All right, traders, hopefully everybody can see everything, hear everything okay. Wanna do a quick audio check, just one more time. Everyone just wanna do a quick, just we'll see if everybody can hear loud and clear. All right, James, good to see you. Thank you very much. It looks like everyone's okay. All right, so let's get started. So welcome everybody, my name is Fausto and hopefully everyone is excited as much as I am because it's been a really fun market. A lot of things have been moving on the market. We're gonna talk about one of the biggest things that control the market. It's about following the money and knowing these entries and exits. So this is one of our most popular topics that we're talking about and we have a brand new PowerPoint and new demonstrations and new examples we wanna go out there and share with you. Now today's presentations give you a little heads up. This is gonna be, it's strictly educational only and I'm not making any guarantees or promises. It varies student to student but I do recommend that if you are gonna trade today's markets please be very smart and wise before you make your first trade. Now, regarding about Cybertrain University and just a little bit about myself and about the company and everything else before we start getting into the education part of it. I've been doing this for over almost 30 wonderful years. I love what I do. I've been doing, actually a market maker. I was a market maker and I started one of the first schools in today's industry. I traveled around the world. I competed against some of the biggest traders in the industry. I beat them all because the big thing you have to understand is a lot of the people out there are not traders, okay? They were not market makers. They didn't live here in New York where I was training my best traders industry. I got some of the most biggest traders that live in my own town in the world. You're not gonna beat them but don't worry, that's not a bad thing. What you can do is you could learn from them. You could actually follow them. Things that are called high-frequency trades, algorithms, dark pools. These are the things that we're gonna cover in today's event but to do that, you have to come to a reality about yourself. Now, I'm gonna be asking a lot of questions like the one I wanna ask right now. And my question is, how long has everyone here been trading for? Has it been a couple of weeks, a couple of months, a couple of years? How long have all of you guys been trading? I mean, I've been doing it for over 30 years. I do it literally almost every day, other than the days on my birthday was this week or on vacation, the markets closes. Few years, seven years, James, Tim, years. Okay, good, good. Well, listen, just started. Okay, well, let me explain something to you. The big thing you have to look at is great traders never stop learning. And regarding about a lot of you like Steve, you say you've been doing 35 years. David, you've been doing it for 13 years. Is that very active or just like obviously, just here and there, dibbles and dabs? Cause I don't count that. I count that, that there's a lot of you here that are maybe starting to retire, maybe are trying to find a new career. Hopefully not getting a lot of video game players in here, which is nothing wrong with that, cause my kids are, but if you're more of an engineer and first responders, grandmas and grandpas, I mean, you're actually really in the right place cause you want to make supplemental income. And that's why we're here. Now, my next question to all of you is this, I want to do a quick poll because polls, I'm always a fan of these polls. These polls are awesome. Now, my poll question is this, where are my, where is that? Okay, where is the one I'm looking for? All right, so what kind of trader are all of you? Okay, regarding about, we're going to talk about who trained you, have you been trained by a professional, but just a quick poll out there, just let me know your stock trader options, futures, forex, just want to know, should be seeing that poll on the right hand side. No one actually trained it, some futures, some stocks, okay. The poll actually won't show up cause I'm not the host, but that's okay. Just put it in the chat room. We'll scout some futures, some crypto currencies. Okay, Davey doing some options. All right, so let me kind of explain something really quick before we move forward, okay. I am an actual day trader, stock trader. I do some options, I do swing trading, do all that. Now, regarding about what kind of trader you are, let me just kind of just put the facts on the table. If you've been doing something for more than, I don't know, maybe three months, six months, and if you're not making consistent money, you've got two problems. Number one, you probably have not had a good mentor that taught you how to trade properly, or number two, it's just not your style. So every market trades exactly the same. A lot of psychology, discipline, charts, broker terms, we're only about maybe 30% different. So you might like the market in general, but if you're not really making money in options, you're not really making money in futures, even though you've been doing it long enough, it's okay, it's time for a change. So my goal is to teach you what the change is and how things work. Now, before we move forward, I'm just gonna put it right out there, somebody knows.  The $9 just tells me if you're a real person or not. So I'm just gonna put it out there so you know what to expect.  And for me to practice what I preach, I'm gonna invite you all to the trading room and you gotta come in there for a week.   It's the greatest job in the world, you are your own boss, but you gotta know how to play the game. And what you're about to see right now is going to be extremely disturbing because you're gonna see that a lot of you have been trading blind pretty much since you just started because everyone's so focused about the past, we're gonna focus about the future. Let's talk about a stock called AVGR. Now, did anyone see this stock AVGR this week? Did anybody trade it? Did you see, just give me a yes or no in the trading room. Quick yes or no. Frank, you didn't see it, okay. Conrad, what about you? Dan, Dan, no. David, you haven't seen it. Peter, you haven't seen it. Anyone else? No one, nobody saw this stock, okay? Well, Steve, you saw it in the trading room, obviously. Okay, let me tell you what's going on with this stock, okay? Now let's think about this for a second. Why are you here? You're here for one reason and one reason only and that is to make money, okay? You know what the second reason to know why you're here is to stop losing it, okay? Now, finding these stocks like an AVGR, just let me show you what happened with this stock. Let me get my little crayons on here so everybody can follow along. There we go, my little pointer. So AVGR right at nine o'clock in the morning, this is Eastern Time, within 30 minutes before anyone even knew about the company, we actually start trading at 9 a.m. Now I know we're broadcasting live on YouTube and everybody here, once again, if you watch me on Facebook, YouTube, Instagram, even our trading room, we actually start trading at 8 a.m. in the morning. Look at the stock move from $5 to $6 just within the first 15 minutes. Then when the market opened up, it was up to already up to 650 and this thing shot all the way to 850 by 1010. As the day went on, it went as high as 13, okay? As the day went on, it went to 15, all the way up until the close of the market and you could have traded half the hours.  Where did you find it? Why is nobody talking about it? Because a couple of reasons. First of all, they're not day traders. They don't know where to look and the most important part where you're going to see, well, I'm about to teach you in the next couple of slides. Why did it keep going up? Who ran it up? And how could you have shadowed those traders that ran that stock up? Because if you looked at Intel, Microsoft, Tesla, NVIDIA, you can go down that list. There was no stock that would have gave you less risk with more reward than AVGR, okay? So let's start with a couple of other stocks that we found, all right? So let me show you where we actually find them. There's no big secret, okay? I don't have a crystal ball. I'm not here to sell anybody my newsletter and everything else, which by the way is illegal unless you registered. Finding them is just going through the big percentage gainers and losers. That's it, that's all it is. Now what we do and what I'm gonna invite all of you to see in my trading room is we're gonna show you how we go through this list and find the ones that will give you the least amount of risk with the high amount of reward because a lot of you are looking at this list and be like, there's a lot of stocks that are moving today. Of course there are, there are 20,000 stocks that trade in the market. But how do you find the top 10? And how do you know which one out there is gonna, it's easy to get in and out of it. That's what you're gonna learn in the next week, okay?  But unless you're gonna have a company like us, that's gonna show you how to dissect it and learn what's called the three T's, tradeable trend and trap. It's gonna be very difficult to find a stock like that. Now, next poll I wanna do, okay? How do we, why and how and why do these stocks go up? Is it the news? Is the company fundamentals? Is it the buying and selling or is it supports and resistance levels? So let's see how old you guys answered this question. Peter, you got the answer correct. John, you got it wrong. Michael, you got it right. Steve, you just gotta put A, B, C or D. You're right, Steve. Jean, you're right. Robert, you're right. Come on traders, Ed, Ed Sol, I didn't hear from you. Eric, Frank, Jean, listen, let me tell you a little bit about and don't take this the wrong way. When I took a job as a trader after blowing up two accounts when I got started at 22 years old, I'm actually 52 right now, my mentor told me, if you do not give me an answer, there's the door. Because we're gonna lend you money to trade and you can't answer this question. You should not be trading, okay? Now, you're not trading my money, you're trading your money. Answer the question. If you don't know it, just give me a question mark. You're better off getting it wrong here than putting up 10, 20, 50,000 in the market and not trading blind. Now, if you said the answer is C, congratulations, you are right. It's controlled by buying and selling. Now, everyone out there is like, but I thought a Fibonacci has something to do with it. Oh, I thought it was news. Oh, I thought it was Kramer on TV. Oh, I thought it was a heat map. No fellow traders, it's buying and selling. It's as black as white as you can get it when it comes to trading. Now, so how do we know where to find the buyers and sellers? That is the $64,000 question. Well, what we teach at Cybertrain University, I'm about to show you right now is how we follow the big money, okay? It is so like common sense. It literally is to just know where the buyers and sellers are. You have to understand something. You are the ants on the floor. You're trying to get these crumbs. There are people moving 50, 100,000 shares, 300,000 shares, and I'm gonna show you these orders. What makes you think you know more than them, okay? Wouldn't it be nice to see who they are? That's what I'm gonna show you. So, what we're gonna cover right now is something called level three and level four. Now, I just came back from Toronto last week. I was at the Money Show and I saw an overwhelming interest, the people that were asking the other presenters that were in these rooms, hey, what's level four? What's level three, okay? Well, I could tell you this before we get started. I am actually one of the pioneers that helped build these level threes and level four. So you're gonna hear from the horse's mouth, all right? And there's no question I cannot answer, but all I could tell you right now is this. Forget about what you know in the past because we're gonna focus on the future. And the future is where are the orders? So you know where to get in and get out before everybody else does. So let's start off with level three, okay? Level three is known as Book Viewer.  