Hi everyone, Joe for Jaspy's casebreaks.com, with Nick Jaspy right over here who's gonna help us pack, stack this break, brand new release, 2022 Tops Archives, 10 bucks, pick your team two, all card ship, brand new release, just dropped yesterday. And we got the next one that's down to five teams. Big thanks everybody here for making it happen, appreciate it. So if you have a little rooftop next to you, and that means you won that spot in that team red and filler. David, you got last spot mojo before he pulled those teams. The Met, 70% of the time, last spot mojo hits 100% of the time. Getting a little festive here, it is the festive season. Entering the festive season. Halloween, Thanksgiving, Christmas. Oh yeah, I just replaced that blade earlier this week. Like these little postcards here, look at this, they're pretty neat. So we're looking for two on-card autographs per box. Now there are some variations or short prints and stuff like that. We'll try to identify those over the course of the break as quickly as we can, but if not, don't freak out because all card ship, keep calm and break on. The next one sold out already? Nice. Maybe, should we fast track that, take advantage of Nick's help? I think we might. I know we have that collegiate football sold out, but this is a slightly longer break with some help. Maybe, maybe able to get a gun. It's a trap! No, that's a third one. Not this is the first one. This is the one where it goes three meters and then Luke Skywalker goes, what, three meters? That's no big deal. I used to blast wamp rats in my T16 back home. They're no bigger than three meters, like a serial killer.  A new hope is on TNT, if you want to watch with us. Don't forget tonight's promo. Ladies and gentlemen, while we're ripping these packs open, don't forget tonight's promo, buy a spot, get an entry. And you might win, you might win a box, a sealed box of something. Check out the details on jackeyscasebreaks.com. Some breaks count as triple entries. That's also on the promo page. Here we go. Good luck everybody. There's our first auto, Jorge Pesada, hip hip hooray. That goes to Mark and the Yankees, picked up the Bronx Bombers straight up, 58 out of 99. It's Cody Bellinger to 199. It's for Ryan and the Dodgers. Touchdown Dante Pettis, lock it in. First touchdown Dante Pettis. You heard it here first, folks. What is that, plus 1,000? 30 to 100. Wow, even better. I have, what about JD McKissick, any time touchdown, that's plus 500. There is Travis Ishikawa. For the Higantes, and that will be for Mark and the Giants. Got the Giants in the filler, the team random. So those are our two autographs. Let's look for Wanderers, let's look for Julio's, maybe low number parallels of those guys. That would be pretty cool. The red foil, it's Derek Jeter, 5 out of 50. That'll be another one for Mark S and the Bronx Bombers, Mr. November, the captain. What else do they call him? DJ2, or whatever his number is. Is it number 2? Well, they did the respect, and instead of the S, they do a 2. Word. So it's like retuspect. Retuspect? Retuspect. Bobby Wood Juniors as well, Royals, Chris Walker, in Kansas City. Yasiel Cuig, still playing. Yasiel Cuig, I don't know what he's doing these days. Just go down to T1. See some Mexican League baseball, do some scouting? Yeah. That's where they found Julio Urias and Yasiel Cuig, they were on that same trip. Got a Greek deflected from Cuba. He did, and he kind of was in Mexico for a while, trying to make his way into the United States. Some of these first cards have soft corners. Yeah, they do. Packing problems. First world packing problems. Some of these can be autographed, these little postcard cards, not the full size ones. Yeah, it's not hanging in a trout redemption. Ooh, nice. Jim Rice, Jonathan Kent with the red socks. I made him in a cartel. 7 out of 99. Yeah, Jim Rice? Yeah, it's here too. New York. Is he nice? Yeah, he's out in the baseball. Shout out to Jim Rice. Oh, there's Julio Rodriguez, and there's a Tim Hudson autograph. Long time A's and Braves guy, look at the back of the card. I think he played for the Braves longer than the A's. Yeah, that's even, like that's not an all Braves card, so like, there's probably more. Yeah. That goes to Chris Walker and the ATL, and here's Julio Rodriguez. All of these will go to Chase who got the Mariners straight up. Let's see if we can find some ink for him. Let's see if we can find some low numbered parallels. There's Tyler Glass now to 125. There's a Bobby with Junior. That might be slightly shorter printed than the normal one that we see. Chris Walker with Kansas City. And Mark got randomized, the Tampa Bay Rays. There was a Lamont Wade card that was really miscut. Just like the old days. They're striving for authenticity. All right, so here's the second half. So both autos popped already. Here's the second half of that