All right, well, thanks very much for being here. And thanks to Stuart for having me. I really appreciate it. So title of talk, Incorporating a Security Development Life Cycle and Static Code Analysis into Our Everyday Development Lives, Overview of Theory and Techniques. And I apologize in advance for using windows on my laptop. I'm sorry. So and thanks for HP for supporting my travel here and also to my family for allowing me to be away and come. So a little bit about me real quick. A consultant with Hewlett-Packard Enterprise Services. I work mainly for US public sector entities. And unfortunately, I don't get to develop open source as my full-time gig. However, I like to dabble in my part time. And I do a little security research on the side. So I really hope I'm not preaching to the choir about this topic and that everybody's already kind of got a security mindset for a project and have a set of tools that they're using in terms of code analysis and processes in general. But the picture here from my rental car shows what to keep left. Sometimes it's good to talk about obvious things just to make sure that something's not forgotten. So as usual, I have more slides and I have time. So some of this I'll be moving kind of quickly for. I want to start just giving a few good resources on these topics. The best one I've seen that is just out on the internet, the open source web application security project, or WSAP. Check that out for sure. Give you a lot of good introductory materials on developing secure software, implementing security development lifecycle in general, and a list of tools and that kind of thing that you can use. The books mentioned there are pretty good. If you're interested in the internals of static code analysis, the book there by Brian Chess and Jacob West from HP is pretty good. And then I'd like to also mention Caverity. They have an open source scan cloud service that a lot of open source products are already using. It's really nice of them to do. And it's great. And then I have to give a plug to HP as well with their Fortify on-demand service. So let's face it. It's been a bad year for security and open source. And I'm not here to pick on any particular projects or point of finger. I'm certainly would make mistakes as well. But so don't take it fenced if you're part of any of these projects. But here are a couple of headlines that we've all aware of from this past year. Obviously the open SSL, Heartbleed, some problems found in Drupal with SQLI, and of course the bash of vulnerability shell suck. So we really can't sit here and shake our finger anymore at the closed source giants like Microsoft and say, hey, without pointing it at herself and say, hey, what can we do better in terms of improving the security and the stuff we're putting out there as well. So I was stuck in the Hong Kong airport for 26 hours because I had to miss the flight and I saw the sign. So hopefully I needed to incorporate it in my slide somehow. So hopefully 2015 we're not going to be sheep and we're going to make things better. And so some of the traditional assumptions about open source, they're just approved that not really working out well. Many bugs, many eyes make all bugs shallow, for instance. It is really valid to a large extent, having source code out there available for everyone to see. But it kind of begs the question, who's reviewing it? Is anybody reviewing it? Certainly there's some of that going on. But the best people to review this code are the developers that are writing it and people that are really familiar with the project themselves. And I get a quote there right from Wikipedia's at one time, this open firewall toolkit had 2,000 sites using it, but only 10 people gave them feedback. And then old code is stable as another, with the bash vulnerability, that problem has been there for years. And then firewall, yes, will protect us from our bad coding practices, is not true for zero days, which we're seeing, of course, more and more of. And component-based software development and frameworks are more secure. They definitely help improve the situation quite a bit by removing some common problems. But it introduces a whole nother set of problems where bugs are perpetuated across the large set of systems a lot quicker. And with component-based design, it's hard sometimes to keep up the date with all the vulnerabilities and the components that are used in the build your code. So who's the blame who can't fix it? I think all of us, we're all on the hook to make things better. And I think it is something I'm kind of passionate about. I think it's a failure to educate to a large extent too. And I'm not trying to pick on the local university here. This is true for every software engineering class you probably can think of. But if you look at the syllabus, you don't see anything about security engineering. And that's really a failure that needs to be addressed. I'd like to see students have to be also graded on if they're not only at the code compiles, but that it doesn't have glaring security problems with it, especially when you get into web development and such. So how can we fight back? As I already said, security-oriented developer education is kind of probably number one. So there's been a lot of pushies especially on the corporate side for this security development life cycle. Trying to apply that to the open source, get its own set of challenges, but it's something that I think every project needs to consider how they can do. Organized strong security teams, be ready for incident responses because they're gonna happen. And I mentioned Drupal earlier in my list of vulnerabilities for the year, but they did a great job or security team of getting the fix out the door quickly and making everybody aware of it the best they could. And that's kind of key. And make your updates as easy as possible. Encourage use of tools to manage dependencies and judicious use of automated analysis through static code analysis and human code inspection. Definitely key and empower a developer and include security and everything we do. So if we're not examining the code, who is? So there's definitely other entities that are looking at source code and they have their own set of motivations, hackers. Obviously, some of them are out there just to be able to say they did it. I recall this talk at DEFCON a couple years ago, a guy broke a Google TV firmware update process and he was calling the engineers a bunch of idiots. And I was thinking, it's a lot easier to destroy it and it's great, so that's not really fair, but you don't wanna be a guy being called an idiot, so you'd want to try to be ahead of these guys. And security research companies, they ultimately need to monetize what they're doing. They need to, they're in firewall products or application containers and that kind of thing. And academia has got a publish or die mentality. So they might not have your interest in mind and your friendly local intelligence community. They don't need back doors.  It's a lot harder to get back doors in the software than it is to simply exploit problems that are already out there and for everybody to see in the code. And you might not have time to do a furrow security review, but you can bet that these guys are, and that should give you a warm fuzzy. So who else should not be doing it? As I already said, developers are writing code really the best defense, but if they don't have the knowledge and the tools, they're gonna miss things. If you need to have an overall system architect that really knows what he's doing in terms of security because you can have tools that are gonna find bugs and code, but they're gonna miss things and overall architecture flaws. And again, don't depend on your project security team.  