You know, I'm actually a speaker at the NASDAQ. I do presentations at the NASDAQ, I'm sorry. And NASDAQ wants you to know how to trade the exchange. That's all they want, that's all they care about because brokerage firms and exchanges know that if you can be consistently good at what you do, you're gonna trade forever. They don't wanna see you go out of business, they don't wanna see you blow up your account. So, I do presentations there, I've been doing there for several years now and at the end, I'll show you the last video that was on just last month and you'll see it. But let me explain to what we're gonna look at. Now, please, please pay attention, turn your TV off, turn the video games and watch what I'm about to show you right now because this is gonna be extremely disturbing. I don't keep saying that, but it really is because you're gonna see how the market really works. This window looks quite confusing, lot of numbers, lot of everything. But let's start very simple. There are buyers and there are sellers, buy orders and sell orders. Column one, two, three. One, two, three. The first column is telling you what price they wanna buy it and what price they wanna sell it. The second column tells you how many shares that wanna be bought at that price and how many shares that wanna be sold at that price. The third column tells you how many orders around the entire world make up those shares that wanna buy at that price. Same thing with the orders on the ask, same thing on the sell side. Those, yeah, these are orders out there that make up, how many orders will make up that 3,000 at that price? Now, the way the exchanges work is this. Okay, and it's very important. Let me just clear this out. So whoever wants to buy this stock peloton is up on top where wants to sell it for the least amount of money is right here on the first list. Depending on where you wanna buy it, let's say you wanna buy it for less money, you'll be down here at the bottom. Let's say you wanna sell your shares for more money, you're down here at the bottom. So what you're looking at is what's called a chat room, a negotiator market that's controlled by the exchange where you could see all the buyers at every single price and all the sellers at every single price and how many orders out there on each price. So you basically have a seat on the exchange. Now, let me explain to you, because I still till this day do not understand why nobody would want this data. You have a seat on the exchange, okay? I don't know if you know this, but when you watch, let's say CNBC and you watched them on the, basically they're televising on the New York Stock Exchange. If I could show you a picture in the past and the future, there's no way down there.  There's no reason for it. Everything is electronic. You have a seat on the exchange, you could see every buyer and seller. Back then when I started, I had to pay at 22 years old $1,000 for this data, okay? Today it doesn't cost a thousand, doesn't cost a hundred, cost $15 for this data. Now think about this for a second. You have a seat on the exchange to see over 50% of the volume of stock that you're in why would you not want that data? I still don't understand why nobody wanna pay for it, okay?  Let me throw my other two cents out there. If you're here to learn how to trade, I'm just warning you right now, I am warning you. There is no such thing of free lunches, okay? Data is not free. If a brokerage firm is giving you free stuff, believe me, there's a catch, okay? You don't work for free because you didn't make your money for free, all right? Even if you hit lotto, you still have to buy a ticket, all right? So please keep in mind, if you think it's something, bro, you come to me and you tell me, hey, they're giving this for free. I could tell you 10 other ways how they're making money on you, okay? Yeah, kind of right, there could be dark pools, could be tons of stuff. But let's move on, let me teach you how we're gonna use this data because then you're gonna realize how important it is. What we're looking for is iceberg orders. These are big block orders. There's a lot of orders on the buy side, there's a lot of orders on the sell side, so we need to see what's on the bottom. We need to see where's the big, big order out there because you know what, you saw, you heard, some of you are familiar with what happened to the movie, The Titanic, that big, beautiful ship. All those wonderful people died. Who thought that the Titanic was unsinkable? Well, you know what? That's what happens when you think you're unsinkable and you come up to an iceberg. So we need to find what's called those iceberg orders. So let's look at an example over here. We're looking at a chart, we're looking at CHPT, which is irrelevant. Stocks start in pre-market, starts going down, goes down, down, down, down. All of a sudden, for some reason at $5, it decided to go up. Why did it go up at five? Why did it go up at 550? Why did it drop down to four? Well, when you look over here in the left-hand side, you'll notice that there must have been buyers out there. And when you work your way down, you'll notice right around this $5 is a 55,000 share buyer out there. Now, I don't know about you fellow traders, but when you have 300 share buyers, 400 share buyers, 1,000 shares, and you're talking 55,000, 19 different orders, kind of makes sense because buyers equal support. And where all of you do things where most traders do things backwards, is they're looking for supports in the past. But how is that past indicative of the future? Because if those same buyers are not in the past and not in the future, it doesn't exist. That's why most people read things backwards, and that's why you gotta follow the orders. And that's what you get on the NASDAQ Book Viewer. Let's look at a resistance levels. Here you have a stock, 470 goes up to 530, hits 530 and comes back down to 480. Why at one o'clock did it hit a resistance levels and go back down? It's not the time, it's not the indicator, it's not the news. It's because right here on the sell side, you had a 52,000 share seller out there. That's the only reason why.  Now you get to see the order and that kind of makes sense because think about it. If you had the stock at 1230, you had a stock at $4.80, what is your goal? Take a profit, 480 minus 530 is 50 cents, 50 cents on a thousand shares in a matter of 30 minutes is $500. You do that every day, that is a $100,000 salary. Who doesn't want that job? And you know what?  How many times has that happened to all of you? And the reason why is because did you see the orders, those iceberg orders in the future? Let's go over a few trades that we did this week, okay? Let's talk about Tesla. Let's talk about a brand name stock, right? So Tesla is trending down.  What's the game plan, right? So let me ask everyone this, if you own the stock, right, Tesla, what are we looking for? What is going to make the stock go up? So I'm gonna ask all of you a question. Mike, I didn't hear from you. What, Mike, what do you think? Elaine, what do you think? We need buyers, right? Michael, okay, thank you very much. Not sellers, you need buyers. For the stock to go up, Michael, you need buyers. You need purchases. Okay, Frank, I never heard that before. David, you're right. Shirley, you're right. Okay, we need buyers. Now, everyone loves the chart, okay? Do you see buyers on a chart? Do you see buyers on this chart anywhere?  You know, when I first started, we never had charts. Actually, they didn't even exist back then, okay? We had to work just strictly up to data. We had to use our mind and a pen and paper to write down and make our own little charts. Actually, all we have to do is write down the number. So there's no buyers out here. So what do we have to do? We're gonna go check out the exchange. Now, for me to look for buyers, I gotta be on the buy column, okay? So here's the buy column. Now, what I'm looking for is a lot of shares, okay? And I'm looking down here for shares and I notice like, when we get down here between these shares and orders, I see that I found 262,000 shares and I'm looking at you bought 20,000 shares and that's a lot of money for a $270 stop. By the way, anybody here buying 20,000 shares of Tesla? Anybody here doing it? I'm just out of curiosity. I'm asking, nobody here buying 20,000? Okay, I wish, Erica, saying, okay, but wouldn't it be nice to know if we knew there was a big buyer out there looking to buy that amount of shares? Well, guess what? The date is available for you. So now let me just clear this out. Let me change the slide here. That's the big buyer and that's what we gotta be focused on, okay? Now, let's bring in the chart. What happened right around 1210 when it came up to that big buyer? Hit that big buyer at 270, went right up within a matter of an hour, nice little $3 move. What's wrong with that? How did it know to go from point A to point B? Very simple, buyers, sellers. Now, my question to all of you is this, did I lose anybody yet? Henry has a good question. He goes, what if they cancel in order?  Are you allowed to cancel in order? Did you cancel in order, Henry, to do a trade? If you put a trade out there, could you change your mind and cancel it? Of course you could, okay? But just remember one thing, Henry, right here, there are 262 people out there that are in cahoots with each other. Did they all in cahoots with each other? Okay, all right, so at the end of the day, yeah, someone could cancel it, but there's 262 people out there that are doing it, all right? Now, let's move on, let's look at another example. Why is IONQ going up? It's very simple, all right? Gotta be buying going on. Now, you're looking at a stock, it's going higher, right? What is your game plan, fellow traders? Let me see how everyone answers this question.  Stock's going up, wait, wrong answer. Wrong answer, wait for what, Sherry? That's okay, and you know what? I give you a lot of respect because at least you're the first one to say something and you're out there because, you know, if you're without your answer and someone doesn't tell you what you did right and wrong is what we focus on, that's where it is. Certain percentage dependent on my investment, role that's a beta answer.  