in. Cos we're comfortable at defending. But when we actually counterattack, we've got a lad that you can stick it in the net. And I think as well, because we don't have that. Because we don't have that. When those chances do come along, and they're not going to come along very often, as you say in both the case of Gray and O'Nana, you've got to be doing something properly with it. Because it's not like, oh, we've got to screw those up, but there'll be another six along. Doesn't work like that. Is there a... And Andy did make the point, and I think he's right actually, is that, this season, do we just have to accept that this is almost... And when I say rebuilding, cos there is a rebuild, there's totally different plays in the team. But rebuilding, like Andy said, I guess the confidence and rebuilding evidence of the team is that. There are going to be these moments, I think, this season, where we lose three games on the run. I think it's going to happen. I've got to try to eradicate that. It can't happen regularly. It's going to happen this week, isn't it, I think? Well, it's up to us to make sure it doesn't. But the thing about it is, we might have to go through this pain this season, as long as we stay, as long as we're not in any kind of trouble. And the manager's done a press conference today and alluded to this as well, is that, like, this season is about almost creating the foundations for next season, but we still need results with that. I was going to say, it's great, and we're going to build foundations and everything, but you actually have to win points, you have to score goals. If you don't do that side of things, you won't be in the league. And I genuinely mean that. It's great being to say we're a lot better defensive, but if we can't put the ball in the back of the net, then we're going to really struggle. The player, Saturday was only the second side. No, I know, but how many goals have we scored this season? Eight. Eight, that's a woeful. And I am one person. I am someone who doesn't think Dominic Arblun is coming back. I really don't. I don't think Dominic Arblun is coming back as anywhere near that player. But does this not then put us back to, sorry to keep harping on about it, but the conversation that we had in terms of the inability to get that other striker in addition to Neil Mopat, who isn't really a prolific striker anyway, right? And we didn't do that. And now we find ourselves in this problem because I'm with you, Ped, is I don't think that Dominic Calvert-Lewin is ever coming back to being anywhere near what we thought he could potentially be. See, I mean, it makes me sad to say that about Dom, but I just don't think when I hear things like the manager say, we've got to be very careful. He's not training all the time. I just think, what's going on? What is going on with him? If there's other issues by football, that's fine. That's why I don't think he's ever going to come back. And I think you're absolutely right there. Mopat is nowhere near good enough for Evan to be playing on his own. He's just not. That's a fact.  And I think that's where he got the recruitment wrong. And we said this on Deadline Day, so it's nothing new. On Deadline Day, we sat here, and we watched the clock tick by, and we were like, we're missing a player. That makes it doubly hard, and we've seen that on Saturday. But there's a lot of other points out there. You've got to play 13 other teams twice. There's a lot of points to take, and I think Evan has just got to grow. But when Dave said there about maybe three losses in a row, Newcastle actually is a place where we've got to go and sort of puff out our chest a little bit. And those games like Palace coming up and Leicester and Fulham, we've got to go in those games and really have a go. And that I suppose, it's not out of the pressure, I suppose, but that's what's got to happen. Andy? I think this is probably going to be the game plan that I think this season is going to be try and stay within touching distance and not get humiliated against the bigger teams and pick off the, but not expect to win. But then try and put away teams like, no offence to Palace or Fulham or Leicester or whatever.  Even though we were kind of in the game, lose them, but then try and make sure we beat the teams that are a bit more sadly at our level or below. And that's where it's going to be because I don't really see us turning over any of the top six really at all in a million years. I think we lose tomorrow night and I think Saturday then becomes a massive game because that will be three on the bounce and Saturday has to be a hard fought reset against Palace to then set us up for Fulham away. And then Leicester with a bit of momentum will do them as well. That's what I feel. I'm not going to worry though because I'm going to the game, the Palace game on Saturday. That's as you bloody jinxed it now. My dad is an Albatross. My dad's a terrible footballing Albatross. Obviously the lifelong Evertonian. He got me into Everton when I was a kid and everything, but he's coming with me as well and I am concerned. I don't know if anyone who listens to this podcast knows any like Shaman or people who do kind of cleansing, you know. I think he's a good. Something like that just like it's holy water or something. Shibidi oil. Shibidi oil. Shibidi oil. That's what we need. The coming to the Premier night I believe. Cleansers it. That's what I've heard. Shibidi night. Bring you that. Dosing your dad up like Mr. G before he goes in. It'd be like Jim Robinson, a magic mushrooms on Navers. Earlier episode of Navers. Jim Robinson and Doug Willis. Doug Willis. It'd be like that. He's been a fellow with the ute. Doug Willis. I think Doug had a ute. Everyone had a ute. Doug was the man. Jim Robinson ended up having a fantastic film career. He ended up being in all kinds. He was in the event. He was in 24. He was in 24. He had a fantastic movie career in the end. I'll tell you something really weird. My brother Simon had a VHS cassette with. He would record all the neighbors deaths on it. It was like a death tape. He didn't have a heart attack in the kitchen but actually fall into the lounge. He actually moved across. I think it took him 10 minutes. He pulled a tablecloth off with loads of fruit. That's an amazing thing. How did he know they were going to die? Neighbours at one and again at half time. He knew. Simon had it wrong. Simon was all over. He wasn't a mystery. Simon like that to everyone. I think Helen Daniels is going to pop it tonight. People are complaining about the BBC schedules now. Playing everything three or four times. We lived off this writing for that. You can impress your friends by being at home for dinner. A head of the game. I've got a feeling Helen Daniels is not looking good here guys. I've just got a bad feeling about it. Selling spoilers in school. You know what I think is going to happen tonight? That's what it's like. Is there anything more depressing than watching both additions of neighbours in one day? I know it can't happen anymore but there was nothing more. That was school holidays for me though. Was watching double neighbours. Did you see the last one? I thought it was really disappointing. That's why it was the last one. I've not seen it for years but I thought I would go back and revisit it because it was one of those moments in television history and I thought it was really boring and nothing really happened. Kylie was in it though, right? She never really said anything. It was really odd. Paul Robinson. You've been in it for years. There was a ghost in it as well. I think she was in it. I was just one of the Alessi twins in it. They should be well yet. They would have pulled people to do it. I was a big fan of the Idigars as well. I was thinking it was a... I just like Bouncer's Dream. Remember Bouncer's Dream? What a classic TV moment? CBD oil for dogs. Bouncer's dream. A classic moment when the whole episode was about the dogs dream. You wouldn't lie and extend the twitches. It was not brave enough. That was brave TV. But they were dream of Baradog. That was up there with Bobby Ewing coming out of the shower. Classic Dallas. Brookside Lesbian Kisses and all the rest. Again classic TV. Just don't get that kind of television anymore. Barri Grant, remember coming back into Brookside and all that, that was amazing. I don't know if you guys have... You'll remember Brookside. But do you ever remember Brookside after Darkwood because... No, when VHS has become really, really obviously cheap. So they did specials for them. And they had these like Brookside after Dark and you'd have Jimmy Corkill swearing in them because it's cold. But it was just the worst example of swearing. It was just ridiculous. It was luck, we can say. Barri! And Dickhead, like for no reason. It was absolutely brilliant. Cisle. I don't remember that. He's one of the gangsters. And Barri Grant came back and like he was the gangster one and he had to take this. Did you run the Brookside fan club or something? I was there, it was all over it. It was a time when Brookside was good. And then he disappeared again. Fair play, fair play. I don't know why we got here but we're here. Remember Jimmy Corkill locking his lad in the thing because he was cold shaking and all. Incredible times. I don't know, old stuff. That's what Andy does. Talking of which, I have a question for Mr Andy Bush and his radio station. I don't know whether this is something that you heard or thought about before but on absolute radio now they have... Is it seven different stations? Seven, yes. But only four presenters. Honest to God, it's like a round robin. Here's what I don't understand. I was listening to you and then I was flicking between absolute 90s and absolute the ordinary one. Absolutely ordinary. The regular one. Absolutely ordinary, I believe it. I was flicking. How on earth do you do a show where you as the presenters are doing your links but then there's seven different songs so you don't know whether you're playing my sharoner and Ebony's are good or how does that work? It's nine different playlists with one show when we press the button nine different songs from nine different decades to go out. How do you get the timing right? Do some go slightly faster and some go slightly slower so they all end at the same time? They handpick them and match them all up together. Six of these songs are shorter so you normally get two in the space all handmatched by the computer but as you rightly say Dave from a presenters perspective it's a context nightmare because you don't know what's going to come off the back of what you're