Oh, I'm sorry. Who else should? Companies, I believe, have the obligation. They're using open source. They're putting it into their products or making money off of it. I think they have obligation to try to make the security better. They try to, I don't know, maybe put their will onto the community to an extent to enforce some security standards. And then if you're offshoring development, offshore developers might not be up to date on some security stuff, so you definitely wanna be reviewing that code. Quick example, shown here is a, there was a talk at the Black Hat in Def Connors past year by MITRE, UEFI firmware exploit that if you're running Windows 8, which hopefully none of you guys are, it can basically flash your firmware with a malicious agent that is persistent because it's in firmware. And they looked through the, and how they figured out how to do it is they looked at the UEFI DEC code that is out there, Intel published it, put it out for everybody to use, they review. All the companies, HP included, used it. They didn't look at it. You can see right here, there's some comments, make more checks later. But I think companies of leverages could really do have an obligation to kinda look at it for themselves too. So there's a lot of inherent difficulties. I probably don't have to say too much about this. I mean, if you look at a project, I've been a lot of talk here about OpenStack. You have thousands of people contributing to it. You can't really enforce a, easily enforce, I should say, a true security development life cycle. So you really gotta try to catch things before you put out official builds and such. But if you're working on small projects or you're working on projects for your company, then you really do have a chance to implement a good process. So there's a number of trends that are kinda helping and hurting. So we're using more frameworks, APIs. And these are moving common security problems. But again, lazy admins and time delay in implementing patches or problems. Component-based design I already mentioned can be a problem with version management for affected versions. Rapid development life cycles is great for getting things out to customers, but it might not leave time for adequate security testing. So there's a lot of good resources out there, but not all developers have equal knowledge. There's security researchers who are really looking heavily at open source, but they might not give enough time. And tools like static code analysis are being used on an increasing basis, but it doesn't cover everything. And a lot of times it's not used until the end, where it'd be really nice if it's in the hands of the developers that are working on the code, they can check themselves before they submit, before they submit code. So more trends, there's, yeah, identifying security issues after it's done, it's a costly way of doing things. In the race condition, IP gets stale quickly, we all know that. So we wanna get cool things out quickly. Security is in a future release, et cetera. And then the changing threat landscape we're talking about like in a nation-state, advanced persistent threats. And embedded systems are just a mess when you think about all the things that are out there like phones, that companies have no motivation to create updates for, but they're still out there connected to the network. So advanced persistent threats are what we mentioned is the changing threat landscape that we always hear about. So we need to kinda look harder at the past traditional defenses in order to try to, in some way, counteract this threat. And a good example there at the end was a quote from Ellen Amale from one of the Hadoop designers. He was saying that the security design really had nothing to do with actual hackers. And because it's gonna be behind firewalls and such. And that assumption is just not true anymore because with the APT, they'll find a way around firewalls and whatnot. And the last level of defenses is in the code base and it might as well do the best you can to try to keep them out. Cavarity published a pretty good report I'd recommend reading it. It's from last year. They are scanning a number of open source projects. And here's a couple of highlights that for the first year, open source had a less density of defects than their proprietary code that they've scanned. And they also had a kind of interesting, they've been scanning the Linux kernel for a number of years. And you can see in 2013 they've, more defects were fixed than were introduced. So shows that backlogs are getting too. These numbers are kind of funny too because what they've identified at these facts, the developer might have decided aren't defects or they have a risk mitigation strategy. So onto the SDLC, Security Development Lifecycle or Secures Software Development Lifecycle. So there's a lot of formal approaches. But they all have kind of like the same goal in mind. Basically, try to get security into each stage of your development process. Who should contribute and where? Everybody has a role from the system engineers, developers, testers, and a security team. It's kind of critical that everybody have a security mindset. So here it is in a nutshell in graphical format at that. So no one likes to do it, but it really needs that you have requirements that also include security. You know, that initial phase of trying to figure that out is often skipped when you're making, you have an organic kind of open source collaboration, but you might even need to go back and try to retrofit it, but it's definitely a good first step because that leads into your design phase where you're trying to get your data flows and figure out how things are gonna interact. And if you don't have that figured out and you can't implement the next kind of principle, which is threat modeling, and then of course going on the coding, having developers that are trained in good coding practices and using static code analysis, store and development or at least at the end of it. And testing that includes vulnerability testing. So if you have good requirements designed, you can trace your security requirements in your threat model to test. So you have a traceability matrix, do-fuzz testing as well on top of that. Testing might be a place where you're running your final static code analysis too and generating a report and making it a review. And then the deployment, making sure you get good documentation out that explains the proper way to configure it if you want it to be secure. And also there's no reason not to publish the threat model or risk model or the other documentation that you have. So somebody can make a good independent analysis of what they're getting into. And the image on the bottom is Microsoft's version of this. It's pretty similar. They threw in a training step as well and a response phase. So you definitely wanna have an incident response plan as part of this as well. So there's a couple different methods of threat modeling. But long and short of it, you need to have your data flows figured out and user interaction or security