Are we on? Oh, yes, we are so on. Hello, folks, and welcome. This is the SIG Security talk here on the maintainer track at KubeCon NA 2022. My name is Alah Dewberry. I am a product manager at VMware in the office of the CTO and subproject lead for the self-assessments subproject. Hi, everyone. My name is Savita Raghunathan. I am a senior software engineer at Red Hat. I am the subproject lead for SIG Security documentation. And hello, I'm Tabitha Sable. I'm one of the co-chairs of SIG Security. I'm also a member of the Kubernetes Security Response Committee and a staff engineer at Datadog, focusing on infrastructure security. So click for me. So yeah, thank you so much for coming to hear a little bit about SIG Security. I'm super happy to share it. We are a horizontal SIG that works with all of the other SIGs within Kubernetes to continually improve the security of the Kubernetes project, both the software and the user experience for our users and also things within the project. So the way that we do this is really specific. We focus on building community. We focus on building relationships within Kubernetes and with folks out in the rest of the world. Because Kubernetes is a large and complex project, but even in something simpler, security is not the sort of topic that one person or one entity or one authority can assure for a project, for an organization, for anything. And so since any contributor can potentially make the security of the project better or worse, we are focused on ensuring that everyone has the possibility to come together, learn, share what they know, and together improve the security of the project. So we do this by making documentation, process, and feature improvements within Kubernetes. So that means that sometimes some KEPs appear in a related SIG, and they say to themselves, this has security implications. Let's also go and talk with the SIG security folks about it. Sometimes SIG security folks, I don't know, wake up or get out of the shower or whatever sort of thing gives you ideas. Sometimes SIG security folks say, I wonder about. And then when that happens, we discuss it. Everybody brings their thoughts, their experience. And sometimes those things go out to other SIGs. And we say, SIG security has been thinking about this. We wonder what you think about it. Is this something that you'd like to work on together? And then that happens. And then we see KEPs, we see improvements. And it's all based on talking to each other, sharing our learnings, and using consent with each other. So we also provide some security-related services within Kubernetes. We'll hear a little bit more about that when we get to the tooling subproject. And we also serve as the public forum for the Security Response Committee. Security Response Committee meetings are private due to the nature of the work. But as the SRC, it's our job to help and support Kubernetes. And that means that we need to be able to talk about some of our decision-making processes and things like that in a public forum. And SIG security provides that as well. So that's what we are and that's how we do. So we will move on to Savita to hear about Docks Subproject. Thank you, Tabi. So Kubernetes website is awesome, right? We all have used it and we still use it. Close to the SIG documentation folks, I know I see some of the faces here and all the contributors who have contributed to make it awesome. What do we do here? So we wanna just enhance the documentation by creating a security awareness. And we do that by adding tutorials, security tutorials, and then more security-related examples and keeping the things up-to-date, right? We don't want to have an outdated example. Then you just copy-paste it into a cluster and then there you go. You just created a nightmare for yourself. Some other, on some other day, not on the same day. So that is the major goal of this project. And some of the recent highlights of this project includes the most wanted feature, Kubernetes security list. So we have recently published a Kubernetes security list and all these are hyperlinks. So once the slide is available, you should be able to click on it. We recently published it. It's focused on, focused with the admins and we are hoping to, administrators and we are hoping to expand it to the application developers and whatnot. And the next one is that API risk, API server bypass risk posed by Ruri. And there is also the historical context on PSP. So we all talked about PSP for how long? Three, four releases or more than that? And finally, the PSP is duplicated and we want to know what was history of it, right? It's a nice little thing. It's like a trivia thing. So one of the contributors, Mahe, published a post and my favorite thing is the historical chart. Like if you go to the blog post link there, you can see the timeline and that is my favorite part of the entire blog. In addition to all the years, of course. Can we move to the next slide? Thank you. So what are we gonna work on? So we have some major goals. But the first up is the hardening guide. We have already had it and then it kind of was a very big project so it kind of died down. And it has been finally revived and thanks Kailin. So this time we are gonna do a little difference. So we're gonna divide it by into multiple little tasks so that new contributors, existing contributors who are wants to like contribute, can come in and take a piece and chipboard that into the project. So that is the major idea of that one. And then we're gonna add more tutorials, mainly our back, that is like one of the goals, personal goals that I have. Hopefully I'll get to that or like I'll let any of the awesome contributors get to that. And another thing that we have been talking about is the confidential Kubernetes. So there is quite the buzz and we are, they're all like awesome contributors again working on a blog post. So look forward to that sometime in the quarter, next quarter, sometime next year hopefully. So we'll get that out. So those are the interesting things that we are working on. We are also in need of contributors. So if any of these things is interesting to you, just stop by our meeting and stop by our Slack channel. You can stop by and say hi and seek security as well. So that's all from docs. I'm gonna pass it to Tabi for audit. Yeah, thank you so much. We have third party audit sub project, which is organized by my fabulous colleague Ray, who you may also know from the release team and SIG docs. And the third party audit sub project focuses like you would guess from the name on facilitating periodic professional external audits of the Kubernetes code base. And this provides us a couple of different values. It helps to serve as a check for the work that all of the contributors and maintainers are doing all of the time to represent security needs within the work that they're doing every day. And it helps to discover new potential problems so that we can address them earlier before, hopefully they are discovered in the wild and used for some kind of harmful purpose. Organizing a professional code audit of a large project like Kubernetes requires lots of logistics, requires a lot of communication with the selected vendor in order to help to guide them through an effective way to take a journey through the huge code base. And the folks from the audit sub project have done a great job of sharing their expertise with our vendor in order to get them into the right places and find things that might go bump in the night. They've recently published a blog post about a retrospective of the previous audit that completed in 2019. It is talking about the status of the various issues that were found in that audit. And so we wanna thank Kailin, Pushkar and Rory for the work that they did getting that blog post together. The current audit that started in late 2021 has wrapped up and the results from it are being reviewed within the security response committee. So we will see the full report from the auditors published as soon as the private response is completed. And they're making sure that what they learn from going through this process also gets shared back with the folks in the security self assessment sub project and the folks in CNCF tag security in order to get all of the learnings shared around everywhere so that we can all continue to get better from each other's experience. So I'll give this back to Savita. No, we're done. I'm giving it to Allah. Oh, it is Savita for tooling. Thank you. All right. Thank you Tabi. Thank you Ray for the audit sub project, leading the audit sub project in an amazing way. Next on to tooling. So this project is led by my cool friend and an awesome contributor Pushkar Jogleger. And I'm gonna talk on behalf of Pushkar. So what do we do here? We build and enhance security through code and we do that by collaborating with various sub projects and other various six in the communities. And the project meets every other week on Wednesdays and they alternate between a working session and then a learning session. The learning session's awesome, super