talking about. So you might be talking about something and then don't stand so close to me by but the police might come off the back of you talking and it gives an unwanted context so it can be a nightmare and also you can't say that was this anyway next because it depends what station you're listening to so all your usual gubbins when you're presenting a radio show are not there anymore. Presumably though you will be listening to so are you listening to what you're playing on the regular station? Absolutely ordinary. You're listening to that right and then that's your norm. Yeah that's it. When it goes well and it goes well most of the time it's amazing but it's amazing computer screen with hundreds of different songs going out but when it crashes it absolutely screws up. It's like an F1 car coming off the track everything goes wrong, wheels come off it loads of songs all play at the same time so when it's good it's good, when it's bad it's awful. What a fascinating. It's at the end of the day. What an insight. Don't stand so close to me could be when you've just finished talking about weed. You should be able to fill them but if it's... Whenever something bad happens on the radio they go through and they get rid of songs about dying so many bad things happen in the world then they are very context sensitive. If you talk about obviously it's x amount of years the day sadly we lost Princess Diana and then you play Crash by the Primitives The Primitives always get cold don't they? They always do. I feel bad for them. What an absolute ordinary record. I know but this is it so that's why context is everything and it can be a nightmare if you don't know what the song is that follows what you're talking about. Do you know what I mean? So there you go. What an insight. It's not just people talking bollocks on the radio is it? That's all the same. There's an actual plan. It's crazy. Speak for yourself when David was on the radio I used to always wonder how he managed to talk all the way up to the lyrics of a song and then when I got into the radio I found out the little tricks. I thought he was a magician but I found out the tricks of it. I thought he knew every single song and how far into it the lyrics started but then there's a timer Not on my side of the desk. I genuinely mine was all fail. I was very much analogue in that respect. He sensed it. He knows. Go back to 40 for a minute. Obviously that was that done but Frank Lampard on his press conference was asked about obviously being seen getting strength off of the weekend for not being happy but talked about pressure on managers and social media and radio he referenced he was listening to the radio on quite one station I won't say it might have been absolutely old when he was talking about managers managers getting sacked but do you think obviously both in the media do you think that it is going a little bit far where people discussing which managers being sacked next is now we've gone too far across the line so it's almost become a fascination but that then brings pressure to whoever is doing the job I can remember whenever a new manager to get a job it was almost like you pulled out a a line which said you've got to give him 18 months let him get his own players in let him get his pattern when now it seems like 18 weeks is a luxury show have we created the situation where there's a fascination on people losing their jobs yeah it's not healthy is it you know the turnaround at the moment across every division within English football is absolutely ludicrous I think there was a stat whereby we had Les Ferdinand on the official EFL podcast as we clang and the stat was something like a quarter of the EFL managers have already been dismissed at the stage where we are now which is just a ludicrous scenario and it's just because because obviously everybody wants instant success and often this is driven by owners of football clubs who with the greatest respect and a sweeping statements sometimes they are not the best equipped to know what should and shouldn't be done in terms of the culture of the club and the culture of English football and they think right well I've put in this many millions of pounds to buy whatever club it is and therefore why aren't we sitting in the top six but it is a ridiculous situation where as you say you are already earmarking who might be next to go and all we need is a few losses on the bounce and suddenly Lampard's name will get mentioned as being in trouble or so and so will be in trouble and then sure enough they are gone it must be a very difficult situation to work under Andy I think in society in general we are obsessed with people getting sacked whether it is politics or football or even if your celebrity the past or said something now that people don't agree with then there's a pile on they try and get you sacked or chucked out of whatever you're doing so I think you're right Bas I think there is like an obsession with getting people out of jobs and having vindication all that kind of stuff and I have to say respect to forest because I 100% thought they were going to sack it I said it I, I thought it's great because he's a great manager you can't just keep firing managers that's not the answer to the problem we know that better than anyone we had this conversation yesterday me and Paddan my personal view is that it's far too easy to blame the manager I never have done that regularly since Masier he took over especially the minute results don't start going your way it's I just feel like sometimes these players at these clubs just get off scoffery you know someone says something they don't really like so all your mates getting dropped and it's all of a sudden this fella doesn't know what he's on about and he dropped the standards then the new fella will come and start winning this fella is the best in the world and then they don't like him because he drops one of them over and then it starts again I know it's easier to get to the one fella is to get to the 20 but you have to surely allow people to get on with the job listen if you're getting beat fired in every single week you can't you can't stay can you because at some stage you've got to say well it's not really working mate the manager we're getting battered every single week there doesn't seem to be any improvement I understand there's a need of time to change your manager but I just feel like the media has cranked that right up when I think back to the last 10 years of Everton Managers so I've still got the end of David Moyes at the time Moyes had rocky spells for Everton Managers everybody piled on him because he couldn't win at the top four club away and yet we beat most of them at home under him and then Martinis had two terrible seasons and survived when at the end of his second bad season his third season at that time period got shorter shorter shorter shorter shorter now in the last but I do think there's a couple of reasons for it one being that the financial disparity between the Premier League and the championship is just ridiculous like it's far too big and therefore managers in the championship are under so much pressure to get into the Premier League and the managers in the Premier League are under ridiculous pressure because if Forrest do fall out of the Premier League this season financially they could be ruined and that shouldn't happen and it should be the same way but you'll decide if it is though and I think this is where the football club fail massively is I don't think they open up themselves enough for the media and then the media start poking holes in everything they do because they don't have the answers to the questions they ask I think football clubs are far too scared of the media and this is a media by the way that pays their bills it's kept Evan afloat for the last 25 years so and therefore yeah but I don't care about others I always say this I don't care about other football clubs I care about mine football club it's kept Evan going for 25 years before Mishiri coming and yet Evan have this closed door policy don't look behind the care the reason man has stayed for two extra years was because man has was so good with the media then everyone liked him he created this illusion that he was a brilliant guy a brilliant manager and no one wanted to see him sacked everyone in the media really liked him you see this with people it's why Harry Redknapp is a good manager why he stuck around for so long it's because the media loved him he was great exactly though but he showed that he would always open the door and transfer the deadline football clubs are terrified of the media so they bring on that scrutiny which shouldn't happen because if you go somewhere like America they have an open door policy they are like you pay our bill in fact it comes from the league these people pay our bills you speak to them and if you don't we find you and yet we have this thing in this country where if anyone has clopped the wrong question it's how dare you shut up you make for us not the other way around mate and that has to change if you start to give the media a lot more access the media would back off all that stuff personally I think because they'd have loads to talk about it's like with the art setter thing with the arsenal documentary on Amazon for those few weeks that it was on the media had loads to talk about in terms of art setter because they suddenly and they would relate to things from the year before and go so you're on the documentary on this and even though it was a year old they had something where they could go because managers are like I don't want to talk about that you should have to talk about it the football club protect them we were in America we've seen the difference in what we do here where it's really difficult to get to speak to people and what you find is the people themselves want to talk the people themselves want to come and talk to us yet the football club tries to keep them away and when we went to America we were on different continents and the rules were different and in America certainly the press guys we spoke to were like speak to whoever you want go wherever you want get as much information out there as what you want and yet this country for me is miles behind in terms of that you guys are in the media what do you think I wanted to jump in in terms of a lot of attention is put on managers and obviously they talk about players playing for a certain manager they talk about players not playing for a certain manager has he lost the dressing room etc etc and asides form and fortune can fluctuate hugely however ultimately the question of when lose