requirements. And then you kind of try to reason about it and stride as a way to do it from Microsoft. Dread as a threat ranking system that they have. And they're actually pretty good ways to try to figure it out. But the general process, you're gonna decompose the application, determine the various threats. And then you're going to try to determine whether you're gonna fix it somehow in code via countermeasures or if you're gonna mitigate it via some other mechanism like document the threat. So somebody knows that they know that it's there. So here's a data flow diagram that they started to add a, I guess, sorry, security boundary layers to the dotted red lines. And then here's a stride. Since we're spoofing, tipping, non-repudiation, information disclosure, denial of service and elevation of privilege. And basically you go for each of these categories and think of ways that your particular code could be susceptible to these various types of attacks. And I don't have time to go into this, but this is an example of what I did for Hadoop for another thing that you could see, essentially go for each thing and try to figure out the weaknesses in the design. Another thing you might wanna do is try to document attack paths and root causes of the threats that are there. And then also kind of try to document what you're gonna do to counteract that. And then use cases you can turn into use and abuse cases if you bothered to create those. So this is a good example of why it's good to do all this work in documenting because it makes it easier to see the various ways that a hacker shown here could try to abuse the use cases of the system. You wanna try to rank the threats in kind of terms of their likelihood. Dread is an example of how to do that that stands for damage, reprisability, exploitability, effected users, discovery. And the idea here you can read about as you assign a numeric value and then you kind of come up with essentially a priority of what you're gonna address and what you might not address if you don't have the time. And don't dismiss the small stuff. Something that might seem small when you're working this out, it might not be. And I have a silly little example here and explain what's going on. My three-year-old is in a preschool program at a small Catholic school. And the local utility company had a contest where they created some sort of video about now not executing yourself on a down power line and whatnot. And they had a slate where you can vote for who's the best one, but the winner gets eligible to win $10,000 for the school. And I hate stuff like this because to me it's a popularity contest. Obviously the small school is at a disadvantage to the big school. And so it says they limit you to three votes per day per IP address. Well, when my wife voted and she told me to vote, I was like, well, I shouldn't be able to vote because if it's by IP address and we're behind in that, we have one IP address. Well, of course, that wasn't the case. All they're doing is using a cookie and accepting unvalidated inputs. All you had to do was pass. You needed to get a valid session and then simply it made an Ajax call to a post to a form to submit your vote. So a little W get script and thousands of votes later, they're in the finals for that. So as an example of, they probably figured nobody was gonna bother doing that or they didn't know what they were doing. And the really only way to actually implement a voting system like that is to have a user account and they probably didn't wanna do that. And they ranked that threat low and their countermeasure was having a review process after the votes were submitted to actually determine the winner.  But testing is definitely a golden opportunity. If you don't do it anywhere else, you gotta try to catch it there. You definitely wanna try to have security oriented to test as part of your unit test, do Fuzz testing when you can. And if there's a separate test team, make sure they know the threat model, have access to all documentation and that kind of thing. Check out the OWASP link for testing guides pretty good. What about Agile? Well, a key point, Agile makes things a little bit harder, but it also makes things, I don't know, maybe a little bit easier in some extent, but you still gotta try to shoehorn the security in there, whether it's during major design reviews and definitely any final release that's going out. So there's a lot of research out there about how to get this fitted in. So if you're doing Agile, be sure to read that. We definitely don't have time to talk about this, but be aware of the secure coding and static analysis. Man, I'm like just about out of time. So static code analysis is something everybody can do via the free cloud service that I mentioned, or if they're working for a corporation, there's a number of closed source solutions including HPs that are really good that you can integrate into various places in your development stage, either the part of an ID or part of your CTI server, you can run it as part of Jenkins or something like that. So true static code analysis is an NP hard problem. If you're a computer science buff, you probably heard a halting problem. It's the same kind of problem. So basically it gets around that by heuristics, pattern matching and basically coding rules. It kind of works in a similar way to compiler, but it does a little bit of extra to try to figure out basically where tainted data could be flowing for the program, null pointers, buffer overflows and such, so it's still a little bit more work than with the compiler, but it kind of works in conjunction with it. So we're to use it ideally, use it in your IDE if you use an IDE at build time. If you have a huge project that you're compiling, it's not really practical, sometimes takes a while to run it. So you can run it as part of your continuous integration or you can script it, and basically your output was I'm gonna show you if hopefully you guys bear with me a second. You get a report that you can then review. These are early and often. Here's some various options for you. There's a couple of open source options you can take a look at. I don't have any experience with these. If you care about the magic quadrant, which I don't really, but you can see the players there. And it's limitations, it's not gonna find everything. And I'll give you a couple of quick examples when I show you the things that it missed. And it can only find problems in the code, not the architecture, of course. And there's some things that are just not obvious, but to the analysis tool because there's convoluted input paths and such. And it doesn't read your comments. So one nice thing about those new things come out, like for instance, the SSL vulnerability, they figured out a new pattern matching algorithm to try to detect similar type of problems, which essentially a buffer, off by one kind of buffer problem. And so thanks. I'm gonna show you a couple of quick examples if you don't mind, okay, okay. Sorry this is kind of awkward for me to see in this resolution. So this, I've run a report on my homework from years ago when I was learning how to do PHP. And what you can see is it breaks things down into different categories of problems and critical, you know, high, et cetera. And then it takes you right to the problem in the code. So here, for example, it's taking unvalidated input right from a, I guess this is right from a input