cool. And if you are someone in the industry or someone learning and building Kubernetes security tools, you can sign up in the list and then come show off whatever that you have learned or whatever the tools that you have built or if you even find something super cool that's related to Kubernetes security, you can just bring it here. And that is really awesome. And that is one of the highlights of the tooling project as well. So if you all like me, right? So how many of you used to subscribe to the security announced mailing list and whenever there was a CV announced, you read through it and you are like, oh my God, I need to update this, I need to patch my servers, I need to do this. And then after two days, I have 1000 emails, shift delete or control delete, right? It's all gone. And then you cannot find the information in your mailbox and you have to go to the Google groups and search through and whatnot. So the tooling people automated everything and it is available in a Kubernetes website that's linked and we got amazing feedback from the community and the rest of the announcement is in KEP3203. I hope I got that right, yeah, 303. So like if you're interested, you can go and check that out. If you have any feedback and input, they're all welcome. So that is like the major highlight that's been going on. And oh, we also have vulnerability scanning. So the Kubernetes CI, which builds the images, content images and also the code itself. So there is this vulnerability scanner that has been attached to everything now so you can get the reports and what else? Yeah. And then like we, as I told as the goal suggested that we work with every other subproject, every subproject of security and also various things. That's all about tooling and I hope I did justice to the tooling subproject. Thank you. Next on to self-assessment from Ala. Mind if I scooch over here? Yeah. So hello folks. So and now for something completely different for those Monty Python fans out there. All right, so self-assessments. What are we gonna talk about? So first we're gonna do a brief overview of some history in terms of the CAPTI self-assessment that was just completed and kind of how self-assessments came to be in Kubernetes. Then we're gonna go through some tactical items like what is the goal of a self-assessment and how do you do it? And how does it also at a more strategic level, how does it empower through autonomy? And then of course I am a product manager so we're gonna talk about some roadmap. All right, so a little bit of history here. So in SIG Security we are big on the values of learning and consent and that's definitely how this subproject got started. So I'm gonna look to Pushkar and Tabby to keep me honest here because I wasn't here for this piece of history but what has been recounted to me is that CAPTI reached out to SIG Security asking for help realizing that there are a pretty important project in Kubernetes and if there were security vulnerabilities or issues with it that that could be pretty catastrophic so best to take a proactive stance to kind of uncovering that. So of course Pushkar jumped in with his experience from working in the CNCF Tag Security Self-Assessments group and said, hey, I'm gonna go ahead and rally the troops here to do a self-assessment in Kubernetes for CAPI and we're gonna see how that works. And TLDR, it was overall a positive experience and I think it was the first SIG Security meeting that I came on that we were talking about, hey, this kind of needs to become a subproject now, this was successful, this is a tool and a framework that we wanna reuse in the Kubernetes community and I had the amazing pleasure and honor of merging the CAPI self-assessment PR. And yeah, so thanks again to Pushkar for just getting it started and organizing it and creating an opportunity also for someone new in the community to get involved. All right, so with some history out of the way, let's talk about some goals. So for an individual self-assessment there are two basic goals. So it's to answer two questions. So it's basically, what is the security posture of the workflow in the project that we've modeled and then how can we improve it? So pretty simple and then of course you capture the action items that you've done from the assessment and making sure that we take those actionable things and that we actually make the improvements. Now for the subproject as a whole, my thinking in terms of a really good North Star and totally welcome for feedback on this from the community would be to fill our repo with self-assessments for all the projects and subprojects in Kubernetes. I think that that would be so, so cool. But again, let's work on and iterate on that and that goal and that vision together. All right, so part one, how do you do a self-assessment? So just at a high level, a self-assessment is the process of just mapping out a targeted workflow in use by the community. That's step one, then building a threat model for that workflow sort of like given the scenarios what could go wrong, what are the attack factors that could be exploited? And then of course evaluating the security posture of the workflow based on that threat model of the current day. So it's like what are the security controls that we have in place today and would they be effective against the scenarios that we have decided to model out? So that's really at a high level but let's go a step deeper in terms of what this is here. So the first thing, the first sort of event that happens that tells us, hey, we need to do a self-assessment is that we receive a request. So we do have an intake system in GitHub setup so that you can go ahead and request six security to do a self-assessment. So that's the first thing. The next step is to find your people. So given the project or sub-project that wants and has requested a self-assessment, the exercise becomes, all right, we need folks who are experts in the, who have deep knowledge of the project or sub-project itself, how it's architected. And then we need folks who have skills along the lines of being able to build threat models for stuff. So currently right now the next self-assessment in the queue is for the vSphere CSI driver and I need to find Sheng at some point to start coordinating that process but it's really building your team. Sort of what are the skill sets that you need to make this a successful use of everyone's time. So once you've got your people in place, the next step is to just map out the architecture of whatever it is you're building. So a lot of projects have this already mapped out so this is usually a fairly easy step but it's also a good exercise that maybe if it's a little weak in some areas, let's go ahead and tackle this. We can't secure what we can't see, so let's do it. So with that architecture mapped out, then you can start to look at, okay, what are the sort of highest priority areas that we would want to do a threat model for? And this is generally, I actually asked this for the vSphere CSI driver, what's the priority? What's the used the most in the community? Because that represents the biggest attack surface. And as it turns out it's a vSphere CSI driver for vanilla Kubernetes, so we're gonna do that first. Then it's just a question of mapping out that workflow, sort of how does data move through that system and what does that look like? Then based on that, building out your threat model, sort of how could someone who's a bit naughty exploit this and potentially make someone's day not awesome and then to just evaluate the weaknesses based on sort of the worst things that you can think of that could happen. And then of course to capture and prioritize those action items. All right, so next question, how does this empower through autonomy? So the high level answers here are to make security things that are accessible and repeatable and by virtue of doing that to federate knowledge. I think that at least for me when I got started in security at Veracode a few years back, you know there really is a lot to learn and while we need expertise and we need really deep and rich skill sets in security, I think that it's also really important to make sure that we take beginners along for the ride and we help people understand what the smalling and incremental things that we can do to be more secure and to make doing the secure thing relatively speaking the easy thing. So you know the framework and the process that I've mapped out are not inherently rocket science. It's really about getting the right people and the right skills together and then sharing knowledge with each other. I'm not a developer but I'm super excited to work with people who hack on the vSphere CSI driver and to understand more about what that project does and how it does it and to enrich my learning by virtue of that. So it's really about just taking every opportunity that we can to federate security knowledge which is done by doing things like socializing this framework and socializing sort of the more human concepts of building your team, getting the right skill sets together