or draw on a Saturday afternoon or a Sunday at 7 o'clock or whatever is ultimately down to that squad of players and the application that they put in because the manager and the coaching staff only do so much and once they cross that line then it's up to them now herein lies a big problem in modern day football is the fact that there's no real accountability and no real responsibility and I know that that's a huge sweeping statement and it's something that I do quite a lot but this is a problem with the modern day football is that when you're sitting on that salary and you're thinking well do you know what I get it anyway right whether he's the manager next week or the week after that or whatever I'm only a year into a four year deal and I'm on 80 grand a week or whatever it is or I'm on 180 grand a week or whatever because quite frankly he'll probably disappear and I'll get somebody else I might play, I might not, who cares I still get paid and also even if I leave this club because of who I am I'll get picked up by somebody else and I'll probably double my money so why do I give a fuck really we had the two boxers in last week we had Everton who became Welsh champion and Peter McLeil won as well but they were saying things and it just come up in the conversation and it was like we get injured we don't get paid, that's it we can't fight and they were like footballers get injured and you know we get paid for four years and if you're like that's a bit tight we've seen it with them it's slightly describing Jack Rodwell in the Sunderland just sat on the treatment bench taking a wage packet no that's it, I think things do have to change from that I think there was a documentary about Meepo Mollie as well and she was into she had like a four fight contract and she was on the last one and she knew she didn't win it she'd be out of USC, the highest place and she won it and she put everything into it and days right footballers footballers have these class dying contracts which you're right some weeks they'll be like I don't really feel like it or whatever I know if they had to play that wouldn't always be the answer because you don't exactly know what's going on with footballers but it does make it far too easy for them I don't like this fella I'll just sit it out and wait for the next fella and suddenly what you get as a situation I think whichever and I've already experienced by the way which is where because you have so many different managers anything this must happen in the championship as well massively you have so many different managers with so many different players that how can a manager ever go in and enforce his will on a set of players that hardly any of them are his players I think Frank Lampard what's being good with Frank is I think he's got a set of players in really quickly or who are his players and I think he did a podcast this week with Michael Calvin and he said it was dead important I got a couple of leaders in the dressing room because they lay down the law essentially for everybody else and they're Frank's men and sorry to jump in but they are very much the exception to what I'm saying before because there are those characters and when you get those good characters they're worth their weight in gold and I think in Conor Cody and in Tarkowski you have those sort of rocks in the dressing room but unfortunately there's not enough of them and there's too many people in my opinion and you were talking about Forest before for example who have signed so many players that should they go down which is a possibility I don't want them to but they could go down they could potentially face financial ruin because of the gamble financially that they have made in order to try and sustain their position in the Premier League but it's the fact that the club could be facing ruin the manager could be out on his ass yet these players have still got another three years to remain on their contract so do you know what I don't care where they would play because I still get paid but then we've got situations we've got situations where Forest have paid £40 million from Morgan Gibbs White and God knows what kind of contract they've offered them and it's like that has to stop that has to stop that has to stop there's been no thought process behind 15 of Forest to buy this summer that just hasn't and now we're coming through at the end but obviously we've got we've talked about Newcast we all agree it's a very tricky game for Everton but Saturday is Crystal Palace at home which is again another difficult game there's a big physical side Patrick Vieira has got we know what they like the famous Scottish Knight has it's become we saw them at close quarters they went soon enough Andy you'll be there like you've just said this is again that Everton have got to win isn't it regardless of what happens at St James's Park Saturday surely is again we've got to be looking to take all the points from well yeah I mean as Dave said earlier on I think we're going to lose to Newcastle as we normally do it narrowly I think by the way narrowly but you know then you're looking at it's all narrative isn't it suddenly it's what would that be three losses on the trot and then suddenly you've got a bit of a nose dive going on and Frank's the one that suddenly gets shifted under the spotlight instead of someone else so yeah I think it would be that game to get ourselves back on track I always fancy us at Goodison and maybe be looking for a bit of a reaction to you know not really kind of that second half against Spurs where it just didn't really happen for them at all but yeah it would be interesting I agree with what you're saying about Calvert learning from earlier on as well just in terms of that the camera kept cutting to him sat there before he came on and just I don't know it just didn't look like he was like he fancied it in a kind of strange way so I don't know whether he would get more game time at the weekend but it would be interesting to see how that develops I don't know about you guys but I don't really feel like I know where we're at at the moment I can't quite tell and only through getting more games under our belt we're going to see what kind of team this is it's encouraging but like I think the more we see of them the more we'll know about it and Palace is the perfect kind of game to kick on to a little spell where there's a few teams on the trot that we need to we're going to go back to my theory from earlier on about staying within touch and distance of the bigger teams but you know bravely losing and then trying to clean up on the smaller teams then this is the beginning of a little sequence of teams that we need to be collecting points so that we can happily finish mid table and not have to worry about it Dave we've got four games after Newcastle let Palace at home full them away let's at home bomb us away and someone asked us on one of the other shows we did what's an acceptable points total for when we break for the well cup haven't there on ten two points from Trouble and four or five points from Euro if that's the scale but obviously for Everton if Everton could get maybe two wins and two draws out of those twelve points and get eight to eight I was going to say minimum of five points for me is it? Yeah I was going to say minimum of five points for me over those games that you've mentioned yeah being a necessity rather than a desire yeah we've got to because otherwise you slip very quickly and your league position changes as much as it goes up quickly it also comes down very quickly as well and you know while you're sitting there in 11th or 12th and everything looks kind of respectable and rosy and then before you know it you're looking over your shoulder again as we know to our fear last season and we cannot let that happen and we've got to try and make sure that we are in charge of our own destiny in so much as not allowing ourselves to get sucked that far down like we did last season where it was really really scary ironically it was a palace game as well that was the turning point but we've got to put these games away and while I don't think that we get anything at St James's tomorrow I think it will be a good game but I don't think we get anything there I think we narrowly lose that but palace we have to win to set ourselves up for full and away which I also think we win if we beat palace. Okay Pat to finally ten four games. I think we have to get around 18 points to be on about 18 points when the break comes and we've got to there has to be a shift in terms of when we do play the palace is the Leicester's Fulham's of the Wealth there has to be a shift where you can noticeably see the difference going forward I appreciate Spears of Waze and I was going to be the great example of your how good you are attacking but I think that has to come out because if it doesn't genuinely we are in trouble I know people are sort of very happy with the situation at the moment in one way in respects of we look much better but if you can't put the ball in the net then you've got problems so Newcastle will be a difficult game I think we can get something but palace then has to realistically be three points but it just feels like every game can be a little bit of a slog and that's where I think the frustration comes from is that you look at every game and you don't think that's a given and as I said if we can get maybe up to 18 points while we go for the break then I think everything will look a little bit respectable but get back have more players fit and then we've got the January transfer window hopefully we do some business because if we don't then we've made the mess of it personally any questions you've got for next week's pod random ones put them in and we'll take them out and use them for next week as well big thanks to the lads, big thanks for watching see you later