field and just displaying it back. And it'll give you some details about why it, and give you some recommendations of how to fix it. So these are simple inputs, simple problems that they can easily find. I'll show you a quick, this is integrated with Eclipse. This is kind of how I like to use it. R for 4.5's Eclipse integration really only is good for Java right now. Everything else you kind of gotta run outside and then bring it back in. But it gives you a nice little toolbar and you can analyze the project, bring up your audit results there. And then again, you kind of can switch right back and forth between your design and your results of your scan. And in this case, my homework from a few years ago was pretty good, except it took me to an issue with the encryption I was using, which after, and if I was a Curie reviewer looking at this, and it's actually not a low default, this is a high default because it's not using any sort of, it's just shawling a thing as a encryption when that's not really encryption. Should be at least adding some sort of other value to it. So anyway, and then let me show you two, one other quick, so this is OpenSSL, an old version of it, one of the vulnerable versions, 1.8.1 in all fairness. This 4.5 would not have found this original bug, as I said, it doesn't now find it. And you can see it's right here. Yep, yeah, I just lost it. There you are. Okay, yeah, that's the line right there, the mem copy line. And if you actually look at what's going on here, you can see why it was kind of hard for it to figure out what was going on because it's not obvious that that value came from a network source, but they figured out some way to do it. And this is kind of cool, it gives you a little diagram that shows exactly where the taint came from, taint from that work you can see there. If you understood how this worked, you could see, you could try to, if you actually understood the code, you could get some good insights from this. Another thing I found interesting was the number of other critical vulnerabilities it found. Then, you know, and that's why you need to have a manual review on top of this because I can pretty much guarantee you most of these are probably nothing false positives. But who knows, until you actually go through and look at it, there could be a number of other vulnerabilities out there waiting for somebody to look at. And one last look at a failure of it. This is Drupal, version seven. Now this should be a vulnerable version to the SQLI vulnerability and you can see that they have zero critical vulnerabilities. It did not find this. And this shows you too that the Drupal team does use static code analysis as part of your final build processes. So they pretty much make sure it gets a pretty clean analysis back. So that, you know, that's good. But, and again, and this is one of the ones where I've lost my place in it. But if you look at the function, it's not obvious that the input is coming from a tainted source. So that kind of shows you where, you know, sometimes you do need to do manual review on top of it. So that's all my examples. So I'll take any questions and I'm out of, completely out of time. But thanks for your attention. Got some time for questions? Okay. Okay. Do you see a lot of difference compared to something like there's the, like, LLVM Clang static analysis ones? Is that sort of getting a pretty good sort of easy thing to go now that's open?  Oh, okay. Well, I don't have a lot of experience with the open source security oriented ones. If you're referring to, like, the ones that are kind of built into, like the... Well, not just security as well, just like correctness as well. Correctness, right. Yeah, so security stuff does a lot on top of what the correctness ones do. So correctness, the comparison that I'll use it as, is like a spell checker. And it'll help you if you are usually a good spower, but you occasionally mis-type something, but it doesn't do that deep analysis that some of these tools, these other tools do. My understanding is that the open source, the first one I had listed here, I forget what it's called, is visual code rep is getting pretty good. And then, as I said, the severity thing is nice where you can create a project on their site, submit your code and get a report back. It's not as ideal as being able to integrate it into your own development environment, but, you know, it's better than nothing. And then if you, like I said, there's probably like Hadoop, for instance, is on there, so you can sign up as a... So there's project controllers that really have, can do stuff with the scan, but you can also sign up as a reviewer and anybody can do that. So you can review their code results back without having to pay anything or what have you. So that's really nice. I've been on the receiving end of a customer mailing severity reports and one of the answers of why these weren't fixed. Right, and, you know, again, you probably see a lot of them and you're like, well, this is nothing, right? But, you know, it can help, especially help guide somebody that's not a co-reviewers through the code, too, to try to pinpoint things that might have been missed.  Well, if you're using like Fortify, you know, you can have it in a collaborative environment and you can... Everybody can kind of get their feedback to say, okay, well, this is nothing or this is that or this is mitigated by XYZ.  That's gonna be a huge task to do, but, you know, you're building something new as a really good opportunity to get this stuff in early and try to have the principle is introduce no new bugs, at least no new SCA detectable bugs is a good step. Do I have any questions around the room? All right, thank you. Thank you very much.


And I want to welcome you to our annual care program training summit event You'd understand why we have this summit every year what it's for you need to really understand the history of project care Our mission is to fold We attempt to restore the appearance function and self-esteem of everybody that has been disfigured Traumatically and we seek to advance the art and science of reconstructive care through research education and training Infront with an engineer in front of me We're going to a compound to check out some bad guys and we found a bunch of IEDs and one found me and one thing I got I can honestly say from my point of view is I'm doing well It wouldn't be possible without the team and the support that I have from you guys in Navy medicine Where whether I've met you or it's something you wrote in protocol or doctrine or had something published You should know coming from me who is a patient that I thank you for doing the research and taking the time to think About us when we come home


Ryan, Royce, describe to me what you saw on that hook bat that put this team up by two.   Well, Royce, your stat line, 11 points, 11 rebounds, 11 assists, you got it done on both ends of the floor. What did this one take from you? I mean, it took a lot.  Playing a really good team that's playing well. I think we just played, you know, it was a team effort. And team effort, six players and double figures. You also had 32 assists to end this road trip and to get a win like this. What does it say about what this team can do and be? It says a lot. I mean, we just going to fight for them, you know, all 48 minutes, keep going. You know, it takes all of us to win. Thanks, Royce. Back to you, Ryan.