for success. All right, so how are we gonna keep empowering through autonomy? So by virtue of arming the community with a simple set of tools to raise the tide so to speak in terms of our security posture, you know it's really a question of socializing this tool. Who needs, who would like a self-assessment? Who wants to learn about how to do one? Do you wanna participate in one even if it's not your sub-project? Those are, it's about inviting people in for the journey. Of course when you socialize things and you ask for feedback, you get feedback which means that you can improve it and refine it. What a concept. And then of course in a more tactical sense like I've been saying, the vSphere CSI driver self-assessment is next. And my open invitation to everyone is to come join us. Actually, Savitha introduced me to someone who is in this audience right now who's interested in getting started and we're gonna go on this learning journey together and it's gonna be great, so I'm really excited. And also actually this is, I should almost cross this one off, complete the retro for the CAPI self-assessment. We actually, some of us got together in the speaker lounge and we chatted, we shared a bunch of things. I made a little stickies.io whiteboard and captured a bunch of stuff so I'll be putting that in the CAPI self-assessment Slack channel and I'll probably also put that in the SIG Security channel too just to share, you know, retro-ing is important. And then of course what could be more important than trading learnings with other fellow organists? Yeah, different peers, of course. So of course working with Pushkar and Robert Fikaglia and others in the CNCF tag security to just make sure that we're keeping an open door in terms of sharing learnings as we both do things on the Kubernetes level and at the CNCF level. All right folks, so come join the fun in SIG Security. Again, I was like, I knew nothing about Kubernetes and I argued that I still know very relatively speaking to many folks in this room, not very much, but SIG Security is a really wonderful, open and welcoming place and if you want to learn more or you're curious or you have questions, come join the fun. We're open on Slack 24-7 and that link is to our mailing list and if you sign up for our mailing list you get added to the bi-weekly meetings which are 9 a.m. Pacific, 12 p.m. Eastern, every other Thursday. So yeah, come join the fun. Come have a hunk with us, of course. And yeah, thank you so much. It's been a real pleasure to do this with you all and yeah, I believe we have some time for questions. This is awesome, so thank you very much for this. Where do I sign up? But add Ingress Engine X to the list, because we need this. Besides running through the self-assessment and making sure you're doing that quarterly, what are some suggestions that you would have to help increase the security of a project? Because I know when I get a security release from you, Tabby, it's not fun, but what are some things that we can do to help secure projects? I know it's a very general question, but it's a, security's very general. Yeah, yeah, I'll start with the specific part first. You literally can sign up if you go to the Kubernetes slash SIG Security repo on GitHub. You can go to file an issue and there's an issue template for registering your subproject's interest in having help from SIG Security to go through the process of doing a self-assessment. More generally, at that level of generality, what I'll say is there is no substitute for caring. And so by showing that you care like this, I would say you're already doing the single most fundamental thing because all of the work that we do to develop or maintain software has the ability to improve or harm the overall security of the software. And so to whatever extent the expertise that you have allows, keep security topics in mind when you're doing the work. Ask yourself when you're designing a feature, if I wanted to use this feature to harm someone, what could I do with it? And that can go into a lot of different ways. That can go into things like intentional misuse of features that can go into finding bugs, like finding parsing errors or type confusion errors in network protocols. It can, asking yourself that question, what harm could I do with this? Can lead to a lot of places. And the other thing that I would say is to continue to stay curious. So that means asking folks that you know, have more knowledge or experience than you, asking them for help when you can, reading about the topics that are either relevant to your imagination or relevant to the work that you're doing. I really see the role of a security professional as a helper role. Like I am able to spend all of my professional time learning cool, terrible things that you can do with software.  The folks who are doing the development, they get to spend all of their time with that. And so then we can meet in the middle there where I can learn something about like what you're doing or you know, whatever I'm trying to work with is doing and they can learn something about more general security properties and then we can leave having improved the project and also both learn something. So yeah, I would say care at all which you're already doing great at, do your best and be curious and keep learning. Yeah, I'd love to pass that along. Yeah, I just wanted to highlight like the part about getting social and like sharing your curiosity honestly and sharing, hey, I'm thinking about security. I would love to get other folks's thoughts especially with folks who are your peers, folks who are more junior to you too. It's really about bringing that security, like making it as incremental as we possibly can to be secure a little bit all the time, so to speak. That's where you're gonna see the biggest gains because changes always happen at the margins. In some way, shape, or form and, but yeah, I think getting social, staying curious, but also like persisting in circulating your curiosity is so powerful.  That is also a great place to like get it done from the start in the right way because it's easier to find it, I mean, it's not possible to find everything. I'm not saying that we can do everything but sometimes it's easier because the third party will have the eyes for something that you missed and it would always be nice to get like a, another opinion. So that's all I want to add. On the NGENX, you know, ingress security kind of issue, we have some researchers that are working on actually looking at the runtime packets that are coming in, evaluating changes, you know, what's going on? Is this a pattern that we think, you know, should be looked at deeper and then finding, you know, privacy information or whatever, you know, security kind of data that's being passed across that. The guy's name is David Hadass. He's putting together a presentation, I believe, for SIG Security and I think you guys could probably work together a little bit on that. You might be interested. Yeah, he's got a blog post coming out. He's working with Knative and the project is called SIG Guard and I believe there's a little, so yes, the social activity here, having many summits maybe for security, for certain portions of the horizontal space. I'm a maintainer for Container D. All the time coming up with security issues. It would be very nice if we could probably start doing some mini summits around, like right now we're just doing the username space isolation sort of in our own little, you know, hovel, it'd be nice if we could expand that out a little bit. More public discussions I think. Yeah. Any more? Questions? Adam? So I have a question about the self-assessment process in general. Given that you're doing things about security and there's always some concern that if you are leaking a potential vulnerability or if you discover what you think is a vulnerability during the assessment process, how do you ensure that as you're going through that, that we're protecting the end user community and that we don't expose something that could put people at risk without something that can at least mitigate the risk? I think that's security response. Yeah, those kinds of questions, given the roles that I have both in the private space in security response committee and the public space in security, those kinds of questions are always really in the front of my mind. And the way that we deal with that is by trying to work as openly as we can while making sure that we aren't sharing things until we know what they mean. Because sometimes, yeah, like you're saying, sometimes as you're working through threat modeling a system or a process, you could find something that seems like a nice improvement and let's file an issue about that someday, but you also might find things that keep you up at night. And then in those cases, the folks who are working on that know that they can contact the SRC and go through the existing private disclosure process for that, like short circuit that, it doesn't have to wait until the end of the self-assessment. We have time for one more question.