Hey folks, how are you doing? Now I'll just give folks a couple of minutes here. We have the recording for others as well. Hey Jesse, welcome. And we just get folks to sign in. Great. Notes here. And I try to catch up with the comments on the PRs to date. So I'm going to go ahead and do a couple of things. For a film material while we're waiting. Do the five minute. Wait here. Marina, did you have a link you wanted us to look out? You just wanted to present. How'd you want to do your portion? I think I'll probably just present. It's combining a couple of different branches of tough right now. So. All right, that looks like five. So Marina, you have the fuel. Okay. It's not letting me share multiple terminal windows. Which is interesting. You might have to share your desktop. Oh, yeah, there it is desktop. Okay. Cool. All right. Can you see that? Does that look like it's. All right. So, um, so what I have here basically is, um, a basic. Kind of registered setup and basically basic client setup. Just to demo a couple of, of tough features. So first of all, um, the registry has just like a basic, um, some tough metadata setup already with just a lot of different, um, sample, um, repositories within the registry just for, for demo purposes. Most of them are pretty empty, but they're just so that we have some stuff to work with. And then there's the top level metadata of root, um, snapshot timestamp and targets. Um, which we'll get more into in a minute and then, um, we'll do a sample targets. Kind of within all those example registries to just, sorry. A few example, um, artifact files within all those example repositories just so we can show kind of how those, um, move around and stuff. Um, it's pretty bearable for the demo. And then over here on the client side, um, in order to demonstrate, um, how it would look for a, um, client that starts out as an ephemeral client. Um, the only thing that is currently over in this client is this root metadata. And this can actually be even further simplified by just having the root key or keys, um, available on the client. So that's like the only thing that this client needs to start out with in order for the system to work. And then, so with all that set up, um, I'll just host the registry here so that we can pretend it's on a different machine and it's hosting all this metadata. And then, um, over here on the client, we'll download our first file. So client, hi. Let's download those things in the way. Make some requests over there. And then over here, as you can see, there is, um, a file one got moved over into the, the targets over here. And one thing I want to show over here really fast. So it downloaded, obviously all the metadata needed to download this. And one of the new features I want to show is this, um, the, this snapshot file and what that looks like. So, um, so the, the difference here between the, this snapshot and the classic snapshot, tough snapshot that you may be familiar with is classically the tough snapshot lists every single, um, um, repository, every single, um, targets file, targets metadata file on the, um, register your repo and the version number of that so that you can't roll back to different versions because it keeps track of all these different version numbers. But there were a lot of concerns about, um, things like private, private repositories on registry and be able to see all of that information as well within the snapshot file, as well as scalability for really large registries that may have a lot of different repositories and a lot of different things listed, which can make this really big file that would have to be downloaded every time. So to solve that, what this does instead is it uses a Merkle tree to provide the same guarantees of, um, consistency across the registry of, um, data files so that you can't replay, um, both files and mix and match different files on the registry, but instead it just lists this, this amount of information statically. And so the, the length of this tree path is, um, proportional to the log of the number of repositories. So the only information that's leaked is the number of targets metadata files on the registry. It was not leaked is any information, but what's in those files. And these are all secure hashes.  Cause that all makes sense. So with how that, how that kind of works. And then, um, as I'll demonstrate, this still provides the same protection against build back attacks. Um, so if we go over here and we, um, we copy the, um, so if we copy this Wavis network JSON, uh, metadata, which is the metadata that tells you information about this actual file one, which I can show you here. Um, the same currently in both places. So this tells you, this has the actual hash of the file and all the information about it. So if, for example, someone were just to, to look at this on the, on the network and they were to save this old Wavis network metadata file. So I'm just copying it into this, this other place and then say, you know, we find a security patch for this, um, this Wavis network image. And we want to, to make sure that it gets pushed to all our new year users. So over here, we'll update the, um, registry. So, um, you know, this is just an example of file in real life. This would be an actual like ex vivo file. It should be the actual artifact information just for the demo. This is just a bunch of text, but, um, we update that file so that it changes and that hash will no longer match. Um, because it's a new file. And then we'll do here. And you too. So we'll sign the rabbit networks. Um, metadata. So this is just saying, okay, so we, we have to do this file and this is the new, um, the new one. We verify that this is correct. And then not only, this is actually doing kind of two steps in one script just for simplicity. This is having the rabbits network, um, repository sign this and verify that they, they tested this image is what they want to be sharing. And then it's also having the targets, um, metadata on the registry say that this is correct. And I'll show you in a minute how we can, how the repository can be independent of the registry as well. But for now they're, they're the same. Um, So, so that's, that's signed. And so now we have like a local copy of the signed, uh, metadata file that includes the new version of the image. So the next step is to publish that. And so you upload it to the, um, the registry and then as it's uploaded, it's signed by the snapshot and timestamp. Um, keys on the registry. So that's kind of an automated process on a push. And it just separated out here for, for the demo. And then so we have this new, new metadata file published. And we could download the new metadata, but let's say there's an attack that wants to replay that old version. So, um, so we copy this old rabbits network JSON file back into the registry as the, pretending it's the new one. And then over here. If the client tries to download that rabbit network file just before, um, it gets a bad version of our error because the version number doesn't match the version number that's listed in that kind of metadata file. So, and then I'll just go over here and we sign this to make sure that, um, the registry is back in the good state. Um, start demo and publish that as well. I type it correctly. Okay. And then, okay. So, so that's going to be of the replay attack. And so if you replay the old targets metadata, then, um, the image can't be downloaded by the client. Okay. So next I'll show you the Southern new feature that we, um, that we kind of looked at, which, um, I think it would be especially useful if you have some private registry or private repositories on the registry. Sorry, I always get that confused. So the, um, so the idea here is that if, say, you're the runner of the rabbit network, um, repository and you have your, your clients and you want them to trust the, anything signed by you, rabbit networks, but you don't really know anyone else on this registry and what they're signing. So you don't necessarily want everything on the registry to be trusted by this person.  So the way we support that is, um, you know, this idea of a target's map file. So this is, um, it's basically just on the client side. What it does is it says, okay, I trust anything signed by rabbit networks with this key. And, um, yeah, so anything that is signed by that work with this key is what I'll trust. And so it basically, it kind of overrides through in a certain extent, the top level metadata on the registry itself, because, um, in some cases you want to, you want to get all of your key information from the registry, like up here, what we were doing was we were using this key, but we were getting it from the, the registry. And so the registry's root metadata was telling us, this is the key that you should use to sign, um, to, to, you know, to verify anything from rabbit's networks, but instead we can give this directly to the client. And so the client knows themselves that this is what it's the key that I trust for anything from other networks. And then, um, they can use that to verify. And so what happens then is, so they can. So let's say they try and download something. So I have a map file and they try and download, um, something from a different thing, something that's not signed by rabbit networks. So say it's something from my repo. I have a repo slash, which is, um, something that's available over here. So they try and download that and it won't, it won't be found because of this map file that's blocking it. And actually without the map file, um, just to, to prove my, my demo is accurate. Let's see. So without the map file, um, oh, well that's weird, but without the map file it would be able to download the, the image one. This is probably a problem with my script, not with anything else because it might, my demo set up, but, um, sorry, but they are able to download something from rabbit. Rabbit. Um, networks. Slash. File one. That download is just fine because it's available in this, this target's map file. I'll look into that later. Um, there. So that's, so that's kind of how this map file works. So it, it, um, I think we can get addresses, some of that, the issues with that, um, prior repository situation. And another thing I want to just demonstrate really fast is, um, key rotation and how that works within, um, within the system. So any key within the system can be, um, rotated and kind of transparently to the client. So the client doesn't have to worry too much about, um, managing keys or what's trusted, what's not trusted. As long as a threshold of root keys are not compromised, any key rotation can be done transparently to the client. So for example, um, there's it. So. Let's say that. Okay. So we want to rotate this, that who's trusted to sign. Oh, sorry. I love networks. Um, I was going to do a top level metadata just to demonstrate. Um, how this works. So we run. So rotate. Time stamp. So it goes in there. Stories. So we're wondering here is I'm basically, I'm switching out what is, um, signing the timestamp key to be from the timestamp key in case there were multiple keys that has to specify which key is no trusted and then which key is going to be trusted in its place. So we're, I'm just going to use the snapshot key just to, um, to show. So you can see that they match and that it's being used. So. So rotate here. Let's use there. Oh, that's weird. Oh. And we chewed up