box. Each half stack will be a box. There is Tariq Scoobl, 158 out of 199 for Ryan and the Tigers. Tiger uppercut. Stella Cruz, 29 out of 99 for the fish. It'll be for Chris and the Marlins. They're just like executed. Order 66. What if I just did that? Wow. Then you would just activate an entire clone army just right now to kill all the Jedi. So that's on you. In the shop. That's on you bro. All these come to life. Oh man, all those come to life? Yeah. But like in that size. I think they come to life at night. It's like night at the museum. Yeah. At some point in China, it was time for me to say you like to hear an interview with Rick Rubin. He was on Joe Rogan. The record producer? I don't really care for Joe Rogan's take on music. I want Rick Rubin talking music with other musicians. Talking shop.  Tommy John goes to Mark, by the way. Isn't that how Joe Rogan did it? So like, Rick, how much weed do you smoke? 6 out of 15 JP Crawford. Nice low number there for Seattle. Went down 0-2 in the series. Yeah, Joe Rogan is the guy who watched when he was interviewing an alien. Right, yes, yes. That's what I want. That's why, exactly. So like, what's the government really doing out there? An area of 50, what's in the desert? You know, like, that's what I want here. And we got a Andy Chavez. Remember him? Metz. That's going to go to David. Last Bot Mojo strikes again. 70% of the time Last Bot Mojo hits 100% of the time. 39 out of 150. Yeah. Did they ever... They brought him back. They brought him back? Those are pretty sharp. No, maybe it's bad luck now. Where do you think Jacob Grongo's? Atlanta. Really? He's a good, good angels move. No? He's going to break down in like a... He gets hurt every year. That's true.  I'd rather have a... Should have gone like Luis Castillo. Or player.  Dick Hall. Dick Hall, that is. Is that a third auto out of this box?   Dick Hall. For the Orioles.  That's a... A lot of BDE there. In this box. You don't see a lot of Dick's pole. No. Dick Buccus. Pulls some Dick Buccuses and... Football products. Yeah. Or there's that one player called Rusty. Right, right. I remember that guy. Coons, I think Coons, Coons. I think it's Coons. All right, bonus auto. I'll take it. All right, another box. Another box. Just make an archives autograph only. I get it already, dude. Secondary series? But like... Another box. Not the... Not the way they do it now. Maybe a little more high end. Hmm. I kind of would actually like that. Because I like the fan favorite products. I like the old school names, the old school designs, but let's put it in a sort of higher end set. Yeah. Next up. Plus the archives signature series are five back cards, which I don't remember. True. Alec Blum Red to 75. Little color match there, Shangola with the Phillies. Almost there. Stay on target. Dick Clark has a card.  Dick Tracy. What's that? Tracy, Tracy, Tracy. Remember that? I can't wait. I don't know that one. You don't know that one? That's Al Pacino as big boy in the movie Dick Tracy starring Warren Beatty. And Madonna.  Tracy, Tracy, Tracy. I can't wait for the Hoso fat cards. Who? Did you see that? No. He swapped jerseys with Sharif O'Neal. Wow. He was playing against... Almost there. Stay on target. Steve Hoh, you fat. Steve Hoh, you fat. Hoh, you fat? That's not his real name. It is. It is? Yeah. Put a comma right in between Hoh and you. He's a French professional basketball player. Wow. He plays white fat. I want to put a comma right there. Hoh, you fat. He plays with Web of Nyama. One Nyama? Is everyone going to tank for that guy? That's Gidele Bruhan, by the way, for Mark in the race. There's some exacts if you'd rather have the title this year or Web of Nyama. Number one panel. What do you say? It's a good one. Multiple titles with this guy in the series. But isn't it always like... Isn't there always a cautionary tale about drafting guys like that big? Yeah, like Sean Bradley. Yeah, Sean Bradley, Joellen Biedz. He's been healthier the last couple of years. But Holmgren's another big dude with a put problem. He was like that, kind of lanky. Not as tall, but still almost seven foot. Yeah, did Pacino need the work that bad? Or maybe they just paid him an outrageous amount of money. I think they tried to put together like a big cast. Wasn't Al Pacino in... Corey Patterson. Cubs. Kevin. Adam Sandler's worst movie ever. Plays like a Dunkin' Donuts employee in it. What? Al Pacino. Al Pacino's a free spirit, sometimes. Jack and Jill when Adam Sandler plays two different characters. One named Jack, one named... Rex would know. Rex is our in-house expert on all things Adam Sandler. I don't know. Warren Beatty was in that movie too. I guess it was that weird 90s era where it was like... I don't know. Like they were great in the 70s and 80s or something like that. And they had a little downturn, maybe? Pacino? And then he kind of came back with Heat in the mid-90s with Robert DeNiro. There's the other autograph. There's Josiah Gray, Rookie Auto for Terry. That's for you, Terry. And the Nationals won that team in the filler. Gets the former Dodgers prospect. Current National. Decent year this year. Got to keep the walks down like a lot of young people. There you go, TR. All right. Next box. There's actually a Wonder Franco down here. Slide that out. Another one for Mark and the Rays. Here's Tyler Gilbert. Professor Greg Maddox. And a Kyle Bradish. 