Depending on your, what 2%, 10%, I mean, that doesn't make any sense. That is the role, I don't know who trained you, but that's not the way you're supposed to trade. You own a stock, okay? It's going up. What do you look for? Mike, you're right. Bill, you're right. You gotta look where the sellers are. You gotta know where the sellers are. Listen, your goal is to take a profit. Isn't anyone's goal, take profits, right? You need to, and to take a profit successfully, you need to know where the sellers are because if they're taking a profit, you're the aunt on the floor. Remember, you follow in the crumbs without those big grown-ups dropping the food on the floor, you're not gonna eat, okay? Stop trying to help your own food. Very simple, follow the big boys. So let's go out there and see what's going on here. Back on NASDAQ, can anyone here tell me where you see the big orders? Where are people looking to get out of the stock, okay? Michael, you're right. Eric, you're right. Raul, do you see where you're at right now? If you put your 10%, 15% into this, okay? And this number is maybe 7%, you got a little problem because the right answer is right there, is 1845. So I don't know what percent you're looking at, but that's really the correct number. And by knowing that resistance level is there, you slip in the chart, you're looking at the thing going higher, but at the end of the day, if you didn't have a game plan and got out where they got out, now you convert a winner into a loser. Follow what I'm saying, you need new glasses. Well, maybe you just need someone to teach you how to do it the right way, you know? Listen, I've been doing this 30 years and there's nothing that bothers me. Anything more is seeing people lose money. I really, really do. I just, like I would say, I spent most of my time and my instructors here at Cybertrain University spend more time not teaching people how to make money, but teaching people how to stop losing it like examples like this. That's, you know, because there's no reason for it. You know, listen, I'm a good trader, but I'm a better teacher. And think about how many of you are here not knowing that this date even existed. Now, where can I get now? Some of you are asking me this and I'm gonna put the question here. How can I get book viewer? Like how can I find, how can I get the NASDAQ? Now remember, this is not my data. I don't sell it. I don't own it. I don't make any money on it. I'm doing it from the sincerity of my heart. If you really wanna know how to have a seat on the NASDAQ market, there's my email right back to me because if you write back to me, I'll give you the answer. Okay? So I know exactly who's serious and who's not serious. Listen, we got over a hundred people in here. I don't know who you are, where you came from.  All right? So I'll put my email in here. F-A-U-S-T-O, it's my first name. P, last initial at CTU-Corp.com. All right? So everybody has that, let's move on. So you can sub, write that down. You can always email me now, you can email me later. Okay. Now, there's level four, Falstow. Yeah, yeah, there's even something a little bit higher than that, okay? Now, level four has more of a heat map. So I know everybody likes charts, when I throw this into a chart because there is a program out that it doesn't. Now what you're gonna see right here is we're gonna look at examples of how a heat map actually works. And right now we're looking at Tesla, okay? And if you look here on the left-hand side, you'll see that you're seeing some data coming across and you'll notice that you have these little red lines. Those red lines are big block orders. That red line is a buyer that wants to buy 98,000 shares at Tesla. And if you're watching as the stock is trading, what is the stock doing everyone? It's going up. Why would Tesla go up from a price right here of 270 to 270, 270 150 to 272 and watch how it goes up. Once those buyers showed up, the stock goes higher. So over here on the right-hand side, where you see what COB, that stands for current order book, you're seeing something more of the NASDAQ book viewer. But imagine now you could see how long he's been out there and if he's updating his quote. Now let's look at the opposite. IOVI doesn't matter the symbol, but look right here. We got a 51,000 share seller out there. Look what happens when the stock goes up to that resistance levels of 596. It hits it, it hits it, it hits it. And what ends up happening, stocks starting to go down. See that? Why is that stock driving down because of the resistance levels of that seller out there? The goal is when you trade in today's markets, when you wanna have a game plan and you wanna know what makes these stocks go up and go down and if you wanna know if the person's getting executed, if you wanna know if it's a fake order or anything else, well, this is the examples of what you're gonna see. You need to know who's out there, how long he's been out there, and if he's getting executed. And like one of you mentioned is he canceling it. That's what trading is all about. Let's bring up another stock like ABGR because I know that movement might throw you off, but you know what, when I showed you guys this little simple screenshot, this might make work. ABGR, here's a stock that went from $10 up to 12 and then came back to 10. Why did it do that? Very simple. At nine o'clock this morning, the stock was trading at 10 to $10. It goes up, up, up, up, and then all of a sudden you'll notice this big red line up there. When you get close to the $12, you had a 100,000 share seller out there, okay? How many of you here are putting 100,000 share orders? I almost guarantee no one here is buying $12 stock for 100,000, okay? If I know you wish you would be able to see it, you could.  If you own that stock at 1140, your game plan is to get out of 12. And guess what? It goes to 12 and what happens after 12? Boom, it comes right back down to 1080.  Now, a question to everyone here. Anyone ever had that problem? You have to buy a stock.  His Steve's like, oh yeah, happens old. Sadly, yes, Frank. Okay, surely, yes. Okay, well, let me just tell you the fact. If you feel that way, you know, you shouldn't. The problem is nobody's watching you. You're just not watching them. If you saw that order, you wouldn't have bought the stock at 12. And if you saw that order and you owned it, you should have sold it before 12. But you're looking at the past.  Look, let's talk about another stock, AMC, okay? AMC had a really good move, went from like the 740 all the way up to 830, okay? Now, it's on a steady downtrend now. Now, when you look over here, as you look at an AMC, all of a sudden, the stock comes to a big buyer, he just shows up at 1130 for 108,000 shares. 109, whatever it is. What do you think's gonna happen when you have a big buyer out there? What do you think's gonna happen?  It's gonna spike surely. Listen, if you haven't learned anything yet, focus and watch carefully. How do stocks go up and go down? Buyers and sellers. A buyer just decided to buy 100,000 shares of AMC. Look what ended up happening. Comes down to him, hits him, never broke it. What ended up happening? Tested it, tested it, consolidated, boom, we're from 740, now it's at 770, an hour later. Now I don't know about you, but regardless of how much money, whatever it is, when he showed up, when he showed up, it never went lower. It didn't go back to the $7, it didn't go to 725, it didn't go down to one of you mentioned, oh, my account at 5% or 10%, that's where I know.  This is the person you gotta watch, this is the street. This is Wall Street, not Main Street. And that's what trading's all about. And if you didn't know that, guess what? You could have covered your short or you could be making money on the long. And not only that, but it went even higher than that. It shot up all the way to 830.  I'm gonna repeat this several times until it sinks in. How much smarter and better trading decisions would you have made in a stock that you're in if you could see those 100,000 share buyers and sellers? Okay? Because how many shares you're really trading, ladies and gentlemen, a couple of hundred, maybe 1,000, unless you're trading penny stocks, how many shares would you buy at this stock right here? Okay? I know it's not gonna be a hundred, I know you're not putting a million dollars into an idea. Okay? But somebody is. So you gotta go out there and do it. Now, let's go check out the live market. I wanna have some fun here. Okay? So let's put it to the test now, still, right? I mean, listen, anyone can make some pretty powerful power points. Let's go to the exchange. Let's go have some fun. Anyone here have any stocks? Let's look at some stocks out here. Give me a stock, anything. Anything anyone's looking at. And what I'm gonna do is I wanna test some of you. I'm gonna test your knowledge. AAL, American Airlines. Okay, that stock's been taking a huge hit. Marvel, Neo, okay. I need to find, I'm gonna find something that, we'll look at American Airlines. We'll look at American Airlines. AAL. Hey, let me look at what's going on American Airlines. So, let's look at this example right here. Okay, so let's look at the chart. This one is probably a good example. Okay, can anybody tell me where we support on American Airlines? Where was, where's support on American Airlines? Around 1250, 1380. Okay, I'm gonna draw some, I'm gonna draw some trend lines here. So some of you said, what, 1250 you said? No, it can't be 1250. It's not even there. You got a different number. Like 1280 you said. Okay, right there. All right, anybody else? Some of you are saying right here. Okay, right here at 1290. Okay, great. All right. Now, okay, I, reasonable enough. Okay, now the next question I have to ask you is where was, where's resistance? What's, where's resistance on American Airlines? Where's resistance? Okay, Carlos, Raul, all that. Okay, you guys are saying right around here. Okay. So at 945, the stock goes from this 1290-ish, goes all the way up, hits 1223, comes back down, all right? At this 1370, some of you said bounce right there and then finally went back up and now it's hovering at this resistance. Now, here's the question that hopefully I wanna see for the little, little 30 minutes of education that I gave you. Let's see if you all can answer this question properly. Why did the stock bounce at 1290 and why is it having a tough time getting past 1225? How about this? Anybody have used an RSI? How about a Bolager Band, a MACD? I don't know, what else do we got up here that looks pretty sexy? Another popular one, a pivot point. I don't know, I heard about those are pretty cool. Moving average, let's see if you can figure this out. Maybe this might help. Can anybody tell me, for all these indicators that you're out there, because I know a lot of you do use them, does that help answer the reason why? 200 moving average, okay. You do tell me. You know what I see?   I'd be honest with you. Seriously. But it looks pretty, it makes you look smart. I mean, I love putting it up there. It looks great when I use charts. How about this? Let's look at level four. Where did we say support levels and resistance levels were? So you all set it right here. Here is that big resistance, see that little line? There was that resistance because this big seller showed up and you could see he added to it. And right here where you saw support levels, right here, look at all these buyers out here, 56,000, 70,000, 50,000. So when that stock came here, look at this big seller right here, okay. The reason why it didn't go past this 1290 is because his buyer showed up. The reason why I didn't wanna go past the 1350 is because these sellers showed up. So let me ask everybody a dumb question and why I expect every single one of you to watch and join my trading room when I'm done right now. What's easy to read? The buyers and sellers or the indicators? Michael, I look forward to seeing you in the room. Steve, Eric, I look forward to seeing you in the room.  It's like exactly Carlos, like a no-brainer, right? Now, let's be honest, because nobody can read anybody's chat. How many of you here are using this data right now? How many of you here are using level three and level four in trading in the stocks that you're in? No matter if it's swing trading, option to trade or anything. Shelley said, because I have no access to it. Not me, Frank. Ari says no, Pete says no. Think about smarter and better trading decisions you would make if you were able to see this. Now listen, we're running out of time. Sorry I was going over, but let me get right to the point now because I'm glad that everyone here is following along. So I expect every one of you to join and come and watch me live for one whole week, one week online in my professional trading room, the original one. So listen, here you have an example of people cheering in the background, look at what they have screens. They're looking at orders. Look at me. This sets me at the Schwab booth. Charles Schwab even wants you to learn they hired me as a speaker to kind of teach you this because thinkorswim has, I mean, the list goes on and on and on. NASDAQ, MetaStock, TastyWorks, TradeStation. I could almost guarantee you that no one here, no matter who train you, has the reputation of being endorsed by more brokerage firms or exchanges than anyone in the industry, okay? And not only that, I could almost guarantee you another thing. You probably will never find anybody that has a Google rating as high as ours, okay?  