We are going to go over to the world of our man. Mr. Dave Mazza. Dave is the head of product and a managing director at Direction chairs and volatility Metals we have all sorts of deals out here Dave Mazza. How you doing come Joe? Well happy to be back with you I am telling you so great to have you back and I will I want to start off with the With last week and the reason I do you know I always watch that you know the as As money goes into the spx s and spx l in and out and last week There was quite a shift wasn't there Yeah, no, I think what's really fascinating to me. I've noticed this For a few a few weeks now is that you know it took a little while But we are now really seeing the action happen on the inverse funds and so those are the bear products Yes, the ratio of spx l and spx s has gotten closer to parody and by that I mean people are Using the sure go are going long to go short in really an outright right way because as spx s Provides three times the inverse exposure of the smb 500 on a daily basis, right? No doubt Now I want to change gears on you for a second because we have a lot of action happening and folks You can come over to our website at TF and then you're going to see the direction banner right there Hit the banner bring it up and you're going to see all the different ETFs they have and you know We've traded the nugget a J nug a lot and we have you know gold running right now So we want you to be aware of that because they're great vehicles But now we have a new vehicle and I want to we want to talk to Dave about it in a new vehicle And this is really cool day because we get a lot of calls and the aluminum business and the steel business in the Metal business in general and they have a new ETF folks. Okay. This has been around for a bit But a few months. I think that's all it is and well, I'm talking about that them Daily metal miners Dave. It's two times. I was kind of I was looking at the Holden's so tell us about this Yeah, so MNN that's two times bull fund on we call it the metal miners. Yes Yes, you know and folks who who are On the audience here are likely familiar with with nugget and dust to your point Those are gold miners and those are great because it's you know amplified exposure in a concentrated area But as you noted a moment ago, there's all these other sort of metals that can have kind of different idiosyncratic Returns and volatility and and that's why we thought kind of it was a gap In the lineup around not having something on that space. So this actually provides exposure more to steel and aluminum now there's a little bit of exposure To gold mining companies in here because some miners are doing copper and gold and all that But this is more of like your really industrial type metal play as opposed to The nugget and dust of the world which again are providing more pure play exposure to to gold miners And the symbol again folks so you can check it out is M as in Mary and Nancy M Mary So check it out now. Let's go on to nugget because we know And if you're not familiar with nugget folks, what nugget is a two times of the bottom line The nyse aca mine is index. So and when you're looking for something, you know that bottom line the spreads across it You get you get a lot of good exposure and I it looks to me Dave that you know the bottom line the dollar Is pulling back pretty dramatically and gold and the markets can finally breathe Yeah, no, you're absolutely right. So These are gold miners funds actually are the sweet We're for for a long time the largest funds in the direct and directions leverage an inverse lineup As as we know miners have a lot of volatility They have a high correlation Or inverse correlation I should say to the dollar two interest rates and of course even though they're stocks a relationship with the commodity itself Sure And then you know really in the last couple of years as Everyone's gravitated towards trading the semis and the tech space And other tech related names But these funds have really come back in a big way because now we got some action Happening again in in the commodity space and what I think is interesting here is there's You know for traders maybe some pent up demand, you know because we didn't see didn't see that action and you're you're absolutely right The dollar had really been just like it couldn't even it couldn't take a hit Right because it was so strong particularly relative to some you know some weaker economies And now that we may may finally see inflation peaking It's certainly not over may finally see the interest rate environment still going up But not necessarily at the pace that has been it gives a little bit of a reprieve to To to gold as a commodity and then of course the related mining stocks No, no, and listen, I really think you're on to something with that metals one too because my take Is this is almost like 2002 to 11? I think we've got a commodity run happening And you wouldn't it well, I'm sure you you'll believe it because the amount of calls that you know I had been getting prior to this because gold's in a bummer. I mean that's the bottom line But I see hidden calls that no the reason it's that it's going down is it because everyone's buying bitcoin I'm saying to myself.  But it was it was pretty ironic that when those explosions happen on the downside That's and gold takes off like a rocket ship. So it's going to be really interesting in the future To see that. Okay. Can I feel it hold it? You know, is it backed? You know what I'm saying? So It's been quite a ride. There's no doubt about that Absolutely correct. And yeah, we obviously know what's going on with bitcoin and crypto these days. So Gold might be a real haven in this environment. Right. You got to stay on Regulated exchange folks. That's the bottom line. You work hard. Feel money stay on a regulated exchange Dave, you have a great one safe one. We look forward speaking to two weeks from today Thank you. Happy trading everybody. Happy trading. That's a beautiful thing. Stay right there folks. We're coming right back