12 out of 50. Foil card for the... Oh, Sprint. With Baltimore. Why don't they call him the professor because of the glasses? I think so. Maybe because of the glasses, maybe just because of his demeanor. His studious approach to the game, which was maybe not as popular, I think, in the 90s. Another Julio Rodriguez for Chase and the M's. Let's see if we can find some hits for him. What about this guy? What about Pedro Guerrero? Dodger's Edition going to Ryan Hines. There was a... I saw an Astros player, I think in Top's Chrome, where it was a landscape card, but he signed it this way. So it's like his autograph is right there. So now I'm wondering, are all of his cards, if he signed it all like that, or if he did a few and he's like, wait, that's the wrong way. This is, right. This was where Nick pulled Rex at Will Farrell. Did you end up selling it, Rex? Or did you keep it? He sold it. He sold it? You should have kept it. I think it sold for a lot more than what it would now, though. Oh, you think so? I don't know, but... Because then they did like him and Dynasty and him and... Rex is a Will Farrell fan. Should have kept it. Should have kept it. Should have kept it. Won this year. Sometimes they do like movies. Laser show, Dustin Badroia. A couple years ago they did Sandlot and they've done both their own... Jonathan Kent with the Red Sox. 85 out of 150. That's a pretty decent price. Yeah, I think that... I don't think there's any sort of like non-sport or like any movie tie-in or anything like that. There's some umpires and like the female crush for that. The Yankees. Those will be randomized to someone in the break. So like if we pull, I think it's Joe West. They're fan favorites. I think it's kind of funny. Cowboy Joe? Yeah. There's Whitey Ford. 146 out of 199 Yankees. See how about this idea? This is where Topps needs me. Okay. Get creative. The... Who was... Armando Galaraga? Armando Galaraga? Armando Galaraga? The big cat? First baseman for the Rockies? Who's the guy who threw the no-hitter for the perfect game? He was out at first, but the umpire ended up calling him safe on the very final out. Oh, yeah, yeah, yeah. Wasn't it Galaraga? No, not Galaraga. It's uh... Him and the umpire who made that call. Duel Otto. Someone who had no business throwing a no-hitter, I think. I think the umpire has come out and said, has apologized. Like he feels really bad. The game after. And they did like a picture. Oh yeah, so they're on good terms then. Armando Galaraga. Armando Galaraga. In 2010, he was one out from a perfect game on umpire Jim Joyce, mistakenly called the runner safe. Hunter Green to 25. Duel Otto with those two. For Bill Bell? Yeah, why don't they do more stuff like that? Maybe they can't get the contract. Creative juices. Yeah. Maybe put a Jake Berger and a Seth Beer. Duel Otto? Where's that? For the dicks. Yeah. Quad Dick Otto. Yeah, Quad Dick Otto. Dick Tracy. Dick Hall. Dick Buccas. It's a family show, ladies. And we're just talking about, it's their names. Get your minds out of the gutter. Or Ken Griffey Jr. Ken Griffey Sr. Vlad Jr. Vlad Sr. Quad Otto. Yeah. Little father son Quad Otto. And that one NT product where Ken Griffey Sr. signed it in junior spot. Yeah. Green posted that the other day. And I posed the question, who signed in the wrong spot first? Yeah, definitely dad. Everybody was like senior first. Definitely dad. And like Ken Griffey Jr. gets it later. He's like, come on dad. You're embarrassing us here. There's Whitey Herzog. I guess no one goes Whitey anymore, right? Whitey Ford and Whitey Herzog. There was like a certain era where those guys were like, yeah. I don't know. What's that nickname for? Is that their real name? Can't be. It's Carlos Santana, 50. I don't know. You think some parent said Whitey is going to be his name? Oh, we just missed the desk tower being blown up. Yeah, but was it really? Was it? If you look at the seal beams, man. No way that his name is. It blew up from the inside. It blew up from the inside. Dorell Norman Elvert Whitey Herzog. I guess you're not going by Dorell. Roger Maris in the Hall of Fame or not? What do you think? He's not in the Hall of Fame? He's not. Oh, I don't know if he has the career numbers for it. All right. Not the only one. I think, oh, nice international signing autograph. O'Neill Cruz for the buckos. That's going to be for