But that is the reputation you get with Cybertrain University, okay? You wanna learn how to trade properly. You wanna learn how to play the game. You wanna learn how to stop losing money. This is what you have to do. Now, how can we learn more?  And in this trading room, all it's gonna cost you is $9. That's it. Just take your phone. Everybody got their phone? Where's my phone? Everybody have the phone right here? Take your phone, turn on the camera and scan that QR code. Let me see if it works for me. Yeah, it works for me. And it should bring it to a registration page or you could just click that link that we posted in the chat room, okay? Now, let me explain to what you're gonna get, okay? You're gonna get live audio commentary, all right?   This is all live, okay? This is all for, you know, you're getting in this package. You're getting hundreds of hours of recordings of workshops and classes that we offer.  It's, you know, it was published by Wiley. You're gonna get the opportunity. You can go to Amazon, you can pay $47 or you can get it for free. And you're gonna see live audio commentary from all our instructors, our education advisors were on there all day. And, you know, even right now we're there, you can register right now, you can listen, trade the clothes, wherever it is, all included from nine a.m. to four o'clock.  You're gonna meet all these great traders. You're gonna see how we make full outs. You're gonna see how we work together like a team. We're like one big happy family. And what I'm looking to do is I'm looking to recruit more traders just like you to come in there. Yes, and it is money-back guarantee. Absolutely. Listen, after the week, you feel I've wasted your time. I'll give you $9 back. Listen, I don't need your $9. I need traders that can help and work together like a team, we can trade together. That's what I'm looking for. The $9 is really an application fee to be part of the team, okay? But hundreds of hours of workshops, you're gonna be getting the book, how to beat Mark and make us an own game. You're gonna get all this stuff. And you know what? Basically, oh, this is basically a Monday, Tuesday, Wednesday and Thursday and Friday, a whole agenda of what you're gonna be learning in the classes for the week. This is all for nine bucks, it's like for nothing. It's a steal, okay? Now, I wanna take some questions and the questions that I got that will come in and cross is very popular questions. And first thing is people ask me, how much money do I need to start? You don't have much money you need to start? $9, that's it. I think what I did today as I told you more than what $9 is worth, okay? So we don't want you, you don't need a brokerage account, you don't need anything else. All you need is $9 and that's all you need to get started. Do you need a brokerage account to get started for this program? No, we do not want you to trade, we just want you to watch. Listen, a lot of people out there think, like, can I trade with you? Listen, you can't take a job without doing an interview first. You know what I'm saying? You might not be for you. How many of you guys went to college?  Next thing you find out, you know what, it really wasn't school for me. You did something else. And the only reason why you know that is because you did your homework. Don't worry about trading, don't worry about a brokerage account. Don't worry about getting level two, level three. You don't need it for the class. All you need is $9, get into the room and watch and meet people like you that are trading and see if they make money how to do it. Now, does your room also cover options? I know people are asking me, yes, we do. We do options trading. We do swing trading. You know, you can use this towards that type of data. All you have to do is take your phone and scan it and get into the room. Another question people ask me is this is gonna be a scam that I'm gonna be charged like $200 after the week? That's a great question. And I love hearing those. We don't do that.  Those people are desperate. I don't need your $200, $300. I'm looking for traders I can make six figures with. But if you can't afford nine, then you can't afford to be part of the team. I don't need you, you know, listen, there's not gonna be any charges after that. Absolutely not, okay? Absolutely not. This is it. And after nine days, I'll be happy to give you $9 back, all right? It actually cost me more money for me to talk to my staff than the money I make that I charge you. But I'm willing to make that investment. And you know what? I'm gonna throw a big bonus in there. How about this? I'm gonna throw a big bonus in there. You register right now. I'll give you everybody the first 20 people that register. I'll even speak to you on the phone, okay? How many of you here watch these gurus on YouTube? Have you wanted to wish you could talk to them, call them out and ask them some questions? You know what? They're not gonna answer your phone. They don't interest in you. You know what they're interested in? They're interested in charging you tens of thousands of dollars in training and help them build up that YouTube channel or their Instagram or their TikTok. Listen, I'm a Wall Street trader. I was a market maker. I live here in New York. I was surrounded by the best traders. I worked for some of the most prestigious day training firms in the industry, okay? Nothing has changed 30 years ago other than you're gonna be licensed, ticket charges are free, technology got a hell of a lot cheaper. I used to pay $1,000 for a month for that in level two, that level three, now you get it for $15. But let me show you for nine and we'll go from there. Couple of questions. How much money we need to get started? Frank, Frank, like I told you, forget about the thousand, the 10,000, the 100,000, okay? Let's start off with $9 first. All right, let's just start off with that, Frank. Okay, when could you start Conrad? Listen, the way things work is this. Have you registered yet Conrad? Because the way it works is this. When you apply, we're gonna do a Q&A and we're gonna ask you five questions. We wanna get to know a little bit about you.  He's gonna take the time to walk you through the registration process. He's gonna take the time to kind of walk you through what's going on in the market, what we're looking at, more or less to make you feel comfortable. And then you'll, and when you wanna start. So if you wanna start tomorrow, you start tomorrow. I mean, it's fresh in your mind. You wanna start on Monday, start on Monday. One person says, I'm going away. Can I use it two weeks from now? Absolutely. Lock yourself in for the $9 now and we'll go from there. All right, now let me just look at a couple of things right here. I'm gonna do a couple of shout outs. First of all, Francesco E. from Texas. I got your registration, welcome aboard. Conrad, oh, that's you. You're from Florida. Kiss me, got your registration, welcome aboard. Ed Sutton got your registration from New York Woodside. Oh, you write the block for me. I'm right here in Manhasset. So good to see you. Lucy got your registration from Chicago. Bill from California. I see people still registering right now. Listen, fellow traders, it's $9. What are you afraid of? Think about this. How much better of a trader I made you today to make you realize that you've been trading blind? Now you have the opportunity to come into the trading room and see this and say, you know what? Let me see if that was for real. Let me see, this really makes sense. What I got to lose, okay? You got nothing to lose but wasting our time, all right? So, but I'm not worried about wasting my time because some of my best traders, this is how we kind of find them. But I'm looking for serious traders and serious traders only. So if you're trading stocks, you're trading options, you're doing swing trading, you're trading a market that's not working out for you. Listen, if you're not making the high five, six figures, it's time to do a change. I mean, it comes down to that, all right? A couple of people also, James Hedrick got your registration, Ventura, California. I was actually there. I used to actually teach a class down there in California in your area, really nice, right by the beach. Big financial area too. So nice, I love that area. We also got here, Banu from Austin, Texas. Hope I didn't mangling your name, I'm sorry if I did, but it's got your registration just came in. Thank you very much. Guys, don't forget, when you get to the third page, you're gonna book your appointment with your education advisor. We take a lot of time. You're gonna see we're very big when it comes to customer service. So you're gonna get a walkthrough. We're gonna show you, make sure you watch videos to watch. Very fast videos. You'll get into the trading room. You're gonna know exactly what to look at.  I know there are people all over from different parts of the world. You could be there the first hour or the last hour. I don't know if anybody ever got my mouse pad, but like, listen, there's always certain hours where people trade. All my students do get this, all right? Couple of the shout outs right here. Joe, Joe R from Arizona, got your registration. Almost, we're almost at the 20. Oh my God. Come on, there's almost a hundred of you. You guys better hurry and register pretty quick. Listen, I can't talk to everybody. It's a lot of work, but rather, listen, if you can't talk to me personally, you'll still be able to talk to one of my instructors. I can promise you that. Roy, Roy C from North Carolina, got your registration. Welcome aboard. Hank H, where are you from? Florida? Okay, yeah, I got your registration. There you go. From Florida, I got your registration. What is that? Amrad Beach, okay. Where is that? Is that East Coast or West Coast? Love going to Florida. I'll be joining you soon, by the way, all right? Are these indices available for book order, book order three or four? Well, David, I didn't know if I saw you register yet, David, but when you register, we have these little very detailed, fast little videos. We're not gonna bombard you with these 800 hours of videos, but that's gonna show you exactly how those orders work and how to get them. I told you that if you did register, you could always send me an email and I'll tell you where to get them, but I rather you pay the $9 versus the 15. Let me show you how it works first and then you'll understand a little bit more how to use them because there's certain defaults you gotta set because sometimes they put like seven different columns and you really only three. There's certain filters I put in there, so I really want you guys to kind of know how to use that first before you make that investment. Hervin, sing from, I don't even know where you from, sorry, for what country code that is. Is that China? Guanjin somewhere? Sorry about that. But great, I listen, we have a lot of people from out of the country now around the world that register.  