high. And that will. I'm doing here is I'm, um, resigning the group metadata using this new key and the root metadata has two different. Signatures. So both of those signatures are now used to say, okay, so instead of just trusting this previous times timestamp key, we'll trust this new key to sign the timestamp. And then what I do really fast is, um, I did the script to use the, the new key of the rotation because timestamp is an automated, um, test. So you have to tell the script which key to use to do that automated process. So I just have to do that really quickly. And then, um, and then see we publish this new metadata. And so then, so that's all we've done here. And then over here, let's say we try and download a new file. I'm just trying, you know, the same file. And it works just fine. And the client doesn't know any different. But if you look at the, um, you'll see is that it's actually using this new key. So this timestamp keys now matches the snapshot key because it's using the same key for both of these. And this is just done transparently to the client. And so in real life, you probably wouldn't switch it to the same key, switch it to something new that, um, is more secure or, you know, uh, fresher or whatever. And this process can be used, um, to do that. And then finally, the last thing I want to show is, um, moving an image from one repository on the registry to another repository on the registry. Um, and this, this will be very similar to a new registry all together. I just, um, didn't set up a second demo registry, but I can do that in the future if there's, if there is interest. So, um, what I'll do here is I will move a target from, um, let's see, from repository zero, which is my very creative image example repository over into this web of networks one. So, um, currently there's the file one.txt in rabbit networks. And now we're moving also this file zero, um, file into there. And then all we have to do next is, so the web of networks needs to attest that they actually trust this file zero and want to, want to sign it. So all they do to do that is just say they add the target. They add, um, this target and they're going to sign it with this key. That's what happens when I type this password around. It should be a prettier error message. But yes, that's, this is what, yeah. So that would be, it doesn't use the key. Um, so yeah. So what I did here is I added the file to the rabbit networks metadata. And then I published this, um, this new metadata. It should be available. Over here. Where does it called file zero? Oh, that's because the map file doesn't include that. But it should actually work with them. That's weird. But anyway, it does. It is able to find it. Um, in the, in the, in the web of networks. Um, and so, um, yeah, those are the big features I wanted to demo. I have a couple of other things. If anyone is, has more questions or wants to. Show me elsewhere or take a break now to see if, see, you know, yeah. Any questions or anything. But I think that doesn't make sense. You want to look at or anything. Just let me know. So Milo has a question that he posted in the chat. Sorry. I don't have that. I don't know if you would find, sometimes it gets hard to find the chat. Session when you're presenting. Yeah. Really just read it off. Sure. Yeah. Just for that. Yes. Do I understand correctly that the rollback protection is achieved by splitting the snapshot data into a binary tree. If so, doesn't that still require serializing all repo. Updates over the full scope of the registry to update the root of the tree. Yeah. So it's, um, it is, uh, it's a miracle tree, which is basically a specialized binary tree. So yeah, it is, um, using them all, but the, um, so yeah, it does require some civilization. And I think the idea is that it doesn't have to be updated every single time any image is updated. Um, it can be updated once a day or so and still provide a day's worth of rollback protection. Um, for example. Um, and that way you can do quick updates to things without having to regenerate that tree every single time. And then it would just categorize updates and update the, the snapshot data. And then it would just categorize updates and update the, the snapshot and timestamp information on that cycle, kind of whatever time period makes the most sense. And I think that you all would probably know what time period better than I would. Um, something on the order of a day every day or so, I think would, would make some sense. Um, I shouldn't be too computationally expensive. I think even every hour should work. So, um, it would be done on that, on that cycle. And then in between that, um, images, could you think, you know, clients could either, um, use some other sort of protection in the meantime, like they could just use, you could skip that check. They could, um, have a smaller snapshot file that just includes that piece that's used in the meantime. I think there's a little bit of room for growth there, but definitely it can be, it does have to be regenerated, but it can be, um, it's called group messages. Yeah. I mean, it's always a three phrase, always a threshold. It's always a window threshold of vulnerability. And you just, we can never eliminate it's always minimizing. Yeah. So saying that should, like, however small it can be, while still kind of making it work. I mean, as I think the question that we keep on circling around is not the what or how, you know, because I know the Merkel tree is one way to do some more optimization, you know, you know, around lots of registries and sorry, lots of repos in the same registry and different registry operators categorizing somewhat differently. So there's, there's lots of questions around, you know, how do we do that in a perf and reliable and scalable way? Yeah. I think the question that we keep on struggling with is why do I need to do snapshots across multiple repos in the same registry when they're not owned by the same entity? Yeah. So I think the big thing is that it just improves your security because if basically, if you are downloading something from any of these different, um, repositories on the registry and then you download something from any of the other ones, you get the same kind of rollback protection. Um, and actually one of the benefits of these, this regal tree solution is even an ephemeral client can get this rollback protection because they can check the, um, the hash of the snapshot, even if they don't have an existing one on disk, um, which is pretty powerful. And so, um, Yeah. So I think, yeah, I think the big thing is to, um, to provide that. Reproduction. Sorry, I lost track of. Um, anything else I was going to say. Anyway, the thing is, you know, there's because it's not just one really big registry, right? I mean, it's not just Docker hub. There's quay. There is, you know, GCR. There's everybody's private registry. You know, there is, um, Multitudes of registered that anyone team works with. At the same token, they're not working with all of them. They're working with subsets of them. And it's not clear what benefit I get, especially if I have a frimble clients where I have to get this stuff anyway, there's no benefit to having stuff pre-cached. Like if I have a long standing client, try to put the right context to it. And over time I might read, you know, a dozen different artifacts from one registry. Sure. I don't have to get 12 of them individually. I don't have to get 12 of them individually. I don't have to get 12 of them individually. I don't have to get one in my cover all 12 scenarios. But in, and, but even 12 is still not 200,000 or whatever the number of repos are in something like with Docker hub or some of the other. The. So it's not clear. There's a benefit even for the long standing. And if we get to the frimble clients where they're pulling. One or two, maybe three. Artifacts from. Yeah. I mean, we're struggling with why should we try to figure out a perf scale security solution to something that wouldn't kind of struggle with this? Is it a problem? Yeah. And I think that that's definitely something we should continue to talk about. I think that the issue that, that, you know, that we see and that we worry about is this issue of, of replaying metadata. And if, if, if you, even if you have an ephemeral client or whatever, if someone is able to take that.  Another, if I'm okay, it comes up, they replay that. You know, then you have an image that's six months behind, which in the security standpoint can be really bad because there can be any number of security patches. Over that period of time. So I think you need to kind of something to ensure that. The timeliness of, of the images. I think you need to do it across the registry instead of repository by repository because it just gives you a bigger, a bigger scale. And so it gives you more protection because it, I think that's the question. And you only have to do it. You just have it, this one, one metadata file once in there. They're in the top of our repository and it takes care of. Yeah.  