Stephen Carney and the Pirates. Got the Pirates straight up. Thank you, Stephen. Kenny Powers, yeah. And Kenny Powers RPA. That's a good one, Terry. Did Triple Threats have a Kevin Costner autograph in there? Yeah. Oh, I forgot about that. I think archives did too, actually. They doubled Costner at us. Whoa, what is this all about? You ever watched this? You missed the Death Star being blown up. Yeah, millions of people dying. Just like, I don't know how many, I don't think there were a million people in there, but probably, I don't know. It's a big space station. Basically a moon. Yeah, I mean, like. It's like, there could be a million. We're waiting till, you know, the prequels come on. I guess. So we can go execute all that. 66. You ever watched this YouTube video of them doing this without the music? No, it's an awkward. It's really funny because there's really no, there's really no, where like, where is the music playing from? So. Yeah, it's like not a band. Right. There's no band there. So if you watch it, it's just like, you just hear click, click, click, click of footsteps and no one's really saying anything. And nobody's saying anything like that. Right. Yeah. And they're just kind of laughing. I just want to see, I haven't seen the latest episode that I forgot. Oh yeah. Ander. I just caught up with She-Hulk though. It's good. Did you watch the finale? Yeah, I did. It's really good actually. I love it. I love it. It's a comedy. I got to get into that. They're the postcards. Last night was kind of crazy. A lot of hulks out there. All right. Postcards. Wait, what am I nitpicking about? I wasn't nitpicking. Analyzing Terry is a difference. Learn it. All right. Postcards. Greetings from New York. Greetings from New York. Greetings from the Queen City, Cincinnati. Isn't Charlotte also the Queen City? It's Raphael Devers. Greetings from Boston. Greetings from the South Side. Greetings from the ATL. Greetings from Detroit. Greetings from San Diego. And St. Louis. Another Star Wars happening here? Did we get Empire here? Oh yeah. Empire strikes back. Your tauntaun will freeze before you get to the second marker. Then I'll see you in hell. And I thought they smelled bad on the outside. Echo one. Echo one to base. I found them. Repeat. I've found them. The first transport is away. The first transport is away. Oh. Oh. Moe. Mariano Rivera. That's nice. That's four. Mark and the Yankees. Bought the Yankees straight up. Numbered one out of 50. Nice. Congrats. And let's play two. Six out of 15. Kevin and the Cubs. And we got another Andy Chavez. Autograph for the Mets. David with the Metropolitan's. We got a little mini Josh Lowe. I think there can be mini autographs too. Possibility for that. And a Bobby Wood Junior for the Royals. That'll be for Chris Walker. All right. Yeah. Jonathan saying the Rivera is a premium auto. Next box. Good luck. Oh, see. There it is. Greg Maddox. Four out of 20. Hand numbered. Mini auto. Going to Chris Walker and the Braves. Won the Braves in the filler. And the team random. 420. A smoke and hit. There's Aaron Judge. 7 out of 25. And a George Foster the People autograph. George Foster. Australian for beer. Goes to the Red Legs. That'll be for Bill Bell. All right. Next stack here. Wander Franco for the Rays. It'll be for Mark. And we've got a Francisco Lindor. 157 out of 199 for the Mets. That'll be for David. Julio Rodriguez. And down to our last two boxes. And we've got Bryce Elder. 009 out of 125. Chris with the ATL. And we've got Manny Trilo. Cubs. Kevin with the Cuvys. And a Derek Jeter to 99. With Junior. And Raleigh Fingers. Look at that mustache. That is for Chad Wright and the A's. 111 out of 150. Wander Franco. Another one of those for Mark and the Rays. Julio Rodriguez. And his teammate Robbie Ray to 199. And a couple of Wander Francos. Both for Mark and the Rays. One of the Rays in the filler. Final box. Good luck. Oh yeah. Tons. I'll do a recap in just a minute. It's a pretty solid break. Josh Donaldson. 6 out of 15. Jared Connick just missed. Just missed a homer for the Mariners late in the game. And there's Joe West. We're talking about him. So everyone gets a shot at the Joe West. Randomize that to one person in the break. It's Tom Terrific. 57 out of 125 for the Mets. Got a Helio Ramos foil. 100 out of 149 for the Giants. And our final autograph in the break. Travis Ishikawa for Mark and the Giants. 8 out of 25. On that one. And that my friends is that. Pick your team 2 in the books. Thanks everyone for making it happen. Appreciate it. Now let's see who gets that Joe West autograph. So let's go to the list here. Let's gather everybody's names. 1 through 30. And name on top. Look at the Joe West autograph after 10. 6 out of 4, 10 times. 1, 2, 3, 4, 5, 6, 7, 8, 9, and 10. And final time after 10. Sorry Terry, no Joe West for you. But sad times for you and everyone else. Happy times for Bill Bell. At Joe West autograph. Going your way.  Not a bad break at all. That cool Greg Maddox. Mini auto number to 20. The Mariano Rivera. The O'Neill Cruz. Nice stuff. Thanks everyone for getting in. Appreciate it. I'm Joe. I'll see you next time for the next one. Bye bye.