It's great. South Africa. Okay, there you go. We actually had somebody fly in here like three, four years ago from South Africa that came to our onsite. So yeah, I love the South African people, they agree. The English actually kind of helps. By the way, another thing I have to apologize, I am from New York, I do talk a little fast, I will slow down when I teach my classes. We're just running out of time, I have to go and I wanna make sure that I get every single one of you in there registered, okay? Just got somebody else that just came in right now, Rosemary M from Gainesville, Florida, just got your registration. Welcome aboard. All right, so this is what I'm gonna do. I'm going to, there's the link, that's everything you're gonna get. You could click on the link or you could scan it on your phone, all right? And what I'm gonna do right now is I'm gonna play a video. Oops, let me just pause this. I'm gonna play a video really quick because I gotta get ready for my trading room. Watch the video. This is a video of me on NASDAQ talking about NASDAQ Book Viewer. So as you're watching the video, sit and enjoy it. It's about, a little less than about five, six minutes. And for the ones that haven't registered, hopefully this will help convert you too. But in the meantime, I look forward seeing every one of you in my trading room. If it's not, when we're done now, maybe tomorrow, Monday, just make sure you book your appointment, make sure you watch those videos so you know exactly what we're doing in the live markets, try to be there in the morning when the most volatile time and try to be there at any afternoon when it's closed. Listen, you don't gotta be there all day but definitely be there at the most volatile times. Thanks for watching. Enjoy the video. And I look forward to seeing you all in the trading room. Have a great day, everybody. Thanks, Judy. On Times Square in New York City, we have FASTA Publicity President of Cyber Trading University to discuss using NASDAQ Book Viewer to trade market trends. And it's so interesting that FASTA were almost sector agnostic. It applies for all different types of companies. All different ones, Jill. And it being Ernie's week has been just so much been going on with the market.


Hello, welcome to my talk rolling your own security team for fun and no profit at all We will come to that later while we are focusing on fun. It will be clear at the end So let's quickly go through the agenda First I gonna talk a little bit about what we actually do as in the Arch Linux security team Then we will a little bit look into how we got there and take a small Look into our security tracker, which is our central platform and then discuss the core of this talk basically what we have learned in our journey so far and Finish everything with a small Q&A session. So a little bit about myself I'm Leventa Poyak and I'm a full-stack software and security engineer and also love DevOps duties I joined Arch Linux in 2014 And I'm active in a security team packaging Development and also DevOps. I've been elected as the Arch Linux project leader in 2020 So let's talk about what we actually do in a security team So basically our main goal or our primary value is keeping the arch users safe this is what everything is basically about and If we think about what that means the the main Interaction from a user point of view with our distro is Software installing packages because that's where the software comes from And you're doing that by pulling the packages from our repositories. So Basically Yeah, we were responsible to ensure safety for all users by taking care of the safety of our packages What we on top do is? We also consult infrastructure design choices nowadays and also review some configuration related to it So this is because we also run different services like the a you are and other things and also own machines that we use in the whole distro process and Releases so it's also equally important to focus on our infrastructure ourselves and On top we also coordinate information What that means is basically from a user perspective You see advisories being issued from our side Which basically warns users that there has been Certain update released that fixes shot some security related shortcomings So we also warn about the impact of such Problems so users are aware and can prioritize updates for example, but also We coordinate embargoed issues Barcode issues just to summarize it shortly if you're not familiar with it It's basically coordinated disclosure where you have Upfront information about the security vulnerabilities that is not yet public. It's just shared Across various entities that can prepare updates review The problem or the fixes that are related to the security issue and also have a fixed date where This information gets public so for example every distro can In a timely manner release updates at the same time So we also coordinate that with our with our package maintainers Yeah So We now know what we basically do today, but There is a lot of evolution that's led us Yeah to get there where we are today So let's have a quick look into the timeline and basically how we got here and yep It was a bit before 2014, but I think January 2014 is a good date to pinpoint Some community efforts that were that existed back then Basically community members Filed bug reports and issues about CVs Which means CVs are an Identifier for a specific security vulnerability. So it a certain issue can be referenced in a Uniform way and easily recognizable with an ID and yeah here So the community filed bug reports and patches, but there was nothing really structured We're still very thankful Even up until today that our community still helps us and files bug reports. So thanks a lot there But there was some kind of demand for something established something structural something persistent so this led to In March 2014 that Ellen basically made a call for action to fund or to fund such a security team and Yeah, have have really something established inside our distro that is Dedicated to be responsible for this kind of things It Yeah, the main focus that Ellen wanted to see here was our packages. So this is also as I explained earlier basically the main interaction point from a user perspective and This was what Ellen really was looking for it took until September 2014 until Me and Remy basically founded the security team. It was day zero kind of we came up with with well-defined workflows and structures and also templates for Advisories and really wanted to send out advisories to users things like that did not exist before and This was basically the day zero where where this team has been founded It took over two years to Finally come up with our own platform to coordinate all the work so in around December 2016 it was quite specifically December 2016 I still remember it because I made the big release during the CCC Which is an annual conference at the end of the year And it helped us streamline all our work So I will come to that Shortly and it also show a little bit how it looks like how we interact with this central platform to coordinate To coordinate everything which is package related So and this September we had our sixth birthday, which I'm really proud of This was a long journey so far and we evolved quite a lot And I'm especially proud of it because even through Ellen back then made the call for action to Have such a security team once we stepped ahead and said yeah now is the time we Are really eager to see this happen and we want to invest time and We are very passionate about it. It was kind of skeptical and said like in six months we will be gone And turns out we are still here and yeah, we've come to stay so that's a good thing um All our efforts also led to a lot of visibility and fixes and Improvements in our distro. So these numbers are just from our security tracker Basically, it is a bit higher because I I did not count everything That we released and issued before our central platform went live But so far we have issued over 880 advisories and We have released Over 1100 Packages with fixes that we tracked that had security vulnerabilities or Well after this release they hopefully didn't have those anymore The discrepancy is here a little bit because Sometimes we decide to not issue advisories.  So we only have one version and we expect users to kind of update in a timely manner um, which which means if we If we want to track all Fixes for every software that affects our packages and we do so hopefully But sometimes It takes a while or some some issues were discovered or at least the made public um Very far in the future after a release So for example if an issue was fixed for six months or something like that And we then track and add the information to our platform We basically assume that users should have updated within six months So we don't issue advisories if the severity of an issue is Yeah, also not too critical that we say we still want to warn users after such a long period of time So this is why this difference in the numbers exist um now let's look a little bit about how our security tracker works and You can reach it at security dot arch Linux dot org It it it helps us keep track of all the information Of all the issues and information related to CVs and Certain open source software We also use it to track Yeah related things like links change logs also commits because We always try to find commits so we can easily verify certain fixes and if they Those fixes really made it into a release Our platform also has a central to-do list. So we we um Have a much more streamlined and easier way to find What we need to do right now what kind of packages got updates released and things like that Before our platform before our central security tracker We needed to do all this manually, which was a lot of pain Yeah A lot of pain So we are very lucky that we now have a very well established central platform. Um, I will show shortly show some Some examples, uh, how it how it looks like also describe a little bit What what we did before we had this platform? um It also has or it also provides an api for external consumption Which means just an example the data could be pulled out of our tracker to create tools like giving users the ability to correlate the data on our tracker with their local systems, which basically Makes it able To warn users that Or make users aware that they have some packages installed which have known vulnerabilities As well as that there are updates available that fixes certain issues Which yeah, it was not yet updated on a local machine or a user um We the world tracker is also open source open for contribution And we are also happy always happy if we can extend it further So we are inviting everyone to take a look and if something is missing on the platform We are happily accepting patches Let's look a little bit at how it looks like this is basically the index the the main page the front page when That you will see when you visit our tracker It lists all the currently open security vulnerabilities You can also go through all the fixed ones and get also more detailed information If for instance you click on one of the issues one of the cvs you get a very detailed overview Including descriptions severity and things like that. It also has cross references So it shows what kind of packages were affected by an issue or if they were some advisories already released This kind of handy actually so makes navigation and Yeah, collecting information about certain aspects very easy and convenient From our team perspective, we have a very easy to use form-based input Where we can add details to the tracker Back then this was not that easy. It was very annoying and cumbersome I will show in two slides how it looked like So This is a huge improvement. I can really assure you We also use all this information to correlate and and assemble a final advisory So it lists all the issues