Like, I, we get it. And if we want to do that, we just, we just, we just need to keep that in mind. So, that would be something we want to be able to add. The question is, is the scope and whether it's one month or two months or three months, you know, the longer the months, the more risk it has because there's vulnerabilities every day. So we totally get that. It's the. The concept that it's easier for one across all isn't necessarily true because it's, it's trying to maintain those at a scale. Of the number of updates that get pushed. while we technically have access to everything that's in the registry. We have, of course, a test that we're not accessing things that we shouldn't be doing. So while I appreciate that you're making sure there's no, everything's anonymized and so forth. We promise our customers that we won't do anything around data across customers. In fact, we even have new rules that are forming where they don't want their data to be used in anonymized portions, there's some higher level security up at the registry. So again, it's not that it's, you know, it's code, right? We can write anything we want. The question is should we, and I'm, I don't, I struggle on if I know why I need to have something across all repos, as opposed to here's a repos I care about, as long as each of them are doing their snapshot than a daily, which they, of course, update individually much less frequently than the entire registry. Because there ain't one time the entire registry is getting lots of updates. If we can break them down to smaller units, it's a much more scalable problem, which doesn't impose any of the security data access concerns and performance concerns. Yeah, I think that the downside there would be for those ephemeral clients, because if they only download once from a repository, say, then the only protection they get is, they basically don't get that protection of that rollback protection, unless they do something to check that, to check against an external source. And the thing that this mercury provides basically is like kind of an external check. So if the mercury hashes match up, then you know that the, that, yeah, that is a valid metadata file, that a valid version of a metadata file. But the whole concept of an ephemeral client is it has nothing to start with. So, and it knows, it knows what it's being asked to pull. So as long as we have a way to say of the two things that I'm going to pull, can I go get the timestamp information for those two things? Then, if I understand it right, I should still be able to get that same threshold of time across those two things. But yes, I've got to get two, but okay, I know I'm getting two. It's not I'm getting 2,000, right, different problems we're trying to solve. Okay, yeah, I think that definitely something we should talk more about. The, yeah, I'm trying to figure out how to, how to. I think you're trying to secure that, hey, at any one time this ephemeral client could ask for anything from the registry and let's give them some good protection that they can just, so it doesn't matter which one they pull from is, as long as these timestamps match, you're good. But that assumes that a registry can have access to all that information, which we're saying we can't, like, we literally can't do that. It's not from a technical, from a security liability commitment to our customers. We are saying we cannot do that. So that's problem one, performance and reliability issues are irrelevant. There's no information about any other repository on the registry within the file. To store any kind of information that goes across multiple repos where multiple customers is the barrier that we can't cross. Okay, even if it's a secure hash that's basically around. Nothing, I'm one of these larger calls when the actual customers get on. I've been known to say a Coke and Pepsi because those are obviously competitors and come out, so I might as well just be public when I say it. And for those that are actually working at Coke and Pepsi, I'm trying to make sure you're staying secure. So please don't get upset that I'm using you guys as examples. We can never do anything that their data has any knowledge or intermixing or anything of their others in any anonymizer anyway. So even if we wanted to, we have a challenge that we shouldn't be doing. But the problem that I keep on coming back to is I'm still struggling on why we need to do that across multiple clients. Because it's not even that there's a single registry. The customers work with multiple registries over time. So it's not like, hey, if we can just get this one massive Docker hub, and it's the only one that's really out there, great. There's Docker hubs, there's PIPIs, there's NPMs, all of those. But we're seeing more and more that the public registries, one, people want private copies of them. There's multiple public ones that somebody has to deal with. So there's, in addition to everything else, at best, what you're offering is a single registry you can do all repos. And that's not really the bigger problem, much less, do we? I guess another thing that you could do is, I'd have to think more about this. It's basically you have the root and maybe top level whatever metadata for the registry just basically that just simplifies I think the key management a lot to have kind of one top level thing that then is downloaded and used, except for obviously in the case of this map file, right? Or anything where the client already knows the key's in trust. But then you could also just, you could do just the snapshot per repository. You're suggesting there's, again, there goes the details I don't completely understand. Are you saying there's one snapshot key for the entire registry? Yeah. I mean, that's another thing that customers want their own keys and their own management of that lifecycle of their information. Yeah, because the snapshot is mostly, it's like a, it's more of a, like a server management password, whereas all of the target's keys, which are used to sign the actual information about the files are independent. And they're, they would be very specific to that one repository. If I was trying to take something like Docker Hub, and I want to say all the Docker Hub content that they, it's official content that Docker is certified in regardless of where they got it from. And Docker wanted to put its certified key on it. Okay, that's for the Docker certified content. But for all the other content that's not certified by Docker, for instance, this Rabbit Networks one that we refer to is, it's built by externally. It's sent to Docker Hub. In fact, at first, it's not actually certified by Docker Hub because we're trying to show them examples of things. So I wouldn't expect, I mean, I guess you could say there's time data on that, but as a customer, even in a public registry, I'm not sure that makes a ton of sense. No, exactly. It makes sense in a private registry. And so like a bit, but the timestamp actually doesn't have much to do with like, like Rabbit Networks themselves, they just say, we sign this one thing and we put it on this, on this repository or this registry. And then the registry says, okay, we trust you to trust this thing. And so we'll, we'll assign this to you and we'll say, this is when we uploaded it, this is like when we received it. And then anyone else who's downloading it can check that the time they're downloading it is within a range of the time that it was trusted and the time that it was uploaded. And if there's a newer one, then they're not trusting the older one. They're trusting the currently uploaded thing from Rabbit Networks. It's not. Yeah, I get it. I just, I'm not, I'm not seeing that as the priority scenario with all the complications that we keep on discussing. I don't know if it's as much of a problem for that one registry where I get something as opposed to, I'm actually taking it from Docker Hub and putting it in the Acme Rockets Registry. So it's more important that the Acme Rockets Registry is kept up to sync with stuff that's happening in Rabbit Networks. And how do I, sorry, in Docker Hub, actually. Yeah, exactly, and I think that's something that the Acme Rockets just needs to be in charge of doing because that's kind of their, they can make it automated, they can do whatever. But if they're trusting it, then they need to continually attest that they trust it. And that is something that they sign and they want people to be using. Mila, did I see you pop it in there? Yeah, I think the long-term theme is that there is a non-zero security improvement to go in the full registry. But it's very hard to articulate in a way that you could rely on it. But another point is if the. I must admit that I've forgotten the details of the snapshot scheme, but if the overall idea is that the snapshot is signed and updated about once a day and we get protection on the granularity of days and not for protection of rollbacks being that day. Well, we don't really need a cryptographic structure for that. We just need to sign a timestamp every day with the current state. And that scales trivially because we can just do it for every single repo. And we don't actually need even the timestamp key. We just cannot rely on TLS as long as it's not governed by some CDN, which I'm afraid it probably is. That's it. Yeah, if we are going with the daily granularity, I don't think we need the Markildry at all. We got to the same registry feature anyway. Yeah, I agree. And actually, that's like the traditional tough method is to just list all of the kind of current state information, which is basically version numbers and in the time in the snapshot. The reason for this structure was just to keep the separation between the repositories on the registry while still being able to provide coverage of the entire registry. So yeah, if it is separated down, then that's no longer. I think it's just extra work. Now, what I'm saying is in the very traditional system, the snapshots were managed by the individual authors. And they were sequential. And the snapshot key was managed by the authors. So of course, they had to be consistent. But if we are having the registry sign the snapshot versions every day, we can just sign the snapshot version along with the timestamp. And that gives us the same rollback protection, doesn't it? Assuming all the clients have synchronized blocks, which is. I think it provides the rollback protection kind of the same way. The main reason for this additional structure, again, was for two big reasons. It's for the scalability for if you have a lot of different repositories on the registry with a lot of different images, you want to make sure that this, because even just listing the version information can make a really long file. And so this just shortens it. And it also allows for a separation between the repositories, because you only have to download for your particular repository. You don't have to look at every single one. I guess I'll go back to the Mercury paper, but for right now, I'm thinking I could just split the timestamps per repository and just not have a registry-wide structure at all. And wouldn't that work just as well? That would be going back to the Node-Ruby one model. And I think that the main, I think, concern with that model was kind of the trust on first use issue, where every single repository has its own base structure. You have to figure out trust for every single repository individually. No, I mean, that would still be, well, or that could be a registry-wide root key, a registry-wide timestamp key. But the timestamp key would be used to sign every repository separately. Oh, that's an interesting idea. Yeah, I'd have to look into that and think about it and stuff. But I think that might work. That's interesting. So you're basically given the isolation, so no one repo needs to go about others. Well, the timestamp private key would somehow still have to be used for all the repositories would not allow you to serve parts of the registry absolutely separately. But then you already have a HTTP router at the front of the hostname. So there is something that is shared. Anybody, I guess? Yeah, because if you're hosted in the same place, they do share