Hi, I'm Matteo Mancini, a research fellow from the University of Sussex, and today I will be talking about acceptable research articles and what value they are to meta-analysis and systematic reviews. So let's start with the total experiment. Let's think about the generic meta-analysis and the object that we expect to find in it. But for most outsiders from the hardcore statistics field, this object would be a table, and it's actually a useful table since it allows to quickly find information that otherwise would be probably spread in the paper, but it still has some limitations. There are actually the same limitations of static reviews and the more in general of static papers. The first one is about usability and readability since we would need to actually go sequentially to either a table or a section to find information we are interested in. Another issue is that the statistical analysis is in some way a black box because even if a lot of details are provided, in any case we cannot see the actual code that was used to perform the analysis. And finally, as a result, in order to reproduce the analysis, we would need to actually reimplement it. So what would actually overcome all of these limitations? That would be a leaving runnable paper that is actually another definition of acceptable research article in short ERA. So ERAs can embed both text and code, and they can be accessed through a browser, so a very common tool. And actually these days they are rendered through computational notebooks, something that is becoming quite popular. For people that are not familiar with notebooks, they are objects able to combine code visualization and text in a single document. Most people are familiar with Jupyter, but actually there are more notebook systems, most of them they are able to handle multiple languages, and some of them are even polyglots, so they are able to handle multiple languages in the same notebook. So I'm talking about ERAs, because we recently published an interactive meta-analysis through this format, and the topic was the validation of MRI biomarkers through histology. We used Python with some bits of R, and we mainly relied on the Plotly library for the interactive visualization. We now go through some of the interactive tools that we leverage to actually enhance the presentation of our work. So starting from the actual digital survey process, we used the Sankey diagram to actually show how the screening procedure happened, and we can see the details of how many articles we had at each stage, and we can even see what were the exclusion criteria when moving from one stage to the other. After we defined which were the suitable studies, we used three maps to summarize these papers, and this is a good complement for a table, for example, because it provides the same information, but in an organized way, for example, here is by structure, then by tissue condition, then by species, and actually you can interact with this object, and you can see all the information for each paper, and you have even the link to the paper. Another way that three maps can be used is to actually highlight collateral information, like in this example, we have the color that is proportional to the coefficient of determination that in our study was the FX sides, and the sides of each of the boxes is actually proportional to the sample sides. So you can look at studies where the sample sides were small and the FX sides was big. Another way to look at this kind of pattern is a bubble plot, for example, and since it's an interactive figure, you can still retrieve the information for each paper when you look on a specific bubble. And now let's move to more quantitative plots. So we used a mixed effect model in this paper, and to show the results, we use the forest plot. Since in plot you don't have forest plots per se, we actually realize them combining different scatter plots, and again, you can interact with it, and you can see the result of our modeling and the prediction interval, for example. And finally, on top of the mixed model, we actually did pairwise comparisons, and we used heat maps to summarize the results in terms of both z-score and p-values. So how does it look in the wild? How does it look like there? So at first, it seems like a normal paper, you have the abstract, the text. The difference is when you actually reach a figure, since the figure is first interactive, as we have seen in the presentation, and then you can actually expand the code. You can look at the code that was used to generate the figure, and then you can even