Yes. Nitu Aditabu Suleyman kutoka ajalamu TV. Alright. And congratulations. Congratulations to you two as well for the new team ajalamu TV. Nashikuru. Are you a media personality? Yes, I am. Nuna pata akwamba, kuna zile kampani kubatena sana, nuna pata they want you to feature in the company. Alright. Nuna kukiwa kwa that, nuna pata akwamba, glendali ita kuja, kuna kapuni gini ita kuja. So, nikritir again, nuna tumia, kusimakwamba will just support you. Sita support you, kampuni gini amba ita ni approach. But you see the things, first of all there's something about a contract. We just signed a contract. Bela kelamtu. Number two, come on, unged you are elestation amba naifanya kazi kama na TV 47 and ready for the seven. There's a contract I have with TV 47 and ready for the seven, which is kept media. Nakuna contract amba ni doctorofenike. So, contract to you, aki sign, parle mimenda skumoksabu, parle, ni contract kept media na kampuni gini gini. Nakini he glendali ni kandarasi katia doctorofenike na glendali. Asante. Asante Pia. Hi doctorofenike, super emcee. Go to say top. Go to say YouTube. Thank you so much as well. So, my question is mweme ni emcee kuna kati we did an interview kaseyama, red cardia kwa ina range one point something million. I'm very expensive. Very expensive. He glendali, I'm coming to say mamiliu mwemokpe , What I can tell you is out of all top comedians and emcees um to your face, this is my ear. Yes. And how does it feel being part of this? Being part of Glendale. Yes. Of course, anything classic have to be part of it and that's part of Glendale. So, we all know you are a spiritual person and you've chosen to work with Glendale. Maybe don't you think that people will judge you? No, don't you think that people will judge you? Which thing? Which people?   I'm going to get text. No. I'm going to get text. But you've chosen after. I'm going to get text. No, my pastor. My pastor I'm going to get text. No. Mass to watch you up. Bring it on. I'm going to play an anime. On. I must tell you. People in the blockers never. You are not correct. Eh? I've visited a lot of things. Dr Fonicky, my name is. I'm working with. The one in the only. The one. Baba Yaal. I'm working with. Just a correction. We are journalists. We are world-train journalists. I know. I apologize for that. I apologize to each and every single block. Sorry. No, I apologize to all the blockers. Usigiaan, mumiko knwa. Sava, sava. Zimu groinarana, Utawa urandani, Utawa urandani. Isuna ni hafu, Udumu isuna ni. Adeli kwa wajuntia kucho Udumu isuna ni. Misuniku wajuntia. Wasu unama. M ми prokuni kwa ma, I'm not in any way attached to money. Money is the most useless thing you can ever have. But of course you're not doing it for free? Sorry? You're not doing it for free of course. Well, I wouldn't do it for free because I got kids in good schools and I have a beautiful wife to maintain. But I will tell you this, whatever I'm being paid is a token of appreciation. So what is the main reason you chose this brand? The main reason is because it's classy and it's me. I don't care. Baby, I have a last question to you. Maybe, are you going to share it with me? Bibi, a pasta. Okay, I'm coming. I'm coming. Bibi, a pasta because I don't have any questions about pasta. I'm coming. I'm coming. I'm coming. I'm coming. I'm coming. I'm coming. I'm coming. So I'm coming. I'm coming. I'm coming. I'm coming. But I want to tell you your faces. Put your cameras on? Yes, Diana B 1994 and I have some time going on. We are working together. Now I'm going to say this once again. I know we have to have views and trends as journalists of the online, but also let's also be very keen on respecting people's marriages. I as Dr. Funke, I am happily married, bald italics and the line. And I respect the marriage of Diana B as well to Bahati because Bahati is a young man that we've seen grow in the gospel industry. So I would really want us to be very keen. As much as we are looking for clickbaits, let's also be very keen on, we see, the spirit is speaking. Kamerazina Anguka, hallelujah. Dr. Funke? Pro Funke suali lamu isho tu. Toka apakwansa. My name is Chief Tokaplag TV. Bona ulihacha komedi? Takwambia badai. Uknejeri helikata? Tukotu. Ikitu si puchezo ulizo binana mimi wewe. Urabakamini lihacha. But you're doing amazing, you're doing amazing. Thank you, thank you. First of all, suti meweza, suti pabazito. All my suits have my name on them. Oh yeah, yeah, yeah. Thank you very much. Zoom in, zoom in, zoom in, zoom in. Zoom in, zoom in, zoom in, zoom in. Ni meona. It's a bit of a hype. Yes. You've been in a relationship for long. You don't choose your wife that much as other people. Yeah. And why would you choose a perp? And maybe... Whoa, whoa, nigga, relax. Perp? Why would you say perp? Okay, talk about the perp. All right. So now maybe quite a deal up by the... Zile milionia mambazo mele poa. Yes. What you wanna say about kwa mba, when you look at kulei injerakini, kuna bile wasani wasapotum? Maybe it was supportum? Teote wuku inje? Supportunani? Wasani upcoming comedians. Now wagani? When you wanna talk, say to you. Wako ape? Waki ku approach? Wauskiza. Mabia tuku waka? Wauskiza. You see, that's the thing. Are they listening? Maybe they are watching. You see the reason why some of us are here is because we chose to listen to Eric Komondi. We chose to listen to MC Jessie. We chose to listen to Churchill. We chose to listen to Makoha. We chose to listen to Mama Lucy. We chose to listen to the late Mzeo Joang. We chose to listen. The question is, are upcoming comedians ready to listen? And no, they are not. I'll answer on their behalf. Wasing a level after 10 days, you could random video one minute. Then you think now you can charge what Dr. Fonika is charging. I still can't charge what Eric Komondi is charging. Do you know that? I still can't charge what Jesse is chasing. I still can't charge what Churchill is charging. Yet, I want to think I'm back the top comedy brands in East Africa right now. We need to learn the art of servanthood. And what the upcoming comedians don't know and what they don't have is the art of servanthood. Learn to serve under the ones who have come before you. That's all I can say.