On the Willoughby slope in Langley, we have a hugely growing community, very, very fast growing. Lots of families moving in, lots of pressure, and we needed a school. And today we're celebrating the opening of Lynn Fripps Elementary. Having a new school in the Willoughby area, I think it's very important. This area is one of the fastest scoring areas in Langley, in the Township of Langley, and we need the schools, and this school is fantastic. This has created a space for students to attend, relieve some of the pressure at our other schools. It's also a state-of-the-art facility, so we're very excited to have that in this neighborhood. We've only been open for a hundred days, and many children have moved from around the world to here, and now they can see themselves as a whole, as an entity. And with the passion of what Lynn Fripps brings to us, we're going to move forward. We're deeply honored that Langley has chosen Lynn's name to represent this school. It's such a community-based school, and she was so community-based with all that she did. And I was just brought to tears with the choir today, as they said how they're going to let it begin with them, and they're going to make the future through them. And that was very much who she was. It's very much what this community stands for, and how well they behave today as an example, how our youth of today are just amazing and leaders of the future.


What's the name of this trip? Uh, a family brigade camping trip in RV. Can you show off my blanket? Touch him, he's crying now. Why are you trying to give me a rest today? Bro, in this political climate, keep your hands to yourself. Blanted, Burbank. Quick, work out. Little deadlifts, little upper body pump. Now we're gathering supplies. What is this trip called? What needs a name, dude? Celebrate TNT. What's the trip called? Dang, is this for 4th of July already? Oh, Memorial Day. Should we light the force? We're going to Nevada, where they have real fireworks. Where they have real fireworks, dude. I'm not that bad. Dude, we could Photoshop it. Consider it. We could have Connor make it an edit. Connor, go. Edit some, like, the people are getting sprayed. Make it 3D, like avatar. Yeah, yeah, yeah, yeah, yeah, yeah. Yeah, yeah, yeah, yeah, yeah. What about these two being placed next to each other? These two in particular. What are your thoughts? Whack, whack, whack. Fire. It's everyday, bro. Me, Nads, Evan, Dems, Aaron, Bart, Kwan, Gio, and Baby Tyka. Hence, the earplugs. Need my beauty sleep, you know what I'm saying? We're going to be RVing it, roughing it. Quick trip to the Southwest, California, Nevada. Do you want to look for a shampoo? Why are we in this aisle, dude? Dude, we're looking at my fucking... Your future. The following shots. Those are him. Oh, is that you? Shout out to Best Fit, Depend, Brandeal on the way. That's Natty. It's not my collaboration. It's not Natty. I'll see how long I can go without finding actual toilet if they want to sponsor me. Packed up, ready to go. Really excited. I haven't been to the Grand Canyon, like I said, until I was like 8. Since I was 8. I haven't been, like, camping, probably since, like, high school. Art school I went to kind of forced you to camp. Well, at least once a year, if not more. I was never a big fan. But now you're kind of doing it with your friends and adult. Plus, it's an RV, so it's going to be a little bit nicer, a little bit easier. The crew is supposed to get here about 7. And it's time to roll. Baby Tychus had kicked in at the whole time. Park on. Geo. Should be exciting. Cool relationship with these guys. They've been friends for a long time. Got really close with them really quick. Share a lot of memories. A lot of mutual friends.  We'll see downstairs. We're going to run an experiment. I don't know if you guys know or don't.  I think she's a great person. I'm going to be very, very nice. I think she's a wonderful mother.    But just so you guys know, here's the proof. I'm the nice guy. She's the rude one. Have you ever been to the Grand Canyon, buddy? Never, have you? Yeah. When I was like 10. I've never been to the Grand Canyon. And I have been to the Cabasute. It's cool. I went there and I was on drugs. So I don't remember half of it, but it was pretty fun. Oh, was that with Fluffy or something? Fluffy, Fluffy. Oh, Muffin? Yeah, that was with Muffin. Muffin, that was close. Yeah, that was with Muffin. Muffin, dude. Yeah. You know what they did? They rented a minivan. Yeah. Similar to this situation? It's a bigger minivan.  They gutted out all the cushions and they filled it all with ecstasy. Is that what you did to us and you're not telling us? No. There's no drugs in here? No. No, we leave them on hot-ex. We are trying to buy a new house.  No. Do I not trust you? This is considered a house. Have you been to Grand Canyon? Yeah, I have. Oh, really? Yeah. My parents love me. Wow. Wow. Recently? Recently or not? No, when I was small. So you don't remember? They hated me when I became a teenager. So you don't remember? Oh, no, I remember it. I just didn't do much. I don't remember it. Like, we just went to the top and you just see the crevice and then we took pictures and it's like, alright, let's go. Because it's part of a road trip. He's not sleeping, right? He was... He looked at his eyes and started laughing. What's he seeing? Jurassic World 2? Come on, bro. Halfway on the road trip, way early morning for me. It's time to stretch out. I think we're about two or three hours in. We're in Palm Springs. Lake Havasu is another two or three, but a little cafe, breakfast. I normally don't eat this early, but since I've been up so long, I'll probably munch down a little something.  We'll give you a little view of the RV on the outside. Dirty ruins. I'm like, where are we? Elmer's. Then... I would do... If I'm going out, I'm probably going... That guy... That guy... That looks delicious. Yeah, yeah, yeah. Sure, good dancer. You're a...  Oh, breakdancing. First, he had the hips from the Latin side, now he's got the breakdancing from the Asian side. Oh! Oh! Yeah, he just pooped his shits right all over us. I was good dancing. Have a high-five? High-five?   Come on! What are you doing? What are you doing? He's putting his hips in that thing! You're not getting out! Now he's back! Yeah! Yeah, buddy! Slipping the DMs or what? Who's? Are they having freedom to slip in yours or what? Now, yeah. Yeah, do you slip on in, dude? All the guys. Dude, what's your Instagram? Like, Bradley.Martin or something? It's e-v-n-c-h-v-n. And he'll take whatever in the DMs. Lady, guy, just c-h-n. Plus, e-v-n-c-h-n. What are you doing over there, my chemical romance?  What, are you a pro? Is that what you do for a living? Yeah! Awesome. Have you seen how to lose a guy in 10 days? Have you seen how to lose a guy in 10 days? Probably. Yeah. This is a lot of followers every day. I do not make money every day. Yeah. What's up? About a third of the way to Havasu. Yeah. Quick stop. Coachella, bro! Coachella! Coachella! Yeah! Yeah! Yeah! Yeah! Prime of the three hours to go or roadhog in it. Can't be stopped. Bart's looking for the most picturesque picture he can't. Instagram is behind the scenes.