change the code and run it again, and the figure will get updated. So where you can publish these ERAs? Well, in terms of journals, currently, Elife and the upcoming HBM aperture are publishing them. Elife is in life sciences, HBM aperture is in neuroscience, and there are dedicated platforms such as Stensila Codotion and the no-profit neurolibra. Stensila, in particular, is the one that provides the infrastructure to Elife. And finally, you can simply sharing the notebooks on GitHub as a corollary to a standard journal paper. For a more detailed review, Concol and colleagues went through the actual ways to share these objects. I want to conclude this presentation by thanking all my colleagues, and thank you for their attention. And if you are curious about this and you want to get in touch, this is my email, and you can double check my blog where I posted about the interactive three maps. Thank you.


Good evening everyone and welcome. My name is Melissa Armell and I'm in a company called the stocks whoosh And I'm doing an upcoming webinar about how to trade gaps for a living I trade gaps for a living. It's the only strategy I trade I only have one strategy that I trade daily and in fact I focus on the short side Interestingly enough you make more money quickly faster shorting stocks And so if you want to do this for a living Obviously it makes sense to make the most money you possibly can the shortest amount of time for the least amount of investment Which is exactly what I do. So come to the webinar. It's 4 30 Monday, January 4th the very first trading day of 2016 it's going to be an amazing year and I'd love to see you there And if you'd like more information email me and Melissa at the stocks which calm I'd love to have you come I'm going to be talking about how to trade stocks for a living in the market and Specifically the strategy that I trade which is gaps. Have a great night everyone


Hi everyone, I'm Eji. In this session, Camille and I are going to recap the basics of semi-origin policy and the challenges and mitigations to that, then talk about the new defaults we are bringing to the browser in the future. Let's dive in. One of the powerful aspects of the web as a platform is the ability to bring functional components from different services and embed them as part of your website. Just like puzzles. Using components you can embed to your website like YouTube videos, Google Maps, images, styles, scripts, fonts, and so on. You can load these resources and capabilities onto your website without setting up the hosting server by yourself.  However, at the same time, the nature of cross-origin integrations opens your site up to some threats. For example, cross-site scripting, XSS, is a vulnerability where an attacker can inject arbitrary code in order to steal user data. Clickjacking is a technique where an attacker embeds your website within an iframe and tricks a user to take an unintended action by concealing buttons behind a disguise. As you can see, the boundaries between sites and origins are key to keeping your website secure from attackers. That's why browsers have a mechanism called the same-origin policy. The same-origin policy keeps an origin independent from others while allowing a certain extent of interactions. For example, a document on host.example can load an image from cdn.example and it's visible to the user. However, a script on host.example cannot read the binary of the loaded image from cdn.example because it's loaded cross-origin. The same applies to iframes and pop-up windows. The host document can't read contents from cross-origin resources. This behavior is called an opaque response. And the browser is designed to prevent cross-origin access to such information as part of the same-origin policy. If cdn.example wants to explicitly allow host.example to access the binary of the served resource, they can use cross-origin resource sharing, CORS, to obtain. CORS is a mechanism to instruct the browser to control access to cross-origin resources. However, the discovery of Spectre announced in 2018 was a catastrophic threat to the web that enables a malicious website to even stop cross-origin contents by reading their memory despite being protected behind the same origin policy. We published a proof of concept in March that demonstrates how Spectre.js can even stop a cross-origin resource. If you look at the demo, you can see that it's not just in theory, but it's for real. You can try it yourself at leaky.page. Because the vulnerability is caused by the hardware CPU and it's unrealistic to expect them to be completely eliminated from the market in the foreseeable future, this unfortunately is an irreversible change. Luckily, there are some effective mitigations you can apply to your site to protect against Spectre. Let me walk you through some of them. Protecting against Spectre attack is