some information anyway, so they could share just the keys, but then have individual. Yeah, but more importantly, it would be one direction. It would get the private key to the customer separate container, but nothing from the customer separate container outside. Coke's data has anything to do with what Pepsi's data is. There's some other data that happens to be used across both of them, but they individually have their own security content. And that also keeps the isolation that, in addition to the security boundary we keep talking about, but from a performance, I don't have to worry about any unimixing of different customers updating on different intervals that I have to figure out how to correlate across all registries, across all regions, across all air gap clouds. It's literally each repo has its own isolation boundary that I can, as a service side, manage those updates individually. And that's the only way we can get a healthy scaling across multiple regions, multiple availability zones, multiple clouds, and so forth. OK. OK, yeah. Yeah, I'll definitely think about that more, see if there's anything I come up with. But I think from first glance, it seems to make sense as a way to break that up. Cool. Well, I appreciate you guys keep on iterating on different parts of it. So that's definitely helpful. Do you have anything else? So just for the sake of time, we've got 15 minutes left approximately. I just wanted to leave time. I didn't have a new updated agenda. We have a couple of things that are in flight, but nothing that specifically ready to iterate through. I figured just give a chance for folks to catch up with what we've gotten done already. And if there's any questions, the recording is good for people listening, but it doesn't work for asking new questions. So I don't know if anybody else has been tracking what's going on and has questions that we should address. That's cool, too. In one of the things we always try to make sure is we're addressing everybody's style of communication as well. So we have the Slack channel that we've been tracking for the Notary Vee to work. Of course, questions here and any comments on the PRs. So just do it. We'll address it in every channel that we can. On the tough stuff, but back to some stuff that Mariana was Marina is presenting. We have been trying to make progress on some of the tough work as well. So several weeks ago, we realized that there's a lot of complications here we're trying to work through, such as these conversations here today. And we wanted to split this out from a phase one and phase two, because there's larger end in workflow pieces, which the tough metadata will be a part of. But we wanted to make sure we covered other unknowns that we don't necessarily know. And if you remember, we were doing the Sagrada familiar kind of model where we don't really know the whole piece. So until we get sketching it, we won't really be able to communicate and everybody can look at it like, oh, I hadn't thought about that. For anybody that watched the KubeCon talk, we talked about a sketch of a bathroom. And so I had done the sketch of a bathroom. And probably before we went and built it, I showed the sketch, the model, to Justin. And Justin's like, where's the bidet? He's like, I didn't think about that. We don't think about those in the US, not until COVID. We're running out of toilet paper. So we wanted to be able to get that whole model end to end, because we know there's some stuff around the tough metadata we have to think about. We don't know about the other pieces. So the latest we've been getting there is we have the signature object that we've been kind of working with. We have updated it with the JWT token, format or civilization. The next pieces that we're working on is how do we get that information in and out of our registry?  What do we leverage that's already there? And how do we make additions? And there was some questions specifically today on Ram was asking some questions in the PR around the impact we have to make to a registry. So and this one actually is coupled between the notary working group that is focused on a signing solution that can work within and across registries. But we also need to make changes to a registry so that also involves the OCI working group as well. So we've been kind of having one foot in each sandbox there to make sure that the scenarios we're trying to cover for notary are covered by the distribution APIs because unless this works across all registries, we didn't really meet the goal. So we feel pretty good. We had a good call last week around that where we got a support to go down the index path, which means that registries that already implement index and have to do that tracking between two things, in this case, the signature and the artifact that it's signing, that hard part of doing reference counting and garbage collection will tie into that infrastructure already building. And then the idea that index will be able to declare it is not just a multi arc container image, but it is a signature object. It is a CNAB. It is another thing that we don't know of yet. That's something we've been wanting to do for the OCI effects for a while. So the fact that we can leverage that for signatures means that it's not just a hack for one thing. It's actually a core platform enabler. So that's the path we're currently working down. And for those that might be watching, if you look at the Notary Project under GitHub, you're starting to see some other repos get added there because we need to make changes to the NV2 client that we've been discussing. We need to make changes to which is just our prototype. But then we need to make the end in work. We need the distribution spec. We thought we needed the image spec to update the manifest and index schemas, but we're going to move that into the artifacts repo. So you see the artifacts repo being added there. And then ORAs also, oh, and Docker distribution, which we already had. So the idea is we want to be able to prototype the end in experience out under the Notary Project, make sure we're comfortable with all the moving parts so we don't get all these different groups randomized. And as we're comfortable with that end-to-end changes that we would need, then we can make the appropriate, well, one will make the spec, but then we could also make the appropriate PRs back to the, as a group, because we'll know what the end-to-end is and we'll know what the final PRs would look like back to those upstream repos. The stuff we're thinking about with this phase two of the tough prototype, we believe that at least from a registry perspective, we've captured like, I don't know if it's 80 or 90. So there'll be some more additional work we have to think about, but we believe from what we know today, it will accrue up. So we're feeling pretty good about that so far. Anyway, so that's the idea. We want to be able to continue to iterate, do that model, see if we like it. Everybody's perspective can look at it and understand from their perspective what this thing looks like. And if we're comfortable and as we find new things, we'll keep on iterating. And when we get to a stable state across all of those affected repos, we'll get the spec put together and do the upstream changes. So that's the progress we're at today. The prototype that you mentioned in the cube column, is that the one named under the repository, prototype one or something like that? Yeah, that's a great question. So last week, I think it was last week, we were trying to figure out where do we commit this because we were doing PRs on top of the PRs and on top of PRs and different people's repos and it was getting crazy to figure out what exactly we would look at. We were gonna merge it into the master of NV2 or main, to be fair, we've also changed since the main app. But then we were debating, well, isn't the root of NV2 gonna be a reference implementation? We don't want to stick the prototype there because we know the prototype will change or we don't necessarily want to just evolve but we'll probably toss it, bring the irrelevant things over. So rather than create yet another repo for different prototypes, what we're gonna do is maintain branches in the NV2 repo and keep the root available for the eventual reference implementation. So right now you see prototype one because we were being very creative with the main and we just decided to get something done. And if we need to go down a different prototype, we can do that. And then wherever we wind up landing, you'll see in the root of NV2. So I did push an update to NV2 read me, the main read me just to explain what we're doing. So those outside of our group that they just come in and look, they should be able to find a path. And that's the progress we've got so far. Stuff you've been seeing is in the prototype one branch. Sound good? And just for those tracking, we also saw AWS added artifact support in ECR, which is awesome because that is the base of a lot of this that, and they've been working on it for a while. This isn't like a magic thing. It's something I know that's been working for a while and Omar Paul and Jesse and Sam and others were have been working on for a while. So that's a huge kudos to them. And just really that you're starting to see these things kind of roll out to be able to support these end end scenarios. Without boiling the ocean, we've also been trying to generalize, is there some general metadata APIs that we either need for this or would make this a little helpful? Or if we had a metadata API on all registries, how would that impact a signing solution? Because at least the definition of metadata in my head is it's not something you would necessarily sign. If you want something like that, you can put it on the manifest itself, but it's just like you can add signatures, we would add additional metadata. And the only reason I'm even bringing it up here is it's playing into some of the distribution API conversations we're trying to have is figuring out, like how do we not keep on throwing stuff on here? And by the time we're done, we just have this mad max vehicle of things bolted on and it does rationalize and make sense. Anything else? Well, we'll watch on Slack for the Notary V2 conversations and PRs and I'm hopeful we'll have some more, I'm hopeful we'll have some more progress on the distribution stuff by next week. There's progress being made, but we've got just some churn happening that we have to kind of work through so we don't randomize too many people on the conversations we're having. So that's about where we're at and thank you all for joining.