of the colors of the United States and the playing of our national anthem. Our game day environment, because our patriotism to what we do here, the gifts that really pumped up, of course always thinking about those who are making the ultimate sacrifice for our freedom, I think is really important. We try to do as much of that as we can.


This is covering the spread part of the Fandall podcast network The next three days are going to be hectic. We got the final couple days of the NHL regular season coming up tomorrow We have the final NBA playing games and on Saturday the full NBA playoffs began It's gonna be crazy gonna be wild gonna be a lot to bet So we're gonna have Tom Becchio on today to break down his thoughts on both the final our second to last night in the NHL And also talk about tomorrow's playing games and the NBA playoffs on a Saturday welcome on into covering the spread That's right here on the Fandall podcast network and number fire.com. My name is Jim Sonnis I am a senior writer and analyst for a number fire joined here as mentioned by Tom Vecchio checking out on Twitter at DFS underscore Tom Thomas this I think this is the first time we talked to you since Quinnipiac won the frozen four So national champions have you come down from the high yet? No, thank you. It certainly was an exciting game I obviously wing 10 seconds into overtime after you know coming back down from 2.0 Is great to see you know third time in the last 10 years. They were in the national championship They finally got a win should only point up for recruiting and continuing to build a program So I am doing awesome, you know, my friends. I obviously were all talking about the game Very exciting. We wish it could have been there wish they could have won when we were seniors when they're there for the first time But nonetheless, it's great to see a win. Yeah, I'm curious what the more Minnesota moment was losing in a championship game in OT with 10 10 seconds in or Blowing a huge lead in a play-in game A couple of nights later It's tough up there. Yeah, they're both very Minnesotan It's it's it's rough, but I'm glad that the Benefactor of Minnesota being its typical sports self was Quinnipiac and you so congrats, Tom Hopefully you enjoyed that and now you get a crazy sports schedule for the next 55 I don't know whatever math hours Until the NBA playoffs began. So you guys just about that too with all the NHL and the NBA really hitting their peak right now Yeah, absolutely. I think this is a time where You know depending on how you view the NBA if you're you know, not into the NBA at all You know a lot of people don't pay attention on a day-to-day basis in the regular season like this at the time where you can You know see these high leverage games high leverage moments that you know provide the best of the action that we should see the Best of the stars and really present an awesome betting opportunity Yeah We're talking about that both the Friday playing games will talk Saturday's games talk some futures and much more Then we'll dive in the NHL slate later on all right here on the show for today But first a reminder to make sure you're subscribed to covering the spread wherever you get your podcast yesterday We talked to dr. Ed Fing to talk about some NFL draft betting We talked about a prop that he likes there also talk about ways you can bet NBA despite not knowing it as well as Tom may talk about some tools that Ed and I both use for that find that on the covering the spread podcast feed and Over on the Fandall YouTube page speaking of the NBA playoffs They are here you can turn crossovers into cash with Fandall just visit Fandall right now They place a $5 bet and you'll get an instant 150 bucks in bonus bets win or lose There is no better place to bet all the playoff action than America's number one sportsbook Just go to Fandall and sign up to get a hundred and fifty dollars in bonus bets when you bet your first $5 Fandall official sports betting partner of the NBA must be 21 plus and president select states Fandall is offering online sports wagering in Kansas under an agreement with Kansas star casino LLC Bonus issued is non with trouble bonus bets that expire seven days after a seat Restrictions apply seed terms at sportsbook.fandall.com gambling problem call 1-800-GAMBLER Or visit Fandall.com slash RG and Massachusetts Hope is here Gambling helpline ma.org or call 803-27 50-50 for 24 seven support in New York 1877 a hopin wire text hopin Y in Arizona 1800 next step or text next step to five three three four two in Connecticut one eighty eight seven eight nine 7777 or visit ccpg.org chat slash chat in Indiana 1809 with it in Wyoming, Kansas 1805 to 247 hundred in Kansas KS gambling help calm Louisiana is 1807 770 Stop in Maryland and the gambling health org in West Virginia go to 1 800 gambler.net Now we're gonna begin things for today talking about the final NBA playing games on Friday We got the bowls and the heat and the thunder and the wolves trying to redeem themselves that Back on Tuesday night when you look at these two games Tom any bets you want to lock in right now Yeah, starting off the under 227 and a half for okc in Minnesota. We should see Rigo bear return from Minnesota Obviously altercation the teammate is suspended one game. This is not official yet But you know, we saw the line for Minnesota versus Lakers that line was was super high And you know Rudy bears absolutely very good defender and you know, especially presuming that he does return You know this line, I think he's had a good spot But it's definitely trending towards the under at least in my mind with the matchups Specifically what we saw with Minnesota against the Lakers where they slowed things down a lot I mean this game went that game went to overtime and we're ending with like under 120 points Which is not something we traditionally see in the NBA especially in today's the way today's game is played So to 27 and a half I think is a touch too high compared to the other game I mean to await I think might be the lowest over under I've seen literally all season So if we're gonna continue to see these unders I want to jump in now at 227 and a half and listen for the heat And if we just like take this step back of like the heat first game that total is 228 versus the Hawks And that has dropped 20 points Obviously not expecting this total to drop 20 points But just under that same assumption where people are expecting points They're expecting all these stars to be out there But that's not the way the teams operates in the playoffs They try and play a much more controlled style and that does not you know tend to lead to a lot of scoring And that was one thing Brandon discussed on our show on Tuesday was the slower pace in the NBA playoffs and that manifested for the under like you said despite OT For the Wolves and Lakers also the under for the heat game there as well So you're liking the under 227 and a half for the Wolves and the Thunder for that later game on Friday Anything for you in the Bulls heat or is that one pretty efficiently priced in your eyes? Yeah, that was looking pretty good to me I was looking at some of the player props in that one and this is one of the tough spots It's like you know Zach Levine was super efficient last night for the Bulls He was 12 of 22 from the field, you know didn't need to get a whole lot from downtown He's always been a very efficient mid-range shooter getting to the basket And I think his points prop is at