about isolation. You need to ensure your site's sensitive data is never handled in the same context as an attacker's site. For example, don't let the sensitive resource such as an access-restricted image on a social network be loaded by cross-origin documents unless you intend to do so. To prevent your resources from being loaded by cross-origin documents, you can instruct the browser not to load it by using cores or by sending a cross-origin resource policy, corp header. The corp header can pass same origin, same site or cross-origin to indicate in which relationship with the document the resource can be loaded. If they don't match, the browser will block loading the resource even after they receive the response. A document opened by a cross-origin window with window.open is a chance for an attacker to exploit Spectre too. You can't prevent your document from being opened by a cross-origin document, but you can isolate it to mitigate the risk. Cross-origin opener policy, corp, is a header to instruct the browser to control the isolation of the document when opened as a pop-up. The value of same-origin isolates the document from any cross-origin documents. Note that as a side effect, when the document is opened isolated, they have no handle mutually so they can't send a pass message to each other, for example. Same-origin allow pop-ups is the same, except it allows sharing the context with that window opened by itself unless the opening is opted out. UnsafeNum is a current default and allows any cross-origin documents to share the context. Iframes are in a similar position. Blocking your documents from cross-origin loading has been mainly to protect them from click-jacking, but Spectre is now another reason. In the web today, websites can embed any cross-origin documents by default. This means a malicious website can embed yours and steal the personal information of the browsing user. You can prevent your documents from being embedded with X-Frame Options header and Content Security Policy, CSP's Frame Ancestors directive. With X-Frame Options, you can prevent embeds altogether. With CSP Frame Ancestors, you have more granular control allowing embeds per origin. Content Sniffing XSS is an attack that exploits the browser's mind-sniffing ability. For example, an attacker website can try loading a victim's website as another type, for example, a script, so that Spectre allows the attacker to read the victim's website content. To prevent it, set X-Content Type Options No Sniff to all resources along with the correct content type header. This header instructs the browser not to apply mind-sniffing. Now I have talked about opt-in-based security, but ideally, security should be nibbled by default. Let me hand it over to Camille to talk about upcoming new security defaults in the platform. The recommendations AEG just described mitigate site-channel attacks like Spectre. However, they require all developers to do some work to be protected. Ideally, we'd reverse this. Applications should be self-contained and safe by default. Those developers whose applications require more prosthetic interaction can opt out of protections. This would ensure that costs accrues only to those developers with extraordinary needs. It would also ensure that those developers are encouraged to sync through the mitigations they remove. Then, hopefully, they can put their own application-specific defenses in place. Let's have a look at three problematic behaviors. The first one is document.domain. Document.domain allows a page to relax the same origin policy, and it's easy for developers to accidentally hurt themselves by relaxing the same origin policy using document.domain. Say that you changed document.domain from your specific subdomain origin to the generic top-level site because you want access to another cross-origin document in the same site. Then, any unprotected property in the same site can also become same origin with you, which means that this property has now direct read access to all of your resources. And if that property is poorly protected, it could be exploited by an attacker that leverages the fact that now both different properties are same origin. On top of this, document.domain prevents browsers from deploying mitigations against Spectre by isolating websites based on their origins. Documents in the same site could eventually become same origin because of document.domain, so we cannot isolate them from one another. Concretely, the spend secure page is only as secure as the least secure page in its site. With this in mind, we aim to deprecate document.domain. We recommend that developers shift away from its use as soon as possible. Consider using window.pass message to communicate between cross-origin documents without relaxing the same origin policy. Following the deprecation, just using document.domain will not change your