that affected one release summarizes everything States which version is the one you need to have installed at least installed to make To make those issues disappear and we also have a summary basically an impact All the issues what kind of impact do they have for a user? So it's easier to understand from a user perspective without reading through a wall of text sometimes What is the actual impact? Why should I update or Or can I just delay it a little bit because it does not really affect me or it is not too critical So I don't need to Run home and install updates on all my systems or something like that And back then we we also created this one manually. So This also gave us a lot of free time We also have a logs so audit logs where we can see diff base changes So it also makes the work a little bit easier because if we Want to have a discussion about something for instance if a severity got raised too high Or one of our members thinks it should really be high Because it affects I don't know for example If if it was Detected that is not alone just a local issue But it is a network facing issue then you also want to of course erase the severity And sometimes you want to have a discussion about why some data was added in a way like it was So this helps also to To initialize such a discussion and know who Entered what kind of data? Yeah, this is basically how it looks or what it looked like before we had our central platform This is a simple wiki that we used we inserted all the entries manually We keep track of updated packages manually We wrote all those advisories manually which often were not really Fault tolerant and we had formatting issues and copy paste issues and stuff like that And it also consumed a lot of time. So it was really annoying to do and As you can see this this platform really helped to streamline the whole process for us So let's a little bit talk now about What what we have actually learned in the six years? And what what we have learned by developing the tools we have today and why we did so and the stuff like that So one of the main central Core values is that optimistic optimization is crucial. It is not something optional. You you need to always optimize We'll talk about that very shortly. So let's let's quickly go through this list It is basically a high level summary of what we have learned in the six years and then we will get into detail shortly after Another very important Aspect is having motivated people. This is also something non optional You really need to assure that you have motivated people that are passionate about what they're doing um And if you are dealing with people it is equally important to always be excellent to each other We also talk about that a little bit in depth in a couple of slides But you really need a healthy environment and this is very Very important Also at You also need clear responsibilities So think about your responsibilities and Don't overextend in early stages What I mean by that we'll come to that Also in a couple of slides. So now let's let's focus on the first topic, which is optimization Often in my career And over and over again It happens that people or if you if you want to improve something and you say Look at this this you really need to improve some aspects and then you get a lot of Or a better handling of something you get more free time You you don't need to do busy work and stuff like that. What busy work means. I will explain also shortly, but They they also say they always say They're too busy to improve Which is which is the number one biggest mistake if I if I would Need to name one in my opinion and it is it is really a fundamental part of every tech process Or at least it should be a fundamental Central part of every development process At the end you need to think about it a little bit different. There's virtually never too little work Uh, especially in the enterprise environment where you're hired to do something There is really never At a period of time where you say oh now I'm bored. Now I can optimize. This is just not gonna happen You always have work. You should always do something and so If you take that into account then the only conclusion is that optimization needs to be a fundamental core value of your world development process And this is really important and if you if you look at it like that Then you will also never say that you're too busy to optimize because that's just a lie to yourself and just don't do it It's a very huge mistake So why do we want to optimize? The primary goal is that we want to fight busy work a busy work means Like work you're doing that has no value itself so basically you're just doing the work to achieve something different but To picture it a little bit, let's say we need to dig a hole and You just have a shovel and no further tools And you need to to bring or to carry the sand mile away or something so At early stages when you have no additional tools You can just use your shovel and just walk over a mile every time you dig deeper To to yeah to carry the sand over But this is as you can imagine highly inefficient you can do that at the beginning but This whole process and just walking over and and dropping a shovel full of sand Is literally busy work because it has no value You're just doing it to achieve your final task, which is having the sand somewhere else So this is busy work And if you want to optimize away this kind of busy work You would for example come up with a push cart where you could put in a lot of sand and just carry over a tons of sand In one move so you reduce the busy work without losing any core values So this is super important if you want to grow So Identify and eliminate your busy work parts But you still should always also assess your workflows There are central parts of your workflows that are that that have value itself So you don't want to automate that What I mean by that is if we take an example in in what in the work we do in the security team There are central Parts of our workflow for example the verification step that has huge Huge value that you do not want to lose By by having it fully automated What I mean by that is we have a final look over Or Let's get one step back If our platform In the to-do list of our platform There is an entry that some package got updated which should now carry the fix For a vulnerability And normally you could automate it away and automatically send for instance the advisory right away and stuff like that But then you lose this core value. I I'm about to explain this this verification step So we don't eliminate it that part. We still verify it manually that okay This is really the update There was no mistake done the commit is inside the release and things like that So this is core value So this is why you need to look at your workflows and only automate where you don't lose values We we had that several times already is that some patches that needed to be back ported were applied In Unsufficiently so basically a fully automated process wouldn't have courted and we would have warned about About having something fixed which in fact was still vulnerable So this is why why some manual steps in your workflow can be good. So don't just Blindly automate everything away This also has a little bit to do with peer reviewing critical parts We we we don't just manually verify it like person and then go But we we try to always peer review all the things at least by two persons or more This helps to catch errors that or Fail or just overlooked stuff Sometimes it happens. We are all humans errors can happen and we should think about the process where we can Reduce the amount of errors that could potentially happen and peer reviewing is a really great thing to do It also helps cross cross a knowledge share and This is also very healthy for your world process It is also very important to document everything So write everything down in a wiki in a kanban board or something like that Even if you don't have time right now to solve all the optimization steps you have come up with It is still important to document everything Process we have talked about it Optimization is a fundamental part of your workflow. So by documenting the results of your thoughts of your analyzes You already did a specific Part of this job and by documenting it you ensure that you can just pick it up and solve it later when when you have You are able to to Pick up this part of your optimization and and solve it So even if you don't have time for it right now, you should always document it. This is a good thing So This is It about optimization. We can now a little bit switch over to to the human part to to motivation Motivation is the key to success Basically for everything and also for For running a team and fresh team Motivation is one of the most important things There are different kinds of motivation That that we want to to talk about a little bit There is intrinsic motivation and there is also extrinsic motivation. What I mean by that is And and you can if you're interested in that topic, you can just look up information in the internet. There is tons of information about about motivation intrinsic motivation to summarize it roughly is If you're passionate about something if if the motivation comes from within yourself from From some some values some some some ideas you have really it boils down to having passion and and being self motivated And contrary to that extrinsic motivation is just That there are some goals you want to achieve and everything else is just Yeah, you're not passionate about the thing itself, but about the goal you want to reach For example in a corporate environment that would be getting a salary raise or having a title or something like that The problem with that is that it always needs reinforcement Shortly after you get the salary raise This isn't enough anymore and at one point you want to have Another dose of motivation and then you need another salary raise So what you really want to find is intrinsically motivated people because they're passionate about the work and they will do everything to improve it and This is Extremely healthy for a team. So it is very tough to identify intrinsically motivated people, but is a key component if you want to have a healthy and passionate team It is equally important to maintain motivation So just being motivated at the beginning is not enough. You need to maintain the motivation You need to to keep being motivated There are different ways to achieve it It is also a very personal thing because intrinsic motivation is personal But you want to give Utilities to people that they are able to maintain motivation We come to that Shortly when we talk a little bit about identifying Responsibility sense things like that But all that also boils down Or at least motivation is part of that That that you need to to make sure that you're not burning out or any single one of your team members is burning out There are different ways How you could burn out In a startup phase and this totally fine. It is also Beneficial if you want to start establishing something that you work like let's say 200 percent but this this can't be sustained for Extended period of time you will burn out. So you need to identify that in time and and and reduce the the problematic parts that would lead to burnout Just an example about myself at the early stages. I had some scripts running to identify package updates And basically I had an alarm clock or some kind of ring That would appear In the middle of the night when some new updates were released So I could wake up and just enter the data in a wiki and It was really cool. I was really passionate about doing it about Getting the information out to the users as fast as possible And it was also I believe healthy for for the startup phase, but You can