Without question, Democrats need to prioritize getting aid and survival checks to Americans because this pandemic has absolutely taken an economic toll on folks. Get people what they need, that in the short term is going to help them. But what I've also long maintained is that Democrats have to fix democracy. Like we have to assume that by 2022, they're going to lose power. And there's going to be a turnover at least in one branch of Congress. So they have to do what they can to fix all of the flaws inherent with our democracy. And it's going to be tough to do like really comprehensive reforms. I don't expect them to abolish the electoral college, even though they should be trying to build momentum for that ultimate goal. But they do need to do a lot to at least make our democracy more equitable and franchise as many people as possible. And it seems as if they are still committed to doing one thing that could help. It's not going to be the end all be all. It's not a panacea. Nonetheless, one bill called for the People Act can do wonders if they actually pass it. Now, as John Schwartz of the Intercept reports, since the 117th Congress was convened on January 3rd, over 2000 bills have been introduced in the House and Senate. But the very first legislation proposed by the Democratic Party majorities in both chambers, making it both HR1 and S1, is the For the People Act of 2021. This is appropriate because the For the People Act is plausibly the most important legislation considered by Congress in decades. It would change the basic structure of US politics, making it far more small-D Democratic. The bill makes illegal essentially all of the anti-enfranchisement tactics perfected by the right over the past decades. It then creates a new infrastructure to permanently bolster the influence of regular people. The bill's provisions largely fall into three categories. First, it makes it far easier to vote by eliminating barriers and enhancing basic outreach to citizens. Second, it makes everyone's vote count more equally, especially by reducing gerrymandering. Third, it hugely amplifies the power of small political donors, allowing them to match and possibly swamp the power of big money. Now, we'll talk about the specifics. I will say that I think the author kind of oversells it. It is really, really, really important, but it's not going to basically save democracy. There's still more work to be done. Having said that, though, he's not wrong to suggest that this is a really, really important piece of legislation that Democrats have to pass. And it's a good sign that it was introduced first. They need to absolutely, without question, get this through within the next two years. Otherwise, I don't think they realize how difficult it's going to be for them to ever get power again, because we talked about just a couple of weeks ago how after Joe Biden won, Republicans in state legislatures across this country are going out of their way to crack down on voting rights to make sure that this victory that they saw isn't going to happen again. We're talking about voter ID laws being imposed, more voter purges, more barriers to voting. If they enact more obstacles to voting, then they suppress voter turnout, which is always better for Republicans. So if Democrats don't do something to combat that, they're not going to win again. It's going to be a lot more difficult. Like it's going to take another substantial thing like a bush or a Trump that makes power turn over again.  Don't even think it's real. So we have to make sure that democracy is fair if we want a fighting chance. And Democrats have got to enact this. So what does this actually entail? Why is it so important? Well, I'm not going to read the article for you, but I would recommend the article if you want further context as to why all of these things are important. Nonetheless, here's what it contains. So it would basically subvert the draconian voter ID laws in all of these states. So that way, if Republicans choose to enact them, they're still legal. However, voters can subvert these voter ID laws if they sign a sworn statement where they attest that they are who they say they are. And so that way, if they're lying, they can be held legally accountable. This is really important because these voter ID laws have been proven to disenfranchise people of color disproportionately. This is essential. It's crucial. Also, this would stop illegal voter role purges. This is the way that Brian Kemp won in Georgia in the 2018 gubernatorial campaign against Stacey Abrams. He did a lot of purges of newly registered voters, most of which were black, most of which were Democrat, who would have more likely voted for Stacey Abrams. And that may have been what led to his victory. Like he literally rigged that election in his favor as Secretary of State. And now he is the governor as a result of said rigging. If we stopped these illegal voter role purges, that could change the country. This giving people a voice could have a substantial impact. Additionally, it would reenfranchise felons, but only if they serve their time. This I would want progressives to push back on felons should be able to vote even while they are in prison. Because if we're going to have a true democracy in this country that requires universal suffrage, that means you can't exclude people for arbitrary reasons. Committing a crime being a felon doesn't mean that you shouldn't be allowed to exercise your rights of vote. That's one thing that must change in this bill. Having said that, though, as it is, that would still be a substantial improvement. Also, this would make voter registration near automatic. I don't necessarily know what that means. The author of this article doesn't really describe that. And on the Senate version of this bill, it's a little bit vague. But to have automatic voter registration, that would be really crucial. Now, in Oregon, we basically have automatic voter registration. So that way, when you get a driver's license, you are automatically registered to vote. That is basically near automatic. So if that's what this means, that's great. But this is a step in the right direction. It would also require states to allow early voting by at least two weeks. Really, really crucial. Because if you can't make it into vote, if you have to work on election day, you have to be able to cash your vote ahead of time. That's just basic. Also, it would mandate that all elections be conducted using paper ballots, not machines. And when it comes to gerrymandering, it would require states to create independent commissions for redistricting. To me, this is a no-brainer. It shouldn't be the case that the party who controls the most state legislatures gets to rig the rules in their favor. Redraw district lines to favor them. Like, that's not why we redraw district lines. We redraw district lines to accommodate changes in demographics, accommodate changes in development, in cities, urbanization, and whatnot. So this is just, this is obvious. This is something that should have been addressed a while ago. And I'll say the opposite. If Democrats were in control, I wouldn't want them to be able to redraw district lines to favor them. This should be a democratic process that is nonpartisan, impartial. So this is obviously really important. It would also reform the FEC to give it teeth so that way in the event politicians actually do violate campaign finance laws, they get prosecuted.  