a good spot tonight And he's a high usage high shooter know high high volume shooter for the Bulls It's like I don't want to take an over on a player that is acting where game has a two-way it over under I'm not expecting a ton of points So I think everything is super super tight in that game and ultimately it's probably just the stay away for me Yeah, I think that makes a lot of sense. Okay, so for the Friday games We are liking the under there for the Wolves and the Thunder at 227.5 now the fun thing with being here Tom is that we have these two games to finalize things But most of the matchups are set for the playoffs in the NBA and we've got futures We've got finals markets conference champion markets We've got individual series markets as well when you look at the futures markets Tom broadly Anything you like that you want to get set before tip off on Saturday? Yes starting off that would be Devon Booker finals MVP at 20 to 1 and I spoke about this on Tuesday when I did a segment with stadium for their playoff preview and You know betting on a finals MVP when we're two months out is obviously Very unique thing. It's actually tough. The team needs to make it there So ultimately I want to look for a combination of a team that has a high probability to make it to the finals and then You know be a player that has the potential to win and obviously see we want good odds all these things rolled into one So right now the Suns are plus 190 come out of the west. They're the favorites come out of the west So, you know, we are in a I would say a good spot right from the jump And then if we just look at the differential between Devon Booker at 20 to 1 and Kevin Durant sitting there at 7 to 1 That like kind of implies and what I said in the segment was like that kind of implies like it's number one for Durant And Devon Booker is the number two option in their offense when that's not the case It's like a 1a 1b scenario on any given night It's like Booker is going for 40 Durant can obviously go for 40 Where the prices are too far apart for their actual roles on the court and the production We can see from Booker. We've seen Booker in the finals a couple seasons ago against the box when he's putting up 40 points So I like Booker just from a fundamental standpoint where I think the line and the differential between him and Durant is just too large Right and it's one thing where you could say, okay The narrative here is Durant joins a team mid-season and kind of catalyzes a finals run But that's baked in here with with Durant at 7 to 1 and Booker at 20 to 1 That's a big gap and I think it sounds like in your eyes They're fully accounting for the narrative advantage that KD may have here, right? I think Durant's number is certainly perfect where it is at 7-1 That's probably where it should be given, you know It's in the Coompo and Embiid and all these players are still here with Curry etc, but like again that differential implies Like that there are two different like ceilings of players when Booker can reach a 40 point ceiling in finals game So I'm jumping on a differential regardless of what the outcome might be I think it's still like objectively a good spot and we have a large of a sample on KD with the Suns to know that Booker does not disappear. So I think that that is beneficial there as well Okay, so for futures like in Booker 20 to 1 to win the finals MVP Which you can find in the NBA finals tab over at Fandals Sportsbook Any futures other futures you like here Tom before we talk about Saturday's games? Sure And I'm gonna use the Nets and the 76ers playoff series Pricing as an overall example and I think it does present a good example But I just want to use like this concept overall So the 76ers remind it's 800 on the money line to win the series. No, I'm not betting that I don't think many people are and then you're okay. You're like, okay What if I took the spread the series spread? Well, it's minus two and a half and it's minus one sixty two for the 76ers Like ah, I'm probably not betting that as well. But what does minus two and a half mean they have to win by? three games Right. So if you look to the exact series predictions, right? It the in terms of the exact outcomes of the series The 76ers at winning 41 or winning 4-0 those are both at plus money and that implies that they're winning by three So just like using this as an example if you want to put like half a unit on each or Whatever it might be you are getting that minus two and a half if you nail that exact series score So just because this is this minus 800 is so large. It's minus two and a half It's minus one sixty two like I'm not betting those if I try and just nail the exact series score We're getting them all at solid plus money So that's the route of trying to use in a lot of playoff series for both NBA and NHL Where you have to find that alternate market that does provide value Based on what the odds are telling us like the odds are telling us the 76ers are going to dominate the series How do we take advantage of that for the most plus money? It's going to be at four to one or four zero series Exact score, right? I think that's a good takeaway always With series markets finding the best route to bet your assumption your assumption is the markets are properly pricing in the sixers How can I take advantage of that? But then also with player props with markets with spreads and stuff like that I have this assumption What is the best route for betting that because we have the typical markets, but you've got a full menu so Take advantage of that and use that to your advantage weaponize that because we don't get a lot of legs up In in betting we are at a disadvantage pretty often But make sure you are fully exploiting the good advantage you get in this regard Now I want to focus on saturday tom before we talk about the individual games player props and stuff like that There is a pretty big adjustment here from Talking about worrying about playing time down the stretch to going to the playoffs where uh-oh That is no longer a concern. We are going the opposite way. So how aggressive are you in Upping minutes projections in your mind for key players. Uh, what about role players? How do you adjust for them? How are you making those manual adjustments in your brain to make sure You're accounting for new expectations in high leverage games Yeah, so this is always an interesting question the difference between regular season mba and post season mba and The examples that i'll use I hate the cherry pick box scores, but it just Shows what i'm trying to say so so clearly and it's in these A few most recent games between the hawks and the heat and the bulls and the raptors You know games that's a place to pass tonight. So for the heat in that game They had five players come off the bench But three of those players played at nine minutes or fewer nine four and three minutes That means a two key players come off the bench played 29 and 33 minutes They were essentially running a seven man rotation and the exact same thing For the bulls where they had five players come off the bench three of those players played four five and six minutes The other two players played 25 and 25 minutes. So we are seeing extremely tight rotations Now what does this do for the starters and for the key players someone who already mentioned zack labine You know superficial shooter from the field high usage player primary player and all these sorts of things He averaged just about 36 minutes per