imagine this is not something you want to do forever. This is not cool And you need to identify it and then just just Solve it in a different way which which yeah, which avoids people burning out. This is extremely important If we are talking about people another important topic is communication So you always want to ensure that you have a friendly and respectful environment and communication um The key here is nonviolent communication And you want to have a healthy environment that ensures it. This is also a very huge topic. You can also look at nonviolent communication um but if we want to summarize it in very small bullet points, I would say just there Everyone has basically needs and and you want to solve something and But you may have different point of views or different things you want to solve as your need The the problem is we are all humans and I believe nobody really wants to to fight over something or be disrespectful to something This is just something that happens And you need to take that into account Especially if you're dealing with text and not the voice or personal discussions, then you're also Reducing some side channels. So what I mean by that is you don't have emotional layer You you can't see the expression of the other person. You also don't have maybe the voice you can use to to To hear out that something is meant in a joking way or something like that if you have only text this this increases the likelihood for misinterpretation An easy thing is just Just look at everything that people don't want or people are not evil minded people Try to just get their points straight So you should keep that in mind and don't assume people are disrespectful or something and contrary to that if you write some text or you communicate with someone in some Different ways always try to do it in a way that assures it could not be easily misinterpreted And maintain a healthy environment. This is super important It is also important to be approachable What I mean by that is This also correlates a little bit with with ability and with being friendly and having a healthy and non-violent and communication environment um You established by that a little bit that You don't always need to run Around and see where you need to poke into I mean to some degree you want to do that, but you also want people To know that they can approach you and they can actively consult you when they have some new topics that should be discussed So be approachable. This also means have clear communication channels Like select one primary communication channel, whatever that is For us personally, it is IRC, but I'm pretty sure this wouldn't work out for other people so Just find for your environment and for your team What is an appropriate communication channel and stick to that and make it clear? How you can be reached? This is very important also to Little bit implement a security-centric mindset into different teams and that they themselves Take it a little bit more into account or at least come over to you and consult you in certain aspects It's also super important to be self aware. Um What I mean by that is and especially that applies for security, but also for everything else Um, it's totally okay to not know everything. Not everyone can know everything. This is literally impossible but the problem is if if If you don't respect your Your boundaries where knowledge about topics starts to get blurry Then this is a very destructive for security and also for general Tech-related topics or in general for everything basically um Of course, if you start pretending even through you Should be aware that this area starts to blur out at this point now Then this this this leads to two problems to to Overlooked security implications or something like that You want to be aware of it and then take the steps to either consult further Persons who may have more knowledge in a certain topic or at the very least educate yourself or further so you can make an Yeah, and an educated Response to something This is super important. So so always be self aware. It's totally okay to not know everything Um One thing you also should Think about our responsibilities. So define your core values. Uh, think Think especially at the early stages don't try to solve everything that you come up with just Think about what is the core value? What is the core problem you try to solve? Uh, with with Yeah, introducing a new team For instance, when we have uh, when we founded the security team The core value was packages. Um, and also very In a very limited way um so basically Yeah, basically just keeping track of cvs and App stream fixes and applying those. Um, but but you can extend it. We come to that very shortly Uh, but if you if you have your core values The reason for that is that you want to avoid over saturation. The problem is In the early stage, let's say when we are only two people The problem is if you want to solve everything right away and also take care of infrastructure and everything you can imagine Then you just don't have enough Time to solve all the tasks and you will miss some task or work gets delayed or updates get delayed or advisory Or issuing advisories get delayed. This is why you don't want to oversaturate yourself. Um, Think about the core values and extend them later and stick to them until You feel confident that now you can add more Areas to your responsibilities Before you're and before you're sure that you won't delay the work you're currently focusing on Um, yet just don't add more responsibilities uh It is also important to uh at a test step to to explore further areas. Um You you can do that by even either getting more team members But just throwing more people onto it is not not It is also not sustainable on a long shot.  This just don't do it Explore further areas when you get free time by optimizing or by getting One two new members into your team And always think outside the box. So look around you in for certain topics or areas what I mean by that is All Directions basically mean if we think about packages that we talked about Um, look a layer below and a layer above if Let's say if we want to look a little bit further away a layer above it then What does packages mean a package is not just or not always just an upstream source It can have additional content basically for instance a system d unit file Which describes the service and This can contain for instance Information what users should run the service or what kind of additional hardening this unit activates or configures so A layer above could be hardening those unit files don't run services as root and you don't require restrict further down capabilities and and Other hardening ways This is a layer above we want to think about a layer below A package. What does a package mean if you if we look deeper into it? For instance, it could be a binary a cc plus pass binary or something which is compiled And what does that mean if we compile code then we also have compiler flags and linker flags This this could be also a way of hardening your packages and in revisiting the new new compiler flags that you can use like Pi or other kind of things So so just always look around and think outside the box, but but not just for one area You also want to explore new areas So look at the left and right of you. What I mean by that is Go away from packages if you have enough time and think about new topics like infrastructure Is a totally new area you want to grow into and this is what we did when we gained more More yeah more free time that we could then invest in new work So always be clear and explore your responsibilities when it's appropriate Taking or speaking about responsibilities The current team. This is who is responsible for all that that I described um Are our six core members here and at that point I want to to yet to send special thanks to every single one of of our team members and I'm really proud to have such a great team and to to I'm really lucky That that we managed to have such a nice team You can really rely on every single one of the team members and everyone is really passionate about the works that are doing and Thanks again. So if you see any one of those at the conference or something like that Send some some cheers or buy them some drinks beer amata something they like So yeah, this is give something back to them. They they rock um Let's a little bit summarize what we have learned so far About everything we have talked about in in this uh slide so far so it's a summary and You you I I guess you could have you you see how Passionately I also talked about my team and how proud I am this is uh also because They're intrinsically motivated. They're really passionate about their work and this is one of the key learnings try to find intrinsically motivated people who are really passionate about their work this is a lot cooler to work with people like that and it is also a lot healthier and It makes things easier to expand further areas and to evolve into something bigger and something better So try to find cool people Another important factor is optimization optimization is not optional and don't say you don't have time for optimization Then you're doing something wrong always have time for optimization. It is super important Otherwise, you will spiral down in a tech depth State which is very tough to get out And the further down you you you go the tougher it gets to get out of it. So just Just don't just don't always optimize plan in enough optimization time into your process depending depending on areas it could a little bit differ but Be clear how much time you always invest in optimization And maintain a nonviolent communication environment Be friendly be be excellent to each other and if you see Things can easily get heated especially if you or Yeah, especially if you're dealing only with text Attack that into account and try to de-escalate things and we're all just humans and we all just Yeah We don't want to fight each other. This this is really not something we should do at all We should be friendly to each other. We should spread love and this this is also especially important for For teams for internal and external communication be super friendly Then people will also like to approach you from their own and you don't need to run Around and search where you need to get involved because People like them to talk to you and to communicate with you You always try to also de-escalate yourself and revisit a discussion I also had it several times myself that I noticed that at one point I just misunderstood something or things like that and at the end it turned out that This Shouldn't even have been felt like it needs to go in some kind of heated way Because it was just a miscommunication And and and try to to step back and look again at the information and and try to To bring it into a way which is friendly And this helps a lot Also define Responsibilities think about the core responsibilities of yours and stick to them And when you optimize your processes your toolings and you get You get a little bit of Yeah freedom to to be able to extend the responsibilities then think about or then You can't think about it earlier And document it but then only start to implement or make new responsibilities to your core values If you have really the freedom to do it appropriately what I mean by that is like I mentioned earlier Where you're sure that other work you already have as core responsibilities don't get delayed It's super important. It's better to focus on something which you do appropriately than focusing on everything you can imagine and lose this Yeah, lose the the value itself because you can't sufficiently do the work anymore because it's just too much So At that point I want to thank everyone for listening to my talk. I hope I I could