You can coordinate with your super PAC and what's going to happen. Nothing. The FEC isn't going to crack down on you because it is either deadlocked or it doesn't have the teeth needed to go after you. That would change with this legislation. Also, it would impose additional measures to prevent the illegal coordination between candidates and super PACs. On top of that, it would impose, or excuse me, it would incentivize small dollar donations by matching funds, get this, by a six to one ratio of up to $200. This, I don't want to call it a game changer because it's not going to completely eliminate the influence of big money in politics. Having said that, though, to incentivize small dollar donations would make politicians less reliance on those corporate donors, on the billionaire class. Because if you're matching funds by a six to one ratio, what does that mean in practice? If you submit a $10 donation to a politician, that gets matched. So the total donation will actually be $70. That's huge. That is really important. If we had publicly financed elections, the difference that would make would be incredible. It really would democratize our democratic process for lack of a better word. And this includes primary campaigns as well. And the reason why that's important is because a lot of these incumbents have an advantage over insurgent campaigns. So when we're talking about progressives, for example, I bring progressives on my channel who are running for Congress all the time. And the number one thing that they cite that makes their campaigns very difficult to win is a lack of resources. They're going up against political behemoths who outspend them 10 to one. This would actually level the playing field a little bit. If these people who are running for Congress build these mini grassroots coalitions and we're matching those funds by a six to one ratio, you potentially have it so they can out raise incumbents if those incumbents don't have people power behind them. That's huge. Additionally, I'd have to learn more about this, but it sounds good. It would create a code of ethics for the Supreme Court. So needless to say, all of these things, I think objectively speaking for small D Democrats is positive. If you support democracy, this would strengthen our democracy. It would allow us to further consolidate democracy, bring more people into the process. This is this would be great. Now it's not perfect, right? It's not a panacea. It wouldn't solve all of our problems. Because as we've learned over the years, capitalism is like a virus and it attacks any progress that leads to, you know, them not making as much profit. So if one law stops large multinational corporations from being profitable, they're going to get that overturned. So this isn't like going to end all of the issues that we have with democracy. Having said that though, it's really important, but there's other things that I wish were included. First of all, I wish that there was a provision in this to make voting compulsory. Now I don't care if that is by stick or carrot approach, I would prefer the carrot approach. But if you make voting compulsory, that increases turnout. Australia has compulsory voting. And guess what? It works. Now you don't have to punish people, right? You don't have to impose a penalty or a fine on them if they don't vote. But you can incentivize voting, use the carrot approach so that way if they do vote, and they show proof of voting when it's time to file their taxes, they get maybe a $50 credit, something simple. But doing that will go a long way. So people think, oh, well, I need to vote so I can get my $50 tax credit at the end of the year. It's something as simple as that, that really could make a difference, that could encourage people to participate in the process. Because part of the issue is people don't vote because they don't often see like a big enough difference between Democrats and Republicans to warrant the payoff of coming out to vote, waiting in line for hours. But if you incentivize that even a little bit, that can make a huge difference. Also, I think that voting needs to be a national holiday. The two-week early voting period is important, but it should be a national holiday. Additionally, there should be a tax on super PAC donations. So that way those are disincentivized and politicians don't rely on them since they're taxed and they don't get as much money. On top of that, I think this is another no-brainer, rank choice voting that would drastically change this country and wouldn't be like right away. But this would get rid of the spoiler effect that Democrats complain about. You're worried that, you know, lefties voting for the Green Party is going to spoil the election and lead to a Republican winning? Well, rank choice voting is going to solve that problem. Now, the issue is that Democrats don't want to do this because then they're potentially ceding some of their power to a third party or a fourth party. And both Democrats and Republicans want to preserve the status quo. They want to preserve the amount of power that they get. And if you institute rank choice voting that could open the door to more parties actually winning seats in Congress and they don't want that. But anyone who's against this, they're not serious if they claim to care about the spoiler effect. Just keep that in mind. So overall, though, really, really encouraging to see Democrats still floating this idea. Back in 2018, when they first took power, I actually praised them for this because they floated the For the People Act. And I wasn't sure that they were serious about doing this because they have an incentive to rely on these big dollar donors because that's how you get elected. So there's going to be a lot of lobbying. There's going to be conservative Democrats who want to water this down. But this is where we really need members of the squad and progressive Democrats and principled Democrats to come in and fight. Because if this were to pass, this would be phenomenal. Now, there's more things that need to be done. You have to fight for statehood for D.C. and Puerto Rico. Get rid of the electoral college. It's an antiquated system that doesn't make sense. It suppresses democracy. But having said that, though, in the event this were to pass and Joe Biden were to sign it into law, would it make a substantial difference? Without a doubt, this would make a substantial difference. But if something like this were to pass, it would be attacked immediately by capitalist forces, by lobbyists. So it would be a fight to protect it. That's what we need to do. We can't not pass legislation because we fear that it's going to be watered down or attacked. You know, everything that we do in a capitalist system is going to be attacked. If we ever get Medicare for all immediately once that's codified into law and enacted, it's going to be attacked by private insurance companies and lobbyists. That doesn't mean we don't fight. That doesn't mean that we be discouraged. It's a constant process. It's a constant fight. And something like this would make a difference. And I'm honestly pleasantly surprised that Democrats are still pushing this. So credit where it's due. If they can get this passed, then they get a lot of credit. If they fail to pass this, then they should be absolutely laughed out of the room. This is like the bare minimum that they do if they ever want to win power again. And this isn't like them rigging the process. This is them like democratizing elections in the United States, which is kind of important if you believe in democracy. But having said that, though, we'll leave that there. If you believe in this fight for it, put pressure on them to pass this. They reintroduced it, and that's a really good sign. But I don't think that standing idly by and crossing our fingers that they passed this is a smart political strategy. If you want this fight for it, there's got to be grassroots energy that applies pressure. Otherwise, Democrats aren't going to feel the need to pass this right away when they absolutely have two years. That's it. You don't pass this within that window. They are fucked and Republicans will continue to hold at least some power for a very, very long time, enough power to stop something like this from getting passed, enough power to continue enacting draconian voter ID laws and suppressing the vote. So this is great.


Hello, this is Nick from Laptop Media, and today we will show you how to open the Acer Aspire 5 A515 58M. For removing the bottom panel, you have to unscrew 11 Philips head screws, then, you can pry the plate with a plastic tool starting from one of the top two corners. Please remember, it would be of great help to us if you just hit the like button and subscribe to our channel. That would motivate us to make even more and better videos for you. The battery is a 53 watt hour unit. Before taking it out, you have to detach the connector from the motherboard. After that, you have to unscrew just two Philips head screws. On the inside of the bottom plate, there is a dedicated socket for the battery that keeps the unit in place. The capacity is enough for 12 hours and 30 minutes of web browsing, or 8 hours and 20 minutes of video playback. Good. This laptop has a soldered memory. However, the maximum amount of 32GB of LPDDR5, 4800 MHz RAM, sounds plenty. For storage, there is just one M.2 slot for Gen4 SSDs. The cooling looks modest. It comprises one fan, two heat pipes, one heat sink, and a heat spreader.