game the season last night. He played 40 So and I said this at the deadline in terms of the minutes It's like, okay, what is an extra three or four minutes do but when we have a high usage player You know, he's going to be taking extra three four five field attempt zack labine can be very effective from downtown He's going to be piling up the assists when you take a pra bet on these players that may only be seeing four extra minutes You know, that could be you know, six seven touches on the ball That could be to assist, you know, two three pointers wherever it might be So everything is going to be tightened just a little bit and I'd be willing to go to these high usage players Again for pra bets just because they can do so many different things So when it comes to the role players, I am shying them out from point props But rebounding plot props they're obviously can be very effective Especially if you see lower scoring games because lower scoring games mean turnovers mean more miss shots mean more rebound so you know someone like on a pj. Tucker on on the 76ers If if you are betting on the mba or you playing mba dfs or my pj. Tucker could go 10 games in a row And score a total of 10 points like that's not even exaggeration But he plays 35 minutes a night and he's piling up 30 pounds So I'll never look to him for points, but the rebounding prop could still be there depending on the game environment Are you pulling a clean cappella here and looking for like an alt rebound over 20? Like are we doing that with pj. Tucker, you know Maybe not pj. Tucker, but yeah, you can ladder some of the Uh, some of the the rebounding props that could be for something like rudigo bear who who can put up 15 18 rebounds in some of these games I mean going forward Maybe it's in bead. Maybe it's yokich like whatever might be like we are going to see heavy minutes for them And that just means more consistency and the projections you can bump them up 10 percent Right, you know across the board How much does a decreased pace negate the impact of increased minutes because pace hurts everything But then you do have Three or four extra minutes which matters a lot like you said So does that weigh in for you as well the reduced pace in the postseason? It does and and like I said, it's it's reduced pace extra minutes, but extra minutes on only high usage players of what I want to be focusing on so right Like can take this call will poke on denver is a really effective three-point shooter But he's never the primary ball handler and oftentimes he's fifth on the team in usage It's yokich murray gordon michael port jr. Then kcp So just because he happens to be seeing an extra five minutes doesn't necessarily translate to actual production Yeah, okay, so it's important to weigh those things in your mind kind of know the dynamic roles people may have Whether that role will be scaled back at all stuff like that factor in pace factor in everything I know it's overwhelming But it is necessary if you want to find a good edge here in the postseason now We do have player props up for these saturday games over at faddle sports book They were kind enough to release those pretty early. So when you look at the games on saturday tom Where are you seeing value right now? Starting off that first game Nick clackston of the brooklyn nets under nine and a half rebounds minus 125 The he's the starting center for the nets We don't necessarily see the nets with a ton of size on a nightly basis and we know jill and beat is obviously dominant out there But what in beat is also very good at he's going to drawing fouls And that absolutely puts clackston in tough spots. So Defensively if clackston starts racking up the fouls a he's not going to see the court Which is great for unders for anything And then b if he does start to accumulate some fouls the nets might try to Like ice or not like Iceland but insulate him away from in beat and just bring him help So he's not piling up the fouls and obviously then he's just out of the game So clackston is a good rebounder. He's not great.  So the number you mentioned for clackston under nine and a half minus 125 due to Match between b the fouls he could draw Pace is also a factor there obviously as well. So clackston or nine and a half is where he's going there Any other player props you like on saturday? Yeah, domitus a bonus on the sacramento king's under 41 and a half pra points rebounds assist sitting at minus 111 We know that Both the kings and the warriors are to the highest scoring teams in the league that kings led the league in scoring this year They're one of the best teams all time when it comes to offensive efficiency Now subbonus average 7.3 assist per game for the kings this season Which led the kings the starting center for an mba team led them in assists not the air and fox That's how good subbonus is but what what do we know from the warriors? Uh, the warriors have dream on green. It was an excellent defender and Ultimately these teams are kind of mirrors of each other of kind of copies of each other where Dreamland's going to probably look to to take subbonus out of the game They're going to try and remove him because he's such a key cog in their offense facilitating their offense He leads them in assists So it's not going to be surprised to see curry and and fox and you know Keegan Murray for the kings set the mba record for the most three corners by an mba rookie So it's not going to be surprised to see all these guards scoring But they're going to try and take subbonus away because he's such an important part of their offense and dream on We know is so good at that It doesn't uh, you know, lead me to a lot of confidence in subbonus despite him being probably one of my most profitable players all season And 41 and a half is not a huge number for him either right right He puts a trip. I mean he had a set of career high leadership for triple doubles He's racking up you know these 20 and 18 games He adds in his normal seven assist and boom He's crushing it, but I just don't love the matchup despite this having a high scoring expectation It's a particularly individually tough matchup for subbonus Okay, so the number on subbonus for the pra is under 41 and a half and minus 111 Right now at fendle any final mba thoughts time before a shift focus talk about a massive nhl slate Uh, no my final thought would be to try and use those alternate markets As I mentioned with the 76ers and nets to try and and nail those correct series scores series total games Whatever might be I think that's ultimately What provides a lot of value and even if you don't have a take on which team is going to win Just like six games total seven games total, you know, it doesn't matter who wins at that point You just think it's going to be a tight series six game total could offer a lot of value there Yeah before you place your bet ask yourself is the it's the best way to exploit the thought I have going in And that's just again a general thought not just for the mba playoffs. Okay Let's shift focus now and talk about the nhl a 15 Game slate the second to last day into the regular season tom. My goodness. You've got So many choices on the board here. When you look at the nhl for tonight What are your favorite traditional market bets you're locking in for a 15 game slate? So there's certainly a lot to Consider tonight and the first thing I'll say quickly is that All 16 playoff positions are locked up the seedings are not So all 16 teams are accounted