Hello, welcome to SSUnitech, so shall decide and today we are going to start a new playlist on the PySpark. So before going to watch the PySpark videos, if you haven't watched the Databricks video series then I would strongly recommend to watch the videos of the Databricks. So how you can find out? You should go on YouTube and you can search for SSUnitech. And after that you can go on this channel then you can go on the playlist and inside the playlist you can find out Azure Databricks Tutorial. So you should watch these 15 videos before going to watch the PySpark Tutorial playlist because we are going to use the PySpark inside the Databricks only. Now let's get started. So what is PySpark? So PySpark was introduced in 2009 and later on after one year in 2010 it was published as an open source in the market. And it is an interface for the Apache Spark in Python. The Python library and we are going to utilize those inside the Apache Spark clusters. So Apache Spark clusters are capable to process your data and that data could be your structure data, non-structure data or the live data. So all these this PySpark Apache cluster is enough to process everything. It is not only allow you to write Spark applications using the Python APIs. So what it mean? We are going to use the Python libraries and by using the Python libraries we could be creating the data frames and writing those data frames into the files. So PySpark is not only for that but it is also provide the feature for the PySpark cell for interactively analyzing your data into the distributed environment. So it mean you can also play with the data inside the Databricks notebooks by using the PySpark. So we will be writing the Python course here. So what is the prerequisite for understanding about the PySpark? You should be having the basic understanding about the Python language. If you haven't idea about the Python then don't worry I will be going to teach you about the few Python codes and those will be enough to work inside the PySpark. Next is the what is the benefit feature of PySpark? So why we should go and try to use the PySpark? The first feature that is the memory computation. So what it mean? So PySpark is going to process the data into the memory. So it means your data will be processed into the RAM. Then you can imagine like if we are getting some request and that is processing in the RAM then that will be very faster in the process. But one question should be coming in your mind if we want to process 8 GB of data but your RAM is only for 4 GB then what will be happening on that scenario? On that scenario 4 GB will be processed into the RAM and rest 4 GB will be processed into the disk. So this is for the memory computation. Next is the design to cover the wide range of workflows. So PySpark is designed to process your data and that processing could be in the batch file or the ML then interactive queries then live streaming. So these wide range of the workloads can be handled very easily inside the PySpark. And there is no any additional tool required for processing all these. Next it's very easy to integrate with the other big data tool. So here in this playlist I am going to teach you how you can use the PySpark inside the Azure. But you can also use the PySpark inside the AWS and the GPS for the Google platform. So it's very easy to integrate with the other tools easy and inexpensive. So what it means? It's very easy to use and it's not very expensive. Why it's not? Because once your request will be raised after that your cluster will be start up and running. And once your request will be completed after some time your cluster will be stopped. So it will be charging only when you are processing the data. And after that it will not charge anything. So that's why it's inexpensive as compared to the other tools. That could be your Hadoop or the other system. Next is the data processing. So here we can process the data into the batch applications SQL, ML and graph processing. So all these type of data we can process it here. So as I told you we can process the unstructured data, structured data, live data, graph processing, batch processing, everything we can process by using the PySpark. So these are the major benefits by which we should be going to use the PySpark. This is the architecture of the PySpark. So how PySpark is working. So for example we are receiving some of the request. So once we will receive the request that will come under the driver program. And driver program will be going to create the different tasks. And then the cluster manager will be going to connect with the worker node and start the executors. So cluster manager will be taking care for starting the executors and assigning those tasks which we have received from the driver program to the worker node. Once we will get the request from the cluster manager then that request will be processed into the different tasks. Once that is done then it will directly back to the driver program. So that's why you can imagine like everything will be going to happen on the worker node like the your processing everything will be happening here. And we can also do the parallel processing while we are processing the data. So this is the basic understanding about the PySpark. By the next videos we will be practically showing how we can use the PySpark inside the Azure Databricks. So thank you so much for watching this video. See you in the next video.


Welcome to SuperUserTV. I'm with Mike Apostle, the software engineering director at the OpenStack Innovation Center at Intel. You've been in software for over 15 years and an engineering manager for over six of those years. What are some of the hiring trends you've seen come and go? Well, I think back to what I was looking for and I think it follows the trends pretty well. Very much specialists. I was looking for people with a very specific skill, specific language, specific domain, compute, storage, apps, client, and I found that to be very successful and I think that will continue to be successful. But now I think what I'm really looking for is generals. Somebody who can come in and be a specialist and be very low, but have that ability, that kind of emotional intelligence to move on and be able to do other technologies. In my 18 years at Intel, we move from product to product and technology to technology. The change is fast. I need engineers who will do that as well. For the positions that touch OpenStack, what are some of the changes you've seen in requirements for those roles and the candidates who end up filling those positions? Well, I can speak for the last year. That's about how long I've been in OpenStack. But what I've seen and what I've hired is a significant amount of recent college graduates and they come out and they're awesome at writing software. They don't have a lot of experience. They need some cloud knowledge and they're picking up Python and they're picking up Linux and they're picking up those things well. But what they're lacking is a lot of the operational knowledge. How do I use OpenStack?  What are the pay points? And so I really want them to know that in order to build something better. And for some of those students, there's new certifications on the market in the past few years including now the Certified OpenStack Administrator exam. So for you, what's the place of certifications and what are some of the trends you've seen in those certifications? Well, I would say what certifications the COA is excellent by the way. I love being able to measure and as a hiring manager the ability to see a certification on somebody's resume tells me something. Somebody went out of their way, they spent a little money, they got the certification, they got the training and they proved that they could pass the test. For me what I would like to see, usually those trends come with beginner, intermediate, advanced. I'd like to see next levels so I could say, oh they passed that one, oh they passed that one, oh wow this guy passed this one, right? So I'd really like to see the different levels. For me, upstream contributions, that's what I'm all about and I want my developers to have similar certifications. In fact, in the OpenStack Innovation Center we are piloting something today that works with bringing these new recent college graduates to experts in upstream contributions and it's been hard, it's been hard to figure out what to teach them. So we're going through different levels and we'll be sharing that with the community over time when it makes sense, we're not quite ready but we're getting a lot of input from multiple companies. It'll be interesting but I would say we'd really like to see the trend of certifications and advanced certifications increase. And if I'm looking to land my first OpenStack job ever maybe I have some certifications under my belt or new grad, or maybe I've been in the ecosystem for five years I just have decided it's time for me to start working at OpenStack. What can I do to be a more attractive applicant? I think this is pretty simple. You're talking to somebody who hired a lot of OpenStack engineers over the last year and what made people stand out was if they could send me a Stack Analytics link. So if you are actually making contributions in OpenStack and you send me the bugs you fixed, the specs you implemented, the blueprints you did, the actual code that you implemented to me that says everything. You need to know Linux, you need to know Python, you need to know those cloud technologies. But if you can show me that you actually took the next step and got into OpenStack and did it on your own that tells me a lot, that makes you very interested. And so what are your predictions for OpenStack hiring trends the next 18 months going forward? I think there's going to be a lot of jobs.  That means there's more OpenStack. More OpenStack means more jobs, operators, upstream developers. And for me, I think we're going to see more experience too. This is my hope. In the Innovation Center, we worked with the University of Texas in San Antonio and we actually infused an internship program where we took some of their brightest software engineers and we took them through some OpenStack trade over a six-month period. And now we're starting to hire some of those and they're coming in and they're moving fast and they're contributing very quickly. I'd like to see others do that. But I think there's going to be a lot more jobs and hopefully a lot more talent. Well, that's a really exciting prediction. Thank you so much for being here. Thank you for being on SuperUserTV and we look forward to the next news coming out of the Innovation Center. Awesome. Thanks.