get my points Over to you and if you have any questions then feel free to ask them I also invite you to to come around and Chat with our team and maybe get involved in these different aspects For distro security. We also we always very we are very welcoming for everyone in our community And at the end is every every every part of this is a community effort. So Yeah, come around and Think about how you can get involved if you wish to So if you want to contact us here are some Contact information Thanks a lot. I hope you enjoyed the talk All right, welcome to the last q&a of the day and my name is mackie lannu Or my name is marcus and I go by mackie lannu and I have no other than anthrax with me And we're to do some q&a. So let's just dive into it Um Has arch considered becoming a cve numbering authority? Uh, yes, we did. So far. We just did not Apply for it. So I hopefully we will fix that pretty soon because we sometimes have Yeah cases where we should get some cve numbers ourselves So this would aid a little bit the process of ours Right sounds great. And that that question was by fox born by the way Um, next question by tam's Um, do the arts maintainers ever manually review code Is security a factor in deciding whether to package some software? um I guess partially it's up to the maintainers but at the end There's sometimes that software which is basically un-maintained upstreams and things like that um, so we try to identify it and See if we can get rid of it Sometimes it's challenging because you also have lots of dependencies and yeah, but um We at least try to have an eye on it and get get rid of it if it's really un-maintained and has a lot of vulnerabilities All right sounds great How to close source proprietary packages in the community Repository work, for example discord Um, are there any special procedures with respect to security trust distribution for these packages? Um, I wouldn't say there is this very strict guideline about that but First it boils down to us or being allowed to Redistribute something like that. It depends a little bit also on the license of such projects And on maybe if we get an allowance to do so with which we always are very keen to ensure that this is the case On top of that when it comes to to trust and security, this is a tough question especially because I think open source is extremely important, so It's always like, uh, why is the source not open? This is not good Um But yeah, it I it boils down a little bit to if just how widespread is the software and things like that So I don't think it would make sense to just yeah package everything Yes, um And the next question is by the same guy as the last question daniel are parks Um, what does it take for a proprietary package to get included in the official ripple ripples? Well as mentioned, basically it boils down to Licensing if we are allowed to or we have an allowance to do so And yeah, just have some sanity checks on if we really want to package proprietary software And um, is it really an established software in terms of is it widespread? So this at least gives some Indications about if it's trustworthy or not Also, you can vote on your packages right to to get them accepted and stuff like that Next question by you one one zero six Is there a fixed rule when no asa is done? You mentioned six months, but that sounded a bit like an example It was quite literally an example. We we don't have very strict rules about that Mostly if if something just takes very very long time And as mentioned the severity is not too critical that we still want to make sure to warn people about it We we I guess we always have a small discussion about it like look this package is fixed for Long time. So we let's not issue an advisory or something So there's no strict rule. We basically decide case by case Yes um Next question by oak Um, what software do you use for the security tracking workflow and by workflow there? It means the security tracking and finding and patching um For tracking itself, we now have have our central platform But this right now at least just a part of the world workflow because we also need the information To be pulled out somewhere Like mist or mitra or something like that Right now, this is one case where we are right now optimizing in and having it more streamlined better integrated currently it's more like security team members are responsible to um, yeah to to Fetch themselves the information get updated about new cvs and And all the information and appended to our platform our security tracker But we have identified this this is the current pain point of our world workflow So we are right now started to basically get it addressed and have automatically pulling in data from various sources um Yeah, I think that hopefully answers the question Yes, um next question by al-qasar 79 Is it part of this? Is it part of the security team? Teams mandate to verify the security fixes or is that an individual package maintainers responsibility? Well, I pretty much hope to package maintainers themselves also validated But it also depends on what what means validating A package maintainer ensures for example some patches get applied or something, but as mentioned also on slide 14, I think We still have a verification process that we really try to ensure I mean we as a security team that we really try to assure that certain patches certain fixes Were back ported into a package because sometimes errors can happen and patches not Properly applied or something like that So we try to always have an eye on it and verify that it's indeed got fixed Sometimes there are cases when we have some Reproducers that we also throw those against a fixed version and see if we can still trigger something So yeah, we do it manually Okay, next question by Hoyt Does arch Linux have any paid staff if yes, how many and where does that money come from? No, not at all. So basically we're all volunteers Just free time for every one of us Yes, so we don't have any paid staff But yeah, our income is basically from donations So if you like our project, please donate Go get some merch So the next question by arch guests Concerning arch infrastructures mirrors archlinx.org, etc How is the security handled in their pentests? Vuln assignments um Well, there are different aspects and this is an area we are thoughtly now Or since since a little bit Already involved there and we Well, basically there's some stuff that the DevOps team itself is also doing like monitoring known issues that Are affected by packages we have installed on our own ifrah Which is by pulling out the data of our security trackers And and do timely updates on that. We also actively say like oh, we need to Update our machines because like for instance some nasty kernel issue got fixed or something else On top of that we also review Infrastructure related things But this is a little bit like Where basically the work of the DevOps team and the work of the security team is overlapping So it is also a responsibility of the DevOps team, but we of course help to To try to review configuration try to review design choices and also actively try to to find vulnerabilities in In our servers So yeah, right So the next question is from several people Diabonus Grille and others How can you get involved with in the Arch Linux security team? Uh, that's a good question. I think at the last slide of mine I've shown some channels where you can get in touch with us most notably the IRC at hashtag Arch Linux minus Security where we are basically always hanging around So the first thing that comes to mind is finding Finding CVs or known vulnerabilities that we did not track in our tracker yet also, maybe try to Review something we basically always post our advisories beforehand So this could also be something just looking over it if the data inside it is looks good if The patches we mention are the the ones that really affect this this problem And also sometimes filing bugs to our package maintainers to get some stuff sorted out So I think it's easier just dropping by in the IRC and Trying to find information that we don't already track This would be a first good first entry point Yeah, the IRC is a great starter. It is a great place to start Um, so the next question by arch conf 53 Um, can you talk a bit more about the api for the security tracker? Um, where is it? Is it publicly available or only for for the security team internally? Uh, no, it's publicly available. I guess we could optimize having a proper documentation on it because I think we know we basically lack proper api documentation But what you can do is either a pen slash jason or Dot jason to basically all the endpoints like if you open the index page or Like you open a cve entry and you just add a dot jason at the end Then you get everything in jason formatted way, which should be very easy to write tools to consume the data But this is also something we have documented in our issues We really should have proper api documentation, which we currently lack unfortunately Yes, um So the next question is from Coden alt Um, and that's basically how how you identify burnouts Uh, I guess that's a super tough question and that could be a whole talk on its own Uh, I also wouldn't say like I'm an expert in identifying burnout or something because it's also Very a very personal thing mostly it it also depends on a little bit What what what kind of work or what kind of part of a workflow Starts to frustrate a person this this this could vary a little bit. Of course, there are Things which is common like oversaturation, which I also talked about which you always want to avoid Uh, if people are highly oversaturated this will definitely lead to burnout Um, but it's very tough to identify. I mean if if people are highly oversaturated They either can recognize that themselves or sometimes people can also from the outside recognize it and try to Make people aware of that and help them in some ways um but mostly if it's not very obvious it's very personal and I think this is a point where every every single one of us need to work on that ourselves Because we burnout it's it's mostly personal things that we are annoyed about So we should ourselves somehow create awareness of what leads to burnout in our case right So the last question is from In the kit tanko, sorry if I pronounced that wrong What are typical vulnerabilities? And what are the sources and New users or everyone um, so typical Wernher abilities could be For instance, uh denial of service problems in applications which basically means If you can't crash the application or make it a misbehave or something which makes it basically unusable um This would be one example or more severe things like Remote code execution, which means if you have A service or something like that, which is network facing then sending some specially crafted content to a service can lead to basically Giving the attacker the control to execute custom code and by that they can take over the system and Yeah, exfiltrate data and stuff like that Um, these are some vulnerabilities. There is A lot of different classes of vulnerabilities Mostly I would say they affect all users if they're inside a package or something But It could also be that it only affects all users and not new users for example If a fix was applied to a package because for instance, uh Um Directory modes or Something like that then it may be is that the package when you update it It does not get the new modes applied Um So this could be one example, but that this is or this this should be a shortcoming in The package update itself. So basically it should heal itself, especially when it's um security related I Hope that kind of answers the question Yeah, so that wraps up this q&a. Uh, thank you for answering the questions Sure, very welcome