document's origin. This way, websites will avoid accidentally modifying their origin to something potentially dangerous. Given its usage, we're not going to be able to remove it immediately. To get there, we plan to have an escape hatch for legacy content. Pages that need to use document.domain will need to opt into doing so via document policy. If you enable the document policy document.domain, your site will still be able to modify its origin when we transition to the escape hatch model. Otherwise, using document.domain will be a no-op. The second problematic behavior is cross-origin document embedding. By default, all documents are embeddable cross-origin, which means that by default, an attacker can embed any document it wants. The attacker could try to perform a click-chatking attack on an embedded frame. The attacker has access to a window handle for an iframe it embeds. With this window handle, it can post message to the frame. Or maybe it can count the number of child frames its iframe has. This could allow the attacker page to distinguish between a logged-in version of a site and the not logged-in version and reveal information about the person browsing the page. And in some browsers, the attacker can even perform a specter attack on the embedded iframe. Many documents have no reason to be embedded cross-origin. So instead of every document having to secure themselves, we'd like to require documents to opt into cross-origin. With this change, documents will be saved from an attack from a cross-origin embedder without their developers having to do any work. In the new model, developers will have to opt out of security protections when they want their documents to be embedded cross-origin. To opt out, developers should send either an iframe options header or a CSP Frame Ancestor directive that allows embedding. So if you have documents that you want to be embedded cross-origin, please send an iframe option header or a CSP Frame Ancestor directive in your headers. Beyond iframes, we also have an issue with pages opening another page as a pop-up. When a page opens a cross-origin pop-up, by default the opener page obtains a handle on the pop-up unless the pop-up is using co-op. This allows an opener page to abuse window APIs like frame count to learn information about the cross-origin pop-up they just opened. In some browsers, the handle also allows the opener to mount a spectre attack against the pop-up it opened. In many cases, pop-ups have no use for communication with a cross-origin opener. We think that the web would be safer if pages did not have that communication with their opener by default. Concretely, this means that we would treat pages as having co-ops same origin-allow pop-ups by default. And in this world of co-ops same origin-allow pop-ups by default pages are protected against attacks from their openers by default as well. To be clear, there are legitimate reasons to want to have communication between a pop-up and its cross-origin opener. For example, a no-host flow, which is why in our world of co-ops same origin-allow pop-ups by default a page can specify a co-op of unsafe none and retain communication with its opener. Again, you opt out of security protections to have communication with the opener. So if you have a page that needs to interact with its cross-origin opener, for example you are maintaining an authentication or payment flow that requires pop-ups, we would like you to send co-op and safe none headers with it. This broadcasts that you want this page to communicate with a cross-origin opener. This way, when we switch to a world of co-ops same origin-allow pop-ups by default, your page will still be accessible from a cross-origin opener and it will have access to its opener as well. To summarize, there are security APIs that help protect your pages against a variety of attacks but it requires work to enable them. We want to make some of those protections default. This way, web pages will enjoy more protection even without deploying some of the security headers that AEG presented. To do this, we must change some of the permissive behaviors of the web to be opt-in rather than opt-out. If you are a developer, you can help us move to the safer new world by doing a few things. First, don't use document.domain or prepare to enable the document.domain document policy once we release it. Second, send an XFO header or CSP frame ancestors directive with all of your documents that need to be embedded cross-origin. Finally, send a co-op and saved on header with all of your pages that need to be accessed by a cross-origin opener. Those changes are going to be coming at some point in the future so you know it's your chance to be ahead of them. So if you want to learn more about what we presented today, we have included a few links to interesting resources on this site and thank you all for watching.