for with the aisles when last night They clinched the final eastern conference wildcards pop the exact seedings For most of them for basically all the matchup except one or two are not finalized So we have a lot of high priority games tonight in terms of teams fighting for points Number one would be the carolina hurricanes versus the florida panthers under six and a half It's sitting a minus 106 Both of these teams need points So there's and both of them need them for very different reasons the panthers Last night with that aisles when the panthers got jumped. So the aisles had 93 points The panthers had 92 points. They were holding down the two wildcard spots The panthers right now if they were to lose tonight That means they play the Bruins in the first round and I talked about the Bruins before on this podcast Where I've literally said is a shock to see them lose two games in a row They set a record this year for the most wins in regular season history So they set a record with the most points by team in regular season history. They're literally a historic team No one wants to play them in the first round Which means the panthers desperately want to win this game and move out of that second wildcard spot Which means if they win they would be playing the canes in the first round potentially Depending on what the devils do against the capital So the canes also have a priority because they want to lock up the number one seed in their division to have home mice And mean they'd be playing a wildcard team. So Both of these teams desperately need to win Which means we probably shouldn't see a very back and forth game because this could literally be the playoff match Of which we see starting next week So a very very controlled non-aggressive Defensive style of game is what I'm expecting because these teams cannot take risks Despite being awesome offenses. They cannot take risks. They have to play this very very controlled And that is a lot of motivation No one wants to play the Bruins, right? They're not horsing around Which means you can play things pretty straight here under six and a half minus one is six For the Hurricanes and the Panthers any other traditional market bets you like tonight, Tom I like the abs in regulation. It's minus 130 It might be a touch too much for some people at minus 130, but the abs are also a team Looking to secure up home mice. They can they have two games left. They play tonight and tomorrow night So they they have technically four points. They can gain which would put them If they wouldn't if they grab all four points, which would put them to number one in the central home Ice is great. They know all these sorts of things. So I like them at minus 130. They are coming off a loss They should be able to bounce back against the Jets tonight I would lean the under in this game. It's not one of my picks, but I like the abs in regulation at minus 130 That has shortened to 135 The traditional money line is minus 205. It's not a ton of movement. There is something there Yeah, minus 135. Are you still going that way versus the traditional money line at minus 205? Yeah, I would stick with minus 135. I also like the lightning in regulation. It's basically the same line But I would stick with the abs. They have more motivation to win the the lightning are locked into their spot Okay, so the lightning traditional money line minus 255 for them and their 60 minute money line is minus 170 So that's actually shortened a bit too on their end. It sounds like the abs your preferred way to go here Correct. Okay. What about player props? What do you see there for Thursday night? Sticking with the lightning It would be Braden points their top line center. He has 49 goals this season Yeah Now his goal odds are very short at plus 104 Which aren't amazing, but they're probably where they should be.  Also, his shots are only at two and a half and it's minus 122 I was expecting this line to be a three and a half You know, maybe at like plus plus 108 plus 104 But it's minus 122 for a player is 50 goals two and a half. He's a product It's clearly a primary shooter and scorer for them I'm gonna take both points over two and a half shots and point goal to get to the 50 mark in the final game of the season You go to the over under goal market for point. It is plus 104 to get over a half goals So you get that there and then the shot market as you said is over two and a half minus 122 if you're betting one of those tom preference for you or Split up both ways. I'll go the goal There are a team that has obviously long history Uh, I'll play into the narrative for the final game of the regular season 50 goals is a lot, man. I would do the same thing if I were him. I'm shooting 40 times Don't care. We're we're gunning for it for sure. Any other player props catching your eye for tonight The last one would be the Los Angeles Kings Victor Arbinson over three and a half shots seeing a plus 110 The kings also do have motivation to play and win They do not want to be they're holding down the three seed right now if They were to lose and seattle were to win the kings would drop into the wild card. So You don't want to do that. You'd rather have the three seed than a wild card all these sorts of things The kings are still without Uh, kevin fiallo, who's one of their primary shooters. So victor arbinson now has a very strong offensive role He's been over the smark and can push towards, you know, four or five six seven eight nine shots as we've seen from him so Very easy match of them against the ducks one of the worst defensive teams in the entire league I'll take arbinson over three and a half at plus 110 on a team that has motivation to win And again, that's for the kings and the duck scheme later on tonight I go to the shot market victor arbinson over three and a half is plus 110 Tom, I feel like I've made you run a marathon today Of all the different markets we discussed. No, it's good. Like this is uh A good time where we have some futures we can look at in terms of mba NHL is closing up and again You know, if you're betting on the NHL in these final two days Like stick with the teams that have motivation. I need to play and win like right now I said to you know said to you the other day where like I have the flyers under 73 and a half total points for the season and they're sitting at 73 Tonight and they're going up against the worst team in league against the blackhawks I don't want to bet on that like I'm not betting on two teams that have nothing to play for I need the flyers to lose Like do I hedge out like that's the that's the conversation I now need to have The one exception is if that team is quarterbacked by davis web Then you can bet on them the confidence in week 18 and then he can retire go off into the sunset We can all be happy. Um, so if if davis web suits up for The lightning whatever it may be Feel free to dive on in there That is top vekio. Make sure you check him out on twitter at dfs underscore tom find his work over at number fire tom Appreciate the time as always. Uh, have fun with your bets. Enjoy the next couple of days. We'll talk to you once again very soon Thanks for having me. All right. Appreciate tom as always again follow on twitter at dfs underscore tom I am on twitter at jim sonnis back once again tomorrow talks me pl Talk some mlb. We'll talk some nascar to get you ready for other stuff going on across this weekend This has been covering the spread right here on the fan duel podcast network